first commit

dev/api-gateway/externalsecret.yaml

@@ -0,0 +1,27 @@
+# Replaces the manually-applied secret.yaml — the real PAT now lives only
+# in Vault (secrets/kong-v2/catalog/dev/konnect-pat), never in git, never
+# manually kubectl-applied again. refreshInterval controls how often ESO
+# re-checks Vault and re-syncs the K8s Secret if the value changed there —
+# rotation becomes "update Vault", nothing to touch in the cluster.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: catalog-dev-konnect-auth
+  namespace: catalog
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kong-v2
+  target:
+    name: catalog-dev-konnect-auth
+    template:
+      metadata:
+        labels:
+          konghq.com/credential: konnect
+          konghq.com/secret: "true"
+  data:
+    - secretKey: token
+      remoteRef:
+        key: kong-v2/catalog/dev/konnect-pat
+        property: token