# Bound to the natively-authored KongService (../service.yaml), not to
# individual routes — all of catalog-api's routes share the same audience,
# same as tasks-api's pattern. Unlike the earlier HTTPRoute-derived
# KongService, this name is ours and stable across reconciles.
apiVersion: configuration.konghq.com/v1alpha1
kind: KongPluginBinding
metadata:
  name: ${NAME}-catalog-api-openid-connect-binding
  namespace: ${NAMESPACE}
spec:
  controlPlaneRef:
    type: konnectNamespacedRef
    konnectNamespacedRef:
      name: ${CONTROL_PLANE_REF_NAME}
  pluginRef:
    name: ${NAME}-catalog-api-openid-connect
  targets:
    serviceRef:
      group: configuration.konghq.com
      kind: KongService
      name: ${NAME}-catalog-api