Story Crater Bot
e6ada95b39
Kong key-auth rejected the Authorization: Bearer header every OpenAI-SDK-compatible client sends (verified: raw apikey header works, Bearer doesn't), so it's commented out and stripped from every llm-routes.yaml annotation until there's a Bearer-compatible fix. agent-pod now clones and builds the agent-manager fork from source at container start (no prebuilt binary shipped -- wrong arch and over ConfigMap's size cap) and ships coordinator.js alongside hub.js, so multiple repos can run the pipeline concurrently in one pod via kubectl exec. hub.js keeps its existing role as the container's foreground process, unchanged.
46 lines
1.7 KiB
YAML
46 lines
1.7 KiB
YAML
# API auth layer — Kong key-auth on the model routes.
|
|
#
|
|
# TEMPORARILY RETIRED: verified live that Kong's key-auth here does not accept
|
|
# `Authorization: Bearer <key>` the way the comment below used to claim — a
|
|
# raw `apikey: <key>` header succeeds (200), the same request with only
|
|
# `Authorization: Bearer <key>` fails (401). No OpenAI-SDK-compatible client
|
|
# (pi included) sends a raw apikey header or lets you customize the header
|
|
# name, so every such client was hard-blocked. The KongPlugin below is
|
|
# commented out and every route's `konghq.com/plugins` annotation in
|
|
# llm-routes.yaml has `model-key-auth` stripped, so the model routes are
|
|
# unauthenticated for now. Re-enable once there's a Bearer-compatible fix
|
|
# (e.g. a request-transformer that copies the Bearer token into an `apikey`
|
|
# header before key-auth runs) — do not just uncomment this as-is, that
|
|
# reintroduces the exact block every real client hits.
|
|
#
|
|
# The key itself lives in the ksops-managed Secret model-invoke-apikey
|
|
# (labelled konghq.com/credential: key-auth) and is bound to the KongConsumer
|
|
# below, which stays defined (harmless without the plugin) so re-enabling
|
|
# later is a two-line uncomment instead of a rebuild.
|
|
---
|
|
apiVersion: configuration.konghq.com/v1
|
|
kind: KongConsumer
|
|
metadata:
|
|
name: model-invoker
|
|
namespace: api
|
|
annotations:
|
|
kubernetes.io/ingress.class: kong
|
|
username: model-invoker
|
|
credentials:
|
|
- model-invoke-apikey
|
|
# ---
|
|
# apiVersion: configuration.konghq.com/v1
|
|
# kind: KongPlugin
|
|
# metadata:
|
|
# name: model-key-auth
|
|
# namespace: llm-serving
|
|
# plugin: key-auth
|
|
# config:
|
|
# key_names:
|
|
# - apikey
|
|
# - authorization
|
|
# key_in_header: true
|
|
# key_in_query: false
|
|
# key_in_body: false
|
|
# hide_credentials: true
|