Build customers-api REST layer (Layer 3), mirroring catalog-api

8 routes over Customer + orders/payments sub-resources, proxying to classic-models-api. openid-connect with RFC 8693 token exchange to classic-models-api audience, rate-limiting, proxy-cache, audit-log — same plugin set and structure as catalog-api's REST surface. Not deployed: dev/gitrepository.yaml points at a gitea repo that doesn't exist yet (kong-customers-api.git, 404). No MCP layer yet either, unlike catalog-api.
2026-08-23 14:34:47 +02:00
parent 7ab1cbb569
commit 66565367f1
17 changed files with 775 additions and 9 deletions
@@ -1,12 +1,65 @@
 # customers-api

-Placeholder component repo for the **customers** slice of
-`classic-models-api` (see /Users/stephanetailland/git/classic-models-api),
-split out per the DDD decomposition documented in
-`../kong-konnect-deployment-strategy.md`.
+Kong routing/policy layer for the **customers** slice of
+`classic-models-api` (see `/Users/stephanetailland/git/classic-models-api`),
+split out per the DDD decomposition in `../kong-konnect-deployment-strategy.md`.
+The backend itself stays a single monolith — only Kong does the domain
+split. Same role as `../catalog-api` plays for `catalog`, structure
+deliberately mirrored.

-This repo does not yet contain migrated application code — only the
-routing scaffold (layer 3: `HTTPRoute`/`KongPlugin`/`KongConsumer`,
-alongside the eventual app manifests), targeting the Control Plane(s)
-provisioned for `customers` (see `../konnect-platform/domains/customers/`
-and `../dataplane-customers`).
+**REST only for now** (`kong/rest/`) — 8 routes covering
+`Customer` plus its `orders`/`payments` sub-resources (cross-domain reads,
+same backend). No MCP surface yet, unlike `catalog-api` — add one
+(`kong/mcp/`, a `mcp-customers` Keycloak audience/client-scope, an entry in
+`dataplane-customers`'s `JWT_AUDIENCE_WHITELIST`) the same way if/when this
+domain needs an MCP entry point.
+
+| Route | Method | Backend path |
+|---|---|---|
+| `/customers/v1/customers/` | GET, POST | `/classic-models/api/v1/customers/` |
+| `/customers/v1/customers/{customernumber}/` | GET, PUT, PATCH, DELETE | `/classic-models/api/v1/customers/{customernumber}/` |
+| `/customers/v1/customers/{customernumber}/orders/` | GET | `/classic-models/api/v1/customers/{customernumber}/orders/` |
+| `/customers/v1/customers/{customernumber}/payments/` | GET | `/classic-models/api/v1/customers/{customernumber}/payments/` |
+
+## Auth
+
+`openid-connect` on the REST service, `audience_required`/token-exchange
+target = `classic-models-api` (`BACKEND_AUDIENCE`). Unlike `catalog-api`,
+there's no MCP hop minting an intermediate `customers-api`-audience token
+today — a caller gets one directly via `kong-token-exchange-broker`
+(`customers-api-audience` client scope, added there 2026-08-23) and calls
+these routes with it; the REST-layer plugin then exchanges that token again
+to `classic-models-api` before it reaches the backend, same second-hop
+pattern as `catalog-api`'s REST layer. IdP is the **local** Keycloak
+(`https://keycloak.sttlab.local/realms/classic-models`) — see
+`../dataplane-customers/README.md` and `../STATUS.md` sections 15/16 for
+why (platform-wide migration off the VPS Keycloak, not customers-specific).
+`consumer_claims`/`consumer_by` map the JWT `sub` to a Kong Consumer for
+per-consumer rate limiting, same as `catalog-api`.
+
+## Other policies
+
+Per-consumer rate limiting, response caching (GET/HEAD), audit log
+(`http-log`, endpoint still a placeholder — no real log collector in this
+lab, same caveat as `catalog-api`).
+
+## Structure
+
+Same three-piece `dev/` layout as `catalog-api`: `dev/gitrepository.yaml` +
+`dev/flux-kustomization.yaml` (deploys `./kong` into the `customers`
+namespace's dev environment, `dependsOn` `dataplane-customers`'s Gateway
+Kustomization), `dev/externalsecret.yaml` (git deploy key),
+`dev/token-exchange-broker-externalsecret.yaml` (the broker's client
+secret). `kong/rest/` — service, routes, path-rewrites, auth/rate-
+limit/cache/audit-log policies and their bindings.
+
+**Not deployed yet — blocked on one external step**: the gitea repo
+`kong-customers-api.git` this `dev/gitrepository.yaml` points at doesn't
+exist (`https://gitea.sttlab.eu/stt/kong-customers-api` → 404 as of
+2026-08-23). A dedicated deploy keypair was generated and stored in Vault
+(`kong-v2/customers-api/git-deploy-key`) as if it did — once the repo
+exists and that key is registered as its deploy key, this content needs to
+be pushed to it, then `dev/gitrepository.yaml` + `dev/flux-kustomization.yaml`
+ the two `dev/*externalsecret.yaml` files applied to the cluster.
+`kong-v2/customers-api/token-exchange-broker` (the broker's client secret,
+copied from the live local Keycloak) is already stored in Vault and ready.
@@ -0,0 +1,25 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: customers-api-git-auth
+  namespace: customers
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kong-v2
+  target:
+    name: customers-api-git-auth
+  data:
+    - secretKey: identity
+      remoteRef:
+        key: kong-v2/customers-api/git-deploy-key
+        property: identity
+    - secretKey: identity.pub
+      remoteRef:
+        key: kong-v2/customers-api/git-deploy-key
+        property: identity.pub
+    - secretKey: known_hosts
+      remoteRef:
+        key: kong-v2/customers-api/git-deploy-key
+        property: known_hosts
@@ -0,0 +1,37 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: customers-dev-api
+  namespace: customers
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: customers-api-dev
+  path: ./kong
+  prune: true
+  dependsOn:
+    - name: customers-dev-api-gateway
+      namespace: flux-system
+  postBuild:
+    substitute:
+      NAME: customers-dev
+      NAMESPACE: customers
+      CONTROL_PLANE_REF_NAME: customers-dev-tw8tn
+      BACKEND_HOST: classic-models-api.classic-models.svc.cluster.local
+      OIDC_ISSUER: https://keycloak.sttlab.local/realms/classic-models
+      API_AUDIENCE: '["customers-api"]'
+      # Unused today — same dead variable already present in catalog-api's
+      # flux-kustomization.yaml (no file under kong/rest/ or kong/mcp/
+      # actually reads API_SCOPES_REQUIRED). Kept for parity; fix in both
+      # places together if this ever gets wired up for real.
+      API_SCOPES_REQUIRED: '["customers:read"]'
+      BACKEND_AUDIENCE: '["classic-models-api"]'
+      BACKEND_SCOPES: '[]'
+      API_RATE_LIMIT_MINUTE: "60"
+      AUDIT_LOG_ENDPOINT: http://audit-log-collector.observability.svc.cluster.local/logs
+      REST_HOSTNAME: customers-dev.sttlab.local
+      TOKEN_EXCHANGE_CLIENT_ID: kong-token-exchange-broker
+    substituteFrom:
+      - kind: Secret
+        name: customers-token-exchange-broker
@@ -0,0 +1,12 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: customers-api-dev
+  namespace: customers
+spec:
+  interval: 5m
+  url: ssh://git@gitea.sttlab.eu:2222/stt/kong-customers-api.git
+  secretRef:
+    name: customers-api-git-auth
+  ref:
+    branch: main
@@ -0,0 +1,17 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: customers-token-exchange-broker
+  namespace: customers
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kong-v2
+  target:
+    name: customers-token-exchange-broker
+  data:
+    - secretKey: TOKEN_EXCHANGE_CLIENT_SECRET
+      remoteRef:
+        key: kong-v2/customers-api/token-exchange-broker
+        property: client_secret
@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - rest/service.yaml
+  - rest/routes.yaml
+  - rest/path-rewrite.yaml
+  - rest/path-rewrite-bindings.yaml
+  - rest/kongplugin.yaml
+  - rest/rate-limiting.yaml
+  - rest/proxy-cache.yaml
+  - rest/audit-log.yaml
+  - rest/audit-log-body-capture.yaml
+  - rest/audit-log-body-capture-bindings.yaml
+  - rest/pluginbindings.yaml
@@ -0,0 +1,35 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-customers-api-audit-capture-request-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-customers-api-audit-capture-request
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-customers-api
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-customers-api-audit-capture-response-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-customers-api-audit-capture-response
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-customers-api
@@ -0,0 +1,27 @@
+# dev only: captures raw request/response bodies into kong.ctx.shared for
+# audit-log.yaml's custom_fields_by_lua to read back in the log phase.
