Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Admin Bot
|
2d55830412 |
@@ -17,13 +17,10 @@ jobs:
|
||||
name: CI
|
||||
runs-on: golang
|
||||
steps:
|
||||
- name: Install dependencies
|
||||
- name: Install Node.js and Docker
|
||||
run: |
|
||||
apt-get update
|
||||
apt-get install -y docker.io curl nodejs
|
||||
curl -sLO "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
|
||||
chmod +x kubectl && mv kubectl /usr/local/bin/
|
||||
kubectl version --client
|
||||
apt-get install -y nodejs docker.io
|
||||
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
@@ -50,82 +47,14 @@ jobs:
|
||||
run: |
|
||||
docker build --no-cache \
|
||||
-t "${IMAGE}:${{ steps.sha.outputs.short_sha }}" \
|
||||
-t "${IMAGE}:latest" \
|
||||
-f Dockerfile .
|
||||
|
||||
- name: Push image (SHA tag)
|
||||
run: docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
|
||||
|
||||
# ── Tekton integration tests ─────────────────────────────
|
||||
- name: Setup kubeconfig
|
||||
- name: Push Docker image
|
||||
run: |
|
||||
mkdir -p ~/.kube
|
||||
echo "${KUBECONFIG_B64}" | base64 -d > ~/.kube/config
|
||||
kubectl cluster-info
|
||||
env:
|
||||
KUBECONFIG_B64: ${{ secrets.KUBECONFIG_B64 }}
|
||||
|
||||
- name: Trigger Tekton PipelineRun
|
||||
id: tekton
|
||||
run: |
|
||||
SHA="${{ steps.sha.outputs.short_sha }}"
|
||||
RUN_NAME="integration-test-${SHA}"
|
||||
|
||||
# Clean up any previous run with the same name
|
||||
kubectl delete pipelinerun "${RUN_NAME}" -n api --ignore-not-found
|
||||
|
||||
# Create PipelineRun — spins up gateway sidecar + curl tests
|
||||
cat <<YAML | kubectl create -f -
|
||||
apiVersion: tekton.dev/v1
|
||||
kind: PipelineRun
|
||||
metadata:
|
||||
name: ${RUN_NAME}
|
||||
namespace: api
|
||||
labels:
|
||||
commit-sha: "${SHA}"
|
||||
spec:
|
||||
pipelineRef:
|
||||
name: integration-test-pipeline
|
||||
params:
|
||||
- name: image
|
||||
value: "${IMAGE}:${SHA}"
|
||||
YAML
|
||||
|
||||
echo "✓ PipelineRun created: ${RUN_NAME}"
|
||||
|
||||
# Wait for completion (Succeeded or Failed)
|
||||
echo "Waiting for tests (timeout 5m)..."
|
||||
if kubectl wait pipelinerun/"${RUN_NAME}" -n api \
|
||||
--for=condition=Succeeded --timeout=5m 2>/dev/null; then
|
||||
echo "result=pass" >> $GITHUB_OUTPUT
|
||||
else
|
||||
echo "result=fail" >> $GITHUB_OUTPUT
|
||||
fi
|
||||
|
||||
# Print logs + results
|
||||
echo ""
|
||||
echo "=== Test Logs ==="
|
||||
kubectl logs -n api "pipelinerun/${RUN_NAME}" --all-containers 2>/dev/null || true
|
||||
echo ""
|
||||
REASON=$(kubectl get pipelinerun "${RUN_NAME}" -n api \
|
||||
-o jsonpath='{.status.conditions[0].reason}')
|
||||
SUMMARY=$(kubectl get pipelinerun "${RUN_NAME}" -n api \
|
||||
-o jsonpath='{.status.results[?(@.name=="test-summary")].value}')
|
||||
echo "Status: ${REASON}"
|
||||
echo "Summary: ${SUMMARY}"
|
||||
|
||||
- name: Gate on test result
|
||||
if: steps.tekton.outputs.result != 'pass'
|
||||
run: |
|
||||
echo "✗ Integration tests FAILED — image NOT promoted"
|
||||
exit 1
|
||||
|
||||
# ── Promote only after tests pass ────────────────────────
|
||||
- name: Promote image to latest
|
||||
run: |
|
||||
docker tag "${IMAGE}:${{ steps.sha.outputs.short_sha }}" "${IMAGE}:latest"
|
||||
docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
|
||||
docker push "${IMAGE}:latest"
|
||||
echo "✓ Promoted to latest"
|
||||
echo "✓ Pushed: ${IMAGE}:${{ steps.sha.outputs.short_sha }}"
|
||||
|
||||
- name: Cleanup
|
||||
if: always()
|
||||
run: docker image prune -af 2>&1 | tail -3 || true
|
||||
- name: Prune unused images
|
||||
run: docker image prune -a --force 2>&1 | tail -3 || true
|
||||
|
||||
+2
-32
@@ -1,34 +1,4 @@
|
||||
# SOPS Configuration for secrets encryption
|
||||
# Public keys are safe to commit; private keys stay in cluster
|
||||
|
||||
creation_rules:
|
||||
# Encrypt secrets, configs, and sensitive files
|
||||
# Multiple public keys for key rotation support
|
||||
# Files matching these patterns will be encrypted automatically with `sops -e`
|
||||
# Encrypt secrets, configs, and deployment files with infrastructure details
|
||||
- path_regex: k8s/(.*secret.*|.*config.*|.*deployment.*\.ya?ml)
|
||||
age:
|
||||
- age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
|
||||
- age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
|
||||
encrypted_regex: '^data|^stringData' # Only encrypt data fields, keep structure readable
|
||||
|
||||
# Fallback rule for .enc.yaml files
|
||||
- path_regex: '.*\.enc\.ya?ml'
|
||||
age:
|
||||
- age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
|
||||
- age1ryxmuwhecmdru786eqgek4cf8ppq585j2uqr7e87phya42w9s5wscn6tgp
|
||||
encrypted_regex: '^data|^stringData'
|
||||
|
||||
# To encrypt a file locally:
|
||||
# sops --encrypt k8s/configmap.yaml > k8s/configmap.yaml
|
||||
#
|
||||
# To decrypt and view:
|
||||
# sops k8s/configmap.yaml
|
||||
#
|
||||
# To decrypt to stdout:
|
||||
# sops --decrypt k8s/configmap.yaml
|
||||
#
|
||||
# The private age keys are stored in the cluster at:
|
||||
# kubectl -n argocd get secret sops-age -o jsonpath='{.data.key\.txt}' | base64 -d
|
||||
#
|
||||
# Key rotation: Multiple public keys can coexist for decryption
|
||||
# Only private keys MUST be kept secret (in cluster only)
|
||||
age: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
|
||||
|
||||
@@ -24,8 +24,6 @@ type Config struct {
|
||||
Adapters []*serviceadapter.ServiceAdapter
|
||||
// Auth holds JWT authentication configuration for /v1/* endpoints.
|
||||
Auth AuthConfig
|
||||
// Temporal holds Temporal server configuration.
|
||||
Temporal TemporalConfig
|
||||
}
|
||||
|
||||
// ModelUpstream holds upstream configuration for a specific model.
|
||||
@@ -40,12 +38,6 @@ type ModelUpstream struct {
|
||||
AuthRequired bool
|
||||
}
|
||||
|
||||
// TemporalConfig holds Temporal server configuration.
