Deploy workforce/dev dataplane (Layer 2), mirroring the other domains

Real Konnect Control Plane 1dbd741c-0da2-4718-8c72-6f479530b371, PAT in Vault. Replaces the TODO stubs with the proven three-file pattern. JWT_AUDIENCE_WHITELIST includes mcp-workforce from the start since Layer 3 was built the same session — see STATUS.md section 23.
2026-08-23 17:13:34 +02:00
parent 9ce8058985
commit effdae1083
7 changed files with 95 additions and 22 deletions
@@ -1,5 +0,0 @@
-# TODO: DataPlane CRD for workforce/dev/api-gateway
-apiVersion: gateway-operator.konghq.com/v1beta1
-kind: DataPlane
-metadata:
-  name: workforce-dev
@@ -0,0 +1,22 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: workforce-dev-konnect-auth
+  namespace: workforce
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kong-v2
+  target:
+    name: workforce-dev-konnect-auth
+    template:
+      metadata:
+        labels:
+          konghq.com/credential: konnect
+          konghq.com/secret: "true"
+  data:
+    - secretKey: token
+      remoteRef:
+        key: kong-v2/workforce/dev/konnect-pat
+        property: token
@@ -0,0 +1,21 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: workforce-dev-api-gateway
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: k8s-platform
+  path: ./dataplane-template
+  prune: true
+  postBuild:
+    substitute:
+      NAME: workforce-dev
+      NAMESPACE: workforce
+      CONTROL_PLANE_ID: "1dbd741c-0da2-4718-8c72-6f479530b371"
+      HOSTNAME: workforce-dev.sttlab.local
+    substituteFrom:
+      - kind: ConfigMap
+        name: dataplane-template-defaults
@@ -1,6 +0,0 @@
-# TODO: KonnectExtension referencing the Control Plane created by
-# konnect-platform/domains/workforce/dev/ (by ID, not created here)
-apiVersion: konnect.konghq.com/v1alpha1
-kind: KonnectExtension
-metadata:
-  name: workforce-dev
@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - dataplane.yaml
-  - konnectextension.yaml
@@ -0,0 +1,22 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: workforce-dev-api-gateway-policies
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: k8s-platform
+  path: ./dataplane-globalpolicy-template
+  prune: true
+  postBuild:
+    substitute:
+      NAME: workforce-dev
+      NAMESPACE: workforce
+      CONTROL_PLANE_REF_NAME: workforce-dev-6cq27
+      JWT_AUDIENCE_WHITELIST: '["workforce-api", "mcp-workforce"]'
+      OIDC_ISSUER: https://keycloak.sttlab.local/realms/classic-models
+    substituteFrom:
+      - kind: ConfigMap
+        name: dataplane-template-defaults