maskflow-gateway 0.1.0__tar.gz

maskflow_gateway-0.1.0/.dockerignore

@@ -0,0 +1,8 @@
+tests/
+loadtest/
+deploy/
+*.md
+.venv/
+__pycache__/
+.pytest_cache/
+.ruff_cache/

maskflow_gateway-0.1.0/.gitignore

@@ -0,0 +1,16 @@
+__pycache__/
+*.py[cod]
+.venv/
+venv/
+.env
+node_modules/
+dist/
+build/
+*.egg-info/
+.DS_Store
+.pytest_cache/
+.idea/
+.coverage
+.mypy_cache/
+.ruff_cache/
+bench/indiapii/quality/.cache/

maskflow_gateway-0.1.0/PKG-INFO

@@ -0,0 +1,143 @@
+Metadata-Version: 2.5
+Name: maskflow-gateway
+Version: 0.1.0
+Summary: MaskFlow Gateway: a drop-in OpenAI/Anthropic-compatible proxy that masks PII before it reaches an LLM provider and restores it in the response -- streaming included.
+License: MIT
+Requires-Python: >=3.10
+Requires-Dist: fastapi>=0.111
+Requires-Dist: httpx>=0.27
+Requires-Dist: maskflow-sdk<0.8,>=0.7.0
+Requires-Dist: prometheus-client>=0.20
+Requires-Dist: pydantic-settings>=2.3
+Requires-Dist: pydantic>=2.7
+Requires-Dist: uvicorn[standard]>=0.30
+Provides-Extra: dev
+Requires-Dist: cryptography>=42; extra == 'dev'
+Requires-Dist: fakeredis>=2.23; extra == 'dev'
+Requires-Dist: hypothesis>=6.100; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.23; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: respx>=0.21; extra == 'dev'
+Provides-Extra: loadtest
+Requires-Dist: locust>=2.29; extra == 'loadtest'
+Provides-Extra: redis
+Requires-Dist: cryptography>=42; extra == 'redis'
+Requires-Dist: redis>=5.0; extra == 'redis'
+Description-Content-Type: text/markdown
+
+# maskflow-gateway
+
+A drop-in **OpenAI / Anthropic-compatible proxy** that detects PII in a
+request, replaces it with reversible typed placeholders before the request
+reaches the provider, and restores the originals in the response —
+**including mid-stream**.
+
+Point your existing client's base URL at the gateway. No SDK change, no
+code change.
+
+```python
+from openai import OpenAI
+
+client = OpenAI(
+    base_url="http://localhost:8000/v1",  # <- the gateway
+    api_key="sk-...",  # <- your real OpenAI key, passed straight through
+)
+client.chat.completions.create(
+    model="gpt-4o",
+    messages=[
+        {"role": "user", "content": "Email Rahul at rahul.sharma@example.com about PAN ABCPE1234F"}
+    ],
+)
+# OpenAI sees: "Email Rahul at <EMAIL_1> about PAN <PAN_1>"
+# You get back: the model's reply with <EMAIL_1>/<PAN_1> restored to the real values
+```
+
+## Endpoints
+
+| Route | What it does |
+|---|---|
+| `POST /v1/chat/completions` | OpenAI chat, streaming + non-streaming, tool calls |
+| `POST /v1/messages` | Anthropic Messages, streaming + non-streaming, tool use |
+| `POST /v1/embeddings` | masks each input **before** it is embedded — the RAG path |
+| `POST /v1/mask` / `POST /v1/unmask` | direct masking, no upstream call |
+| `GET /healthz` | liveness (never touches Redis) |
+| `GET /readyz` | readiness — **503 fail-closed** if Redis `maxmemory-policy != noeviction` |
+| `GET /metrics` | Prometheus |
+| `GET /v1/entities` | every PII type the loaded packs detect |
+
+## Streaming unmask
+
+The model streams the reply in arbitrary chunks and a placeholder like
+`<PERSON_NAME_1>` can be split across two SSE frames. The gateway parses
+the provider's SSE, keeps a rolling buffer + a trie of the session's active
+placeholders, and emits the longest prefix that is *certain* — a completed
