fix(operator): make per-model API-key auth work end-to-end on AI Gateway v0.5 (#116)#117

Open

dcmcand wants to merge 21 commits into

mainfrom

fix/116-model-scoped-api-key-auth

Commits on Jul 7, 2026

feat(operator): add ClientIDsFromSecret helper for api-key client IDs
dcmcand
committed
feat(operator): scope API keys per-model via per-route authorization
dcmcand
committed
feat(operator): re-render api-key authorization when keys change
dcmcand
committed
docs: describe per-model API-key authorization on the external endpoint
dcmcand
committed
docs: fold redundant forwardClientIDHeader bullet into the authorization paragraph
dcmcand
committed
fix(operator): drop Host matcher from AIGatewayRoute so models route on AI Gateway v0.5
dcmcand
committed
fix(operator): grant EPP RBAC for the inference scheduler's GIE watches
dcmcand
committed
feat(operator): pool api-key authentication across the shared listener
dcmcand
committed
chore(dev): mock-vllm answers chat completions for end-to-end testing
dcmcand
committed
fix(operator): grant the operator the inference.networking.x-k8s.io perms the EPP Role needs
dcmcand
committed
fix(operator): set explicit vLLM command for the CUDA serving image
dcmcand
committed
fix(key-manager): scope API-key client IDs by model
dcmcand
committed
style(key-manager): gofmt handler_test.go struct field alignment
dcmcand
committed
chore(docs): exclude architecture.md from content-parity
dcmcand
committed
fix(operator): use constants for authz actions and client-ID header
dcmcand
committed

Commits on Jul 9, 2026