Add production deployment docs for AI Workspace - #422
Merged
Conversation
|
Warning Review limit reached
Next review available in: 43 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (12)
📝 WalkthroughWalkthroughAdded production deployment documentation for AI Gateway and AI Workspace. The guides cover deployment, security, databases, scaling, TLS, gateway connectivity, operations, navigation, redirects, and self-hosted deployment options. ChangesAI Gateway production deployment
AI Workspace production deployment
Documentation index and product links
Estimated code review effort: 3 (Moderate) | ~30 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 73
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
en/docs/ai-gateway/1.2.0/deployment/production-deployment/deploy-and-verify.md (1)
276-290: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winMount the database CA bundle used by
verify-full.The configuration points
ssl_root_certto/etc/platform-api/tls/ca.pem, but these volumes mount only the encryption keys and database password. Add a read-only CA mount or change the configuration to the mounted path.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@en/docs/ai-gateway/1.2.0/deployment/production-deployment/deploy-and-verify.md` around lines 276 - 290, Update the production deployment configuration so the CA bundle required by ssl_root_cert at /etc/platform-api/tls/ca.pem is available inside the container. Add a read-only volume mount for the database CA certificate, or adjust ssl_root_cert to the path of an existing mounted CA file, while preserving the verify-full configuration.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@en/docs/ai-gateway/1.0.0/deployment/production-deployment/overview.md`:
- Around line 28-34: Update the concluding deployment recommendation so each
capability points to its minimum supported version: external database and chart
HPA/PDB support should recommend the appropriate 1.1.x release, while AI
Workspace governance should continue recommending AI Gateway 1.2.0. Preserve the
capability descriptions and conditional requirement wording.
In
`@en/docs/ai-gateway/1.0.0/deployment/production-deployment/resources-and-scaling.md`:
- Line 3: Update the page description near the front matter to match the actual
content: either add guidance covering autoscaling and pod disruption budgets, or
remove those promises from the description while retaining only the documented
CPU, memory, replica anti-affinity, and related resource-scaling topics.
- Around line 50-51: Update the note in resources-and-scaling.md (lines 50-51)
to replace “needs a later version” with an explicit database or AI Gateway
version requirement. Also update control-plane-connection.md (line 66) to
replace “Later chart versions” with the exact versions supporting the combined
host:port field. Use timeless, version-specific wording at both sites.
- Line 20: The documentation does not consistently expand less familiar acronyms
at first use. Update all listed sites:
en/docs/ai-gateway/1.0.0/deployment/production-deployment/resources-and-scaling.md
lines 20-20, 34-35, 76-76, and 93-94;
en/docs/ai-workspace/next/production/tls.md lines 3-3 and 193-193;
en/docs/ai-gateway/1.1.0/deployment/production-deployment/control-plane-connection.md
lines 18-20; en/docs/ai-workspace/next/production/secrets-and-keys.md lines
24-26;
en/docs/ai-gateway/1.0.0/deployment/production-deployment/security-hardening.md
lines 142-142, 180-180, and 219-221;
en/docs/ai-gateway/1.1.0/deployment/production-deployment/security-hardening.md
lines 142-142, 180-180, and 219-221;
en/docs/ai-gateway/1.1.0/deployment/production-deployment/ai-workload-tuning.md
lines 19-19, 57-57, and 65-65;
en/docs/ai-gateway/1.0.0/deployment/production-deployment/control-plane-connection.md
lines 18-20;
en/docs/ai-gateway/1.0.0/deployment/production-deployment/deploy-and-verify.md
lines 86-86 and 152-152;
en/docs/ai-gateway/1.0.0/deployment/production-deployment/ai-workload-tuning.md
line 19;
en/docs/ai-gateway/1.2.0/deployment/production-deployment/control-plane-connection.md
lines 21-26; and
en/docs/ai-gateway/1.1.0/deployment/production-deployment/resources-and-scaling.md
lines 43-43, 60-60, 106-108, and 136-138. At each first use, expand the
requested terms consistently—LLM, MCP, CA, BFF, APIM, HMAC, OIDC, PKI, PII, JWT,
JWKS, REST, HPA, and PDB—then use their abbreviations; retain universally
recognized HTTP and API without expansion.
In
`@en/docs/ai-gateway/1.0.0/deployment/production-deployment/security-hardening.md`:
- Around line 248-255: Remove the plaintext --from-literal password workflow
from both security-hardening.md sites:
en/docs/ai-gateway/1.0.0/deployment/production-deployment/security-hardening.md
lines 248-255 and
en/docs/ai-gateway/1.1.0/deployment/production-deployment/security-hardening.md
lines 248-255. Replace each with guidance to use an external secret manager or a
protected credential-rotation workflow, without storing a second long-lived
plaintext copy in Kubernetes.
In `@en/docs/ai-gateway/1.0.0/overview.md`:
- Around line 21-22: Update the LLM Quick Start Guide and MCP Quick Start Guide
entries in the overview list to use an unspaced em dash instead of the spaced
hyphen, and add a period to the end of each description.
In
`@en/docs/ai-gateway/1.1.0/deployment/production-deployment/ai-workload-tuning.md`:
- Line 3: Update the description in
en/docs/ai-gateway/1.1.0/deployment/production-deployment/ai-workload-tuning.md
at line 3 by either documenting actionable body-buffer configuration in the page
or removing “body buffers” from the description. Apply the same correction to
en/docs/ai-gateway/1.0.0/deployment/production-deployment/ai-workload-tuning.md
at line 3.
In
`@en/docs/ai-gateway/1.1.0/deployment/production-deployment/control-plane-connection.md`:
- Line 37: Replace “afterwards” with “afterward” in
en/docs/ai-gateway/1.1.0/deployment/production-deployment/control-plane-connection.md
at lines 37-37 (both occurrences),
en/docs/ai-workspace/next/production/secrets-and-keys.md at lines 197-197, and
en/docs/ai-gateway/1.2.0/deployment/production-deployment/control-plane-connection.md
at lines 56-56.
In
`@en/docs/ai-gateway/1.1.0/deployment/production-deployment/database-configuration.md`:
- Around line 32-36: Update the database setup instructions around the CREATE
USER statement to avoid placing the password directly in SQL or psql history.
Replace the inline password with an interactive \password gateway command or an
equivalent secret-managed bootstrap procedure, while preserving the database
creation and privilege-grant steps.
In
`@en/docs/ai-gateway/1.1.0/deployment/production-deployment/deploy-and-verify.md`:
- Around line 88-117: The deployment example must avoid embedding the OpenAI
credential directly in the heredoc command. Update the provider request around
the LlmProvider manifest to read the key from a protected Secret-backed file or
environment variable and generate the request body without exposing the value in
shell history or command logs.
In
`@en/docs/ai-gateway/1.1.0/deployment/production-deployment/resources-and-scaling.md`:
- Around line 106-123: Update the Horizontal Pod Autoscaler description to state
that the shown configuration scales on CPU utilization only, matching the
configured targetCPUUtilizationPercentage fields for both components; do not
imply memory-based scaling unless a memory metric is added.
In `@en/docs/ai-gateway/1.2.0/deployment/deployment-modes/immutable-gateway.md`:
- Line 65: Capitalize the sentence-opening “then” to “Then” in the immutable
gateway deployment instructions, leaving the surrounding configuration text
unchanged.
In
`@en/docs/ai-gateway/1.2.0/deployment/production-deployment/ai-workload-tuning.md`:
- Around line 48-63: The body-buffer guidance must distinguish the 10 MiB
policy-engine default from the configured 20 MiB override. In
en/docs/ai-gateway/1.2.0/deployment/production-deployment/ai-workload-tuning.md
lines 48-63, update the explanatory text and YAML comments to label 10 MiB as
the default and 20 MiB as the override; apply the same clarification in
en/docs/ai-gateway/next/deployment/production-deployment/ai-workload-tuning.md
lines 48-63.
- Line 19: Define each unfamiliar acronym at first use, preserving the existing
meaning: in
en/docs/ai-gateway/1.2.0/deployment/production-deployment/ai-workload-tuning.md
lines 19-19 and
en/docs/ai-gateway/next/deployment/production-deployment/ai-workload-tuning.md
lines 19-19 define LLM, MCP, and REST; in
en/docs/ai-gateway/next/deployment/production-deployment/overview.md lines 19-19
define LLM and MCP and lines 55-57 define xDS; in
en/docs/ai-gateway/next/deployment/production-deployment/deploy-and-verify.md
line 211 define xDS; define PII, HPA, and PDB in the corresponding
resources-and-scaling ranges for both versions; define AES-GCM, TLS, PKI, CA,
and JWKS in the corresponding security-hardening ranges for both versions;
define BFF, PKCE, JWT, and JWKS in
en/docs/ai-workspace/1.0.0/production/deploy.md lines 42-67; and define CA in
en/docs/ai-workspace/1.0.0/production/connect-gateways.md lines 28-31. Do not
expand HTTP or API.
In
`@en/docs/ai-gateway/1.2.0/deployment/production-deployment/control-plane-connection.md`:
- Line 35: In the connection-troubleshooting paragraph, split the long sentence
into complete sentences or a list, keeping the three requirements distinct:
gateway-side address resolution and connectivity, WebSocket upgrades with
long-lived connections, and certificate trust through a trusted CA. Ensure every
sentence contains fewer than 26 words.
- Around line 39-42: Update the kubectl conn-test command to use a GET request
for the Platform API health check: replace the curl flags with the documented
fail/silent GET behavior, including -X GET, while preserving the existing health
endpoint and Kubernetes execution context.
In
`@en/docs/ai-gateway/1.2.0/deployment/production-deployment/database-configuration.md`:
- Around line 34-38: Remove command-line credential exposure across all listed
production procedures: in
en/docs/ai-gateway/1.2.0/deployment/production-deployment/database-configuration.md
lines 34-38, create the database-password Secret via protected file input or
interactive input; in lines 122-149, create DSN Secrets without embedding
passwords in commands; in
en/docs/ai-gateway/1.2.0/deployment/production-deployment/overview.md lines
129-136, replace --docker-password with protected input; and in
en/docs/ai-workspace/next/production/connect-gateways.md lines 106-111, create
the registration-token Secret from a protected file. Remove any temporary
credential files afterward.
In
`@en/docs/ai-gateway/1.2.0/deployment/production-deployment/deploy-and-verify.md`:
- Line 34: In the deployment documentation, replace the word “afterwards” with
“afterward” to follow American English conventions.
- Around line 88-90: Update the deployment instructions around the LlmProvider
and proxy commands to avoid placing API keys directly in heredocs or
terminal-expanded values. Use a protected temporary file, sed-based injection,
or supported Secret reference, and explicitly remove any temporary credentials
file after deployment.
- Around line 88-96: Update the management API verification commands around the
curl request to use the production bearer-token authentication flow shown
elsewhere in the deployment documentation, replacing the local BasicAuth
credentials. Ensure the provider API key is not exposed through shell input, or
explicitly state that these commands must run before BasicAuth is disabled.
