[ChrisJBurns]

Follows #2613 (merged). Closes #2621.

Summary

• Private IdP settings: --identity-broker-as1-upstream-ca-file (a PEM CA bundle trusted in addition to system roots) and --identity-broker-as1-upstream-allow-private-addresses, both refused without --identity-broker-as1-issuer. Admitting private addresses requires the CA file, as --oidc-allow-private-https-issuer requires --oidc-ca-cert-file. It applies to every request AS-1 makes to the upstream IdP (discovery, discovered endpoints, redirects), because ToolHive enforces it in its HTTP client's dialer; the flag help and values say so. Helm: identityBroker.as1.upstream.caSecret.{secretName,key} (mounted read-only) and identityBroker.as1.upstream.allowPrivateAddresses. Moved here from Operator configuration, keys, and deployment #2538; the kind/Keycloak demo uses them too.
• Audience check: AS-1 (ToolHive) accepts only an absolute http or https URL with a host and no fragment as its audience and otherwise fails at startup. mecak8s now refuses any other --oidc-audience when --identity-broker-as1-issuer is set, the chart refuses it at render time, and the production identity-broker CI fixture uses https://mecatl.example.com/api instead of mecatl.
• Kind e2e spec (e2e/k8s/hosted_as1_test.go, build tag kind_e2e): in its own namespace mecatl-as1, so the suite's two-replica release and existing Dex are untouched:
  • a test CA and certificates generated in memory; Dex v2.44.0 (the suite's image) on HTTPS with alice and bob and a static client for AS-1, without a service-account token;
  • a second single-replica mecak8s release with TLS, --no-shell, OIDC sub_id ownership, the broker, AS-1 at https://mecak8s-as1.mecatl-as1.svc.cluster.local:8081/as1, a signing-key Secret, and the new CA and private-address values;
  • the real clientauth.Login from the test process, through port-forwards (the client maps in-cluster host names to them; no /etc/hosts), with a browser that fills Dex's login form and approves AS-1's consent page (detection follows ToolHive's consentPageTemplate).
• Local dev profile (deploy/mecak8s-idbroker/, root include mecak8s-idbroker:): task mecak8s-idbroker:kind-setup creates a separate mecatl-idbroker Kind cluster (host ports 18090, 18091, 5557, so it runs alongside mecatl-dev), builds and loads the image, installs cert-manager and a fixture CA, deploys Dex over HTTPS with a dev-only user dev@example.com, and installs mecak8s with the broker and AS-1 (values-kind-idbroker.yaml). Then hosts-add, login, connect; also image-refresh, status, hosts-remove (with its own /etc/hosts backup), and destroy. A fixture test keeps ports, host names, the Dex redirect, the audience URL, and the login and connect tasks consistent. Verified live: full sign-in through AS-1 and Dex, sessions over HTTPS and gRPC, per-user isolation, image-refresh keeping the signing key, and destroy removing only its own cluster. Added to Test hosted AS-1 in the Kind e2e suite with Dex, and add a local Kind profile #2621's scope.
• CI: k8s-e2e.yml path filters add internal/identitybroker/**, internal/app/identitybroker.go, internal/adapter/clientauth/**, internal/adapter/server/** (replacing the individual files), authn/oidc/**, and mcp/oauthlogin/**.

What the spec asserts

1. Protected-resource metadata lists only AS-1, with the TUI client, audience, and the broker sign-in signal.
2. Sign-in succeeds; the token has typ: at+jwt, AS-1's iss, client_id, aud, and a sub_id (iss_sub) naming Dex's issuer and subject.
3. A session created with it is owned by that issuer and subject.
4. Bob, signed in through AS-1 and Dex, gets a different sub_id; his session list leaves out alice's session, opening hers returns 404, and alice still sees hers but not his.
5. Access tokens signed with AS-1's own key but with the wrong audience, or without sub_id, get 401; a control token minted the same way with the correct claims is accepted, so the refusals come from the claim checks.
6. Refresh returns a new token for the same sub_id, rotates the refresh token, and opens a session.
7. After the pod is deleted and replaced, a pre-restart access token still opens a session (signing key from a Secret), and the pre-restart refresh token gets invalid_grant (AS-1's in-memory state until Durable broker state and recovery #2563, which flips this assertion).

Observed Dex behaviour: AS-1's consent page comes first, then Dex's login form; Dex v2.44 shows no approval screen for prompt=consent with skipApprovalScreen (the browser approves one if a later Dex shows it). The spec shows that AS-1 requests offline_access with prompt=consent; that Dex issued an upstream refresh token is not asserted (that would need Dex's gRPC API).

Testing

• Focused: GOWORK=off go test -tags kind_e2e -count=1 -timeout 40m ./e2e/k8s/ -ginkgo.focus='hosted AS-1' passes 7/7 (85 s).
• CI's Kind job covers the full suite.
• Unit: go test ./cmd/mecak8s/... ./deploy/helm/mecak8s/ ./deploy/mecak8s-idbroker/, helm-unittest, kubeconform, docs:check, and site:build pass; lint clean on touched packages.

API compatibility

• Assessment: additive, plus one tightening. Two new opt-in mecak8s flags and Helm values, accepted only with --identity-broker-as1-issuer; no wire change. With AS-1 enabled, a non-URL --oidc-audience (oidc.audience) is now refused at flag parsing and at chart render time; this moves an existing AS-1 startup failure earlier with a clear message.
• Major / features: none.
• Upgrade: none required. A deployment with AS-1 enabled already needed a URL audience to start.