Stéphane Tailland
752d5fd110
Two hardcoded values tied this repo to one specific Konnect org, and
replacing that org broke both.
CONTROL_PLANE_ID was pasted into gateway-kustomization.yaml. It now
comes from Vault through External Secrets, into a Secret in flux-system
that postBuild.substituteFrom reads. flux-system is acceptable for the
id — it is visible in the Konnect UI URL — but not for the token, which
keeps going straight to the domain namespace as before.
CONTROL_PLANE_REF_NAME held the random suffix the Gateway operator gives
its auto-created mirror CR, looked up by hand. The new org recreated
those CRs under new suffixes, so the ref named an object that no longer
existed and the domain's Kong entities sat Programmed=False. It now
names the ${NAME}-cp mirror declared in k8s-platform's
dataplane-template — derived from NAME, stable across Gateway
recreations and org changes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
dataplane-customers
Layer 2 (Gateway infrastructure) for the customers bounded context (domain team: customers) — one Control Plane per environment, referenced by ID (created manually in Konnect for now, never recreated here).
This repo does NOT hold KonnectAPIAuthConfiguration/GatewayConfiguration/
Gateway/Certificate YAML directly. The actual resource template (one
copy, covering every domain/environment) lives in
../k8s-platform/dataplane-template/, ${VAR}-parameterized. This repo
only holds what's specific to one <env>/<gateway-type>/ — same
gateway-kustomization.yaml / externalsecret.yaml / policies-kustomization.yaml
three-file pattern as dataplane-catalog (see that repo's README for the
full explanation of each file's role — identical here, not repeated).
IdP: the openid-connect policy's OIDC_ISSUER (in
dev/api-gateway/policies-kustomization.yaml) points at the local
in-cluster Keycloak (ns keycloak, https://keycloak.sttlab.local/realms/classic-models,
deployed 2026-08-23 — config-as-code source in the separate infra-keycloak
repo). Not a customers-specific choice: catalog/classic-models-api/
librechat were migrated to the same local Keycloak the same day (see
../STATUS.md section 15) — the old VPS Keycloak (keycloak.sttlab.eu) is
being phased out platform-wide, customers was just built against the
local one from the start rather than migrated later. The
dataplane-template-defaults ConfigMap's cluster-wide OIDC_ISSUER default
still hasn't been updated to match (still the stale VPS value) — every
domain currently overrides past it individually; see ../STATUS.md
section 16 for that gap.
Only dev/ is real. staging/api-gateway/ and prod/api-gateway/
still hold the original TODO placeholder files (dataplane.yaml,
konnectextension.yaml) from before this pattern existed — not converted,
not deployed, no Control Plane created for them yet.
This is Layer 2 (Gateway infrastructure) only — no API is actually
reachable through it yet. The Layer 3 repo (../customers-api, the
KongService/KongRoute/plugin definitions that would route real traffic
to the backend, same role as ../catalog-api plays for catalog) is
still just two # TODO placeholder files, not deployed — kubectl get kongservice,kongroute -n customers returns nothing. A request to
customers-dev.sttlab.local would 404, not route anywhere.
Self-service pipeline (../konnect-platform generating this content
automatically) does not exist yet — still a stub per ../STATUS.md.
Everything here is hand-maintained, same as dataplane-catalog.