+placeholder (replaced) or a character that cannot begin any placeholder —
+retaining only the tail that could still grow into one. A two-layer
+decoder handles chunk splits mid-UTF-8. Property: for **any** chunking of a
+masked reply, the concatenated stream equals the non-streaming
+`unmask` result (fuzz-tested at every byte boundary).
+
+## Sessions (multi-turn / tool loops)
+
+Send `X-Maskflow-Session: <your opaque id>` to keep `<PHONE_1>` meaning the
+same number across every turn and tool call of one agent run. Without the
+header each request is masked and unmasked in isolation.
+
+- `X-Maskflow-Session-TTL: <seconds>` overrides the default (3600), capped
+  at `MASKFLOW_GATEWAY_SESSION_TTL_MAX_SECONDS` (86400).
+- Keyed sessions need Redis (`MASKFLOW_GATEWAY_REDIS_URL`). Mappings are
+  encrypted with **AES-256-GCM** (`MASKFLOW_GATEWAY_SESSION_KEY`, 32 random
+  bytes hex) before they touch Redis, with a mandatory TTL.
+- Redis **must** run `maxmemory-policy noeviction` — an evicted session
+  mid-conversation means unmask finds nothing and a user sees raw
+  `<PERSON_NAME_1>` text. `/readyz` returns 503 until this is fixed.
+
+## Configuration
+
+Every setting is an environment variable prefixed `MASKFLOW_GATEWAY_`:
+
+| Variable | Default | Notes |
+|---|---|---|
+| `OPENAI_BASE_URL` | `https://api.openai.com/v1` | must include the version segment |
+| `ANTHROPIC_BASE_URL` | `https://api.anthropic.com/v1` | |
+| `UPSTREAM_API_KEY` | *(unset)* | set → gateway injects it; unset → client's own key is forwarded, nothing stored |
+| `NER` | `0` | `1` enables the spaCy pass (bare Indian names & addresses); much slower — see `loadtest/` |
+| `MIN_CONFIDENCE` | `0.5` | detection threshold |
+| `REDIS_URL` | *(unset)* | unset → in-process ephemeral sessions only (single replica) |
+| `SESSION_KEY` | *(unset)* | hex, 32 bytes; **required** when `REDIS_URL` is set |
+| `SESSION_TTL_SECONDS` / `SESSION_TTL_MAX_SECONDS` | `3600` / `86400` | |
+| `REQUIRE_MAXMEMORY_NOEVICTION` | `true` | |
+| `MAX_REQUEST_BYTES` | `2000000` | |
+| `UPSTREAM_TIMEOUT_SECONDS` / `UPSTREAM_CONNECT_TIMEOUT_SECONDS` | `120` / `10` | |
+| `RATE_LIMIT_PER_MINUTE` / `RATE_LIMIT_BURST` | `0` (off) | keyed by a hash of the client's `Authorization` |
+| `TOOL_CALL_MAX_DEPTH` / `TOOL_CALL_MAX_ITEMS` | `32` / `10000` | bound the tool-argument JSON walk |
+| `JSON_LOGS` | `1` | structured logs; every record also passes MaskFlow's PII scrub filter |
+| `CORS_ALLOW_ORIGINS` | `[]` | JSON list |
+
+The gateway's masking config comes only from these variables — it does not
+read a `.maskflowrc`.
+
+## Run
+
+```bash
+pip install "maskflow-gateway[redis]"
+export MASKFLOW_GATEWAY_REDIS_URL=redis://localhost:6379/0
+export MASKFLOW_GATEWAY_SESSION_KEY=$(python -c "import os;print(os.urandom(32).hex())")
+maskflow-gateway --host 0.0.0.0 --port 8000 --workers 4
+```
+
+Deploy artifacts in [`deploy/`](deploy/): multi-arch `Dockerfile`,
+`docker-compose.yml` (gateway + noeviction Redis), a Helm chart
+(`deploy/helm/maskflow-gateway`, with HPA / PDB / ServiceMonitor), and
+Fly / Render / Railway templates.
+
+## Throughput
+
+Published honestly, with the hardware, in [`loadtest/README.md`](loadtest/README.md).
+Rough laptop floor: **~430 req/s** pattern-only, **~90 req/s** NER-enabled
+(4 workers, Intel i7-9750H).
+
+## License
+
+MIT — like the rest of MaskFlow. No license gates, no paid flags, no
+telemetry.

