From a8459f7ecf1dd2d5e6b63dd7d6bf6d38665bd4a8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Tailland?= <stephane.tailland@ibm.com>
Date: Fri, 21 Aug 2026 18:39:30 +0200
Subject: [PATCH] Fix invalid K8s resource names for read_only/product_manager
 consumer groups

metadata.name must be an RFC 1123 subdomain (no underscores); spec.name
(the value actually matched against the JWT role claim) stays read_only/
product_manager to match the realm role names exactly.
---
 kong/mcp/consumergroups.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kong/mcp/consumergroups.yaml b/kong/mcp/consumergroups.yaml
index 2b727ef..b18fe72 100644
--- a/kong/mcp/consumergroups.yaml
+++ b/kong/mcp/consumergroups.yaml
@@ -13,7 +13,7 @@ spec:
 apiVersion: configuration.konghq.com/v1beta1
 kind: KongConsumerGroup
 metadata:
-  name: ${NAME}-read_only
+  name: ${NAME}-read-only
   namespace: ${NAMESPACE}
 spec:
   controlPlaneRef:
@@ -25,7 +25,7 @@ spec:
 apiVersion: configuration.konghq.com/v1beta1
 kind: KongConsumerGroup
 metadata:
-  name: ${NAME}-product_manager
+  name: ${NAME}-product-manager
   namespace: ${NAMESPACE}
 spec:
   controlPlaneRef: