homelab-frontend/tasks/7.2-sqs-prefix.md

7.2 — /sqs/* to kmsvc management-service and Kafka (GREEN)

Phase: 7 — Additional capability prefixes Stage: GREEN Depends on: Phase 6 (cutover) — done, confirmed live in-cluster

management-service already exposes gRPC at kmsvc.riotpiao.com. This prefix is a NEW surface, not a replacement — that gRPC endpoint stays exactly as it is and nothing here migrates off it.

• /sqs/* on api.riotpiao.com proxies to kmsvc management-service and the Kafka/Strimzi surfaces in the sqs namespace
• kmsvc.riotpiao.com is unchanged and still serving after this lands
• Which sub-paths map to which upstream is explicit in configuration; there is no catch-all fallback
• Timeouts and body caps are explicit per sub-route, with no silent defaults (G6)
• The route requires authentication and the token is checked for queue capability
• The NetworkPolicy is extended to reach only the named sqs upstreams
• kmsvc-redis-master.sqs:6379 has NO authentication — ALLOW_EMPTY_PASSWORD=yes, TLS off. Any workload with network reach has full unauthenticated read/write. It is not proxied, and the NetworkPolicy must not grant the gateway egress to it
• /v1/* behaviour is unchanged before and after
• Metrics and rejection counters cover this route with its own route label

Verify

curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/sqs/healthz
# expected: 401 without a token

curl -s -H "authorization: Bearer $QUEUE_TOKEN" https://api.riotpiao.com/sqs/healthz
# expected: management-service's own response, proxied unmodified

kubectl -n api get networkpolicy -o yaml | grep -c 6379
# expected: 0 — no egress path from the gateway to unauthenticated Redis

curl -s -o /dev/null -w '%{http_code}\n' https://kmsvc.riotpiao.com
# expected: unchanged from before this task — the existing gRPC surface is untouched