fix(agent-pod): remote tui session for multi-agent

2026-08-18 15:08:04 -07:00
parent 0fe3d25936
commit afb9b35292
34 changed files with 1874 additions and 27 deletions
@@ -0,0 +1,49 @@
+# API auth layer — Kong key-auth on the model routes.
+#
+# The model API (api.riotpiao.com/v1/...) requires a static API key, presented
+# OpenAI-style as `Authorization: Bearer <key>` (or `apikey: <key>`). The key
+# lives in the ksops-managed Secret model-invoke-apikey (labelled
+# konghq.com/credential: key-auth) and is bound to the KongConsumer below.
+#
+# Issue the key to rock; use it as the OpenAI SDK api_key. Rotate by updating the
+# ksops secret. This is self-contained in Kong — the invoke path does not depend
+# on an Authentik token (Authentik still fronts every *human* dashboard SSO).
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongConsumer
+metadata:
+  name: model-invoker
+  namespace: api
+  annotations:
+    kubernetes.io/ingress.class: kong
+username: model-invoker
+credentials:
+  - model-invoke-apikey
+---
+# key-auth: require the API key on the model routes. key_in_header accepts the
+# `apikey` header; key_in_bearer accepts `Authorization: Bearer <key>` so any
+# OpenAI-compatible SDK (api_key=..., base_url=https://api.riotpiao.com/v1) works
+# unchanged.
+#
+# Namespace `llm-serving`, not `api`: the ingress controller resolves a
+# `konghq.com/plugins` annotation against the annotated object's OWN namespace,
+# and all five model routes in llm-routes.yaml live in llm-serving. While this
+# sat in `api` the reference dangled, the plugin never bound, and every model
+# route served traffic with no key at all — verified: an unauthenticated
+# /v1/models and /v1/ornith/chat/completions both returned 200. A dangling
+# plugin reference is silent; it fails open, so re-test without a key after any
+# move rather than trusting that the object exists.
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: model-key-auth
+  namespace: llm-serving
+plugin: key-auth
+config:
+  key_names:
+    - apikey
+    - authorization
+  key_in_header: true
+  key_in_query: false
+  key_in_body: false
+  hide_credentials: true