34 lines
1.8 KiB
Markdown
34 lines
1.8 KiB
Markdown
|
# 3.4 — Flag-gated auth rollout (GREEN)
|
||
|
|
|
||
|
|
Phase: 3 — Authentication
|
||
|
|
Stage: GREEN
|
||
|
|
Depends on: [3.2](3.2-bearer-validation.md)
|
||
|
|
|
||
|
|
- [ ] Authentication is controlled by an explicit flag in configuration, and its default is OFF
|
||
|
|
- [ ] With the flag off, every route answers exactly as it did before Phase 3 existed — no 401s, no `WWW-Authenticate`, no behaviour change
|
||
|
|
- [ ] With the flag on, protected routes require `Authorization: Bearer` and reject anything else with 401
|
||
|
|
- [ ] `GET /healthz` and `GET /readyz` never require authentication in either state
|
||
|
|
- [ ] Which routes are protected is per-route configuration, so auth can be turned on for one surface at a time
|
||
|
|
- [ ] Turning the flag on is a git change synced by Argo; it is never toggled by hand against the cluster
|
||
|
|
- [ ] The flag's current state is visible in logs at startup and in metrics, so nobody has to guess whether auth is on
|
||
|
|
- [ ] Turning the flag off again fully restores unauthenticated access, making the rollout reversible
|
||
|
|
|
||
|
|
The model API is unauthenticated today — verified live, a request with no credentials
|
||
|
|
returns 200. Enabling this flag breaks every current caller until they hold a token,
|
||
|
|
pi included. That is why it defaults off and is enabled deliberately, after
|
||
|
|
[3.6](3.6-pi-client-migration.md).
|
||
|
|
|
||
|
|
## Verify
|
||
|
|
|
||
|
|
```bash
|
||
|
|
# flag off
|
||
|
|
curl -s -o /dev/null -w '%{http_code}\n' localhost:8080/v1/models # expected: 200
|
||
|
|
curl -s -o /dev/null -w '%{http_code}\n' localhost:8080/v1/chat/completions \
|
||
|
|
-H 'content-type: application/json' -d '{"model":"reasoning","messages":[]}' # expected: 200
|
||
|
|
|
||
|
|
# flag on, no credentials
|
||
|
|
curl -s -o /dev/null -w '%{http_code}\n' localhost:8080/v1/chat/completions \
|
||
|
|
-H 'content-type: application/json' -d '{"model":"reasoning","messages":[]}' # expected: 401
|
||
|
|
curl -s -o /dev/null -w '%{http_code}\n' localhost:8080/healthz # expected: 200
|
||
|
|
```
|