From baa9eb8f8baf1a61ac02ea165b09b01d4ee08c7b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Tailland?= Date: Sun, 23 Aug 2026 15:53:04 +0200 Subject: [PATCH] JWT audience fix --- dev/api-gateway/policies-kustomization.yaml | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/dev/api-gateway/policies-kustomization.yaml b/dev/api-gateway/policies-kustomization.yaml index aa772dc..36bf5a7 100644 --- a/dev/api-gateway/policies-kustomization.yaml +++ b/dev/api-gateway/policies-kustomization.yaml @@ -27,15 +27,14 @@ spec: # comment. Automate this lookup once the self-service pipeline exists. CONTROL_PLANE_REF_NAME: customers-dev-tw8tn # Every audience valid anywhere in the customers domain — grows as the - # domain gains APIs. - JWT_AUDIENCE_WHITELIST: '["customers-api"]' - # Deliberate override of dataplane-template-defaults' OIDC_ISSUER (VPS - # Keycloak) — the customers-api client lives only in the local - # in-cluster Keycloak (ns keycloak, keycloak.sttlab.local/realms/ - # classic-models, deployed 2026-08-23), a separate IdP instance from - # the VPS one the other domains (catalog, librechat) authenticate - # against. Confirmed reachable in-cluster (OIDC discovery, 200) before - # wiring this in. + # domain gains APIs. mcp-customers added 2026-08-23 alongside the + # customers-mcp Kong layer (customers-api/kong/mcp/). + JWT_AUDIENCE_WHITELIST: '["customers-api", "mcp-customers"]' + # OIDC_ISSUER override, not dataplane-template-defaults' stale VPS + # value — the local in-cluster Keycloak (ns keycloak, + # keycloak.sttlab.local/realms/classic-models) is the platform-wide + # IdP now (see ../../../STATUS.md sections 15/16), confirmed + # reachable in-cluster before wiring this in. OIDC_ISSUER: https://keycloak.sttlab.local/realms/classic-models substituteFrom: - kind: ConfigMap