Stéphane Tailland
e01b15f14c
ai-gateway-kustomization sat in flux-system, so the team's own bootstrap was writing into a namespace the team has no access to — the thing the move was meant to end. It follows the others into llm, with an explicit sourceRef namespace since k8s-platform stays in flux-system. The control-plane ExternalSecret goes with it, for the same reason it did in the dataplane repos: it only lived in flux-system because substituteFrom resolves in the Kustomization's own namespace. And this retires a workaround. proxy-kustomization inlined OTEL_TRACES_ENDPOINT because it must stay in llm — it substitutes from a Secret holding OPENROUTER_BEARER and LIBRECHAT_APIKEY, which must not be copied into flux-system — and could therefore not read dataplane-template-defaults, which existed only there. k8s-platform now places that ConfigMap in every domain namespace, so the reference works and the duplicated value goes. Changing the cluster trace backend is one edit again. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
platform-llm
Platform-owned llm bounded context — Gateway infrastructure and the
shared LLM proxy in one repo. Never split per functional domain, and never
split between infra/routing here either: both are owned by the same
(platform) team, unlike catalog's dataplane-catalog/catalog-api split
(feature team vs. platform team, a real access boundary that doesn't exist
for this domain).
What it does
Fronts OpenRouter (https://openrouter.ai) via one proxy route
(/llm/v1/chat/completions) — the client's own model field selects among
any OpenRouter-hosted model, not just a fixed set Kong picks.
Active policies:
ai-rate-limiting-advanced, token-based, both global (across all callers) and per-client (per authenticated consumer).ai-prompt-guard(regex) andai-semantic-prompt-guard(embedding-based, backed by Redis Stack) for prompt-injection/jailbreak safeguarding.- Two-tier auth:
key-auth(static, shared key) for chatbot UIs that can't do OIDC on their outbound LLM connection (LibreChat and similar tools — structural limitation of that whole category, not fixable client-side),openid-connectfor agents built in-house. Either succeeds; a request passing neither is rejected (request-terminationon the fallback anonymous consumer).
Not yet active: PII redaction (ai-sanitizer) — needs a private Kong
Cloudsmith registry image and an AI Gateway Enterprise entitlement, blocked
pending that access. Everything else in this repo is unaffected.
Structure
dev/ai-gateway-kustomization.yaml+dev/ai-gateway-externalsecret.yaml— Gateway/DataPlane/Control Plane infra (same sharedk8s-platformtemplate every domain uses).dev/proxy-kustomization.yaml+dev/proxy-externalsecret.yaml— the LLM proxy itself (./kong).dev/gitrepository.yaml— this repo, self-referential.