Stéphane Tailland
2.6 KiB
dataplane-customers
Layer 2 (Gateway infrastructure) for the customers bounded context (domain team: customers) — one Control Plane per environment, referenced by ID (created manually in Konnect for now, never recreated here).
This repo does NOT hold KonnectAPIAuthConfiguration/GatewayConfiguration/
Gateway/Certificate YAML directly. The actual resource template (one
copy, covering every domain/environment) lives in
../k8s-platform/dataplane-template/, ${VAR}-parameterized. This repo
only holds what's specific to one <env>/<gateway-type>/ — same
gateway-kustomization.yaml / externalsecret.yaml / policies-kustomization.yaml
three-file pattern as dataplane-catalog (see that repo's README for the
full explanation of each file's role — identical here, not repeated).
IdP: the openid-connect policy's OIDC_ISSUER (in
dev/api-gateway/policies-kustomization.yaml) points at the local
in-cluster Keycloak (ns keycloak, https://keycloak.sttlab.local/realms/classic-models,
deployed 2026-08-23 — config-as-code source in the separate infra-keycloak
repo). Not a customers-specific choice: catalog/classic-models-api/
librechat were migrated to the same local Keycloak the same day (see
../STATUS.md section 15) — the old VPS Keycloak (keycloak.sttlab.eu) is
being phased out platform-wide, customers was just built against the
local one from the start rather than migrated later. The
dataplane-template-defaults ConfigMap's cluster-wide OIDC_ISSUER default
still hasn't been updated to match (still the stale VPS value) — every
domain currently overrides past it individually; see ../STATUS.md
section 16 for that gap.
Only dev/ is real. staging/api-gateway/ and prod/api-gateway/
still hold the original TODO placeholder files (dataplane.yaml,
konnectextension.yaml) from before this pattern existed — not converted,
not deployed, no Control Plane created for them yet.
This is Layer 2 (Gateway infrastructure) only — no API is actually
reachable through it yet. The Layer 3 repo (../customers-api, the
KongService/KongRoute/plugin definitions that would route real traffic
to the backend, same role as ../catalog-api plays for catalog) is
still just two # TODO placeholder files, not deployed — kubectl get kongservice,kongroute -n customers returns nothing. A request to
customers-dev.sttlab.local would 404, not route anywhere.
Self-service pipeline (../konnect-platform generating this content
automatically) does not exist yet — still a stub per ../STATUS.md.
Everything here is hand-maintained, same as dataplane-catalog.