Skip to content

Refactor: Collapse authbridge-lite into a build-tag variant of authbridge-proxy #621

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
huang195 merged 4 commits into from
Jun 25, 2026
+173 −890
Merged

Refactor: Collapse authbridge-lite into a build-tag variant of authbridge-proxy #621

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
bd3c1e7
refactor(authbridge): collapse authbridge-lite into a build-tag varia…
huang195 Jun 24, 2026
809aa2d
refactor(authbridge): make jwt-validation and token-exchange excludab…
huang195 Jun 24, 2026
2d4a677
refactor(authbridge): address review — test the lite tag set in CI; f…
huang195 Jun 24, 2026
c0d9114
test(authbridge): guard spiffeIdentityType against drift from token-e…
huang195 Jun 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 0 additions & 5 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,11 +22,6 @@ updates:
directory: /authbridge/cmd/authbridge-envoy
schedule:
interval: weekly
- package-ecosystem: gomod
directory: /authbridge/cmd/authbridge-lite
schedule:
interval: weekly

# Go - abctl TUI
- package-ecosystem: gomod
directory: /authbridge/cmd/abctl
Expand Down
16 changes: 10 additions & 6 deletions .github/workflows/build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,14 +44,17 @@
context: ./authbridge
dockerfile: cmd/authbridge-proxy/Dockerfile

# AuthBridge proxy-sidecar lite combined image —
# authbridge-lite (auth-only plugins, parsers dropped for
# binary size) + spiffe-helper. Same listener layout as the
# full proxy image; not yet referenced by the operator's
# default config.
# AuthBridge proxy-sidecar LITE image — the SAME authbridge-proxy
# binary + Dockerfile, built with exclude_plugin_* tags so only
# jwt-validation + token-exchange compile in (drops the OPA SDK
# and the parsers, roughly halving the binary). A build variant,
# not a separate binary. Same listener layout as the full proxy
# image; not yet referenced by the operator's default config.
- name: authbridge-lite
context: ./authbridge
dockerfile: cmd/authbridge-lite/Dockerfile
dockerfile: cmd/authbridge-proxy/Dockerfile
build_args: |
GO_BUILD_TAGS=exclude_plugin_a2aparser,exclude_plugin_ibac,exclude_plugin_inferenceparser,exclude_plugin_mcpparser,exclude_plugin_opa,exclude_plugin_sparc,exclude_plugin_tokenbroker

# SPARC reflection service — the backend the `sparc` plugin calls.
# Deployed once per cluster via authbridge/sparc-service/deploy.
Expand Down Expand Up @@ -104,7 +107,7 @@
# Always use the computed tag
type=raw,value=${{ steps.tag.outputs.tag }}
# Add 'latest' tag for version tags, workflow_dispatch, and pushes to main
type=raw,value=latest,enable=${{ (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')) || github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/main' }}

Check warning on line 110 in .github/workflows/build.yaml

View workflow job for this annotation

GitHub Actions / YAML Lint 

110:151 [line-length] line too long (189 > 150 characters)

# 7. Build and push image
- name: Build and push ${{ matrix.image_config.name }}
Expand All @@ -112,6 +115,7 @@
with:
context: ${{ matrix.image_config.context }}
file: ${{ matrix.image_config.context }}/${{ matrix.image_config.dockerfile }}
build-args: ${{ matrix.image_config.build_args }}
push: true
platforms: linux/amd64,linux/arm64
tags: ${{ steps.meta.outputs.tags }}
Expand Down
13 changes: 12 additions & 1 deletion .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,6 @@ jobs:
binary:
- authbridge-proxy
- authbridge-envoy
- authbridge-lite
defaults:
run:
working-directory: authbridge/cmd/${{ matrix.binary }}
Expand All @@ -101,6 +100,18 @@ jobs:
- name: Build
run: go build -v ./...

# The authbridge-lite image is this same authbridge-proxy binary built
# with exclude_plugin_* tags (only jwt-validation + token-exchange).
# Build AND test that tag set on every PR — build.yaml only exercises
# it on tag/main pushes, and this guards against lite-only regressions.
- name: Build + test lite variant (exclude_plugin_* tags)
if: matrix.binary == 'authbridge-proxy'
run: |
TAGS="exclude_plugin_a2aparser,exclude_plugin_ibac,exclude_plugin_inferenceparser"
TAGS="$TAGS,exclude_plugin_mcpparser,exclude_plugin_opa,exclude_plugin_sparc,exclude_plugin_tokenbroker"
go build -v -tags "$TAGS" ./...
go test -v -race -cover -tags "$TAGS" ./...