|
||||
type TemporalConfig struct {
|
||||
// HostPort is the address of the Temporal server (host:port).
|
||||
HostPort string
|
||||
}
|
||||
|
||||
// AuthConfig holds JWT authentication configuration.
|
||||
type AuthConfig struct {
|
||||
// Enabled globally enables/disables auth for /v1/* endpoints.
|
||||
@@ -146,12 +138,6 @@ func Load() (*Config, error) {
|
||||
authConfig = loadedAuth
|
||||
}
|
||||
|
||||
temporalHostPort := "localhost:7233"
|
||||
// Allow override via environment variable
|
||||
if hostPort, ok := os.LookupEnv("TEMPORAL_HOST_PORT"); ok {
|
||||
temporalHostPort = hostPort
|
||||
}
|
||||
|
||||
return &Config{
|
||||
ListenAddr: listenAddr,
|
||||
ShutdownTimeout: shutdownTimeout,
|
||||
@@ -159,8 +145,5 @@ func Load() (*Config, error) {
|
||||
Models: models,
|
||||
Adapters: adapters,
|
||||
Auth: authConfig,
|
||||
Temporal: TemporalConfig{
|
||||
HostPort: temporalHostPort,
|
||||
},
|
||||
}, nil
|
||||
}
|
||||
|
||||
@@ -1,299 +0,0 @@
|
||||
//go:build integration
|
||||
|
||||
package integration
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
|
||||
const (
|
||||
gatewayBaseURL = "http://api-gateway:8080"
|
||||
timeout = 30 * time.Second
|
||||
)
|
||||
|
||||
// TestIntegrationMemoryService tests memory adapter (ingest, query)
|
||||
func TestIntegrationMemoryService(t *testing.T) {
|
||||
if testing.Short() {
|
||||
t.Skip("skipping integration test")
|
||||
}
|
||||
|
||||
client := &http.Client{Timeout: timeout}
|
||||
|
||||
// Test 1: Ingest memory
|
||||
t.Log("Testing memory ingest...")
|
||||
ingestPayload := map[string]interface{}{
|
||||
"ingest_id": "test-ingest-" + fmt.Sprintf("%d", time.Now().Unix()),
|
||||
"project": "test-project",
|
||||
"title": "Integration Test Memory",
|
||||
"content": "This is a test memory entry from integration test",
|
||||
"tags": []string{"integration", "test"},
|
||||
"source": "integration-test",
|
||||
}
|
||||
|
||||
ingestBody, _ := json.Marshal(ingestPayload)
|
||||
req, _ := http.NewRequest("POST", gatewayBaseURL+"/memory/ingest", bytes.NewReader(ingestBody))
|
||||
req.Header.Set("X-Service", "memory")
|
||||
req.Header.Set("X-Resource", "ingest")
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
|
||||
resp, err := client.Do(req)
|
||||
if err != nil {
|
||||
t.Fatalf("memory ingest request failed: %v", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
body, _ := io.ReadAll(resp.Body)
|
||||
t.Logf("Ingest response: %d - %s", resp.StatusCode, string(body))
|
||||
|
||||
if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
|
||||
t.Fatalf("memory ingest failed with status %d", resp.StatusCode)
|
||||
}
|
||||
|
||||
t.Log("✓ Memory ingest successful")
|
||||
|
||||
// Test 2: Query memory
|
||||
t.Log("Testing memory query...")
|
||||
queryPayload := map[string]interface{}{
|
||||
"query": "integration test",
|
||||
}
|
||||
|
||||
queryBody, _ := json.Marshal(queryPayload)
|
||||
req, _ = http.NewRequest("POST", gatewayBaseURL+"/memory/query", bytes.NewReader(queryBody))
|
||||
req.Header.Set("X-Service", "memory")
|
||||
req.Header.Set("X-Resource", "query")
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
|
||||
resp, err = client.Do(req)
|
||||
if err != nil {
|
||||
t.Fatalf("memory query request failed: %v", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
body, _ = io.ReadAll(resp.Body)
|
||||
t.Logf("Query response: %d - %s", resp.StatusCode, string(body))
|
||||
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
t.Fatalf("memory query failed with status %d", resp.StatusCode)
|
||||
}
|
||||
|
||||
t.Log("✓ Memory query successful")
|
||||
}
|
||||
|
||||
// TestIntegrationS3Service tests S3 adapter (list, put, get)
|
||||
func TestIntegrationS3Service(t *testing.T) {
|
||||
if testing.Short() {
|
||||
t.Skip("skipping integration test")
|
||||
}
|
||||
|
||||
client := &http.Client{Timeout: timeout}
|
||||
|
||||
// Test 1: List objects
|
||||
t.Log("Testing S3 list objects...")
|
||||
req, _ := http.NewRequest("GET", gatewayBaseURL+"/", nil)
|
||||
req.Header.Set("X-Service", "s3")
|
||||
req.Header.Set("X-Resource", "list-objects")
|
||||
|
||||
resp, err := client.Do(req)
|
||||
if err != nil {
|
||||
t.Fatalf("S3 list request failed: %v", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
body, _ := io.ReadAll(resp.Body)
|
||||
t.Logf("List response: %d - %s", resp.StatusCode, string(body)[:100])
|
||||
|
||||
// S3 should respond with either 200 (list) or 403 (access denied) - both mean routing works
|
||||
if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusForbidden {
|
||||
t.Fatalf("S3 list failed with unexpected status %d", resp.StatusCode)
|
||||
}
|
||||
|
||||
t.Log("✓ S3 list objects successful")
|
||||
|
||||
// Test 2: Put object to dedicated test bucket
|
||||
t.Log("Testing S3 put object...")
|
||||
testContent := fmt.Sprintf("Integration test data - %d", time.Now().Unix())
|
||||
testKey := "test-file-" + fmt.Sprintf("%d", time.Now().Unix()) + ".txt"
|
||||
|
||||
req, _ = http.NewRequest("PUT", gatewayBaseURL+"/"+testKey, bytes.NewReader([]byte(testContent)))
|
||||
req.Header.Set("X-Service", "s3")
|
||||
req.Header.Set("X-Resource", "put-object")
|
||||
req.Header.Set("Content-Type", "text/plain")
|
||||
|
||||
resp, err = client.Do(req)
|
||||
if err != nil {
|
||||
t.Fatalf("S3 put request failed: %v", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
body, _ = io.ReadAll(resp.Body)
|
||||
t.Logf("Put response: %d - %s", resp.StatusCode, string(body)[:100])
|
||||
|
||||
// Put should respond - either success or S3 error (both mean routing works)
|
||||
if resp.StatusCode < 200 || resp.StatusCode >= 600 {
|
||||
t.Fatalf("S3 put failed with status %d", resp.StatusCode)
|
||||
}
|
||||
|
||||
t.Log("✓ S3 put object successful")
|
||||
}
|
||||
|
||||
// TestIntegrationSQSService tests SQS adapter (create queue, send, receive)
|
||||
func TestIntegrationSQSService(t *testing.T) {
|
||||
if testing.Short() {
|
||||
t.Skip("skipping integration test")
|
||||
}
|
||||
|
||||
client := &http.Client{Timeout: timeout}
|
||||
|
||||
// Test 1: List queues (no auth required in test, auth error is ok)
|
||||
t.Log("Testing SQS list queues...")
