Admin Bot
55b32b97e0
PHASE 8 COMPLETE (10/10 tasks): - 8.2: X-Service/X-Resource dispatcher ✅ - 8.10: Phase gate - all 5 services routing ✅ Architecture decisions documented: - Gateway = dumb pipe (Option B) - SQS: gateway validates JWT (code unverified) - MinIO, Temporal: native JWT support - Memory, IAM: service-owned validation - ConfigMap-based config with Stakater Reloader - Real integration tests with cluster services PHASE 3 (Auth) TASKS CREATED (0/3 TODO): - 3.1: SQS JWT validation vs Authentik JWKS - 3.2: MinIO native JWT load-test - 3.3: Temporal JWT jwtKeyProvider configuration Updates: - tasks/8.2-x-service-dispatcher.md: marked GREEN - tasks/8.10-serviceadapter-gate.md: marked GREEN with notes - tasks/3.1-3.3: new Phase 3 auth tasks - tasks/INDEX.md: Phase 8 complete, Phase 3 active
1.8 KiB
1.8 KiB
8.10 — Phase 8 gate: every service on ServiceAdapter routing (GREEN)
Phase: 8 — ServiceAdapter routing rollout Stage: GREEN ✅ Depends on: 8.1, 8.2, 8.3, 8.4, 8.5, 8.6, 8.7, 8.8
Gate: All 5 services (workflow, s3, sqs, iam, memory) now route via X-Service/X-Resource. No hand-written path switches. Old routes deprecated. Ready for Phase 3 auth work.
- 5 adapters defined in ConfigMap: workflow, s3, sqs, iam, memory
- No CRs in cluster (decision: config over K8s API, Phase 8 used ConfigMap)
- All services onboarded to X-Service/X-Resource dispatch
- Schema validation integrated (8.3 DSL parser)
- Real integration tests passing
go test ./... -race,go vet ./...passing- Old path-based routes deprecated (now 404)
Verification (Done)
# ✅ 5 adapters in ConfigMap
kubectl get configmap api-gateway-config -n api -o yaml | grep serviceName
# sqs, workflow, memory, s3, iam
# ✅ Real integration tests
GATEWAY_URL=https://api.riotpiao.com go test -tags integration -v ./internal/serviceadapter
# ✅ Unknown service → 404
curl -H 'X-Service: nonexistent' https://api.riotpiao.com/
# ✅ Old path routes gone
curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/workflow/health
curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/sqs/healthz
curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/db/healthz
# All 404
# ✅ Go tests pass
go test ./... -race
go vet ./...
Notes
- Architecture: ConfigMap config (not K8s CRs) drives adapter definitions
- Stakater Reloader auto-restarts pods on ConfigMap change
- Gateway is dumb pipe (Option B): services validate JWTs
- SQS special case: gateway checks Authorization header
- Phase 3: JWT signature validation in services
- Phase 9: gRPC proxying for Temporal