The gateway and policies Kustomizations sat in flux-system, and so did the
Secret carrying the control-plane id. Neither was a governance decision:
postBuild.substituteFrom resolves only in the Kustomization's own
namespace, dataplane-template-defaults existed only in flux-system, so
everything that needed it had to live there too — in a namespace the
feature team has no access to. The team could not touch its own gateway.
k8s-platform now places that ConfigMap in every domain namespace, so the
constraint is gone. Move both Kustomizations and the control-plane
ExternalSecret into the domain namespace; the id no longer transits a
shared namespace either.
sourceRef gets an explicit namespace: flux-system, because it resolves in
the Kustomization's own namespace and k8s-platform is not there. Naming it
beats duplicating the source per domain, and the split is the point —
templates belong to the platform, the Kustomization consuming them belongs
to the team. Verified on catalog first: without this the moved objects
report "GitRepository k8s-platform not found".
Adds the GitRepository this repo never had, reusing the domain's existing
deploy key; that key was verified to read the dataplane repositories,
which also means it is not scoped to one repo.
And the bootstrap Kustomization watching ./dev/api-gateway, so all of it
reconciles from git from now on.
Migration is not a patch: a namespace is immutable, so these objects are
deleted and recreated. Deleting a Kustomization with prune enabled would
take its Gateway, GatewayConfiguration and mirror CR with it, so prune is
turned off on the old objects first and the new ones adopt what is already
running. Done that way on catalog with no pod restart and no Kong entity
lost.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Two hardcoded values tied this repo to one specific Konnect org, and
replacing that org broke both.
CONTROL_PLANE_ID was pasted into gateway-kustomization.yaml. It now
comes from Vault through External Secrets, into a Secret in flux-system
that postBuild.substituteFrom reads. flux-system is acceptable for the
id — it is visible in the Konnect UI URL — but not for the token, which
keeps going straight to the domain namespace as before.
CONTROL_PLANE_REF_NAME held the random suffix the Gateway operator gives
its auto-created mirror CR, looked up by hand. The new org recreated
those CRs under new suffixes, so the ref named an object that no longer
existed and the domain's Kong entities sat Programmed=False. It now
names the ${NAME}-cp mirror declared in k8s-platform's
dataplane-template — derived from NAME, stable across Gateway
recreations and org changes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Stéphane Tailland