stt/kong-dataplane-customers
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

JWT audience fix

Browse Source
This commit is contained in:
Stéphane Tailland
2026-08-23 15:53:04 +02:00
parent 9c2dd3f8db
commit baa9eb8f8b
1 changed files with 8 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dev/api-gateway/policies-kustomization.yaml
+8 -9
View File
@@ -27,15 +27,14 @@ spec:
# comment. Automate this lookup once the self-service pipeline exists. # comment. Automate this lookup once the self-service pipeline exists.
CONTROL_PLANE_REF_NAME: customers-dev-tw8tn CONTROL_PLANE_REF_NAME: customers-dev-tw8tn
# Every audience valid anywhere in the customers domain — grows as the # Every audience valid anywhere in the customers domain — grows as the
# domain gains APIs. # domain gains APIs. mcp-customers added 2026-08-23 alongside the
JWT_AUDIENCE_WHITELIST: '["customers-api"]' # customers-mcp Kong layer (customers-api/kong/mcp/).
# Deliberate override of dataplane-template-defaults' OIDC_ISSUER (VPS JWT_AUDIENCE_WHITELIST: '["customers-api", "mcp-customers"]'
# Keycloak) — the customers-api client lives only in the local # OIDC_ISSUER override, not dataplane-template-defaults' stale VPS
# in-cluster Keycloak (ns keycloak, keycloak.sttlab.local/realms/ # value — the local in-cluster Keycloak (ns keycloak,
# classic-models, deployed 2026-08-23), a separate IdP instance from # keycloak.sttlab.local/realms/classic-models) is the platform-wide
# the VPS one the other domains (catalog, librechat) authenticate # IdP now (see ../../../STATUS.md sections 15/16), confirmed
# against. Confirmed reachable in-cluster (OIDC discovery, 200) before # reachable in-cluster before wiring this in.
# wiring this in.
OIDC_ISSUER: https://keycloak.sttlab.local/realms/classic-models OIDC_ISSUER: https://keycloak.sttlab.local/realms/classic-models
substituteFrom: substituteFrom:
- kind: ConfigMap - kind: ConfigMap