20 Commits

Include renames

Author	SHA1	Message	Date
Admin Bot	95045e80f6	fix: SQS gateway JWT validation, MinIO/Temporal native JWT support ... Auth strategy clarified per service: - SQS: Gateway validates JWT (kmsvc code unverified, needs Phase 3) - MinIO: Native JWT/OIDC support (validates itself, Phase 3: load-test) - Temporal: Native JWT via jwtKeyProvider (Phase 3: configure) - Memory, IAM: Services validate JWTs (dumb pipe) SQS now requires Authorization header at gateway. Phase 3 will implement actual JWT signature validation against Authentik.	2026-08-27 11:33:04 -07:00
Admin Bot	139bc80529	refactor: dispatcher as dumb pipe + add gRPC detection for Temporal ... BREAKING CHANGE: Gateway no longer validates JWTs at dispatcher level. Each upstream service (MinIO, Authentik, Temporal) validates bearer tokens independently. Gateway passes Authorization header through unchanged. Changes: - Removed JWT validation from Dispatcher - Removed internal/auth JWT validator usage - Added gRPC URL scheme detection (grpc://) - Added temporal-frontend with gRPC config (returns 501 not-implemented) - All adapters now auth: required: false (services validate own tokens) - Gateway is now a transparent routing layer, not auth gateway gRPC forwarding requires grpcproxy middleware (future Phase 9). For now, gRPC clients should connect directly to temporal-frontend:7233.	2026-08-27 11:16:15 -07:00
Admin Bot	57d64039d5	config: set memory to public (no JWT required), only iam protected ... - sqs, s3, memory: public APIs (auth not required) - memory: uses static API key internally, no JWT validation needed - iam: protected by JWT validation + iam:admin capability check - revoked tokens detected via JWKS key rotation (15min cache TTL)	2026-08-27 11:11:37 -07:00
Admin Bot	46dc24a26c	fix: remove workflow adapter (temporal-frontend is gRPC-only, not HTTP) ... Per homelab/project-usage/jwt-auth-rollout.md, temporal-frontend (port 7233) is gRPC-specific for workers/SDKs. External HTTP access is unresolved design. Disabled until gRPC ingress is added. Keeps only: sqs, memory, s3, iam.	2026-08-27 09:48:46 -07:00
Admin Bot	e7536a80ce	fix: correct SQS port from 8080 to 9090	2026-08-27 09:07:12 -07:00
Admin Bot	f4193fe6e1	fix: correct service names in adapter upstreams (management-service.sqs, minio.storage, authentik-server.iam)	2026-08-27 09:03:58 -07:00
Admin Bot	50503445f7	fix: add serviceaccount manifest (was in deleted rbac.yaml)	2026-08-26 19:49:11 -07:00
Admin Bot	62e23d6876	chore: remove CRD, RBAC, and CR manifests (adapters now in ConfigMap)	2026-08-26 16:47:15 -07:00
Admin Bot	81e228e818	feat: add stakater reloader annotation for configmap auto-reload	2026-08-26 16:41:42 -07:00
Admin Bot	9c5fb0ce84	feat: load service adapters from ConfigMap, remove k8s API dependency ... Adapters defined in config.yaml alongside routes and models. Parsed by existing config loader, populated into registry at startup. Removed: client-go deps, REST loader, informer, nginx proxy, CiliumNetworkPolicy, apis/gateway/v1/ (duplicate types). Kept: merged CI pipeline, imagePullPolicy Always, CA certs in Dockerfile.	2026-08-26 16:39:30 -07:00
Admin Bot	951a4399d6	feat: unblock 8.9 memory adapter extended (all 33 tasks GREEN)	2026-08-26 13:54:23 -07:00
Admin Bot	425611ec42	feat: phase 8 serviceadapter crd rollout (32/33 tasks)	2026-08-26 13:47:36 -07:00
Story Crater Bot	9740334d24	ci(main): push latest tag on main commits, auto-deploy via kustomization	2026-08-21 20:56:47 -07:00
Story Crater Bot	a949707aaf	deploy: bump gateway to v0.1.1 with llm-client label	2026-08-20 00:10:27 -07:00
Story Crater Bot	2aabd4288b	fix: label gateway pods llm-client=true so upstreams accept them ... llm-serving-default-deny admits only llm-client=true pods on 8080; without the label every dispatch timed out with 502.	2026-08-20 00:06:23 -07:00
Story Crater Bot	500eb74577	fix: match namespaces by kubernetes.io/metadata.name in netpol egress ... kube-system and llm-serving carry only the automatic label, so DNS and upstream egress matched nothing and every dispatch failed with 502.	2026-08-20 00:04:17 -07:00
Story Crater Bot	d7362985f9	deploy: bump gateway image to v0.1.0	2026-08-19 23:57:21 -07:00
Story Crater Bot	fd45c2c0d3	deploy: pin gateway image to v0.0.0	2026-08-19 22:50:03 -07:00
Story Crater Bot	b0ce2fb67c	feat: build and publish the gateway image via Forgejo Actions ... - Dockerfile: multi-stage, distroless nonroot, CGO_ENABLED=0 static, commit SHA stamped via VERSION build arg. - .forgejo/workflows/ci.yaml: Forgejo reads .forgejo/, not .github/, and the runner declares only the "docker" label. Verify job on every push; image build and push gated to main. - Drop .github/workflows/ci.yml — this remote is Forgejo, so it never ran. - deployment.yaml: image from the Forgejo registry, forgejo-registry pull secret, runAsUser 65532 to match distroless nonroot. - kustomization.yaml: pin the tag in one place. Promoting a build is a one-line newTag bump, never :latest.	2026-08-19 21:48:11 -07:00
Story Crater BotandClaude Opus 5	058f11cf2b	chore: initial commit of Go API gateway ... Baseline for the Kong replacement on api.riotpiao.com. Brings the working tree under version control for the first time: gateway source, the task board that drives the agent runs, test fixtures, and K8s manifests. Anchor the gateway ignore rule to the repo root. Unanchored, "gateway" also matched the cmd/gateway/ source directory, so the program entrypoint was excluded from every commit. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>	2026-08-19 20:54:34 -07:00