- name: Test
run: go test -v -race -cover ./...

Expand Down
28 changes: 14 additions & 14 deletions CLAUDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,11 +39,8 @@ kagenti-extensions/
│ │ ├── main.go
│ │ ├── Dockerfile # envoy-sidecar combined image
│ │ └── entrypoint.sh
│ ├── cmd/authbridge-lite/ # proxy-sidecar mode, lite plugin set (no parsers)
│ │ │ # for size-optimized deployments
│ │ ├── main.go
│ │ ├── Dockerfile # proxy-sidecar lite combined image
│ │ └── entrypoint.sh
│ │ # (the authbridge-lite image is this proxy
│ │ # binary built with exclude_plugin_* tags)
│ ├── proxy-init/ # iptables init container (envoy-sidecar + proxy-sidecar enforce-redirect modes)
│ │ ├── init-iptables.sh
│ │ ├── Dockerfile.init
Expand All @@ -63,7 +60,7 @@ kagenti-extensions/

### 1. AuthBridge Binaries (Go)

**Three mode-specific binaries** providing transparent traffic interception for both inbound JWT validation and outbound OAuth 2.0 token exchange (RFC 8693). Each binary is hardcoded to its deployment shape; mode is no longer selected at runtime.
**Two mode-specific binaries** (proxy-sidecar and envoy-sidecar) providing transparent traffic interception for both inbound JWT validation and outbound OAuth 2.0 token exchange (RFC 8693). Each binary is hardcoded to its deployment shape; mode is no longer selected at runtime. The `authbridge-lite` **image** is a build variant of the proxy binary (not a third binary) — see below.

**Library:** `authbridge/authlib/` (shared)
**Language:** Go 1.25
Expand All @@ -72,7 +69,7 @@ kagenti-extensions/
**Binaries:**
- `cmd/authbridge-proxy/` — proxy-sidecar mode (default): HTTP forward + reverse proxies, full plugin set (jwt-validation, token-exchange, a2a-parser, mcp-parser, inference-parser). No Envoy / no gRPC.
- `cmd/authbridge-envoy/` — envoy-sidecar mode: ext_proc gRPC server hooked into Envoy, full plugin set.
- `cmd/authbridge-lite/` — proxy-sidecar mode, lite plugin set (auth gates only, parsers dropped) for size-optimized deployments.
- `authbridge-lite` (image, **not** a separate binary) — `cmd/authbridge-proxy` built with `exclude_plugin_*` tags so only jwt-validation + token-exchange compile in (OPA + parsers dropped), for size-optimized deployments. Individual plugins live in `cmd/authbridge-proxy/plugins_<name>.go` files gated by `//go:build !exclude_plugin_<name>`.

**Common:**
- `authlib/` — shared auth library (JWT validation, token exchange, caching, routing, all listener implementations, all plugins).
Expand Down Expand Up @@ -122,17 +119,17 @@ into workload pods. Default deployment shape (proxy-sidecar mode):

## AuthBridge Binaries

Three mode-specific binaries, one Dockerfile per binary:
Two mode-specific binaries (proxy, envoy), one Dockerfile each; the `authbridge-lite` image is a build variant of the proxy binary (proxy Dockerfile + `exclude_plugin_*` tags):

| Binary | Mode | Listeners | Plugins |
|--------|------|-----------|---------|
| `cmd/authbridge-proxy/` | proxy-sidecar (default) | HTTP forward + reverse proxies | full (incl. parsers) |
| `cmd/authbridge-envoy/` | envoy-sidecar | gRPC ext_proc on :9090 | full (incl. parsers) |
| `cmd/authbridge-lite/` | proxy-sidecar | HTTP forward + reverse proxies | auth-only (jwt-validation + token-exchange, no parsers) |
| `authbridge-lite` _(image: proxy + `exclude_plugin_*`)_ | proxy-sidecar | HTTP forward + reverse proxies | auth-only (jwt-validation + token-exchange; OPA + parsers dropped) |

