kaos-cli 0.7.7__tar.gz → 0.8.1__tar.gz

{kaos_cli-0.7.7 → kaos_cli-0.8.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kaos-cli
-Version: 0.7.7
+Version: 0.8.1
 Summary: CLI for KAOS (K8s Agent Orchestration System)
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown

{kaos_cli-0.7.7 → kaos_cli-0.8.1}/kaos_cli/__init__.py

@@ -5,4 +5,4 @@ try:
 
     __version__ = version("kaos-cli")
 except Exception:
-    __version__ = "0.7.5.dev0"
+    __version__ = "0.8.1.dev0"

{kaos_cli-0.7.7 → kaos_cli-0.8.1}/kaos_cli/install/__init__.py

@@ -38,6 +38,9 @@ DEFAULT_CREDENTIAL_SECRET_PREFIX = "kaos-aib"
 AUTH_ENDUSER_PORT = 8000
 AUTH_ADMIN_PORT = 14000
 AUTH_EXTPROC_PORT = 50051
+DEFAULT_AIB_EXTPROC_IMAGE = (
+    "ghcr.io/zalando-incubator/agentic-identity-broker-extproc:v0.1.8"
+)
 
 
 # Independent agent and user identity modes selected by the install flags.
@@ -121,8 +124,8 @@ from .auth import (
     _build_aib_broker_public_url_args, _build_auth_operator_args,
     _build_token_exchange_aib_args, _default_auth_admin_url,
     _default_auth_issuer, _default_user_auth_issuer, _install_aib,
-    _install_keycloak, _keycloak_dev_manifests, _keycloak_realm_configmap_name,
-    _keycloak_realm_json,
+    _install_aib_extproc, _install_keycloak, _keycloak_dev_manifests,
+    _keycloak_realm_configmap_name, _keycloak_realm_json,
 )
 
 
@@ -248,8 +251,23 @@ def install_command(
                 keycloak_namespace, keycloak_release
             )
 
-        # Install the identity broker from a local chart when provided (it is
-        # unpublished, so a chart path is required to install it here).
+        # In exchange mode the public broker and extProc both contact Keycloak
+        # during startup, so apply Keycloak first.
+        if token_exchange_enabled:
+            if not _install_keycloak(
+                keycloak_namespace,
+                keycloak_release,
+                DEFAULT_USER_AUTH_REALM,
+                user_auth_audience,
+                keycloak_chart_path,
+                wait,
+                token_exchange_enabled,
+            ):
+                typer.echo(
+                    "Warning: Keycloak installation failed, continuing...", err=True
+                )
+
+        # Install the broker from the public chart checkout when provided.
         if (identity_provider == "aib" or token_exchange_enabled) and aib_chart_path:
             if token_exchange_enabled:
                 keycloak_issuer = user_auth_issuer or _default_user_auth_issuer(
@@ -269,6 +287,7 @@ def install_command(
                 aib_values_path,
                 wait,
                 extra_set=aib_extra_set,
+                seed_identity_bootstrap=identity_provider == "aib",
             ):
                 typer.echo(
                     "Warning: identity broker installation failed, continuing...",
@@ -285,7 +304,7 @@ def install_command(
 
         # Keycloak backs the user plane and the OIDC DCR agent mode. Install it
         # when either plane selects it.
-        if user_auth or identity_provider == "oidc":
+        if (user_auth or identity_provider == "oidc") and not token_exchange_enabled:
             if not _install_keycloak(
                 keycloak_namespace,
                 keycloak_release,
@@ -299,6 +318,17 @@ def install_command(
                     "Warning: Keycloak installation failed, continuing...", err=True
                 )
 
+        if token_exchange_enabled and not _install_aib_extproc(
+            auth_namespace,
+            auth_release,
+            user_auth_issuer
+            or _default_user_auth_issuer(keycloak_namespace, keycloak_release),
+            wait,
+        ):
+            typer.echo(
+                "Warning: AIB extProc installation failed, continuing...", err=True
+            )
+
     # Phase 2: Wait for infra that the operator depends on
     if gateway_enabled:
         _wait_for_gateway_class()
@@ -432,6 +462,11 @@ def install_command(
                 policy_rego_override=policy_rego_override,
                 policy_configmap_name=policy_configmap_name or "",
                 policy_configmap_namespace=policy_configmap_namespace or "",
+                default_permission_set=(
+                    "kaos-identity"
+                    if identity_provider == "aib" and aib_chart_path
+                    else ""
+                ),
             )
         )
         if token_exchange_enabled:

