apiVersion: configuration.konghq.com/v1
kind: KongConsumer
metadata:
  name: ${NAME}-llm-librechat
  namespace: ${NAMESPACE}
username: librechat
spec:
  controlPlaneRef:
    type: konnectNamespacedRef
    konnectNamespacedRef:
      name: ${CONTROL_PLANE_REF_NAME}
  tags:
    - llm
---
apiVersion: configuration.konghq.com/v1alpha1
kind: KongCredentialAPIKey
metadata:
  name: ${NAME}-llm-librechat-apikey
  namespace: ${NAMESPACE}
spec:
  consumerRef:
    name: ${NAME}-llm-librechat
  key: ${LIBRECHAT_APIKEY}
  tags:
    - llm
---
# Fallback identity for a request that fails every real auth plugin (see
# key-auth.yaml/openid-connect.yaml's anonymous field) — request-termination
# below rejects anything that lands here.
apiVersion: configuration.konghq.com/v1
kind: KongConsumer
metadata:
  name: ${NAME}-llm-anonymous
  namespace: ${NAMESPACE}
username: llm-anonymous
spec:
  controlPlaneRef:
    type: konnectNamespacedRef
    konnectNamespacedRef:
      name: ${CONTROL_PLANE_REF_NAME}
  tags:
    - llm
---
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: ${NAME}-llm-anonymous-termination
  namespace: ${NAMESPACE}
plugin: request-termination
config:
  status_code: 401
  message: Authentication required