fix(oidc): Switch LibreChat and MCP OAuth to local Keycloak (keycloak.sttlab.local)

k8s/librechat/configmap-app.yaml

@@ -5,11 +5,44 @@ metadata:
   namespace: librechat
 data:
   librechat.yaml: |
-    version: 1.3.9
+    version: 1.3.13
     mcpSettings:
       allowedDomains:
-        - "http://mcp-jira.mcp.svc.cluster.local:9000"
+        - "https://catalog-dev.sttlab.local"
     mcpServers:
-      jira:
+      catalog-mcp:
         type: streamable-http
-        url: http://mcp-jira.mcp.svc.cluster.local:9000/mcp
+        url: https://catalog-dev.sttlab.local/catalog-mcp
+        oauth:
+          authorization_url: https://keycloak.sttlab.local/realms/classic-models/protocol/openid-connect/auth
+          token_url: https://keycloak.sttlab.local/realms/classic-models/protocol/openid-connect/token
+          client_id: librechat
+          client_secret: '${LIBRECHAT_OIDC_CLIENT_SECRET}'
+          redirect_uri: https://librechat.sttlab.local/api/mcp/catalog-mcp/oauth/callback
+          scope: 'openid mcp-catalog-audience kong-token-exchange-broker-audience'
+          grant_types_supported: ['authorization_code', 'refresh_token']
+          token_endpoint_auth_methods_supported: ['client_secret_post']
+    endpoints:
+      custom:
+        # kong-v2's platform-llm proxy (not the old kube/llms/openrouter lab)
+        # — key-auth, same shared-key limitation as before (LibreChat's
+        # custom endpoints don't support OAuth/OIDC on this outbound leg).
+        # baseURL is `/llm/v1`, not the full path: LibreChat appends
+        # `/chat/completions` itself.
+        - name: 'OpenRouter'
+          apiKey: '${PLATFORM_LLM_LIBRECHAT_APIKEY}'
+          baseURL: 'https://llm-dev.sttlab.local/llm/v1'
+          headers:
+            apikey: '${PLATFORM_LLM_LIBRECHAT_APIKEY}'
+          models:
+            default:
+              - 'google/gemini-3.7-flash'
+              - 'anthropic/claude-sonnet-5'
+              - 'openai/gpt-5.6-luna'
+              - 'deepseek/deepseek-v4-flash'
+              - 'openai/gpt-oss-120b'
+              - 'mistralai/mistral-nemo'
+            fetch: false
+          titleConvo: true
+          titleModel: 'google/gemini-3.7-flash'
+          modelDisplayLabel: 'OpenRouter'

k8s/librechat/deployment.yaml

@@ -13,6 +13,18 @@ spec:
       labels:
         app: librechat
     spec:
+      # *.sttlab.local are lab-only hostnames (self-signed cert), not real
+      # DNS — this pod needs an explicit mapping to each Gateway's stable
+      # in-cluster ClusterIP to resolve them at all.
+      # catalog-dev: kong-v2 catalog-api Gateway (dataplane-ingress-catalog-dev-v4bkm-xqq6v), REST+MCP share this hostname now.
+      # llm-dev: kong-v2's platform-llm Gateway (dataplane-ingress-llm-dev-rlrxf-7fkb7).
+      hostAliases:
+        - ip: "192.168.194.225"
+          hostnames:
+            - "catalog-dev.sttlab.local"
+        - ip: "192.168.194.153"
+          hostnames:
+            - "llm-dev.sttlab.local"
       initContainers:
         - name: wait-for-mongodb
           image: busybox:1.36
@@ -81,13 +93,51 @@ spec:
                 secretKeyRef:
                   name: librechat-secrets
                   key: ANTHROPIC_API_KEY
+            - name: PLATFORM_LLM_LIBRECHAT_APIKEY
+              valueFrom:
+                secretKeyRef:
+                  name: librechat-secrets
+                  key: PLATFORM_LLM_LIBRECHAT_APIKEY
+            - name: LIBRECHAT_OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: librechat-secrets
+                  key: LIBRECHAT_OIDC_CLIENT_SECRET
+            # Same Keycloak client secret as LIBRECHAT_OIDC_CLIENT_SECRET
+            # above (one Keycloak client, "librechat", used both for the
+            # app's own SSO login and for each MCP server's OAuth flow) —
+            # LibreChat's OIDC-login code path reads this specific env var
+            # name, so it's duplicated rather than referenced once.
+            - name: OPENID_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: librechat-secrets
+                  key: LIBRECHAT_OIDC_CLIENT_SECRET
+            - name: OPENID_SESSION_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: librechat-secrets
+                  key: OPENID_SESSION_SECRET
+            # jira-mcp.sttlab.local / konggw.sttlab.local serve a self-signed
+            # cert (see hostAliases comment above) — Node rejects it by
+            # default; NODE_EXTRA_CA_CERTS trusts just this one CA, unlike
+            # NODE_TLS_REJECT_UNAUTHORIZED=0 which would disable TLS
+            # verification globally.
+            - name: NODE_EXTRA_CA_CERTS
+              value: /etc/sttlab-tls/tls.crt
+            # 512Mi was too tight for LibreChat under real use (MCP clients,
+            # OTel instrumentation) and caused repeated V8 heap-limit crashes.
+            # Cap old-space explicitly, leaving headroom under the new
+            # container limit for non-heap memory (buffers, native modules).
+            - name: NODE_OPTIONS
+              value: "--max-old-space-size=1200"
           resources:
             requests:
               cpu: 100m
-              memory: 256Mi
+              memory: 512Mi
             limits:
               cpu: 500m
-              memory: 512Mi
+              memory: 1536Mi
           livenessProbe:
             httpGet:
               path: /health
@@ -104,7 +154,16 @@ spec:
             - name: app-config
               mountPath: /app/librechat.yaml
               subPath: librechat.yaml
+            - name: sttlab-tls-cert
+              mountPath: /etc/sttlab-tls
+              readOnly: true
       volumes:
         - name: app-config
           configMap:
             name: librechat-app-config
+        - name: sttlab-tls-cert
+          secret:
+            secretName: sttlab-tls
+            items:
+              - key: tls.crt
+                path: tls.crt