Stéphane Tailland
6c93aec717
Every agent has to name this client in the audience scopes it requests, so the one thing an agent cannot avoid naming was the very thing it should know nothing about. The gateway is replaceable; the contract should not say otherwise. token-exchange-broker, same credential, same behaviour. The old client stays in the realm until every consumer has moved. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
49 lines
2.1 KiB
YAML
49 lines
2.1 KiB
YAML
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
|
kind: Kustomization
|
|
metadata:
|
|
name: customers-dev-api
|
|
namespace: customers
|
|
spec:
|
|
interval: 10m
|
|
sourceRef:
|
|
kind: GitRepository
|
|
name: customers-api-dev
|
|
path: ./kong
|
|
prune: true
|
|
dependsOn:
|
|
- name: customers-dev-api-gateway
|
|
# The gateway Kustomization moved out of flux-system into this domain's
|
|
# namespace, where the team can reach it. A dependsOn that still named
|
|
# flux-system resolved to nothing and left this Kustomization not ready.
|
|
namespace: customers
|
|
postBuild:
|
|
substitute:
|
|
NAME: customers-dev
|
|
NAMESPACE: customers
|
|
CONTROL_PLANE_REF_NAME: customers-dev-cp
|
|
BACKEND_HOST: classic-models-api.classic-models.svc.cluster.local
|
|
OIDC_ISSUER: https://keycloak.sttlab.local/realms/classic-models
|
|
API_AUDIENCE: '["customers-api"]'
|
|
# Unused today — same dead variable already present in catalog-api's
|
|
# flux-kustomization.yaml (no file under kong/rest/ or kong/mcp/
|
|
# actually reads API_SCOPES_REQUIRED). Kept for parity; fix in both
|
|
# places together if this ever gets wired up for real.
|
|
API_SCOPES_REQUIRED: '["customers:read"]'
|
|
BACKEND_AUDIENCE: '["classic-models-api"]'
|
|
BACKEND_SCOPES: '[]'
|
|
API_RATE_LIMIT_MINUTE: "60"
|
|
# The URI path is the collector's routing key: Fluent Bit tags the
|
|
# record `customers` and turns that into the Loki label domain=customers.
|
|
AUDIT_LOG_ENDPOINT: http://audit-log-collector.observability.svc.cluster.local/customers
|
|
REST_HOSTNAME: customers-dev.sttlab.local
|
|
TOKEN_EXCHANGE_CLIENT_ID: token-exchange-broker
|
|
# Unused today — same dead variable already present in catalog-api's
|
|
# flux-kustomization.yaml (kong/mcp/openid-connect.yaml uses
|
|
# API_AUDIENCE for its audience_required/token_exchange target, not
|
|
# this). Kept for parity/documentation of what the MCP layer's real
|
|
# token audience is meant to be.
|
|
MCP_AUDIENCE: '["mcp-customers"]'
|
|
substituteFrom:
|
|
- kind: Secret
|
|
name: customers-token-exchange-broker
|