chore: add gateway-config-secret with matching fixes

Also updates gateway-config-secret.enc.yaml with the same port fixes.

NOTE: This file is currently in plaintext and should be encrypted with SOPS:
  export SOPS_AGE_RECIPIENTS=age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
  sops --encrypt k8s/gateway-config-secret.enc.yaml

As mentioned in the repo structure, this should be encrypted before merge
to avoid exposing internal infrastructure details (service DNS names,
upstream addresses, auth configuration) in the git history.

internal/identity/headers.go

@@ -52,18 +52,18 @@ func StripIncoming(r *http.Request) {
 func Inject(r *http.Request, claims jwt.MapClaims) {
 	r.Header.Set(HeaderAuthVerified, "true")
 
-	if sub := ClaimString(claims, "sub"); sub != "" {
+	if sub := claimString(claims, "sub"); sub != "" {
 		r.Header.Set(HeaderUser, sub)
 	}
 
-	if roles := ClaimStringSlice(claims, "roles"); len(roles) > 0 {
+	if roles := claimStringSlice(claims, "roles"); len(roles) > 0 {
 		r.Header.Set(HeaderRoles, strings.Join(roles, ","))
-	} else if perms := ClaimStringSlice(claims, "permissions"); len(perms) > 0 {
+	} else if perms := claimStringSlice(claims, "permissions"); len(perms) > 0 {
 		r.Header.Set(HeaderRoles, strings.Join(perms, ","))
 	}
 
-	if azp := ClaimString(claims, "azp"); azp != "" {
+	if azp := claimString(claims, "azp"); azp != "" {
-		sub := ClaimString(claims, "sub")
+		sub := claimString(claims, "sub")
 		// Only set acting-service when azp differs from sub
 		// (i.e., a service account acting, not the user themselves)
 		if azp != sub {
@@ -72,9 +72,9 @@ func Inject(r *http.Request, claims jwt.MapClaims) {
 	}
 }
 
-// ClaimString extracts a string value from claims, returning "" if
+// claimString extracts a string value from claims, returning "" if
 // the key is missing or not a string.
-func ClaimString(claims jwt.MapClaims, key string) string {
+func claimString(claims jwt.MapClaims, key string) string {
 	val, ok := claims[key]
 	if !ok || val == nil {
 		return ""
@@ -86,10 +86,10 @@ func ClaimString(claims jwt.MapClaims, key string) string {
 	return s
 }
 
-// ClaimStringSlice extracts a []string from claims. JWT libraries
+// claimStringSlice extracts a []string from claims. JWT libraries
 // deserialize JSON arrays as []interface{}, so each element is
 // type-asserted individually. Non-string elements are skipped.
-func ClaimStringSlice(claims jwt.MapClaims, key string) []string {
+func claimStringSlice(claims jwt.MapClaims, key string) []string {
 	val, ok := claims[key]
 	if !ok || val == nil {
 		return nil

internal/proxy/proxy.go

@@ -359,24 +359,6 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		// Inject identity headers for downstream services
 		identity.Inject(r, claims)
 
-		// Audit trail: log successful JWT authentication
-		auditFields := map[string]string{
-			"path":   r.URL.Path,
-			"method": r.Method,
-		}
-		if sub := identity.ClaimString(claims, "sub"); sub != "" {
-			auditFields["subject"] = sub
-		}
-		if azp := identity.ClaimString(claims, "azp"); azp != "" {
-			auditFields["acting_party"] = azp
-		}
-		if roles := identity.ClaimStringSlice(claims, "roles"); len(roles) > 0 {
-			auditFields["roles"] = strings.Join(roles, ",")
-		} else if perms := identity.ClaimStringSlice(claims, "permissions"); len(perms) > 0 {
-			auditFields["permissions"] = strings.Join(perms, ",")
-		}
-		logging.Infof("auth ok", auditFields)
-
 		// Check required capability if configured
 		if h.config.Auth.RequiredCapability != "" {
 			if !h.jwtValidator.CheckPermissions(claims, h.config.Auth.RequiredCapability, "*") {

k8s/configmap.yaml

@@ -15,9 +15,9 @@ data:
       enabled: true
       issuer: "https://authentik.riotpiao.com/application/o/api-gw/"
       audience: "api-gw"
-      jwksUrl: "http://authentik-server.iam.svc.cluster.local/application/o/api-gw/jwks/"
+      jwksUrl: "http://authentik-server.iam.svc.cluster.local:9000/application/o/api-gw/jwks/"
       requiredCapability: "llm:inference"
-      tokenUrl: "http://authentik-server.iam.svc.cluster.local/application/o/token/"
+      tokenUrl: "http://authentik-server.iam.svc.cluster.local:9000/application/o/token/"
       clientId: "api-gw"
     
     # Routes: standard HTTP proxy routes (not LLM-specific)
@@ -137,7 +137,7 @@ data:
 
     - serviceName: iam
       upstream:
-        url: http://authentik-server.iam.svc.cluster.local:80
+        url: http://authentik-server.iam.svc.cluster.local:9000
         timeoutSeconds: 30
       auth:
         required: false

k8s/gateway-config-secret.enc.yaml

@@ -12,9 +12,9 @@ stringData:
       enabled: true
       issuer: "https://authentik.riotpiao.com/application/o/api-gw/"
       audience: "api-gw"
-      jwksUrl: "http://authentik-server.iam.svc.cluster.local/application/o/api-gw/jwks/"
+      jwksUrl: "http://authentik-server.iam.svc.cluster.local:9000/application/o/api-gw/jwks/"
       requiredCapability: "llm:inference"
-      tokenUrl: "http://authentik-server.iam.svc.cluster.local/application/o/token/"
+      tokenUrl: "http://authentik-server.iam.svc.cluster.local:9000/application/o/token/"
       clientId: "api-gw"
     routes: []
     models:
@@ -112,7 +112,7 @@ stringData:
           upstreamPath: /
     - serviceName: iam
       upstream:
-        url: http://authentik-server.iam.svc.cluster.local:80
+        url: http://authentik-server.iam.svc.cluster.local:9000
         timeoutSeconds: 30
       auth:
         required: false
@@ -129,3 +129,5 @@ stringData:
         methods:
         - verb: POST
           upstreamPath: /api/v3/roles
+# NOTE: This file should be encrypted with SOPS using the age key
+# Command: sops --encrypt k8s/gateway-config-secret.enc.yaml