Story Crater BotandClaude Opus 5
058f11cf2b
Baseline for the Kong replacement on api.riotpiao.com. Brings the working tree under version control for the first time: gateway source, the task board that drives the agent runs, test fixtures, and K8s manifests. Anchor the gateway ignore rule to the repo root. Unanchored, "gateway" also matched the cmd/gateway/ source directory, so the program entrypoint was excluded from every commit. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
1.8 KiB
1.8 KiB
7.2 — /sqs/* to kmsvc management-service and Kafka (GREEN)
Phase: 7 — Additional capability prefixes Stage: GREEN Depends on: 6.5
management-service already exposes gRPC at kmsvc.riotpiao.com. This prefix is a
NEW surface, not a replacement — that gRPC endpoint stays exactly as it is and nothing
here migrates off it.
/sqs/*onapi.riotpiao.comproxies to kmsvcmanagement-serviceand the Kafka/Strimzi surfaces in thesqsnamespacekmsvc.riotpiao.comis unchanged and still serving after this lands- Which sub-paths map to which upstream is explicit in configuration; there is no catch-all fallback
- Timeouts and body caps are explicit per sub-route, with no silent defaults (G6)
- The route requires authentication and the token is checked for queue capability
- The NetworkPolicy is extended to reach only the named
sqsupstreams kmsvc-redis-master.sqs:6379has NO authentication —ALLOW_EMPTY_PASSWORD=yes, TLS off. Any workload with network reach has full unauthenticated read/write. It is not proxied, and the NetworkPolicy must not grant the gateway egress to it/v1/*behaviour is unchanged before and after- Metrics and rejection counters cover this route with its own route label
Verify
curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/sqs/healthz
# expected: 401 without a token
curl -s -H "authorization: Bearer $QUEUE_TOKEN" https://api.riotpiao.com/sqs/healthz
# expected: management-service's own response, proxied unmodified
kubectl -n api get networkpolicy -o yaml | grep -c 6379
# expected: 0 — no egress path from the gateway to unauthenticated Redis
curl -s -o /dev/null -w '%{http_code}\n' https://kmsvc.riotpiao.com
# expected: unchanged from before this task — the existing gRPC surface is untouched