Skip to content

Draft: feat: POC: package CC PubKeys with AIGW build

Matthias Käppler requested to merge 639-package-pubkeys-poc into main

What does this merge request do and why?

NOT INTENDED FOR MERGE

Explore the idea of baking public keys for CC token validation straight into the AI GW container:

  1. Create Cloud Connector Docker image with keyfiles. For purposes of this POC, it has been included in this repo as build context. For a production-ready solution, we would move cloud-connector-build contents into a separate repo from which we publish a Docker image to the GitLab Registry.
  2. During AIGW Docker build, copy config from CC Docker image into AIGW image
  3. Create new DiskKeyProvider for reading these keys into a JWKS. For purposes of this POC, I store the keys in JWK format. This made it easier to integrate. For production, we would probably store them in PEM format instead, then convert them to JWK in the application.

I did not have JWKs available to me from a local CDot deployment (because reasons), so I grabbed the staging ones. Of course they will fail to validate signatures from tokens coming from a local Rails instance, but the general mechanism appears to work.

How to set up and validate locally

  1. Run docker build -t mk-cc-poc cloud-connector-build
  2. Run make develop-local

Merge request checklist

  • Tests added for new functionality. If not, please raise an issue to follow up.
  • Documentation added/updated, if needed.

Closes #639

Edited by Matthias Käppler

Merge request reports