maskflow_gateway-0.1.0/README.md

@@ -0,0 +1,116 @@
+# maskflow-gateway
+
+A drop-in **OpenAI / Anthropic-compatible proxy** that detects PII in a
+request, replaces it with reversible typed placeholders before the request
+reaches the provider, and restores the originals in the response —
+**including mid-stream**.
+
+Point your existing client's base URL at the gateway. No SDK change, no
+code change.
+
+```python
+from openai import OpenAI
+
+client = OpenAI(
+    base_url="http://localhost:8000/v1",  # <- the gateway
+    api_key="sk-...",  # <- your real OpenAI key, passed straight through
+)
+client.chat.completions.create(
+    model="gpt-4o",
+    messages=[
+        {"role": "user", "content": "Email Rahul at rahul.sharma@example.com about PAN ABCPE1234F"}
+    ],
+)
+# OpenAI sees: "Email Rahul at <EMAIL_1> about PAN <PAN_1>"
+# You get back: the model's reply with <EMAIL_1>/<PAN_1> restored to the real values
+```
+
+## Endpoints
+
+| Route | What it does |
+|---|---|
+| `POST /v1/chat/completions` | OpenAI chat, streaming + non-streaming, tool calls |
+| `POST /v1/messages` | Anthropic Messages, streaming + non-streaming, tool use |
+| `POST /v1/embeddings` | masks each input **before** it is embedded — the RAG path |
+| `POST /v1/mask` / `POST /v1/unmask` | direct masking, no upstream call |
+| `GET /healthz` | liveness (never touches Redis) |
+| `GET /readyz` | readiness — **503 fail-closed** if Redis `maxmemory-policy != noeviction` |
+| `GET /metrics` | Prometheus |
+| `GET /v1/entities` | every PII type the loaded packs detect |
+
+## Streaming unmask
+
+The model streams the reply in arbitrary chunks and a placeholder like
+`<PERSON_NAME_1>` can be split across two SSE frames. The gateway parses
+the provider's SSE, keeps a rolling buffer + a trie of the session's active
+placeholders, and emits the longest prefix that is *certain* — a completed
+placeholder (replaced) or a character that cannot begin any placeholder —
+retaining only the tail that could still grow into one. A two-layer
+decoder handles chunk splits mid-UTF-8. Property: for **any** chunking of a
+masked reply, the concatenated stream equals the non-streaming
+`unmask` result (fuzz-tested at every byte boundary).
+
+## Sessions (multi-turn / tool loops)
+
+Send `X-Maskflow-Session: <your opaque id>` to keep `<PHONE_1>` meaning the
+same number across every turn and tool call of one agent run. Without the
+header each request is masked and unmasked in isolation.
+
+- `X-Maskflow-Session-TTL: <seconds>` overrides the default (3600), capped
+  at `MASKFLOW_GATEWAY_SESSION_TTL_MAX_SECONDS` (86400).