|
||||
req, _ := http.NewRequest("GET", gatewayBaseURL+"/sqs/queues", nil)
|
||||
req.Header.Set("X-Service", "sqs")
|
||||
req.Header.Set("X-Resource", "list-queues")
|
||||
|
||||
resp, err := client.Do(req)
|
||||
if err != nil {
|
||||
t.Fatalf("SQS list request failed: %v", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
body, _ := io.ReadAll(resp.Body)
|
||||
t.Logf("List queues response: %d - %s", resp.StatusCode, string(body))
|
||||
|
||||
// SQS requires auth, so 401 is expected but proves routing works
|
||||
if resp.StatusCode == http.StatusUnauthorized {
|
||||
t.Log("✓ SQS correctly requires authorization (routing works)")
|
||||
return
|
||||
}
|
||||
|
||||
if resp.StatusCode == http.StatusOK {
|
||||
t.Log("✓ SQS list queues successful")
|
||||
return
|
||||
}
|
||||
|
||||
t.Fatalf("SQS list failed with unexpected status %d", resp.StatusCode)
|
||||
}
|
||||
|
||||
// TestIntegrationWorkflowService tests workflow adapter (list, describe)
|
||||
func TestIntegrationWorkflowService(t *testing.T) {
|
||||
if testing.Short() {
|
||||
t.Skip("skipping integration test")
|
||||
}
|
||||
|
||||
client := &http.Client{Timeout: timeout}
|
||||
|
||||
// Test 1: List workflows with gRPC
|
||||
t.Log("Testing workflow list (gRPC)...")
|
||||
req, _ := http.NewRequest("GET",
|
||||
gatewayBaseURL+"/temporal.api.workflowservice.v1.WorkflowService/ListWorkflowExecutions",
|
||||
nil)
|
||||
req.Header.Set("X-Service", "workflow")
|
||||
req.Header.Set("X-Resource", "list")
|
||||
req.Header.Set("Content-Type", "application/grpc")
|
||||
req.Header.Set("TE", "trailers")
|
||||
|
||||
resp, err := client.Do(req)
|
||||
if err != nil {
|
||||
t.Fatalf("workflow list request failed: %v", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
body, _ := io.ReadAll(resp.Body)
|
||||
|
||||
// gRPC responses are binary, but we can check status code
|
||||
t.Logf("List workflows response: %d (body length: %d bytes)", resp.StatusCode, len(body))
|
||||
|
||||
// Status 200 with gRPC binary data, or 501 if not yet implemented
|
||||
if resp.StatusCode == http.StatusOK {
|
||||
t.Log("✓ Workflow list successful (gRPC forwarding working)")
|
||||
return
|
||||
}
|
||||
|
||||
if resp.StatusCode == http.StatusNotImplemented {
|
||||
t.Log("⚠ Workflow list: gRPC forwarding not yet implemented")
|
||||
return
|
||||
}
|
||||
|
||||
if resp.StatusCode >= 400 && resp.StatusCode < 500 {
|
||||
// Client error might indicate routing works but request format issue
|
||||
t.Logf("✓ Workflow adapter routing confirmed (status %d)", resp.StatusCode)
|
||||
return
|
||||
}
|
||||
|
||||
t.Fatalf("Workflow list failed with status %d", resp.StatusCode)
|
||||
}
|
||||
|
||||
// TestIntegrationIAMService tests IAM adapter
|
||||
func TestIntegrationIAMService(t *testing.T) {
|
||||
if testing.Short() {
|
||||
t.Skip("skipping integration test")
|
||||
}
|
||||
|
||||
client := &http.Client{Timeout: timeout}
|
||||
|
||||
t.Log("Testing IAM list users...")
|
||||
req, _ := http.NewRequest("GET", gatewayBaseURL+"/api/v3/users", nil)
|
||||
req.Header.Set("X-Service", "iam")
|
||||
req.Header.Set("X-Resource", "list-users")
|
||||
|
||||
resp, err := client.Do(req)
|
||||
if err != nil {
|
||||
t.Fatalf("IAM list request failed: %v", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
_, _ = io.ReadAll(resp.Body)
|
||||
t.Logf("IAM list users response: %d", resp.StatusCode)
|
||||
|
||||
// IAM (Authentik) should respond - 200, 404, or auth error all prove routing works
|
||||
if resp.StatusCode >= 200 && resp.StatusCode < 600 {
|
||||
t.Log("✓ IAM adapter routing successful")
|
||||
return
|
||||
}
|
||||
|
||||
t.Fatalf("IAM list failed with status %d", resp.StatusCode)
|
||||
}
|
||||
|
||||
// TestIntegrationHealthChecks tests gateway health endpoints
|
||||
func TestIntegrationHealthChecks(t *testing.T) {
|
||||
if testing.Short() {
|
||||
t.Skip("skipping integration test")
|
||||
}
|
||||
|
||||
client := &http.Client{Timeout: timeout}
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
endpoint string
|
||||
}{
|
||||
{"liveness", "/healthz"},
|
||||
{"readiness", "/readyz"},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
req, _ := http.NewRequest("GET", gatewayBaseURL+tt.endpoint, nil)
|
||||
resp, err := client.Do(req)
|
||||
if err != nil {
|
||||
t.Fatalf("health check request failed: %v", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
t.Fatalf("health check failed with status %d", resp.StatusCode)
|
||||
}
|
||||
|
||||
var health map[string]string
|
||||
if err := json.NewDecoder(resp.Body).Decode(&health); err != nil {
|
||||
t.Fatalf("failed to decode health response: %v", err)
|
||||
}
|
||||
|
||||
t.Logf("✓ %s: %s", tt.name, health["status"])
|
||||
})
|
||||
}
|
||||
}
|
||||
@@ -33,8 +33,8 @@ func NewRouter(healthChecker *HealthChecker, dispatcher *serviceadapter.Dispatch
|
||||
// ServeHTTP implements http.Handler.
|
||||
// Priority order:
|
||||
// 1. /healthz and /readyz to health handlers
|
||||
// 2. X-Service header to ServiceAdapter dispatcher (phase 8) - PREFERRED routing method
|
||||
// 3. /workflow* to temporal handler - DEPRECATED: use X-Service: workflow instead
|
||||
// 2. X-Service header to ServiceAdapter dispatcher (phase 8)
|
||||
// 3. /workflow* to temporal handler
|
||||
// 4. All other paths to upstream handler (phase 0-7)
|
||||
func (r *Router) ServeHTTP(w http.ResponseWriter, req *http.Request) {
|
||||
// Health endpoints first
|
||||
@@ -48,8 +48,6 @@ func (r *Router) ServeHTTP(w http.ResponseWriter, req *http.Request) {
|
||||
}
|
||||
|
||||
// X-Service (ServiceAdapter) routing - checked before path-based routing
|
||||
// PREFERRED: All service routing should use X-Service header pattern for consistency,
|
||||
// auth enforcement, and resource-based access control.
|
||||
if req.Header.Get("X-Service") != "" {
|
||||
if r.dispatcher != nil {
|
||||
r.dispatcher.Dispatch(w, req)
|
||||
@@ -58,8 +56,6 @@ func (r *Router) ServeHTTP(w http.ResponseWriter, req *http.Request) {
|
||||
}
|
||||
|
||||
// Workflow endpoints
|
||||
// DEPRECATED: Path-based /workflow routing is legacy.
