MCP server

dev/flux-kustomization.yaml

@@ -26,3 +26,10 @@ spec:
       BACKEND_SCOPES: '[]'
       API_RATE_LIMIT_MINUTE: "60"
       AUDIT_LOG_ENDPOINT: http://audit-log-collector.observability.svc.cluster.local/logs
+      REST_HOSTNAME: catalog-dev.sttlab.local
+      MCP_HOSTNAME: catalog-mcp-dev.sttlab.local
+      MCP_AUDIENCE: '["mcp-catalog"]'
+      TOKEN_EXCHANGE_CLIENT_ID: kong-token-exchange-broker
+    substituteFrom:
+      - kind: Secret
+        name: catalog-token-exchange-broker

dev/token-exchange-broker-externalsecret.yaml

@@ -0,0 +1,17 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: catalog-token-exchange-broker
+  namespace: catalog
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kong-v2
+  target:
+    name: catalog-token-exchange-broker
+  data:
+    - secretKey: TOKEN_EXCHANGE_CLIENT_SECRET
+      remoteRef:
+        key: kong-v2/catalog-api/token-exchange-broker
+        property: client_secret