Stéphane Tailland
2880e21ef1
16 routes: Office (single key, full CRUD + employees sub-resource) and Employee (single key, full CRUD + reports + customers sub-resources). MCP layer built with the single-route pattern from the start. Only domain where customer role has zero access — verified against ReferenceDataPermission.check(): read_only/product_manager/support get reads, writes are admin-only, customer isn't in the allow-list at all. All 9 MCP tool ACLs reflect this exactly. Keycloak (local): workforce-api-audience + mcp-workforce-audience client scopes, resource clients, broker/librechat attachments. Deploy key and broker secret reused/mirrored, same pattern as every domain since payments-api.
24 lines
651 B
YAML
24 lines
651 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
- rest/service.yaml
|
|
- rest/routes.yaml
|
|
- rest/path-rewrite.yaml
|
|
- rest/path-rewrite-bindings.yaml
|
|
- rest/kongplugin.yaml
|
|
- rest/rate-limiting.yaml
|
|
- rest/proxy-cache.yaml
|
|
- rest/audit-log.yaml
|
|
- rest/audit-log-body-capture.yaml
|
|
- rest/audit-log-body-capture-bindings.yaml
|
|
- rest/pluginbindings.yaml
|
|
- mcp/service.yaml
|
|
- mcp/routes.yaml
|
|
- mcp/consumergroups.yaml
|
|
- mcp/ai-mcp-proxy.yaml
|
|
- mcp/openid-connect.yaml
|
|
- mcp/audit-log.yaml
|
|
- mcp/audit-log-body-capture.yaml
|
|
- mcp/audit-log-body-capture-bindings.yaml
|
|
- mcp/pluginbindings.yaml
|