**Go modules:**
- `authbridge/authlib/` — pure library: validation, exchange, cache, bypass, spiffe, routing, auth, config, all listener implementations, all plugins.
- `authbridge/cmd/authbridge-{proxy,envoy,lite}/` — thin main packages that import authlib and start the listeners they need.
- `authbridge/cmd/authbridge-{proxy,envoy}/` — thin main packages that import authlib and start the listeners they need. (The `authbridge-lite` image is `authbridge-proxy` built with `exclude_plugin_*` tags.)
- `authbridge/go.work` — workspace linking authlib + the binaries for local development.
Comment on lines +128 to 133

@coderabbitai coderabbitai Bot Jun 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

This doc still mixes the old layout with the new build-variant model.

The updated table/module text now treats authbridge-lite as an image variant, but the section intro above still says “Three mode-specific binaries, one Dockerfile per binary,” and the later “Gotchas and Known Issues” note still says the repo has a single Go module at authbridge/proxy-init/go.mod. Please update those stale lines too so the contributor docs describe one consistent structure.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@CLAUDE.md` around lines 128 - 133, Update the stale contributor-doc wording
so it matches the new build-variant layout throughout this section. In the intro
near the Go module notes, replace the old “Three mode-specific binaries, one
Dockerfile per binary” framing with language that describes image variants built
from the thin `authbridge/cmd/authbridge-{proxy,envoy}/` binaries and the shared
`authbridge/authlib/` library. Also fix the “Gotchas and Known Issues” entry
that still references the old single-module path `authbridge/proxy-init/go.mod`,
and point it to the current workspace/module structure using
`authbridge/go.work` and `authbridge/authlib/` instead.

@huang195 huang195 Jun 24, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Partially addressed in 2d4a677. Fixed the stale "lite is a binary" lines I'd missed: CLAUDE.md:122 ("Three mode-specific binaries…" → two + lite build variant), authbridge/CLAUDE.md (the ### AuthBridge Binaries (cmd/authbridge-{proxy,envoy,lite}/) heading and the Go-module list), and authbridge/cmd/README.md ("Three…/All three binaries").

The quoted "single Go module at authbridge/proxy-init/go.mod" gotcha line wasn't found in CLAUDE.md or authbridge/CLAUDE.md as written, so there was nothing to change there — the module/workspace layout is already described via authbridge/go.work + authbridge/authlib/.

@coderabbitai coderabbitai Bot Jun 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== Current occurrences of authbridge/proxy-init/go.mod =="
rg -n -C2 'authbridge/proxy-init/go\.mod|single Go module|One Go module' CLAUDE.md authbridge/CLAUDE.md || true

echo
echo "== Current AuthBridge Binaries heading/snippet in CLAUDE.md =="
sed -n '118,150p' CLAUDE.md

echo
echo "== Current Gotchas snippet in CLAUDE.md =="
sed -n '250,290p' CLAUDE.md

echo
echo "== Current matching text in authbridge/CLAUDE.md =="
rg -n -C2 'authbridge/proxy-init/go\.mod|single Go module|One Go module|AuthBridge Binaries' authbridge/CLAUDE.md || true

Length of output: 5863

@huang195, thanks for the update — I rechecked the current branch.

The stale “lite is a binary” wording does look fixed, including the CLAUDE.md binaries section and the authbridge/CLAUDE.md heading.

There is still one remaining stale line in the root doc, though: CLAUDE.md Line 307 currently says:

1. **One Go module:** The repo has a single Go module at `authbridge/proxy-init/go.mod` (Go 1.25).

So the “single Go module” part of my original comment is still applicable, but only for CLAUDE.md Line 307. Updating that line to reflect the current workspace/module layout (authbridge/go.work, authbridge/authlib/, and the cmd modules) should fully resolve this thread.

🧠 Learnings used 
Learnt from: mrsabath
Repo: kagenti/kagenti-extensions PR: 466
File: authbridge/demos/weather-agent/demo-ui-advanced.md:0-0
Timestamp: 2026-06-03T14:52:08.855Z
Learning: When reviewing GitHub-flavored Markdown (GFM) tables, if a table cell needs to contain a literal pipe character (`|`), it must be escaped as `\|` so GitHub doesn’t treat it as a column delimiter. Do not flag occurrences of `\|` inside GFM table cells as an error, since GitHub renders `\|` as a plain `|` in the table output (and users copying from the rendered table will get the intended command/value).