In `@en/docs/ai-gateway/1.2.0/deployment/production-deployment/overview.md`:
- Around line 53-61: Add a complete standalone introductory sentence immediately
before each image in the overview section, including the image following “How
failures are contained.” Keep the existing images and surrounding explanatory
text unchanged.
- Line 19: Apply the acronym rule by defining each term at first use and
preserving the existing content:
en/docs/ai-gateway/1.2.0/deployment/production-deployment/overview.md lines
19-19: expand LLM (large language model), MCP (Model Context Protocol), and xDS
(xDiscovery Service); database-configuration.md lines 116-118: expand DSN (data
source name); deploy-and-verify.md lines 33-36: expand OCI (Open Container
Initiative), and lines 84-88: expand LLM;
en/docs/ai-workspace/1.0.0/production/secrets-and-keys.md lines 20-26: expand
OIDC (OpenID Connect) and BFF (backend for frontend); tls.md lines 18-25: expand
TLS (Transport Layer Security) and CA (certificate authority);
en/docs/ai-workspace/next/production/connect-gateways.md lines 18-30: expand LLM
and CA; deploy.md lines 58-68: expand BFF, OIDC, PKCE (Proof Key for Code
Exchange), JWT (JSON Web Token), and JWKS (JSON Web Key Set);
expose-the-workspace.md lines 22-25 and harden.md lines 20-24: expand BFF;
high-availability.md lines 124-124: expand HPA (horizontal pod autoscaler), and
lines 214-214: expand PDB (pod disruption budget); operate.md lines 20-22:
expand JSON (JavaScript Object Notation), and lines 118-122: expand RFC (Request
for Comments).
In
`@en/docs/ai-gateway/1.2.0/deployment/production-deployment/security-hardening.md`:
- Around line 230-251: Remove plaintext credential values from command arguments
and unused Kubernetes Secrets. In
en/docs/ai-gateway/1.2.0/deployment/production-deployment/security-hardening.md:230-251
and
en/docs/ai-gateway/next/deployment/production-deployment/security-hardening.md:230-251,
update the htpasswd, docker run, and kubectl examples to use interactive input,
protected files, or a secret manager, and retain only the bcrypt hash in chart
values; do not create a plaintext reference Secret. In
en/docs/ai-workspace/1.0.0/production/connect-gateways.md:106-110, create the
registration token from protected file input or stdin instead of --from-literal.
- Around line 63-75: Clarify the key-version derivation in the
security-hardening examples: for both
en/docs/ai-gateway/1.2.0/deployment/production-deployment/security-hardening.md
lines 63-75 and
en/docs/ai-gateway/next/deployment/production-deployment/security-hardening.md
lines 63-75, state that default-aesgcm256-v1.bin produces version aesgcm256-v1
rather than the full filename stem, while preserving the requirement that file
is beneath mountPath.
In `@en/docs/ai-gateway/1.2.0/overview.md`:
- Around line 21-22: Update both Quick Start entries in
en/docs/ai-gateway/1.2.0/overview.md lines 21-22 and
en/docs/ai-gateway/1.1.0/overview.md lines 21-22: replace spaced hyphens with em
dashes without surrounding spaces, rewrite the descriptions as short imperative
sentences using clearer action wording instead of “controller admin health
endpoint,” and end each item with a period.
In `@en/docs/ai-gateway/1.2.0/quick-start-guide.md`:
- Line 201: Rewrite the “Bottom-up” bullet in the quick-start guide as short,
direct sentences, replacing “the way this guide does” with explicit wording
about deploying through the management API. Keep each sentence under 26 words,
preserve the gateway-to-AI-Workspace synchronization behavior and artifact
examples, and retain the existing reference link.
In `@en/docs/ai-gateway/next/deployment/deployment-modes/immutable-gateway.md`:
- Line 65: Capitalize the opening word of the instruction following the code
block from “then set” to “Then set,” preserving the existing environment
variable and link.
In
`@en/docs/ai-gateway/next/deployment/production-deployment/control-plane-connection.md`:
- Line 56: Use standard American English and timeless wording in all three
documented locations: in
en/docs/ai-gateway/next/deployment/production-deployment/control-plane-connection.md
lines 56-56, replace “afterwards” with “afterward”; in
en/docs/ai-gateway/next/deployment/production-deployment/database-configuration.md
lines 113-114, replace “new deployments” with “deployments”; and in
en/docs/ai-workspace/next/production/overview.md lines 35-35, replace
“afterwards” with “afterward.”
- Line 35: Rewrite the paragraph around the gateway-to-Platform API connection
using short sentences or an explicit list. Replace the ambiguous “That
direction” reference with clear subjects, and state the DNS, network routing,
WebSocket upgrade/long-lived connection, and certificate trust requirements
separately.
In `@en/docs/ai-gateway/next/deployment/production-deployment/overview.md`:
- Around line 51-53: Introduce each image with a standalone descriptive sentence
immediately before it: in
en/docs/ai-gateway/next/deployment/production-deployment/overview.md at lines
51-53, describe the high-availability architecture; at lines 59-61, describe the
failure-containment architecture; and in
en/docs/ai-workspace/1.0.0/production/overview.md at lines 39-41, describe the
deployment architecture.
In
`@en/docs/ai-gateway/next/deployment/production-deployment/resources-and-scaling.md`:
- Around line 106-123: Align the Horizontal Pod Autoscaler description with the
YAML by stating that it adjusts replicas from CPU utilization, or add matching
memory metric configuration. Apply the same correction in
en/docs/ai-gateway/next/deployment/production-deployment/resources-and-scaling.md
lines 106-123 and
en/docs/ai-gateway/1.2.0/deployment/production-deployment/resources-and-scaling.md
lines 106-123.
- Around line 136-152: Remove “evictions under resource pressure” from the
protected-scenarios sentence following the Pod Disruption Budget example in
en/docs/ai-gateway/next/deployment/production-deployment/resources-and-scaling.md
(lines 136-152) and
en/docs/ai-gateway/1.2.0/deployment/production-deployment/resources-and-scaling.md
(lines 136-152); retain only voluntary disruption scenarios such as node drains,
autoscaler scale-down, and planned maintenance.
- Around line 156-172: Revise the rollout explanation following the
gatewayRuntime deployment configuration in
en/docs/ai-gateway/next/deployment/production-deployment/resources-and-scaling.md
lines 156-172 to state only that maxUnavailable: 0 prevents the rollout
controller from voluntarily removing an old pod before a replacement is ready;
do not claim capacity never dips. Apply the identical wording correction in
en/docs/ai-gateway/1.2.0/deployment/production-deployment/resources-and-scaling.md
lines 156-172.
In `@en/docs/ai-gateway/next/overview.md`:
- Around line 21-22: Update the LLM and MCP Quick Start Guide entries in the
overview documentation to replace the spaced hyphens separating each title from
its description with em dashes without surrounding spaces, preserving the
existing link text and descriptions.
- Around line 117-125: Insert a meaningful introductory sentence between the
Documentation section heading and the table in the overview document, explaining
that the table lists available AI Gateway documentation topics and links. Keep
the existing table entries unchanged.
In `@en/docs/ai-workspace/1.0.0/production/connect-gateways.md`:
- Around line 32-38: Update the connectivity guidance around the curl
reachability check to use non-categorical language such as “usually indicates”
for timeout and certificate errors, and direct readers to the symptom table for
other possible causes including hostname mismatch and expiry.
In `@en/docs/ai-workspace/1.0.0/production/deploy.md`:
- Around line 252-255: Update the ai_workspace.control_plane TOML example so
tls_skip_verify uses the boolean value false without quotes, matching the
expected configuration type and the Kubernetes tlsSkipVerify setting.
In `@en/docs/ai-workspace/1.0.0/production/expose-the-workspace.md`:
- Around line 113-148: Update the Ingress example to route the root path "/" by
default to the same <release-name>-ai-workspace-ui service on port 9643, so the
documented /healthz verification works on the public hostname. Remove the
optional wording that suggests adding "/" only for root redirects, and keep the
existing /ai-workspace route unchanged.
- Around line 4-5: Update canonical_url and md_url to use the 1.0.0 path in
en/docs/ai-workspace/1.0.0/production/expose-the-workspace.md lines 4-5,
harden.md lines 4-5, high-availability.md lines 4-5, and operate.md lines 4-5;
do not move the files to the next tree.
- Around line 58-65: Update the NGINX location block in the workspace exposure
configuration to enable upstream SNI and explicitly set the TLS verification
server name to the workspace hostname, alongside the existing proxy_ssl_verify
and proxy_ssl_trusted_certificate directives.
In `@en/docs/ai-workspace/1.0.0/production/harden.md`:
- Around line 103-123: Update the Kubernetes example to configure authorization
for both services by adding matching ai-workspace-ui.config.auth.authorization
settings alongside platform-api, including enabled: true and mode: role.
Preserve the existing role-to-scope mapping and roles configuration.
- Around line 247-273: Update the Kubernetes NetworkPolicy example under the
platform-api-ingress manifest to include the AI gateway traffic source in
ingress.from. Use the gateway namespace selector, gateway pod selector, or
deployment source ipBlock, while preserving access for ai-workspace-ui and
ingress-nginx on TCP port 9243.
In `@en/docs/ai-workspace/1.0.0/production/operate.md`:
- Around line 134-140: The backup section claims three required items but the
table contains only the database and at-rest encryption key; update the
introductory text to say “Two things” while preserving the existing table and
explanation.
- Around line 166-209: Update the “Step 4: Upgrade” procedures for both the
“Virtual machine” and “Kubernetes” sections to either remove the
one-component-at-a-time sequencing claim or provide explicit per-component
upgrade commands with a health check between each component. Ensure the
documented commands do not upgrade both services or the entire release in a
single step while retaining the backup and verification steps.
- Around line 197-202: Update the Helm preview command in the “Preview what
changes before you apply it” section to prevent rendered Secret data from being
exposed: either suppress secrets in the output or write the preview to a
mode-0600 temporary file and remove it immediately after review. Preserve the
existing values-file inputs and preview behavior.
In `@en/docs/ai-workspace/1.0.0/production/overview.md`:
- Around line 35-36: Replace “afterwards” with “afterward” in
en/docs/ai-workspace/1.0.0/production/overview.md lines 35-36 and
en/docs/ai-workspace/1.0.0/production/deploy.md lines 32-34, preserving the
surrounding text.
- Around line 1-5: Align the source path and metadata for
en/docs/ai-workspace/1.0.0/production/overview.md lines 1-5 by changing
canonical_url and md_url to use /1.0.0/. Apply the same correction to
en/docs/ai-workspace/1.0.0/production/deploy.md lines 1-5 and
en/docs/ai-workspace/1.0.0/production/connect-gateways.md lines 1-5; no files
need to be moved.
