Stéphane Tailland
fc6b60c582
KongConsumerGroups were still named sttlab-user/sttlab-admin, a leftover from before the classic-models realm's role model existed. Real users' JWTs carry realm roles (admin, read_only, product_manager, customer, support) via consumer_groups_claim, so no group ever matched and every tool call was rejected with 403 "consumer groups were not found". Groups now match the realm roles directly; tool ACLs gate on each role's catalog:read/catalog:write grant from security-model.yaml.
60 lines
1.3 KiB
YAML
60 lines
1.3 KiB
YAML
apiVersion: configuration.konghq.com/v1beta1
|
|
kind: KongConsumerGroup
|
|
metadata:
|
|
name: ${NAME}-admin
|
|
namespace: ${NAMESPACE}
|
|
spec:
|
|
controlPlaneRef:
|
|
type: konnectNamespacedRef
|
|
konnectNamespacedRef:
|
|
name: ${CONTROL_PLANE_REF_NAME}
|
|
name: admin
|
|
---
|
|
apiVersion: configuration.konghq.com/v1beta1
|
|
kind: KongConsumerGroup
|
|
metadata:
|
|
name: ${NAME}-read_only
|
|
namespace: ${NAMESPACE}
|
|
spec:
|
|
controlPlaneRef:
|
|
type: konnectNamespacedRef
|
|
konnectNamespacedRef:
|
|
name: ${CONTROL_PLANE_REF_NAME}
|
|
name: read_only
|
|
---
|
|
apiVersion: configuration.konghq.com/v1beta1
|
|
kind: KongConsumerGroup
|
|
metadata:
|
|
name: ${NAME}-product_manager
|
|
namespace: ${NAMESPACE}
|
|
spec:
|
|
controlPlaneRef:
|
|
type: konnectNamespacedRef
|
|
konnectNamespacedRef:
|
|
name: ${CONTROL_PLANE_REF_NAME}
|
|
name: product_manager
|
|
---
|
|
apiVersion: configuration.konghq.com/v1beta1
|
|
kind: KongConsumerGroup
|
|
metadata:
|
|
name: ${NAME}-customer
|
|
namespace: ${NAMESPACE}
|
|
spec:
|
|
controlPlaneRef:
|
|
type: konnectNamespacedRef
|
|
konnectNamespacedRef:
|
|
name: ${CONTROL_PLANE_REF_NAME}
|
|
name: customer
|
|
---
|
|
apiVersion: configuration.konghq.com/v1beta1
|
|
kind: KongConsumerGroup
|
|
metadata:
|
|
name: ${NAME}-support
|
|
namespace: ${NAMESPACE}
|
|
spec:
|
|
controlPlaneRef:
|
|
type: konnectNamespacedRef
|
|
konnectNamespacedRef:
|
|
name: ${CONTROL_PLANE_REF_NAME}
|
|
name: support
|