{kaos_cli-0.7.7 → kaos_cli-0.8.1}/kaos_cli/install/auth.py

@@ -1,11 +1,16 @@
 """Authentication provider installation and Helm argument helpers."""
 
 import json
+from urllib.parse import urlsplit
 
+import httpx
 import typer
 
+from kaos_cli.cluster_http import local_service_url
+
 from . import (
-    AUTH_ADMIN_PORT, AUTH_ENDUSER_PORT, DEFAULT_AGENT_AUTH_AUDIENCE,
+    AUTH_ADMIN_PORT, AUTH_ENDUSER_PORT, AUTH_EXTPROC_PORT,
+    DEFAULT_AGENT_AUTH_AUDIENCE, DEFAULT_AIB_EXTPROC_IMAGE,
     DEFAULT_KEYCLOAK_ADMIN_PASSWORD, DEFAULT_KEYCLOAK_ADMIN_USER,
     DEFAULT_KEYCLOAK_IMAGE, DEFAULT_OIDC_REGISTRATION_SECRET_KEY,
     DEFAULT_OIDC_REGISTRATION_SECRET_NAME, DEFAULT_TOKEN_EXCHANGE_AUDIENCE,
@@ -64,6 +69,7 @@ def _build_auth_operator_args(
     policy_rego_override: bool = False,
     policy_configmap_name: str = "",
     policy_configmap_namespace: str = "",
+    default_permission_set: str = "",
 ) -> list[str]:
     """Build the operator Helm --set arguments that enable agent-auth wiring.
 
@@ -101,6 +107,14 @@ def _build_auth_operator_args(
         )
     if identity_provider == "aib" and admin_url:
         args.extend(["--set", f"security.agentAuth.adminUrl={admin_url}"])
+        if default_permission_set:
+            args.extend(
+                [
+                    "--set",
+                    "security.agentAuth.defaultPermissionSet="
+                    f"{default_permission_set}",
+                ]
+            )
     if identity_provider == "oidc" and oidc_registration_secret_name:
         args.extend(
             [
@@ -179,8 +193,9 @@ def _install_aib(
     values_path: str | None,
     wait: bool,
     extra_set: list[str] | None = None,
+    seed_identity_bootstrap: bool = True,
 ) -> bool:
-    """Install the identity broker from a local chart (unpublished/dev path)."""
+    """Install the public identity-broker chart from a local v0.1.8 checkout."""
     typer.echo("Installing identity broker...")
     helm_args = [
         "upgrade",
@@ -203,9 +218,111 @@ def _install_aib(
         typer.echo(f"Error installing identity broker: {result.stderr}", err=True)
         return False
 
+    if seed_identity_bootstrap and not _seed_aib_identity_bootstrap(
+        namespace, release
+    ):
+        return False
+
     typer.echo(f"✅ Identity broker installed in '{namespace}' namespace")
     return True
 
