feat(plugins): Add keycloak_url + keycloak_realm to jwt-validation for internal JWKS derivation

[huang195]

Summary

Per-plugin cutover (PR #378) silently dropped the cross-plugin derivation that let inbound.jwks_url be derived from outbound.keycloak_url + keycloak_realm. Without that, jwt-validation falls back to deriving jwks_url from issuer — which in split-horizon deployments is the public URL (required to match the iss claim bit-for-bit) and typically isn't reachable from inside the sidecar pod. Result: every inbound JWT validation hits connection refused fetching the JWKS → 401.

Observed failure in rossoctl/rossoctl#1507 CI, weather-tool-advanced envoy-proxy stderr:

msg="JWT validation failed" error="fetching JWKS:
  Get \"http://keycloak.localtest.me:8080/realms/kagenti/protocol/openid-connect/certs\":
  dial tcp [::1]:8080: connect: connection refused"

This restores feature parity with pre-#378 semantics by giving jwt-validation its own keycloak_url + keycloak_realm fields — symmetric with token-exchange, which already has them.

Changes

• authlib/plugins/jwtvalidation.go: two new config fields, updated applyDefaults() derivation priority:
  1. Explicit jwks_url wins
  2. keycloak_url + keycloak_realm → internal URL
  3. issuer → fallback (single-horizon; existing behavior)
• authlib/plugins/plugins_test.go: tightened existing DefaultsJWKSFromIssuer to assert exact URL; added DerivesJWKSFromInternalKeycloakURL, ExplicitJWKSURLWins, PartialKeycloakConfigFallsThroughToIssuer.
• authproxy/authbridge-combined.yaml (image default): pass KEYCLOAK_URL / KEYCLOAK_REALM into inbound jwt-validation as well as outbound. Block comment explains split-horizon expectation.

Pipeline config change

Before (chart/operator had to hand-roll the full URL):

pipeline:
  inbound:
    plugins:
    - name: jwt-validation
      config:
        issuer: "http://keycloak.public:8080/realms/kagenti"
        jwks_url: "http://keycloak-service.keycloak.svc:8080/realms/kagenti/protocol/openid-connect/certs"

After:

pipeline:
  inbound:
    plugins:
    - name: jwt-validation
      config:
        issuer: "http://keycloak.public:8080/realms/kagenti"
        keycloak_url: "http://keycloak-service.keycloak.svc:8080"
        keycloak_realm: kagenti

Both plugins now take the same shape for "where is Keycloak internally."

Backward compatibility

Purely additive:

• Configs with only issuer still work (single-horizon).
• Configs with explicit jwks_url still win (custom JWKS proxies).
• Plugin configs remain isolated — the new fields decode independently from token-exchange's copies.

Follow-ups

• kagenti-operator: update synthesizePipeline to pass keycloak_url + keycloak_realm through to jwt-validation (already in NamespaceConfig). New alpha tag.
• kagenti chart (kagenti#1507): drop the temporary explicit jwks_url workaround once both new pins are available.

Test plan

• go test ./... in authlib/ — all green, including 3 new tests
• go test ./... in cmd/authbridge/ — all green
• kagenti-operator PR ingests new extensions tag → synthesizePipeline emits new fields
• kagenti chart PR #1507 re-run with new extensions + operator pins → advanced E2E passes

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com

[pdettori]

Clean, focused PR that restores split-horizon JWKS derivation lost during the per-plugin cutover in PR #378.

The three-tier priority logic in applyDefaults() is correct and well-tested (4 tests covering all paths including partial-config fallthrough). YAML template aligns with the Go struct fields.

Areas reviewed: Go, Tests, YAML, Security
Commits: 1 commit, signed-off ✓
CI: all passing (17/17 checks green)

No blocking issues found.