|
||||
// New clients should use X-Service: workflow header instead for consistent auth.
|
||||
switch req.URL.Path {
|
||||
case "/workflow", "/workflow/health", "/workflow/metrics":
|
||||
r.temporalHandler.ServeHTTP(w, req)
|
||||
|
||||
@@ -10,7 +10,6 @@ import (
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"golang.org/x/net/http2"
|
||||
"google.golang.org/grpc"
|
||||
"google.golang.org/grpc/credentials/insecure"
|
||||
|
||||
@@ -165,10 +164,6 @@ func (d *Dispatcher) dispatchHTTP(w http.ResponseWriter, r *http.Request, upstre
|
||||
req.URL.Path = method.UpstreamPath
|
||||
req.RequestURI = ""
|
||||
req.Host = parsedURL.Host
|
||||
|
||||
// Preserve Authorization header for S3 SigV4 and other auth schemes
|
||||
// Note: httputil.ReverseProxy preserves most headers automatically,
|
||||
// but we need to ensure Authorization isn't lost when overriding Director
|
||||
}
|
||||
|
||||
timeout := adapter.Spec.Upstream.TimeoutSeconds
|
||||
@@ -219,33 +214,9 @@ func (d *Dispatcher) dispatchGRPC(w http.ResponseWriter, r *http.Request, upstre
|
||||
}
|
||||
defer conn.Close()
|
||||
|
||||
// Create HTTP/2 reverse proxy for gRPC
|
||||
// gRPC uses HTTP/2 protocol, so we need an HTTP/2-capable transport
|
||||
upstreamURLObj := &url.URL{
|
||||
Scheme: "http",
|
||||
Host: host,
|
||||
}
|
||||
|
||||
proxy := httputil.NewSingleHostReverseProxy(upstreamURLObj)
|
||||
proxy.Director = func(req *http.Request) {
|
||||
req.URL.Scheme = "http"
|
||||
req.URL.Host = host
|
||||
req.URL.Path = method.UpstreamPath
|
||||
req.RequestURI = ""
|
||||
req.Host = host
|
||||
}
|
||||
|
||||
// Create HTTP/2 client transport for gRPC calls
|
||||
// gRPC requires HTTP/2 for proper message framing
|
||||
h2transport := &http2.Transport{
|
||||
AllowHTTP: true,
|
||||
}
|
||||
|
||||
// Set the transport on the proxy
|
||||
proxy.Transport = h2transport
|
||||
|
||||
// Serve the request through the proxy
|
||||
proxy.ServeHTTP(w, r)
|
||||
d.writeError(w, problem.NewProblem(http.StatusNotImplemented,
|
||||
"about:blank#not-implemented", "Not Implemented",
|
||||
"gRPC forwarding not yet implemented"))
|
||||
}
|
||||
|
||||
func (d *Dispatcher) writeError(w http.ResponseWriter, p *problem.Problem) {
|
||||
|
||||
+14
-14
File diff suppressed because one or more lines are too long
@@ -0,0 +1,27 @@
|
||||
apiVersion: ENC[AES256_GCM,data:zPM=,iv:31E0HyT/gIYuP7wJuv2PyZTUI8ZSxzsHoNwJBXtN3eQ=,tag:UiOz3gWeZpseTvijzoMO/g==,type:str]
|
||||
kind: ENC[AES256_GCM,data:fC9L4bgQ,iv:cTB5L5uOy/klV5ACJgHwY2voWGo1NcoINrrQyyZMBl8=,tag:v0/8OPMW/Yun7/JPJidUtA==,type:str]
|
||||
metadata:
|
||||
name: ENC[AES256_GCM,data:35058TEeQUpJ7TT16XX4HsxN,iv:W/n1SdzwAGeOhwD7XE3dIoMnzttaxHV4fBqfW+1cut8=,tag:AOlK9sfDT5wzNq+91hxQtw==,type:str]
|
||||
namespace: ENC[AES256_GCM,data:GTD3,iv:58j03KpGyiiEJCvSip9hdZA/scPtn31VkYxE9U3SCN8=,tag:q+RNx4PmENfNHgK5RRE3kw==,type:str]
|
||||
labels:
|
||||
app: ENC[AES256_GCM,data:2ZMbFp4alrD/qnM=,iv:p66pFUVHBYPnYE9icQhrphsLbF41if26EcxQ7x0uIV0=,tag:GjQJbzjrf5Bx6rKMMALXmw==,type:str]
|
||||
type: ENC[AES256_GCM,data:bKTOubPr,iv:jUOAj9p6BhrQGIXYNcp7aam5IkfGHzvmnja6Po8dHwc=,tag:mUKMVkGOGma4CF3OIAWHyg==,type:str]
|
||||
stringData:
|
||||
config.yaml: ENC[AES256_GCM,data:sRkonCAvqqiOdyZLNUVvptbwB9Cf5QxBw5mo9vG7uEy3ySrI4MdpxoZ05zxGZbTbGmzOg7Nmh26AXqnizuICRiHknXQz9eOFPvbHuPCMOlezhMfbIRmcJ6HBUPVdKo4uAYbTfJVsqH0KXVsaSptEPydx4nPR1u8GB26NC1qqzIT7ax1bKzUEWvI9LZNZWfHfirp7O/CGTA0QvzfKp7dP7tkf84+SiJLlrl90q4mUTFF4D0LZLS4sxMi5LfwVls4epB13Jo83ezOojdO8lc2wj8PWRan2PE8pLwC6r36kiZ2upXQR2rU9h8rblgHL0lRM5vcgEy0Ey54s32sLLl3m8jW2f/npXYSUh/lSyjdT9JlTcknMa1FwMvm0AMyzZ2p0DeoGa+gnbXhxhq7cGa2tKTOby07eJxNs9k2wyr7ThvTMnpatpnV6qMvGj2P4SZKj5a3WKQpSacJ7jTyBa16FBmN+IMzlnP89/55zpx/WCG0xHxcr16h1bZFE+isTyrHPJ7TYtcailA/+sM7HJL7rnXBPzs2LjmJPY90wX6marle9Vg7+L69DwC4fswpjcMFZ1o8gd9na3jWHr4so4Y9nUok9qPnJIW3C9NUMN/mPNKVC7tt6p04jq9Q2GzGPK3sLx/vD36kkD4DgjOBe/DDnskTC6G0CSZfAjFOc+ec5ExVCpgPH8ysw7Xj8SvCYGhklcuR/D4xKldNUT5KfEExQLBbsjlW1PJGheIdjftmgultmDDsb86Yp0DOicxzWuh4ekA8hkqb1RSkyl2OiDgVvvANvBDQLuZBuFBlJoF0bLNLcyJXdl9EjnG0ClqYz5mzkId50afbh1p13tOkpIv66ONYznu5hKfLdtUrqnjTjtDt68msnsvUbQVvI6OOHUcqOzHZ4W/X8hOEzqRf9aAriEyIPj6Ac+SRvvuYOjzFPjCW/+RlyqZ8ec8MKZ43NeFI9Hg8Xnm9QoursiLRhbch20/FH3rEN7RGx2NGc2FU4HuCbV0spVPmItv7SsDKM88nXRa5C+g+cDl8YkPc1blDz3xX24jOD5oa7fVWhjmVLdKrTGGzykrmMDdj7phBviWiuFvOXt5b2A1l35ABDNjKC104bieuGM06p9T6xuB3eRPJLcJufKq4N8kk/LamvMYf9T1GAHhCxiy3iXwRhVCmMhea5e5N7OdnSWa8OipxRNcJBO7uWSrTlLYnFdkTXoYXM4syc8+j4P+1k45zOkwaUAR/WdaAQlHZgu6o9on7nFFd4QTSElJgh00y76Mb/wHdPdlAOi2lg9dA0DAWfGKi42ez4dOWjn9UDJdRLJUIh2vSJyu39wgsXHTNBQXcRc86jTBhhjh6iaAXoTmXmWvx9ZuBhOsW0clUePGbg+c8oRmWvIAYR21IPA46WSxPDQQve0JjrO73rEPQ2vmy5nqpDpywRPgbgYReDZ1FiBtZASnaEPCwunro1oKUJbjtaJBt3yx1+xilg/wTmeH9kP9sDWE47LJ3hBGEtmTNTTrDP11IP8rqU5tSHGNlRW6V9nxlAW73LJrahNWrl8tm2UP8SQG+hyrQmKvALzDQlnbjVEo9m+kPTbiewxN8gRCt8qfgk9jDcJASynQWButjyutQt84qdFQWYMRV1GNvZ7oU0OdEXfHgM7vwm+Qke1EohGkXqtqLUmXqF+NWMzWTeg1SCuH60MsOMHoKM8LId7IYl3NsmALhYOSn/FojR80ejt6AzJtezXKupeRjHHszLYP5xZDpu7swqQy4PoIybQXB9alWNhS7wTsqr8zIjKN8LFNKV4r4Nx2BdtbrWzvAGVDpGTZclTDTqm5IhcQRMOPsd3Hh3zOchpczeqdZsW0CE2EByJOqlQFRTUS7ebqU+nfNxra51hlehEGjwW2qjF/1JY+2kaaSqLerZpQkAhuyfOnFhVmN3QWXO7EvHpL4D658R2MwYAqcq1Lhlqo9kz0ebOib/YlazDEa6Wd/oenUcT9pTapRozZcOAo6bkZ4BBTxTd+dUYbJpqJfZFJt3rHJiutX9Go46mP+PQJ9MM8HeW2KicB33hPFBDiTKCySRprJCfc6Q/iP4UVk7n0AXkAzLLm8gIUByxF1yKwRyYNTS9Dko4mkiueKK96X9LrPy2s2o7hK+s1qcF7Hh+4HMJw9U/Ys2mZKecvRfcbAGXrPFORGSm59PRyMQycPPz/uOiFnEVL1xKrn/foq81iADpCSf/pTS+Rkb0EbH6MGN8b6CPKq2m5rxWgNKcRyOD85UPjyhMKF12CjAjRxEg8hlce7e5StEOgH01W9uT8MkXmBWag2FcwRU282jvcPJYHUKR6LlZRTMbJN+5onxlOkGco8//Cw48X+rASCS899+1AQkPNzdkUn49tqhHMlLBCOfFkXi3QJ/L3lloe/rPA2b4PQu0v80kgHVn+LaDUX8LcMbTA5fay85tiFlETSS1M9qZPQ+HY7QjJScDQsKU36NmgyMpdwKccuqSv+qd2E4mPRlE6mG+BrqvR6+Vrk9MGvrsnt/Dgjuc8z9rM1mgnrP9/uucseeTqYc5ibrp0X4Umn03a9QJa1wIvbLQkvOFq0BILwsCbOu4ls/EuGO2mUMjfoqD03UXFXbnH1GspX8nm8Dk9w3rugVeFD3ZVBKV5aRkx3cxVGgkpQv33Jd8e6O+s7+B7AcVpL+D+lIGWFkf6CjxTe+zZ1fjdNQrKEuXJ0koOn2r5SqbQC4PI+mWlIhgQ2ELYMHHRLYDi2DiC44UMNVwxbVNdtBnTf0EDdUIsprneS6kcjg4MuXJVdbtMYmMbeOSeP7Lk7mAM2gkEy8jZcoKhdG6kmojCi+T9D37hn7038rz+JOCJxBuH099yvI87IRp01PLOczASWBFgBe7Jxa6zEdOXR3PLb/oiTn9EB0oDxO5oSMM5jM8SxqspRP/5gAjQdkIFH9gE+y56PUbyAcbFqEqO1oODVUKv1u7tx43yosH0R5LK0JM+R5bcwJ3D0qBWPSjnU4aczRZ1XSenkLJXOE1+V3bWMNlpEqR4mtSUqe3msv8tryNWkQpdqPeTN4F89Wmhvx/d74RfZ+IDc674tJs40hK4kwm761RtXlItvcUtRokva9PDLRe50zcG9s6gkMkflrVcVKTepGGa7cNm9HxQeOeHSonBXWSRrisz5EISWwuWA6RteF5PMznApizZbCrmoIW0GDa1ibBnVZrVq87jRl0jkJelqp5kAVFajWPXW/XOwLfpOKBcQX9hKxUeFEaXSXaf6vY7SWle6EFb+3wk/Gy6piULDCkAM6LyOskxFLaqQP6PJ7Jg89MmHj2cK8wIvMNt8SdoxM/Ckrj3chSq/9yCy9UoVGDTYg6PNmzcRj9RFBKIXpldgC37rNWwshc6HXRLPmrNiJe0PjNOYPyUU0UtY87peS5C1HxABWGEjv+nIqlAgTmLieKlMLzCW+PDjvp7pYu324t4gLywgxem4mrHVTSCHmXY9UOODzZ3vzspx+RrsAmF01mLG6nxgMycf7t4U6d1yaOGn/78i947IUx/CkdKUbHlgl7qeGOOk/GPM01yz86xczviMjYLL5J9GlpQwOpAvr39ODjCKv9jmoq6XP9RVLdVLo+/JsjQnuDCqnC6razVUYiDQbFbR6Rj/2bY97UEJPeJu1RBkwUooQ8XTn3tf2g02bM9VjBFEnjBRw7zBTAwNA+vMp25a3NgFCDV/tBI93bddJd9P5BjXPW9a/44yHi36/CiFf0W8w/62DlmFLCBKP9aduZ3dYv7T6pn5fZILtF4TPGkZxXxPRakhtNnz49/DaGkxY8X2V5Gt4TVZg9aohQHJfAhmaCwb4DRnDZyd2lD8xI82V2XIUIUK0gMRT5aBrZdvLNSOnHjLZuyRjd/3iYxPjP2PaT9cDcpFxvsBSfXbGafDITqwWoDasPSWviBgJlKRbtkXUu0AlVKTL7uukM4DUcR60olyrjyJmbrKeRcueiHJ4aLjjKbI+2j8i9QC0rH+hgdFFer09b/ORAzbPDq+MknsYVux33wNTQ+7haXadjqMSIzdx0FgWBfMQOquj6gT80OQ3yiu2M+k=,iv:F+45ts5NR7auZMszEdZc6m1yqs5m90v+LSZinS0uo5M=,tag:3g351RmwiBMCtYyRGJAm+A==,type:str]
|
||||
#ENC[AES256_GCM,data:j2gPjs0hZwK/5c3fIRqnfMaRbxe0uoUTiUO7oSexIgOpbQGwZBME2BBZTf/BjlbnWGFgU43E9Y3LZm/Da3xR7w==,iv:BmUAWIEuzu+mz2Q2c3HNrS/gbdbXhaHaD/edcaVbSKs=,tag:ckp/2N8vGCoE/5i284LzSw==,type:comment]
|
||||
#ENC[AES256_GCM,data:sQaf5dfdmyJ0czeNstXaN38TGZMa3/nfD1jaV46MT4deBJFgWAikcnnJJGC8hGK8KKVXZ+W7mmxwskE=,iv:1JKnZFYzm5PrcsvGduSLk31saixMBrMqk/VwG1P3JQg=,tag:UWW/ngvsz6/GNYLrUUxLzQ==,type:comment]
|
||||
sops:
|
||||
age:
|
||||
- enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZQTVNVXczc29yQ1JnTmJR
|
||||
QnFJTVJvczROZU44cmNqZW5POHJEbnc4Rnl3ClhldTg2dkY2aGpVN2FBb1dGQ2tS
|
||||
Y1M3TTQ2NjNvRm45YzlBODIweHcxZVUKLS0tIEZpZnJ1cncxUm04a2hWMkZVSHEv
|
||||
cVFraWhTNzBNUHlPMGxPNVhkTmxubWsKYUkhnMX/1aXP7yh5z1JNUlSW9GKSU1QM
|
||||
3DDporJvkUBx/PEUkRuCY0ntFqQKxsOPzfY1R3Xls2KdXHgQjPFkMA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
|
||||
lastmodified: "2026-09-12T23:54:28Z"
|
||||
mac: ENC[AES256_GCM,data:BXGmTl7z+oh4+sAnWqzIpzGkoJ1ebzQJYZAYZHb2xrsrMK6LRtzZYW9OHTXuP1UCZtLnFvy5dsLFUMFXwOo8hxeBx4GpRJUFrTuA+phkkv3+RHXL+sDBvzDr/Z0vqgVE7evAxumnfAnLfpRvbAs5BaaFi3s2GWYO/pj1k9hRL4o=,iv:IeKfgXERKH7Vwd3mJLsufTvQ52EwoK4jCH538VW7Fxs=,tag:/HsSYetbscQ3CTm081I3QA==,type:str]
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.13.2
|
||||
@@ -1,10 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: api-gateway-config
|
||||
namespace: api
|
||||
labels:
|
||||
app: api-gateway
