diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..266bf00 --- /dev/null +++ b/.gitignore @@ -0,0 +1,4 @@ +.DS_Store +*.swp + +**/secret.yaml diff --git a/README.md b/README.md index 09fe4e8..195a8c8 100644 --- a/README.md +++ b/README.md @@ -1,10 +1,32 @@ # dataplane-catalog Layer 2 (Gateway infrastructure) for the **catalog** bounded context -(domain team: catalog). `DataPlane`, `KonnectExtension`, certs (cert-manager), -secrets (External Secrets Operator) — one Control Plane per environment, -referenced by ID (created by `../konnect-platform`, never recreated here). +(domain team: catalog) — one Control Plane per environment, referenced by +ID (created by `../konnect-platform`, never recreated here). -Content is generated and PR'd automatically when the matching Control -Plane is created via the self-service flow in `../konnect-platform` — -never hand-edited directly. +**This repo does NOT hold `KonnectAPIAuthConfiguration`/`GatewayConfiguration`/ +`Gateway` YAML directly.** The actual resource template (one copy, covering +every domain/environment) lives in `../k8s-platform/dataplane-template/`, +`${VAR}`-parameterized. This repo only holds the values for one +`//` — the Helm-`values.yaml` equivalent: + +- `configmap.yaml` — non-sensitive values (domain, env, namespace, Control + Plane ID, image, hostname...). +- `secret.yaml` — the Konnect PAT. **Gitignored, never committed** — copy + `secret.yaml.example` to `secret.yaml` and fill in the real token locally. +- `kustomization.yaml` — a Flux `Kustomization` CR (not a plain Kustomize + build file, despite the name) that builds `../k8s-platform/dataplane-template/` + from a `GitRepository` source and substitutes values from the ConfigMap + and Secret above (`postBuild.substituteFrom`). + +Content (the ConfigMap/Secret pair) is generated and PR'd automatically +when the matching Control Plane is created via the self-service flow in +`../konnect-platform` — never hand-edited directly. + +**Not yet applied/validated**: `kustomization.yaml`'s `sourceRef` points at +a `GitRepository` named `k8s-platform` that doesn't exist yet — this repo +has no git remote (see `../STATUS.md`), so `source-controller` has nothing +to clone. `configmap.yaml` and `secret.yaml` have been applied directly +(`kubectl apply -f`) to validate they're well-formed, but the actual +generate-a-Gateway-from-the-template flow hasn't been exercised end-to-end +yet — that requires the `GitRepository` to exist first. diff --git a/dev/api-gateway/dataplane.yaml b/dev/api-gateway/dataplane.yaml deleted file mode 100644 index e6e21bf..0000000 --- a/dev/api-gateway/dataplane.yaml +++ /dev/null @@ -1,5 +0,0 @@ -# TODO: DataPlane CRD for catalog/dev/api-gateway -apiVersion: gateway-operator.konghq.com/v1beta1 -kind: DataPlane -metadata: - name: catalog-dev diff --git a/dev/api-gateway/externalsecret.yaml b/dev/api-gateway/externalsecret.yaml new file mode 100644 index 0000000..c3c65a4 --- /dev/null +++ b/dev/api-gateway/externalsecret.yaml @@ -0,0 +1,27 @@ +# Replaces the manually-applied secret.yaml — the real PAT now lives only +# in Vault (secrets/kong-v2/catalog/dev/konnect-pat), never in git, never +# manually kubectl-applied again. refreshInterval controls how often ESO +# re-checks Vault and re-syncs the K8s Secret if the value changed there — +# rotation becomes "update Vault", nothing to touch in the cluster. +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: catalog-dev-konnect-auth + namespace: catalog +spec: + refreshInterval: 1h + secretStoreRef: + kind: ClusterSecretStore + name: vault-kong-v2 + target: + name: catalog-dev-konnect-auth + template: + metadata: + labels: + konghq.com/credential: konnect + konghq.com/secret: "true" + data: + - secretKey: token + remoteRef: + key: kong-v2/catalog/dev/konnect-pat + property: token diff --git a/dev/api-gateway/konnectextension.yaml b/dev/api-gateway/konnectextension.yaml deleted file mode 100644 index c066cdb..0000000 --- a/dev/api-gateway/konnectextension.yaml +++ /dev/null @@ -1,6 +0,0 @@ -# TODO: KonnectExtension referencing the Control Plane created by -# konnect-platform/domains/catalog/dev/ (by ID, not created here) -apiVersion: konnect.konghq.com/v1alpha1 -kind: KonnectExtension -metadata: - name: catalog-dev diff --git a/dev/api-gateway/kustomization.yaml b/dev/api-gateway/kustomization.yaml index 44ec993..1b23264 100644 --- a/dev/api-gateway/kustomization.yaml +++ b/dev/api-gateway/kustomization.yaml @@ -1,5 +1,38 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 +# sourceRef points at the GitRepository "k8s-platform" (created once, +# flux-system, see ../../../k8s-platform/flux/gitrepository.yaml) — any +# domain's Kustomization can reference this same object, no monorepo: +# k8s-platform and dataplane-catalog stay two separate repos, `path` below +# is relative to the root of whichever repo `sourceRef` names. +apiVersion: kustomize.toolkit.fluxcd.io/v1 kind: Kustomization -resources: - - dataplane.yaml - - konnectextension.yaml +metadata: + name: catalog-dev-api-gateway + namespace: flux-system +spec: + interval: 10m + sourceRef: + kind: GitRepository + name: k8s-platform + path: ./dataplane-template + prune: true + postBuild: + # Domain-specific non-sensitive values inline — no separate ConfigMap to + # forget to re-apply after an edit (bit us twice already). Inline + # substitute always wins over substituteFrom regardless of order, so + # this still overrides dataplane-template-defaults where needed. + substitute: + NAME: catalog-dev + NAMESPACE: catalog + CONTROL_PLANE_ID: "7a1e7127-0a02-4d09-b1dd-2efc865e9e97" + HOSTNAME: catalog-dev.sttlab.local + TLS_ISSUER_NAME: sttlab-local-ca + # Cluster-wide defaults only — the Konnect PAT is NOT handled via + # substitute/substituteFrom at all: that mechanism requires the source + # Secret to sit in flux-system (same namespace as this Kustomization), + # which put a live copy of the real PAT in a shared, broadly-readable + # namespace. Rejected. The real konnect-auth Secret is applied directly + # into the catalog namespace instead (secret.yaml, kubectl apply -f) — + # never passes through flux-system. + substituteFrom: + - kind: ConfigMap + name: dataplane-template-defaults