Stéphane Tailland
27a9dfc037
Moving them into the catalog namespace broke their source: sourceRef resolves in the Kustomization's own namespace, so "k8s-platform" no longer matched anything and both reported GitRepository not found. Name the namespace explicitly rather than duplicating the source per domain. Cross-namespace refs are allowed here — kustomize-controller runs without --no-cross-namespace-refs — and the split is the point: the templates belong to the platform in flux-system, the Kustomization that consumes them belongs to the team in its own namespace. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
48 lines
2.2 KiB
YAML
48 lines
2.2 KiB
YAML
# sourceRef points at the GitRepository "k8s-platform" (created once,
|
|
# flux-system, see ../../../k8s-platform/flux/gitrepository.yaml) — any
|
|
# domain's Kustomization can reference this same object, no monorepo:
|
|
# k8s-platform and dataplane-catalog stay two separate repos, `path` below
|
|
# is relative to the root of whichever repo `sourceRef` names.
|
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
|
kind: Kustomization
|
|
metadata:
|
|
name: catalog-dev-api-gateway
|
|
namespace: catalog
|
|
spec:
|
|
interval: 10m
|
|
sourceRef:
|
|
kind: GitRepository
|
|
name: k8s-platform
|
|
# k8s-platform lives in flux-system: the templates are the platform's,
|
|
# this Kustomization is the team's. sourceRef resolves in the
|
|
# Kustomization's own namespace unless told otherwise, hence the
|
|
# explicit namespace rather than a copy of the source per domain.
|
|
namespace: flux-system
|
|
path: ./dataplane-template
|
|
prune: true
|
|
postBuild:
|
|
# Domain-specific non-sensitive values inline — no separate ConfigMap to
|
|
# forget to re-apply after an edit (bit us twice already). Inline
|
|
# substitute always wins over substituteFrom regardless of order, so
|
|
# this still overrides dataplane-template-defaults where needed.
|
|
substitute:
|
|
NAME: catalog-dev
|
|
NAMESPACE: catalog
|
|
HOSTNAME: catalog-dev.sttlab.local
|
|
# Cluster-wide defaults only — the Konnect PAT is NOT handled via
|
|
# substitute/substituteFrom at all: that mechanism requires the source
|
|
# Secret to sit in flux-system (same namespace as this Kustomization),
|
|
# which put a live copy of the real PAT in a shared, broadly-readable
|
|
# namespace. Rejected. The real konnect-auth Secret is materialized
|
|
# directly into the catalog namespace instead (externalsecret.yaml, via
|
|
# External Secrets Operator + Vault) — never passes through flux-system.
|
|
substituteFrom:
|
|
- kind: ConfigMap
|
|
name: dataplane-template-defaults
|
|
# CONTROL_PLANE_ID comes from Vault via ESO instead of being hardcoded
|
|
# here: a new Konnect org then needs no edit in this repo. Both this
|
|
# Secret and this Kustomization are in the domain namespace now, so the
|
|
# id no longer has to pass through flux-system to be substitutable.
|
|
- kind: Secret
|
|
name: catalog-dev-control-plane
|