Stéphane Tailland
3248f7c9d3
The ACL answers 'may this identity call create-product'. Nothing answered 'may it call it with these arguments' — write authorises writing, not this particular record. And the read cap counts calls, so one call asking for a hundred thousand rows cost the same as one asking for ten. The OPA plugin sends the decoded JSON-RPC body, so the decision point sees the tool name and its arguments. The policy lives once in k8s-platform/opa and every domain asks the same server. Enforced at the gateway rather than in an agent, because an agent that has been talked into something is the case this exists for. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
90 lines
2.2 KiB
YAML
90 lines
2.2 KiB
YAML
apiVersion: configuration.konghq.com/v1alpha1
|
|
kind: KongPluginBinding
|
|
metadata:
|
|
name: ${NAME}-payments-mcp-openid-connect-binding
|
|
namespace: ${NAMESPACE}
|
|
spec:
|
|
controlPlaneRef:
|
|
type: konnectNamespacedRef
|
|
konnectNamespacedRef:
|
|
name: ${CONTROL_PLANE_REF_NAME}
|
|
pluginRef:
|
|
name: ${NAME}-payments-mcp-openid-connect
|
|
targets:
|
|
serviceRef:
|
|
group: configuration.konghq.com
|
|
kind: KongService
|
|
name: ${NAME}-payments-mcp
|
|
---
|
|
apiVersion: configuration.konghq.com/v1alpha1
|
|
kind: KongPluginBinding
|
|
metadata:
|
|
name: ${NAME}-payments-mcp-ai-mcp-proxy-binding
|
|
namespace: ${NAMESPACE}
|
|
spec:
|
|
controlPlaneRef:
|
|
type: konnectNamespacedRef
|
|
konnectNamespacedRef:
|
|
name: ${CONTROL_PLANE_REF_NAME}
|
|
pluginRef:
|
|
name: ${NAME}-payments-mcp-ai-mcp-proxy
|
|
targets:
|
|
routeRef:
|
|
group: configuration.konghq.com
|
|
kind: KongRoute
|
|
name: ${NAME}-payments-mcp
|
|
---
|
|
apiVersion: configuration.konghq.com/v1alpha1
|
|
kind: KongPluginBinding
|
|
metadata:
|
|
name: ${NAME}-payments-mcp-audit-log-binding
|
|
namespace: ${NAMESPACE}
|
|
spec:
|
|
controlPlaneRef:
|
|
type: konnectNamespacedRef
|
|
konnectNamespacedRef:
|
|
name: ${CONTROL_PLANE_REF_NAME}
|
|
pluginRef:
|
|
name: ${NAME}-payments-mcp-audit-log
|
|
targets:
|
|
serviceRef:
|
|
group: configuration.konghq.com
|
|
kind: KongService
|
|
name: ${NAME}-payments-mcp
|
|
---
|
|
apiVersion: configuration.konghq.com/v1alpha1
|
|
kind: KongPluginBinding
|
|
metadata:
|
|
name: ${NAME}-payments-mcp-rate-limiting-binding
|
|
namespace: ${NAMESPACE}
|
|
spec:
|
|
controlPlaneRef:
|
|
type: konnectNamespacedRef
|
|
konnectNamespacedRef:
|
|
name: ${CONTROL_PLANE_REF_NAME}
|
|
pluginRef:
|
|
name: ${NAME}-payments-mcp-rate-limiting
|
|
targets:
|
|
routeRef:
|
|
group: configuration.konghq.com
|
|
kind: KongRoute
|
|
name: ${NAME}-payments-mcp
|
|
---
|
|
apiVersion: configuration.konghq.com/v1alpha1
|
|
kind: KongPluginBinding
|
|
metadata:
|
|
name: ${NAME}-payments-mcp-opa-binding
|
|
namespace: ${NAMESPACE}
|
|
spec:
|
|
controlPlaneRef:
|
|
type: konnectNamespacedRef
|
|
konnectNamespacedRef:
|
|
name: ${CONTROL_PLANE_REF_NAME}
|
|
pluginRef:
|
|
name: ${NAME}-payments-mcp-opa
|
|
targets:
|
|
routeRef:
|
|
group: configuration.konghq.com
|
|
kind: KongRoute
|
|
name: ${NAME}-payments-mcp
|