+# Drop this file (and its bindings) to stop body capture without touching
+# audit-log.yaml itself — it degrades gracefully to metadata-only logging.
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-customers-api-audit-capture-request
+  namespace: ${NAMESPACE}
+plugin: pre-function
+config:
+  access:
+    - "kong.ctx.shared.audit_request_body = kong.request.get_raw_body()"
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-customers-api-audit-capture-response
+  namespace: ${NAMESPACE}
+plugin: post-function
+config:
+  body_filter:
+    - |
+      local chunk = ngx.arg[1]
+      if chunk then
+        kong.ctx.shared.audit_response_body = (kong.ctx.shared.audit_response_body or "") .. chunk
+      end
@@ -0,0 +1,17 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-customers-api-audit-log
+  namespace: ${NAMESPACE}
+plugin: http-log
+# dev only: the raw Authorization (JWT) header is captured in clear text,
+# not acceptable as-is for a non-dev environment. request_body/response_body
+# below read from kong.ctx.shared, populated by audit-log-body-capture.yaml
+# — nil (and silently omitted) if that file isn't applied.
+config:
+  http_endpoint: ${AUDIT_LOG_ENDPOINT}
+  method: POST
+  content_type: application/json
+  custom_fields_by_lua:
+    request_body: "return kong.ctx.shared.audit_request_body"
+    response_body: "return kong.ctx.shared.audit_response_body"
@@ -0,0 +1,30 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-customers-api-openid-connect
+  namespace: ${NAMESPACE}
+plugin: openid-connect
+config:
+  issuer: ${OIDC_ISSUER}
+  audience_required: ${BACKEND_AUDIENCE}
+  auth_methods:
+    - bearer
+  display_errors: false
+  ssl_verify: true
+  consumer_claims:
+    - - sub
+  consumer_by:
+    - custom_id
+    - username
+  consumer_optional: true
+  client_id:
+    - ${TOKEN_EXCHANGE_CLIENT_ID}
+  client_secret:
+    - ${TOKEN_EXCHANGE_CLIENT_SECRET}
+  token_exchange:
+    subject_token_issuers:
+      - issuer: ${OIDC_ISSUER}
+        conditions: {}
+    request:
+      audience: ${BACKEND_AUDIENCE}
+      scopes: ${BACKEND_SCOPES}
@@ -0,0 +1,143 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-customers-api-rewrite-listcustomers-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-customers-api-rewrite-listcustomers
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-customers-api-listcustomers
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-customers-api-rewrite-createcustomer-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-customers-api-rewrite-createcustomer
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-customers-api-createcustomer
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-customers-api-rewrite-getcustomer-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-customers-api-rewrite-getcustomer
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-customers-api-getcustomer
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-customers-api-rewrite-updatecustomer-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-customers-api-rewrite-updatecustomer
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-customers-api-updatecustomer
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-customers-api-rewrite-patchcustomer-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-customers-api-rewrite-patchcustomer
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-customers-api-patchcustomer
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-customers-api-rewrite-deletecustomer-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-customers-api-rewrite-deletecustomer
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-customers-api-deletecustomer
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-customers-api-rewrite-getcustomerorders-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-customers-api-rewrite-getcustomerorders
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-customers-api-getcustomerorders
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-customers-api-rewrite-getcustomerpayments-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-customers-api-rewrite-getcustomerpayments
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-customers-api-getcustomerpayments
@@ -0,0 +1,79 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-customers-api-rewrite-listcustomers
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/customers/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-customers-api-rewrite-createcustomer
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/customers/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-customers-api-rewrite-getcustomer
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/customers/$(uri_captures.customernumber)/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-customers-api-rewrite-updatecustomer
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/customers/$(uri_captures.customernumber)/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-customers-api-rewrite-patchcustomer
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/customers/$(uri_captures.customernumber)/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-customers-api-rewrite-deletecustomer