In `@en/docs/ai-workspace/1.0.0/production/secrets-and-keys.md`:
- Around line 224-227: Update the kubectl command in the secrets listing example
to pipe the Secret JSON through jq and output only the keys under .data, such as
using jq -r '.data | keys[]'. Remove the current tr-based .data output so no
encoded Secret values are printed.
- Line 197: Update the documentation sentence near the at-rest encryption key
guidance to use the American English term “afterward” instead of “afterwards,”
without changing the surrounding meaning.
In `@en/docs/ai-workspace/1.0.0/production/tls.md`:
- Around line 166-189: Update the Kubernetes TLS examples to cover both
ai-workspace-ui and platform-api: add corresponding Secret-managed TLS and
plain-HTTP settings for platform-api, or explicitly instruct operators to repeat
each configuration for both components.
- Around line 244-253: Update both TLS verification commands in the
certificate-checking section to make validation failures return a nonzero
status: add s_client’s -verify_return_error, configure a trusted CA source via
-CAfile or system roots, and provide the appropriate -servername for each
endpoint. Preserve the existing certificate subject, issuer, and dates output.
In `@en/docs/ai-workspace/1.0.0/sync-gateway-created-artifacts.md`:
- Line 331: Update the Immutable Gateway link in the AI Workspace 1.0.0 release
guide to reference the versioned AI Gateway 1.0.0 page instead of the unreleased
next page, preserving the existing relative-link structure and documentation
wording.
In `@en/docs/ai-workspace/next/production/connect-gateways.md`:
- Around line 99-104: Update the encryption-key setup commands in the gateway
documentation to replace the plain rm cleanup with the repository-approved
secure-cleanup procedure, ensuring the raw default-aesgcm256-v1.bin key material
is securely removed after the Kubernetes Secret is created.
In `@en/docs/ai-workspace/next/production/deploy.md`:
- Line 34: Update the documentation sentence in the deployment guide by
replacing “afterwards” with the American English spelling “afterward,” leaving
the rest of the text unchanged.
- Around line 276-290: Update the Compose example for platform-api to mount the
database CA bundle at /etc/platform-api/tls/ca.pem as read-only, matching the
configured ssl_root_cert path; alternatively, change ssl_root_cert to the
documented mounted location.
In `@en/docs/ai-workspace/next/production/expose-the-workspace.md`:
- Around line 58-64: Update the Nginx upstream TLS settings in the location
block to enable SNI with proxy_ssl_server_name and set proxy_ssl_name to the
public workspace hostname served by the listener, while preserving certificate
verification and the existing trusted CA configuration.
In `@en/docs/ai-workspace/next/production/harden.md`:
- Around line 247-273: Update the Kubernetes NetworkPolicy named
platform-api-ingress to permit gateway traffic on port 9243 by adding the
required in-cluster gateway pod selectors and any external gateway source ranges
as ipBlock entries, while preserving the existing ai-workspace-ui and
ingress-nginx rules.
- Around line 103-123: Update the Kubernetes authorization example so
ai-workspace-ui also uses role-based authorization with the same role-to-scope
mapping and matching roles as platform-api. Add the required ai-workspace-ui
configuration in the YAML, or explicitly document the chart behavior that
derives this configuration.
In `@en/docs/ai-workspace/next/production/high-availability.md`:
- Line 31: In the high-availability documentation, add a complete standalone
introductory sentence immediately before the architecture image Markdown. Keep
the existing architecture details in the surrounding prose and leave the image
reference unchanged.
- Around line 228-240: Update the ai-workspace-ui topologySpreadConstraints
example so it does not imply zone-failure guarantees with the soft
whenUnsatisfiable: ScheduleAnyway setting. Either change whenUnsatisfiable to
DoNotSchedule for hard separation, or explicitly describe the ScheduleAnyway
configuration as best effort and note that replicas may still share a zone.
In `@en/docs/ai-workspace/next/production/operate.md`:
- Around line 132-140: Update the “Step 3: Back up what you can't regenerate”
introduction to match the table’s two listed backup items: change “Three things
matter” to “Two things matter,” while preserving the existing database and
encryption-key guidance.
- Around line 166-209: Align the Step 4 upgrade instructions with the stated
one-component-at-a-time strategy: either revise the wording to describe
full-stack upgrades accurately, or replace the docker compose up -d and helm
upgrade commands with commands that target individual components. Update both
the “Virtual machine” and “Kubernetes” sections consistently, including the
surrounding verification guidance.
In `@en/docs/ai-workspace/next/production/overview.md`:
- Around line 76-82: Update the Kubernetes “Scaling” bullet in the production
overview to qualify HorizontalPodAutoscaler support: state that HPA applies only
to deployments using the exact postgres database driver, while SQL Server
deployments require manual scaling; keep the remaining scaling details
unchanged.
- Around line 56-66: Update the COMPOSE_PROFILES examples to make the selection
persistent or available to Compose: show the corresponding entries in the
stack’s .env file, or explicitly export the variable and indicate that Compose
must run from the same shell. Keep the separate control-plane and workspace
profile values unchanged.
In `@en/docs/ai-workspace/next/production/secrets-and-keys.md`:
- Around line 20-26: Add an introductory sentence immediately before the secrets
provisioning table, explaining that it maps each secret to its consumer, when it
is required, and the impact of losing it. Keep the existing table content
unchanged.
- Around line 89-93: Update the cleanup command in the “Remove the two password
files once the Secrets exist” section to also delete encryption.key, but
instruct users to verify an independent secret-manager backup before removing
the local copy.
- Around line 222-227: Update the verification command near the
CreateContainerConfigError troubleshooting guidance to avoid outputting Secret
data values. Replace the jsonpath query with a safe key-only listing or kubectl
describe secret, while preserving the namespace and release-specific Secret
reference.
In `@en/docs/ai-workspace/next/production/tls.md`:
- Around line 166-176: Update the TLS Secret-provider example in the production
TLS documentation to also include the equivalent platform-api configuration, or
explicitly state that platform-api requires cert-manager. Keep the existing
ai-workspace-ui settings unchanged and ensure the documentation accurately
reflects Secret support for both component charts.
- Around line 256-258: Expand the browser certificate-warning guidance in the
TLS verification section to instruct readers to check the certificate chain and
issuer trust, validity dates, and subject alternative names, rather than
attributing the warning only to hostname coverage. Keep the existing hostname
and BFF `ca_file` verification guidance intact.
In `@en/docs/index.md`:
- Line 139: Rewrite the adoption-path paragraph around the standalone gateway
guidance into shorter, complete sentences under 26 words each. State starting
with a standalone gateway first, then describe attaching it to Cloud,
self-hosted, or API Manager control planes in separate sentences.
- Line 149: Update the API Portal and MCP Hub description to hyphenate the
compound modifier as “developer-facing portal,” leaving the surrounding
description and links unchanged.
In `@en/mkdocs.yml`:
- Around line 1524-1529: Update the redirect mappings in the MkDocs
configuration so the legacy API Gateway paths listed in this block point to the
corresponding API Gateway documentation pages, not the ai-gateway/1.1.0
destinations. Preserve the existing deployment-mode targets while correcting the
product prefix for the affected redirects.
---
Outside diff comments:
In
`@en/docs/ai-gateway/1.2.0/deployment/production-deployment/deploy-and-verify.md`:
- Around line 276-290: Update the production deployment configuration so the CA
bundle required by ssl_root_cert at /etc/platform-api/tls/ca.pem is available
inside the container. Add a read-only volume mount for the database CA
certificate, or adjust ssl_root_cert to the path of an existing mounted CA file,
while preserving the verify-full configuration.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 5bf91ed0-3d88-47fa-b8f7-73c5a9b23b42
⛔ Files ignored due to path filters (2)
en/docs/assets/img/ai-gateway/standalone-ai-workspace/production/deployment-architecture.pngis excluded by!**/*.pngen/docs/assets/img/ai-gateway/standalone-ai-workspace/production/kubernetes-high-availability.pngis excluded by!**/*.png
📒 Files selected for processing (75)
en/docs/ai-gateway/1.0.0/deployment/deployment-modes/immutable-gateway.mden/docs/ai-gateway/1.0.0/deployment/deployment-modes/kubernetes/gateway-operator.mden/docs/ai-gateway/1.0.0/deployment/deployment-modes/kubernetes/kubernetes-standalone.mden/docs/ai-gateway/1.0.0/deployment/deployment-modes/kubernetes/overview.mden/docs/ai-gateway/1.0.0/deployment/production-deployment/ai-workload-tuning.mden/docs/ai-gateway/1.0.0/deployment/production-deployment/control-plane-connection.mden/docs/ai-gateway/1.0.0/deployment/production-deployment/deploy-and-verify.mden/docs/ai-gateway/1.0.0/deployment/production-deployment/overview.mden/docs/ai-gateway/1.0.0/deployment/production-deployment/resources-and-scaling.mden/docs/ai-gateway/1.0.0/deployment/production-deployment/security-hardening.mden/docs/ai-gateway/1.0.0/overview.mden/docs/ai-gateway/1.1.0/deployment/deployment-modes/immutable-gateway.mden/docs/ai-gateway/1.1.0/deployment/deployment-modes/kubernetes/gateway-operator.mden/docs/ai-gateway/1.1.0/deployment/deployment-modes/kubernetes/kubernetes-standalone.mden/docs/ai-gateway/1.1.0/deployment/deployment-modes/kubernetes/overview.mden/docs/ai-gateway/1.1.0/deployment/production-deployment/ai-workload-tuning.mden/docs/ai-gateway/1.1.0/deployment/production-deployment/control-plane-connection.mden/docs/ai-gateway/1.1.0/deployment/production-deployment/database-configuration.mden/docs/ai-gateway/1.1.0/deployment/production-deployment/deploy-and-verify.mden/docs/ai-gateway/1.1.0/deployment/production-deployment/overview.mden/docs/ai-gateway/1.1.0/deployment/production-deployment/resources-and-scaling.mden/docs/ai-gateway/1.1.0/deployment/production-deployment/security-hardening.mden/docs/ai-gateway/1.1.0/overview.mden/docs/ai-gateway/1.2.0/deployment/deployment-modes/immutable-gateway.mden/docs/ai-gateway/1.2.0/deployment/deployment-modes/kubernetes/gateway-operator.mden/docs/ai-gateway/1.2.0/deployment/deployment-modes/kubernetes/kubernetes-standalone.mden/docs/ai-gateway/1.2.0/deployment/deployment-modes/kubernetes/overview.mden/docs/ai-gateway/1.2.0/deployment/production-deployment/ai-workload-tuning.mden/docs/ai-gateway/1.2.0/deployment/production-deployment/control-plane-connection.mden/docs/ai-gateway/1.2.0/deployment/production-deployment/database-configuration.mden/docs/ai-gateway/1.2.0/deployment/production-deployment/deploy-and-verify.mden/docs/ai-gateway/1.2.0/deployment/production-deployment/overview.mden/docs/ai-gateway/1.2.0/deployment/production-deployment/resources-and-scaling.mden/docs/ai-gateway/1.2.0/deployment/production-deployment/security-hardening.mden/docs/ai-gateway/1.2.0/llm-proxy/multi-provider-routing.mden/docs/ai-gateway/1.2.0/llm-proxy/quick-start-guide.mden/docs/ai-gateway/1.2.0/mcp-proxy/quick-start-guide.mden/docs/ai-gateway/1.2.0/overview.mden/docs/ai-gateway/1.2.0/quick-start-guide.mden/docs/ai-gateway/next/deployment/deployment-modes/immutable-gateway.mden/docs/ai-gateway/next/deployment/deployment-modes/kubernetes/gateway-operator.mden/docs/ai-gateway/next/deployment/deployment-modes/kubernetes/kubernetes-standalone.mden/docs/ai-gateway/next/deployment/deployment-modes/kubernetes/overview.mden/docs/ai-gateway/next/deployment/production-deployment/ai-workload-tuning.mden/docs/ai-gateway/next/deployment/production-deployment/control-plane-connection.mden/docs/ai-gateway/next/deployment/production-deployment/database-configuration.mden/docs/ai-gateway/next/deployment/production-deployment/deploy-and-verify.mden/docs/ai-gateway/next/deployment/production-deployment/overview.mden/docs/ai-gateway/next/deployment/production-deployment/resources-and-scaling.mden/docs/ai-gateway/next/deployment/production-deployment/security-hardening.mden/docs/ai-gateway/next/overview.mden/docs/ai-gateway/next/quick-start-guide.mden/docs/ai-workspace/1.0.0/production/connect-gateways.mden/docs/ai-workspace/1.0.0/production/deploy.mden/docs/ai-workspace/1.0.0/production/expose-the-workspace.mden/docs/ai-workspace/1.0.0/production/harden.mden/docs/ai-workspace/1.0.0/production/high-availability.mden/docs/ai-workspace/1.0.0/production/operate.mden/docs/ai-workspace/1.0.0/production/overview.mden/docs/ai-workspace/1.0.0/production/secrets-and-keys.mden/docs/ai-workspace/1.0.0/production/tls.mden/docs/ai-workspace/1.0.0/sync-gateway-created-artifacts.mden/docs/ai-workspace/next/production/connect-gateways.mden/docs/ai-workspace/next/production/deploy.mden/docs/ai-workspace/next/production/expose-the-workspace.mden/docs/ai-workspace/next/production/harden.mden/docs/ai-workspace/next/production/high-availability.mden/docs/ai-workspace/next/production/operate.mden/docs/ai-workspace/next/production/overview.mden/docs/ai-workspace/next/production/secrets-and-keys.mden/docs/ai-workspace/next/production/tls.mden/docs/ai-workspace/next/sync-gateway-created-artifacts.mden/docs/index.mden/docs/llms.txten/mkdocs.yml
…g revisions to deployment guidelines, descriptions, and terminology. Adjusted references to LLM and MCP traffic, improved formatting, and ensured accurate descriptions of security and scaling configurations.
