T

Stéphane Tailland 41f7a996c5 Reconcile this repo's Flux entrypoints instead of applying them by hand

dev/ declares this repo's GitRepository, the Kustomization that deploys
./kong, and its ExternalSecrets — but nothing watched dev/, so those files
were applied once by hand and never re-read. Editing them in git changed
nothing until someone remembered to kubectl apply, which is what silently
swallowed the CONTROL_PLANE_REF_NAME rollout: correct in git for hours
while the cluster still held the old value.

Add the bootstrap Kustomization that watches ./dev and, living in ./dev,
manages itself. This is what `flux bootstrap` would have created;
flux-operator installs the controllers and no root.

It sits in the domain namespace rather than flux-system, because sourceRef
resolves in the Kustomization's own namespace and because this is the
team's to own.

Needs one kubectl apply to exist. That is the last one this repo needs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-27 14:32:55 +02:00

dev

Reconcile this repo's Flux entrypoints instead of applying them by hand

2026-08-27 14:32:55 +02:00

kong

Restore SSE on the catalog MCP route

2026-08-26 16:50:52 +02:00

.gitignore

First commit

2026-08-20 13:24:10 +02:00

openapi.yaml

Regenerate the spec against the gateway, not the backend

2026-08-27 06:42:02 +02:00

README.md

MCP server

2026-08-20 17:27:09 +02:00

README.md

catalog-api

Kong routing/policy layer for the catalog slice of classic-models-api (see /Users/stephanetailland/git/classic-models-api), split out per the DDD decomposition in ../kong-konnect-deployment-strategy.md. The backend itself stays a single monolith — only Kong does the domain split.

Two exposure surfaces of the same API, both proxying to the real classic-models-api backend:

REST (kong/rest/) — 14 routes covering products/productlines.
MCP (kong/mcp/) — the same catalog exposed as MCP tools (list-products, get-product, create-product so far; extending to the rest is mechanical), via ai-mcp-proxy.

Auth

openid-connect on both surfaces, with a distinct audience each (catalog-api for REST, mcp-catalog for MCP) and a real RFC 8693 token exchange chain: MCP → catalog-api → classic-models-api (REST's own exchange target), narrowing the token before it ever reaches the backend — the backend never sees a token minted for a different audience. consumer_claims/consumer_by map the JWT sub to a Kong Consumer for per-consumer rate limiting; consumer_groups_claim maps realm roles to Kong Consumer Groups for MCP's per-tool ACLs.

Other policies

Per-consumer + API-level rate limiting, response caching (GET/HEAD), audit log (http-log, endpoint still a placeholder — no real log collector in this lab).

Structure

dev/gitrepository.yaml + dev/flux-kustomization.yaml — this repo, self-referential; deploys ./kong into the catalog domain's dev environment (dependsOn the domain's Gateway infra in dataplane-catalog).
dev/externalsecret.yaml — git deploy key (ESO/Vault).
dev/token-exchange-broker-externalsecret.yaml — the shared client secret Kong uses to authenticate its own token-exchange calls to Keycloak.
kong/rest/, kong/mcp/ — see above.
openapi.yaml — extracted from the live backend, filtered to this domain's paths/schemas.