Update the playground to Barbacane 0.11.0

.env.example

@@ -1,7 +1,7 @@
 # Barbacane image version to pull from ghcr.io/barbacane-dev
-# Set to a specific release tag (e.g. 0.10.0) to pin the playground to that version.
+# Set to a specific release tag (e.g. 0.11.0) to pin the playground to that version.
 # Use "latest" to always pull the most recent release.
-BARBACANE_VERSION=0.10.0
+BARBACANE_VERSION=0.11.0
 
 # Admin token for the control plane. Since 0.8 the control plane refuses to
 # start without a non-empty token. This is a demo default — change it for any

README.md

@@ -27,7 +27,7 @@ By default the playground pulls the `latest` images from [GitHub Container Regis
 
 ```bash
 cp .env.example .env
-# Edit .env and set BARBACANE_VERSION=0.10.0 (or any release tag)
+# Edit .env and set BARBACANE_VERSION=0.11.0 (or any release tag)
 docker compose pull
 docker compose up -d
 ```

docker-compose.yml

@@ -20,7 +20,7 @@ services:
   # Spec Compiler (init container - compiles specs before gateway starts)
   # ==========================================================================
   compiler:
-    image: ghcr.io/barbacane-dev/barbacane-standalone:${BARBACANE_VERSION:-0.10.0}
+    image: ghcr.io/barbacane-dev/barbacane-standalone:${BARBACANE_VERSION:-0.11.0}
     command: ["compile", "--spec", "/specs/train-travel-api.yaml", "--spec", "/specs/train-events.yaml", "--spec", "/specs/s3-proxy.yaml", "--spec", "/specs/waf-demo.yaml", "--manifest", "/manifest/barbacane.yaml", "--output", "/output/api.bca", "--allow-plaintext"]
     # Run as root so the init container can write the shared artifact volume,
     # which is root-owned by default. The gateway mounts it read-only.
@@ -36,7 +36,7 @@ services:
   # API Gateway (Data Plane)
   # ==========================================================================
   barbacane:
-    image: ghcr.io/barbacane-dev/barbacane-standalone:${BARBACANE_VERSION:-0.10.0}
+    image: ghcr.io/barbacane-dev/barbacane-standalone:${BARBACANE_VERSION:-0.11.0}
     # --admin-bind on 0.0.0.0 exposes the admin API (/health, /metrics,
     # /provenance) to Prometheus and the host. It defaults to loopback, which
     # other containers cannot reach. The admin endpoints are unauthenticated;
@@ -88,7 +88,7 @@ services:
   # Control Plane (Web UI + API)
   # ==========================================================================
   control-plane:
-    image: ghcr.io/barbacane-dev/barbacane-control:${BARBACANE_VERSION:-0.10.0}
+    image: ghcr.io/barbacane-dev/barbacane-control:${BARBACANE_VERSION:-0.11.0}
     ports:
       - "3001:80"    # Web UI
       - "9091:9090"  # Control Plane API

specs/s3-proxy.yaml

@@ -35,6 +35,8 @@ paths:
             issuer_url: "http://mock-oauth:8080/barbacane"
             issuer_override: "http://localhost:9099/barbacane"
             audience: "train-travel-api"
+      security:
+        - OpenIdConnect: []
       x-barbacane-dispatch:
         name: s3
         config:
@@ -84,6 +86,8 @@ paths:
             issuer_url: "http://mock-oauth:8080/barbacane"
             issuer_override: "http://localhost:9099/barbacane"
             audience: "train-travel-api"
+      security:
+        - OpenIdConnect: []
       x-barbacane-dispatch:
         name: s3
         config:
@@ -119,6 +123,8 @@ paths:
             issuer_url: "http://mock-oauth:8080/barbacane"
             issuer_override: "http://localhost:9099/barbacane"
             audience: "train-travel-api"
+      security:
+        - OpenIdConnect: []
       x-barbacane-dispatch:
         name: s3
         config:
@@ -168,3 +174,9 @@ paths:
           description: Asset content
         "404":
           description: Asset not found
+
+components:
+  securitySchemes:
+    OpenIdConnect:
+      type: openIdConnect
+      openIdConnectUrl: http://localhost:9099/barbacane/.well-known/openid-configuration

specs/train-travel-api.yaml

@@ -338,6 +338,8 @@ paths:
             issuer_url: "http://mock-oauth:8080/barbacane"
             issuer_override: "http://localhost:9099/barbacane"
             audience: "train-travel-api"
+      security:
+        - OpenIdConnect: []
       parameters:
         - name: status
           in: query
@@ -389,6 +391,8 @@ paths:
           config:
             latency_slo_ms: 1000
             detailed_request_logs: true
+      security:
+        - OpenIdConnect: []
       requestBody:
         required: true
         content:
@@ -429,6 +433,8 @@ paths:
             issuer_url: "http://mock-oauth:8080/barbacane"
             issuer_override: "http://localhost:9099/barbacane"
             audience: "train-travel-api"
+      security:
+        - OpenIdConnect: []
       parameters:
         - name: bookingId
           in: path
@@ -462,6 +468,8 @@ paths:
             issuer_url: "http://mock-oauth:8080/barbacane"
             issuer_override: "http://localhost:9099/barbacane"
             audience: "train-travel-api"
+      security:
+        - OpenIdConnect: []
       parameters:
         - name: bookingId
           in: path
@@ -492,6 +500,8 @@ paths:
             issuer_url: "http://mock-oauth:8080/barbacane"
             issuer_override: "http://localhost:9099/barbacane"
             audience: "train-travel-api"
+      security:
+        - OpenIdConnect: []
       parameters:
         - name: bookingId
           in: path
@@ -527,6 +537,8 @@ paths:
             issuer_url: "http://mock-oauth:8080/barbacane"
             issuer_override: "http://localhost:9099/barbacane"
             audience: "train-travel-api"
+      security:
+        - OpenIdConnect: []
       parameters:
         - name: bookingId
           in: path
@@ -563,6 +575,8 @@ paths:
             latency_slo_ms: 5000
             detailed_request_logs: true
             detailed_response_logs: true
+      security:
+        - OpenIdConnect: []
       parameters:
         - name: bookingId
           in: path
@@ -592,6 +606,10 @@ paths:
           $ref: "#/components/responses/PaymentRequired"
 
 components:
+  securitySchemes:
+    OpenIdConnect:
+      type: openIdConnect
+      openIdConnectUrl: http://localhost:9099/barbacane/.well-known/openid-configuration
   schemas:
     Station:
       type: object