There was a problem hiding this comment.
Actionable comments posted: 9
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (14)
en/docs/index.md (1)
101-103: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winRewrite the self-hosted component descriptions with short, complete sentences.
The two list items use spaced em dashes. The AI Workspace item also contains a 29-word sentence. Replace the separators with unspaced em dashes or colons. Split the actions into sentences with fewer than 26 words.
Proposed fix
-* **AI Workspace** — A self-hosted control plane for AI traffic. Connect AI Gateway runtimes, configure LLM providers, App LLM proxies, and MCP proxies, apply guardrails and rate limits, manage secrets, and deploy the configuration to one or more gateways. See [AI Workspace documentation](ai-workspace/1.0.0/overview.md). -* **API Portal** — A self-hosted developer portal where consumers discover APIs and MCP servers, create applications, and manage subscriptions and keys. See [API Portal documentation](api-portal/1.0.0/overview.md). +* **AI Workspace**—Use AI Workspace as a self-hosted control plane for AI traffic. Connect AI Gateway runtimes, configure LLM providers, App LLM proxies, and MCP proxies. Apply guardrails and rate limits, manage secrets, and deploy the configuration to one or more gateways. See [AI Workspace documentation](ai-workspace/1.0.0/overview.md). +* **API Portal**—Use API Portal as a self-hosted developer portal. Consumers can discover APIs and MCP servers, create applications, and manage subscriptions and keys. See [API Portal documentation](api-portal/1.0.0/overview.md).As per coding guidelines, use em dashes without surrounding spaces and write simple, complete sentences with fewer than 26 words. As per path instructions, report these documentation violations for files under
en/docs/**/*.md.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@en/docs/index.md` around lines 101 - 103, Rewrite the AI Workspace and API Portal descriptions in the documentation list using unspaced em dashes or colons. Split the AI Workspace actions into short, complete sentences, keeping each sentence under 26 words while preserving the existing feature descriptions and links.Sources: Coding guidelines, Path instructions
en/docs/ai-gateway/1.0.0/deployment/production-deployment/ai-workload-tuning.md (1)
57-57: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winRemove spaces around the em dashes.
Use the required form, such as
service—link, in the external-service sentence and both bullets.As per coding guidelines, use em dashes without surrounding spaces.
Also applies to: 108-109
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@en/docs/ai-gateway/1.0.0/deployment/production-deployment/ai-workload-tuning.md` at line 57, Update the external-service sentence and the corresponding bullets in the AI workload tuning documentation to remove spaces surrounding em dashes, using the required `service—link` form while preserving the existing links and wording.Sources: Coding guidelines, Path instructions
en/docs/ai-workspace/1.0.0/production/operate.md (2)
218-223: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winWait for the UI rollout before declaring success.
The upgrade changes both services, but the verification waits only for
<release-name>-platform-api. A failedai-workspace-uirollout can be missed. Addkubectl rollout status deploy/<release-name>-ai-workspace-ui.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@en/docs/ai-workspace/1.0.0/production/operate.md` around lines 218 - 223, Update the rollout verification commands in the production operation instructions to wait for both deployments: retain the existing <release-name>-platform-api status check and add kubectl rollout status for <release-name>-ai-workspace-ui before checking pod readiness.
37-47: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winConfigure log rotation for both Compose services.
The example configures
platform-apionly, although the preceding text covers both services. Add the same logging configuration forai-workspace, or state that operators must repeat it. Otherwise, workspace logs can fill the host disk.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@en/docs/ai-workspace/1.0.0/production/operate.md` around lines 37 - 47, Update the Compose logging example to apply the same json-file rotation settings (max-size and max-file) to both platform-api and ai-workspace services, matching the documented scope.en/docs/ai-gateway/1.0.0/deployment/production-deployment/deploy-and-verify.md (1)
159-171: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winDo not attribute all buffered responses to a policy.
Ingress controllers, reverse proxies, providers, and policies can buffer streams. Update this diagnosis to include each layer and distinguish buffering from a provider that does not stream.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@en/docs/ai-gateway/1.0.0/deployment/production-deployment/deploy-and-verify.md` around lines 159 - 171, The streaming verification guidance after the curl example should diagnose end-of-response delivery across ingress controllers, reverse proxies, gateway policies, and providers, rather than attributing it solely to a policy. Distinguish buffering at any layer from a provider/model that does not support streaming, and retain the existing timeout guidance for responses that cut off partway.en/docs/ai-workspace/next/production/connect-gateways.md (2)
77-85: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winKeep the registration token out of shell input.
The operator replaces
<registration-token>inside an interactive here-document. Terminal capture or shell history can retain the token. Useread -rspandprintfunderumask 077, or reference a protected file or secret manager.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@en/docs/ai-workspace/next/production/connect-gateways.md` around lines 77 - 85, Update the api-platform.env setup instructions to avoid entering the registration token in an interactive here-document; under umask 077, collect it with read -rsp and write it using printf, or reference an existing protected file or secret manager while preserving the file permissions.
174-180: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winClarify that the registration token is for the gateway identity, not each replica
The page says the token is shown once and is single-use, but Step 6 tells readers to run two gateway instances while reusing the same token per environment. Add one sentence explaining that multiple replicas connect as the same gateway identity after registration, not as separate one-time registrations.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@en/docs/ai-workspace/next/production/connect-gateways.md` around lines 174 - 180, Add a sentence to Step 6 clarifying that gateway replicas reuse the registered gateway identity after initial registration, rather than performing separate one-time registrations with the registration token. Keep the existing guidance about separate tokens for each environment.en/docs/ai-workspace/1.0.0/production/overview.md (1)
31-33: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winDefine less familiar acronyms at first use.
These pages still introduce acronyms without definitions:
en/docs/ai-workspace/1.0.0/production/overview.md#L31-L33: DefineRESTandLLM.en/docs/ai-gateway/1.0.0/deployment/production-deployment/ai-workload-tuning.md#L41-L41: DefineTOML.en/docs/ai-gateway/1.0.0/deployment/production-deployment/control-plane-connection.md#L72-L72: DefineHTTPS.en/docs/ai-gateway/1.0.0/deployment/production-deployment/resources-and-scaling.md#L3-L3: ReplaceCPUwithprocessor, or expand it without exceeding the description limit.en/docs/ai-workspace/1.0.0/production/tls.md#L208-L208: DefineBFF.As per coding guidelines, define every acronym and initialism at first use. Based on learnings, keep universally recognized
HTTPandAPIabbreviated and expand less familiar acronyms.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@en/docs/ai-workspace/1.0.0/production/overview.md` around lines 31 - 33, Define less familiar acronyms at first use while preserving the existing documentation meaning: in en/docs/ai-workspace/1.0.0/production/overview.md lines 31-33, expand REST and LLM; in en/docs/ai-gateway/1.0.0/deployment/production-deployment/ai-workload-tuning.md line 41, define TOML; in en/docs/ai-gateway/1.0.0/deployment/production-deployment/control-plane-connection.md line 72, define HTTPS; in en/docs/ai-gateway/1.0.0/deployment/production-deployment/resources-and-scaling.md line 3, replace CPU with “processor” or expand it within the description limit; and in en/docs/ai-workspace/1.0.0/production/tls.md line 208, define BFF. Keep HTTP and API abbreviated.Sources: Coding guidelines, Path instructions, Learnings
en/docs/ai-workspace/next/production/operate.md (1)
218-223: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winWait for both component rollouts.