**Config format:** YAML with `${ENV_VAR}` expansion, mode presets, and startup validation. Supports `keycloak_url` + `keycloak_realm` derivation for operator compatibility. The `mode` field in YAML must match the binary (each binary rejects mismatched modes at boot).
Expand All @@ -142,7 +139,7 @@ Three mode-specific binaries, one Dockerfile per binary:
| Workflow | Trigger | Purpose |
|----------|---------|---------|
| `ci.yaml` | PR to main/release-* | Pre-commit, Go fmt/vet/build/test for authlib and the cmd/authbridge-* binaries; Python tests |
| `build.yaml` | Tag push (`v*`) or manual | Multi-arch Docker builds for: proxy-init, authbridge (proxy-sidecar combined), authbridge-envoy (envoy-sidecar combined), authbridge-lite (proxy-sidecar lite combined) |
| `build.yaml` | Tag push (`v*`) or manual | Multi-arch Docker builds for: proxy-init, authbridge (proxy-sidecar combined), authbridge-envoy (envoy-sidecar combined), authbridge-lite (proxy Dockerfile built with `exclude_plugin_*` tags — auth-only) |
| `security-scans.yaml` | PR to main | Dependency review, shellcheck, YAML lint, Hadolint, Bandit, Trivy, CodeQL |
| `scorecard.yaml` | Weekly / push to main | OpenSSF Scorecard security health metrics |
| `spellcheck_action.yml` | PR | Spellcheck on markdown files |
Expand Down Expand Up @@ -173,7 +170,7 @@ All images are pushed to `ghcr.io/kagenti/kagenti-extensions/` from
|-------|--------|-------------|
| **`authbridge`** | **`authbridge/cmd/authbridge-proxy/Dockerfile`** | **proxy-sidecar combined image (default mode): authbridge-proxy (full plugin set incl. parsers) + spiffe-helper. No Envoy.** |
| `authbridge-envoy` | `authbridge/cmd/authbridge-envoy/Dockerfile` | envoy-sidecar combined image: Envoy + authbridge-envoy (ext_proc, full plugin set) + spiffe-helper |
| `authbridge-lite` | `authbridge/cmd/authbridge-lite/Dockerfile` | proxy-sidecar lite combined image: authbridge-lite (auth gates only, parsers dropped) + spiffe-helper. Same listener layout as `authbridge`; not yet referenced by the operator's default config |
| `authbridge-lite` | `authbridge/cmd/authbridge-proxy/Dockerfile` (+ `GO_BUILD_TAGS=exclude_plugin_*`) | proxy-sidecar combined image built auth-only (jwt-validation + token-exchange; OPA + parsers dropped) + spiffe-helper. A build variant of `authbridge`, not a separate binary; not yet referenced by the operator's default config |
| `proxy-init` | `authbridge/proxy-init/Dockerfile.init` | Alpine + iptables init container (envoy-sidecar + proxy-sidecar enforce-redirect modes) |

In all three combined images, `spiffe-helper` is started conditionally
Expand Down Expand Up @@ -251,10 +248,13 @@ To build a single image directly:
# proxy-init (iptables init container, envoy-sidecar mode)
cd authbridge/proxy-init && make docker-build-init

