first commit

dev/api-gateway/kustomization.yaml

@@ -1,5 +1,38 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
+# sourceRef points at the GitRepository "k8s-platform" (created once,
+# flux-system, see ../../../k8s-platform/flux/gitrepository.yaml) — any
+# domain's Kustomization can reference this same object, no monorepo:
+# k8s-platform and dataplane-catalog stay two separate repos, `path` below
+# is relative to the root of whichever repo `sourceRef` names.
+apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
-resources:
-  - dataplane.yaml
-  - konnectextension.yaml
+metadata:
+  name: catalog-dev-api-gateway
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: k8s-platform
+  path: ./dataplane-template
+  prune: true
+  postBuild:
+    # Domain-specific non-sensitive values inline — no separate ConfigMap to
+    # forget to re-apply after an edit (bit us twice already). Inline
+    # substitute always wins over substituteFrom regardless of order, so
+    # this still overrides dataplane-template-defaults where needed.
+    substitute:
+      NAME: catalog-dev
+      NAMESPACE: catalog
+      CONTROL_PLANE_ID: "7a1e7127-0a02-4d09-b1dd-2efc865e9e97"
+      HOSTNAME: catalog-dev.sttlab.local
+      TLS_ISSUER_NAME: sttlab-local-ca
+    # Cluster-wide defaults only — the Konnect PAT is NOT handled via
+    # substitute/substituteFrom at all: that mechanism requires the source
+    # Secret to sit in flux-system (same namespace as this Kustomization),
+    # which put a live copy of the real PAT in a shared, broadly-readable
+    # namespace. Rejected. The real konnect-auth Secret is applied directly
+    # into the catalog namespace instead (secret.yaml, kubectl apply -f) —
+    # never passes through flux-system.
+    substituteFrom:
+      - kind: ConfigMap
+        name: dataplane-template-defaults