Admin Bot
55b32b97e0
PHASE 8 COMPLETE (10/10 tasks): - 8.2: X-Service/X-Resource dispatcher ✅ - 8.10: Phase gate - all 5 services routing ✅ Architecture decisions documented: - Gateway = dumb pipe (Option B) - SQS: gateway validates JWT (code unverified) - MinIO, Temporal: native JWT support - Memory, IAM: service-owned validation - ConfigMap-based config with Stakater Reloader - Real integration tests with cluster services PHASE 3 (Auth) TASKS CREATED (0/3 TODO): - 3.1: SQS JWT validation vs Authentik JWKS - 3.2: MinIO native JWT load-test - 3.3: Temporal JWT jwtKeyProvider configuration Updates: - tasks/8.2-x-service-dispatcher.md: marked GREEN - tasks/8.10-serviceadapter-gate.md: marked GREEN with notes - tasks/3.1-3.3: new Phase 3 auth tasks - tasks/INDEX.md: Phase 8 complete, Phase 3 active
2.1 KiB
2.1 KiB
8.2 — X-Service/X-Resource dispatcher (GREEN)
Phase: 8 — ServiceAdapter CRD rollout Stage: GREEN ✅ Depends on: 8.1 (CRD, in-memory registry)
Design contract: API_ROUTING_HYBRID_DESIGN.md §2, §4.
internal/server/router.goX-Service branch before path routing- Path-based routes (
/v1/chat/completions, etc.) unchanged - X-Service + X-Resource dispatch to adapter methods
- 404 for unknown services/resources
- Auth stub (SQS requires header, others pass-through)
- HTTP proxying with path rewriting
- gRPC detection (Temporal, Phase 9)
- Real integration tests
Future (not Phase 8.2):
- Blind 5xx retry with backoff (scope: internal/resilience)
- {id} path parameter resolution (scope: API design)
- Phase 3: JWT signature validation vs Authentik JWKS
Verification (Done)
# ✅ Unknown service → 404
curl -H 'X-Service: nonexistent' https://api.riotpiao.com/
# {"type":"about:blank#not-found","detail":"service 'nonexistent' not found"}
# ✅ Known service, unknown resource → 404
curl -H 'X-Service: sqs' -H 'X-Resource: invalid' https://api.riotpiao.com/
# {"type":"about:blank#not-found","detail":"resource 'invalid' not found"}
# ✅ Authorization header pass-through (MinIO, Temporal, Memory, IAM)
curl -H 'X-Service: s3' -H 'Authorization: Bearer token' https://api.riotpiao.com/
# Requests proxied with header intact
# ✅ SQS requires auth header
curl -H 'X-Service: sqs' https://api.riotpiao.com/
# {"type":"about:blank#forbidden","detail":"SQS requires Authorization header"}
# ✅ Real integration tests
GATEWAY_URL=https://api.riotpiao.com go test -tags integration -v ./internal/serviceadapter
Notes
- Router moved to dumb pipe (Option B): services validate JWTs independently
- SQS special case: Gateway checks header (code unverified, Phase 3 will validate signature)
- MinIO, Temporal: Native JWT support (dumb pipe pass-through)
- ConfigMap-based config, Stakater Reloader auto-restarts on changes
- 5 adapters: sqs, workflow (gRPC), memory, s3, iam