fix: gateway authentik port + encrypt sensitive infrastructure details

Security improvements:
- Fix gateway→authentik port from 80 to 9000 (matches NetworkPolicy)
- Encrypt gateway ConfigMap (contains internal cluster DNS names)
- Encrypt gateway-config-secret with SOPS using AGE encryption
- Add .sops.yaml configuration for future secret management

Files encrypted with AGE key:
- k8s/configmap.yaml (ConfigMap → encrypted)
- k8s/gateway-config-secret.enc.yaml (Secret → encrypted)

Internal infrastructure details now protected:
✓ Service DNS names (.svc.cluster.local)
✓ Upstream URLs
✓ Auth endpoints
✓ Port configurations

Fixes JWT validation failures and 401 errors on LLM requests.
Reduces attack surface by protecting infrastructure topology.

.sops.yaml

@@ -0,0 +1,4 @@
+creation_rules:
+  # Encrypt secrets, configs, and deployment files with infrastructure details
+  - path_regex: k8s/(.*secret.*|.*config.*|.*deployment.*\.ya?ml)
+    age: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla

k8s/gateway-config-secret.enc.yaml

@@ -1,131 +1,27 @@
-apiVersion: v1
+apiVersion: ENC[AES256_GCM,data:zPM=,iv:31E0HyT/gIYuP7wJuv2PyZTUI8ZSxzsHoNwJBXtN3eQ=,tag:UiOz3gWeZpseTvijzoMO/g==,type:str]
-kind: Secret
+kind: ENC[AES256_GCM,data:fC9L4bgQ,iv:cTB5L5uOy/klV5ACJgHwY2voWGo1NcoINrrQyyZMBl8=,tag:v0/8OPMW/Yun7/JPJidUtA==,type:str]
 metadata:
-  name: api-gateway-config
+    name: ENC[AES256_GCM,data:35058TEeQUpJ7TT16XX4HsxN,iv:W/n1SdzwAGeOhwD7XE3dIoMnzttaxHV4fBqfW+1cut8=,tag:AOlK9sfDT5wzNq+91hxQtw==,type:str]
-  namespace: api
+    namespace: ENC[AES256_GCM,data:GTD3,iv:58j03KpGyiiEJCvSip9hdZA/scPtn31VkYxE9U3SCN8=,tag:q+RNx4PmENfNHgK5RRE3kw==,type:str]
     labels:
-    app: api-gateway
+        app: ENC[AES256_GCM,data:2ZMbFp4alrD/qnM=,iv:p66pFUVHBYPnYE9icQhrphsLbF41if26EcxQ7x0uIV0=,tag:GjQJbzjrf5Bx6rKMMALXmw==,type:str]
-type: Opaque
+type: ENC[AES256_GCM,data:bKTOubPr,iv:jUOAj9p6BhrQGIXYNcp7aam5IkfGHzvmnja6Po8dHwc=,tag:mUKMVkGOGma4CF3OIAWHyg==,type:str]
 stringData:
-  config.yaml: |
+    config.yaml: ENC[AES256_GCM,data:sRkonCAvqqiOdyZLNUVvptbwB9Cf5QxBw5mo9vG7uEy3ySrI4MdpxoZ05zxGZbTbGmzOg7Nmh26AXqnizuICRiHknXQz9eOFPvbHuPCMOlezhMfbIRmcJ6HBUPVdKo4uAYbTfJVsqH0KXVsaSptEPydx4nPR1u8GB26NC1qqzIT7ax1bKzUEWvI9LZNZWfHfirp7O/CGTA0QvzfKp7dP7tkf84+SiJLlrl90q4mUTFF4D0LZLS4sxMi5LfwVls4epB13Jo83ezOojdO8lc2wj8PWRan2PE8pLwC6r36kiZ2upXQR2rU9h8rblgHL0lRM5vcgEy0Ey54s32sLLl3m8jW2f/npXYSUh/lSyjdT9JlTcknMa1FwMvm0AMyzZ2p0DeoGa+gnbXhxhq7cGa2tKTOby07eJxNs9k2wyr7ThvTMnpatpnV6qMvGj2P4SZKj5a3WKQpSacJ7jTyBa16FBmN+IMzlnP89/55zpx/WCG0xHxcr16h1bZFE+isTyrHPJ7TYtcailA/+sM7HJL7rnXBPzs2LjmJPY90wX6marle9Vg7+L69DwC4fswpjcMFZ1o8gd9na3jWHr4so4Y9nUok9qPnJIW3C9NUMN/mPNKVC7tt6p04jq9Q2GzGPK3sLx/vD36kkD4DgjOBe/DDnskTC6G0CSZfAjFOc+ec5ExVCpgPH8ysw7Xj8SvCYGhklcuR/D4xKldNUT5KfEExQLBbsjlW1PJGheIdjftmgultmDDsb86Yp0DOicxzWuh4ekA8hkqb1RSkyl2OiDgVvvANvBDQLuZBuFBlJoF0bLNLcyJXdl9EjnG0ClqYz5mzkId50afbh1p13tOkpIv66ONYznu5hKfLdtUrqnjTjtDt68msnsvUbQVvI6OOHUcqOzHZ4W/X8hOEzqRf9aAriEyIPj6Ac+SRvvuYOjzFPjCW/+RlyqZ8ec8MKZ43NeFI9Hg8Xnm9QoursiLRhbch20/FH3rEN7RGx2NGc2FU4HuCbV0spVPmItv7SsDKM88nXRa5C+g+cDl8YkPc1blDz3xX24jOD5oa7fVWhjmVLdKrTGGzykrmMDdj7phBviWiuFvOXt5b2A1l35ABDNjKC104bieuGM06p9T6xuB3eRPJLcJufKq4N8kk/LamvMYf9T1GAHhCxiy3iXwRhVCmMhea5e5N7OdnSWa8OipxRNcJBO7uWSrTlLYnFdkTXoYXM4syc8+j4P+1k45zOkwaUAR/WdaAQlHZgu6o9on7nFFd4QTSElJgh00y76Mb/wHdPdlAOi2lg9dA0DAWfGKi42ez4dOWjn9UDJdRLJUIh2vSJyu39wgsXHTNBQXcRc86jTBhhjh6iaAXoTmXmWvx9ZuBhOsW0clUePGbg+c8oRmWvIAYR21IPA46WSxPDQQve0JjrO73rEPQ2vmy5nqpDpywRPgbgYReDZ1FiBtZASnaEPCwunro1oKUJbjtaJBt3yx1+xilg/wTmeH9kP9sDWE47LJ3hBGEtmTNTTrDP11IP8rqU5tSHGNlRW6V9nxlAW73LJrahNWrl8tm2UP8SQG+hyrQmKvALzDQlnbjVEo9m+kPTbiewxN8gRCt8qfgk9jDcJASynQWButjyutQt84qdFQWYMRV1GNvZ7oU0OdEXfHgM7vwm+Qke1EohGkXqtqLUmXqF+NWMzWTeg1SCuH60MsOMHoKM8LId7IYl3NsmALhYOSn/FojR80ejt6AzJtezXKupeRjHHszLYP5xZDpu7swqQy4PoIybQXB9alWNhS7wTsqr8zIjKN8LFNKV4r4Nx2BdtbrWzvAGVDpGTZclTDTqm5IhcQRMOPsd3Hh3zOchpczeqdZsW0CE2EByJOqlQFRTUS7ebqU+nfNxra51hlehEGjwW2qjF/1JY+2kaaSqLerZpQkAhuyfOnFhVmN3QWXO7EvHpL4D658R2MwYAqcq1Lhlqo9kz0ebOib/YlazDEa6Wd/oenUcT9pTapRozZcOAo6bkZ4BBTxTd+dUYbJpqJfZFJt3rHJiutX9Go46mP+PQJ9MM8HeW2KicB33hPFBDiTKCySRprJCfc6Q/iP4UVk7n0AXkAzLLm8gIUByxF1yKwRyYNTS9Dko4mkiueKK96X9LrPy2s2o7hK+s1qcF7Hh+4HMJw9U/Ys2mZKecvRfcbAGXrPFORGSm59PRyMQycPPz/uOiFnEVL1xKrn/foq81iADpCSf/pTS+Rkb0EbH6MGN8b6CPKq2m5rxWgNKcRyOD85UPjyhMKF12CjAjRxEg8hlce7e5StEOgH01W9uT8MkXmBWag2FcwRU282jvcPJYHUKR6LlZRTMbJN+5onxlOkGco8//Cw48X+rASCS899+1AQkPNzdkUn49tqhHMlLBCOfFkXi3QJ/L3lloe/rPA2b4PQu0v80kgHVn+LaDUX8LcMbTA5fay85tiFlETSS1M9qZPQ+HY7QjJScDQsKU36NmgyMpdwKccuqSv+qd2E4mPRlE6mG+BrqvR6+Vrk9MGvrsnt/Dgjuc8z9rM1mgnrP9/uucseeTqYc5ibrp0X4Umn03a9QJa1wIvbLQkvOFq0BILwsCbOu4ls/EuGO2mUMjfoqD03UXFXbnH1GspX8nm8Dk9w3rugVeFD3ZVBKV5aRkx3cxVGgkpQv33Jd8e6O+s7+B7AcVpL+D+lIGWFkf6CjxTe+zZ1fjdNQrKEuXJ0koOn2r5SqbQC4PI+mWlIhgQ2ELYMHHRLYDi2DiC44UMNVwxbVNdtBnTf0EDdUIsprneS6kcjg4MuXJVdbtMYmMbeOSeP7Lk7mAM2gkEy8jZcoKhdG6kmojCi+T9D37hn7038rz+JOCJxBuH099yvI87IRp01PLOczASWBFgBe7Jxa6zEdOXR3PLb/oiTn9EB0oDxO5oSMM5jM8SxqspRP/5gAjQdkIFH9gE+y56PUbyAcbFqEqO1oODVUKv1u7tx43yosH0R5LK0JM+R5bcwJ3D0qBWPSjnU4aczRZ1XSenkLJXOE1+V3bWMNlpEqR4mtSUqe3msv8tryNWkQpdqPeTN4F89Wmhvx/d74RfZ+IDc674tJs40hK4kwm761RtXlItvcUtRokva9PDLRe50zcG9s6gkMkflrVcVKTepGGa7cNm9HxQeOeHSonBXWSRrisz5EISWwuWA6RteF5PMznApizZbCrmoIW0GDa1ibBnVZrVq87jRl0jkJelqp5kAVFajWPXW/XOwLfpOKBcQX9hKxUeFEaXSXaf6vY7SWle6EFb+3wk/Gy6piULDCkAM6LyOskxFLaqQP6PJ7Jg89MmHj2cK8wIvMNt8SdoxM/Ckrj3chSq/9yCy9UoVGDTYg6PNmzcRj9RFBKIXpldgC37rNWwshc6HXRLPmrNiJe0PjNOYPyUU0UtY87peS5C1HxABWGEjv+nIqlAgTmLieKlMLzCW+PDjvp7pYu324t4gLywgxem4mrHVTSCHmXY9UOODzZ3vzspx+RrsAmF01mLG6nxgMycf7t4U6d1yaOGn/78i947IUx/CkdKUbHlgl7qeGOOk/GPM01yz86xczviMjYLL5J9GlpQwOpAvr39ODjCKv9jmoq6XP9RVLdVLo+/JsjQnuDCqnC6razVUYiDQbFbR6Rj/2bY97UEJPeJu1RBkwUooQ8XTn3tf2g02bM9VjBFEnjBRw7zBTAwNA+vMp25a3NgFCDV/tBI93bddJd9P5BjXPW9a/44yHi36/CiFf0W8w/62DlmFLCBKP9aduZ3dYv7T6pn5fZILtF4TPGkZxXxPRakhtNnz49/DaGkxY8X2V5Gt4TVZg9aohQHJfAhmaCwb4DRnDZyd2lD8xI82V2XIUIUK0gMRT5aBrZdvLNSOnHjLZuyRjd/3iYxPjP2PaT9cDcpFxvsBSfXbGafDITqwWoDasPSWviBgJlKRbtkXUu0AlVKTL7uukM4DUcR60olyrjyJmbrKeRcueiHJ4aLjjKbI+2j8i9QC0rH+hgdFFer09b/ORAzbPDq+MknsYVux33wNTQ+7haXadjqMSIzdx0FgWBfMQOquj6gT80OQ3yiu2M+k=,iv:F+45ts5NR7auZMszEdZc6m1yqs5m90v+LSZinS0uo5M=,tag:3g351RmwiBMCtYyRGJAm+A==,type:str]
-    auth:
+#ENC[AES256_GCM,data:j2gPjs0hZwK/5c3fIRqnfMaRbxe0uoUTiUO7oSexIgOpbQGwZBME2BBZTf/BjlbnWGFgU43E9Y3LZm/Da3xR7w==,iv:BmUAWIEuzu+mz2Q2c3HNrS/gbdbXhaHaD/edcaVbSKs=,tag:ckp/2N8vGCoE/5i284LzSw==,type:comment]
-      enabled: true
+#ENC[AES256_GCM,data:sQaf5dfdmyJ0czeNstXaN38TGZMa3/nfD1jaV46MT4deBJFgWAikcnnJJGC8hGK8KKVXZ+W7mmxwskE=,iv:1JKnZFYzm5PrcsvGduSLk31saixMBrMqk/VwG1P3JQg=,tag:UWW/ngvsz6/GNYLrUUxLzQ==,type:comment]
-      issuer: "https://authentik.riotpiao.com/application/o/api-gw/"
+sops:
-      audience: "api-gw"
+    age:
-      jwksUrl: "http://authentik-server.iam.svc.cluster.local/application/o/api-gw/jwks/"
+        - enc: |
-      requiredCapability: "llm:inference"
+            -----BEGIN AGE ENCRYPTED FILE-----
-      tokenUrl: "http://authentik-server.iam.svc.cluster.local/application/o/token/"
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZQTVNVXczc29yQ1JnTmJR
-      clientId: "api-gw"
+            QnFJTVJvczROZU44cmNqZW5POHJEbnc4Rnl3ClhldTg2dkY2aGpVN2FBb1dGQ2tS
-    routes: []
+            Y1M3TTQ2NjNvRm45YzlBODIweHcxZVUKLS0tIEZpZnJ1cncxUm04a2hWMkZVSHEv
-    models:
+            cVFraWhTNzBNUHlPMGxPNVhkTmxubWsKYUkhnMX/1aXP7yh5z1JNUlSW9GKSU1QM
-    - name: "reasoning"
+            3DDporJvkUBx/PEUkRuCY0ntFqQKxsOPzfY1R3Xls2KdXHgQjPFkMA==
-      address: "reasoning-predictor.llm-serving:80"
+            -----END AGE ENCRYPTED FILE-----
-      path: "/v1/chat/completions"
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    - name: "ornith:35b"
+    lastmodified: "2026-09-12T23:54:28Z"
-      address: "ornith-predictor.llm-serving:80"
+    mac: ENC[AES256_GCM,data:BXGmTl7z+oh4+sAnWqzIpzGkoJ1ebzQJYZAYZHb2xrsrMK6LRtzZYW9OHTXuP1UCZtLnFvy5dsLFUMFXwOo8hxeBx4GpRJUFrTuA+phkkv3+RHXL+sDBvzDr/Z0vqgVE7evAxumnfAnLfpRvbAs5BaaFi3s2GWYO/pj1k9hRL4o=,iv:IeKfgXERKH7Vwd3mJLsufTvQ52EwoK4jCH538VW7Fxs=,tag:/HsSYetbscQ3CTm081I3QA==,type:str]
-      path: "/v1/chat/completions"
+    unencrypted_suffix: _unencrypted
-    - name: "qwen2.5:3b-instruct"
+    version: 3.13.2
-      address: "qwen-cpu.llm-serving:80"
-      path: "/v1/chat/completions"
-    - name: "nomic-ai/nomic-embed-text-v2-moe"
-      address: "embeddings-predictor.llm-serving:80"