+
+AIB_BOOTSTRAP_SERVICE = "kaos-identity-placeholder"
+AIB_BOOTSTRAP_PERMISSION_SET = "kaos-identity"
+AIB_BOOTSTRAP_DESCRIPTION = (
+    "KAOS identity-only bootstrap; remove once AIB allows agents without permission sets"
+)
+
+
+def _items(response: httpx.Response) -> list[dict]:
+    response.raise_for_status()
+    payload = response.json()
+    return payload if isinstance(payload, list) else payload.get("items", [])
+
+
+def _seed_aib_identity_bootstrap(namespace: str, release: str) -> bool:
+    """Idempotently seed the public AIB permission-set registration bridge."""
+    rollout = _root()._run_kubectl(
+        [
+            "rollout",
+            "status",
+            f"deployment/{_auth_broker_fullname(release)}",
+            "-n",
+            namespace,
+            "--timeout=120s",
+        ],
+        check=False,
+    )
+    if rollout.returncode != 0:
+        typer.echo(f"Error waiting for identity broker: {rollout.stderr}", err=True)
+        return False
+
+    admin_url = _default_auth_admin_url(namespace, release)
+    headers = {
+        "Host": urlsplit(admin_url).netloc,
+        "X-Remote-User": "kaos-operator",
+    }
+    try:
+        with local_service_url(admin_url) as local_url:
+            base = local_url.rstrip("/")
+            with httpx.Client(headers=headers, timeout=30.0) as client:
+                services = _items(client.get(f"{base}/services"))
+                service = next(
+                    (
+                        item
+                        for item in services
+                        if item.get("canonical_id") == AIB_BOOTSTRAP_SERVICE
+                        or item.get("display_name") == AIB_BOOTSTRAP_SERVICE
+                    ),
+                    None,
+                )
+                if service is None:
+                    response = client.post(
+                        f"{base}/services",
+                        json={
+                            "canonical_id": AIB_BOOTSTRAP_SERVICE,
+                            # AIB services have no description field, so the
+                            # descriptive marker lives in display_name.
+                            "display_name": AIB_BOOTSTRAP_DESCRIPTION,
+                            "client_id": AIB_BOOTSTRAP_SERVICE,
+                            "token_endpoint_auth_method": "none",
+                            "issuer_uri": "https://kaos-identity-placeholder.invalid",
+                            "discovery": {"enable_discovery": False},
+                            "endpoints": {
+                                "authorize_endpoint": "https://kaos-identity-placeholder.invalid/oauth2/authorize",
+                                "token_endpoint": "https://kaos-identity-placeholder.invalid/oauth2/token",
+                            },
+                            "scopes": [],
+                        },
+                    )
+                    response.raise_for_status()
+                    service = response.json()
+
+                permission_sets = _items(client.get(f"{base}/permission-sets"))
+                if not any(
+                    item.get("name") == AIB_BOOTSTRAP_PERMISSION_SET
+                    for item in permission_sets
+                ):
+                    response = client.post(
+                        f"{base}/permission-sets",
+                        json={
+                            "canonical_id": AIB_BOOTSTRAP_PERMISSION_SET,
+                            "name": AIB_BOOTSTRAP_PERMISSION_SET,
+                            "description": AIB_BOOTSTRAP_DESCRIPTION,
+                            "service_scopes": [
+                                {"service_id": service["id"], "scopes": []}
+                            ],
+                        },
+                    )
+                    response.raise_for_status()
+    except (httpx.HTTPError, KeyError, RuntimeError, ValueError) as exc:
+        typer.echo(f"Error seeding identity broker: {exc}", err=True)
+        return False
+
+    typer.echo("✅ Seeded AIB permission set 'kaos-identity'")
+    return True
+
+
 def _build_aib_broker_public_url_args(public_url: str) -> list[str]:
     """Set the broker enduser ``public_url`` to its in-cluster service URL.
 
@@ -219,25 +336,17 @@ def _build_aib_broker_public_url_args(public_url: str) -> list[str]:
     """
     return ["--set", f"broker.server.enduser.publicUrl={public_url}"]
 
