## Why The .com Closed Beta needs AR running end-to-end against its real dependencies on a developer workstation. The original rig wired only the monolith, AR, and Postgres. GLAZ, IAM Data Access, Garage, and Valkey are missing. ## Rig location (decided 2026-06-11) The full integration rig moves into the shared **`caproni-demo`** project, worked off the [`artifact-registry` branch](https://gitlab.com/gitlab-com/gl-infra/sandbox/caproni-demo/-/tree/artifact-registry) to start. `caproni-demo` is the shared Caproni instance that already wires a working monolith and other components. A branch keeps integration moving without the Caproni team gatekeeping `main`; the `artifact-registry` directory can be proposed for merge later. The in-repo AR rig (`caproni.yaml` + `caproni/`) is kept for a fast AR-only loop. Provisional: pivot if the shared-branch model doesn't work. ## Connection paths to wire ``` ┌───────────┐ ┌──────────────┐ │ Client │── token request ──────────────▶│ monolith │ │ (glab, │◄── GitLab JWT ──────────────────│ (Rails) │ │ docker, │ └───┬──────┬───┘ │ npm, │ │ │ │ mvn) │ (4) REST: frontend and │ │ (1) gRPC writes └─────┬─────┘ admin operations │ │ │ │ │ │ HTTP + GitLab JWT │ ▼ ▼ │ ┌─────────────────┐ ┌─────────────────┐── (2) gRPC reads ────────────┼──▶│ IAM Data Access │ │ AR │◀─────────────────────────────┘ └─────────────────┘ └────┬────────────┘ │ (3) gRPC over UDS ▼ ┌──────────┐ │ GLAZ │ sidecar in the AR pod └──────────┘ ``` | \# | Path | Purpose | |----|------|---------| | 1 | Monolith → IAM Data Access | Relationships API writes via a Rails GraphQL wrapper over the gRPC client (KAS gRPC-client pattern) | | 2 | AR → IAM Data Access | Relationships API reads | | 3 | AR → GLAZ sidecar | Cedar policy evaluation: `check_permission(urt, context)` over UDS gRPC | | 4 | Monolith → AR | Frontend and admin operations (for example, namespace provisioning) over the REST API. Already wired in the base rig; listed for completeness | ## Scope In: an `artifact-registry` directory in `caproni-demo` wiring all three paths plus Garage and Valkey, exercisable end-to-end on a developer workstation. Local DB = Postgres for AR and IAM Data Access (no Yugabyte). Out: - Yugabyte ([&22265](https://gitlab.com/groups/gitlab-org/-/work_items/22265)). - Local CDN stub. Real CDN signing is covered by CI integration tests; revisit if the rig needs the 307 redirect path. ## Cross-cutting decisions (2026-06-11) - [**buf**](https://github.com/bufbuild/buf) for sharing protos across repos. - **AR, IAM, and GLAZ public**, so buf imports and the JWKS Go library work. - **No TLS in Caproni**; transport encryption is a platform concern. ## GLAZ deployment shape Sidecar in the AR pod. Helm supports multi-container pods, so this is a chart concern. No reloader edit-mode needed for the sidecar. ## Action items `Blocked by` references the `#` column. | \# | Title | Team | Issue | Blocked by | |----|-------|------|-------|------------| | 1 | Add the AR directory to `caproni-demo` | AR | gitlab-org/gitlab#602998 | None | | 2 | Connect the monolith to IAM Data Access (Relationships API writes) | AR | gitlab-org/gitlab#602999 | 1, 8, 11 | | 3 | Wire AR → IAM Data Access (Relationships API reads) | AR | gitlab-org/gitlab#602994 | 1, 8, 11, 12 | | 4 | Wire the GLAZ sidecar into the AR pod | AR | gitlab-org/gitlab#602995 | 1, 10, 12 | | 5 | Enable Garage object storage in the rig | AR | gitlab-org/gitlab#602996 | 1 | | 6 | Enable Valkey in the rig | AR | gitlab-org/gitlab#602997 | 1 | | 7 | Make the IAM repo public | Auth | Done | None | | 8 | Deploy IAM Data Access in the rig | Auth | | 7 | | 9 | Define and pin the GLAZ gRPC contract | Auth | | None | | 10 | Provide a GLAZ image (stub or full) | Auth | | 9 | | 11 | Stub the Relationships API gRPC endpoint | Auth | | None | | 12 | Publish the GLAZ and Relationships protos via buf (importable by AR) | Auth | | 9 | | 13 | Provide the token-validation (JWKS) Go library for AR to embed | Auth | | 7 | | 14 | Verify CC v1 self-signing in the rig | Auth | | 1 | ## Constraints - The AR repo keeps its own artifacts (Helm `chart/`, values); the `caproni-demo` AR directory composes them by pulling the AR repo as a Caproni `repository`, as the in-repo `caproni.yaml` does today. - IAM Data Access is moving to Runway v2 ([iam!269](https://gitlab.com/gitlab-org/auth/iam/-/merge_requests/269)); track the v2 artifact. - The Rails to Relationships API mechanism is a GraphQL wrapper over the gRPC client, modeled on the monolith's KAS gRPC-client pattern (item 2). - AR's auth _consumption_ (embedding the token-validation library, calling GLAZ, reading Relationships) is separate AR feature work. This epic provides rig connectivity and stubs, not the consumption logic. - Enabling Garage/Valkey is config-only; AR _using_ Garage as its object store depends on the ported S06 storage drivers. ## Related - AR closed-beta infra tracking: [gl-infra#1999](https://gitlab.com/groups/gitlab-com/gl-infra/-/work_items/1999) - Auth infrastructure: [&22265](https://gitlab.com/groups/gitlab-org/-/work_items/22265) - Embedded GLAZ ADR: handbook [!115](https://gitlab.com/gitlab-org/architecture/auth-architecture/design-doc/-/merge_requests/115) - Relationships API gRPC-only: [#599077](https://gitlab.com/gitlab-org/gitlab/-/work_items/599077) - GLAZ sidecar production deployment: [#602298](https://gitlab.com/gitlab-org/gitlab/-/work_items/602298) - Integration rig branch: [caproni-demo @ artifact-registry](https://gitlab.com/gitlab-com/gl-infra/sandbox/caproni-demo/-/tree/artifact-registry) - Weekly sync agenda & notes: [Google Doc](https://docs.google.com/document/d/1MQ1sJ9eK5M6Siv3BiAhFe-Gq9XKtbNS23ZAv-7XSPls/edit)