Stéphane Tailland
31 lines
1.4 KiB
YAML
31 lines
1.4 KiB
YAML
# Per-API audience check — narrows on top of the domain-wide whitelist
|
|
# check already enforced globally (k8s-platform/dataplane-globalpolicy-template,
|
|
# scope: GlobalInControlPlane). Defense in depth: both instances run
|
|
# independently on every request (verified Kong behavior, see STATUS.md).
|
|
#
|
|
# PLACEHOLDER-in-spirit: no Keycloak client named "catalog-api" exists yet
|
|
# (only classic-models-api's own client/mapper does) — this will reject
|
|
# every real token until that client + its oidc-audience-mapper are created.
|
|
apiVersion: configuration.konghq.com/v1
|
|
kind: KongPlugin
|
|
metadata:
|
|
name: ${NAME}-catalog-api-openid-connect
|
|
namespace: ${NAMESPACE}
|
|
plugin: openid-connect
|
|
config:
|
|
issuer: ${OIDC_ISSUER}
|
|
# Whole YAML flow-sequence as one string var, same reason as
|
|
# JWT_AUDIENCE_WHITELIST in the global template — postBuild.substitute
|
|
# does plain text substitution, not list generation.
|
|
audience_required: ${API_AUDIENCE}
|
|
auth_methods:
|
|
- bearer
|
|
display_errors: false
|
|
# This Control Plane enforces a global tls_certificate_verify option
|
|
# (Konnect-side, not set by us) that rejects any plugin instance whose TLS
|
|
# verification is off — openid-connect defaults to ssl_verify: false,
|
|
# which silently broke the DataPlane's config sync entirely (verified via
|
|
# DataPlane pod logs: "ssl_verify cannot be disabled"). Explicit true is
|
|
# the correct fix anyway: verify the issuer's cert when fetching JWKS.
|
|
ssl_verify: true
|