+
 def _build_token_exchange_aib_args(
     auth_namespace: str,
     auth_release: str,
     keycloak_issuer: str,
 ) -> list[str]:
-    """Configure the self-managed AIB release for Keycloak-backed exchange."""
+    """Configure public AIB v0.1.8 for Keycloak-backed token exchange."""
     aib_issuer = _default_auth_issuer(auth_namespace, auth_release)
     keycloak_token_endpoint = f"{keycloak_issuer}/protocol/openid-connect/token"
     keycloak_authorize_endpoint = f"{keycloak_issuer}/protocol/openid-connect/auth"
-    extra_env = [
-        {"name": "EXTPROC_OAUTH2_ISSUER", "value": keycloak_issuer},
-        {"name": "EXTPROC_OAUTH2_CLIENT_ID", "value": DEFAULT_USER_AUTH_CLIENT_ID},
-        {
-            "name": "EXTPROC_OAUTH2_CLIENT_SECRET",
-            "value": DEFAULT_USER_AUTH_CLIENT_SECRET,
-        },
-        {"name": "EXTPROC_OAUTH2_CLIENT_ASSERTION_TYPE", "value": "access_token"},
-    ]
-    return [
+    args = [
         "--set",
         f"broker.server.enduser.publicUrl={aib_issuer}",
         "--set",
@@ -248,7 +357,8 @@ def _build_token_exchange_aib_args(
         "broker.oauth2AuthorizationServer.proxy.upstreamAuthorizeEndpoint="
         f"{keycloak_authorize_endpoint}",
         "--set",
-        f"broker.oauth2AuthorizationServer.proxy.upstreamTokenEndpoint={keycloak_token_endpoint}",
+        "broker.oauth2AuthorizationServer.proxy.upstreamTokenEndpoint="
+        f"{keycloak_token_endpoint}",
         "--set",
         f"broker.tokenExchange.expectedAudience={DEFAULT_TOKEN_EXCHANGE_AUDIENCE}",
         "--set",
@@ -261,13 +371,153 @@ def _build_token_exchange_aib_args(
         "--set",
         "broker.tokenExchange.authorization.cel.expression="
         f'client_assertion.azp == "{DEFAULT_USER_AUTH_CLIENT_ID}"',
-        "--set",
-        "extProc.enabled=true",
-        "--set",
-        f"extProc.oauth2.clientCredentialsEndpoint={keycloak_token_endpoint}",
-        "--set-json",
-        f"extProc.extraEnv={json.dumps(extra_env, separators=(',', ':'))}",
     ]
+    if keycloak_issuer.startswith("http://"):
+        args.extend(
+            ["--set", "broker.security.skipThirdpartyHttpsValidation=true"]
+        )
+    return args
+
+
+def _auth_extproc_name(auth_release: str) -> str:
+    return f"{auth_release}-agentic-identity-broker-extproc"
+
+
+def _aib_extproc_manifests(
+    namespace: str, release: str, keycloak_issuer: str
+) -> list[dict]:
+    """Build the public extProc workload using its v0.1.8 env contract."""
+    name = _auth_extproc_name(release)
+    labels = {"app.kubernetes.io/name": name}
+    secret_name = f"{name}-credentials"
+    token_endpoint = f"{_default_auth_issuer(namespace, release)}/oauth2/token"
+    client_credentials_endpoint = (
+        f"{keycloak_issuer}/protocol/openid-connect/token"
+    )
+    secret = {
+        "apiVersion": "v1",
+        "kind": "Secret",
+        "metadata": {"name": secret_name, "namespace": namespace},
+        "type": "Opaque",
+        "stringData": {"client-secret": DEFAULT_USER_AUTH_CLIENT_SECRET},
+    }
+    deployment = {
+        "apiVersion": "apps/v1",
+        "kind": "Deployment",
+        "metadata": {"name": name, "namespace": namespace, "labels": labels},
+        "spec": {
+            "replicas": 1,
+            "selector": {"matchLabels": labels},
+            "template": {
+                "metadata": {"labels": labels},
+                "spec": {
+                    "containers": [
+                        {
+                            "name": "extproc",
+                            "image": DEFAULT_AIB_EXTPROC_IMAGE,
+                            "imagePullPolicy": "IfNotPresent",
+                            "ports": [
+                                {"name": "grpc", "containerPort": AUTH_EXTPROC_PORT}
+                            ],
+                            "env": [
+                                {
+                                    "name": "EXTPROC_OAUTH2_TOKEN_ENDPOINT",
+                                    "value": token_endpoint,
+                                },
+                                {
+                                    "name": "EXTPROC_OAUTH2_ISSUER",
+                                    "value": keycloak_issuer,
+                                },
+                                {
+                                    "name": "EXTPROC_OAUTH2_CLIENT_ID",
+                                    "value": DEFAULT_USER_AUTH_CLIENT_ID,
+                                },
+                                {
+                                    "name": "EXTPROC_OAUTH2_CLIENT_SECRET",
+                                    "valueFrom": {
+                                        "secretKeyRef": {
+                                            "name": secret_name,
+                                            "key": "client-secret",
+                                        }
+                                    },
+                                },
+                                {
+                                    "name": (
+                                        "EXTPROC_OAUTH2_CLIENT_CREDENTIALS_ENDPOINT"
+                                    ),
+                                    "value": client_credentials_endpoint,
+                                },
+                                {
+                                    "name": "EXTPROC_OAUTH2_CLIENT_ASSERTION_TYPE",
+                                    "value": "access_token",
+                                },
+                                {
+                                    "name": "EXTPROC_OAUTH2_TLS_ALLOW_HTTP",
+                                    "value": "true",
+                                },
+                                {
+                                    "name": "EXTPROC_GRPC_PORT",
+                                    "value": str(AUTH_EXTPROC_PORT),
+                                },
+                            ],
+                            "readinessProbe": {
+                                "tcpSocket": {"port": "grpc"},
+                                "periodSeconds": 2,
+                            },
+                        }
+                    ]
+                },
+            },
+        },
+    }
+    service = {
+        "apiVersion": "v1",
+        "kind": "Service",
+        "metadata": {"name": name, "namespace": namespace, "labels": labels},
+        "spec": {
+            "selector": labels,
+            "ports": [
+                {
+                    "name": "grpc",
+                    "port": AUTH_EXTPROC_PORT,
+                    "targetPort": "grpc",
+                }
+            ],
+        },
+    }
+    return [secret, deployment, service]
+
+
+def _install_aib_extproc(
+    namespace: str, release: str, keycloak_issuer: str, wait: bool
+) -> bool:
+    """Apply KAOS-owned extProc resources for the public AIB release."""
+    typer.echo("Installing AIB token-exchange extProc...")
+    for manifest in _aib_extproc_manifests(namespace, release, keycloak_issuer):
+        result = _root()._run_kubectl(
+            ["apply", "-f", "-"], check=False, input=json.dumps(manifest)
+        )
+        if result.returncode != 0:
+            typer.echo(f"Error installing AIB extProc: {result.stderr}", err=True)
+            return False
+    if wait:
+        result = _root()._run_kubectl(
+            [
+                "rollout",
+                "status",
+                f"deployment/{_auth_extproc_name(release)}",
+                "-n",
+                namespace,
+                "--timeout=120s",
+            ],
+            check=False,
+        )
+        if result.returncode != 0:
+            typer.echo(f"Error waiting for AIB extProc: {result.stderr}", err=True)
+            return False
+    typer.echo(f"✅ AIB extProc installed in '{namespace}' namespace")
+    return True
+
 
