36 lines
1.9 KiB
Markdown
36 lines
1.9 KiB
Markdown
# 7.2 — `/sqs/*` to kmsvc management-service and Kafka (GREEN)
|
|
|
|
Phase: 7 — Additional capability prefixes
|
|
Stage: GREEN
|
|
Depends on: Phase 6 (cutover) — done, confirmed live in-cluster
|
|
|
|
`management-service` already exposes gRPC at `kmsvc.riotpiao.com`. This prefix is a
|
|
NEW surface, not a replacement — that gRPC endpoint stays exactly as it is and nothing
|
|
here migrates off it.
|
|
|
|
- [ ] `/sqs/*` on `api.riotpiao.com` proxies to kmsvc `management-service` and the Kafka/Strimzi surfaces in the `sqs` namespace
|
|
- [ ] `kmsvc.riotpiao.com` is unchanged and still serving after this lands
|
|
- [ ] Which sub-paths map to which upstream is explicit in configuration; there is no catch-all fallback
|
|
- [ ] Timeouts and body caps are explicit per sub-route, with no silent defaults (G6)
|
|
- [ ] The route requires authentication and the token is checked for queue capability
|
|
- [ ] The NetworkPolicy is extended to reach only the named `sqs` upstreams
|
|
- [ ] `kmsvc-redis-master.sqs:6379` has NO authentication — `ALLOW_EMPTY_PASSWORD=yes`, TLS off. Any workload with network reach has full unauthenticated read/write. It is not proxied, and the NetworkPolicy must not grant the gateway egress to it
|
|
- [ ] `/v1/*` behaviour is unchanged before and after
|
|
- [ ] Metrics and rejection counters cover this route with its own route label
|
|
|
|
## Verify
|
|
|
|
```bash
|
|
curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/sqs/healthz
|
|
# expected: 401 without a token
|
|
|
|
curl -s -H "authorization: Bearer $QUEUE_TOKEN" https://api.riotpiao.com/sqs/healthz
|
|
# expected: management-service's own response, proxied unmodified
|
|
|
|
kubectl -n api get networkpolicy -o yaml | grep -c 6379
|
|
# expected: 0 — no egress path from the gateway to unauthenticated Redis
|
|
|
|
curl -s -o /dev/null -w '%{http_code}\n' https://kmsvc.riotpiao.com
|
|
# expected: unchanged from before this task — the existing gRPC surface is untouched
|
|
```
|