|
||||
type: Opaque
|
||||
stringData:
|
||||
config.yaml: "# PRODUCTION GATEWAY CONFIGURATION\n# ==========================================\n# All upstream services MUST use Kubernetes internal service DNS names\n# Format: <service>.<namespace>.svc.cluster.local\n# \n# This ensures:\n# - Communication within cluster network only (no external IP exposure)\n# - Pod-to-pod service discovery via internal DNS\n# - Security policy enforcement at network level\n# - Service-level load balancing via kube-proxy\n#\n# Routing Pattern:\n# PREFERRED: X-Service header routing (e.g., X-Service: workflow)\n# Legacy: Path-based routing (e.g., /workflow) - being deprecated\n#\nauth:\n enabled: true\n issuer: \"https://authentik.riotpiao.com/application/o/api-gw/\"\n audience: \"api-gw\"\n jwksUrl: \"http://authentik-server.iam.svc.cluster.local/application/o/api-gw/jwks/\"\n requiredCapability: \"llm:inference\"\n tokenUrl: \"http://authentik-server.iam.svc.cluster.local/application/o/token/\"\n clientId: \"api-gw\"\nroutes: []\nmodels:\n# All model services use internal Kubernetes DNS (llm-serving namespace)\n- name: \"reasoning\"\n address: \"reasoning-predictor.llm-serving.svc.cluster.local:80\"\n path: \"/v1/chat/completions\"\n- name: \"ornith:35b\"\n address: \"ornith-predictor.llm-serving.svc.cluster.local:80\"\n path: \"/v1/chat/completions\"\n- name: \"qwen2.5:3b-instruct\"\n address: \"qwen-cpu.llm-serving.svc.cluster.local:80\"\n path: \"/v1/chat/completions\"\n- name: \"nomic-ai/nomic-embed-text-v2-moe\"\n address: \"embeddings-predictor.llm-serving.svc.cluster.local:80\"\n path: \"/v1/embeddings\"\n- name: \"BAAI/bge-reranker-base\"\n address: \"reranker-predictor.llm-serving.svc.cluster.local:80\"\n path: \"/v1/rerank\"\nadapters:\n- serviceName: sqs\n upstream:\n url: http://management-service.sqs.svc.cluster.local:9090\n timeoutSeconds: 30\n auth:\n required: true\n resources:\n - name: send-message\n methods:\n - verb: POST\n upstreamPath: /sqs/send\n - name: receive-message\n methods:\n - verb: POST\n upstreamPath: /sqs/receive\n - name: list-queues\n methods:\n - verb: GET\n upstreamPath: /sqs/queues\n- serviceName: workflow\n upstream:\n url: grpc://temporal-frontend.temporal.svc.cluster.local:7233\n timeoutSeconds: 60\n auth:\n required: false\n resources:\n - name: execute\n methods:\n - verb: POST\n upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ExecuteWorkflow\n - name: describe\n methods:\n - verb: GET\n upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/DescribeWorkflowExecution\n - name: list\n methods:\n - verb: GET\n upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ListWorkflowExecutions\n- serviceName: memory\n upstream:\n url: http://poimen-memory.poimen.svc.cluster.local:8080\n timeoutSeconds: 30\n auth:\n required: false\n resources:\n - name: query\n methods:\n - verb: POST\n upstreamPath: /memory/query\n - name: ingest\n methods:\n - verb: POST\n upstreamPath: /memory/ingest\n - name: skills\n methods:\n - verb: GET\n upstreamPath: /memory/skills\n- serviceName: s3\n upstream:\n url: http://minio.storage.svc.cluster.local:80\n timeoutSeconds: 30\n auth:\n required: false\n resources:\n - name: list-objects\n methods:\n - verb: GET\n upstreamPath: /\n - name: get-object\n methods:\n - verb: GET\n upstreamPath: /\n - name: put-object\n methods:\n - verb: PUT\n upstreamPath: /\n- serviceName: iam\n upstream:\n url: http://authentik-server.iam.svc.cluster.local:80\n timeoutSeconds: 30\n auth:\n required: false\n resources:\n - name: list-roles\n methods:\n - verb: GET\n upstreamPath: /api/v3/roles\n - name: list-users\n methods:\n - verb: GET\n upstreamPath: /api/v3/users\n - name: create-role\n methods:\n - verb: POST\n upstreamPath: /api/v3/roles\n"
|
||||
@@ -1,70 +0,0 @@
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: api-gateway-integration-test
|
||||
namespace: api
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
serviceAccountName: api-gateway
|
||||
restartPolicy: Never
|
||||
containers:
|
||||
- name: integration-tester
|
||||
image: golang:1.26-bookworm
|
||||
imagePullPolicy: IfNotPresent
|
||||
workingDir: /workspace
|
||||
command:
|
||||
- /bin/bash
|
||||
- -c
|
||||
- |
|
||||
set -e
|
||||
echo "Starting integration tests..."
|
||||
|
||||
# Clone the repo
|
||||
git clone https://forgejo.riotpiao.com/riotpiao-poimen/homelab-frontend.git .