+- Keyed sessions need Redis (`MASKFLOW_GATEWAY_REDIS_URL`). Mappings are
+  encrypted with **AES-256-GCM** (`MASKFLOW_GATEWAY_SESSION_KEY`, 32 random
+  bytes hex) before they touch Redis, with a mandatory TTL.
+- Redis **must** run `maxmemory-policy noeviction` — an evicted session
+  mid-conversation means unmask finds nothing and a user sees raw
+  `<PERSON_NAME_1>` text. `/readyz` returns 503 until this is fixed.
+
+## Configuration
+
+Every setting is an environment variable prefixed `MASKFLOW_GATEWAY_`:
+
+| Variable | Default | Notes |
+|---|---|---|
+| `OPENAI_BASE_URL` | `https://api.openai.com/v1` | must include the version segment |
+| `ANTHROPIC_BASE_URL` | `https://api.anthropic.com/v1` | |
+| `UPSTREAM_API_KEY` | *(unset)* | set → gateway injects it; unset → client's own key is forwarded, nothing stored |
+| `NER` | `0` | `1` enables the spaCy pass (bare Indian names & addresses); much slower — see `loadtest/` |
+| `MIN_CONFIDENCE` | `0.5` | detection threshold |
+| `REDIS_URL` | *(unset)* | unset → in-process ephemeral sessions only (single replica) |
+| `SESSION_KEY` | *(unset)* | hex, 32 bytes; **required** when `REDIS_URL` is set |
+| `SESSION_TTL_SECONDS` / `SESSION_TTL_MAX_SECONDS` | `3600` / `86400` | |
+| `REQUIRE_MAXMEMORY_NOEVICTION` | `true` | |
+| `MAX_REQUEST_BYTES` | `2000000` | |
+| `UPSTREAM_TIMEOUT_SECONDS` / `UPSTREAM_CONNECT_TIMEOUT_SECONDS` | `120` / `10` | |
+| `RATE_LIMIT_PER_MINUTE` / `RATE_LIMIT_BURST` | `0` (off) | keyed by a hash of the client's `Authorization` |
+| `TOOL_CALL_MAX_DEPTH` / `TOOL_CALL_MAX_ITEMS` | `32` / `10000` | bound the tool-argument JSON walk |
+| `JSON_LOGS` | `1` | structured logs; every record also passes MaskFlow's PII scrub filter |
+| `CORS_ALLOW_ORIGINS` | `[]` | JSON list |
+
+The gateway's masking config comes only from these variables — it does not
+read a `.maskflowrc`.
+
+## Run
+
+```bash
+pip install "maskflow-gateway[redis]"
+export MASKFLOW_GATEWAY_REDIS_URL=redis://localhost:6379/0
+export MASKFLOW_GATEWAY_SESSION_KEY=$(python -c "import os;print(os.urandom(32).hex())")
+maskflow-gateway --host 0.0.0.0 --port 8000 --workers 4
+```
+
+Deploy artifacts in [`deploy/`](deploy/): multi-arch `Dockerfile`,
+`docker-compose.yml` (gateway + noeviction Redis), a Helm chart
+(`deploy/helm/maskflow-gateway`, with HPA / PDB / ServiceMonitor), and
+Fly / Render / Railway templates.
+
+## Throughput
+
+Published honestly, with the hardware, in [`loadtest/README.md`](loadtest/README.md).
+Rough laptop floor: **~430 req/s** pattern-only, **~90 req/s** NER-enabled
+(4 workers, Intel i7-9750H).
+
+## License
+
+MIT — like the rest of MaskFlow. No license gates, no paid flags, no
+telemetry.

