You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: aiac/docs/specs/components/event-broker.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -44,7 +44,7 @@ All messages carry a minimal JSON payload containing only the entity ID:
44
44
{ "id": "<entity-id>" }
45
45
```
46
46
47
-
For `aiac.apply.policy.build`, the payload is empty (`{}`). The AIAC Agent pulls all required state from the PDP Configuration Service at processing time — the event payload is a trigger, not a data carrier.
47
+
For `aiac.apply.policy.build`, the payload is empty (`{}`). The AIAC Agent pulls all required state from the IdP Configuration Service at processing time — the event payload is a trigger, not a data carrier.
48
48
49
49
---
50
50
@@ -87,7 +87,7 @@ No authentication credentials are required. The NATS server runs with no-auth co
87
87
A dedicated `aiac-init` init container runs in the **Agent Pod** before the Agent container starts. It orchestrates the AIAC startup sequence:
88
88
89
89
1.**Wait for NATS** — poll `aiac-event-broker-service:4222` until TCP connection succeeds.
90
-
2.**Wait for PDP Configuration Service** — poll `AIAC_PDP_CONFIG_URL/health` until HTTP 200.
90
+
2.**Wait for IdP Configuration Service** — poll `AIAC_PDP_CONFIG_URL/health` until HTTP 200.
91
91
3.**Wait for PDP Policy Writer** — poll `AIAC_PDP_POLICY_URL/health` until HTTP 200.
92
92
4.**Wait for RAG Ingest Service** — poll `AIAC_RAG_INGEST_URL/health` until HTTP 200 (confirms ChromaDB in the same RAG pod is also up).
93
93
5.**Create NATS JetStream stream** — call `js.add_stream()` idempotently with the `aiac-events` stream configuration. Safe to call on every restart.
Copy file name to clipboardExpand all lines: aiac/docs/specs/components/pdp-policy-keycloak-service.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@
6
6
## Description
7
7
A FastAPI web service that applies RBAC policy changes to Keycloak by managing composite role mappings. Roles are made composites of service (client) permissions (roles), so that any subject (user) assigned a role automatically inherits the associated service permissions. Stateless — no caching.
8
8
9
-
This is the **Phase 1** implementation of the PDP Policy Writer. It is deployed as a container in the **Kagenti Interface Pod** alongside the PDP Configuration Service, behind the `aiac-pdp-policy-service:7072` ClusterIP. Phase 2 replaces only this container image (`aiac-pdp-policy-keycloak` → `aiac-pdp-policy-opa`) within the same pod. The service name and port remain stable so the AIAC Agent and library require no reconfiguration.
9
+
This is the **Phase 1** implementation of the PDP Policy Writer. It is deployed as a container in the **Kagenti Interface Pod** alongside the IdP Configuration Service, behind the `aiac-pdp-policy-service:7072` ClusterIP. Phase 2 replaces only this container image (`aiac-pdp-policy-keycloak` → `aiac-pdp-policy-opa`) within the same pod. The service name and port remain stable so the AIAC Agent and library require no reconfiguration.
10
10
11
11
## Endpoints
12
12
@@ -18,7 +18,7 @@ This is the **Phase 1** implementation of the PDP Policy Writer. It is deployed
18
18
| POST |`/services/{service_id}/permissions`|`POST /admin/realms/{realm}/clients/{service_id}/roles`| Create a new permission (client role) for a specific service |
19
19
| POST |`/services/{service_id}/scopes`|`POST /admin/realms/{realm}/client-scopes` then `PUT .../clients/{service_id}/default-client-scopes/{scope_id}`| Create a realm-level scope and assign it to a service as a default scope (atomic) |
20
20
21
-
Every endpoint accepts an optional `realm` query parameter, same as the PDP Configuration Service.
21
+
Every endpoint accepts an optional `realm` query parameter, same as the IdP Configuration Service.
22
22
23
23
`POST /roles/{role_name}/composites` and `DELETE /roles/{role_name}/composites` accept a JSON array of role representation objects `[{"id": "...", "name": "..."}]` and return `204 No Content` on success.
24
24
@@ -44,7 +44,7 @@ All endpoints return `502 Bad Gateway` with a JSON error body if the Keycloak Ad
0 commit comments