Layer 2 (Gateway infrastructure) for the catalog bounded context (domain team: catalog) — one Control Plane per environment, referenced by ID (created by ../konnect-platform, never recreated here).

This repo does NOT hold KonnectAPIAuthConfiguration/GatewayConfiguration/ Gateway/Certificate YAML directly. The actual resource template (one copy, covering every domain/environment) lives in ../k8s-platform/dataplane-template/, ${VAR}-parameterized. This repo only holds what's specific to one <env>/<gateway-type>/ — two files:

kustomization.yaml — a Flux Kustomization CR (not a plain Kustomize build file, despite the name) that builds ../k8s-platform/dataplane-template/ from the k8s-platform GitRepository source. Domain-specific non-sensitive values (NAME, NAMESPACE, CONTROL_PLANE_ID, HOSTNAME, TLS_ISSUER_NAME) are inline under spec.postBuild.substitute — no separate ConfigMap to forget to re-apply after an edit (bit us twice before this got simplified). Cluster-wide defaults (KONNECT_SERVER_URL, GATEWAY_IMAGE, REPLICAS, TLS_ISSUER_KIND) come from dataplane-template-defaults, a ConfigMap shared by every domain, via substituteFrom.
externalsecret.yaml — an ExternalSecret (External Secrets Operator) that pulls the Konnect PAT from Vault (secrets/kong-v2/catalog/dev/konnect-pat at https://vault.sttlab.eu, via the shared ClusterSecretStore vault-kong-v2) and materializes it directly as catalog-dev-konnect-auth in the catalog namespace. Not part of the substitute/substituteFrom flow above — Flux's substitution would have required the real PAT to sit in a Secret in flux-system (shared, broadly-readable namespace) before landing here, which was rejected. Rotation is now just "update the value in Vault" — ExternalSecret's refreshInterval (1h) picks it up automatically, nothing to touch in the cluster or in git.

Content here is generated and PR'd automatically when the matching Control Plane is created via the self-service flow in ../konnect-platform — never hand-edited directly.

Deployed and validated on the local cluster (2026-08-19): full chain working end-to-end — KonnectAPIAuthConfiguration Valid: True, Gateway Programmed: True, a real DataPlane pod running, TLS cert issued by the sttlab-local-ca ClusterIssuer, Konnect PAT synced live from Vault via ESO.