Stéphane Tailland
8596514e42
Real Konnect Control Plane dc3b2a36-e2ad-4da1-a142-022d0ce6d94e, PAT in Vault (kong-v2/payments/dev/konnect-pat). Replaces the TODO stubs with the proven gateway-kustomization.yaml + externalsecret.yaml + policies-kustomization.yaml pattern. IdP is the local Keycloak from the start (platform default now, see STATUS.md 15/16), not the VPS. Layer 3 (payments-api) not started — Gateway answers 404, nothing routed yet.
dataplane-payments
Layer 2 (Gateway infrastructure) for the payments bounded context
(domain team: payments) — one Control Plane per environment, referenced by
ID (created manually in Konnect for now, never recreated here:
dc3b2a36-e2ad-4da1-a142-022d0ce6d94e for dev).
Same gateway-kustomization.yaml / externalsecret.yaml /
policies-kustomization.yaml three-file pattern as dataplane-catalog and
dataplane-customers — see dataplane-catalog/README.md for the full
explanation of each file's role, identical here, not repeated. Actual
resource template lives in ../k8s-platform/dataplane-template/ and
../k8s-platform/dataplane-globalpolicy-template/, this repo only holds
what's specific to dev/api-gateway/.
IdP: https://keycloak.sttlab.local/realms/classic-models (local
in-cluster Keycloak), same platform-wide default as catalog/customers
— see ../STATUS.md sections 15/16. JWT_AUDIENCE_WHITELIST is
["payments-api"] only so far; no payments-api Keycloak client/audience
scope exists yet either (Layer 3 not built) — that whitelist entry is
forward-looking, matches nothing real yet.
Only dev/ is real. staging/api-gateway/ and prod/api-gateway/
still hold the original TODO placeholder files, not converted, not
deployed, no Control Plane created for them yet.
This is Layer 2 (Gateway infrastructure) only — no API is actually
reachable through it. Gateway payments-dev: Programmed: True,
DataPlane pod running, TLS cert issued, DNS entry added to
coredns-custom (same manual per-domain step documented in
../STATUS.md section 17 — not automatic). Smoke-tested: 404 (Gateway
answers, nothing routed — correct, expected). No Layer 3 repo
(../payments-api) exists yet; when it does, follow ../customers-api's
structure as the reference, not ../catalog-api's (customers is the more
recently corrected/simpler pattern — REST-only until an MCP layer is
actually needed, single merged MCP route if one is added — see
../STATUS.md section 18 for why).
Self-service pipeline (../konnect-platform generating this content
automatically) does not exist yet — still a stub per ../STATUS.md.
Everything here is hand-maintained.