ガバナンスを高めるKong AI Gateway + Langfuseで"アプリ計装なし"のLLMオブザーバビリティ

User (curl)
↓
MCP Server / ADK Agent (Python)
↓ genai SDK (base_url → Kong)
Kong AI Gateway（Docker network 内部）
  ├── ai-proxy plugin          → LLM リクエストを Vertex AI に送信
  └── opentelemetry plugin     → Langfuse OTLP/HTTP endpoint

_format_version: "3.0"
services:
  - name: gemini-service
    # Service 定義上 url は必須だがダミー値。
    # ai-proxy が upstream を置き換え、Vertex AI へ直接接続するため転送されない。
    url: http://httpbin.konghq.com
    routes:
      - name: gemini-route
        paths:
          - /gemini
    plugins:
      - name: ai-proxy
        config:
          route_type: llm/v1/chat
          llm_format: gemini
          logging:
            log_statistics: true
          auth:
            gcp_use_service_account: true
            gcp_service_account_json: '${GCP_SERVICE_ACCOUNT_JSON}'
            # 本番環境では、サービスアカウント鍵（JSON）の配布・保管・ローテーションが
            # セキュリティ上の課題・運用負荷になりやすいため、サービスアカウントキーを
            # 使わない認証を推奨します。今回はあくまで検証用ということでご理解ください。
          model:
            provider: gemini
            name: gemini-2.5-flash
            options:
              gemini:
                api_endpoint: us-central1-aiplatform.googleapis.com
                project_id: ${GCP_PROJECT_ID}
                location_id: ${GCP_LOCATION_ID}
      - name: opentelemetry
        config:
          traces_endpoint: ${LANGFUSE_HOST}/api/public/otel/v1/traces
          headers:
            Authorization: "Basic ${LANGFUSE_AUTH_BASE64}"

KONG_BASE_URL = os.getenv("KONG_BASE_URL", "http://kong:8000/gemini")
model = Gemini(model="gemini-2.5-flash", base_url=KONG_BASE_URL)
client = genai.Client(http_options={"base_url": KONG_BASE_URL})

services:
  kong:
    build:
      context: .
      dockerfile: Dockerfile.kong
    environment:
      KONG_DATABASE: "off"
      KONG_DECLARATIVE_CONFIG: /opt/kong/kong.yml
      KONG_PLUGINS: bundled
      KONG_PROXY_LISTEN: "0.0.0.0:8000"
      # 詰まりどころ（後述）
      KONG_NGINX_PROXY_CLIENT_BODY_BUFFER_SIZE: "8m"
      LANGFUSE_PUBLIC_KEY: ${LANGFUSE_PUBLIC_KEY}
      LANGFUSE_SECRET_KEY: ${LANGFUSE_SECRET_KEY}
      LANGFUSE_HOST: ${LANGFUSE_HOST:-https://cloud.langfuse.com}
      GCP_PROJECT_ID: ${GCP_PROJECT_ID}
      GCP_LOCATION_ID: ${GCP_LOCATION_ID}
    volumes:
      - ./credentials/service-account-key.json:/app/credentials/service-account-key.json:ro
  app:
    environment:
      - KONG_BASE_URL=http://kong:8000/gemini
      - GOOGLE_API_KEY=dummy
    depends_on:
      - kong

docker compose exec kong kong health

docker compose exec kong curl -s -X POST http://localhost:8000/gemini/v1/chat/completions \  -H "Content-Type: application/json" \  -d '{"messages":[{"role":"user","content":"hello"}],"model":"gemini-2.5-flash"}' \  | jq .choices[0].message.content

KONG_NGINX_PROXY_CLIENT_BODY_BUFFER_SIZE: "8m"