From b4fd7064a3118ac22a98df43fb7bf539b2a4b22e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Tailland?= Date: Thu, 20 Aug 2026 12:11:59 +0200 Subject: [PATCH] Globol Policies template --- .../global-policies-plugins.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/dataplane-globalpolicy-template/global-policies-plugins.yaml b/dataplane-globalpolicy-template/global-policies-plugins.yaml index 8c8253b..0cb36b0 100644 --- a/dataplane-globalpolicy-template/global-policies-plugins.yaml +++ b/dataplane-globalpolicy-template/global-policies-plugins.yaml @@ -27,6 +27,14 @@ config: auth_methods: - bearer display_errors: false # never leak IdP/token internals in error responses + # Every domain's Control Plane enforces a global tls_certificate_verify + # option (Konnect-side) that rejects plugin instances with TLS verification + # off. openid-connect defaults to ssl_verify: false, which silently broke + # DataPlane config sync entirely (verified via pod logs: "ssl_verify cannot + # be disabled" — the DataPlane never applied ANY config past this plugin, + # not just this domain's, until fixed). Explicit true is also the correct + # choice on its own merits: verify the issuer's cert when fetching JWKS. + ssl_verify: true --- apiVersion: configuration.konghq.com/v1 kind: KongPlugin