# dataplane-sales

Layer 2 (Gateway infrastructure) for the **sales** bounded context
(domain team: sales) — one Control Plane per environment, referenced by
ID (created manually in Konnect for now, never recreated here:
`84a3dd19-7daf-47e6-84ea-9ad5966b91a6` for `dev`).

Same `gateway-kustomization.yaml` / `externalsecret.yaml` /
`policies-kustomization.yaml` three-file pattern as `dataplane-catalog`/
`dataplane-customers`/`dataplane-payments` — see `dataplane-catalog/README.md`
for the full explanation of each file's role, identical here, not
repeated. Actual resource template lives in
`../k8s-platform/dataplane-template/` and
`../k8s-platform/dataplane-globalpolicy-template/`, this repo only holds
what's specific to `dev/api-gateway/`.

**IdP**: `https://keycloak.sttlab.local/realms/classic-models` (local
in-cluster Keycloak), platform-wide default — see `../STATUS.md` sections
15/16. `JWT_AUDIENCE_WHITELIST` set to `["sales-api", "mcp-sales"]` from
the start (both the REST and MCP layers were built in the same pass as
this Layer 2 deploy — see `../STATUS.md` section 22).

**Only `dev/` is real.** `staging/api-gateway/` and `prod/api-gateway/`
still hold the original TODO placeholder files, not converted, not
deployed, no Control Plane created for them yet.

**Layer 3 is real here, unlike some other domains at their Layer-2-only
stage**: `../sales-api` (REST + MCP) was built and deployed the same
session as this Layer 2 repo — `Gateway sales-dev`: `Programmed: True`,
DNS entry added to `coredns-custom` (`sales-dev.sttlab.local` →
the `dataplane-ingress-sales-dev-*` Service `ClusterIP`, same manual
per-domain step documented in `../STATUS.md` section 17), all REST/MCP
routes smoke-tested (`401`, not `404`/`502`).

Self-service pipeline (`../konnect-platform` generating this content
automatically) does not exist yet — still a stub per `../STATUS.md`.
Everything here is hand-maintained.