The verification waits only for
platform-api.kubectl get podslists state but does not wait forai-workspace-ui. Add rollout status checks for both deployments before declaring the upgrade complete.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@en/docs/ai-workspace/next/production/operate.md` around lines 218 - 223, Update the rollout verification instructions to wait for both platform-api and ai-workspace-ui deployments using kubectl rollout status before checking pod readiness or declaring the upgrade complete. Keep the existing platform-api check and add the corresponding ai-workspace-ui deployment check.en/docs/ai-gateway/1.1.0/deployment/production-deployment/resources-and-scaling.md (1)
130-131: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winRemove SQL Server from the 1.1.0 prerequisite.
en/docs/ai-gateway/1.1.0/deployment/production-deployment/database-configuration.mdstates that AI Gateway 1.2.0 adds SQL Server. This 1.1.0 page must requirestorage.type: postgresonly.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@en/docs/ai-gateway/1.1.0/deployment/production-deployment/resources-and-scaling.md` around lines 130 - 131, Update the controller HPA warning in the production scaling documentation to require storage.type set to postgres only; remove sqlserver from the listed prerequisites while preserving the SQLite concurrent-replica limitation and database configuration reference.en/docs/ai-gateway/1.1.0/deployment/production-deployment/database-configuration.md (2)
113-115: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winDefine
DSNat first use.Change the heading or first sentence to
data source name (DSN). The documentation rules require less-universal acronyms to be defined before later use.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@en/docs/ai-gateway/1.1.0/deployment/production-deployment/database-configuration.md` around lines 113 - 115, Update the “Supply a DSN instead” section heading or its first sentence to spell out “data source name (DSN)” before using the acronym, while preserving the existing guidance about supplying a full DSN from a secrets manager.Sources: Coding guidelines, Path instructions
117-120: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winKeep the database password out of command arguments.
Replacing
your-db-passwordwith a real value places that password in shell history and in thekubectlprocess arguments. Use a protected file, stdin, or a secret manager. URL-encode the password when constructing a DSN.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@en/docs/ai-gateway/1.1.0/deployment/production-deployment/database-configuration.md` around lines 117 - 120, Update the gateway-db-dsn creation example to avoid embedding the database password in the command or shell history by sourcing the DSN from a protected file, stdin, or secret manager. Ensure the password is URL-encoded when constructing the PostgreSQL DSN, while preserving the existing secret name and namespace usage.en/docs/ai-gateway/1.2.0/deployment/production-deployment/deploy-and-verify.md (1)
173-181: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winThe high-availability check does not test every runtime replica.
en/docs/ai-gateway/1.2.0/deployment/production-deployment/deploy-and-verify.md#L173-L181: Add per-pod requests or active-configuration checks. Keep the Service request as a separate load-balancing check.en/docs/ai-gateway/1.1.0/deployment/production-deployment/deploy-and-verify.md#L173-L181: Add the same per-pod verification before declaring cross-replica propagation successful.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@en/docs/ai-gateway/1.2.0/deployment/production-deployment/deploy-and-verify.md` around lines 173 - 181, Update the “Verify high availability” section in en/docs/ai-gateway/1.2.0/deployment/production-deployment/deploy-and-verify.md (lines 173-181) and en/docs/ai-gateway/1.1.0/deployment/production-deployment/deploy-and-verify.md (lines 173-181) to add requests or active-configuration checks directly against every runtime pod before declaring propagation successful; retain the existing Service-based repeated request as a separate load-balancing verification.en/docs/ai-gateway/1.2.0/deployment/deployment-modes/kubernetes/gateway-operator.md (1)
424-424: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winForward to the controller before posting certificates.
The
localhost:9090command targets the gateway controller management API, but this operator document does not establish akubectl port-forwardlistener for that port. Add the port-forward step before this command, or use a documented service endpoint instead.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@en/docs/ai-gateway/1.2.0/deployment/deployment-modes/kubernetes/gateway-operator.md` at line 424, Add a documented kubectl port-forward step before the curl certificate POST so localhost:9090 is connected to the gateway controller management API, or replace the URL with an already documented service endpoint. Ensure the certificate command uses the same reachable endpoint established by the deployment instructions.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@en/docs/ai-gateway/1.0.0/deployment/production-deployment/deploy-and-verify.md`:
- Around line 95-98: Update both management curl requests in the deployment
instructions to avoid passing the administrator password through the
command-line arguments. Create and use a mode-0600 --netrc-file or equivalent
file-based credential input, and replace the -u
"$ADMIN_USERNAME:$ADMIN_PASSWORD" usage while preserving authentication for both
requests.
In
`@en/docs/ai-gateway/1.2.0/deployment/production-deployment/deploy-and-verify.md`:
- Line 88: Split the long sentences into shorter, clear declarative statements
while preserving the existing technical meaning: in
en/docs/ai-gateway/1.2.0/deployment/production-deployment/deploy-and-verify.md
lines 88 and 218, separate credential-handling actions from security guidance
and split upgrade-availability guidance; in overview.md line 19,
resources-and-scaling.md line 43, and security-hardening.md lines 19-25, split
the deployment scope, runtime workload, and security/encryption statements;
apply the same workload split in
en/docs/ai-gateway/next/deployment/production-deployment/ai-workload-tuning.md
line 19; and make the corresponding sentence-length corrections in the listed
1.1.0 security-hardening.md lines 19-25, control-plane-connection.md lines
20-23, database-configuration.md line 18, resources-and-scaling.md line 43, and
deploy-and-verify.md lines 88 and 218.
In `@en/docs/ai-gateway/1.2.0/quick-start-guide.md`:
- Line 201: Update the “Bottom-up” bullet to remove time-dependent phrases such
as “as you did earlier on this page” and “you deployed above,” replacing them
with direct present-tense wording while preserving the existing synchronization
behavior and links.
In
`@en/docs/ai-gateway/next/deployment/production-deployment/control-plane-connection.md`:
- Line 19: Split the identified long sentences into short, complete sentences,
keeping each under 26 words. In control-plane-connection.md (19), separate
optional control-plane use from LLM and MCP routing. In deploy-and-verify.md
(88, 218), separate secret handling, history protection, here-document
expansion, availability guidance, and streaming drain guidance. In overview.md
(19), separate audience, deployment, security, database, scaling, and AI traffic
requirements. In resources-and-scaling.md (43), separate runtime composition
from per-request policy cost. In security-hardening.md (19, 23, 75), separate
security requirements from rationale, encryption from credential examples, and
filename parsing from mounted-path validation. In connect-gateways.md (20, 107),
separate registration guidance from production additions and protected-file
handling from warnings. In expose-the-workspace.md (157), separate backend
routing from redirect and health checks. In harden.md (304), separate source
selection from gateway disconnection consequences.
In `@en/docs/ai-gateway/next/overview.md`:
- Around line 21-22: Update both Quick Start summaries in
en/docs/ai-gateway/next/overview.md lines 21-22 and
en/docs/ai-gateway/1.0.0/overview.md lines 21-22, replacing “Gateway Controller
Management API” with “Gateway Controller admin health endpoint” while leaving
the remaining bullet text unchanged.
In `@en/docs/ai-workspace/1.0.0/production/deploy.md`:
- Around line 34-46: Update the introductory sentence above the configuration
table to state the concrete consequences: changing the workspace hostname
requires updating identity-provider redirect URLs, and changing the control
plane address requires reconfiguring every gateway. Remove the vague “hard to
change afterward” wording while keeping the existing warning details consistent.
In `@en/docs/ai-workspace/1.0.0/production/expose-the-workspace.md`:
- Line 25: Update the browser-routing statement to apply only to the default
backend-for-frontend deployment, where the BFF proxies calls server-to-server.
Separately describe the documented direct-browser access path through CORS,
rather than asserting that the browser never calls the Platform API.
In `@en/docs/ai-workspace/1.0.0/production/harden.md`:
- Around line 289-304: Update the NetworkPolicy ingress sources in the
documented policy example to remove the broad ingress-nginx namespace allowance;
retain only the specific AI Workspace backend, frontend, and gateway sources
required by the deployment, adding a narrower selector if ingress-nginx is
genuinely an actual caller.
In `@en/docs/ai-workspace/next/production/operate.md`:
- Around line 201-208: Update the Helm rendering instructions around the helm
template command to avoid writing unencrypted Secret manifests to the persistent
next.yaml file. Render into a protected temporary location with cleanup
guaranteed by an exit trap, or use a validation flow that redacts Secret data,
while preserving the review step and secure cleanup behavior.
---
Outside diff comments:
In
`@en/docs/ai-gateway/1.0.0/deployment/production-deployment/ai-workload-tuning.md`:
- Line 57: Update the external-service sentence and the corresponding bullets in
the AI workload tuning documentation to remove spaces surrounding em dashes,
using the required `service—link` form while preserving the existing links and
wording.
In
`@en/docs/ai-gateway/1.0.0/deployment/production-deployment/deploy-and-verify.md`:
- Around line 159-171: The streaming verification guidance after the curl
example should diagnose end-of-response delivery across ingress controllers,
reverse proxies, gateway policies, and providers, rather than attributing it
solely to a policy. Distinguish buffering at any layer from a provider/model
that does not support streaming, and retain the existing timeout guidance for
responses that cut off partway.
In
`@en/docs/ai-gateway/1.1.0/deployment/production-deployment/database-configuration.md`:
- Around line 113-115: Update the “Supply a DSN instead” section heading or its
first sentence to spell out “data source name (DSN)” before using the acronym,
while preserving the existing guidance about supplying a full DSN from a secrets
manager.
- Around line 117-120: Update the gateway-db-dsn creation example to avoid
embedding the database password in the command or shell history by sourcing the
DSN from a protected file, stdin, or secret manager. Ensure the password is
URL-encoded when constructing the PostgreSQL DSN, while preserving the existing
secret name and namespace usage.
In
`@en/docs/ai-gateway/1.1.0/deployment/production-deployment/resources-and-scaling.md`:
- Around line 130-131: Update the controller HPA warning in the production
scaling documentation to require storage.type set to postgres only; remove
sqlserver from the listed prerequisites while preserving the SQLite
concurrent-replica limitation and database configuration reference.
In
`@en/docs/ai-gateway/1.2.0/deployment/deployment-modes/kubernetes/gateway-operator.md`:
- Line 424: Add a documented kubectl port-forward step before the curl
certificate POST so localhost:9090 is connected to the gateway controller
management API, or replace the URL with an already documented service endpoint.
Ensure the certificate command uses the same reachable endpoint established by
the deployment instructions.
In
`@en/docs/ai-gateway/1.2.0/deployment/production-deployment/deploy-and-verify.md`:
- Around line 173-181: Update the “Verify high availability” section in
en/docs/ai-gateway/1.2.0/deployment/production-deployment/deploy-and-verify.md
(lines 173-181) and
en/docs/ai-gateway/1.1.0/deployment/production-deployment/deploy-and-verify.md
(lines 173-181) to add requests or active-configuration checks directly against
every runtime pod before declaring propagation successful; retain the existing
Service-based repeated request as a separate load-balancing verification.
In `@en/docs/ai-workspace/1.0.0/production/operate.md`:
- Around line 218-223: Update the rollout verification commands in the
production operation instructions to wait for both deployments: retain the
existing <release-name>-platform-api status check and add kubectl rollout status
for <release-name>-ai-workspace-ui before checking pod readiness.