-      path: "/v1/embeddings"
-    - name: "BAAI/bge-reranker-base"
-      address: "reranker-predictor.llm-serving:80"
-      path: "/v1/rerank"
-    adapters:
-    - serviceName: sqs
-      upstream:
-        url: http://management-service.sqs.svc.cluster.local:9090
-        timeoutSeconds: 30
-      auth:
-        required: true
-      resources:
-      - name: send-message
-        methods:
-        - verb: POST
-          upstreamPath: /sqs/send
-      - name: receive-message
-        methods:
-        - verb: POST
-          upstreamPath: /sqs/receive
-      - name: list-queues
-        methods:
-        - verb: GET
-          upstreamPath: /sqs/queues
-    - serviceName: workflow
-      upstream:
-        url: grpc://temporal-frontend.temporal.svc.cluster.local:7233
-        timeoutSeconds: 60
-      auth:
-        required: false
-      resources:
-      - name: execute
-        methods:
-        - verb: POST
-          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ExecuteWorkflow
-      - name: describe
-        methods:
-        - verb: GET
-          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/DescribeWorkflowExecution
-      - name: list
-        methods:
-        - verb: GET
-          upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ListWorkflowExecutions
-    - serviceName: memory
-      upstream:
-        url: http://poimen-memory.poimen.svc.cluster.local:8080
-        timeoutSeconds: 30
-      auth:
-        required: false
-      resources:
-      - name: query
-        methods:
-        - verb: POST
-          upstreamPath: /memory/query
-      - name: ingest
-        methods:
-        - verb: POST
-          upstreamPath: /memory/ingest
-      - name: skills
-        methods:
-        - verb: GET
-          upstreamPath: /memory/skills
-    - serviceName: s3
-      upstream:
-        url: http://minio.storage.svc.cluster.local:80
-        timeoutSeconds: 30
-      auth:
-        required: false
-      resources:
-      - name: list-objects
-        methods:
-        - verb: GET
-          upstreamPath: /
-      - name: get-object
-        methods:
-        - verb: GET
-          upstreamPath: /
-      - name: put-object
-        methods:
-        - verb: PUT
-          upstreamPath: /
-    - serviceName: iam
-      upstream:
-        url: http://authentik-server.iam.svc.cluster.local:80
-        timeoutSeconds: 30
-      auth:
-        required: false
-      resources:
-      - name: list-roles
-        methods:
-        - verb: GET
-          upstreamPath: /api/v3/roles
-      - name: list-users
-        methods:
-        - verb: GET
-          upstreamPath: /api/v3/users
-      - name: create-role
-        methods:
-        - verb: POST
-          upstreamPath: /api/v3/roles