Openfga

apiVersion: v1
kind: ServiceAccount
metadata:
  name: openfga-actors-auth
  namespace: openfga-actors
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: alice
  namespace: openfga-actors
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: bob
  namespace: openfga-actors
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: openfga-actors-token-review
rules:
- apiGroups: [authentication.k8s.io]
  resources: [tokenreviews]
  verbs: [create]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: openfga-actors-token-review
roleRef:
  kind: ClusterRole
  name: openfga-actors-token-review
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: ServiceAccount
  name: openfga-actors-auth
  namespace: openfga-actors
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: openfga-actors-auth
  namespace: openfga-actors
spec:
  replicas: 1
  selector:
    matchLabels:
      app: openfga-actors-auth
  template:
    metadata:
      labels:
        app: openfga-actors-auth
    spec:
      serviceAccountName: openfga-actors-auth
      containers:
      - name: adapter
        image: ADAPTER_IMAGE_PLACEHOLDER
        ports:
        - containerPort: 8080
          name: http
        env:
        - name: OPENFGA_STORE_ID
          valueFrom:
            configMapKeyRef:
              name: openfga-actors-ids
              key: store
        - name: OPENFGA_MODEL_ID
          valueFrom:
            configMapKeyRef:
              name: openfga-actors-ids
              key: model
        readinessProbe:
          httpGet:
            path: /healthz
            port: http
        volumeMounts:
        - name: ate-ca
          mountPath: /run/servicedns-ca
          readOnly: true
        - name: ate-token
          mountPath: /run/ate-token
          readOnly: true
      volumes:
      - name: ate-ca
        projected:
          sources:
          - clusterTrustBundle:
              signerName: servicedns.podcert.ate.dev/identity
              labelSelector:
                matchLabels:
                  podcert.ate.dev/canarying: live
              path: trust-bundle.pem
      - name: ate-token
        projected:
          sources:
          - serviceAccountToken:
              path: token
              audience: api.ate-system.svc
              expirationSeconds: 3600
---
apiVersion: v1
kind: Service
metadata:
  name: openfga-actors-auth
  namespace: openfga-actors
spec:
  selector:
    app: openfga-actors-auth
  ports:
  - name: http
    port: 8080
    targetPort: http

apiVersion: v1
kind: ConfigMap
metadata:
  name: openfga-actors-gateway
  namespace: openfga-actors
data:
  config.yaml: |
    # yaml-language-server: $schema=https://agentgateway.dev/schema/config
    gateways:
      http:
        port: 8080
        protocol: HTTP
    routes:
    - name: protected-actors
      gateways: [http]
      matches:
      - path:
          pathPrefix: /
      policies:
        extAuthz:
          host: openfga-actors-auth.openfga-actors.svc:8080
          failureMode: deny
          policies:
            http:
              requestTimeout: 10s
          includeRequestHeaders: [authorization, ate-target-actor]
          protocol:
            http:
              path: '"/authorize"'
      backends:
      - host: atenet-router.ate-system.svc:80
        policies:
          requestHeaderModifier:
            remove: [authorization]
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: openfga-actors-gateway
  namespace: openfga-actors
spec:
  replicas: 1
  selector:
    matchLabels:
      app: openfga-actors-gateway
  template:
    metadata:
      labels:
        app: openfga-actors-gateway
    spec:
      containers:
      - name: agentgateway
        image: cr.agentgateway.dev/agentgateway:v1.5.0
        args: [-f, /etc/agentgateway/config.yaml]
        ports:
        - containerPort: 8080
          name: http
        - containerPort: 15021
          name: readiness
        readinessProbe:
          httpGet:
            path: /healthz/ready
            port: 15021
          periodSeconds: 5
        volumeMounts:
        - name: config
          mountPath: /etc/agentgateway
      volumes:
      - name: config
        configMap:
          name: openfga-actors-gateway
---
apiVersion: v1
kind: Service
metadata:
  name: openfga-actors-gateway
  namespace: openfga-actors
spec:
  selector:
    app: openfga-actors-gateway
  ports:
  - name: http
    port: 8080
    targetPort: http

{
  "schema_version": "1.1",
  "type_definitions": [
    { "type": "user" },
    {
      "type": "actor",
      "relations": {
        "allowed_caller": { "this": {} },
        "can_invoke": { "computedUserset": { "relation": "allowed_caller" } }
      },
      "metadata": {
        "relations": {
          "allowed_caller": {
            "directly_related_user_types": [{ "type": "user" }, { "type": "actor" }]
          },
          "can_invoke": { "directly_related_user_types": [] }
        }
      }
    }
  ]
}