- Around line 37-47: Update the Compose logging example to apply the same
json-file rotation settings (max-size and max-file) to both platform-api and
ai-workspace services, matching the documented scope.
In `@en/docs/ai-workspace/1.0.0/production/overview.md`:
- Around line 31-33: Define less familiar acronyms at first use while preserving
the existing documentation meaning: in
en/docs/ai-workspace/1.0.0/production/overview.md lines 31-33, expand REST and
LLM; in
en/docs/ai-gateway/1.0.0/deployment/production-deployment/ai-workload-tuning.md
line 41, define TOML; in
en/docs/ai-gateway/1.0.0/deployment/production-deployment/control-plane-connection.md
line 72, define HTTPS; in
en/docs/ai-gateway/1.0.0/deployment/production-deployment/resources-and-scaling.md
line 3, replace CPU with “processor” or expand it within the description limit;
and in en/docs/ai-workspace/1.0.0/production/tls.md line 208, define BFF. Keep
HTTP and API abbreviated.
In `@en/docs/ai-workspace/next/production/connect-gateways.md`:
- Around line 77-85: Update the api-platform.env setup instructions to avoid
entering the registration token in an interactive here-document; under umask
077, collect it with read -rsp and write it using printf, or reference an
existing protected file or secret manager while preserving the file permissions.
- Around line 174-180: Add a sentence to Step 6 clarifying that gateway replicas
reuse the registered gateway identity after initial registration, rather than
performing separate one-time registrations with the registration token. Keep the
existing guidance about separate tokens for each environment.
In `@en/docs/ai-workspace/next/production/operate.md`:
- Around line 218-223: Update the rollout verification instructions to wait for
both platform-api and ai-workspace-ui deployments using kubectl rollout status
before checking pod readiness or declaring the upgrade complete. Keep the
existing platform-api check and add the corresponding ai-workspace-ui deployment
check.
In `@en/docs/index.md`:
- Around line 101-103: Rewrite the AI Workspace and API Portal descriptions in
the documentation list using unspaced em dashes or colons. Split the AI
Workspace actions into short, complete sentences, keeping each sentence under 26
words while preserving the existing feature descriptions and links.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 4136975e-528c-47ae-be7e-9eecd8f56e1e
📒 Files selected for processing (58)
en/docs/ai-gateway/1.0.0/deployment/production-deployment/ai-workload-tuning.mden/docs/ai-gateway/1.0.0/deployment/production-deployment/control-plane-connection.mden/docs/ai-gateway/1.0.0/deployment/production-deployment/deploy-and-verify.mden/docs/ai-gateway/1.0.0/deployment/production-deployment/overview.mden/docs/ai-gateway/1.0.0/deployment/production-deployment/resources-and-scaling.mden/docs/ai-gateway/1.0.0/deployment/production-deployment/security-hardening.mden/docs/ai-gateway/1.0.0/overview.mden/docs/ai-gateway/1.1.0/deployment/production-deployment/ai-workload-tuning.mden/docs/ai-gateway/1.1.0/deployment/production-deployment/control-plane-connection.mden/docs/ai-gateway/1.1.0/deployment/production-deployment/database-configuration.mden/docs/ai-gateway/1.1.0/deployment/production-deployment/deploy-and-verify.mden/docs/ai-gateway/1.1.0/deployment/production-deployment/resources-and-scaling.mden/docs/ai-gateway/1.1.0/deployment/production-deployment/security-hardening.mden/docs/ai-gateway/1.1.0/overview.mden/docs/ai-gateway/1.2.0/deployment/deployment-modes/immutable-gateway.mden/docs/ai-gateway/1.2.0/deployment/deployment-modes/kubernetes/gateway-operator.mden/docs/ai-gateway/1.2.0/deployment/deployment-modes/kubernetes/kubernetes-standalone.mden/docs/ai-gateway/1.2.0/deployment/production-deployment/ai-workload-tuning.mden/docs/ai-gateway/1.2.0/deployment/production-deployment/control-plane-connection.mden/docs/ai-gateway/1.2.0/deployment/production-deployment/database-configuration.mden/docs/ai-gateway/1.2.0/deployment/production-deployment/deploy-and-verify.mden/docs/ai-gateway/1.2.0/deployment/production-deployment/overview.mden/docs/ai-gateway/1.2.0/deployment/production-deployment/resources-and-scaling.mden/docs/ai-gateway/1.2.0/deployment/production-deployment/security-hardening.mden/docs/ai-gateway/1.2.0/overview.mden/docs/ai-gateway/1.2.0/quick-start-guide.mden/docs/ai-gateway/next/deployment/deployment-modes/immutable-gateway.mden/docs/ai-gateway/next/deployment/deployment-modes/kubernetes/gateway-operator.mden/docs/ai-gateway/next/deployment/deployment-modes/kubernetes/kubernetes-standalone.mden/docs/ai-gateway/next/deployment/production-deployment/ai-workload-tuning.mden/docs/ai-gateway/next/deployment/production-deployment/control-plane-connection.mden/docs/ai-gateway/next/deployment/production-deployment/database-configuration.mden/docs/ai-gateway/next/deployment/production-deployment/deploy-and-verify.mden/docs/ai-gateway/next/deployment/production-deployment/overview.mden/docs/ai-gateway/next/deployment/production-deployment/resources-and-scaling.mden/docs/ai-gateway/next/deployment/production-deployment/security-hardening.mden/docs/ai-gateway/next/overview.mden/docs/ai-workspace/1.0.0/production/connect-gateways.mden/docs/ai-workspace/1.0.0/production/deploy.mden/docs/ai-workspace/1.0.0/production/expose-the-workspace.mden/docs/ai-workspace/1.0.0/production/harden.mden/docs/ai-workspace/1.0.0/production/high-availability.mden/docs/ai-workspace/1.0.0/production/operate.mden/docs/ai-workspace/1.0.0/production/overview.mden/docs/ai-workspace/1.0.0/production/secrets-and-keys.mden/docs/ai-workspace/1.0.0/production/tls.mden/docs/ai-workspace/1.0.0/sync-gateway-created-artifacts.mden/docs/ai-workspace/next/production/connect-gateways.mden/docs/ai-workspace/next/production/deploy.mden/docs/ai-workspace/next/production/expose-the-workspace.mden/docs/ai-workspace/next/production/harden.mden/docs/ai-workspace/next/production/high-availability.mden/docs/ai-workspace/next/production/operate.mden/docs/ai-workspace/next/production/overview.mden/docs/ai-workspace/next/production/secrets-and-keys.mden/docs/ai-workspace/next/production/tls.mden/docs/index.mden/mkdocs.yml
There was a problem hiding this comment.
Actionable comments posted: 12
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (6)
en/docs/index.md (1)
148-149: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winDefine abbreviations and format the filename.
Line 148 introduces
GenAIwithout expansion. Line 149 introducesSDKwithout expansion and rendersllms.txtas plain text. Expand the abbreviations at first use and format the filename as`llms.txt`.As per coding guidelines, define acronyms at first use and use code formatting for filenames. As per path instructions, report this documentation violation under
en/docs/**/*.md.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@en/docs/index.md` around lines 148 - 149, Update the AI Workspace description to expand “GenAI” at first use, and update the API Portal and MCP Hub description to expand “SDK” at first use. Format the llms.txt filename with inline code syntax while preserving the existing links and descriptions.Sources: Coding guidelines, Path instructions
en/docs/ai-gateway/1.0.0/deployment/production-deployment/ai-workload-tuning.md (1)
130-131: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winClarify the log-level direction.
Line 115 tells readers to move from
debugtoinfo. Line 131 says “before raising the log level,” which can imply enabling more verbose logging. State “before enabling debug-level logging” or “before changing the log level.”As per path instructions, use concise and unambiguous wording in documentation.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@en/docs/ai-gateway/1.0.0/deployment/production-deployment/ai-workload-tuning.md` around lines 130 - 131, Update the warning text near “Prompts and completions are sensitive” to replace the ambiguous “before raising the log level” wording with concise language such as “before enabling debug-level logging” or “before changing the log level,” while preserving the existing sensitivity and access-control guidance.Source: Path instructions
en/docs/ai-workspace/next/production/deploy.md (1)
41-41: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winUse the issuer URL, not the token endpoint.
https://idp.example.com/oauth2/tokenis the token endpoint, but the Platform API and AI Workspace need the token issuer (iss) or OIDC discovery authority for validation and discovery. Use the actual issuer, such ashttps://idp.example.com/oauth2, and keep the token endpoint separate if it differs.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@en/docs/ai-workspace/next/production/deploy.md` at line 41, Update the “Identity provider issuer” entry in the deployment configuration table to use the OIDC issuer or discovery authority URL, not the `/token` endpoint. Use the actual issuer value, such as `https://idp.example.com/oauth2`, and document the token endpoint separately only where needed.en/docs/ai-gateway/1.0.0/deployment/production-deployment/control-plane-connection.md (1)
31-37: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winGuarantee owner-only permissions for credential files.
Local credential files must remain readable only by the owner on shell reruns.
control-plane-connection.md#L31-L37: create or protecttoken.txtwith mode0600, then delete it after the Secret is created.deploy-and-verify.md#L93-L98:umask 077only affects newly created files; useinstall -m 600 controller.netrcor set permissions before writing if rerunning the command.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@en/docs/ai-gateway/1.0.0/deployment/production-deployment/control-plane-connection.md` around lines 31 - 37, Ensure credential files are owner-readable only: in control-plane-connection.md lines 31-37, create or protect token.txt with mode 0600 before using it and delete it after the Secret is created; in deploy-and-verify.md lines 93-98, replace reliance on umask for reruns by using install -m 600 controller.netrc or setting its permissions before writing.en/docs/ai-gateway/1.1.0/deployment/production-deployment/control-plane-connection.md (1)
37-37: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winProtect
token.txtbefore creating the Secret.The procedure deletes the file afterward but does not set restrictive permissions before
kubectlreads it. If the file inherits a permissive mode, another local account can read the registration token. Setumask 077before creating the file or requirechmod 600 token.txt.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@en/docs/ai-gateway/1.1.0/deployment/production-deployment/control-plane-connection.md` at line 37, Update the token-file creation procedure to enforce restrictive permissions before kubectl reads token.txt by setting umask 077 before creating it or explicitly applying chmod 600. Preserve the existing deletion step afterward.en/docs/ai-gateway/1.2.0/deployment/production-deployment/overview.md (1)
136-145: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winKeep registry credentials out of command arguments.
The 1.2.0 example repeats the earlier credential-exposure finding. The 1.1.0 example has the same issue. Use protected file input or a supported secret manager.
en/docs/ai-gateway/1.2.0/deployment/production-deployment/overview.md#L136-L145: remove--docker-password="$WSO2_TOKEN"from the command argument list.en/docs/ai-gateway/1.1.0/deployment/production-deployment/overview.md#L132-L139: replace the literal password placeholder with protected Secret creation.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@en/docs/ai-gateway/1.2.0/deployment/production-deployment/overview.md` around lines 136 - 145, Remove the registry password from command arguments in en/docs/ai-gateway/1.2.0/deployment/production-deployment/overview.md lines 136-145 by using protected file input or a supported secret manager instead of --docker-password="$WSO2_TOKEN"; update the corresponding Secret creation example in en/docs/ai-gateway/1.1.0/deployment/production-deployment/overview.md lines 132-139 to replace the literal password placeholder with the same protected approach.
