Additional plugins

dev/flux-kustomization.yaml

@@ -21,3 +21,8 @@ spec:
       BACKEND_HOST: classic-models-api.classic-models.svc.cluster.local
       OIDC_ISSUER: https://keycloak.sttlab.eu/realms/sttlab
       API_AUDIENCE: '["catalog-api"]'
+      API_SCOPES_REQUIRED: '["catalog:read"]'
+      BACKEND_AUDIENCE: '["classic-models-api"]'
+      BACKEND_SCOPES: '[]'
+      API_RATE_LIMIT_MINUTE: "60"
+      AUDIT_LOG_ENDPOINT: http://audit-log-collector.observability.svc.cluster.local/logs

kong/audit-log.yaml

@@ -0,0 +1,10 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-catalog-api-audit-log
+  namespace: ${NAMESPACE}
+plugin: http-log
+config:
+  http_endpoint: ${AUDIT_LOG_ENDPOINT}
+  method: POST
+  content_type: application/json

kong/kongplugin.yaml

@@ -7,7 +7,21 @@ plugin: openid-connect
 config:
   issuer: ${OIDC_ISSUER}
   audience_required: ${API_AUDIENCE}
+  scopes_required: ${API_SCOPES_REQUIRED}
   auth_methods:
     - bearer
   display_errors: false
   ssl_verify: true
+  consumer_claims:
+    - - sub
+  consumer_by:
+    - custom_id
+    - username
+  consumer_optional: true
+  token_exchange:
+    subject_token_issuers:
+      - issuer: ${OIDC_ISSUER}
+        conditions: {}
+    request:
+      audience: ${BACKEND_AUDIENCE}
+      scopes: ${BACKEND_SCOPES}

kong/kustomization.yaml

@@ -4,4 +4,7 @@ resources:
   - service.yaml
   - routes.yaml
   - kongplugin.yaml
+  - rate-limiting.yaml
+  - proxy-cache.yaml
+  - audit-log.yaml
   - pluginbindings.yaml

kong/pluginbindings.yaml

@@ -15,3 +15,57 @@ spec:
       group: configuration.konghq.com
       kind: KongService
       name: ${NAME}-catalog-api
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-catalog-api-rate-limiting-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-catalog-api-rate-limiting
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-catalog-api
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-catalog-api-proxy-cache-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-catalog-api-proxy-cache
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-catalog-api
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-catalog-api-audit-log-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-catalog-api-audit-log
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-catalog-api

kong/proxy-cache.yaml

@@ -0,0 +1,16 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-catalog-api-proxy-cache
+  namespace: ${NAMESPACE}
+plugin: proxy-cache-advanced
+config:
+  strategy: memory
+  request_method:
+    - GET
+    - HEAD
+  response_code:
+    - 200
+  content_type:
+    - application/json
+  cache_ttl: 60

kong/rate-limiting.yaml

@@ -0,0 +1,14 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-catalog-api-rate-limiting
+  namespace: ${NAMESPACE}
+plugin: rate-limiting-advanced
+config:
+  limit:
+    - ${API_RATE_LIMIT_MINUTE}
+  window_size:
+    - 60
+  identifier: consumer
+  sync_rate: -1
+  strategy: local