Stéphane Tailland
cc4933c1e8
Two hardcoded values tied this repo to one specific Konnect org, and
replacing that org broke both.
CONTROL_PLANE_ID was pasted into gateway-kustomization.yaml. It now
comes from Vault through External Secrets, into a Secret in flux-system
that postBuild.substituteFrom reads. flux-system is acceptable for the
id — it is visible in the Konnect UI URL — but not for the token, which
keeps going straight to the domain namespace as before.
CONTROL_PLANE_REF_NAME held the random suffix the Gateway operator gives
its auto-created mirror CR, looked up by hand. The new org recreated
those CRs under new suffixes, so the ref named an object that no longer
existed and the domain's Kong entities sat Programmed=False. It now
names the ${NAME}-cp mirror declared in k8s-platform's
dataplane-template — derived from NAME, stable across Gateway
recreations and org changes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
dataplane-payments
Layer 2 (Gateway infrastructure) for the payments bounded context
(domain team: payments) — one Control Plane per environment, referenced by
ID (created manually in Konnect for now, never recreated here:
dc3b2a36-e2ad-4da1-a142-022d0ce6d94e for dev).
Same gateway-kustomization.yaml / externalsecret.yaml /
policies-kustomization.yaml three-file pattern as dataplane-catalog and
dataplane-customers — see dataplane-catalog/README.md for the full
explanation of each file's role, identical here, not repeated. Actual
resource template lives in ../k8s-platform/dataplane-template/ and
../k8s-platform/dataplane-globalpolicy-template/, this repo only holds
what's specific to dev/api-gateway/.
IdP: https://keycloak.sttlab.local/realms/classic-models (local
in-cluster Keycloak), same platform-wide default as catalog/customers
— see ../STATUS.md sections 15/16. JWT_AUDIENCE_WHITELIST is
["payments-api"] only so far; no payments-api Keycloak client/audience
scope exists yet either (Layer 3 not built) — that whitelist entry is
forward-looking, matches nothing real yet.
Only dev/ is real. staging/api-gateway/ and prod/api-gateway/
still hold the original TODO placeholder files, not converted, not
deployed, no Control Plane created for them yet.
This is Layer 2 (Gateway infrastructure) only — no API is actually
reachable through it. Gateway payments-dev: Programmed: True,
DataPlane pod running, TLS cert issued, DNS entry added to
coredns-custom (same manual per-domain step documented in
../STATUS.md section 17 — not automatic). Smoke-tested: 404 (Gateway
answers, nothing routed — correct, expected). No Layer 3 repo
(../payments-api) exists yet; when it does, follow ../customers-api's
structure as the reference, not ../catalog-api's (customers is the more
recently corrected/simpler pattern — REST-only until an MCP layer is
actually needed, single merged MCP route if one is added — see
../STATUS.md section 18 for why).
Self-service pipeline (../konnect-platform generating this content
automatically) does not exist yet — still a stub per ../STATUS.md.
Everything here is hand-maintained.