|
||||
|
||||
# Wait for gateway to be ready
|
||||
echo "Waiting for gateway service to be ready..."
|
||||
for i in {1..30}; do
|
||||
if curl -s http://api-gateway:8080/healthz | grep -q "alive"; then
|
||||
echo "✓ Gateway is ready"
|
||||
break
|
||||
fi
|
||||
echo "Attempting to reach gateway ($i/30)..."
|
||||
sleep 2
|
||||
done
|
||||
|
||||
# Run integration tests
|
||||
echo "Running integration tests..."
|
||||
go test -v -tags=integration -timeout=5m ./internal/integration/...
|
||||
|
||||
echo "✓ Integration tests completed"
|
||||
env:
|
||||
- name: GATEWAY_URL
|
||||
value: "http://api-gateway:8080"
|
||||
resources:
|
||||
requests:
|
||||
cpu: 250m
|
||||
memory: 512Mi
|
||||
limits:
|
||||
cpu: 500m
|
||||
memory: 1Gi
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 65532
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
volumeMounts:
|
||||
- name: tmp
|
||||
mountPath: /tmp
|
||||
- name: home
|
||||
mountPath: /home/nonroot
|
||||
volumes:
|
||||
- name: tmp
|
||||
emptyDir: {}
|
||||
- name: home
|
||||
emptyDir: {}
|
||||
backoffLimit: 1
|
||||
@@ -8,7 +8,7 @@ resources:
|
||||
- service.yaml
|
||||
- deployment.yaml
|
||||
- network-policy.yaml
|
||||
- gateway-config-secret.yaml
|
||||
- gateway-config-secret.enc.yaml
|
||||
|
||||
# The deployed image tag lives here and nowhere else. CI publishes
|
||||
# forgejo.riotpiao.com/rock/api-gateway:<commit-sha> and tags it as :latest on main.
|
||||
|
||||
@@ -46,14 +46,6 @@ spec:
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 8080
|
||||
# Allow from paperless namespace (paperless-ai document auto-tagging)
|
||||
- from:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: paperless
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 8080
|
||||
egress:
|
||||
# Allow DNS
|
||||
- to:
|
||||
|
||||
@@ -1,58 +0,0 @@
|
||||
# Tekton Integration Tests
|
||||
|
||||
Curl-based integration tests for the API gateway, orchestrated by Tekton.
|
||||
|
||||
## How It Works
|
||||
|
||||
```
|
||||
CI pushes image:sha → creates PipelineRun → Tekton spins up gateway sidecar
|
||||
→ runs curl tests → reports pass/fail → CI promotes to :latest if pass
|
||||
```
|
||||
|
||||
The Task runs the gateway image as a **sidecar** (same pod, localhost),
|
||||
then executes `scripts/integration-test.sh` which tests every adapter
|
||||
via `X-Service` + `X-Resource` header routing.
|
||||
|
||||
## Files
|
||||
|
||||
| File | Purpose |
|
||||
|------|---------|
|
||||
| `task-integration-test.yaml` | Task: sidecar gateway + curl test step |
|
||||
| `pipeline-integration-test.yaml` | Pipeline: wraps the Task |
|
||||
| `scripts/integration-test.sh` | Test script (mounted as ConfigMap) |
|
||||
| `kustomization.yaml` | Generates ConfigMap from script |
|
||||
|
||||
## Manual Run
|
||||
|
||||
```bash
|
||||
kubectl apply -k k8s/tekton/
|
||||
kubectl create -f - <<'EOF'
|
||||
apiVersion: tekton.dev/v1
|
||||
kind: PipelineRun
|
||||
metadata:
|
||||
name: integration-test-manual
|
||||
namespace: api
|
||||
spec:
|
||||
pipelineRef:
|
||||
name: integration-test-pipeline
|
||||
params:
|
||||
- name: image
|
||||
value: forgejo.riotpiao.com/rock/api-gateway:latest
|
||||
EOF
|
||||
|
||||
# Watch
|
||||
kubectl logs -f -n api pipelinerun/integration-test-manual -c step-run-tests
|
||||
```
|
||||
|
||||
## Updating Tests
|
||||
|
||||
Edit `scripts/integration-test.sh`, then:
|
||||
|
||||
```bash
|
||||
kubectl apply -k k8s/tekton/ # recreates ConfigMap
|
||||
```
|
||||
|
||||
## Tekton Infrastructure
|
||||
|
||||
Tekton Pipelines is installed in `~/workplace/homelab` via ArgoCD
|
||||
(`k8s/argocd/apps/06-ci-cd.yaml` → vendored `k8s/infra/tekton/release.yaml`).
|
||||
@@ -1,51 +0,0 @@
|
||||
# ServiceAccount and RBAC for CI runner to create/watch Tekton PipelineRuns.
|
||||
# Applied to the `api` namespace where PipelineRuns execute.
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: ci-tekton-trigger
|
||||
namespace: api
|
||||
labels:
|
||||
app: api-gateway
|
||||
component: ci
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: ci-tekton-trigger
|
||||
namespace: api
|
||||
rules:
|
||||
- apiGroups: ["tekton.dev"]
|
||||
resources: ["pipelineruns"]
|
||||
verbs: ["create", "get", "list", "watch", "delete"]
|
||||
- apiGroups: ["tekton.dev"]
|
||||
resources: ["taskruns"]
|
||||
verbs: ["get", "list"]
|
||||
- apiGroups: [""]
|
||||
resources: ["pods", "pods/log"]
|
||||
verbs: ["get", "list"]
|
||||
---
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: ci-tekton-trigger
|
||||
namespace: api
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: ci-tekton-trigger
|
||||
namespace: api
|
||||
roleRef:
|
||||
kind: Role
|
||||
name: ci-tekton-trigger
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
---
|
||||
# Secret to generate a long-lived token for the CI runner.
|
||||
# The runner mounts this as KUBECONFIG_B64 or uses it directly.
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: ci-tekton-trigger-token
|
||||
namespace: api
|
||||
annotations:
|
||||
kubernetes.io/service-account.name: ci-tekton-trigger
|
||||
type: kubernetes.io/service-account-token
|
||||
@@ -1,17 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
|
||||
namespace: api
|
||||
|
||||
resources:
|
||||
- ci-rbac.yaml
|
||||
- task-integration-test.yaml
|
||||
- pipeline-integration-test.yaml
|
||||
|
||||
generatorOptions:
|
||||
disableNameSuffixHash: true
|
||||
|
||||
configMapGenerator:
|
||||
- name: integration-test-script
|
||||
files:
|
||||
- scripts/integration-test.sh
|
||||
@@ -1,30 +0,0 @@
|
||||
apiVersion: tekton.dev/v1
|
||||
kind: Pipeline
|
||||
metadata:
|
||||
name: integration-test-pipeline
|
||||
namespace: api
|
||||
labels:
|
||||
app: api-gateway
|
||||
component: testing
|
||||
spec:
|
||||
description: >
|
||||
Run integration tests against a gateway image.
|
||||
Spins up the image as a sidecar, tests via curl, reports pass/fail.
