First commit

dev/kong/pluginbindings.yaml

@@ -0,0 +1,21 @@
+# Bound to the natively-authored KongService (../service.yaml), not to
+# individual routes — all of catalog-api's routes share the same audience,
+# same as tasks-api's pattern. Unlike the earlier HTTPRoute-derived
+# KongService, this name is ours and stable across reconciles.
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-catalog-api-openid-connect-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-catalog-api-openid-connect
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-catalog-api