# sourceRef points at the GitRepository "k8s-platform" (created once,
# flux-system, see ../../../k8s-platform/flux/gitrepository.yaml) — any
# domain's Kustomization can reference this same object, no monorepo:
# k8s-platform and dataplane-catalog stay two separate repos, `path` below
# is relative to the root of whichever repo `sourceRef` names.
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: catalog-dev-api-gateway
  namespace: catalog
spec:
  interval: 10m
  sourceRef:
    kind: GitRepository
    name: k8s-platform
    # k8s-platform lives in flux-system: the templates are the platform's,
    # this Kustomization is the team's. sourceRef resolves in the
    # Kustomization's own namespace unless told otherwise, hence the
    # explicit namespace rather than a copy of the source per domain.
    namespace: flux-system
  path: ./dataplane-template
  prune: true
  postBuild:
    # Domain-specific non-sensitive values inline — no separate ConfigMap to
    # forget to re-apply after an edit (bit us twice already). Inline
    # substitute always wins over substituteFrom regardless of order, so
    # this still overrides dataplane-template-defaults where needed.
    substitute:
      NAME: catalog-dev
      NAMESPACE: catalog
      HOSTNAME: catalog-dev.sttlab.local
    # Cluster-wide defaults only — the Konnect PAT is NOT handled via
    # substitute/substituteFrom at all: that mechanism requires the source
    # Secret to sit in flux-system (same namespace as this Kustomization),
    # which put a live copy of the real PAT in a shared, broadly-readable
    # namespace. Rejected. The real konnect-auth Secret is materialized
    # directly into the catalog namespace instead (externalsecret.yaml, via
    # External Secrets Operator + Vault) — never passes through flux-system.
    substituteFrom:
      - kind: ConfigMap
        name: dataplane-template-defaults
      # CONTROL_PLANE_ID comes from Vault via ESO instead of being hardcoded
      # here: a new Konnect org then needs no edit in this repo. Both this
      # Secret and this Kustomization are in the domain namespace now, so the
      # id no longer has to pass through flux-system to be substitutable.
      - kind: Secret
        name: catalog-dev-control-plane