Moving them into the catalog namespace broke their source: sourceRef
resolves in the Kustomization's own namespace, so "k8s-platform" no longer
matched anything and both reported GitRepository not found.
Name the namespace explicitly rather than duplicating the source per
domain. Cross-namespace refs are allowed here — kustomize-controller runs
without --no-cross-namespace-refs — and the split is the point: the
templates belong to the platform in flux-system, the Kustomization that
consumes them belongs to the team in its own namespace.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The gateway and policies Kustomizations sat in flux-system, and so did the
Secret carrying the control-plane id. Neither was a governance decision:
postBuild.substituteFrom resolves only in the Kustomization's own
namespace, dataplane-template-defaults existed only in flux-system, so
everything that needed it had to live there too — in a namespace the
feature team has no access to. The team could not touch its own gateway.
k8s-platform now places that ConfigMap in every domain namespace, so the
constraint is gone. Move both Kustomizations and the control-plane
ExternalSecret to catalog. The id no longer transits a shared namespace
either, which was a compromise this repo documented rather than liked.
Adds the GitRepository this repo never had — its Kustomizations point at
k8s-platform for templates, and nothing needed to read the repo that
declares them, because those declarations were applied by hand. It reuses
the domain's existing deploy key rather than minting one; verified that
the key reads this repository. Worth knowing what that implies: the key is
not scoped to a single repo, so the isolation its per-repo name suggests
does not exist.
And the bootstrap Kustomization that watches ./dev/api-gateway, so all of
it reconciles from git from now on.
Migration is not a patch: a namespace is immutable, so the existing
objects have to be deleted and recreated. Deleting a Kustomization with
prune enabled would take its Gateway, GatewayConfiguration and mirror CR
with it, so prune has to be turned off on the old objects first, then the
new ones adopt what is already running.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Two hardcoded values tied this repo to one specific Konnect org, and
replacing that org broke both.
CONTROL_PLANE_ID was pasted into gateway-kustomization.yaml. It now
comes from Vault through External Secrets, into a Secret in flux-system
that postBuild.substituteFrom reads. flux-system is acceptable for the
id — it is visible in the Konnect UI URL — but not for the token, which
keeps going straight to the domain namespace as before.
CONTROL_PLANE_REF_NAME held the random suffix the Gateway operator gives
its auto-created mirror CR, looked up by hand. The new org recreated
those CRs under new suffixes, so the ref named an object that no longer
existed and the domain's Kong entities sat Programmed=False. It now
names the ${NAME}-cp mirror declared in k8s-platform's
dataplane-template — derived from NAME, stable across Gateway
recreations and org changes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Stéphane Tailland