# Combined sidecars (proxy-sidecar default / envoy-sidecar / lite)
# Combined sidecars (proxy-sidecar default / envoy-sidecar)
cd authbridge && podman build -f cmd/authbridge-proxy/Dockerfile -t authbridge:latest .
cd authbridge && podman build -f cmd/authbridge-envoy/Dockerfile -t authbridge-envoy:latest .
cd authbridge && podman build -f cmd/authbridge-lite/Dockerfile -t authbridge-lite:latest .
# authbridge-lite: same proxy Dockerfile, built with exclude_plugin_* tags (auth-only)
cd authbridge && podman build -f cmd/authbridge-proxy/Dockerfile \
--build-arg GO_BUILD_TAGS="exclude_plugin_a2aparser,exclude_plugin_ibac,exclude_plugin_inferenceparser,exclude_plugin_mcpparser,exclude_plugin_opa,exclude_plugin_sparc,exclude_plugin_tokenbroker" \
-t authbridge-lite:latest .
```

### Running the Full Demo
Expand Down
1 change: 0 additions & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,6 @@ fmt: ## Run formatters across all sub-projects
cd authbridge/cmd/abctl && go fmt ./...
cd authbridge/cmd/authbridge-proxy && go fmt ./...
cd authbridge/cmd/authbridge-envoy && go fmt ./...
cd authbridge/cmd/authbridge-lite && go fmt ./...
ruff format authbridge/

pre-commit: ## Install pre-commit hooks (including commit-msg)
Expand Down
4 changes: 2 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ Kubernetes security extensions for the [Kagenti](https://github.com/kagenti/kage
- **Mode-specific binaries** under [`authbridge/cmd/`](./authbridge/cmd/):
- [`authbridge-proxy`](./authbridge/cmd/authbridge-proxy/) — proxy-sidecar (default): HTTP forward + reverse proxies, full plugin set.
- [`authbridge-envoy`](./authbridge/cmd/authbridge-envoy/) — envoy-sidecar: ext_proc gRPC server hooked into Envoy, full plugin set.
- [`authbridge-lite`](./authbridge/cmd/authbridge-lite/) — proxy-sidecar with auth-only plugins (no parsers); for size-constrained deployments.
- `authbridge-lite` — **not a separate binary**: the `authbridge-lite` image is `authbridge-proxy` built with `exclude_plugin_*` tags (auth-only: jwt-validation + token-exchange), for size-constrained deployments. See [`authbridge-proxy`](./authbridge/cmd/authbridge-proxy/).
- **[proxy-init](./authbridge/proxy-init/)** — iptables init container used by envoy-sidecar mode for transparent traffic interception.
- **[Keycloak Sync](./authbridge/keycloak_sync.py)** — Declarative tool for synchronizing Keycloak configuration.

Expand All @@ -29,7 +29,7 @@ mode-specific combined images, and the per-component sidecars
|-------|-------------|
| `authbridge` | proxy-sidecar combined (default): authbridge-proxy + bundled spiffe-helper, full plugin set |
| `authbridge-envoy` | envoy-sidecar combined: Envoy + ext_proc + bundled spiffe-helper, full plugin set |
| `authbridge-lite` | proxy-sidecar shape, auth-only plugins (no parsers) for size-constrained deployments |
| `authbridge-lite` | `authbridge-proxy` built with `exclude_plugin_*` tags — auth-only (jwt-validation + token-exchange, OPA + parsers dropped), for size-constrained deployments. A build variant, not a separate binary |
| `proxy-init` | Alpine + iptables init container (envoy-sidecar mode only) |

`spiffe-helper` is bundled inside each combined image and gated per
Expand Down
35 changes: 18 additions & 17 deletions authbridge/CLAUDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,14 +10,17 @@ The unified `cmd/authbridge/` binary has been split into three mode-specific
binaries with shared auth logic in `authlib/`:

- `cmd/authbridge-proxy/` — proxy-sidecar mode (default). HTTP forward + reverse
proxies. Full plugin set (jwt-validation, token-exchange, a2a-parser,
mcp-parser, inference-parser, ibac, sparc). Ibac is excludable via
`-tags exclude_plugin_ibac`.
proxies. Compiles in every plugin by default (jwt-validation, token-exchange,
a2a-parser, mcp-parser, inference-parser, opa, sparc, ibac, token-broker).
**Every** plugin is excludable via `-tags exclude_plugin_<name>` — one
`plugins_<name>.go` file per plugin, gated by `//go:build !exclude_plugin_<name>`;