 def _keycloak_realm_json(
     realm: str,
@@ -276,6 +526,7 @@ def _keycloak_realm_json(
     audience: str,
     username: str,
     password: str,
+    token_exchange_enabled: bool = False,
 ) -> dict:
     """Build a minimal Keycloak realm definition for non-interactive validation.
 
@@ -285,6 +536,32 @@ def _keycloak_realm_json(
     and group-based AccessGrants require.
     """
 
+    agent_audience_mappers = [
+        {
+            "name": "kaos-agent-audience",
+            "protocol": "openid-connect",
+            "protocolMapper": "oidc-audience-mapper",
+            "config": {
+                "included.custom.audience": DEFAULT_AGENT_AUTH_AUDIENCE,
+                "id.token.claim": "false",
+                "access.token.claim": "true",
+            },
+        }
+    ]
+    if token_exchange_enabled:
+        agent_audience_mappers.append(
+            {
+                "name": "token-exchange-audience",
+                "protocol": "openid-connect",
+                "protocolMapper": "oidc-audience-mapper",
+                "config": {
+                    "included.custom.audience": DEFAULT_TOKEN_EXCHANGE_AUDIENCE,
+                    "id.token.claim": "false",
+                    "access.token.claim": "true",
+                },
+            }
+        )
+
     return {
         "realm": realm,
         "enabled": True,
@@ -293,18 +570,7 @@ def _keycloak_realm_json(
                 "name": "kaos-agent-audience",
                 "protocol": "openid-connect",
                 "attributes": {"include.in.token.scope": "false"},
-                "protocolMappers": [
-                    {
-                        "name": "kaos-agent-audience",
-                        "protocol": "openid-connect",
-                        "protocolMapper": "oidc-audience-mapper",
-                        "config": {
-                            "included.custom.audience": DEFAULT_AGENT_AUTH_AUDIENCE,
-                            "id.token.claim": "false",
-                            "access.token.claim": "true",
-                        },
-                    }
-                ],
+                "protocolMappers": agent_audience_mappers,
             }
         ],
         "defaultDefaultClientScopes": ["kaos-agent-audience"],
@@ -385,15 +651,18 @@ def _keycloak_realm_json(
         ],
     }
 
+
 def _keycloak_realm_configmap_name(release: str) -> str:
     """Name of the ConfigMap holding the imported realm definition."""
     return f"{release}-realm-import"
 
+
 def _bootstrap_keycloak_realm(
     namespace: str,
     release: str,
     realm: str,
     audience: str,
+    token_exchange_enabled: bool = False,
 ) -> bool:
     """Create the realm-import ConfigMap consumed by Keycloak's --import-realm.
 
@@ -409,6 +678,7 @@ def _bootstrap_keycloak_realm(
             audience,
             DEFAULT_USER_AUTH_TEST_USER,
             DEFAULT_USER_AUTH_TEST_PASSWORD,
+            token_exchange_enabled,
         ),
         indent=2,
     )
@@ -521,6 +791,7 @@ def _keycloak_dev_manifests(
     }
     return [deployment, service]
 
+
 def _install_keycloak(
     namespace: str,
     release: str,
@@ -537,7 +808,9 @@ def _install_keycloak(
     dev path); otherwise a self-contained dev deployment is applied via kubectl.
     """
     typer.echo("Installing user identity provider (Keycloak)...")
-    if not _bootstrap_keycloak_realm(namespace, release, realm, audience):
+    if not _bootstrap_keycloak_realm(
+        namespace, release, realm, audience, token_exchange_enabled
+    ):
         return False
 
     if chart_path:

