Admin Bot
57d64039d5
- sqs, s3, memory: public APIs (auth not required) - memory: uses static API key internally, no JWT validation needed - iam: protected by JWT validation + iam:admin capability check - revoked tokens detected via JWKS key rotation (15min cache TTL)
129 lines
3.4 KiB
YAML
129 lines
3.4 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: api-gateway-config
|
|
namespace: api
|
|
labels:
|
|
app: api-gateway
|
|
data:
|
|
config.yaml: |
|
|
# Gateway configuration - loaded at startup, never compiled in
|
|
# See REQUIREMENTS.md for full specification
|
|
|
|
# Routes: standard HTTP proxy routes (not LLM-specific)
|
|
# These are for non-LLM services (agent-pod/console, etc.)
|
|
routes: []
|
|
|
|
# Models: LLM model registry for body-based dispatch
|
|
# POST /v1/chat/completions routes based on the "model" field in request JSON
|
|
models:
|
|
- name: "reasoning"
|
|
address: "reasoning-predictor.llm-serving:80"
|
|
path: "/v1/chat/completions"
|
|
|
|
- name: "ornith:35b"
|
|
address: "ornith-predictor.llm-serving:80"
|
|
path: "/v1/chat/completions"
|
|
|
|
- name: "qwen2.5:3b-instruct"
|
|
address: "ornith-predictor.llm-serving:80"
|
|
path: "/v1/chat/completions"
|
|
|
|
- name: "nomic-ai/nomic-embed-text-v2-moe"
|
|
address: "embeddings-predictor.llm-serving:80"
|
|
path: "/v1/embeddings"
|
|
|
|
- name: "BAAI/bge-reranker-base"
|
|
address: "reranker-predictor.llm-serving:80"
|
|
path: "/v1/rerank"
|
|
|
|
# Service adapters for X-Service header routing
|
|
adapters:
|
|
- serviceName: sqs
|
|
upstream:
|
|
url: http://management-service.sqs.svc.cluster.local:9090
|
|
timeoutSeconds: 30
|
|
auth:
|
|
required: false
|
|
resources:
|
|
- name: send-message
|
|
methods:
|
|
- verb: POST
|
|
upstreamPath: /sqs/send
|
|
- name: receive-message
|
|
methods:
|
|
- verb: POST
|
|
upstreamPath: /sqs/receive
|
|
- name: list-queues
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /sqs/queues
|
|
|
|
# NOTE: temporal-frontend (port 7233) is gRPC-only, not HTTP.
|
|
# External worker/SDK access is unresolved per homelab/project-usage/jwt-auth-rollout.md
|
|
# Disabled until a gRPC-capable ingress is added.
|
|
# - serviceName: workflow
|
|
# upstream:
|
|
# url: http://temporal-frontend.temporal.svc.cluster.local:7233
|
|
|
|
- serviceName: memory
|
|
upstream:
|
|
url: http://poimen-memory.poimen.svc.cluster.local:8080
|
|
timeoutSeconds: 30
|
|
auth:
|
|
required: false
|
|
resources:
|
|
- name: query
|
|
methods:
|
|
- verb: POST
|
|
upstreamPath: /memory/query
|
|
- name: ingest
|
|
methods:
|
|
- verb: POST
|
|
upstreamPath: /memory/ingest
|
|
- name: skills
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /memory/skills
|
|
|
|
- serviceName: s3
|
|
upstream:
|
|
url: http://minio.storage.svc.cluster.local:9000
|
|
timeoutSeconds: 30
|
|
auth:
|
|
required: false
|
|
resources:
|
|
- name: list-objects
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /
|
|
- name: get-object
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /
|
|
- name: put-object
|
|
methods:
|
|
- verb: PUT
|
|
upstreamPath: /
|
|
|
|
- serviceName: iam
|
|
upstream:
|
|
url: http://authentik-server.iam.svc.cluster.local:80
|
|
timeoutSeconds: 30
|
|
auth:
|
|
required: true
|
|
capability: "iam:admin"
|
|
resources:
|
|
- name: list-roles
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /api/v3/roles
|
|
- name: list-users
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /api/v3/users
|
|
- name: create-role
|
|
methods:
|
|
- verb: POST
|
|
upstreamPath: /api/v3/roles
|