configmaps.yaml

# Demo-specific ConfigMap overrides for GitHub Issue Agent + AuthBridge
#
# The Rossoctl installer already creates correct defaults for authbridge-config,
# spiffe-helper-config, and envoy-config (with the rossoctl realm). This file
# overrides:
# - authbridge-config: Keycloak connection, inbound validation, and outbound exchange settings
# - authproxy-routes: per-target token exchange routes
#
# Authbridge defaults to "passthrough" for outbound traffic, meaning
# requests to unknown hosts (LLM APIs, telemetry, etc.) pass through without
# token exchange. Only hosts listed in authproxy-routes get token exchange.
#
# Usage:
#   kubectl apply -f configmaps.yaml
#
# Note: These manifests default to namespace "team1". If you deploy to a different
#       namespace, update the metadata.namespace accordingly.

---
# authbridge-config ConfigMap - Unified config for both client-registration and envoy-proxy
#
# This ConfigMap controls:
#   1. Client registration: KEYCLOAK_URL, KEYCLOAK_REALM for Keycloak client setup
#   2. INBOUND validation: Validates JWT tokens on incoming requests to the agent
#   3. OUTBOUND exchange:  Exchanges tokens when the agent calls the GitHub tool
#
# KEYCLOAK_URL and KEYCLOAK_REALM match the installer defaults (rossoctl realm)
# and are included because kubectl apply replaces the entire ConfigMap.
# TOKEN_URL and ISSUER are auto-derived from KEYCLOAK_URL + KEYCLOAK_REALM.
apiVersion: v1
kind: ConfigMap
metadata:
  name: authbridge-config
  namespace: team1
data:
  KEYCLOAK_URL: "http://keycloak-service.keycloak.svc:8080"
  KEYCLOAK_REALM: "rossoctl"
  # TOKEN_URL: Auto-derived from KEYCLOAK_URL + KEYCLOAK_REALM. Only set explicitly
  # when the token endpoint differs from the standard Keycloak path.
  # TOKEN_URL: "http://keycloak-service.keycloak.svc:8080/realms/rossoctl/protocol/openid-connect/token"
  # ISSUER: Set explicitly because the internal KEYCLOAK_URL differs from the frontend URL.
  ISSUER: "http://keycloak.localtest.me:8080/realms/rossoctl"
  # Audience validation is automatic — uses CLIENT_ID from /shared/client-id.txt
  # (written by client-registration or operator). No manual configuration needed.

---
# authproxy-routes ConfigMap - Per-target token exchange routes
#
# Defines which outbound hosts should get token exchange. All other hosts
# pass through unchanged (the default outbound policy is "passthrough").
# This allows the agent to call LLM APIs, telemetry endpoints, and other
# services without interference from the token exchange proxy.
#
# Update the host pattern if the github-tool service name or namespace changes.
apiVersion: v1
kind: ConfigMap
metadata:
  name: authproxy-routes
  namespace: team1
data:
  routes.yaml: |
    - host: "github-tool-mcp"
      target_audience: "github-tool"
      token_scopes: "openid github-tool-aud github-full-access"