{kaos_cli-0.7.7 → kaos_cli-0.8.1}/kaos_cli/install/infra.py

@@ -90,6 +90,32 @@ def _install_gateway_api(enable_backend: bool = False) -> bool:
         typer.echo(f"Error installing Envoy Gateway: {result.stderr}", err=True)
         return False
 
+    if enable_backend:
+        for args in (
+            [
+                "rollout",
+                "restart",
+                "deployment/envoy-gateway",
+                "-n",
+                "envoy-gateway-system",
+            ],
+            [
+                "rollout",
+                "status",
+                "deployment/envoy-gateway",
+                "-n",
+                "envoy-gateway-system",
+                "--timeout=180s",
+            ],
+        ):
+            rollout = _root()._run_kubectl(args, check=False)
+            if rollout.returncode != 0:
+                typer.echo(
+                    f"Error reloading Envoy Gateway Backend support: {rollout.stderr}",
+                    err=True,
+                )
+                return False
+
     typer.echo("✅ Envoy Gateway installed")
     return True
 

{kaos_cli-0.7.7 → kaos_cli-0.8.1}/kaos_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kaos-cli
-Version: 0.7.7
+Version: 0.8.1
 Summary: CLI for KAOS (K8s Agent Orchestration System)
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown

{kaos_cli-0.7.7 → kaos_cli-0.8.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "kaos-cli"
-version = "0.7.7"
+version = "0.8.1"
 description = "CLI for KAOS (K8s Agent Orchestration System)"
 readme = "README.md"
 requires-python = ">=3.12"

{kaos_cli-0.7.7 → kaos_cli-0.8.1}/tests/test_cli_integration.py

@@ -1,5 +1,6 @@
 """CLI integration tests using --dry-run to validate YAML generation."""
 
+import json
 import re
 import yaml
 import pytest
@@ -1137,16 +1138,40 @@ def test_token_exchange_gateway_install_enables_backend_api():
     from kaos_cli.install import _install_gateway_api
 
     calls = []
+    kubectl_calls = []
 
     def fake_helm(args, check=False):
         calls.append(args)
         return SimpleNamespace(returncode=0, stdout="", stderr="")
 
-    with patch("kaos_cli.install.run_helm_command", side_effect=fake_helm):
+    def fake_kubectl(args, check=False, input=None):
+        kubectl_calls.append(args)
+        return SimpleNamespace(returncode=0, stdout="", stderr="")
+
+    with patch("kaos_cli.install.run_helm_command", side_effect=fake_helm), patch(
+        "kaos_cli.install._run_kubectl", side_effect=fake_kubectl
+    ):
         assert _install_gateway_api(enable_backend=True)
 
     install_args = calls[-1]
     assert "config.envoyGateway.extensionApis.enableBackend=true" in install_args
+    assert kubectl_calls[-2:] == [
+        [
+            "rollout",
+            "restart",
+            "deployment/envoy-gateway",
+            "-n",
+            "envoy-gateway-system",
+        ],
+        [
+            "rollout",
+            "status",
+            "deployment/envoy-gateway",
+            "-n",
+            "envoy-gateway-system",
+            "--timeout=180s",
+        ],
+    ]
 
 
 class TestAuthWiring:
@@ -1183,6 +1208,105 @@ class TestAuthWiring:
         # Each value is preceded by a --set flag.
         assert args.count("--set") == 4
 
