# dataplane-payments

Layer 2 (Gateway infrastructure) for the **payments** bounded context
(domain team: payments) — one Control Plane per environment, referenced by
ID (created manually in Konnect for now, never recreated here:
`dc3b2a36-e2ad-4da1-a142-022d0ce6d94e` for `dev`).

Same `gateway-kustomization.yaml` / `externalsecret.yaml` /
`policies-kustomization.yaml` three-file pattern as `dataplane-catalog` and
`dataplane-customers` — see `dataplane-catalog/README.md` for the full
explanation of each file's role, identical here, not repeated. Actual
resource template lives in `../k8s-platform/dataplane-template/` and
`../k8s-platform/dataplane-globalpolicy-template/`, this repo only holds
what's specific to `dev/api-gateway/`.

**IdP**: `https://keycloak.sttlab.local/realms/classic-models` (local
in-cluster Keycloak), same platform-wide default as `catalog`/`customers`
— see `../STATUS.md` sections 15/16. `JWT_AUDIENCE_WHITELIST` is
`["payments-api"]` only so far; no `payments-api` Keycloak client/audience
scope exists yet either (Layer 3 not built) — that whitelist entry is
forward-looking, matches nothing real yet.

**Only `dev/` is real.** `staging/api-gateway/` and `prod/api-gateway/`
still hold the original TODO placeholder files, not converted, not
deployed, no Control Plane created for them yet.

**This is Layer 2 (Gateway infrastructure) only — no API is actually
reachable through it.** `Gateway payments-dev`: `Programmed: True`,
DataPlane pod running, TLS cert issued, DNS entry added to
`coredns-custom` (same manual per-domain step documented in
`../STATUS.md` section 17 — not automatic). Smoke-tested: `404` (Gateway
answers, nothing routed — correct, expected). No Layer 3 repo
(`../payments-api`) exists yet; when it does, follow `../customers-api`'s
structure as the reference, not `../catalog-api`'s (customers is the more
recently corrected/simpler pattern — REST-only until an MCP layer is
actually needed, single merged MCP route if one is added — see
`../STATUS.md` section 18 for why).

Self-service pipeline (`../konnect-platform` generating this content
automatically) does not exist yet — still a stub per `../STATUS.md`.
Everything here is hand-maintained.