chore: initial commit of Go API gateway

Baseline for the Kong replacement on api.riotpiao.com. Brings the working tree under version control for the first time: gateway source, the task board that drives the agent runs, test fixtures, and K8s manifests. Anchor the gateway ignore rule to the repo root. Unanchored, "gateway" also matched the cmd/gateway/ source directory, so the program entrypoint was excluded from every commit. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
2026-08-19 20:54:34 -07:00
commit 058f11cf2b
109 changed files with 8992 additions and 0 deletions
@@ -0,0 +1,35 @@
+# 7.2 — `/sqs/*` to kmsvc management-service and Kafka (GREEN)
+
+Phase: 7 — Additional capability prefixes
+Stage: GREEN
+Depends on: [6.5](6.5-cutover.md)
+
+`management-service` already exposes gRPC at `kmsvc.riotpiao.com`. This prefix is a
+NEW surface, not a replacement — that gRPC endpoint stays exactly as it is and nothing
+here migrates off it.
+
+- [ ] `/sqs/*` on `api.riotpiao.com` proxies to kmsvc `management-service` and the Kafka/Strimzi surfaces in the `sqs` namespace
+- [ ] `kmsvc.riotpiao.com` is unchanged and still serving after this lands
+- [ ] Which sub-paths map to which upstream is explicit in configuration; there is no catch-all fallback
+- [ ] Timeouts and body caps are explicit per sub-route, with no silent defaults (G6)
+- [ ] The route requires authentication and the token is checked for queue capability
+- [ ] The NetworkPolicy is extended to reach only the named `sqs` upstreams
+- [ ] `kmsvc-redis-master.sqs:6379` has NO authentication — `ALLOW_EMPTY_PASSWORD=yes`, TLS off. Any workload with network reach has full unauthenticated read/write. It is not proxied, and the NetworkPolicy must not grant the gateway egress to it
+- [ ] `/v1/*` behaviour is unchanged before and after
+- [ ] Metrics and rejection counters cover this route with its own route label
+
+## Verify
+
+```bash
+curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/sqs/healthz
+# expected: 401 without a token
+
+curl -s -H "authorization: Bearer $QUEUE_TOKEN" https://api.riotpiao.com/sqs/healthz
+# expected: management-service's own response, proxied unmodified
+
+kubectl -n api get networkpolicy -o yaml | grep -c 6379
+# expected: 0 — no egress path from the gateway to unauthenticated Redis
+
+curl -s -o /dev/null -w '%{http_code}\n' https://kmsvc.riotpiao.com
+# expected: unchanged from before this task — the existing gRPC surface is untouched
+```