First commit

2026-08-20 13:24:10 +02:00
parent 1275748655
commit 89add4914a
10 changed files with 1111 additions and 2 deletions
@@ -0,0 +1,30 @@
+# Per-API audience check — narrows on top of the domain-wide whitelist
+# check already enforced globally (k8s-platform/dataplane-globalpolicy-template,
+# scope: GlobalInControlPlane). Defense in depth: both instances run
+# independently on every request (verified Kong behavior, see STATUS.md).
+#
+# PLACEHOLDER-in-spirit: no Keycloak client named "catalog-api" exists yet
+# (only classic-models-api's own client/mapper does) — this will reject
+# every real token until that client + its oidc-audience-mapper are created.
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-catalog-api-openid-connect
+  namespace: ${NAMESPACE}
+plugin: openid-connect
+config:
+  issuer: ${OIDC_ISSUER}
+  # Whole YAML flow-sequence as one string var, same reason as
+  # JWT_AUDIENCE_WHITELIST in the global template — postBuild.substitute
+  # does plain text substitution, not list generation.
+  audience_required: ${API_AUDIENCE}
+  auth_methods:
+    - bearer
+  display_errors: false
+  # This Control Plane enforces a global tls_certificate_verify option
+  # (Konnect-side, not set by us) that rejects any plugin instance whose TLS
+  # verification is off — openid-connect defaults to ssl_verify: false,
+  # which silently broke the DataPlane's config sync entirely (verified via
+  # DataPlane pod logs: "ssl_verify cannot be disabled"). Explicit true is
+  # the correct fix anyway: verify the issuer's cert when fetching JWKS.
+  ssl_verify: true
@@ -0,0 +1,14 @@
+# Explicit on purpose, unlike catalog-api's earlier (removed) layout —
+# kong-kustomization.yaml (the Flux CR) now lives in this same directory,
+# and Flux's path-without-a-kustomization.yaml auto-generation scans every
+# yaml file present, indiscriminately. Without this explicit list, it would
+# include kong-kustomization.yaml itself as a managed resource — the
+# Kustomization would end up applying (and, with prune: true, potentially
+# pruning) its own object. Listing resources explicitly avoids that.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - service.yaml
+  - routes.yaml
+  - kongplugin.yaml
+  - pluginbindings.yaml
@@ -0,0 +1,21 @@
+# Bound to the natively-authored KongService (../service.yaml), not to
+# individual routes — all of catalog-api's routes share the same audience,
+# same as tasks-api's pattern. Unlike the earlier HTTPRoute-derived
+# KongService, this name is ours and stable across reconciles.
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-catalog-api-openid-connect-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-catalog-api-openid-connect
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-catalog-api
@@ -0,0 +1,285 @@
+# One KongRoute per operation in ../openapi.yaml (14 total — same
+# granularity as ~/dev/kong/kube/apis/tasks-api/routes.yaml: split by
+# operation even when two share a path, so a future per-operation policy
+# doesn't require restructuring). Regex paths use Kong's own `~` syntax
+# directly — no auto-translation layer involved this time (that was
+# specific to the HTTPRoute path we abandoned).
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-catalog-api-listproductlines
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-catalog-api
+  name: catalog-api_listproductlines
+  methods:
+    - GET
+    - OPTIONS
+  paths:
+    - /classic-models/api/v1/productlines/
+  strip_path: false
+  tags:
+    - catalog
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-catalog-api-createproductline
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-catalog-api
+  name: catalog-api_createproductline
+  methods:
+    - POST
+    - OPTIONS
+  paths:
+    - /classic-models/api/v1/productlines/
+  strip_path: false
+  tags:
+    - catalog
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-catalog-api-getproductline
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-catalog-api
+  name: catalog-api_getproductline
+  methods:
+    - GET
+    - OPTIONS
+  paths:
+    - ~/classic-models/api/v1/productlines/(?<productline>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - catalog
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-catalog-api-updateproductline
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-catalog-api
+  name: catalog-api_updateproductline
+  methods:
+    - PUT
+    - OPTIONS
+  paths:
+    - ~/classic-models/api/v1/productlines/(?<productline>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - catalog
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-catalog-api-patchproductline
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-catalog-api
+  name: catalog-api_patchproductline
+  methods:
+    - PATCH
+    - OPTIONS
+  paths:
+    - ~/classic-models/api/v1/productlines/(?<productline>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - catalog
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-catalog-api-deleteproductline
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-catalog-api
+  name: catalog-api_deleteproductline
+  methods:
+    - DELETE
+    - OPTIONS
+  paths:
+    - ~/classic-models/api/v1/productlines/(?<productline>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - catalog
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-catalog-api-listproductlineproducts
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-catalog-api
+  name: catalog-api_listproductlineproducts
+  methods:
+    - GET
+    - OPTIONS
+  paths:
+    - ~/classic-models/api/v1/productlines/(?<productline>[^#?/]+)/products/$
+  strip_path: false
+  tags:
+    - catalog
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-catalog-api-listproducts
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-catalog-api
+  name: catalog-api_listproducts
+  methods:
+    - GET
+    - OPTIONS
+  paths:
+    - /classic-models/api/v1/products/
+  strip_path: false
+  tags:
+    - catalog
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-catalog-api-createproduct
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-catalog-api
+  name: catalog-api_createproduct
+  methods:
+    - POST
+    - OPTIONS
+  paths:
+    - /classic-models/api/v1/products/
+  strip_path: false
+  tags:
+    - catalog
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-catalog-api-getproduct
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-catalog-api
+  name: catalog-api_getproduct
+  methods:
+    - GET
+    - OPTIONS
+  paths:
+    - ~/classic-models/api/v1/products/(?<productcode>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - catalog
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-catalog-api-updateproduct
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-catalog-api
+  name: catalog-api_updateproduct
+  methods:
+    - PUT
+    - OPTIONS
+  paths:
+    - ~/classic-models/api/v1/products/(?<productcode>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - catalog
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-catalog-api-patchproduct
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-catalog-api
+  name: catalog-api_patchproduct
+  methods:
+    - PATCH
+    - OPTIONS
+  paths:
+    - ~/classic-models/api/v1/products/(?<productcode>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - catalog
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-catalog-api-deleteproduct
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-catalog-api
+  name: catalog-api_deleteproduct
+  methods:
+    - DELETE
+    - OPTIONS
+  paths:
+    - ~/classic-models/api/v1/products/(?<productcode>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - catalog
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-catalog-api-getproductorderdetails
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-catalog-api
+  name: catalog-api_getproductorderdetails
+  methods:
+    - GET
+    - OPTIONS
+  paths:
+    - ~/classic-models/api/v1/products/(?<productcode>[^#?/]+)/order-details/$
+  strip_path: false
+  tags:
+    - catalog
@@ -0,0 +1,25 @@
+# host is a plain DNS string, not a Kubernetes object reference — unlike
+# HTTPRoute's backendRefs, this needs no ReferenceGrant to cross into the
+# classic-models namespace.
+#
+# metadata.name carries the ${NAME} (env) prefix because this domain's
+# environments share one k8s namespace (see dataplane-catalog's own
+# NAME/NAMESPACE split) — spec.name (Kong/Konnect-side) doesn't need it,
+# each env already has its own isolated Control Plane.
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongService
+metadata:
+  name: ${NAME}-catalog-api
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  name: catalog-api
+  host: ${BACKEND_HOST}
+  port: 8000
+  protocol: http
+  path: /
+  tags:
+    - catalog