API · 01 of 03 · The shape

One front door for CI/CD

Tower, agents, scripts and people all ask the same API. How they get to it differs; what they are allowed to do, and what gets written down, does not.

One front door for CI/CD Four callers, Tower, Clearance with its MCP tools for agents, a script or pipeline with a ServiceAccount token, and a person with a people-dex ID token, reach glidepath-api three ways: through the API server proxy from the other cluster, through the Service inside the cluster, or over the new Gateway route that serves only /v1. glidepath-api runs two replicas with 30 operations, decides each call with a TokenReview and a SubjectAccessReview, and records an audit line, metrics and a trace. It reads Tekton Results, live Tekton runs and pod logs, Testkube, Sigstore and GHCR, GitHub with a read token minted per request, and the CDEvents broker. WHO CALLSHOW THEY REACH ITGLIDEPATH · ONE APIREADS AND STARTSTowerthe developer portalClearanceMCP tools for agentsA script or pipelinea ServiceAccount tokenA persona people-dex ID tokenAPI server proxyfrom the other clusterThe Service, in the clusterglidepath-api.platform-system:8080Gateway route/v1 only · since Nov 1glidepath-api2 replicas · 30 operations · TokenReview + SubjectAccessReview · audit, metrics, tracesTekton Results30 days of runs, logsLive Tektonruns in flight, pod logsTestkubetest runs, JUnitSigstore + GHCRsignatures, re-verifiedGitHub, reada token per requestCDEvents brokerevents, re-verifiedEvery caller gets the same answers, decided the same way, in the same place.LEGENDWho callsThe new routeThe APIPlatform dataOutside the APIHTTP

One contract

30 operations in one OpenAPI file, each with a tier. A test fails if the server and the spec ever differ.

Three ways in

The API server proxy for the other cluster, the Service inside it, and since November 1 a Gateway route for people.

Sources stay behind it

No caller reads Tekton Results, Testkube or Rekor itself any more, or holds a GitHub token.

Hangar · Glidepath · API