first commit

README.md

@@ -1,10 +1,32 @@
 # dataplane-catalog
 
 Layer 2 (Gateway infrastructure) for the **catalog** bounded context
-(domain team: catalog). `DataPlane`, `KonnectExtension`, certs (cert-manager),
-secrets (External Secrets Operator) — one Control Plane per environment,
-referenced by ID (created by `../konnect-platform`, never recreated here).
+(domain team: catalog) — one Control Plane per environment, referenced by
+ID (created by `../konnect-platform`, never recreated here).
 
-Content is generated and PR'd automatically when the matching Control
-Plane is created via the self-service flow in `../konnect-platform` —
-never hand-edited directly.
+**This repo does NOT hold `KonnectAPIAuthConfiguration`/`GatewayConfiguration`/
+`Gateway` YAML directly.** The actual resource template (one copy, covering
+every domain/environment) lives in `../k8s-platform/dataplane-template/`,
+`${VAR}`-parameterized. This repo only holds the values for one
+`<env>/<gateway-type>/` — the Helm-`values.yaml` equivalent:
+
+- `configmap.yaml` — non-sensitive values (domain, env, namespace, Control
+  Plane ID, image, hostname...).
+- `secret.yaml` — the Konnect PAT. **Gitignored, never committed** — copy
+  `secret.yaml.example` to `secret.yaml` and fill in the real token locally.
+- `kustomization.yaml` — a Flux `Kustomization` CR (not a plain Kustomize
+  build file, despite the name) that builds `../k8s-platform/dataplane-template/`
+  from a `GitRepository` source and substitutes values from the ConfigMap
+  and Secret above (`postBuild.substituteFrom`).
+
+Content (the ConfigMap/Secret pair) is generated and PR'd automatically
+when the matching Control Plane is created via the self-service flow in
+`../konnect-platform` — never hand-edited directly.
+
+**Not yet applied/validated**: `kustomization.yaml`'s `sourceRef` points at
+a `GitRepository` named `k8s-platform` that doesn't exist yet — this repo
+has no git remote (see `../STATUS.md`), so `source-controller` has nothing
+to clone. `configmap.yaml` and `secret.yaml` have been applied directly
+(`kubectl apply -f`) to validate they're well-formed, but the actual
+generate-a-Gateway-from-the-template flow hasn't been exercised end-to-end
+yet — that requires the `GitRepository` to exist first.