From effdae10833b81d3d387bbf778371546a364e413 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Tailland?= Date: Sun, 23 Aug 2026 17:13:34 +0200 Subject: [PATCH] Deploy workforce/dev dataplane (Layer 2), mirroring the other domains MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Real Konnect Control Plane 1dbd741c-0da2-4718-8c72-6f479530b371, PAT in Vault. Replaces the TODO stubs with the proven three-file pattern. JWT_AUDIENCE_WHITELIST includes mcp-workforce from the start since Layer 3 was built the same session — see STATUS.md section 23. --- README.md | 36 +++++++++++++++++---- dev/api-gateway/dataplane.yaml | 5 --- dev/api-gateway/externalsecret.yaml | 22 +++++++++++++ dev/api-gateway/gateway-kustomization.yaml | 21 ++++++++++++ dev/api-gateway/konnectextension.yaml | 6 ---- dev/api-gateway/kustomization.yaml | 5 --- dev/api-gateway/policies-kustomization.yaml | 22 +++++++++++++ 7 files changed, 95 insertions(+), 22 deletions(-) delete mode 100644 dev/api-gateway/dataplane.yaml create mode 100644 dev/api-gateway/externalsecret.yaml create mode 100644 dev/api-gateway/gateway-kustomization.yaml delete mode 100644 dev/api-gateway/konnectextension.yaml delete mode 100644 dev/api-gateway/kustomization.yaml create mode 100644 dev/api-gateway/policies-kustomization.yaml diff --git a/README.md b/README.md index 40dd386..21411d6 100644 --- a/README.md +++ b/README.md @@ -1,10 +1,34 @@ # dataplane-workforce Layer 2 (Gateway infrastructure) for the **workforce** bounded context -(domain team: workforce). `DataPlane`, `KonnectExtension`, certs (cert-manager), -secrets (External Secrets Operator) — one Control Plane per environment, -referenced by ID (created by `../konnect-platform`, never recreated here). +(domain team: workforce) — one Control Plane per environment, referenced +by ID (created manually in Konnect for now, never recreated here: +`1dbd741c-0da2-4718-8c72-6f479530b371` for `dev`). -Content is generated and PR'd automatically when the matching Control -Plane is created via the self-service flow in `../konnect-platform` — -never hand-edited directly. +Same `gateway-kustomization.yaml` / `externalsecret.yaml` / +`policies-kustomization.yaml` three-file pattern as `dataplane-catalog`/ +`dataplane-customers`/`dataplane-payments`/`dataplane-sales` — see +`dataplane-catalog/README.md` for the full explanation of each file's +role, identical here, not repeated. + +**IdP**: `https://keycloak.sttlab.local/realms/classic-models` (local +in-cluster Keycloak), platform-wide default — see `../STATUS.md` sections +15/16. `JWT_AUDIENCE_WHITELIST` set to `["workforce-api", "mcp-workforce"]` +from the start — Layer 3 (REST + MCP) was built the same session, see +`../STATUS.md` section 23. + +**Only `dev/` is real.** `staging/api-gateway/` and `prod/api-gateway/` +still hold the original TODO placeholder files, not converted, not +deployed. + +**Layer 3 is real here too**: `../workforce-api` (REST + MCP over `Office` +and `Employee`) was built and deployed the same session — `Gateway +workforce-dev`: `Programmed: True`, DNS entry added to `coredns-custom` +(`workforce-dev.sttlab.local` → the `dataplane-ingress-workforce-dev-*` +Service `ClusterIP`, same manual per-domain step documented in +`../STATUS.md` section 17), all routes smoke-tested (`401`, not +`404`/`502`). + +Self-service pipeline (`../konnect-platform` generating this content +automatically) does not exist yet — still a stub per `../STATUS.md`. +Everything here is hand-maintained. diff --git a/dev/api-gateway/dataplane.yaml b/dev/api-gateway/dataplane.yaml deleted file mode 100644 index 4167fbe..0000000 --- a/dev/api-gateway/dataplane.yaml +++ /dev/null @@ -1,5 +0,0 @@ -# TODO: DataPlane CRD for workforce/dev/api-gateway -apiVersion: gateway-operator.konghq.com/v1beta1 -kind: DataPlane -metadata: - name: workforce-dev diff --git a/dev/api-gateway/externalsecret.yaml b/dev/api-gateway/externalsecret.yaml new file mode 100644 index 0000000..258c35d --- /dev/null +++ b/dev/api-gateway/externalsecret.yaml @@ -0,0 +1,22 @@ +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: workforce-dev-konnect-auth + namespace: workforce +spec: + refreshInterval: 1h + secretStoreRef: + kind: ClusterSecretStore + name: vault-kong-v2 + target: + name: workforce-dev-konnect-auth + template: + metadata: + labels: + konghq.com/credential: konnect + konghq.com/secret: "true" + data: + - secretKey: token + remoteRef: + key: kong-v2/workforce/dev/konnect-pat + property: token diff --git a/dev/api-gateway/gateway-kustomization.yaml b/dev/api-gateway/gateway-kustomization.yaml new file mode 100644 index 0000000..be215d8 --- /dev/null +++ b/dev/api-gateway/gateway-kustomization.yaml @@ -0,0 +1,21 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: workforce-dev-api-gateway + namespace: flux-system +spec: + interval: 10m + sourceRef: + kind: GitRepository + name: k8s-platform + path: ./dataplane-template + prune: true + postBuild: + substitute: + NAME: workforce-dev + NAMESPACE: workforce + CONTROL_PLANE_ID: "1dbd741c-0da2-4718-8c72-6f479530b371" + HOSTNAME: workforce-dev.sttlab.local + substituteFrom: + - kind: ConfigMap + name: dataplane-template-defaults diff --git a/dev/api-gateway/konnectextension.yaml b/dev/api-gateway/konnectextension.yaml deleted file mode 100644 index 32aca83..0000000 --- a/dev/api-gateway/konnectextension.yaml +++ /dev/null @@ -1,6 +0,0 @@ -# TODO: KonnectExtension referencing the Control Plane created by -# konnect-platform/domains/workforce/dev/ (by ID, not created here) -apiVersion: konnect.konghq.com/v1alpha1 -kind: KonnectExtension -metadata: - name: workforce-dev diff --git a/dev/api-gateway/kustomization.yaml b/dev/api-gateway/kustomization.yaml deleted file mode 100644 index 44ec993..0000000 --- a/dev/api-gateway/kustomization.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: - - dataplane.yaml - - konnectextension.yaml diff --git a/dev/api-gateway/policies-kustomization.yaml b/dev/api-gateway/policies-kustomization.yaml new file mode 100644 index 0000000..e83b9ce --- /dev/null +++ b/dev/api-gateway/policies-kustomization.yaml @@ -0,0 +1,22 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: workforce-dev-api-gateway-policies + namespace: flux-system +spec: + interval: 10m + sourceRef: + kind: GitRepository + name: k8s-platform + path: ./dataplane-globalpolicy-template + prune: true + postBuild: + substitute: + NAME: workforce-dev + NAMESPACE: workforce + CONTROL_PLANE_REF_NAME: workforce-dev-6cq27 + JWT_AUDIENCE_WHITELIST: '["workforce-api", "mcp-workforce"]' + OIDC_ISSUER: https://keycloak.sttlab.local/realms/classic-models + substituteFrom: + - kind: ConfigMap + name: dataplane-template-defaults