Admin Bot
139bc80529
BREAKING CHANGE: Gateway no longer validates JWTs at dispatcher level. Each upstream service (MinIO, Authentik, Temporal) validates bearer tokens independently. Gateway passes Authorization header through unchanged. Changes: - Removed JWT validation from Dispatcher - Removed internal/auth JWT validator usage - Added gRPC URL scheme detection (grpc://) - Added temporal-frontend with gRPC config (returns 501 not-implemented) - All adapters now auth: required: false (services validate own tokens) - Gateway is now a transparent routing layer, not auth gateway gRPC forwarding requires grpcproxy middleware (future Phase 9). For now, gRPC clients should connect directly to temporal-frontend:7233.
144 lines
3.9 KiB
YAML
144 lines
3.9 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: api-gateway-config
|
|
namespace: api
|
|
labels:
|
|
app: api-gateway
|
|
data:
|
|
config.yaml: |
|
|
# Gateway configuration - loaded at startup, never compiled in
|
|
# See REQUIREMENTS.md for full specification
|
|
|
|
# Routes: standard HTTP proxy routes (not LLM-specific)
|
|
# These are for non-LLM services (agent-pod/console, etc.)
|
|
routes: []
|
|
|
|
# Models: LLM model registry for body-based dispatch
|
|
# POST /v1/chat/completions routes based on the "model" field in request JSON
|
|
models:
|
|
- name: "reasoning"
|
|
address: "reasoning-predictor.llm-serving:80"
|
|
path: "/v1/chat/completions"
|
|
|
|
- name: "ornith:35b"
|
|
address: "ornith-predictor.llm-serving:80"
|
|
path: "/v1/chat/completions"
|
|
|
|
- name: "qwen2.5:3b-instruct"
|
|
address: "ornith-predictor.llm-serving:80"
|
|
path: "/v1/chat/completions"
|
|
|
|
- name: "nomic-ai/nomic-embed-text-v2-moe"
|
|
address: "embeddings-predictor.llm-serving:80"
|
|
path: "/v1/embeddings"
|
|
|
|
- name: "BAAI/bge-reranker-base"
|
|
address: "reranker-predictor.llm-serving:80"
|
|
path: "/v1/rerank"
|
|
|
|
# Service adapters for X-Service header routing
|
|
adapters:
|
|
- serviceName: sqs
|
|
upstream:
|
|
url: http://management-service.sqs.svc.cluster.local:9090
|
|
timeoutSeconds: 30
|
|
auth:
|
|
required: false
|
|
# Note: Services validate their own JWTs. Gateway is dumb pipe.
|
|
resources:
|
|
- name: send-message
|
|
methods:
|
|
- verb: POST
|
|
upstreamPath: /sqs/send
|
|
- name: receive-message
|
|
methods:
|
|
- verb: POST
|
|
upstreamPath: /sqs/receive
|
|
- name: list-queues
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /sqs/queues
|
|
|
|
- serviceName: workflow
|
|
upstream:
|
|
url: grpc://temporal-frontend.temporal.svc.cluster.local:7233
|
|
timeoutSeconds: 60
|
|
auth:
|
|
required: false
|
|
resources:
|
|
- name: execute
|
|
methods:
|
|
- verb: POST
|
|
upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ExecuteWorkflow
|
|
- name: describe
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/DescribeWorkflowExecution
|
|
- name: list
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ListWorkflowExecutions
|
|
|
|
- serviceName: memory
|
|
upstream:
|
|
url: http://poimen-memory.poimen.svc.cluster.local:8080
|
|
timeoutSeconds: 30
|
|
auth:
|
|
required: false
|
|
resources:
|
|
- name: query
|
|
methods:
|
|
- verb: POST
|
|
upstreamPath: /memory/query
|
|
- name: ingest
|
|
methods:
|
|
- verb: POST
|
|
upstreamPath: /memory/ingest
|
|
- name: skills
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /memory/skills
|
|
|
|
- serviceName: s3
|
|
upstream:
|
|
url: http://minio.storage.svc.cluster.local:9000
|
|
timeoutSeconds: 30
|
|
auth:
|
|
required: false
|
|
# MinIO validates bearer tokens independently
|
|
resources:
|
|
- name: list-objects
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /
|
|
- name: get-object
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /
|
|
- name: put-object
|
|
methods:
|
|
- verb: PUT
|
|
upstreamPath: /
|
|
|
|
- serviceName: iam
|
|
upstream:
|
|
url: http://authentik-server.iam.svc.cluster.local:80
|
|
timeoutSeconds: 30
|
|
auth:
|
|
required: false
|
|
# Authentik validates bearer tokens independently
|
|
resources:
|
|
- name: list-roles
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /api/v3/roles
|
|
- name: list-users
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /api/v3/users
|
|
- name: create-role
|
|
methods:
|
|
- verb: POST
|
|
upstreamPath: /api/v3/roles
|