Layer 2 (Gateway infrastructure) for the customers bounded context (domain team: customers) — one Control Plane per environment, referenced by ID (created manually in Konnect for now, never recreated here).

This repo does NOT hold KonnectAPIAuthConfiguration/GatewayConfiguration/ Gateway/Certificate YAML directly. The actual resource template (one copy, covering every domain/environment) lives in ../k8s-platform/dataplane-template/, ${VAR}-parameterized. This repo only holds what's specific to one <env>/<gateway-type>/ — same gateway-kustomization.yaml / externalsecret.yaml / policies-kustomization.yaml three-file pattern as dataplane-catalog (see that repo's README for the full explanation of each file's role — identical here, not repeated).

IdP: the openid-connect policy's OIDC_ISSUER (in dev/api-gateway/policies-kustomization.yaml) points at the local in-cluster Keycloak (ns keycloak, https://keycloak.sttlab.local/realms/classic-models, deployed 2026-08-23 — config-as-code source in the separate infra-keycloak repo). Not a customers-specific choice: catalog/classic-models-api/ librechat were migrated to the same local Keycloak the same day (see ../STATUS.md section 15) — the old VPS Keycloak (keycloak.sttlab.eu) is being phased out platform-wide, customers was just built against the local one from the start rather than migrated later. The dataplane-template-defaults ConfigMap's cluster-wide OIDC_ISSUER default still hasn't been updated to match (still the stale VPS value) — every domain currently overrides past it individually; see ../STATUS.md section 16 for that gap.

Only dev/ is real. staging/api-gateway/ and prod/api-gateway/ still hold the original TODO placeholder files (dataplane.yaml, konnectextension.yaml) from before this pattern existed — not converted, not deployed, no Control Plane created for them yet.

This is Layer 2 (Gateway infrastructure) only — no API is actually reachable through it yet. The Layer 3 repo (../customers-api, the KongService/KongRoute/plugin definitions that would route real traffic to the backend, same role as ../catalog-api plays for catalog) is still just two # TODO placeholder files, not deployed — kubectl get kongservice,kongroute -n customers returns nothing. A request to customers-dev.sttlab.local would 404, not route anywhere.

Self-service pipeline (../konnect-platform generating this content automatically) does not exist yet — still a stub per ../STATUS.md. Everything here is hand-maintained, same as dataplane-catalog.