riotpiao-poimen/homelab
2
0
Fork 0
Code Issues 23 Pull Requests 1 Actions Packages Projects 1 Releases Wiki Activity

fix(api): unbreak >10.6KB LLM requests and actually bind key-auth to the model routes

Browse Source 
Two independent bugs, both silent, both found while pointing an agent harness
at api.riotpiao.com.

1. Requests over ~10.6KB failed with HTTP 400
   {"error":{"message":"[] is too short - 'messages'"}}.

   The request-transformer plugin on the llm-chat-* routes rewrites the JSON
   body, which means it reads it via kong.request.get_body(). That returns
   nothing once nginx spills the body past client_body_buffer_size into a temp
   file, so the plugin re-serialized a body with no `messages` and the upstream
   rejected it. Measured on /v1/ornith/chat/completions: 10588 B -> 200,
   11088 B -> 400. Isolated by size-sweeping /v1/embeddings, the one route with
   no request-transformer, which passed an 18057 B body straight through to a
   semantic 413 from TEI.

   Raises the Kong http-block buffer to 16m. Any agent request carrying tool
   schemas clears the old ceiling in a single turn.

2. key-auth was never applied to any model route.

   The model-key-auth KongPlugin sat in namespace `api` while all five routes
   that annotate it live in `llm-serving`. The ingress controller resolves
   konghq.com/plugins against the annotated object's own namespace, so the
   reference dangled and the plugin never bound. Verified before the fix:
   unauthenticated GET /v1/models and POST /v1/ornith/chat/completions both
   returned 200. A dangling plugin reference fails open and logs nothing.

   Re-test both without a key after this syncs; expect 401.

Note for follow-up: llm-embeddings and llm-score carry no plugins annotation at
all, so they stay unauthenticated even after this change.

Co-Authored-By: Claude Opus 5 <[email protected]>
This commit is contained in:
Story Crater Bot
2026-08-13 21:34:50 -07:00
co-authored by Claude Opus 5
parent a118195b6f
commit 826a2acda3
2 changed files with 21 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8s/apps/api/model-auth.yaml
+10 -1
View File
@@ -24,11 +24,20 @@ credentials:
# `apikey` header; key_in_bearer accepts `Authorization: Bearer <key>` so any
# OpenAI-compatible SDK (api_key=..., base_url=https://api.riotpiao.com/v1) works
# unchanged.
#
# Namespace `llm-serving`, not `api`: the ingress controller resolves a
# `konghq.com/plugins` annotation against the annotated object's OWN namespace,
# and all five model routes in llm-routes.yaml live in llm-serving. While this
# sat in `api` the reference dangled, the plugin never bound, and every model
# route served traffic with no key at all — verified: an unauthenticated
# /v1/models and /v1/ornith/chat/completions both returned 200. A dangling
# plugin reference is silent; it fails open, so re-test without a key after any
# move rather than trusting that the object exists.
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
name: model-key-auth
namespace: api
namespace: llm-serving
plugin: key-auth
config:
key_names: