Stéphane Tailland
e1a6b67fc3
Two hardcoded values tied this repo to one specific Konnect org, and
replacing that org broke both.
CONTROL_PLANE_ID was pasted into gateway-kustomization.yaml. It now
comes from Vault through External Secrets, into a Secret in flux-system
that postBuild.substituteFrom reads. flux-system is acceptable for the
id — it is visible in the Konnect UI URL — but not for the token, which
keeps going straight to the domain namespace as before.
CONTROL_PLANE_REF_NAME held the random suffix the Gateway operator gives
its auto-created mirror CR, looked up by hand. The new org recreated
those CRs under new suffixes, so the ref named an object that no longer
existed and the domain's Kong entities sat Programmed=False. It now
names the ${NAME}-cp mirror declared in k8s-platform's
dataplane-template — derived from NAME, stable across Gateway
recreations and org changes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
43 lines
1.9 KiB
YAML
43 lines
1.9 KiB
YAML
# sourceRef points at the GitRepository "k8s-platform" (created once,
|
|
# flux-system, see ../../../k8s-platform/flux/gitrepository.yaml) — any
|
|
# domain's Kustomization can reference this same object, no monorepo:
|
|
# k8s-platform and dataplane-catalog stay two separate repos, `path` below
|
|
# is relative to the root of whichever repo `sourceRef` names.
|
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
|
kind: Kustomization
|
|
metadata:
|
|
name: catalog-dev-api-gateway
|
|
namespace: flux-system
|
|
spec:
|
|
interval: 10m
|
|
sourceRef:
|
|
kind: GitRepository
|
|
name: k8s-platform
|
|
path: ./dataplane-template
|
|
prune: true
|
|
postBuild:
|
|
# Domain-specific non-sensitive values inline — no separate ConfigMap to
|
|
# forget to re-apply after an edit (bit us twice already). Inline
|
|
# substitute always wins over substituteFrom regardless of order, so
|
|
# this still overrides dataplane-template-defaults where needed.
|
|
substitute:
|
|
NAME: catalog-dev
|
|
NAMESPACE: catalog
|
|
HOSTNAME: catalog-dev.sttlab.local
|
|
# Cluster-wide defaults only — the Konnect PAT is NOT handled via
|
|
# substitute/substituteFrom at all: that mechanism requires the source
|
|
# Secret to sit in flux-system (same namespace as this Kustomization),
|
|
# which put a live copy of the real PAT in a shared, broadly-readable
|
|
# namespace. Rejected. The real konnect-auth Secret is materialized
|
|
# directly into the catalog namespace instead (externalsecret.yaml, via
|
|
# External Secrets Operator + Vault) — never passes through flux-system.
|
|
substituteFrom:
|
|
- kind: ConfigMap
|
|
name: dataplane-template-defaults
|
|
# CONTROL_PLANE_ID comes from Vault via ESO instead of being hardcoded
|
|
# here: a new Konnect org then needs no edit in this repo. Not a secret —
|
|
# the id is visible in the Konnect UI URL — so flux-system is fine for it,
|
|
# unlike the token.
|
|
- kind: Secret
|
|
name: catalog-dev-control-plane
|