+    def test_seed_aib_identity_bootstrap(self):
+        from contextlib import nullcontext
+        from types import SimpleNamespace
+        from unittest.mock import MagicMock, patch
+
+        from kaos_cli.install.auth import _seed_aib_identity_bootstrap
+
+        empty = MagicMock()
+        empty.json.side_effect = [[], {"items": []}]
+        created_service = MagicMock()
+        created_service.json.return_value = {"id": "service-1"}
+        created_permission_set = MagicMock()
+        created_permission_set.json.return_value = {"id": "permission-set-1"}
+        client = MagicMock()
+        client.__enter__.return_value = client
+        client.get.side_effect = [empty, empty]
+        client.post.side_effect = [created_service, created_permission_set]
+        root = SimpleNamespace(
+            _run_kubectl=lambda *args, **kwargs: SimpleNamespace(
+                returncode=0, stdout="", stderr=""
+            )
+        )
+
+        with patch("kaos_cli.install.auth._root", return_value=root), patch(
+            "kaos_cli.install.auth.local_service_url",
+            return_value=nullcontext("http://127.0.0.1:14000/api"),
+        ), patch("kaos_cli.install.auth.httpx.Client", return_value=client):
+            assert _seed_aib_identity_bootstrap("aib-system", "aib") is True
+
+        service_body = client.post.call_args_list[0].kwargs["json"]
+        assert service_body["canonical_id"] == "kaos-identity-placeholder"
+        assert service_body["display_name"].startswith("KAOS identity-only bootstrap")
+        permission_body = client.post.call_args_list[1].kwargs["json"]
+        assert permission_body["name"] == "kaos-identity"
+        assert permission_body["service_scopes"] == [
+            {"service_id": "service-1", "scopes": []}
+        ]
+
+    def test_aib_extproc_manifest_uses_public_v018_contract(self):
+        from kaos_cli.install.auth import _aib_extproc_manifests
+
+        secret, deployment, service = _aib_extproc_manifests(
+            "aib-system",
+            "aib",
+            "http://keycloak.keycloak.svc.cluster.local:8080/realms/kaos",
+        )
+
+        assert secret["kind"] == "Secret"
+        container = deployment["spec"]["template"]["spec"]["containers"][0]
+        assert container["image"].endswith(
+            "agentic-identity-broker-extproc:v0.1.8"
+        )
+        env = {item["name"]: item for item in container["env"]}
+        assert env["EXTPROC_OAUTH2_TOKEN_ENDPOINT"]["value"] == (
+            "http://aib-agentic-identity-broker.aib-system.svc.cluster.local:8000"
+            "/oauth2/token"
+        )
+        assert env["EXTPROC_OAUTH2_CLIENT_CREDENTIALS_ENDPOINT"]["value"].endswith(
+            "/realms/kaos/protocol/openid-connect/token"
+        )
+        assert env["EXTPROC_OAUTH2_CLIENT_ASSERTION_TYPE"]["value"] == "access_token"
+        assert env["EXTPROC_OAUTH2_TLS_ALLOW_HTTP"]["value"] == "true"
+        assert "valueFrom" in env["EXTPROC_OAUTH2_CLIENT_SECRET"]
+        assert service["metadata"]["name"] == (
+            "aib-agentic-identity-broker-extproc"
+        )
+        assert service["spec"]["ports"][0]["port"] == 50051
+
+    def test_install_aib_extproc_applies_and_waits(self):
+        from types import SimpleNamespace
+        from unittest.mock import patch
+
+        from kaos_cli.install.auth import _install_aib_extproc
+
+        calls = []
+
+        def fake_kubectl(args, check=False, input=None):
+            calls.append((args, input))
+            return SimpleNamespace(returncode=0, stdout="", stderr="")
+
+        with patch("kaos_cli.install._run_kubectl", side_effect=fake_kubectl):
+            assert _install_aib_extproc(
+                "aib-system",
+                "aib",
+                "http://keycloak:8080/realms/kaos",
+                wait=True,
+            )
+
+        assert [json.loads(body)["kind"] for _, body in calls[:3]] == [
+            "Secret",
+            "Deployment",
+            "Service",
+        ]
+        assert calls[3][0][:3] == [
+            "rollout",
+            "status",
+            "deployment/aib-agentic-identity-broker-extproc",
+        ]
+
     def test_install_uses_one_aib_issuer_for_broker_and_operator(self):
         from types import SimpleNamespace
         from unittest.mock import patch
@@ -1644,6 +1768,24 @@ class TestAuthWiring:
             "--features=token-exchange,admin-fine-grained-authz",
         ]
 
+    def test_keycloak_te_realm_adds_exchange_audience_to_dynamic_clients(self):
+        from kaos_cli.install.auth import _keycloak_realm_json
+
+        realm = _keycloak_realm_json(
+            "kaos",
+            "kaos",
+            "secret",
+            "kaos",
+            "user",
+            "password",
+            token_exchange_enabled=True,
+        )
+        audiences = {
+            mapper["config"]["included.custom.audience"]
+            for mapper in realm["clientScopes"][0]["protocolMappers"]
+        }
+        assert audiences == {"kaos-gateway", "token-exchange-broker"}
+
     def test_auth_enabled_wires_user_auth_values(self):
         """aib-keycloak (user-auth on) adds security.userAuth.* args."""
         from unittest.mock import patch
@@ -1934,6 +2076,7 @@ class TestAuthWiring:
                     "security.agentAuth.issuer=http://aib-agentic-identity-broker.aib-system.svc.cluster.local:8000",
                     "security.agentAuth.credentialSecretPrefix=kaos-aib",
                     "security.agentAuth.adminUrl=http://aib-agentic-identity-broker.aib-system.svc.cluster.local:14000/api",
+                    "security.agentAuth.defaultPermissionSet=kaos-identity",
                     "security.agentAuth.authorization.policyDataSource=automated",
                     "security.agentAuth.projection.policyConfigMap.name=kaos-authz-policy",
                     "security.agentAuth.projection.policyConfigMap.namespace=kaos-system",
@@ -1954,6 +2097,7 @@ class TestAuthWiring:
                     "security.agentAuth.issuer=http://aib-agentic-identity-broker.aib-system.svc.cluster.local:8000",
                     "security.agentAuth.credentialSecretPrefix=kaos-aib",
                     "security.agentAuth.adminUrl=http://aib-agentic-identity-broker.aib-system.svc.cluster.local:14000/api",
+                    "security.agentAuth.defaultPermissionSet=kaos-identity",
                     "security.agentAuth.authorization.policyDataSource=automated",
                     "security.agentAuth.projection.policyConfigMap.name=kaos-authz-policy",
                     "security.agentAuth.projection.policyConfigMap.namespace=kaos-system",
@@ -2142,7 +2286,7 @@ class TestAuthWiring:
         assert result.exit_code != 0
         assert "No such option: --auth-enabled" in strip_ansi(result.output)
 
