refactor(realm): rename the token-exchange broker, drop the middleware's name

Browse Source

Every agent has to name this client in the audience scopes it requests, so the
one thing an agent could not avoid naming was the very thing it should know
nothing about. The gateway serving those URLs is replaceable; the contract
should not imply otherwise.

kong-token-exchange-broker becomes token-exchange-broker, same credential, same
behaviour. The rename was rolled out in order — new client alongside the old,
then the callers, then the gateways, then removal — so no call ever hit a realm
that had forgotten the name its caller was still using. Followed through the
client scope, the audience mappers, the fine-grained admin policy
allow-broker-client, and the roles map.

The Vault property keeps the old name. Renaming it there means re-issuing the
value to every gateway holding a copy, for no gain; the ExternalSecret maps it
to KC_SECRET_TOKEN_EXCHANGE_BROKER instead, so everything the cluster can see
is neutral.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

...

This commit is contained in:

Stéphane Tailland

2026-08-29 07:52:58 +02:00

parent 6c89f6124d

commit eed8c3da3b

2 changed files with 11 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

k8s/keycloak/configmap-realm.yaml

+1 -1

File diff suppressed because one or more lines are too long