first commit

.gitignore

@@ -0,0 +1,4 @@
+.DS_Store
+*.swp
+
+**/secret.yaml

README.md

@@ -1,10 +1,32 @@
 # dataplane-catalog
 
 Layer 2 (Gateway infrastructure) for the **catalog** bounded context
-(domain team: catalog). `DataPlane`, `KonnectExtension`, certs (cert-manager),
-secrets (External Secrets Operator) — one Control Plane per environment,
-referenced by ID (created by `../konnect-platform`, never recreated here).
+(domain team: catalog) — one Control Plane per environment, referenced by
+ID (created by `../konnect-platform`, never recreated here).
 
-Content is generated and PR'd automatically when the matching Control
-Plane is created via the self-service flow in `../konnect-platform` —
-never hand-edited directly.
+**This repo does NOT hold `KonnectAPIAuthConfiguration`/`GatewayConfiguration`/
+`Gateway` YAML directly.** The actual resource template (one copy, covering
+every domain/environment) lives in `../k8s-platform/dataplane-template/`,
+`${VAR}`-parameterized. This repo only holds the values for one
+`<env>/<gateway-type>/` — the Helm-`values.yaml` equivalent:
+
+- `configmap.yaml` — non-sensitive values (domain, env, namespace, Control
+  Plane ID, image, hostname...).
+- `secret.yaml` — the Konnect PAT. **Gitignored, never committed** — copy
+  `secret.yaml.example` to `secret.yaml` and fill in the real token locally.
+- `kustomization.yaml` — a Flux `Kustomization` CR (not a plain Kustomize
+  build file, despite the name) that builds `../k8s-platform/dataplane-template/`
+  from a `GitRepository` source and substitutes values from the ConfigMap
+  and Secret above (`postBuild.substituteFrom`).
+
+Content (the ConfigMap/Secret pair) is generated and PR'd automatically
+when the matching Control Plane is created via the self-service flow in
+`../konnect-platform` — never hand-edited directly.
+
+**Not yet applied/validated**: `kustomization.yaml`'s `sourceRef` points at
+a `GitRepository` named `k8s-platform` that doesn't exist yet — this repo
+has no git remote (see `../STATUS.md`), so `source-controller` has nothing
+to clone. `configmap.yaml` and `secret.yaml` have been applied directly
+(`kubectl apply -f`) to validate they're well-formed, but the actual
+generate-a-Gateway-from-the-template flow hasn't been exercised end-to-end
+yet — that requires the `GitRepository` to exist first.

dev/api-gateway/dataplane.yaml

@@ -1,5 +0,0 @@
-# TODO: DataPlane CRD for catalog/dev/api-gateway
-apiVersion: gateway-operator.konghq.com/v1beta1
-kind: DataPlane
-metadata:
-  name: catalog-dev

dev/api-gateway/externalsecret.yaml

@@ -0,0 +1,27 @@
+# Replaces the manually-applied secret.yaml — the real PAT now lives only
+# in Vault (secrets/kong-v2/catalog/dev/konnect-pat), never in git, never
+# manually kubectl-applied again. refreshInterval controls how often ESO
+# re-checks Vault and re-syncs the K8s Secret if the value changed there —
+# rotation becomes "update Vault", nothing to touch in the cluster.
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: catalog-dev-konnect-auth
+  namespace: catalog
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kong-v2
+  target:
+    name: catalog-dev-konnect-auth
+    template:
+      metadata:
+        labels:
+          konghq.com/credential: konnect
+          konghq.com/secret: "true"
+  data:
+    - secretKey: token
+      remoteRef:
+        key: kong-v2/catalog/dev/konnect-pat
+        property: token

dev/api-gateway/konnectextension.yaml

@@ -1,6 +0,0 @@
-# TODO: KonnectExtension referencing the Control Plane created by
-# konnect-platform/domains/catalog/dev/ (by ID, not created here)
-apiVersion: konnect.konghq.com/v1alpha1
-kind: KonnectExtension
-metadata:
-  name: catalog-dev

dev/api-gateway/kustomization.yaml

@@ -1,5 +1,38 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
+# sourceRef points at the GitRepository "k8s-platform" (created once,
+# flux-system, see ../../../k8s-platform/flux/gitrepository.yaml) — any
+# domain's Kustomization can reference this same object, no monorepo:
+# k8s-platform and dataplane-catalog stay two separate repos, `path` below
+# is relative to the root of whichever repo `sourceRef` names.
+apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
-resources:
-  - dataplane.yaml
-  - konnectextension.yaml
+metadata:
+  name: catalog-dev-api-gateway
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: k8s-platform
+  path: ./dataplane-template
+  prune: true
+  postBuild:
+    # Domain-specific non-sensitive values inline — no separate ConfigMap to
+    # forget to re-apply after an edit (bit us twice already). Inline
+    # substitute always wins over substituteFrom regardless of order, so
+    # this still overrides dataplane-template-defaults where needed.
+    substitute:
+      NAME: catalog-dev
+      NAMESPACE: catalog
+      CONTROL_PLANE_ID: "7a1e7127-0a02-4d09-b1dd-2efc865e9e97"
+      HOSTNAME: catalog-dev.sttlab.local
+      TLS_ISSUER_NAME: sttlab-local-ca
+    # Cluster-wide defaults only — the Konnect PAT is NOT handled via
+    # substitute/substituteFrom at all: that mechanism requires the source
+    # Secret to sit in flux-system (same namespace as this Kustomization),
+    # which put a live copy of the real PAT in a shared, broadly-readable
+    # namespace. Rejected. The real konnect-auth Secret is applied directly
+    # into the catalog namespace instead (secret.yaml, kubectl apply -f) —
+    # never passes through flux-system.
+    substituteFrom:
+      - kind: ConfigMap
+        name: dataplane-template-defaults