# Owner-review candidate only. Not a kubectl resource and not activated.
# Cluster owner must merge with existing authenticators, validate natively and
# preserve existing admin/service-account authentication and rollback access.
apiVersion: apiserver.config.k8s.io/v1
kind: AuthenticationConfiguration
jwt:
  - issuer:
      url: https://kc.coulomb.social
      audiences:
        - playwright-kubernetes
      audienceMatchPolicy: MatchAny
    claimValidationRules:
      - expression: "claims.aud == 'playwright-kubernetes' || claims.aud == ['playwright-kubernetes']"
        message: dedicated Playwright audience required
      - expression: "has(claims.scope) && 'playwright:connect' in claims.scope.split(' ')"
        message: Playwright access scope required
      - expression: "claims.principal_type == 'human' || (claims.principal_type == 'service' && has(claims.roles) && 'coding-agent' in claims.roles)"
        message: identified human or registered coding agent required
      - expression: "claims.sub != '' && claims.exp > claims.iat && claims.exp - claims.iat <= 3600"
        message: nonempty subject and bounded token lifetime required
    claimMappings:
      username:
        expression: "'keycape:' + claims.principal_type + ':' + claims.sub"
      groups:
        expression: "['playwright-consumers']"
    userValidationRules:
      - expression: "!user.username.startsWith('system:')"
        message: reserved Kubernetes identity prefix refused
      - expression: "user.groups == ['playwright-consumers']"
        message: only the Playwright consumer group may be mapped