stt/kong-workforce-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
main
kong-workforce-api/kong/rest/path-rewrite-bindings.yaml
T
Stéphane Tailland 2880e21ef1 Build workforce-api REST + MCP layers (Layer 3), full build in one pass 
16 routes: Office (single key, full CRUD + employees sub-resource)
and Employee (single key, full CRUD + reports + customers
sub-resources). MCP layer built with the single-route pattern from
the start.

Only domain where customer role has zero access — verified against
ReferenceDataPermission.check(): read_only/product_manager/support
get reads, writes are admin-only, customer isn't in the allow-list
at all. All 9 MCP tool ACLs reflect this exactly.

Keycloak (local): workforce-api-audience + mcp-workforce-audience
client scopes, resource clients, broker/librechat attachments.
Deploy key and broker secret reused/mirrored, same pattern as every
domain since payments-api.
2026-08-23 17:13:45 +02:00

270 lines
7.2 KiB
YAML
Raw Permalink Blame History

apiVersion: configuration.konghq.com/v1alpha1
kind: KongPluginBinding
metadata:
name: ${NAME}-workforce-api-rewrite-listoffices-binding
namespace: ${NAMESPACE}
spec:
controlPlaneRef:
type: konnectNamespacedRef
konnectNamespacedRef:
name: ${CONTROL_PLANE_REF_NAME}
pluginRef:
name: ${NAME}-workforce-api-rewrite-listoffices
targets:
routeRef:
group: configuration.konghq.com
kind: KongRoute
name: ${NAME}-workforce-api-listoffices
---
apiVersion: configuration.konghq.com/v1alpha1
kind: KongPluginBinding
metadata:
name: ${NAME}-workforce-api-rewrite-createoffice-binding
namespace: ${NAMESPACE}
spec:
controlPlaneRef:
type: konnectNamespacedRef
konnectNamespacedRef:
name: ${CONTROL_PLANE_REF_NAME}
pluginRef:
name: ${NAME}-workforce-api-rewrite-createoffice
targets:
routeRef:
group: configuration.konghq.com
kind: KongRoute
name: ${NAME}-workforce-api-createoffice
---
apiVersion: configuration.konghq.com/v1alpha1
kind: KongPluginBinding
metadata:
name: ${NAME}-workforce-api-rewrite-getoffice-binding
namespace: ${NAMESPACE}
spec:
controlPlaneRef:
type: konnectNamespacedRef
konnectNamespacedRef:
name: ${CONTROL_PLANE_REF_NAME}
pluginRef:
name: ${NAME}-workforce-api-rewrite-getoffice
targets:
routeRef:
group: configuration.konghq.com
kind: KongRoute
name: ${NAME}-workforce-api-getoffice
---
apiVersion: configuration.konghq.com/v1alpha1
kind: KongPluginBinding
metadata:
name: ${NAME}-workforce-api-rewrite-updateoffice-binding
namespace: ${NAMESPACE}
spec:
controlPlaneRef:
type: konnectNamespacedRef
konnectNamespacedRef:
name: ${CONTROL_PLANE_REF_NAME}
pluginRef:
name: ${NAME}-workforce-api-rewrite-updateoffice
targets:
routeRef:
group: configuration.konghq.com
kind: KongRoute
name: ${NAME}-workforce-api-updateoffice
---
apiVersion: configuration.konghq.com/v1alpha1
kind: KongPluginBinding
metadata:
name: ${NAME}-workforce-api-rewrite-patchoffice-binding
namespace: ${NAMESPACE}
spec:
controlPlaneRef:
type: konnectNamespacedRef
konnectNamespacedRef:
name: ${CONTROL_PLANE_REF_NAME}
pluginRef:
name: ${NAME}-workforce-api-rewrite-patchoffice
targets:
routeRef:
group: configuration.konghq.com
kind: KongRoute
name: ${NAME}-workforce-api-patchoffice
---
apiVersion: configuration.konghq.com/v1alpha1
kind: KongPluginBinding
metadata:
name: ${NAME}-workforce-api-rewrite-deleteoffice-binding
namespace: ${NAMESPACE}
spec:
controlPlaneRef:
type: konnectNamespacedRef
konnectNamespacedRef:
name: ${CONTROL_PLANE_REF_NAME}
pluginRef:
name: ${NAME}-workforce-api-rewrite-deleteoffice
targets:
routeRef:
group: configuration.konghq.com
kind: KongRoute
name: ${NAME}-workforce-api-deleteoffice
---
apiVersion: configuration.konghq.com/v1alpha1
kind: KongPluginBinding
metadata:
name: ${NAME}-workforce-api-rewrite-getofficeemployees-binding
namespace: ${NAMESPACE}
spec:
controlPlaneRef:
type: konnectNamespacedRef
konnectNamespacedRef:
name: ${CONTROL_PLANE_REF_NAME}
pluginRef:
name: ${NAME}-workforce-api-rewrite-getofficeemployees
targets:
routeRef:
group: configuration.konghq.com
kind: KongRoute
name: ${NAME}-workforce-api-getofficeemployees
---
apiVersion: configuration.konghq.com/v1alpha1
kind: KongPluginBinding
metadata:
name: ${NAME}-workforce-api-rewrite-listemployees-binding
namespace: ${NAMESPACE}
spec:
controlPlaneRef:
type: konnectNamespacedRef
konnectNamespacedRef:
name: ${CONTROL_PLANE_REF_NAME}
pluginRef:
name: ${NAME}-workforce-api-rewrite-listemployees
targets:
routeRef:
group: configuration.konghq.com
kind: KongRoute
name: ${NAME}-workforce-api-listemployees
---
apiVersion: configuration.konghq.com/v1alpha1
kind: KongPluginBinding
metadata:
name: ${NAME}-workforce-api-rewrite-createemployee-binding
namespace: ${NAMESPACE}
spec:
controlPlaneRef:
type: konnectNamespacedRef
konnectNamespacedRef:
name: ${CONTROL_PLANE_REF_NAME}
pluginRef:
name: ${NAME}-workforce-api-rewrite-createemployee
targets:
routeRef:
group: configuration.konghq.com
kind: KongRoute
name: ${NAME}-workforce-api-createemployee
---
apiVersion: configuration.konghq.com/v1alpha1
kind: KongPluginBinding
metadata:
name: ${NAME}-workforce-api-rewrite-getemployee-binding
namespace: ${NAMESPACE}
spec:
controlPlaneRef:
type: konnectNamespacedRef
konnectNamespacedRef:
name: ${CONTROL_PLANE_REF_NAME}
pluginRef:
name: ${NAME}-workforce-api-rewrite-getemployee
targets:
routeRef:
group: configuration.konghq.com
kind: KongRoute
name: ${NAME}-workforce-api-getemployee
---
apiVersion: configuration.konghq.com/v1alpha1
kind: KongPluginBinding
metadata:
name: ${NAME}-workforce-api-rewrite-updateemployee-binding
namespace: ${NAMESPACE}
spec:
controlPlaneRef:
type: konnectNamespacedRef
konnectNamespacedRef:
name: ${CONTROL_PLANE_REF_NAME}
pluginRef:
name: ${NAME}-workforce-api-rewrite-updateemployee
targets:
routeRef:
group: configuration.konghq.com
kind: KongRoute
name: ${NAME}-workforce-api-updateemployee
---
apiVersion: configuration.konghq.com/v1alpha1
kind: KongPluginBinding
metadata:
name: ${NAME}-workforce-api-rewrite-patchemployee-binding
namespace: ${NAMESPACE}
spec:
controlPlaneRef:
type: konnectNamespacedRef
konnectNamespacedRef:
name: ${CONTROL_PLANE_REF_NAME}
pluginRef:
name: ${NAME}-workforce-api-rewrite-patchemployee
targets:
routeRef:
group: configuration.konghq.com
kind: KongRoute
name: ${NAME}-workforce-api-patchemployee
---
apiVersion: configuration.konghq.com/v1alpha1
kind: KongPluginBinding
metadata:
name: ${NAME}-workforce-api-rewrite-deleteemployee-binding
namespace: ${NAMESPACE}
spec:
controlPlaneRef:
type: konnectNamespacedRef
konnectNamespacedRef:
name: ${CONTROL_PLANE_REF_NAME}
pluginRef:
name: ${NAME}-workforce-api-rewrite-deleteemployee
targets:
routeRef:
group: configuration.konghq.com
kind: KongRoute
name: ${NAME}-workforce-api-deleteemployee
---
apiVersion: configuration.konghq.com/v1alpha1
kind: KongPluginBinding
metadata:
name: ${NAME}-workforce-api-rewrite-getemployeereports-binding
namespace: ${NAMESPACE}
spec:
controlPlaneRef:
type: konnectNamespacedRef
konnectNamespacedRef:
name: ${CONTROL_PLANE_REF_NAME}
pluginRef:
name: ${NAME}-workforce-api-rewrite-getemployeereports
targets:
routeRef:
group: configuration.konghq.com
kind: KongRoute
name: ${NAME}-workforce-api-getemployeereports
---
apiVersion: configuration.konghq.com/v1alpha1
kind: KongPluginBinding
metadata:
name: ${NAME}-workforce-api-rewrite-getemployeecustomers-binding
namespace: ${NAMESPACE}
spec:
controlPlaneRef:
type: konnectNamespacedRef
konnectNamespacedRef:
name: ${CONTROL_PLANE_REF_NAME}
pluginRef:
name: ${NAME}-workforce-api-rewrite-getemployeecustomers
targets:
routeRef:
group: configuration.konghq.com
kind: KongRoute
name: ${NAME}-workforce-api-getemployeecustomers
Reference in New Issue View Git Blame Copy Permalink