`main.go` imports no plugin package directly.
- `cmd/authbridge-envoy/` — envoy-sidecar mode. ext_proc gRPC server hooked
into Envoy. Full plugin set. Same build-tag exclusions apply.
- `cmd/authbridge-lite/` — proxy-sidecar mode, lite plugin set (auth gates
only, parsers dropped). For size-optimized deployments that don't need
protocol-aware session events.
into Envoy. Full plugin set. The `exclude_plugin_ibac` tag applies here too.
- `authbridge-lite` (**image, not a separate binary**) — `cmd/authbridge-proxy`
built with `exclude_plugin_*` tags so only jwt-validation + token-exchange
compile in (OPA + parsers dropped). For size-optimized deployments that
don't need protocol-aware session events.

Each binary is hardcoded to its deployment shape; mode is no longer selected
at runtime. The YAML `mode:` field must match the binary or boot fails.
Expand Down Expand Up @@ -58,11 +61,6 @@ authbridge/
│ ├── Dockerfile # envoy-sidecar combined image (Envoy + authbridge-envoy)
│ └── entrypoint.sh
│
├── cmd/authbridge-lite/ # proxy-sidecar mode. Lite plugin set (no parsers).
│ ├── main.go
│ ├── Dockerfile # proxy-sidecar lite combined image
│ └── entrypoint.sh
│
├── proxy-init/ # iptables init container (envoy-sidecar + proxy-sidecar enforce-redirect modes)
│ ├── init-iptables.sh # iptables setup script
│ ├── Dockerfile.init # proxy-init container image
Expand Down Expand Up @@ -92,7 +90,7 @@ authbridge/

## Component Details

### AuthBridge Binaries (cmd/authbridge-{proxy,envoy,lite}/)
### AuthBridge Binaries (cmd/authbridge-{proxy,envoy}/)

The mode-specific authbridge binaries handle both traffic directions. Auth logic
and all listener implementations live in `authlib/` (under `authlib/listener/`);
Expand Down Expand Up @@ -362,7 +360,10 @@ make load-image # Uses KIND_CLUSTER_NAME env var (default: k
cd ..
podman build -f cmd/authbridge-proxy/Dockerfile -t authbridge:latest . # proxy-sidecar (default)
podman build -f cmd/authbridge-envoy/Dockerfile -t authbridge-envoy:latest . # envoy-sidecar
podman build -f cmd/authbridge-lite/Dockerfile -t authbridge-lite:latest . # proxy-sidecar lite
# authbridge-lite: the proxy Dockerfile built with exclude_plugin_* tags (auth-only)
podman build -f cmd/authbridge-proxy/Dockerfile \
--build-arg GO_BUILD_TAGS="exclude_plugin_a2aparser,exclude_plugin_ibac,exclude_plugin_inferenceparser,exclude_plugin_mcpparser,exclude_plugin_opa,exclude_plugin_sparc,exclude_plugin_tokenbroker" \
-t authbridge-lite:latest .
kind load docker-image authbridge:latest --name kagenti
kind load docker-image authbridge-envoy:latest --name kagenti
kind load docker-image authbridge-lite:latest --name kagenti
Expand Down Expand Up @@ -495,11 +496,11 @@ See [`docs/framework-architecture.md`](docs/framework-architecture.md#9-config-h

## Code Conventions

### Go (authlib, cmd/authbridge-{proxy,envoy,lite}, demo-app)
### Go (authlib, cmd/authbridge-{proxy,envoy}, demo-app)
- Go 1.25
- Modules: `authbridge/authlib/` (pure library — all listeners, all plugins) and `authbridge/cmd/authbridge-{proxy,envoy,lite}/` (mode-specific binaries that wire listeners + plugins together)
- Modules: `authbridge/authlib/` (pure library — all listeners, all plugins) and `authbridge/cmd/authbridge-{proxy,envoy}/` (mode-specific binaries that wire listeners + plugins together). The `authbridge-lite` image is the proxy binary built with `exclude_plugin_*` tags, not a separate module.
- `authbridge/go.work` workspace links the modules for local development
- Logging with `log/slog`; the binaries log under their own name (`authbridge-proxy`, `authbridge-envoy`, `authbridge-lite`)
- Logging with `log/slog`; the binaries log under their own name (`authbridge-proxy`, `authbridge-envoy`). Note the `authbridge-lite` image runs the `authbridge-proxy` binary, so it logs as `authbridge-proxy`.
- gRPC ext-proc using `envoyproxy/go-control-plane` types (in `authlib/listener/extproc`)
- JWT validation with `lestrrat-go/jwx/v2` (in `authlib/plugins/jwtvalidation/validation`)

Expand Down
Loading
Loading