Repository navigation
Conversation
Move the budgets API, pricing catalog, spend monitoring, console budget flow, and audit shipper sections into partials so a second gateway section can reuse them. The budgets endpoints are served by Enterprise Manager, so the examples use an Enterprise Manager placeholder. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Alejandro Ponce <aponcedeleonch@stacklok.com>
Add a self-contained section for AI Gateway v2 that mirrors the AI Gateway page set: providers, routing and model access, budgets, screening, audit logs, telemetry, an endpoints reference, and a migration guide. Add a platform setup page and wire the section into the navbar, sidebars, platform overview, and visual tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Alejandro Ponce <aponcedeleonch@stacklok.com>
Make status codes, egress rules, value path conventions, and the migration mapping agree across the AI Gateway v2 pages and the setup page, and document where scan decisions land in audit records. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Alejandro Ponce <aponcedeleonch@stacklok.com>
The shared partials carried over errors from the v1 pages. Pricing writes go through per-entry PUT with If-Match, budget subjects are directory UUIDs, and the Fluent Bit and Promtail filters dropped every audit record. Also cover service account budgets and bulk import precedence, which exist on platform main. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add the cluster OIDC issuer and groupsResolutionIssuer to setup, document disconnect through the API since the console hides it for v2-only installs, and correct migration mappings, error tables, and failure classes against source. Also apply repo style conventions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Snapshot capture also persists bodies, ready pods don't prove a working budgets or provider setup, and removing a provider's Secret must wait for the rollout so old pods keep their credentials. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Capture stores log-only matches and fail-open requests unredacted, so turning on scanning alone doesn't protect captured bodies. Name the settings that do. Most country-specific Presidio recognizers ship disabled in the bundled registry, so listing IN_AADHAAR or AU_TFN fails the adapter rollout rather than enabling detection. Drop service account caller content (budgets, 403 cause, and the workloadIssuers migration row) until workload callers are documented. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Trim operational detail the v1 pages don't carry: reason-code, span, metric, and error tables, troubleshooting entries without a v1 counterpart, and repeated rollout explanations, which now live once in "How configuration changes apply". Keep sections for v2-only features. Fill v1 gaps where v2 behaves the same, verified against platform main: NIST audit fields, the Kubernetes API audit log pointer, Vertex region and credential notes, the Connector Gateway link, the directory namespace note, content screening posture, and the private CA note. Restore the v1 organization default sentence dropped in 5c2a0d7, and fix the budgets probe check, since a first-try success logs nothing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Document the new implementation as the AI Gateway at the unqualified /ai-gateway URLs and move the operator-based implementation under /ai-gateway/legacy, with one navbar entry and one sidebar. Reader-facing prose no longer says "v2"; literal chart and value names keep it. Budgets get one shared home (budgets-and-pricing, manage-budgets), and each gateway gets a budget-enforcement page for its own connection and verification steps. The legacy setup page moves to platform/enterprise-platform/legacy/configure-ai-gateway. Every legacy page carries a pointer to its current counterpart and to a new "Identify your deployment" section, and current task pages point back to their legacy counterparts. The retired management API URL redirects to its legacy location. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A samplingRate of 0 keeps every root span, and a sampled inbound traceparent is always kept, so the rate is not a fixed fraction of traffic. The migration guide also lacked a mapping for the legacy directoryGrpcEndpoint group label lookup. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The gateway dials TLS by default and trusts only the system store, but the directory listener it calls is cleartext on 9091, so the examples without insecure: true failed every directory call and refused all traffic. Match the dev and staging setup: port 9091, insecure: true, and a projected token, which the gateway still sends. Also scope the virtual API key management API note to the legacy gateway, which is the only one that deploys it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Title the operator chart references as legacy and the gateway chart as the AI Gateway, in the hand-written Helm index, the sidebar, and the upstream-projects config that sets the generated titles at the next release sync. The legacy setup page now names clusterOidcIssuer alongside the allowlist step, since the Enterprise Manager verifies the legacy gateway's ServiceAccount tokens against it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Cover every scanning failure setting the chart exposes, including the hook failure policy and the extraction and mutation failure actions, with the status codes clients see. Add the global placeholder and shadow mode, and a minimal KEDA setup that scales Presidio on the adapter's in-flight metric. Add migration notes learned from running both gateways in staging: shared tokens and caches, model access, overlapping Presidio metrics, per-provider Secrets, and Enterprise Manager allowlist overrides. Describe how the gateway validates JWTs and virtual API keys. