MCP server

dev/flux-kustomization.yaml

@@ -26,3 +26,10 @@ spec:
       BACKEND_SCOPES: '[]'
       API_RATE_LIMIT_MINUTE: "60"
       AUDIT_LOG_ENDPOINT: http://audit-log-collector.observability.svc.cluster.local/logs
+      REST_HOSTNAME: catalog-dev.sttlab.local
+      MCP_HOSTNAME: catalog-mcp-dev.sttlab.local
+      MCP_AUDIENCE: '["mcp-catalog"]'
+      TOKEN_EXCHANGE_CLIENT_ID: kong-token-exchange-broker
+    substituteFrom:
+      - kind: Secret
+        name: catalog-token-exchange-broker

dev/token-exchange-broker-externalsecret.yaml

@@ -0,0 +1,17 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: catalog-token-exchange-broker
+  namespace: catalog
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kong-v2
+  target:
+    name: catalog-token-exchange-broker
+  data:
+    - secretKey: TOKEN_EXCHANGE_CLIENT_SECRET
+      remoteRef:
+        key: kong-v2/catalog-api/token-exchange-broker
+        property: client_secret

kong/kustomization.yaml

@@ -1,10 +1,16 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - service.yaml
+  - rest/service.yaml
-  - routes.yaml
+  - rest/routes.yaml
-  - kongplugin.yaml
+  - rest/kongplugin.yaml
-  - rate-limiting.yaml
+  - rest/rate-limiting.yaml
-  - proxy-cache.yaml
+  - rest/proxy-cache.yaml
-  - audit-log.yaml
+  - rest/audit-log.yaml
-  - pluginbindings.yaml
+  - rest/pluginbindings.yaml
+  - mcp/service.yaml
+  - mcp/routes.yaml
+  - mcp/consumergroups.yaml
+  - mcp/ai-mcp-proxy.yaml
+  - mcp/openid-connect.yaml
+  - mcp/pluginbindings.yaml

kong/mcp/ai-mcp-proxy.yaml

@@ -0,0 +1,89 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-catalog-mcp-ai-mcp-proxy
+  namespace: ${NAMESPACE}
+plugin: ai-mcp-proxy
+config:
+  mode: conversion-listener
+  include_consumer_groups: true
+  tools:
+    - name: list-products
+      description: Retrieves a paginated list of products in the classic-models catalog.
+      annotations:
+        title: List all products
+        read_only_hint: true
+        idempotent_hint: true
+        destructive_hint: false
+        open_world_hint: false
+      acl:
+        allow:
+          - sttlab-user
+          - sttlab-admin
+      method: GET
+      scheme: http
+      host: ${REST_HOSTNAME}
+      path: /classic-models/api/v1/products/
+    - name: get-product
+      description: Retrieves a single product by its product code.
+      annotations:
+        title: Get a product
+        read_only_hint: true
+        idempotent_hint: true
+        destructive_hint: false
+        open_world_hint: false
+      acl:
+        allow:
+          - sttlab-user
+          - sttlab-admin
+      method: GET
+      scheme: http
+      host: ${REST_HOSTNAME}
+      path: /classic-models/api/v1/products/{productcode}/
+      parameters:
+        - name: productcode
+          in: path
+          required: true
+          description: The product's unique code.
+          schema: {}
+    - name: create-product
+      description: Creates a new product in the catalog.
+      annotations:
+        title: Create a product
+        read_only_hint: false
+        idempotent_hint: false
+        destructive_hint: false
+        open_world_hint: false
+      acl:
+        allow:
+          - sttlab-admin
+      method: POST
+      scheme: http
+      host: ${REST_HOSTNAME}
+      path: /classic-models/api/v1/products/
+      request_body:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                productname:
+                  type: string
+                productline:
+                  type: string
+                productscale:
+                  type: string
+                productvendor:
+                  type: string
+                productdescription:
+                  type: string
+                quantityinstock:
+                  type: integer
+                buyprice:
+                  type: string
+                msrp:
+                  type: string
+              required:
+                - productname
+                - productline

kong/mcp/consumergroups.yaml

@@ -0,0 +1,23 @@
+apiVersion: configuration.konghq.com/v1beta1
+kind: KongConsumerGroup
+metadata:
+  name: ${NAME}-sttlab-user
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  name: sttlab-user
+---
+apiVersion: configuration.konghq.com/v1beta1
+kind: KongConsumerGroup
+metadata:
+  name: ${NAME}-sttlab-admin
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  name: sttlab-admin

kong/mcp/openid-connect.yaml

@@ -0,0 +1,27 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-catalog-mcp-openid-connect
+  namespace: ${NAMESPACE}
+plugin: openid-connect
+config:
+  issuer: ${OIDC_ISSUER}
+  audience_required: ${API_AUDIENCE}
+  auth_methods:
+    - bearer
+  display_errors: false
+  ssl_verify: true
+  consumer_groups_claim:
+    - realm_access
+    - roles
+  client_id:
+    - ${TOKEN_EXCHANGE_CLIENT_ID}
+  client_secret:
+    - ${TOKEN_EXCHANGE_CLIENT_SECRET}
+  token_exchange:
+    subject_token_issuers:
+      - issuer: ${OIDC_ISSUER}
+        conditions: {}
+    request:
+      audience: ${API_AUDIENCE}
+      scopes: []

kong/mcp/pluginbindings.yaml

@@ -0,0 +1,35 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-catalog-mcp-openid-connect-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-catalog-mcp-openid-connect
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-catalog-mcp
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-catalog-mcp-ai-mcp-proxy-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-catalog-mcp-ai-mcp-proxy
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-catalog-mcp

kong/mcp/routes.yaml

@@ -0,0 +1,42 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-catalog-mcp
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-catalog-mcp
+  name: catalog-mcp
+  hosts:
+    - ${MCP_HOSTNAME}
+  methods:
+    - POST
+    - DELETE
+  paths:
+    - /catalog-mcp
+  strip_path: false
+  tags:
+    - catalog
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-catalog-mcp-stream
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-catalog-mcp
+  name: catalog-mcp-stream
+  hosts:
+    - ${MCP_HOSTNAME}
+  methods:
+    - GET
+  paths:
+    - /catalog-mcp
+  strip_path: false
+  tags:
+    - catalog

kong/mcp/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongService
+metadata:
+  name: ${NAME}-catalog-mcp
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  name: catalog-mcp
+  host: ${REST_HOSTNAME}
+  port: 80
+  protocol: http
+  path: /
+  tags:
+    - catalog

kong/rest/kongplugin.yaml

@@ -6,8 +6,7 @@ metadata:
 plugin: openid-connect
 config:
   issuer: ${OIDC_ISSUER}
-  audience_required: ${API_AUDIENCE}
+  audience_required: ${BACKEND_AUDIENCE}
-  scopes_required: ${API_SCOPES_REQUIRED}
   auth_methods:
     - bearer
   display_errors: false
@@ -18,6 +17,10 @@ config:
     - custom_id
     - username
   consumer_optional: true
+  client_id:
+    - ${TOKEN_EXCHANGE_CLIENT_ID}
+  client_secret:
+    - ${TOKEN_EXCHANGE_CLIENT_SECRET}
   token_exchange:
     subject_token_issuers:
       - issuer: ${OIDC_ISSUER}