Stéphane Tailland
27a9dfc037
Moving them into the catalog namespace broke their source: sourceRef resolves in the Kustomization's own namespace, so "k8s-platform" no longer matched anything and both reported GitRepository not found. Name the namespace explicitly rather than duplicating the source per domain. Cross-namespace refs are allowed here — kustomize-controller runs without --no-cross-namespace-refs — and the split is the point: the templates belong to the platform in flux-system, the Kustomization that consumes them belongs to the team in its own namespace. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
dataplane-catalog
Layer 2 (Gateway infrastructure) for the catalog bounded context
(domain team: catalog) — one Control Plane per environment, referenced by
ID (created by ../konnect-platform, never recreated here).
This repo does NOT hold KonnectAPIAuthConfiguration/GatewayConfiguration/
Gateway/Certificate YAML directly. The actual resource template (one
copy, covering every domain/environment) lives in
../k8s-platform/dataplane-template/, ${VAR}-parameterized. This repo
only holds what's specific to one <env>/<gateway-type>/ — two files:
kustomization.yaml— a FluxKustomizationCR (not a plain Kustomize build file, despite the name) that builds../k8s-platform/dataplane-template/from thek8s-platformGitRepositorysource. Domain-specific non-sensitive values (NAME,NAMESPACE,CONTROL_PLANE_ID,HOSTNAME,TLS_ISSUER_NAME) are inline underspec.postBuild.substitute— no separate ConfigMap to forget to re-apply after an edit (bit us twice before this got simplified). Cluster-wide defaults (KONNECT_SERVER_URL,GATEWAY_IMAGE,REPLICAS,TLS_ISSUER_KIND) come fromdataplane-template-defaults, a ConfigMap shared by every domain, viasubstituteFrom.externalsecret.yaml— anExternalSecret(External Secrets Operator) that pulls the Konnect PAT from Vault (secrets/kong-v2/catalog/dev/konnect-patathttps://vault.sttlab.eu, via the sharedClusterSecretStore vault-kong-v2) and materializes it directly ascatalog-dev-konnect-authin thecatalognamespace. Not part of the substitute/substituteFrom flow above — Flux's substitution would have required the real PAT to sit in a Secret influx-system(shared, broadly-readable namespace) before landing here, which was rejected. Rotation is now just "update the value in Vault" —ExternalSecret'srefreshInterval(1h) picks it up automatically, nothing to touch in the cluster or in git.