chore: initial commit of Go API gateway

Baseline for the Kong replacement on api.riotpiao.com. Brings the working tree under version control for the first time: gateway source, the task board that drives the agent runs, test fixtures, and K8s manifests. Anchor the gateway ignore rule to the repo root. Unanchored, "gateway" also matched the cmd/gateway/ source directory, so the program entrypoint was excluded from every commit. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
2026-08-19 20:54:34 -07:00
commit 058f11cf2b
109 changed files with 8992 additions and 0 deletions
@@ -0,0 +1,45 @@
+# 6.6 — Kong teardown (REFACTOR)
+
+Phase: 6 — Deploy and cutover
+Stage: REFACTOR
+Depends on: [6.5](6.5-cutover.md)
+
+IRREVERSIBLE. Every step before this one could be undone in seconds by repointing
+Ingress `api/api` back to `kong-proxy:80`. Once the Kong Application is removed and
+Argo prunes the Helm release and its CRDs, that escape hatch is gone — recovery means
+reinstalling Kong from scratch and rebuilding six plugin CRs.
+
+Do not start until the soak after 6.5 has been clean for a deliberate, agreed period.
+
+Preconditions:
+
+- [ ] 6.5 is complete: `api.riotpiao.com` has been served entirely by the gateway through the soak, with no reverts
+- [ ] Gateway metrics over the soak show no elevated 5xx rate and no unexplained rejections
+- [ ] pi and every other known caller have been confirmed working against the gateway
+- [ ] The inventory has been re-verified immediately beforehand — Kong's config has been actively iterated
+
+Order matters. Delete the routing objects first, the Application last:
+
+- [ ] The 7 `ingressClassName: kong` Ingresses are deleted from git — 6 in `llm-serving`, 1 in `agent-pod` for `/console`, `/run`, `/sessions`
+- [ ] The 6 `KongPlugin` CRs are deleted from git: the three `llm-rewrite-*` chat rewrites, `llm-rewrite-rerank`, `llm-models-list`, and the cluster-wide `prometheus` plugin
+- [ ] Removing the cluster-wide `prometheus` plugin does not blind any dashboard, because 5.1 parity metrics are already being scraped from the gateway
+- [ ] The `kong` Application is then removed from `k8s/argocd/apps/55-api-gateway.yaml`
+- [ ] Argo prunes the Helm release, the Kong CRDs and the namespace leftovers on its own. No `helm uninstall`, no `kubectl delete` (G7)
+- [ ] Public traffic is verified unaffected after each deletion, not only at the end
+- [ ] No orphaned Kong CRDs, ReplicaSets or Services remain in namespace `api`
+
+## Verify
+
+```bash
+kubectl get ingress -A -o jsonpath='{range .items[*]}{.spec.ingressClassName}{"\n"}{end}' | sort | uniq -c
+# expected: no kong entries remain; nginx and istio counts unchanged
+
+kubectl get kongplugins -A 2>&1; kubectl -n argocd get app kong 2>&1
+# expected: CRD not found, and Application "kong" not found
+
+kubectl -n api get all | grep -i kong
+# expected: no output — nothing Kong-related left
+
+curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/v1/models
+# expected: 200, served by the gateway
+```