# Per-API audience check — narrows on top of the domain-wide whitelist
# check already enforced globally (k8s-platform/dataplane-globalpolicy-template,
# scope: GlobalInControlPlane). Defense in depth: both instances run
# independently on every request (verified Kong behavior, see STATUS.md).
#
# PLACEHOLDER-in-spirit: no Keycloak client named "catalog-api" exists yet
# (only classic-models-api's own client/mapper does) — this will reject
# every real token until that client + its oidc-audience-mapper are created.
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: ${NAME}-catalog-api-openid-connect
  namespace: ${NAMESPACE}
plugin: openid-connect
config:
  issuer: ${OIDC_ISSUER}
  # Whole YAML flow-sequence as one string var, same reason as
  # JWT_AUDIENCE_WHITELIST in the global template — postBuild.substitute
  # does plain text substitution, not list generation.
  audience_required: ${API_AUDIENCE}
  auth_methods:
    - bearer
  display_errors: false
  # This Control Plane enforces a global tls_certificate_verify option
  # (Konnect-side, not set by us) that rejects any plugin instance whose TLS
  # verification is off — openid-connect defaults to ssl_verify: false,
  # which silently broke the DataPlane's config sync entirely (verified via
  # DataPlane pod logs: "ssl_verify cannot be disabled"). Explicit true is
  # the correct fix anyway: verify the issuer's cert when fetching JWKS.
  ssl_verify: true