Update READMEs

Author: cvandesande

README.md

@@ -166,16 +166,6 @@ Troubleshooting
 - BBR processes JSON directly in the module - ensure request bodies contain valid JSON with a "model" field.
 - Use `error_log` and debug logging to verify module activation. BBR logs body reading and size limit enforcement; EPP logs gRPC errors with detailed TLS diagnostics. Set `error_log` to `debug` to observe processing details.
 
-Roadmap
--------
-- Validate EPP and BBR implementations against Gateway API Inference Extension conformance tests.
-- Align exact header names and semantics to the upstream specification and reference implementations.
-- Validate large body handling and back-pressure for BBR; refine chunked reads/writes and resource usage for very large payloads.
-- Connection pooling and caching for improved performance at scale.
-- Enhanced TLS configuration options (client certificates, cipher suites, etc.).
-- ✅ **Completed**: Enhanced TLS error logging with detailed certificate validation messages
-- ✅ **Completed**: Streamlined test infrastructure with consistent vLLM backend usage
-
 License
 -------
 Apache-2.0 (to align with upstream projects).

docker/README.md

@@ -5,7 +5,7 @@ This directory contains Docker configurations for the ngx-inference module and r
 ## Directory Structure
 
 - `nginx/` - NGINX configurations and Dockerfile for the main inference gateway
-- `mock-extproc/` - Mock external processor service implementing EPP (Endpoint Picker Processor) and BBR functionality
+- `mock-extproc/` - Mock external processor service implementing EPP (Endpoint Picker Processor)
 - `echo-server/` - Simple Node.js echo server for testing
 
 ## Quick Start
@@ -59,7 +59,9 @@ docker run -p 8081:80 \
 
 ## Mock External Processor
 
-The `mock-extproc/` directory contains the mock external processor service that implements both EPP (Endpoint Picker Processor) and BBR (Body Buffer & Rewrite) functionality via gRPC. It uses the `extproc_mock` binary from this repository.
+The `mock-extproc/` directory contains the mock external processor service that implements EPP (Endpoint Picker Processor) functionality via gRPC. It uses the `extproc_mock` binary from this repository.
+
+**Note**: BBR (Body-Based Routing) is implemented directly in the ngx-inference module, not in the external processor. The mock service only handles EPP endpoint selection.
 
 ### Usage
 

tests/README.md

@@ -13,7 +13,8 @@ Main test runner that validates BBR (Body-Based Routing) and EPP (External Proce
 - **BBR OFF + EPP ON**: Tests upstream selection with EPP routing to vLLM
 - **BBR ON + EPP ON**: Tests both modules active with vLLM responses
 - **BBR OFF + EPP OFF**: Tests direct vLLM routing (no processing)
-- **EPP Untrusted TLS**: Tests TLS certificate validation with enhanced error logging
+- **EPP Untrusted TLS (Allow)**: Tests TLS certificate validation with fail-open mode (Kind only)
+- **EPP Untrusted TLS (Deny)**: Tests TLS certificate validation with fail-closed mode (Kind only)
 
 **Execution Modes:**
 - **Local Mode**: Uses locally compiled nginx module with local backend services
@@ -297,4 +298,4 @@ make test-kind
 - **Networking**: All tests work against nginx on `localhost:8081` (local and Docker) or cluster IP (Kind)
 - **Mock Services**: Mock gRPC EPP service provides realistic upstream selection in local/Docker environments
 - **Echo Server**: Provides request inspection and header validation
-- **Production EPP**: Kind environment uses a reference External Processing implementation with TLS support
+- **Production EPP**: Kind environment uses a reference External Processing implementation with TLS support

tests/kind-ngf/README.md

@@ -15,32 +15,19 @@ This provides realistic validation of the module's compatibility with the Gatewa
 
 ## Architecture
 
-```
-┌─────────────────────────────────────────────────────────┐
-│ kind Cluster (ngx-inference-test)                       │
-│                                                          │
-│  ┌──────────────┐    ┌─────────────────┐               │
-│  │   Client     │───▶│  NGINX (port    │               │
-│  │  (curl)      │    │  80 → 8080)     │               │
-│  └──────────────┘    │  with module    │               │
-│                      └────────┬────────┘               │
-│                               │                         │
-│                               │ gRPC (EPP)             │
-│                               ▼                         │
-│                      ┌─────────────────┐               │
-│                      │  Reference EPP  │               │
-│                      │  (port 9001)    │               │
-│                      └────────┬────────┘               │
-│                               │                         │
-│                               │ reads InferencePool    │
-│                               │ selects endpoint       │
-│                               ▼                         │
-│                      ┌─────────────────┐               │
-│                      │  vLLM Simulator │               │
-│                      │  (3 replicas)   │               │
-│                      │  (port 8000)    │               │
-│                      └─────────────────┘               │
-└─────────────────────────────────────────────────────────┘
+```mermaid
+graph TB
+    subgraph cluster["kind Cluster (ngx-inference-test)"]
+        Client["Client<br/>(curl)"]
+        NGINX["NGINX<br/>(port 80 → 8080)<br/>with module"]
+        RefEPP["Reference EPP<br/>(port 9001)"]
+        vLLM["vLLM Simulator<br/>(3 replicas)<br/>(port 8000)"]
+
+        Client -->|HTTP Request| NGINX
+        NGINX -->|"gRPC (EPP)"| RefEPP
+        RefEPP -->|"reads InferencePool<br/>selects endpoint"| vLLM
+        NGINX -.->|"proxies to selected<br/>endpoint"| vLLM
+    end
 ```
 
 ## Quick Start
@@ -83,11 +70,13 @@ This automated script will:
 make test-kind
 ```
 
-The test suite runs **all four configuration scenarios** automatically:
+The test suite runs **all six configuration scenarios** automatically:
 - **BBR ON + EPP OFF**: Model extraction only
 - **BBR OFF + EPP ON**: Endpoint selection only  
 - **BBR ON + EPP ON**: Both features enabled
 - **BBR OFF + EPP OFF**: Direct proxy (baseline)
+- **EPP Untrusted TLS (Allow)**: TLS certificate validation with fail-open mode
+- **EPP Untrusted TLS (Deny)**: TLS certificate validation with fail-closed mode
 
 Each scenario is tested by:
 1. Generating the appropriate NGINX configuration using `generate-config.sh`
@@ -197,14 +186,16 @@ kubectl create configmap nginx-inference-bbr_on_epp_on \
 make test-kind
 ```
 
-This runs the complete test matrix across all four configuration scenarios:
+This runs the complete test matrix across all six configuration scenarios:
 
 | Scenario | BBR | EPP | Tests |
 |----------|-----|-----|-------|
 | bbr_on_epp_off | ✓ | ✗ | Model extraction, direct routing |
 | bbr_off_epp_on | ✗ | ✓ | Endpoint selection via reference EPP |
 | bbr_on_epp_on | ✓ | ✓ | Both BBR + EPP active |
 | bbr_off_epp_off | ✗ | ✗ | Baseline (no processing) |
+| bbr_off_epp_on_untrusted_tls_allow | ✗ | ✓ | EPP with untrusted TLS (fail-open) |
+| bbr_off_epp_on_untrusted_tls_deny | ✗ | ✓ | EPP with untrusted TLS (fail-closed) |
 
 Each scenario validates:
 1. NGINX health check
@@ -445,7 +436,7 @@ docker rmi ngx-inference:latest
 | EPP | Mock implementation | Real reference EPP |
 | Backend | Echo server | vLLM Simulator |
 | Environment | Docker Compose | Kubernetes cluster |
-| Test Matrix | ✓ All 4 scenarios | ✓ All 4 scenarios |
+| Test Matrix | ✓ 4 basic scenarios | ✓ 6 scenarios (incl. TLS) |
 | Config Method | File replacement | ConfigMap + rollout |
 | Setup Time | ~1 minute | ~2 minutes |
 | Resource Usage | Low | Low |