homelab-frontend/tasks/7.2-sqs-prefix.md

# 7.2 — `/sqs/*` to kmsvc management-service and Kafka (GREEN)

Phase: 7 — Additional capability prefixes
Stage: GREEN
Depends on: Phase 6 (cutover) — done, confirmed live in-cluster

`management-service` already exposes gRPC at `kmsvc.riotpiao.com`. This prefix is a
NEW surface, not a replacement — that gRPC endpoint stays exactly as it is and nothing
here migrates off it.

- [ ] `/sqs/*` on `api.riotpiao.com` proxies to kmsvc `management-service` and the Kafka/Strimzi surfaces in the `sqs` namespace
- [ ] `kmsvc.riotpiao.com` is unchanged and still serving after this lands
- [ ] Which sub-paths map to which upstream is explicit in configuration; there is no catch-all fallback
- [ ] Timeouts and body caps are explicit per sub-route, with no silent defaults (G6)
- [ ] The route requires authentication and the token is checked for queue capability
- [ ] The NetworkPolicy is extended to reach only the named `sqs` upstreams
- [ ] `kmsvc-redis-master.sqs:6379` has NO authentication — `ALLOW_EMPTY_PASSWORD=yes`, TLS off. Any workload with network reach has full unauthenticated read/write. It is not proxied, and the NetworkPolicy must not grant the gateway egress to it
- [ ] `/v1/*` behaviour is unchanged before and after
- [ ] Metrics and rejection counters cover this route with its own route label

## Verify

```bash
curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/sqs/healthz
# expected: 401 without a token

curl -s -H "authorization: Bearer $QUEUE_TOKEN" https://api.riotpiao.com/sqs/healthz
# expected: management-service's own response, proxied unmodified

kubectl -n api get networkpolicy -o yaml | grep -c 6379
# expected: 0 — no egress path from the gateway to unauthenticated Redis

curl -s -o /dev/null -w '%{http_code}\n' https://kmsvc.riotpiao.com
# expected: unchanged from before this task — the existing gRPC surface is untouched
```