|
||||
params:
|
||||
- name: image
|
||||
type: string
|
||||
description: "Container image to test (repo:sha)"
|
||||
results:
|
||||
- name: test-result
|
||||
description: "pass or fail"
|
||||
value: $(tasks.integration-test.results.result)
|
||||
- name: test-summary
|
||||
description: "e.g. 8/8 passed"
|
||||
value: $(tasks.integration-test.results.summary)
|
||||
tasks:
|
||||
- name: integration-test
|
||||
taskRef:
|
||||
name: integration-test
|
||||
params:
|
||||
- name: image
|
||||
value: $(params.image)
|
||||
@@ -1,94 +0,0 @@
|
||||
#!/bin/sh
|
||||
set -e
|
||||
|
||||
# Integration test runner for API gateway.
|
||||
# Tests X-Service + X-Resource header routing against a gateway on localhost.
|
||||
#
|
||||
# Required env:
|
||||
# GW — gateway base URL (e.g. http://localhost:8080)
|
||||
# RESULTS_DIR — directory to write Tekton results
|
||||
|
||||
PASS=0; FAIL=0; TOTAL=0
|
||||
|
||||
assert() {
|
||||
NAME="$1"; EXPECT="$2"
|
||||
shift 2
|
||||
TOTAL=$((TOTAL + 1))
|
||||
CODE=$(curl -s -o /dev/null -w '%{http_code}' "$@" 2>/dev/null || echo "000")
|
||||
|
||||
if [ "$CODE" = "$EXPECT" ]; then
|
||||
echo " ✓ ${NAME} (${CODE})"
|
||||
PASS=$((PASS + 1))
|
||||
else
|
||||
echo " ✗ ${NAME} — expected ${EXPECT}, got ${CODE}"
|
||||
FAIL=$((FAIL + 1))
|
||||
fi
|
||||
}
|
||||
|
||||
# ── Wait for sidecar gateway ──
|
||||
echo "⏳ Waiting for gateway sidecar..."
|
||||
READY=false
|
||||
for i in $(seq 1 60); do
|
||||
CODE=$(curl -s -o /dev/null -w '%{http_code}' "${GW}/healthz" 2>/dev/null || echo "000")
|
||||
if [ "$CODE" = "200" ]; then
|
||||
sleep 1
|
||||
C2=$(curl -s -o /dev/null -w '%{http_code}' "${GW}/healthz" 2>/dev/null || echo "000")
|
||||
C3=$(curl -s -o /dev/null -w '%{http_code}' "${GW}/healthz" 2>/dev/null || echo "000")
|
||||
if [ "$C2" = "200" ] && [ "$C3" = "200" ]; then
|
||||
READY=true
|
||||
echo "✓ Gateway ready"
|
||||
break
|
||||
fi
|
||||
fi
|
||||
sleep 2
|
||||
done
|
||||
|
||||
if [ "$READY" = "false" ]; then
|
||||
echo "✗ Gateway never became ready"
|
||||
echo "fail" > "${RESULTS_DIR}/result"
|
||||
echo "0/0 gateway timeout" > "${RESULTS_DIR}/summary"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "═══ Integration Tests ═══"
|
||||
echo ""
|
||||
|
||||
# ── Health ──
|
||||
echo "▸ Health"
|
||||
assert "GET /healthz" 200 -X GET "${GW}/healthz"
|
||||
assert "GET /readyz" 200 -X GET "${GW}/readyz"
|
||||
|
||||
# ── Header validation ──
|
||||
echo "▸ Header validation"
|
||||
assert "X-Service without X-Resource → 400" 400 \
|
||||
-X GET -H "X-Service: memory" "${GW}/"
|
||||
assert "unknown service → 404" 404 \
|
||||
-X GET -H "X-Service: nonexistent" -H "X-Resource: foo" "${GW}/"
|
||||
|
||||
# ── S3 (no auth, MinIO rejects → 403) ──
|
||||
echo "▸ S3 service"
|
||||
assert "s3/list-objects" 403 \
|
||||
-X GET -H "X-Service: s3" -H "X-Resource: list-objects" "${GW}/"
|
||||
|
||||
# ── SQS (auth required → 401) ──
|
||||
echo "▸ SQS service"
|
||||
assert "sqs/list-queues" 401 \
|
||||
-X GET -H "X-Service: sqs" -H "X-Resource: list-queues" "${GW}/"
|
||||
|
||||
# ── Workflow (gRPC needs content-type → 400) ──
|
||||
echo "▸ Workflow service"
|
||||
assert "workflow/list (no grpc content-type → 400)" 400 \
|
||||
-X GET -H "X-Service: workflow" -H "X-Resource: list" "${GW}/"
|
||||
|
||||
echo ""
|
||||
echo "═══ Results: ${PASS}/${TOTAL} passed, ${FAIL} failed ═══"
|
||||
|
||||
if [ "$FAIL" -eq 0 ]; then
|
||||
echo "pass" > "${RESULTS_DIR}/result"
|
||||
else
|
||||
echo "fail" > "${RESULTS_DIR}/result"
|
||||
fi
|
||||
echo "${PASS}/${TOTAL} passed, ${FAIL} failed" > "${RESULTS_DIR}/summary"
|
||||
|
||||
[ "$FAIL" -eq 0 ]
|
||||
@@ -1,75 +0,0 @@
|
||||
apiVersion: tekton.dev/v1
|
||||
kind: Task
|
||||
metadata:
|
||||
name: integration-test
|
||||
namespace: api
|
||||
labels:
|
||||
app: api-gateway
|
||||
component: testing
|
||||
spec:
|
||||
description: >
|
||||
Spin up a gateway pod from the given image as a sidecar,
|
||||
run curl-based integration tests, report pass/fail.
|
||||
params:
|
||||
- name: image
|
||||
type: string
|
||||
description: "Container image to test (repo:tag)"
|
||||
- name: gateway-port
|
||||
type: string
|
||||
default: "8080"
|
||||
results:
|
||||
- name: result
|
||||
type: string
|
||||
- name: summary
|
||||
type: string
|
||||
|
||||
sidecars:
|
||||
- name: gateway
|
||||
image: $(params.image)
|
||||
env:
|
||||
- name: LISTEN_ADDR
|
||||
value: "0.0.0.0:$(params.gateway-port)"
|
||||
- name: CONFIG_PATH
|
||||
value: /etc/gateway/config.yaml
|
||||
- name: LOG_LEVEL
|
||||
value: info
|
||||
- name: AUTH_CLIENT_SECRET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: api-gw-client-secret
|
||||
key: client-secret
|
||||
optional: true
|
||||
volumeMounts:
|
||||
- name: gateway-config
|
||||
mountPath: /etc/gateway
|
||||
readOnly: true
|
||||
|
||||
steps:
|
||||
- name: run-tests
|
||||
image: curlimages/curl:8.13.0
|
||||
env:
|
||||
- name: GW
|
||||
value: "http://localhost:$(params.gateway-port)"
|
||||
- name: RESULTS_DIR
|
||||
value: /tekton/results
|
||||
command: ["sh", "/scripts/integration-test.sh"]
|
||||
volumeMounts:
|
||||
- name: test-script
|
||||
mountPath: /scripts
|
||||
readOnly: true
|
||||
computeResources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 64Mi
|
||||
limits:
|
||||
cpu: 200m
|
||||
memory: 128Mi
|
||||
|
||||
volumes:
|
||||
- name: gateway-config
|
||||
secret:
|
||||
secretName: api-gateway-config
|
||||
- name: test-script
|
||||
configMap:
|
||||
name: integration-test-script
|
||||
defaultMode: 0755
|
||||
Reference in New Issue
Block a user