Admin Bot
95045e80f6
Auth strategy clarified per service: - SQS: Gateway validates JWT (kmsvc code unverified, needs Phase 3) - MinIO: Native JWT/OIDC support (validates itself, Phase 3: load-test) - Temporal: Native JWT via jwtKeyProvider (Phase 3: configure) - Memory, IAM: Services validate JWTs (dumb pipe) SQS now requires Authorization header at gateway. Phase 3 will implement actual JWT signature validation against Authentik.
148 lines
4.1 KiB
YAML
148 lines
4.1 KiB
YAML
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: api-gateway-config
|
|
namespace: api
|
|
labels:
|
|
app: api-gateway
|
|
data:
|
|
config.yaml: |
|
|
# Gateway configuration - loaded at startup, never compiled in
|
|
# See REQUIREMENTS.md for full specification
|
|
|
|
# Routes: standard HTTP proxy routes (not LLM-specific)
|
|
# These are for non-LLM services (agent-pod/console, etc.)
|
|
routes: []
|
|
|
|
# Models: LLM model registry for body-based dispatch
|
|
# POST /v1/chat/completions routes based on the "model" field in request JSON
|
|
models:
|
|
- name: "reasoning"
|
|
address: "reasoning-predictor.llm-serving:80"
|
|
path: "/v1/chat/completions"
|
|
|
|
- name: "ornith:35b"
|
|
address: "ornith-predictor.llm-serving:80"
|
|
path: "/v1/chat/completions"
|
|
|
|
- name: "qwen2.5:3b-instruct"
|
|
address: "ornith-predictor.llm-serving:80"
|
|
path: "/v1/chat/completions"
|
|
|
|
- name: "nomic-ai/nomic-embed-text-v2-moe"
|
|
address: "embeddings-predictor.llm-serving:80"
|
|
path: "/v1/embeddings"
|
|
|
|
- name: "BAAI/bge-reranker-base"
|
|
address: "reranker-predictor.llm-serving:80"
|
|
path: "/v1/rerank"
|
|
|
|
# Service adapters for X-Service header routing
|
|
adapters:
|
|
- serviceName: sqs
|
|
upstream:
|
|
url: http://management-service.sqs.svc.cluster.local:9090
|
|
timeoutSeconds: 30
|
|
auth:
|
|
required: true
|
|
# Gateway validates (kmsvc JWT validation code unverified)
|
|
# TODO: Phase 3 - validate JWT signature against Authentik JWKS
|
|
resources:
|
|
- name: send-message
|
|
methods:
|
|
- verb: POST
|
|
upstreamPath: /sqs/send
|
|
- name: receive-message
|
|
methods:
|
|
- verb: POST
|
|
upstreamPath: /sqs/receive
|
|
- name: list-queues
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /sqs/queues
|
|
|
|
- serviceName: workflow
|
|
upstream:
|
|
url: grpc://temporal-frontend.temporal.svc.cluster.local:7233
|
|
timeoutSeconds: 60
|
|
auth:
|
|
required: false
|
|
# Temporal has native JWT support via jwtKeyProvider
|
|
# Phase 3: configure and test Temporal JWT validation
|
|
resources:
|
|
- name: execute
|
|
methods:
|
|
- verb: POST
|
|
upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ExecuteWorkflow
|
|
- name: describe
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/DescribeWorkflowExecution
|
|
- name: list
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /temporal.api.workflowservice.v1.WorkflowService/ListWorkflowExecutions
|
|
|
|
- serviceName: memory
|
|
upstream:
|
|
url: http://poimen-memory.poimen.svc.cluster.local:8080
|
|
timeoutSeconds: 30
|
|
auth:
|
|
required: false
|
|
resources:
|
|
- name: query
|
|
methods:
|
|
- verb: POST
|
|
upstreamPath: /memory/query
|
|
- name: ingest
|
|
methods:
|
|
- verb: POST
|
|
upstreamPath: /memory/ingest
|
|
- name: skills
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /memory/skills
|
|
|
|
- serviceName: s3
|
|
upstream:
|
|
url: http://minio.storage.svc.cluster.local:9000
|
|
timeoutSeconds: 30
|
|
auth:
|
|
required: false
|
|
# MinIO has native JWT/OIDC support - validates JWTs itself
|
|
# Phase 3: load-test MinIO JWT validation
|
|
resources:
|
|
- name: list-objects
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /
|
|
- name: get-object
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /
|
|
- name: put-object
|
|
methods:
|
|
- verb: PUT
|
|
upstreamPath: /
|
|
|
|
- serviceName: iam
|
|
upstream:
|
|
url: http://authentik-server.iam.svc.cluster.local:80
|
|
timeoutSeconds: 30
|
|
auth:
|
|
required: false
|
|
# Authentik validates bearer tokens independently
|
|
resources:
|
|
- name: list-roles
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /api/v3/roles
|
|
- name: list-users
|
|
methods:
|
|
- verb: GET
|
|
upstreamPath: /api/v3/users
|
|
- name: create-role
|
|
methods:
|
|
- verb: POST
|
|
upstreamPath: /api/v3/roles
|