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The budget enforcement page repeated the bring-up steps and the budgets page. Move its probe check and CA bundle note into Configure the AI Gateway, and its catalog mapping and 402 details into Budgets and pricing. The page itself was removed in the previous commit. Inline the single-use budget partials, also removed in the previous commit, back into their pages. Only the audit shippers partial is shared, so it stays. Remove conversation capture, which is an unreleased beta feature. Document how to authenticate to the Enterprise Manager API and point the budget examples' placeholders at it. Add the scanning hook's failure policy to the screening posture section. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Fix the doubled URL scheme, audit field and telemetry gaps, route timeout claim, and budget duplication. Drop cross-section sidebar entries. Add a model access guide, pricing and protection checks, and overview starting points. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Verified against the dev cluster and the platform chart and sprout source. Covers directory provisioning for token callers, workload issuers, model access defaults, client API changes from inputSchema, token metric and claim label mapping, missing CRD fields, and corrects the screening comparison. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Remove claims that the directory or budgets behave differently between the AI Gateway and the legacy gateway, drop the stray user-group sentence from the migration guide, and move the overview's test request after budgets and model access. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Bedrock Guardrails can't screen /v1/responses on either gateway, since both run the same adapter. Drop it from the migration guide's behavior differences and add the caveat to the legacy screening page. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add a service accounts guide for administrators and a page on calling the AI Gateway from Kubernetes workloads, covering stacklok/ stacklok-enterprise-platform#4934. Add the cluster prerequisites to Configure the AI Gateway, and cover service accounts in the budgets, model access, audit log, groups, virtual key, and directory pages. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Describe service accounts reaching connectors through their groups, limited to None, Bearer token, and Header injection authentication, and the Access tab warning for connectors that can't serve them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Match the console label the trusted issuers table already uses for the issuer of the cluster Stacklok Enterprise runs in. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Move the model access and budget rules into the wizard step where the reader decides them, fold activation into account creation, link to the canonical charge order instead of repeating it, and rephrase negative statements as positive ones. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The console starts the in-cluster issuer with an empty Issuer URL, so the reader enters the issuer the cluster publishes instead of checking a prefilled value. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Documents service accounts in Stacklok Enterprise, following the acceptance criteria in stacklok/stacklok-enterprise-platform#4934. A service account gives a Kubernetes workload its own directory identity, groups, model set grants, and budget. The workload authenticates with its pod's projected ServiceAccount token, so there's no static key.
New pages:
platform/enterprise-directory/service-accounts.mdx(AC4.1, AC4.5, AC4.6): when to use a service account instead of a virtual API key, trusting a cluster's issuer, the creation wizard, pinned and name-only bindings (including reassign), activation, revocation, and what an account can reach depending on model access, budgets, and connector authentication.ai-gateway/kubernetes-workloads.mdx(AC4.2): the projected token volume, audience andexpirationSeconds: 1800,Authorization: Beareronly, what401,402,403, and503mean, and where an administrator finds the reason behind a refusal.Updated pages:
configure-ai-gateway.mdx: new "Accept service account workloads" section with the cluster administrator's prerequisites (AC4.3).users-and-groups,manage-budgets,budgets-and-pricing,virtual-api-keys(AC4.4).control-model-access,connector-policies,forward-audit-logs(workloadauth method and service account subjects), the console and directory index pages, andsidebars.ts.The branch is stacked on #1244 because it edits the same AI Gateway pages and links to
control-model-access.mdx.Keep in draft until
service_accountsconsole flag is on by default.mainstill has 2 hours.Where the pages follow the code instead of #4934
401: an invalid token gets401, while a valid token without an active binding gets403withidentity not resolved by the directory. The page covers both, with the auditreason_codevalues and the Enterprise Manager'sworkload.resolutionsmetric and debug log.system:service-account-issuer-discovery, so it's documented as a check, not a manual step.valid_for.Type of change
Related issues/PRs
Screenshots
None. No page in the platform, AI Gateway, or Connector Gateway sections uses screenshots.
Submitter checklist
Content and formatting
Navigation
sidebars.ts) updated for added, deleted, reordered, or renamed filesvercel.jsonfor moved, renamed, or deleted pages (no URLs changed, so none needed)Reviewer checklist
Content
🤖 Generated with Claude Code