apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: ${NAME}-catalog-mcp-openid-connect
  namespace: ${NAMESPACE}
plugin: openid-connect
config:
  issuer: ${OIDC_ISSUER}
  audience_required: ${API_AUDIENCE}
  auth_methods:
    - bearer
  display_errors: false
  ssl_verify: true
  consumer_groups_claim:
    - realm_access
    - roles
  client_id:
    - ${TOKEN_EXCHANGE_CLIENT_ID}
  client_secret:
    - ${TOKEN_EXCHANGE_CLIENT_SECRET}
  token_exchange:
    subject_token_issuers:
      - issuer: ${OIDC_ISSUER}
        conditions: {}
    request:
      audience: ${API_AUDIENCE}
      scopes: []