Stéphane Tailland
752d5fd110
Two hardcoded values tied this repo to one specific Konnect org, and
replacing that org broke both.
CONTROL_PLANE_ID was pasted into gateway-kustomization.yaml. It now
comes from Vault through External Secrets, into a Secret in flux-system
that postBuild.substituteFrom reads. flux-system is acceptable for the
id — it is visible in the Konnect UI URL — but not for the token, which
keeps going straight to the domain namespace as before.
CONTROL_PLANE_REF_NAME held the random suffix the Gateway operator gives
its auto-created mirror CR, looked up by hand. The new org recreated
those CRs under new suffixes, so the ref named an object that no longer
existed and the domain's Kong entities sat Programmed=False. It now
names the ${NAME}-cp mirror declared in k8s-platform's
dataplane-template — derived from NAME, stable across Gateway
recreations and org changes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
39 lines
1.7 KiB
YAML
39 lines
1.7 KiB
YAML
# Split from gateway-kustomization.yaml on purpose: different change
|
|
# cadence (policies get tuned far more often than the Gateway itself gets
|
|
# recreated) and different blast radius (a bad policy build/prune can't
|
|
# touch the Gateway/DataPlane, and vice versa). Same GitRepository, same
|
|
# domain namespace, different path.
|
|
apiVersion: kustomize.toolkit.fluxcd.io/v1
|
|
kind: Kustomization
|
|
metadata:
|
|
name: customers-dev-api-gateway-policies
|
|
namespace: flux-system
|
|
spec:
|
|
interval: 10m
|
|
sourceRef:
|
|
kind: GitRepository
|
|
name: k8s-platform
|
|
path: ./dataplane-globalpolicy-template
|
|
prune: true
|
|
postBuild:
|
|
substitute:
|
|
NAME: customers-dev
|
|
NAMESPACE: customers
|
|
# Stable by construction: the mirror CR is declared with this derived
|
|
# name in k8s-platform/dataplane-template/controlplane-mirror.yaml, so
|
|
# it no longer has to be looked up after each Gateway reconcile.
|
|
CONTROL_PLANE_REF_NAME: customers-dev-cp
|
|
# Every audience valid anywhere in the customers domain — grows as the
|
|
# domain gains APIs. mcp-customers added 2026-08-23 alongside the
|
|
# customers-mcp Kong layer (customers-api/kong/mcp/).
|
|
JWT_AUDIENCE_WHITELIST: '["customers-api", "mcp-customers"]'
|
|
# OIDC_ISSUER override, not dataplane-template-defaults' stale VPS
|
|
# value — the local in-cluster Keycloak (ns keycloak,
|
|
# keycloak.sttlab.local/realms/classic-models) is the platform-wide
|
|
# IdP now (see ../../../STATUS.md sections 15/16), confirmed
|
|
# reachable in-cluster before wiring this in.
|
|
OIDC_ISSUER: https://keycloak.sttlab.local/realms/classic-models
|
|
substituteFrom:
|
|
- kind: ConfigMap
|
|
name: dataplane-template-defaults
|