Admin Bot
3188ce3e6a
CI / CI (pull_request) Successful in 2m57s
Also updates gateway-config-secret.enc.yaml with the same port fixes. NOTE: This file is currently in plaintext and should be encrypted with SOPS: export SOPS_AGE_RECIPIENTS=age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla sops --encrypt k8s/gateway-config-secret.enc.yaml As mentioned in the repo structure, this should be encrypted before merge to avoid exposing internal infrastructure details (service DNS names, upstream addresses, auth configuration) in the git history.
134 lines
3.7 KiB
YAML
134 lines
3.7 KiB
YAML
apiVersion: v1
|
|
kind: Secret
|
|
metadata:
|
|
name: api-gateway-config
|
|
namespace: api
|
|
labels:
|
|
app: api-gateway
|
|
type: Opaque
|
|
stringData:
|
|
config.yaml: |
|
|
auth:
|
|
enabled: true
|
|
issuer: "https://authentik.riotpiao.com/application/o/api-gw/"
|
|
audience: "api-gw"
|
|
jwksUrl: "http://authentik-server.iam.svc.cluster.local:9000/application/o/api-gw/jwks/"
|
|
requiredCapability: "llm:inference"
|
|
tokenUrl: "http://authentik-server.iam.svc.cluster.local:9000/application/o/token/"
|
|
clientId: "api-gw"
|
|
routes: []
|
|
models:
|
|
- name: "reasoning"
|
|
address: "reasoning-predictor.llm-serving:80"
|
|
path: "/v1/chat/completions"
|
|
- name: "ornith:35b"
|
|
address: "ornith-predictor.llm-serving:80"
|
|
path: "/v1/chat/completions"
|
|
- name: "qwen2.5:3b-instruct"
|
|
address: "qwen-cpu.llm-serving:80"
|
|
path: "/v1/chat/completions"
|
|
- name: "nomic-ai/nomic-embed-text-v2-moe"
|
|
address: "embeddings-predictor.llm-serving:80"
|
|
path: "/v1/embeddings"
|
|
- name: "BAAI/bge-reranker-base"
|
|
address: "reranker-predictor.llm-serving:80"
|
|
path: "/v1/rerank"
|
|
adapters:
|
|
- serviceName: sqs
|
|
upstream:
|
|
url: http://management-service.sqs.svc.cluster.local:9090
|
|
timeoutSeconds: 30
|
|
auth:
|
|
required: true
|
|
resources:
|
|
- name: send-message
|
|
methods:
|
|
- verb: POST
|
|
upstreamPath: /sqs/send
|
|
- name: receive-message
|
|
methods:
|
|
- verb: POST
|
|
upstreamPath: /sqs/receive
|
|
- name: list-queues
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /sqs/queues
|
|
- serviceName: workflow
|
|
upstream:
|
|
url: grpc://temporal-frontend.temporal.svc.cluster.local:7233
|
|
timeoutSeconds: 60
|
|
auth:
|
|
required: false
|
|
resources:
|
|
- name: execute
|
|
methods:
|
|
- verb: POST
|
|
upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ExecuteWorkflow
|
|
- name: describe
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/DescribeWorkflowExecution
|
|
- name: list
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ListWorkflowExecutions
|
|
- serviceName: memory
|
|
upstream:
|
|
url: http://poimen-memory.poimen.svc.cluster.local:8080
|
|
timeoutSeconds: 30
|
|
auth:
|
|
required: false
|
|
resources:
|
|
- name: query
|
|
methods:
|
|
- verb: POST
|
|
upstreamPath: /memory/query
|
|
- name: ingest
|
|
methods:
|
|
- verb: POST
|
|
upstreamPath: /memory/ingest
|
|
- name: skills
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /memory/skills
|
|
- serviceName: s3
|
|
upstream:
|
|
url: http://minio.storage.svc.cluster.local:80
|
|
timeoutSeconds: 30
|
|
auth:
|
|
required: false
|
|
resources:
|
|
- name: list-objects
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /
|
|
- name: get-object
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /
|
|
- name: put-object
|
|
methods:
|
|
- verb: PUT
|
|
upstreamPath: /
|
|
- serviceName: iam
|
|
upstream:
|
|
url: http://authentik-server.iam.svc.cluster.local:9000
|
|
timeoutSeconds: 30
|
|
auth:
|
|
required: false
|
|
resources:
|
|
- name: list-roles
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /api/v3/roles
|
|
- name: list-users
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /api/v3/users
|
|
- name: create-role
|
|
methods:
|
|
- verb: POST
|
|
upstreamPath: /api/v3/roles
|
|
# NOTE: This file should be encrypted with SOPS using the age key
|
|
# Command: sops --encrypt k8s/gateway-config-secret.enc.yaml
|