From 8fa5053aef815746f562a3ef32c259ef1866e7ef Mon Sep 17 00:00:00 2001 From: rock Date: Mon, 14 Sep 2026 08:09:26 +0900 Subject: [PATCH] fix: allow paperless direct LLM access, bypass gateway JWT - Add paperless namespace to llm-serving NetworkPolicy ingress - Point paperless-ai CUSTOM_BASE_URL to reasoning-predictor directly - Gateway JWT auth not yet available for service accounts - paperless-ai-agent has llm:inference role in Authentik --- k8s/apps/llm-serving/networkpolicy.yaml | 14 ++++++++++++++ k8s/apps/paperless/paperless-ai.yaml | 2 +- 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/k8s/apps/llm-serving/networkpolicy.yaml b/k8s/apps/llm-serving/networkpolicy.yaml index 7255782..d403e60 100644 --- a/k8s/apps/llm-serving/networkpolicy.yaml +++ b/k8s/apps/llm-serving/networkpolicy.yaml @@ -52,6 +52,20 @@ spec: port: 8080 - protocol: TCP port: 9000 + # Allow from paperless namespace (paperless-ai auto-tagging) + # Bypasses gateway until service-account JWT token exchange is implemented. + # paperless-ai-agent has llm:inference role in Authentik. + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: paperless + ports: + - protocol: TCP + port: 8080 + - protocol: TCP + port: 80 + - protocol: TCP + port: 8000 # Allow intra-namespace (pod-to-pod within llm-serving) - from: - podSelector: diff --git a/k8s/apps/paperless/paperless-ai.yaml b/k8s/apps/paperless/paperless-ai.yaml index add4d26..ea6b975 100644 --- a/k8s/apps/paperless/paperless-ai.yaml +++ b/k8s/apps/paperless/paperless-ai.yaml @@ -39,7 +39,7 @@ spec: - name: AI_PROVIDER value: "custom" - name: CUSTOM_BASE_URL - value: "http://api-gateway.api.svc.cluster.local:8080/v1" + value: "http://reasoning-predictor.llm-serving.svc.cluster.local:80/v1" - name: CUSTOM_API_KEY value: "not-required" - name: CUSTOM_MODEL