From 3c5025ee52f89ad03912af1e1097b3b57231d699 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Tailland?= Date: Thu, 27 Aug 2026 14:39:03 +0200 Subject: [PATCH] Move the gateway entrypoints into the domain namespace MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The gateway and policies Kustomizations sat in flux-system, and so did the Secret carrying the control-plane id. Neither was a governance decision: postBuild.substituteFrom resolves only in the Kustomization's own namespace, dataplane-template-defaults existed only in flux-system, so everything that needed it had to live there too — in a namespace the feature team has no access to. The team could not touch its own gateway. k8s-platform now places that ConfigMap in every domain namespace, so the constraint is gone. Move both Kustomizations and the control-plane ExternalSecret to catalog. The id no longer transits a shared namespace either, which was a compromise this repo documented rather than liked. Adds the GitRepository this repo never had — its Kustomizations point at k8s-platform for templates, and nothing needed to read the repo that declares them, because those declarations were applied by hand. It reuses the domain's existing deploy key rather than minting one; verified that the key reads this repository. Worth knowing what that implies: the key is not scoped to a single repo, so the isolation its per-repo name suggests does not exist. And the bootstrap Kustomization that watches ./dev/api-gateway, so all of it reconciles from git from now on. Migration is not a patch: a namespace is immutable, so the existing objects have to be deleted and recreated. Deleting a Kustomization with prune enabled would take its Gateway, GatewayConfiguration and mirror CR with it, so prune has to be turned off on the old objects first, then the new ones adopt what is already running. Co-Authored-By: Claude Opus 5 --- dev/api-gateway/bootstrap-kustomization.yaml | 24 +++++++++++++++++++ .../externalsecret-control-plane.yaml | 7 +++++- dev/api-gateway/gateway-kustomization.yaml | 8 +++---- dev/api-gateway/gitrepository.yaml | 21 ++++++++++++++++ dev/api-gateway/policies-kustomization.yaml | 2 +- 5 files changed, 56 insertions(+), 6 deletions(-) create mode 100644 dev/api-gateway/bootstrap-kustomization.yaml create mode 100644 dev/api-gateway/gitrepository.yaml diff --git a/dev/api-gateway/bootstrap-kustomization.yaml b/dev/api-gateway/bootstrap-kustomization.yaml new file mode 100644 index 0000000..0367230 --- /dev/null +++ b/dev/api-gateway/bootstrap-kustomization.yaml @@ -0,0 +1,24 @@ +# Watches ./dev/api-gateway so the entrypoints in it — the GitRepository above, +# the gateway and policies Kustomizations, the ExternalSecrets — reconcile from +# git instead of waiting on a kubectl apply. Lives in that directory, so it +# manages itself. +# +# In the catalog namespace, not flux-system. The gateway Kustomizations sat in +# flux-system only because postBuild.substituteFrom reads a ConfigMap from its +# own namespace and dataplane-template-defaults existed nowhere else. That +# ConfigMap is now in every domain namespace, so the constraint is gone and the +# team can own its own gateway. +# +# Apply once with kubectl. That is the last manual apply this repo needs. +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: dataplane-catalog-dev-bootstrap + namespace: catalog +spec: + interval: 10m + sourceRef: + kind: GitRepository + name: dataplane-catalog-dev + path: ./dev/api-gateway + prune: true diff --git a/dev/api-gateway/externalsecret-control-plane.yaml b/dev/api-gateway/externalsecret-control-plane.yaml index 1c8482d..a5255a6 100644 --- a/dev/api-gateway/externalsecret-control-plane.yaml +++ b/dev/api-gateway/externalsecret-control-plane.yaml @@ -1,3 +1,8 @@ +# Moved out of flux-system with the Kustomization that reads it. It only ever +# lived there because postBuild.substituteFrom resolves in the Kustomization's +# own namespace, and that Kustomization had to be in flux-system to reach +# dataplane-template-defaults. Both now sit in the domain namespace, so the +# control-plane id no longer transits a shared namespace at all. # The Control Plane id, delivered to flux-system so gateway-kustomization.yaml # can substitute it instead of carrying a hardcoded UUID. # @@ -13,7 +18,7 @@ apiVersion: external-secrets.io/v1 kind: ExternalSecret metadata: name: catalog-dev-control-plane - namespace: flux-system + namespace: catalog spec: refreshInterval: 1h secretStoreRef: diff --git a/dev/api-gateway/gateway-kustomization.yaml b/dev/api-gateway/gateway-kustomization.yaml index 314d24a..11efcda 100644 --- a/dev/api-gateway/gateway-kustomization.yaml +++ b/dev/api-gateway/gateway-kustomization.yaml @@ -7,7 +7,7 @@ apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization metadata: name: catalog-dev-api-gateway - namespace: flux-system + namespace: catalog spec: interval: 10m sourceRef: @@ -35,8 +35,8 @@ spec: - kind: ConfigMap name: dataplane-template-defaults # CONTROL_PLANE_ID comes from Vault via ESO instead of being hardcoded - # here: a new Konnect org then needs no edit in this repo. Not a secret — - # the id is visible in the Konnect UI URL — so flux-system is fine for it, - # unlike the token. + # here: a new Konnect org then needs no edit in this repo. Both this + # Secret and this Kustomization are in the domain namespace now, so the + # id no longer has to pass through flux-system to be substitutable. - kind: Secret name: catalog-dev-control-plane diff --git a/dev/api-gateway/gitrepository.yaml b/dev/api-gateway/gitrepository.yaml new file mode 100644 index 0000000..7f81082 --- /dev/null +++ b/dev/api-gateway/gitrepository.yaml @@ -0,0 +1,21 @@ +# This repo, as a source Flux can read. It had none: its Kustomizations point at +# k8s-platform for the templates, and nothing ever needed to read the repo that +# declares them — because those declarations were applied by hand. +# +# Reuses the domain's existing deploy key rather than minting a new one. Verified +# that it reads this repository: a throwaway GitRepository with secretRef +# catalog-api-git-auth reached Ready against this URL. Worth knowing what that +# implies — the key is not scoped to a single repository, so the isolation its +# per-repo name suggests does not exist. +apiVersion: source.toolkit.fluxcd.io/v1 +kind: GitRepository +metadata: + name: dataplane-catalog-dev + namespace: catalog +spec: + interval: 5m + url: ssh://git@gitea.sttlab.eu:2222/stt/kong-dataplane-catalog.git + secretRef: + name: catalog-api-git-auth + ref: + branch: main diff --git a/dev/api-gateway/policies-kustomization.yaml b/dev/api-gateway/policies-kustomization.yaml index 1c391d4..9211016 100644 --- a/dev/api-gateway/policies-kustomization.yaml +++ b/dev/api-gateway/policies-kustomization.yaml @@ -7,7 +7,7 @@ apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization metadata: name: catalog-dev-api-gateway-policies - namespace: flux-system + namespace: catalog spec: interval: 10m sourceRef: