Build surface + flow-serving server scaffolding #12

New issue

Closed

opened 2026-09-14 17:04:55 +00:00 by ginjiruu · 0 comments

ginjiruu commented

2026-09-14 17:04:55 +00:00

Owner

Parent

#11 — Spec: The flow-serving bridge (gRPC ext_authz Check + OIDC/Exchange flows + callback/logout listener)

What to build

The Bridge's flow-serving foundation: the single binary runs three listeners — a gRPC ext_authz Check service on :8083 (OIDC) and :8084 (Exchange), and a plain-HTTP listener on :8082 (callback/logout) — all wired into the manager and consuming the per-replica Snapshot, with the ext_authz proto and a JWT/JWKS library in place. Nothing protocol-specific yet: a Check returns a stub OK; a :8082 request returns a stub. This makes "the servers exist, are wired, and read the Snapshot" true, unblocking every flow ticket.

Acceptance criteria

envoyproxy/go-control-plane (ext_authz Check proto) and github.com/go-jose/go-jose/v4 (JWKS + ES256 verification + claim checks) are direct dependencies; go build is clean.
The manager runs the three listeners (gRPC Check on :8083 + :8084; plain-HTTP on :8082), all consuming the per-replica Snapshot with no new K8s reads on the serving path.
A Check on :8083 and :8084 returns a stub OK; a request to :8082 returns a stub.
GOTOOLCHAIN=go1.26.0 make lint and GOTOOLCHAIN=go1.26.0 make test pass.

Blocked by

None — can start immediately.

## Parent #11 — Spec: The flow-serving bridge (gRPC ext_authz Check + OIDC/Exchange flows + callback/logout listener) ## What to build The Bridge's flow-serving foundation: the single binary runs three listeners — a gRPC `ext_authz` `Check` service on `:8083` (OIDC) and `:8084` (Exchange), and a plain-HTTP listener on `:8082` (callback/logout) — all wired into the manager and consuming the per-replica Snapshot, with the `ext_authz` proto and a JWT/JWKS library in place. Nothing protocol-specific yet: a `Check` returns a stub `OK`; a `:8082` request returns a stub. This makes "the servers exist, are wired, and read the Snapshot" true, unblocking every flow ticket. ## Acceptance criteria - [ ] `envoyproxy/go-control-plane` (ext_authz `Check` proto) and `github.com/go-jose/go-jose/v4` (JWKS + ES256 verification + claim checks) are direct dependencies; `go build` is clean. - [ ] The manager runs the three listeners (gRPC `Check` on `:8083` + `:8084`; plain-HTTP on `:8082`), all consuming the per-replica Snapshot with no new K8s reads on the serving path. - [ ] A `Check` on `:8083` and `:8084` returns a stub `OK`; a request to `:8082` returns a stub. - [ ] `GOTOOLCHAIN=go1.26.0 make lint` and `GOTOOLCHAIN=go1.26.0 make test` pass. ## Blocked by None — can start immediately.

ginjiruu added this to the Flow-serving bridge (spec #11) milestone

2026-09-14 17:06:34 +00:00

ginjiruu referenced this issue

2026-09-14 17:06:35 +00:00

OIDC steady-state Check #14

ginjiruu referenced this issue

2026-09-14 17:06:35 +00:00

Exchange Check #15

ginjiruu referenced this issue

2026-09-14 17:06:38 +00:00

Services (static) + ReferenceGrant (controller-managed) #20

ginjiruu added the