maskflow_gateway-0.1.0/deploy/Dockerfile

@@ -0,0 +1,44 @@
+# MaskFlow Gateway -- OpenAI/Anthropic-compatible masking proxy.
+#
+# Build (multi-arch in CI via buildx):
+#   docker build -f packages/maskflow-gateway/deploy/Dockerfile \
+#     --build-arg MASKFLOW_GATEWAY_VERSION=0.1.0 \
+#     -t maskflow/gateway packages/maskflow-gateway
+#
+# The spaCy model is baked in so MASKFLOW_GATEWAY_NER=1 works out of the
+# box; it is inert (never loaded) when NER is off, which is the default.
+#
+# Published as ghcr.io/maskflow/gateway:<version> and :latest by
+# .github/workflows/release-gateway.yml on a `gateway-v*` tag.
+
+FROM python:3.12-slim AS build
+
+ARG MASKFLOW_GATEWAY_VERSION=""
+ENV PIP_NO_CACHE_DIR=1 PIP_DISABLE_PIP_VERSION_CHECK=1
+
+RUN python -m venv /opt/venv
+ENV PATH="/opt/venv/bin:$PATH"
+
+RUN set -eux; \
+    pip install "maskflow-gateway[redis]${MASKFLOW_GATEWAY_VERSION:+==${MASKFLOW_GATEWAY_VERSION}}"; \
+    python -m spacy download en_core_web_sm; \
+    python -c "import maskflow_gateway.app, maskflow_pack_india, maskflow_pack_intl"
+
+FROM python:3.12-slim
+
+ENV PATH="/opt/venv/bin:$PATH" \
+    PYTHONUNBUFFERED=1 \
+    MASKFLOW_GATEWAY_JSON_LOGS=1
+COPY --from=build /opt/venv /opt/venv
+
+RUN useradd --create-home --uid 10001 gateway
+USER gateway
+WORKDIR /home/gateway
+
+EXPOSE 8000
+# Liveness only -- /readyz (which pings Redis) is for the orchestrator.
+HEALTHCHECK --interval=15s --timeout=3s --start-period=5s --retries=3 \
+    CMD python -c "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8000/healthz').status==200 else 1)"
+
+ENTRYPOINT ["maskflow-gateway"]
+CMD ["--host", "0.0.0.0", "--port", "8000"]

maskflow_gateway-0.1.0/deploy/docker-compose.yml

@@ -0,0 +1,36 @@
+# Local / single-box deployment: gateway + Redis with a mandatory
+# noeviction policy (an evicted session = a failed unmask = raw
+# placeholders shown to a user).
+#
+#   export MASKFLOW_GATEWAY_SESSION_KEY=$(python -c "import os;print(os.urandom(32).hex())")
+#   docker compose -f packages/maskflow-gateway/deploy/docker-compose.yml up
+
+services:
+  gateway:
+    image: ghcr.io/maskflow/gateway:latest
+    build:
+      context: ..
+      dockerfile: deploy/Dockerfile
+    ports:
+      - "8000:8000"
+    environment:
+      MASKFLOW_GATEWAY_REDIS_URL: redis://redis:6379/0
+      MASKFLOW_GATEWAY_SESSION_KEY: ${MASKFLOW_GATEWAY_SESSION_KEY:?set MASKFLOW_GATEWAY_SESSION_KEY to 32 random bytes, hex-encoded}
+      MASKFLOW_GATEWAY_NER: ${MASKFLOW_GATEWAY_NER:-0}
+      MASKFLOW_GATEWAY_OPENAI_BASE_URL: ${MASKFLOW_GATEWAY_OPENAI_BASE_URL:-https://api.openai.com/v1}
+      MASKFLOW_GATEWAY_ANTHROPIC_BASE_URL: ${MASKFLOW_GATEWAY_ANTHROPIC_BASE_URL:-https://api.anthropic.com/v1}
+      MASKFLOW_GATEWAY_RATE_LIMIT_PER_MINUTE: ${MASKFLOW_GATEWAY_RATE_LIMIT_PER_MINUTE:-0}
+    depends_on:
+      redis:
+        condition: service_healthy
+    restart: unless-stopped
+
+  redis:
+    image: redis:7-alpine
+    command: ["redis-server", "--maxmemory-policy", "noeviction", "--save", "", "--appendonly", "no"]
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 3s
+      retries: 5
+    restart: unless-stopped

maskflow_gateway-0.1.0/deploy/fly.toml

@@ -0,0 +1,32 @@
+# fly.io -- `fly launch --copy-config --dockerfile deploy/Dockerfile` from
+# packages/maskflow-gateway, then:
+#   fly secrets set MASKFLOW_GATEWAY_SESSION_KEY=$(python -c "import os;print(os.urandom(32).hex())")
+#   fly redis create   # and set MASKFLOW_GATEWAY_REDIS_URL to its URL
+# Ensure the Redis has maxmemory-policy=noeviction (Upstash: eviction OFF).
+
+app = "maskflow-gateway"
+primary_region = "bom"
+
+[build]
+  dockerfile = "deploy/Dockerfile"
+
+[env]
+  MASKFLOW_GATEWAY_NER = "0"
+  MASKFLOW_GATEWAY_JSON_LOGS = "1"
+
+[http_service]
+  internal_port = 8000
+  force_https = true
+  auto_stop_machines = "suspend"
+  auto_start_machines = true
+  min_machines_running = 1
+
+  [[http_service.checks]]
+    method = "GET"
+    path = "/readyz"
+    interval = "10s"
+    timeout = "3s"
+
+[[vm]]
+  size = "shared-cpu-2x"
+  memory = "512mb"

maskflow_gateway-0.1.0/deploy/helm/maskflow-gateway/Chart.yaml

@@ -0,0 +1,15 @@
+apiVersion: v2
+name: maskflow-gateway
+description: OpenAI/Anthropic-compatible proxy that masks PII before it reaches an LLM provider and restores it in the response, streaming included.
+type: application
+version: 0.1.0
+appVersion: "0.1.0"
+home: https://maskflow.in
+sources:
+  - https://github.com/maskflow/maskflow
+keywords:
+  - pii
+  - llm
+  - proxy
+  - dpdp
+  - privacy

maskflow_gateway-0.1.0/deploy/helm/maskflow-gateway/templates/NOTES.txt

@@ -0,0 +1,20 @@
+MaskFlow Gateway {{ .Chart.AppVersion }} deployed as {{ include "maskflow-gateway.fullname" . }}.
+
+Point your OpenAI / Anthropic client's base URL at the service:
+
+  http://{{ include "maskflow-gateway.fullname" . }}.{{ .Release.Namespace }}.svc:{{ .Values.service.port }}/v1
+
+Checklist:
+{{- if .Values.redis.url }}
+  * Redis: {{ .Values.redis.url }} -- confirm `maxmemory-policy noeviction`
+    (the gateway's /readyz returns 503 otherwise, and an evicted session
+    means a user sees raw <PERSON_NAME_1> placeholders).
+{{- else }}
+  * No Redis configured: sessions are in-process. Keep replicaCount: 1 or
+    two replicas will disagree on placeholder identity.
+{{- end }}
+{{- if not (or .Values.sessionKey.existingSecret .Values.sessionKey.value) }}
+  * MASKFLOW_GATEWAY_SESSION_KEY is NOT set. Redis sessions need it
+    (AES-256-GCM at rest). Set sessionKey.existingSecret or sessionKey.value.
+{{- end }}
+  * NER pass is {{ if eq (toString (index .Values.env "MASKFLOW_GATEWAY_NER")) "1" }}ON{{ else }}OFF{{ end }}.

maskflow_gateway-0.1.0/deploy/helm/maskflow-gateway/templates/_helpers.tpl

@@ -0,0 +1,28 @@
+{{- define "maskflow-gateway.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "maskflow-gateway.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name (include "maskflow-gateway.name" .) | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "maskflow-gateway.labels" -}}
+app.kubernetes.io/name: {{ include "maskflow-gateway.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version }}
+{{- end -}}
+
+{{- define "maskflow-gateway.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "maskflow-gateway.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{- define "maskflow-gateway.image" -}}
+{{- printf "%s:%s" .Values.image.repository (default .Chart.AppVersion .Values.image.tag) -}}
+{{- end -}}

