Deploy sales/dev dataplane (Layer 2), mirroring catalog/customers/payments

Real Konnect Control Plane 84a3dd19-7daf-47e6-84ea-9ad5966b91a6, PAT in Vault (kong-v2/sales/dev/konnect-pat). Replaces the TODO stubs with the proven gateway-kustomization.yaml + externalsecret.yaml + policies-kustomization.yaml pattern. JWT_AUDIENCE_WHITELIST includes mcp-sales from the start since Layer 3 (REST + MCP) was built the same session — see STATUS.md section 22.
2026-08-23 17:05:54 +02:00
parent 82bd38b10a
commit 9079c5ee59
7 changed files with 98 additions and 22 deletions
@@ -1,5 +0,0 @@
-# TODO: DataPlane CRD for sales/dev/api-gateway
-apiVersion: gateway-operator.konghq.com/v1beta1
-kind: DataPlane
-metadata:
-  name: sales-dev
@@ -0,0 +1,22 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: sales-dev-konnect-auth
+  namespace: sales
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kong-v2
+  target:
+    name: sales-dev-konnect-auth
+    template:
+      metadata:
+        labels:
+          konghq.com/credential: konnect
+          konghq.com/secret: "true"
+  data:
+    - secretKey: token
+      remoteRef:
+        key: kong-v2/sales/dev/konnect-pat
+        property: token
@@ -0,0 +1,21 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: sales-dev-api-gateway
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: k8s-platform
+  path: ./dataplane-template
+  prune: true
+  postBuild:
+    substitute:
+      NAME: sales-dev
+      NAMESPACE: sales
+      CONTROL_PLANE_ID: "84a3dd19-7daf-47e6-84ea-9ad5966b91a6"
+      HOSTNAME: sales-dev.sttlab.local
+    substituteFrom:
+      - kind: ConfigMap
+        name: dataplane-template-defaults
@@ -1,6 +0,0 @@
-# TODO: KonnectExtension referencing the Control Plane created by
-# konnect-platform/domains/sales/dev/ (by ID, not created here)
-apiVersion: konnect.konghq.com/v1alpha1
-kind: KonnectExtension
-metadata:
-  name: sales-dev
@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - dataplane.yaml
-  - konnectextension.yaml
@@ -0,0 +1,22 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: sales-dev-api-gateway-policies
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: k8s-platform
+  path: ./dataplane-globalpolicy-template
+  prune: true
+  postBuild:
+    substitute:
+      NAME: sales-dev
+      NAMESPACE: sales
+      CONTROL_PLANE_REF_NAME: sales-dev-pjdc7
+      JWT_AUDIENCE_WHITELIST: '["sales-api", "mcp-sales"]'
+      OIDC_ISSUER: https://keycloak.sttlab.local/realms/classic-models
+    substituteFrom:
+      - kind: ConfigMap
+        name: dataplane-template-defaults