♻️ Duplicate comments (2)
en/docs/ai-workspace/1.0.0/production/harden.md (1)
286-290:⚠️ Potential issue | 🟠 MajorNarrow the optional
ingress-nginxsource.The NetworkPolicy allows every pod in the
ingress-nginxnamespace to reach Platform API port9243. This remains broader than the stated caller set. Remove it unless the ingress controller is an actual gateway source, or select only the ingress pods required for this route.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@en/docs/ai-workspace/1.0.0/production/harden.md` around lines 286 - 290, Restrict the optional ingress-nginx NetworkPolicy peer so it is included only when the ingress controller is an actual gateway source; otherwise remove the ingress-nginx namespaceSelector. When retained, add a podSelector targeting only the ingress pods required to reach the Platform API on port 9243, rather than allowing every pod in the namespace.en/docs/ai-workspace/1.0.0/production/operate.md (1)
203-215:⚠️ Potential issue | 🟠 MajorDo not write rendered Secret data to
./next.yaml.The command renders Secret manifests in cleartext to a file.
umask 077does not remove the exposure while the file exists, and it does not change permissions on an existing file. Suppress Secret output, or use a mode-0600 temporary file with immediate cleanup.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@en/docs/ai-workspace/1.0.0/production/operate.md` around lines 203 - 215, Update the Helm preview instructions in the production operations guide so rendered Secret data is not written to the persistent ./next.yaml file. Replace the current output approach with either Secret suppression or a securely created mode-0600 temporary file that is cleaned up immediately, while preserving the preview workflow for non-secret manifests.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@en/docs/ai-gateway/1.0.0/deployment/production-deployment/deploy-and-verify.md`:
- Line 135: Update the authentication guidance near the basic-auth note to avoid
passing identity-provider tokens directly through curl arguments. Replace the
Bearer-token command example with a protected curl header or configuration-file
approach, while preserving the documented Authorization header behavior.
- Around line 199-207: Update the per-replica verification loop around the
kubectl wget request to remove --no-check-certificate. Configure wget to use the
runtime CA and a hostname matching the certificate; if artifact-routing requires
localhost, explicitly bound that check and add a separate TLS-validated request.
In `@en/docs/ai-gateway/1.0.0/deployment/production-deployment/overview.md`:
- Around line 22-23: Update the database compatibility note in the deployment
overview to limit PostgreSQL and SQL Server interchangeability to connection and
setup configuration fields, and acknowledge driver-specific feature differences
such as autoscaling behavior. Avoid claiming they are interchangeable
everywhere.
In
`@en/docs/ai-gateway/1.1.0/deployment/production-deployment/database-configuration.md`:
- Around line 113-125: Update the DSN secret example in the “Supply a data
source name instead” section to use the database-specific secret name expected
by the reference implementation: gateway-postgres-dsn, gateway-mysql-dsn, or
gateway-sqlserver-dsn as appropriate. Keep the existing DSN input and kubectl
creation flow unchanged.
In
`@en/docs/ai-gateway/1.1.0/deployment/production-deployment/deploy-and-verify.md`:
- Line 210: In the deployment verification documentation, split the final
propagation-delay sentence into two sentences: keep the instruction to allow a
short interval separate from the explanation about controller replicas
coordinating through the shared database. Ensure each sentence has fewer than 26
words.
In
`@en/docs/ai-gateway/1.2.0/deployment/deployment-modes/kubernetes/gateway-operator.md`:
- Around line 422-427: Update the Kubernetes deployment instructions around the
port-forward command so certificate upload waits until port 9090 is ready and
the forwarding process is cleaned up afterward. Prefer instructing users to run
kubectl port-forward in a separate terminal without backgrounding it, or add an
explicit readiness check and cleanup trap before the subsequent curl request.
In
`@en/docs/ai-gateway/1.2.0/deployment/production-deployment/ai-workload-tuning.md`:
- Line 19: Update the introductory sentence in the deployment tuning section to
state that the gateway starts with chart defaults that production LLM traffic
often outgrows, explicitly referring to the documented settings rather than
saying “any of them” or using ambiguous pronouns.
In
`@en/docs/ai-gateway/1.2.0/deployment/production-deployment/deploy-and-verify.md`:
- Line 203: Remove the certificate-validation bypass from the replica check’s
wget command in
en/docs/ai-gateway/1.2.0/deployment/production-deployment/deploy-and-verify.md
at lines 203-203 and
en/docs/ai-gateway/1.1.0/deployment/production-deployment/deploy-and-verify.md
at lines 203-203. Keep the checks configured to validate the expected CA and
hostname rather than suppressing TLS certificate errors.
- Around line 199-207: Update the replica verification loops in
en/docs/ai-gateway/1.2.0/deployment/production-deployment/deploy-and-verify.md
lines 199-207 and
en/docs/ai-gateway/1.1.0/deployment/production-deployment/deploy-and-verify.md
lines 199-207 to enable strict shell failure handling, explicitly reject an
empty pod list, and preserve failure status from every kubectl exec runtime
check so the verification cannot report success unless all replicas pass.
- Around line 105-108: Make both management API curl procedures fail on HTTP
4xx/5xx responses by adding HTTP failure handling to the provider and proxy
requests. Apply the change at
en/docs/ai-gateway/1.2.0/deployment/production-deployment/deploy-and-verify.md
lines 105-108 and 140-143, and
en/docs/ai-gateway/1.1.0/deployment/production-deployment/deploy-and-verify.md
lines 105-108 and 140-143; use curl’s --fail option consistently so subsequent
deployment steps do not continue after an unsuccessful request.
In
`@en/docs/ai-gateway/1.2.0/deployment/production-deployment/security-hardening.md`:
- Line 23: Classify AWS Bedrock as an LLM provider credential rather than a
guardrail credential in both
en/docs/ai-gateway/1.2.0/deployment/production-deployment/security-hardening.md
lines 23-23 and
en/docs/ai-gateway/1.1.0/deployment/production-deployment/security-hardening.md
lines 23-23; move its example into the upstream API key list and leave only
guardrail services in the guardrail examples.
In
`@en/docs/ai-gateway/next/deployment/production-deployment/ai-workload-tuning.md`:
- Line 84: In ai-workload-tuning.md:84, split the guardrail guidance into
separate short sentences covering external-service examples, latency, and
keeping python_executor.timeout below route_timeout_ms. In
security-hardening.md:19, split the security overview into separate requirements
for encryption, TLS, and management API authentication; keep each documentation
sentence under 26 words.
---
Outside diff comments:
In
`@en/docs/ai-gateway/1.0.0/deployment/production-deployment/ai-workload-tuning.md`:
- Around line 130-131: Update the warning text near “Prompts and completions are
sensitive” to replace the ambiguous “before raising the log level” wording with
concise language such as “before enabling debug-level logging” or “before
changing the log level,” while preserving the existing sensitivity and
access-control guidance.
In
`@en/docs/ai-gateway/1.0.0/deployment/production-deployment/control-plane-connection.md`:
- Around line 31-37: Ensure credential files are owner-readable only: in
control-plane-connection.md lines 31-37, create or protect token.txt with mode
0600 before using it and delete it after the Secret is created; in
deploy-and-verify.md lines 93-98, replace reliance on umask for reruns by using
install -m 600 controller.netrc or setting its permissions before writing.
In
`@en/docs/ai-gateway/1.1.0/deployment/production-deployment/control-plane-connection.md`:
- Line 37: Update the token-file creation procedure to enforce restrictive
permissions before kubectl reads token.txt by setting umask 077 before creating
it or explicitly applying chmod 600. Preserve the existing deletion step
afterward.
In `@en/docs/ai-gateway/1.2.0/deployment/production-deployment/overview.md`:
- Around line 136-145: Remove the registry password from command arguments in
en/docs/ai-gateway/1.2.0/deployment/production-deployment/overview.md lines
136-145 by using protected file input or a supported secret manager instead of
--docker-password="$WSO2_TOKEN"; update the corresponding Secret creation
example in en/docs/ai-gateway/1.1.0/deployment/production-deployment/overview.md
lines 132-139 to replace the literal password placeholder with the same
protected approach.
In `@en/docs/ai-workspace/next/production/deploy.md`:
- Line 41: Update the “Identity provider issuer” entry in the deployment
configuration table to use the OIDC issuer or discovery authority URL, not the
`/token` endpoint. Use the actual issuer value, such as
`https://idp.example.com/oauth2`, and document the token endpoint separately
only where needed.
In `@en/docs/index.md`:
- Around line 148-149: Update the AI Workspace description to expand “GenAI” at
first use, and update the API Portal and MCP Hub description to expand “SDK” at
first use. Format the llms.txt filename with inline code syntax while preserving
the existing links and descriptions.
---
Duplicate comments:
In `@en/docs/ai-workspace/1.0.0/production/harden.md`:
- Around line 286-290: Restrict the optional ingress-nginx NetworkPolicy peer so
it is included only when the ingress controller is an actual gateway source;
otherwise remove the ingress-nginx namespaceSelector. When retained, add a
podSelector targeting only the ingress pods required to reach the Platform API
on port 9243, rather than allowing every pod in the namespace.
In `@en/docs/ai-workspace/1.0.0/production/operate.md`:
- Around line 203-215: Update the Helm preview instructions in the production
operations guide so rendered Secret data is not written to the persistent
./next.yaml file. Replace the current output approach with either Secret
suppression or a securely created mode-0600 temporary file that is cleaned up
immediately, while preserving the preview workflow for non-secret manifests.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 966eba92-cfb0-4041-960f-1c41277eb3c6
📒 Files selected for processing (49)
en/docs/ai-gateway/1.0.0/deployment/production-deployment/ai-workload-tuning.mden/docs/ai-gateway/1.0.0/deployment/production-deployment/control-plane-connection.mden/docs/ai-gateway/1.0.0/deployment/production-deployment/deploy-and-verify.mden/docs/ai-gateway/1.0.0/deployment/production-deployment/overview.mden/docs/ai-gateway/1.0.0/deployment/production-deployment/resources-and-scaling.mden/docs/ai-gateway/1.0.0/deployment/production-deployment/security-hardening.mden/docs/ai-gateway/1.0.0/overview.mden/docs/ai-gateway/1.1.0/deployment/production-deployment/ai-workload-tuning.mden/docs/ai-gateway/1.1.0/deployment/production-deployment/control-plane-connection.mden/docs/ai-gateway/1.1.0/deployment/production-deployment/database-configuration.mden/docs/ai-gateway/1.1.0/deployment/production-deployment/deploy-and-verify.mden/docs/ai-gateway/1.1.0/deployment/production-deployment/overview.mden/docs/ai-gateway/1.1.0/deployment/production-deployment/resources-and-scaling.mden/docs/ai-gateway/1.1.0/deployment/production-deployment/security-hardening.mden/docs/ai-gateway/1.1.0/overview.mden/docs/ai-gateway/1.2.0/deployment/deployment-modes/kubernetes/gateway-operator.mden/docs/ai-gateway/1.2.0/deployment/production-deployment/ai-workload-tuning.mden/docs/ai-gateway/1.2.0/deployment/production-deployment/control-plane-connection.mden/docs/ai-gateway/1.2.0/deployment/production-deployment/database-configuration.mden/docs/ai-gateway/1.2.0/deployment/production-deployment/deploy-and-verify.mden/docs/ai-gateway/1.2.0/deployment/production-deployment/overview.mden/docs/ai-gateway/1.2.0/deployment/production-deployment/resources-and-scaling.mden/docs/ai-gateway/1.2.0/deployment/production-deployment/security-hardening.mden/docs/ai-gateway/1.2.0/overview.mden/docs/ai-gateway/1.2.0/quick-start-guide.mden/docs/ai-gateway/next/deployment/production-deployment/ai-workload-tuning.mden/docs/ai-gateway/next/deployment/production-deployment/control-plane-connection.mden/docs/ai-gateway/next/deployment/production-deployment/database-configuration.mden/docs/ai-gateway/next/deployment/production-deployment/deploy-and-verify.mden/docs/ai-gateway/next/deployment/production-deployment/overview.mden/docs/ai-gateway/next/deployment/production-deployment/resources-and-scaling.mden/docs/ai-gateway/next/deployment/production-deployment/security-hardening.mden/docs/ai-gateway/next/overview.mden/docs/ai-gateway/next/quick-start-guide.mden/docs/ai-workspace/1.0.0/production/connect-gateways.mden/docs/ai-workspace/1.0.0/production/deploy.mden/docs/ai-workspace/1.0.0/production/expose-the-workspace.mden/docs/ai-workspace/1.0.0/production/harden.mden/docs/ai-workspace/1.0.0/production/operate.mden/docs/ai-workspace/1.0.0/production/overview.mden/docs/ai-workspace/1.0.0/production/tls.mden/docs/ai-workspace/next/production/connect-gateways.mden/docs/ai-workspace/next/production/deploy.mden/docs/ai-workspace/next/production/expose-the-workspace.mden/docs/ai-workspace/next/production/harden.mden/docs/ai-workspace/next/production/operate.mden/docs/ai-workspace/next/production/overview.mden/docs/ai-workspace/next/production/tls.mden/docs/index.md
…and consistency across deployment guidelines, security configurations, and API interactions. Revisions include improved instructions for handling sensitive data, adjustments to timeout settings for LLM traffic, and updated examples for creating Kubernetes Secrets.
There was a problem hiding this comment.
Actionable comments posted: 5
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (3)
en/docs/index.md (2)
135-135: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winClarify the AI Workspace comparison row.
Configure per gatewaydoes not name the configured object. Replaceorgwithorganization, and identify the AI resources explicitly.Proposed fix
-| **AI Workspace** | Available. Manage LLM providers, guardrails, and MCP at org level | Configure per gateway, or connect a self-hosted AI Workspace | +| **AI Workspace** | Available. Manage LLM providers, guardrails, and MCP servers and proxies at the organization level | Configure AI traffic per gateway, or connect a self-hosted AI Workspace |As per coding guidelines, use plain language and avoid ambiguous phrasing. As per path instructions, apply the documentation style rules strictly.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@en/docs/index.md` at line 135, Update the AI Workspace row in the comparison table to replace “org” with “organization” and explicitly identify the configured AI resources, including LLM providers, guardrails, and MCP; preserve the existing per-gateway and self-hosted configuration meaning.Sources: Coding guidelines, Path instructions
139-139: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winAddress the reader directly.
Replace the third-person adoption-path sentence with a direct instruction using
you.Proposed fix
-This is a common adoption path: a developer starts with a standalone gateway, and the organization later adds a control plane for unified governance. +You can start with a standalone gateway and add a control plane later for unified governance.As per coding guidelines, address the reader as “you.” As per path instructions, apply the documentation style rules strictly.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@en/docs/index.md` at line 139, Update the adoption-path sentence in the standalone gateway guidance to address the reader directly with “you” instead of describing what “a developer” does. Preserve the existing meaning and surrounding control-plane options.Sources: Coding guidelines, Path instructions
en/docs/ai-gateway/1.1.0/deployment/production-deployment/overview.md (1)
28-29: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winAlign the Helm chart version across the 1.1.0 guide.
This page pins chart version
1.1.5, buten/docs/ai-gateway/1.1.0/deployment/production-deployment/deploy-and-verify.mdinstalls chart version1.0.1at Lines 100-101. Following both pages can deploy an incompatible chart. Use the supported 1.1.x chart version consistently.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@en/docs/ai-gateway/1.1.0/deployment/production-deployment/overview.md` around lines 28 - 29, Update the Helm chart version used by the deployment command in deploy-and-verify.md to the supported 1.1.x version 1.1.5, matching the version pinned in the production deployment overview and keeping the guide’s release references consistent.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@en/docs/ai-gateway/1.2.0/deployment/production-deployment/control-plane-connection.md`:
- Around line 57-66: Guard token cleanup so shred -u token.txt runs only when
kubectl create secret generic gateway-cp-token succeeds. Apply this change in
en/docs/ai-gateway/1.2.0/deployment/production-deployment/control-plane-connection.md
lines 57-66 and
en/docs/ai-gateway/1.0.0/deployment/production-deployment/control-plane-connection.md
lines 32-41, preserving the token file when Secret creation fails.
In
`@en/docs/ai-gateway/1.2.0/deployment/production-deployment/deploy-and-verify.md`:
- Around line 135-144: Split the authentication note into shorter, direct
sentences in deploy-and-verify.md for
en/docs/ai-gateway/1.2.0/deployment/production-deployment/deploy-and-verify.md
lines 135-144,
en/docs/ai-gateway/next/deployment/production-deployment/deploy-and-verify.md
lines 135-144, and
en/docs/ai-gateway/1.0.0/deployment/production-deployment/deploy-and-verify.md
lines 135-144. Separate token selection, process-list protection,
configuration-file creation, replacement of --netrc-file with --config, cleanup,
and header behavior; keep every sentence under 26 words and preserve the
instructions.
- Around line 221-225: Update the repeated runtime replica wget probes in
en/docs/ai-gateway/1.2.0/deployment/production-deployment/deploy-and-verify.md
lines 221-225,
en/docs/ai-gateway/next/deployment/production-deployment/deploy-and-verify.md
lines 221-225, and
en/docs/ai-gateway/1.0.0/deployment/production-deployment/deploy-and-verify.md
lines 221-225 to include bounded timeout and no-retry options, such as
--timeout=30 -T 30 -r 0, so stalled probes fail instead of hanging.
In `@en/docs/ai-gateway/1.2.0/deployment/production-deployment/overview.md`:
- Around line 138-145: Update the credential-building command around WSO2_TOKEN
to JSON-encode both the WSO2 username and password before constructing
.dockerconfigjson, ensuring quotes, backslashes, and other special characters
are escaped correctly while preserving the existing kubectl secret creation
flow.
In `@en/docs/ai-gateway/next/deployment/production-deployment/overview.md`:
- Around line 141-145: Replace the raw JSON construction in the WSO2
subscription secret setup with a safe Docker Secret flow: preferably use kubectl
create secret docker-registry with WSO2_TOKEN passed through --docker-password,
or generate a properly JSON-escaped .dockerconfigjson before kubectl create
secret generic. Preserve the registry, namespace, username, and secret name
configuration.
---
Outside diff comments:
In `@en/docs/ai-gateway/1.1.0/deployment/production-deployment/overview.md`:
- Around line 28-29: Update the Helm chart version used by the deployment
command in deploy-and-verify.md to the supported 1.1.x version 1.1.5, matching
the version pinned in the production deployment overview and keeping the guide’s
release references consistent.
In `@en/docs/index.md`:
- Line 135: Update the AI Workspace row in the comparison table to replace “org”
with “organization” and explicitly identify the configured AI resources,
including LLM providers, guardrails, and MCP; preserve the existing per-gateway
and self-hosted configuration meaning.
- Line 139: Update the adoption-path sentence in the standalone gateway guidance
to address the reader directly with “you” instead of describing what “a
developer” does. Preserve the existing meaning and surrounding control-plane
options.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 6bab8f9c-5290-4d52-868e-0c8bbb05c8d5
📒 Files selected for processing (23)
en/docs/ai-gateway/1.0.0/deployment/production-deployment/ai-workload-tuning.mden/docs/ai-gateway/1.0.0/deployment/production-deployment/control-plane-connection.mden/docs/ai-gateway/1.0.0/deployment/production-deployment/deploy-and-verify.mden/docs/ai-gateway/1.0.0/deployment/production-deployment/security-hardening.mden/docs/ai-gateway/1.1.0/deployment/production-deployment/ai-workload-tuning.mden/docs/ai-gateway/1.1.0/deployment/production-deployment/control-plane-connection.mden/docs/ai-gateway/1.1.0/deployment/production-deployment/deploy-and-verify.mden/docs/ai-gateway/1.1.0/deployment/production-deployment/overview.mden/docs/ai-gateway/1.1.0/deployment/production-deployment/security-hardening.mden/docs/ai-gateway/1.2.0/deployment/deployment-modes/kubernetes/gateway-operator.mden/docs/ai-gateway/1.2.0/deployment/production-deployment/ai-workload-tuning.mden/docs/ai-gateway/1.2.0/deployment/production-deployment/control-plane-connection.mden/docs/ai-gateway/1.2.0/deployment/production-deployment/deploy-and-verify.mden/docs/ai-gateway/1.2.0/deployment/production-deployment/overview.mden/docs/ai-gateway/1.2.0/deployment/production-deployment/security-hardening.mden/docs/ai-gateway/next/deployment/production-deployment/ai-workload-tuning.mden/docs/ai-gateway/next/deployment/production-deployment/control-plane-connection.mden/docs/ai-gateway/next/deployment/production-deployment/deploy-and-verify.mden/docs/ai-gateway/next/deployment/production-deployment/overview.mden/docs/ai-gateway/next/deployment/production-deployment/security-hardening.mden/docs/ai-workspace/1.0.0/production/harden.mden/docs/ai-workspace/next/production/harden.mden/docs/index.md
Contributor
Author
|
@CodeRabbit approve |
Rate Limit Exceeded
|
Contributor
Author
|
@CodeRabbit approve |
✅ Action performedComments resolved and changes approved. |
renuka-fernando
approved these changes
Aug 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
$subject