Documentation

dev/kong/kongplugin.yaml

@@ -1,11 +1,3 @@
-# Per-API audience check — narrows on top of the domain-wide whitelist
-# check already enforced globally (k8s-platform/dataplane-globalpolicy-template,
-# scope: GlobalInControlPlane). Defense in depth: both instances run
-# independently on every request (verified Kong behavior, see STATUS.md).
-#
-# PLACEHOLDER-in-spirit: no Keycloak client named "catalog-api" exists yet
-# (only classic-models-api's own client/mapper does) — this will reject
-# every real token until that client + its oidc-audience-mapper are created.
 apiVersion: configuration.konghq.com/v1
 kind: KongPlugin
 metadata:
@@ -14,17 +6,8 @@ metadata:
 plugin: openid-connect
 config:
   issuer: ${OIDC_ISSUER}
-  # Whole YAML flow-sequence as one string var, same reason as
-  # JWT_AUDIENCE_WHITELIST in the global template — postBuild.substitute
-  # does plain text substitution, not list generation.
   audience_required: ${API_AUDIENCE}
   auth_methods:
     - bearer
   display_errors: false
-  # This Control Plane enforces a global tls_certificate_verify option
-  # (Konnect-side, not set by us) that rejects any plugin instance whose TLS
-  # verification is off — openid-connect defaults to ssl_verify: false,
-  # which silently broke the DataPlane's config sync entirely (verified via
-  # DataPlane pod logs: "ssl_verify cannot be disabled"). Explicit true is
-  # the correct fix anyway: verify the issuer's cert when fetching JWKS.
   ssl_verify: true