From 62e23d68764b62979eb7714c61df3d848707bcfd Mon Sep 17 00:00:00 2001 From: Admin Bot Date: Wed, 26 Aug 2026 16:47:15 -0700 Subject: [PATCH] chore: remove CRD, RBAC, and CR manifests (adapters now in ConfigMap) --- k8s/crd-serviceadapter.yaml | 161 ------------------------ k8s/kustomization.yaml | 2 - k8s/rbac.yaml | 45 ------- k8s/serviceadapter-memory-extended.yaml | 54 -------- 4 files changed, 262 deletions(-) delete mode 100644 k8s/crd-serviceadapter.yaml delete mode 100644 k8s/rbac.yaml delete mode 100644 k8s/serviceadapter-memory-extended.yaml diff --git a/k8s/crd-serviceadapter.yaml b/k8s/crd-serviceadapter.yaml deleted file mode 100644 index 0d6f4dc..0000000 --- a/k8s/crd-serviceadapter.yaml +++ /dev/null @@ -1,161 +0,0 @@ -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - name: serviceadapters.gateway.riotpiao.com -spec: - group: gateway.riotpiao.com - names: - kind: ServiceAdapter - plural: serviceadapters - singular: serviceadapter - scope: Namespaced - versions: - - name: v1 - served: true - storage: true - subresources: - status: {} - schema: - openAPIV3Schema: - type: object - description: ServiceAdapter describes a service exposed through the gateway. - properties: - apiVersion: - type: string - kind: - type: string - metadata: - type: object - spec: - type: object - description: ServiceAdapterSpec defines the desired state of ServiceAdapter. - required: - - serviceName - - upstream - - auth - - resources - properties: - serviceName: - type: string - description: ServiceName is the unique identifier for this service. - minLength: 1 - maxLength: 63 - upstream: - type: object - description: Upstream defines where to forward requests. - required: - - url - - timeoutSeconds - properties: - url: - type: string - description: URL is the upstream service endpoint. - minLength: 1 - timeoutSeconds: - type: integer - description: TimeoutSeconds is the request timeout in seconds. - minimum: 1 - maximum: 3600 - auth: - type: object - description: Auth defines default authentication for this adapter. - required: - - required - properties: - required: - type: boolean - description: Required indicates if authentication is needed. - capability: - type: string - description: Capability is the required capability name. - retryable: - type: boolean - description: Retryable indicates if requests can be retried on 5xx. - default: false - resources: - type: array - description: Resources are the endpoints exposed by this adapter. - minItems: 1 - items: - type: object - description: ServiceAdapterResource defines a resource. - required: - - name - - methods - properties: - name: - type: string - description: Name is the resource identifier. - minLength: 1 - methods: - type: array - description: Methods are the HTTP methods available. - minItems: 1 - items: - type: object - description: ServiceAdapterMethod defines a single method. - required: - - verb - - upstreamPath - properties: - verb: - type: string - description: Verb is the HTTP method. - enum: - - GET - - POST - - PUT - - DELETE - - PATCH - - HEAD - - OPTIONS - upstreamPath: - type: string - description: UpstreamPath is the path on upstream. - minLength: 1 - requestSchema: - type: string - description: RequestSchema validation DSL. - responseSchema: - type: string - description: ResponseSchema validation DSL. - auth: - type: object - description: Auth overrides resource-level auth. - properties: - required: - type: boolean - capability: - type: string - auth: - type: object - description: Auth applies to all methods unless overridden. - properties: - required: - type: boolean - capability: - type: string - status: - type: object - description: ServiceAdapterStatus defines observed state. - properties: - ready: - type: boolean - description: Ready indicates if adapter is loaded. - error: - type: string - description: Error message if adapter failed to load. - lastSyncTime: - type: string - format: date-time - description: LastSyncTime is when adapter was last synced. - additionalPrinterColumns: - - name: Service - type: string - jsonPath: .spec.serviceName - - name: Ready - type: boolean - jsonPath: .status.ready - - name: Age - type: date - jsonPath: .metadata.creationTimestamp diff --git a/k8s/kustomization.yaml b/k8s/kustomization.yaml index 9c99aea..539038f 100644 --- a/k8s/kustomization.yaml +++ b/k8s/kustomization.yaml @@ -4,8 +4,6 @@ kind: Kustomization namespace: api resources: -- crd-serviceadapter.yaml -- rbac.yaml - service.yaml - deployment.yaml - network-policy.yaml diff --git a/k8s/rbac.yaml b/k8s/rbac.yaml deleted file mode 100644 index 5afc7d6..0000000 --- a/k8s/rbac.yaml +++ /dev/null @@ -1,45 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: api-gateway - namespace: api - labels: - app: api-gateway ---- -# Role for ServiceAdapter CRD access (read-only, G2 supersession) -# Scoped to exactly: get, list, watch on serviceadapters in gateway.riotpiao.com/v1 -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: api-gateway-serviceadapter-reader - namespace: api - labels: - app: api-gateway -rules: -- apiGroups: - - gateway.riotpiao.com - resources: - - serviceadapters - verbs: - - get - - list - - watch ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: api-gateway-serviceadapter-reader - namespace: api - labels: - app: api-gateway -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: api-gateway-serviceadapter-reader -subjects: -- kind: ServiceAccount - name: api-gateway - namespace: api ---- -# No ClusterRole needed - the gateway has no k8s API access -# G2: The gateway holds no Kubernetes credentials (except read-only ServiceAdapter access above) diff --git a/k8s/serviceadapter-memory-extended.yaml b/k8s/serviceadapter-memory-extended.yaml deleted file mode 100644 index 25e8751..0000000 --- a/k8s/serviceadapter-memory-extended.yaml +++ /dev/null @@ -1,54 +0,0 @@ -apiVersion: gateway.riotpiao.com/v1 -kind: ServiceAdapter -metadata: - name: memory-extended - namespace: api -spec: - serviceName: memory-extended - upstream: - url: http://poimen-memory.poimen.svc.cluster.local:8080 - timeoutSeconds: 30 - auth: - required: true - capability: memory:read - retryable: true - resources: - # Extended: notes resource (M3.5.6+) - - name: notes - methods: - - verb: GET - upstreamPath: /memory/projects/{id}/notes - responseSchema: "items: object" - auth: - required: true - capability: memory:read - - # Extended: context resource (M3.7.7+, M3.7.8+) - - name: context - methods: - - verb: POST - upstreamPath: /memory/context - requestSchema: "tool: string" - responseSchema: "bundle: object" - auth: - required: true - capability: memory:read - - # Extended: git-aware lookups (M3.5.9) - - name: nodes - methods: - - verb: POST - upstreamPath: /memory/nodes/by-git - requestSchema: "repo: string, ref: string" - responseSchema: "nodes: array" - - verb: POST - upstreamPath: /memory/nodes/by-commit - requestSchema: "commit: string" - responseSchema: "nodes: array" - - verb: POST - upstreamPath: /memory/nodes/by-author - requestSchema: "author: string" - responseSchema: "nodes: array" - auth: - required: true - capability: memory:read