Stéphane Tailland
6dd6b61eb0
Every agent has to name this client in the audience scopes it requests, so the one thing an agent cannot avoid naming was the very thing it should know nothing about. The gateway is replaceable; the contract should not say otherwise. token-exchange-broker, same credential, same behaviour. The old client stays in the realm until every consumer has moved. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
38 lines
1.4 KiB
YAML
38 lines
1.4 KiB
YAML
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
|
kind: Kustomization
|
|
metadata:
|
|
name: payments-dev-api
|
|
namespace: payments
|
|
spec:
|
|
interval: 10m
|
|
sourceRef:
|
|
kind: GitRepository
|
|
name: payments-api-dev
|
|
path: ./kong
|
|
prune: true
|
|
dependsOn:
|
|
- name: payments-dev-api-gateway
|
|
# The gateway Kustomization moved out of flux-system into this domain's
|
|
# namespace, where the team can reach it. A dependsOn that still named
|
|
# flux-system resolved to nothing and left this Kustomization not ready.
|
|
namespace: payments
|
|
postBuild:
|
|
substitute:
|
|
NAME: payments-dev
|
|
NAMESPACE: payments
|
|
CONTROL_PLANE_REF_NAME: payments-dev-cp
|
|
BACKEND_HOST: classic-models-api.classic-models.svc.cluster.local
|
|
OIDC_ISSUER: https://keycloak.sttlab.local/realms/classic-models
|
|
API_AUDIENCE: '["payments-api"]'
|
|
BACKEND_AUDIENCE: '["classic-models-api"]'
|
|
BACKEND_SCOPES: '[]'
|
|
API_RATE_LIMIT_MINUTE: "60"
|
|
# The URI path is the collector's routing key: Fluent Bit tags the
|
|
# record `payments` and turns that into the Loki label domain=payments.
|
|
AUDIT_LOG_ENDPOINT: http://audit-log-collector.observability.svc.cluster.local/payments
|
|
REST_HOSTNAME: payments-dev.sttlab.local
|
|
TOKEN_EXCHANGE_CLIENT_ID: token-exchange-broker
|
|
substituteFrom:
|
|
- kind: Secret
|
|
name: payments-token-exchange-broker
|