fix(auth): enforce management API JWT audience

[jsell-rh]

Summary

• upgrade the API server to the rh-trex-ai issuer/audience validation merged in fix(auth): validate JWT issuer and audience rh-trex-ai#52 and the fail-closed verification hardening merged in fix(auth): fail closed without JWT verification keys rh-trex-ai#53
• require the configured Keycloak issuer and the hypershell-frontend management API audience in Kind and OpenShift deployments
• document that aud identifies the resource while azp identifies the calling client, so hsctl, frontend, and control-plane clients can share the management API audience
• reject dynamic gateway-client tokens that are not minted for the management API

Security hardening

The pinned rh-trex-ai commit rejects JWTs unless cryptographic verification marked them valid and makes gRPC authentication fail closed when no JWK provider is available.

Testing

• GOTOOLCHAIN=auto go test ./pkg/... ./cmd/...
• GOTOOLCHAIN=auto go test -race ./pkg/... ./cmd/...
• GOTOOLCHAIN=auto go build ./cmd/hypershell
• make check
• make lint-api-server
• go mod verify
• kustomize build deploy/kind
• kustomize build deploy/openshift

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: ec9b9c62-48c2-4be0-9501-4b33e279f057

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}