From fc6b60c582a668efb78d5a470c463021e1783744 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Tailland?= <stephane.tailland@ibm.com>
Date: Fri, 21 Aug 2026 18:35:02 +0200
Subject: [PATCH] Rebuild catalog-mcp consumer groups on the real 5-role model

KongConsumerGroups were still named sttlab-user/sttlab-admin, a leftover
from before the classic-models realm's role model existed. Real users'
JWTs carry realm roles (admin, read_only, product_manager, customer,
support) via consumer_groups_claim, so no group ever matched and every
tool call was rejected with 403 "consumer groups were not found".

Groups now match the realm roles directly; tool ACLs gate on each role's
catalog:read/catalog:write grant from security-model.yaml.
---
 kong/mcp/ai-mcp-proxy.yaml   | 17 ++++++++++----
 kong/mcp/consumergroups.yaml | 44 ++++++++++++++++++++++++++++++++----
 2 files changed, 52 insertions(+), 9 deletions(-)

diff --git a/kong/mcp/ai-mcp-proxy.yaml b/kong/mcp/ai-mcp-proxy.yaml
index 87b8028..fe36bf4 100644
--- a/kong/mcp/ai-mcp-proxy.yaml
+++ b/kong/mcp/ai-mcp-proxy.yaml
@@ -18,8 +18,11 @@ config:
         open_world_hint: false
       acl:
         allow:
-          - sttlab-user
-          - sttlab-admin
+          - admin
+          - read_only
+          - product_manager
+          - customer
+          - support
       method: GET
       scheme: http
       host: ${REST_HOSTNAME}
@@ -34,8 +37,11 @@ config:
         open_world_hint: false
       acl:
         allow:
-          - sttlab-user
-          - sttlab-admin
+          - admin
+          - read_only
+          - product_manager
+          - customer
+          - support
       method: GET
       scheme: http
       host: ${REST_HOSTNAME}
@@ -56,7 +62,8 @@ config:
         open_world_hint: false
       acl:
         allow:
-          - sttlab-admin
+          - admin
+          - product_manager
       method: POST
       scheme: http
       host: ${REST_HOSTNAME}
diff --git a/kong/mcp/consumergroups.yaml b/kong/mcp/consumergroups.yaml
index 3d21174..2b727ef 100644
--- a/kong/mcp/consumergroups.yaml
+++ b/kong/mcp/consumergroups.yaml
@@ -1,23 +1,59 @@
 apiVersion: configuration.konghq.com/v1beta1
 kind: KongConsumerGroup
 metadata:
-  name: ${NAME}-sttlab-user
+  name: ${NAME}-admin
   namespace: ${NAMESPACE}
 spec:
   controlPlaneRef:
     type: konnectNamespacedRef
     konnectNamespacedRef:
       name: ${CONTROL_PLANE_REF_NAME}
-  name: sttlab-user
+  name: admin
 ---
 apiVersion: configuration.konghq.com/v1beta1
 kind: KongConsumerGroup
 metadata:
-  name: ${NAME}-sttlab-admin
+  name: ${NAME}-read_only
   namespace: ${NAMESPACE}
 spec:
   controlPlaneRef:
     type: konnectNamespacedRef
     konnectNamespacedRef:
       name: ${CONTROL_PLANE_REF_NAME}
-  name: sttlab-admin
+  name: read_only
+---
+apiVersion: configuration.konghq.com/v1beta1
+kind: KongConsumerGroup
+metadata:
+  name: ${NAME}-product_manager
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  name: product_manager
+---
+apiVersion: configuration.konghq.com/v1beta1
+kind: KongConsumerGroup
+metadata:
+  name: ${NAME}-customer
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  name: customer
+---
+apiVersion: configuration.konghq.com/v1beta1
+kind: KongConsumerGroup
+metadata:
+  name: ${NAME}-support
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  name: support