-    def test_token_exchange_expands_keycloak_aib_and_operator_wiring(self):
+    def test_token_exchange_deploys_public_extproc_and_wires_operator(self):
         from types import SimpleNamespace
         from unittest.mock import patch
 
@@ -2156,7 +2300,9 @@ class TestAuthWiring:
             "kaos_cli.install.run_helm_command", side_effect=fake_helm
         ), patch("kaos_cli.install._install_aib", return_value=True) as mock_aib, patch(
             "kaos_cli.install._install_keycloak", return_value=True
-        ) as mock_keycloak:
+        ) as mock_keycloak, patch(
+            "kaos_cli.install._install_aib_extproc", return_value=True
+        ) as mock_extproc:
             result = runner.invoke(
                 app,
                 [
@@ -2173,27 +2319,23 @@ class TestAuthWiring:
         assert result.exit_code == 0, result.output
         mock_keycloak.assert_called_once()
         mock_aib.assert_called_once()
-        aib_args = mock_aib.call_args.kwargs["extra_set"]
-        joined_aib = " ".join(aib_args)
-        assert "extProc.enabled=true" in joined_aib
-        assert "EXTPROC_OAUTH2_ISSUER" in joined_aib
-        assert "EXTPROC_OAUTH2_CLIENT_ID" in joined_aib
-        assert "EXTPROC_OAUTH2_CLIENT_SECRET" in joined_aib
-        assert "EXTPROC_OAUTH2_CLIENT_ASSERTION_TYPE" in joined_aib
-        assert "EXTPROC_OAUTH2_TOKEN_ENDPOINT" not in joined_aib
-        assert "EXTPROC_OAUTH2_TLS_ALLOW_HTTP" not in joined_aib
-        assert "EXTPROC_OAUTH2_CLIENT_CREDENTIALS_ENDPOINT" not in joined_aib
-        assert "extProc.oauth2.clientCredentialsEndpoint=" in joined_aib
+        mock_extproc.assert_called_once_with(
+            "aib-system",
+            "aib",
+            "http://keycloak.keycloak.svc.cluster.local:8080/realms/kaos",
+            False,
+        )
+        joined_aib = " ".join(mock_aib.call_args.kwargs["extra_set"])
+        assert mock_aib.call_args.kwargs["seed_identity_bootstrap"] is False
+        assert "broker.oauth2AuthorizationServer.mode=proxy" in joined_aib
+        assert "resolveAgentIdByClientId(subject_token.azp)" in joined_aib
         assert 'client_assertion.azp == "kaos"' in joined_aib
+        assert "broker.security.skipThirdpartyHttpsValidation=true" in joined_aib
+        assert "extProc." not in joined_aib
 
-        assert mock_keycloak.call_args.args[-1] is True
-
-        joined = " ".join(captured["operator"])
-        assert "security.agentAuth.identity.provider=oidc" in joined
-        assert "security.userAuth.audience=kaos" in joined
-        assert "security.tokenExchange.enabled=true" in joined
-        assert "security.tokenExchange.aib.adminUrl=" in joined
-        assert "security.tokenExchange.extProc.port=50051" in joined
+        joined_operator = " ".join(captured["operator"])
+        assert "security.tokenExchange.enabled=true" in joined_operator
+        assert "security.tokenExchange.extProc.port=50051" in joined_operator
 
     @pytest.mark.parametrize(
         "args,message",