apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: ${NAME}-catalog-api-openid-connect
  namespace: ${NAMESPACE}
plugin: openid-connect
config:
  issuer: ${OIDC_ISSUER}
  audience_required: ${BACKEND_AUDIENCE}
  auth_methods:
    - bearer
  display_errors: false
  ssl_verify: true
  consumer_claims:
    - - sub
  consumer_by:
    - custom_id
    - username
  consumer_optional: true
  client_id:
    - ${TOKEN_EXCHANGE_CLIENT_ID}
  client_secret:
    - ${TOKEN_EXCHANGE_CLIENT_SECRET}
  token_exchange:
    subject_token_issuers:
      - issuer: ${OIDC_ISSUER}
        conditions: {}
    request:
      audience: ${BACKEND_AUDIENCE}
      scopes: ${BACKEND_SCOPES}