First commit

dev/kong/kongplugin.yaml

@@ -0,0 +1,30 @@
+# Per-API audience check — narrows on top of the domain-wide whitelist
+# check already enforced globally (k8s-platform/dataplane-globalpolicy-template,
+# scope: GlobalInControlPlane). Defense in depth: both instances run
+# independently on every request (verified Kong behavior, see STATUS.md).
+#
+# PLACEHOLDER-in-spirit: no Keycloak client named "catalog-api" exists yet
+# (only classic-models-api's own client/mapper does) — this will reject
+# every real token until that client + its oidc-audience-mapper are created.
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-catalog-api-openid-connect
+  namespace: ${NAMESPACE}
+plugin: openid-connect
+config:
+  issuer: ${OIDC_ISSUER}
+  # Whole YAML flow-sequence as one string var, same reason as
+  # JWT_AUDIENCE_WHITELIST in the global template — postBuild.substitute
+  # does plain text substitution, not list generation.
+  audience_required: ${API_AUDIENCE}
+  auth_methods:
+    - bearer
+  display_errors: false
+  # This Control Plane enforces a global tls_certificate_verify option
+  # (Konnect-side, not set by us) that rejects any plugin instance whose TLS
+  # verification is off — openid-connect defaults to ssl_verify: false,
+  # which silently broke the DataPlane's config sync entirely (verified via
+  # DataPlane pod logs: "ssl_verify cannot be disabled"). Explicit true is
+  # the correct fix anyway: verify the issuer's cert when fetching JWKS.
+  ssl_verify: true