Stéphane Tailland
42 lines
2.4 KiB
Markdown
42 lines
2.4 KiB
Markdown
# dataplane-catalog
|
|
|
|
Layer 2 (Gateway infrastructure) for the **catalog** bounded context
|
|
(domain team: catalog) — one Control Plane per environment, referenced by
|
|
ID (created by `../konnect-platform`, never recreated here).
|
|
|
|
**This repo does NOT hold `KonnectAPIAuthConfiguration`/`GatewayConfiguration`/
|
|
`Gateway`/`Certificate` YAML directly.** The actual resource template (one
|
|
copy, covering every domain/environment) lives in
|
|
`../k8s-platform/dataplane-template/`, `${VAR}`-parameterized. This repo
|
|
only holds what's specific to one `<env>/<gateway-type>/` — two files:
|
|
|
|
- `kustomization.yaml` — a Flux `Kustomization` CR (not a plain Kustomize
|
|
build file, despite the name) that builds `../k8s-platform/dataplane-template/`
|
|
from the `k8s-platform` `GitRepository` source. Domain-specific
|
|
non-sensitive values (`NAME`, `NAMESPACE`, `CONTROL_PLANE_ID`, `HOSTNAME`,
|
|
`TLS_ISSUER_NAME`) are inline under `spec.postBuild.substitute` — no
|
|
separate ConfigMap to forget to re-apply after an edit (bit us twice
|
|
before this got simplified). Cluster-wide defaults (`KONNECT_SERVER_URL`,
|
|
`GATEWAY_IMAGE`, `REPLICAS`, `TLS_ISSUER_KIND`) come from
|
|
`dataplane-template-defaults`, a ConfigMap shared by every domain, via
|
|
`substituteFrom`.
|
|
- `externalsecret.yaml` — an `ExternalSecret` (External Secrets Operator)
|
|
that pulls the Konnect PAT from Vault (`secrets/kong-v2/catalog/dev/konnect-pat`
|
|
at `https://vault.sttlab.eu`, via the shared `ClusterSecretStore
|
|
vault-kong-v2`) and materializes it directly as `catalog-dev-konnect-auth`
|
|
in the `catalog` namespace. **Not part of the substitute/substituteFrom
|
|
flow above** — Flux's substitution would have required the real PAT to
|
|
sit in a Secret in `flux-system` (shared, broadly-readable namespace)
|
|
before landing here, which was rejected. Rotation is now just "update the
|
|
value in Vault" — `ExternalSecret`'s `refreshInterval` (1h) picks it up
|
|
automatically, nothing to touch in the cluster or in git.
|
|
|
|
Content here is generated and PR'd automatically when the matching Control
|
|
Plane is created via the self-service flow in `../konnect-platform` — never
|
|
hand-edited directly.
|
|
|
|
**Deployed and validated on the local cluster (2026-08-19)**: full chain
|
|
working end-to-end — `KonnectAPIAuthConfiguration` `Valid: True`, `Gateway`
|
|
`Programmed: True`, a real `DataPlane` pod running, TLS cert issued by the
|
|
`sttlab-local-ca` ClusterIssuer, Konnect PAT synced live from Vault via ESO.
|