Admin Bot
55b32b97e0
PHASE 8 COMPLETE (10/10 tasks): - 8.2: X-Service/X-Resource dispatcher ✅ - 8.10: Phase gate - all 5 services routing ✅ Architecture decisions documented: - Gateway = dumb pipe (Option B) - SQS: gateway validates JWT (code unverified) - MinIO, Temporal: native JWT support - Memory, IAM: service-owned validation - ConfigMap-based config with Stakater Reloader - Real integration tests with cluster services PHASE 3 (Auth) TASKS CREATED (0/3 TODO): - 3.1: SQS JWT validation vs Authentik JWKS - 3.2: MinIO native JWT load-test - 3.3: Temporal JWT jwtKeyProvider configuration Updates: - tasks/8.2-x-service-dispatcher.md: marked GREEN - tasks/8.10-serviceadapter-gate.md: marked GREEN with notes - tasks/3.1-3.3: new Phase 3 auth tasks - tasks/INDEX.md: Phase 8 complete, Phase 3 active
50 lines
1.8 KiB
Markdown
50 lines
1.8 KiB
Markdown
# 8.10 — Phase 8 gate: every service on `ServiceAdapter` routing (GREEN)
|
|
|
|
Phase: 8 — ServiceAdapter routing rollout
|
|
Stage: GREEN ✅
|
|
Depends on: 8.1, 8.2, 8.3, 8.4, 8.5, 8.6, 8.7, 8.8
|
|
|
|
**Gate**: All 5 services (workflow, s3, sqs, iam, memory) now route via X-Service/X-Resource.
|
|
No hand-written path switches. Old routes deprecated. Ready for Phase 3 auth work.
|
|
|
|
- [x] 5 adapters defined in ConfigMap: workflow, s3, sqs, iam, memory
|
|
- [x] No CRs in cluster (decision: config over K8s API, Phase 8 used ConfigMap)
|
|
- [x] All services onboarded to X-Service/X-Resource dispatch
|
|
- [x] Schema validation integrated (8.3 DSL parser)
|
|
- [x] Real integration tests passing
|
|
- [x] `go test ./... -race`, `go vet ./...` passing
|
|
- [x] Old path-based routes deprecated (now 404)
|
|
|
|
## Verification (Done)
|
|
|
|
```bash
|
|
# ✅ 5 adapters in ConfigMap
|
|
kubectl get configmap api-gateway-config -n api -o yaml | grep serviceName
|
|
# sqs, workflow, memory, s3, iam
|
|
|
|
# ✅ Real integration tests
|
|
GATEWAY_URL=https://api.riotpiao.com go test -tags integration -v ./internal/serviceadapter
|
|
|
|
# ✅ Unknown service → 404
|
|
curl -H 'X-Service: nonexistent' https://api.riotpiao.com/
|
|
|
|
# ✅ Old path routes gone
|
|
curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/workflow/health
|
|
curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/sqs/healthz
|
|
curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/db/healthz
|
|
# All 404
|
|
|
|
# ✅ Go tests pass
|
|
go test ./... -race
|
|
go vet ./...
|
|
```
|
|
|
|
## Notes
|
|
|
|
- Architecture: ConfigMap config (not K8s CRs) drives adapter definitions
|
|
- Stakater Reloader auto-restarts pods on ConfigMap change
|
|
- Gateway is dumb pipe (Option B): services validate JWTs
|
|
- SQS special case: gateway checks Authorization header
|
|
- Phase 3: JWT signature validation in services
|
|
- Phase 9: gRPC proxying for Temporal
|