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/customers/$(uri_captures.customernumber)/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-customers-api-rewrite-getcustomerorders
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/customers/$(uri_captures.customernumber)/orders/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-customers-api-rewrite-getcustomerpayments
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/customers/$(uri_captures.customernumber)/payments/
@@ -0,0 +1,71 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-customers-api-openid-connect-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-customers-api-openid-connect
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-customers-api
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-customers-api-rate-limiting-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-customers-api-rate-limiting
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-customers-api
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-customers-api-proxy-cache-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-customers-api-proxy-cache
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-customers-api
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-customers-api-audit-log-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-customers-api-audit-log
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-customers-api
@@ -0,0 +1,16 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-customers-api-proxy-cache
+  namespace: ${NAMESPACE}
+plugin: proxy-cache-advanced
+config:
+  strategy: memory
+  request_method:
+    - GET
+    - HEAD
+  response_code:
+    - 200
+  content_type:
+    - application/json
+  cache_ttl: 60
@@ -0,0 +1,14 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-customers-api-rate-limiting
+  namespace: ${NAMESPACE}
+plugin: rate-limiting-advanced
+config:
+  limit:
+    - ${API_RATE_LIMIT_MINUTE}
+  window_size:
+    - 60
+  identifier: consumer
+  sync_rate: -1
+  strategy: local
@@ -0,0 +1,159 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-customers-api-listcustomers
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-customers-api
+  name: customers-api_listcustomers
+  methods:
+    - GET
+    - OPTIONS
+  paths:
+    - /customers/v1/customers/
+  strip_path: false
+  tags:
+    - customers
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-customers-api-createcustomer
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-customers-api
+  name: customers-api_createcustomer
+  methods:
+    - POST
+    - OPTIONS
+  paths:
+    - /customers/v1/customers/
+  strip_path: false
+  tags:
+    - customers
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-customers-api-getcustomer
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-customers-api
+  name: customers-api_getcustomer
+  methods:
+    - GET
+    - OPTIONS
+  paths:
+    - ~/customers/v1/customers/(?<customernumber>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - customers
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-customers-api-updatecustomer
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-customers-api
+  name: customers-api_updatecustomer
+  methods:
+    - PUT
+    - OPTIONS
+  paths:
+    - ~/customers/v1/customers/(?<customernumber>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - customers
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-customers-api-patchcustomer
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-customers-api
+  name: customers-api_patchcustomer
+  methods:
+    - PATCH
+    - OPTIONS
+  paths:
+    - ~/customers/v1/customers/(?<customernumber>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - customers
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-customers-api-deletecustomer
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-customers-api
+  name: customers-api_deletecustomer
+  methods:
+    - DELETE
+    - OPTIONS
+  paths:
+    - ~/customers/v1/customers/(?<customernumber>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - customers
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-customers-api-getcustomerorders
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-customers-api
+  name: customers-api_getcustomerorders
+  methods:
+    - GET
+    - OPTIONS
+  paths:
+    - ~/customers/v1/customers/(?<customernumber>[^#?/]+)/orders/$
+  strip_path: false
+  tags:
+    - customers
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-customers-api-getcustomerpayments
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-customers-api
+  name: customers-api_getcustomerpayments
+  methods:
+    - GET
+    - OPTIONS
+  paths:
+    - ~/customers/v1/customers/(?<customernumber>[^#?/]+)/payments/$
+  strip_path: false
+  tags:
+    - customers
@@ -0,0 +1,17 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongService
+metadata:
+  name: ${NAME}-customers-api
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  name: customers-api
+  host: ${BACKEND_HOST}
+  port: 8000
+  protocol: http
+  path: /
+  tags:
+    - customers