Stéphane Tailland
9079c5ee59
Real Konnect Control Plane 84a3dd19-7daf-47e6-84ea-9ad5966b91a6, PAT in Vault (kong-v2/sales/dev/konnect-pat). Replaces the TODO stubs with the proven gateway-kustomization.yaml + externalsecret.yaml + policies-kustomization.yaml pattern. JWT_AUDIENCE_WHITELIST includes mcp-sales from the start since Layer 3 (REST + MCP) was built the same session — see STATUS.md section 22.
dataplane-sales
Layer 2 (Gateway infrastructure) for the sales bounded context
(domain team: sales) — one Control Plane per environment, referenced by
ID (created manually in Konnect for now, never recreated here:
84a3dd19-7daf-47e6-84ea-9ad5966b91a6 for dev).
Same gateway-kustomization.yaml / externalsecret.yaml /
policies-kustomization.yaml three-file pattern as dataplane-catalog/
dataplane-customers/dataplane-payments — see dataplane-catalog/README.md
for the full explanation of each file's role, identical here, not
repeated. Actual resource template lives in
../k8s-platform/dataplane-template/ and
../k8s-platform/dataplane-globalpolicy-template/, this repo only holds
what's specific to dev/api-gateway/.
IdP: https://keycloak.sttlab.local/realms/classic-models (local
in-cluster Keycloak), platform-wide default — see ../STATUS.md sections
15/16. JWT_AUDIENCE_WHITELIST set to ["sales-api", "mcp-sales"] from
the start (both the REST and MCP layers were built in the same pass as
this Layer 2 deploy — see ../STATUS.md section 22).
Only dev/ is real. staging/api-gateway/ and prod/api-gateway/
still hold the original TODO placeholder files, not converted, not
deployed, no Control Plane created for them yet.
Layer 3 is real here, unlike some other domains at their Layer-2-only
stage: ../sales-api (REST + MCP) was built and deployed the same
session as this Layer 2 repo — Gateway sales-dev: Programmed: True,
DNS entry added to coredns-custom (sales-dev.sttlab.local →
the dataplane-ingress-sales-dev-* Service ClusterIP, same manual
per-domain step documented in ../STATUS.md section 17), all REST/MCP
routes smoke-tested (401, not 404/502).
Self-service pipeline (../konnect-platform generating this content
automatically) does not exist yet — still a stub per ../STATUS.md.
Everything here is hand-maintained.