maskflow_gateway-0.1.0/deploy/helm/maskflow-gateway/templates/deployment.yaml

@@ -0,0 +1,90 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "maskflow-gateway.fullname" . }}
+  labels:
+    {{- include "maskflow-gateway.labels" . | nindent 4 }}
+spec:
+  {{- if not .Values.autoscaling.enabled }}
+  replicas: {{ .Values.replicaCount }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "maskflow-gateway.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "maskflow-gateway.selectorLabels" . | nindent 8 }}
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 10001
+        fsGroup: 10001
+      containers:
+        - name: gateway
+          image: {{ include "maskflow-gateway.image" . }}
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: 8000
+          env:
+            {{- range $k, $v := .Values.env }}
+            - name: {{ $k }}
+              value: {{ $v | quote }}
+            {{- end }}
+            {{- if .Values.redis.url }}
+            - name: MASKFLOW_GATEWAY_REDIS_URL
+              value: {{ .Values.redis.url | quote }}
+            {{- end }}
+            - name: MASKFLOW_GATEWAY_SESSION_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.sessionKey.existingSecret | default (include "maskflow-gateway.fullname" .) }}
+                  key: session-key
+                  optional: {{ not (or .Values.sessionKey.existingSecret .Values.sessionKey.value) }}
+            {{- if or .Values.upstreamApiKey.existingSecret .Values.upstreamApiKey.value }}
+            - name: MASKFLOW_GATEWAY_UPSTREAM_API_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.upstreamApiKey.existingSecret | default (include "maskflow-gateway.fullname" .) }}
+                  key: upstream-api-key
+            {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          startupProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            failureThreshold: 30
+            periodSeconds: 2
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /readyz
+              port: http
+            periodSeconds: 10
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

maskflow_gateway-0.1.0/deploy/helm/maskflow-gateway/templates/hpa.yaml

@@ -0,0 +1,22 @@
+{{- if .Values.autoscaling.enabled -}}
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ include "maskflow-gateway.fullname" . }}
+  labels:
+    {{- include "maskflow-gateway.labels" . | nindent 4 }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ include "maskflow-gateway.fullname" . }}
+  minReplicas: {{ .Values.autoscaling.minReplicas }}
+  maxReplicas: {{ .Values.autoscaling.maxReplicas }}
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
+{{- end -}}

maskflow_gateway-0.1.0/deploy/helm/maskflow-gateway/templates/ingress.yaml

@@ -0,0 +1,35 @@
+{{- if .Values.ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "maskflow-gateway.fullname" . }}
+  labels:
+    {{- include "maskflow-gateway.labels" . | nindent 4 }}
+  {{- with .Values.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with .Values.ingress.className }}
+  ingressClassName: {{ . }}
+  {{- end }}
+  {{- with .Values.ingress.tls }}
+  tls:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    {{- range .Values.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            pathType: {{ .pathType }}
+            backend:
+              service:
+                name: {{ include "maskflow-gateway.fullname" $ }}
+                port:
+                  number: {{ $.Values.service.port }}
+          {{- end }}
+    {{- end }}
+{{- end -}}

maskflow_gateway-0.1.0/deploy/helm/maskflow-gateway/templates/pdb.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.podDisruptionBudget.enabled -}}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: {{ include "maskflow-gateway.fullname" . }}
+  labels:
+    {{- include "maskflow-gateway.labels" . | nindent 4 }}
+spec:
+  minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
+  selector:
+    matchLabels:
+      {{- include "maskflow-gateway.selectorLabels" . | nindent 6 }}
+{{- end -}}

maskflow_gateway-0.1.0/deploy/helm/maskflow-gateway/templates/secret.yaml

@@ -0,0 +1,16 @@
+{{- if or .Values.sessionKey.value .Values.upstreamApiKey.value -}}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "maskflow-gateway.fullname" . }}
+  labels:
+    {{- include "maskflow-gateway.labels" . | nindent 4 }}
+type: Opaque
+stringData:
+  {{- if .Values.sessionKey.value }}
+  session-key: {{ .Values.sessionKey.value | quote }}
+  {{- end }}
+  {{- if .Values.upstreamApiKey.value }}
+  upstream-api-key: {{ .Values.upstreamApiKey.value | quote }}
+  {{- end }}
+{{- end -}}

maskflow_gateway-0.1.0/deploy/helm/maskflow-gateway/templates/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "maskflow-gateway.fullname" . }}
+  labels:
+    {{- include "maskflow-gateway.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - name: http
+      port: {{ .Values.service.port }}
+      targetPort: http
+  selector:
+    {{- include "maskflow-gateway.selectorLabels" . | nindent 4 }}