Services (static) + ReferenceGrant (controller-managed) #20

New issue

Closed

opened 2026-09-14 17:05:01 +00:00 by ginjiruu · 0 comments

ginjiruu commented

2026-09-14 17:05:01 +00:00

Owner

Parent

#11 — Spec: The flow-serving bridge (gRPC ext_authz Check + OIDC/Exchange flows + callback/logout listener)

What to build

The in-cluster wiring that lets Apps (in many namespaces) route to the Bridge: the three fixed Services (fronting :8082/:8083/:8084 in authz-bridge-system) as static config, plus a controller-managed ReferenceGrant that authorizes each App's namespace to reference the Bridge's Services, updated as Routes change.

Acceptance criteria

The three Services (:8082/:8083/:8084) in authz-bridge-system are static config in the install bundle.
A new controller watches HTTPRoute/GRPCRoutes across namespaces and owns a ReferenceGrant granting each Route's namespace permission to reference the Bridge's Services in authz-bridge-system.
The ReferenceGrant is updated as Routes appear/disappear.
Verified via the existing envtest suite pattern (Seam B).

Blocked by

#12 — Build surface + flow-serving server scaffolding

## Parent #11 — Spec: The flow-serving bridge (gRPC ext_authz Check + OIDC/Exchange flows + callback/logout listener) ## What to build The in-cluster wiring that lets Apps (in many namespaces) route to the Bridge: the three fixed Services (fronting `:8082`/`:8083`/`:8084` in `authz-bridge-system`) as static config, plus a controller-managed `ReferenceGrant` that authorizes each App's namespace to reference the Bridge's Services, updated as Routes change. ## Acceptance criteria - [ ] The three Services (`:8082`/`:8083`/`:8084`) in `authz-bridge-system` are static config in the install bundle. - [ ] A new controller watches `HTTPRoute`/`GRPCRoute`s across namespaces and owns a `ReferenceGrant` granting each Route's namespace permission to reference the Bridge's Services in `authz-bridge-system`. - [ ] The `ReferenceGrant` is updated as Routes appear/disappear. - [ ] Verified via the existing envtest suite pattern (Seam B). ## Blocked by - #12 — Build surface + flow-serving server scaffolding

ginjiruu added this to the Flow-serving bridge (spec #11) milestone

2026-09-14 17:05:36 +00:00

ginjiruu added the

ready-for-agent

label

2026-09-14 17:08:14 +00:00

ginjiruu referenced this issue from a pull request that will close it,

2026-09-15 04:55:34 +00:00

Services (static) + ReferenceGrant (controller-managed) #29

ginjiruu closed this issue

2026-09-15 16:24:01 +00:00

ginjiruu referenced this issue