Stéphane Tailland
e1a6b67fc3
Two hardcoded values tied this repo to one specific Konnect org, and
replacing that org broke both.
CONTROL_PLANE_ID was pasted into gateway-kustomization.yaml. It now
comes from Vault through External Secrets, into a Secret in flux-system
that postBuild.substituteFrom reads. flux-system is acceptable for the
id — it is visible in the Konnect UI URL — but not for the token, which
keeps going straight to the domain namespace as before.
CONTROL_PLANE_REF_NAME held the random suffix the Gateway operator gives
its auto-created mirror CR, looked up by hand. The new org recreated
those CRs under new suffixes, so the ref named an object that no longer
existed and the domain's Kong entities sat Programmed=False. It now
names the ${NAME}-cp mirror declared in k8s-platform's
dataplane-template — derived from NAME, stable across Gateway
recreations and org changes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
35 lines
1.2 KiB
YAML
35 lines
1.2 KiB
YAML
# The Control Plane id, delivered to flux-system so gateway-kustomization.yaml
|
|
# can substitute it instead of carrying a hardcoded UUID.
|
|
#
|
|
# Why a second ExternalSecret rather than extra keys on the existing one:
|
|
# substituteFrom requires the Secret to sit in the same namespace as the Flux
|
|
# Kustomization, which is flux-system — a shared, broadly-readable namespace.
|
|
# The Konnect token must never go there. A Control Plane id is not a secret;
|
|
# it is visible in the Konnect UI URL.
|
|
#
|
|
# Terraform writes this path (see konnect-platform). Moving to a new Konnect
|
|
# org then needs no edit here at all.
|
|
apiVersion: external-secrets.io/v1
|
|
kind: ExternalSecret
|
|
metadata:
|
|
name: catalog-dev-control-plane
|
|
namespace: flux-system
|
|
spec:
|
|
refreshInterval: 1h
|
|
secretStoreRef:
|
|
kind: ClusterSecretStore
|
|
name: vault-kong-v2
|
|
target:
|
|
name: catalog-dev-control-plane
|
|
data:
|
|
# Key names are the Flux substitution variables verbatim: substituteFrom
|
|
# exposes each key as ${KEY}.
|
|
- secretKey: CONTROL_PLANE_ID
|
|
remoteRef:
|
|
key: kong-v2/catalog/dev/control-plane
|
|
property: CONTROL_PLANE_ID
|
|
- secretKey: CONTROL_PLANE_NAME
|
|
remoteRef:
|
|
key: kong-v2/catalog/dev/control-plane
|
|
property: CONTROL_PLANE_NAME
|