From e8c1a48423308d44ce7321f635e53b6a33bb4bb8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Tailland?= <stephane.tailland@ibm.com>
Date: Wed, 19 Aug 2026 18:56:29 +0200
Subject: [PATCH] first commit

---
 README.md | 49 +++++++++++++++++++++++++++++--------------------
 1 file changed, 29 insertions(+), 20 deletions(-)

diff --git a/README.md b/README.md
index 195a8c8..083c662 100644
--- a/README.md
+++ b/README.md
@@ -5,28 +5,37 @@ Layer 2 (Gateway infrastructure) for the **catalog** bounded context
 ID (created by `../konnect-platform`, never recreated here).
 
 **This repo does NOT hold `KonnectAPIAuthConfiguration`/`GatewayConfiguration`/
-`Gateway` YAML directly.** The actual resource template (one copy, covering
-every domain/environment) lives in `../k8s-platform/dataplane-template/`,
-`${VAR}`-parameterized. This repo only holds the values for one
-`<env>/<gateway-type>/` — the Helm-`values.yaml` equivalent:
+`Gateway`/`Certificate` YAML directly.** The actual resource template (one
+copy, covering every domain/environment) lives in
+`../k8s-platform/dataplane-template/`, `${VAR}`-parameterized. This repo
+only holds what's specific to one `<env>/<gateway-type>/` — two files:
 
-- `configmap.yaml` — non-sensitive values (domain, env, namespace, Control
-  Plane ID, image, hostname...).
-- `secret.yaml` — the Konnect PAT. **Gitignored, never committed** — copy
-  `secret.yaml.example` to `secret.yaml` and fill in the real token locally.
 - `kustomization.yaml` — a Flux `Kustomization` CR (not a plain Kustomize
   build file, despite the name) that builds `../k8s-platform/dataplane-template/`
-  from a `GitRepository` source and substitutes values from the ConfigMap
-  and Secret above (`postBuild.substituteFrom`).
+  from the `k8s-platform` `GitRepository` source. Domain-specific
+  non-sensitive values (`NAME`, `NAMESPACE`, `CONTROL_PLANE_ID`, `HOSTNAME`,
+  `TLS_ISSUER_NAME`) are inline under `spec.postBuild.substitute` — no
+  separate ConfigMap to forget to re-apply after an edit (bit us twice
+  before this got simplified). Cluster-wide defaults (`KONNECT_SERVER_URL`,
+  `GATEWAY_IMAGE`, `REPLICAS`, `TLS_ISSUER_KIND`) come from
+  `dataplane-template-defaults`, a ConfigMap shared by every domain, via
+  `substituteFrom`.
+- `externalsecret.yaml` — an `ExternalSecret` (External Secrets Operator)
+  that pulls the Konnect PAT from Vault (`secrets/kong-v2/catalog/dev/konnect-pat`
+  at `https://vault.sttlab.eu`, via the shared `ClusterSecretStore
+  vault-kong-v2`) and materializes it directly as `catalog-dev-konnect-auth`
+  in the `catalog` namespace. **Not part of the substitute/substituteFrom
+  flow above** — Flux's substitution would have required the real PAT to
+  sit in a Secret in `flux-system` (shared, broadly-readable namespace)
+  before landing here, which was rejected. Rotation is now just "update the
+  value in Vault" — `ExternalSecret`'s `refreshInterval` (1h) picks it up
+  automatically, nothing to touch in the cluster or in git.
 
-Content (the ConfigMap/Secret pair) is generated and PR'd automatically
-when the matching Control Plane is created via the self-service flow in
-`../konnect-platform` — never hand-edited directly.
+Content here is generated and PR'd automatically when the matching Control
+Plane is created via the self-service flow in `../konnect-platform` — never
+hand-edited directly.
 
-**Not yet applied/validated**: `kustomization.yaml`'s `sourceRef` points at
-a `GitRepository` named `k8s-platform` that doesn't exist yet — this repo
-has no git remote (see `../STATUS.md`), so `source-controller` has nothing
-to clone. `configmap.yaml` and `secret.yaml` have been applied directly
-(`kubectl apply -f`) to validate they're well-formed, but the actual
-generate-a-Gateway-from-the-template flow hasn't been exercised end-to-end
-yet — that requires the `GitRepository` to exist first.
+**Deployed and validated on the local cluster (2026-08-19)**: full chain
+working end-to-end — `KonnectAPIAuthConfiguration` `Valid: True`, `Gateway`
+`Programmed: True`, a real `DataPlane` pod running, TLS cert issued by the
+`sttlab-local-ca` ClusterIssuer, Konnect PAT synced live from Vault via ESO.