Story Crater Bot
3e4af746b0
Verified live: Authorization: Bearer <key> (what every OpenAI-SDK-compatible client sends, pi included) gets 401 from this Kong key-auth config. A raw apikey: <key> header succeeds. No such client lets you send a raw apikey header or customize the auth header name, so key-auth here was blocking 100% of real usage, not just an edge case. Comments out the model-key-auth KongPlugin and strips it from every route's konghq.com/plugins annotation in llm-routes.yaml. KongConsumer/secret stay defined so re-enabling later is cheap. Needs a real fix before going back on (e.g. a request-transformer that copies the Bearer token into an apikey header before key-auth runs) -- until then the model routes are unauthenticated.
46 lines
1.7 KiB
YAML
46 lines
1.7 KiB
YAML
# API auth layer — Kong key-auth on the model routes.
|
|
#
|
|
# TEMPORARILY RETIRED: verified live that Kong's key-auth here does not accept
|
|
# `Authorization: Bearer <key>` the way the comment below used to claim — a
|
|
# raw `apikey: <key>` header succeeds (200), the same request with only
|
|
# `Authorization: Bearer <key>` fails (401). No OpenAI-SDK-compatible client
|
|
# (pi included) sends a raw apikey header or lets you customize the header
|
|
# name, so every such client was hard-blocked. The KongPlugin below is
|
|
# commented out and every route's `konghq.com/plugins` annotation in
|
|
# llm-routes.yaml has `model-key-auth` stripped, so the model routes are
|
|
# unauthenticated for now. Re-enable once there's a Bearer-compatible fix
|
|
# (e.g. a request-transformer that copies the Bearer token into an `apikey`
|
|
# header before key-auth runs) — do not just uncomment this as-is, that
|
|
# reintroduces the exact block every real client hits.
|
|
#
|
|
# The key itself lives in the ksops-managed Secret model-invoke-apikey
|
|
# (labelled konghq.com/credential: key-auth) and is bound to the KongConsumer
|
|
# below, which stays defined (harmless without the plugin) so re-enabling
|
|
# later is a two-line uncomment instead of a rebuild.
|
|
---
|
|
apiVersion: configuration.konghq.com/v1
|
|
kind: KongConsumer
|
|
metadata:
|
|
name: model-invoker
|
|
namespace: api
|
|
annotations:
|
|
kubernetes.io/ingress.class: kong
|
|
username: model-invoker
|
|
credentials:
|
|
- model-invoke-apikey
|
|
# ---
|
|
# apiVersion: configuration.konghq.com/v1
|
|
# kind: KongPlugin
|
|
# metadata:
|
|
# name: model-key-auth
|
|
# namespace: llm-serving
|
|
# plugin: key-auth
|
|
# config:
|
|
# key_names:
|
|
# - apikey
|
|
# - authorization
|
|
# key_in_header: true
|
|
# key_in_query: false
|
|
# key_in_body: false
|
|
# hide_credentials: true
|