Stéphane Tailland
23a3f3e24f
Two hardcoded values tied this repo to one specific Konnect org, and
replacing that org broke both.
CONTROL_PLANE_ID was pasted into gateway-kustomization.yaml. It now
comes from Vault through External Secrets, into a Secret in flux-system
that postBuild.substituteFrom reads. flux-system is acceptable for the
id — it is visible in the Konnect UI URL — but not for the token, which
keeps going straight to the domain namespace as before.
CONTROL_PLANE_REF_NAME held the random suffix the Gateway operator gives
its auto-created mirror CR, looked up by hand. The new org recreated
those CRs under new suffixes, so the ref named an object that no longer
existed and the domain's Kong entities sat Programmed=False. It now
names the ${NAME}-cp mirror declared in k8s-platform's
dataplane-template — derived from NAME, stable across Gateway
recreations and org changes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
dataplane-workforce
Layer 2 (Gateway infrastructure) for the workforce bounded context
(domain team: workforce) — one Control Plane per environment, referenced
by ID (created manually in Konnect for now, never recreated here:
1dbd741c-0da2-4718-8c72-6f479530b371 for dev).
Same gateway-kustomization.yaml / externalsecret.yaml /
policies-kustomization.yaml three-file pattern as dataplane-catalog/
dataplane-customers/dataplane-payments/dataplane-sales — see
dataplane-catalog/README.md for the full explanation of each file's
role, identical here, not repeated.
IdP: https://keycloak.sttlab.local/realms/classic-models (local
in-cluster Keycloak), platform-wide default — see ../STATUS.md sections
15/16. JWT_AUDIENCE_WHITELIST set to ["workforce-api", "mcp-workforce"]
from the start — Layer 3 (REST + MCP) was built the same session, see
../STATUS.md section 23.
Only dev/ is real. staging/api-gateway/ and prod/api-gateway/
still hold the original TODO placeholder files, not converted, not
deployed.
Layer 3 is real here too: ../workforce-api (REST + MCP over Office
and Employee) was built and deployed the same session — Gateway workforce-dev: Programmed: True, DNS entry added to coredns-custom
(workforce-dev.sttlab.local → the dataplane-ingress-workforce-dev-*
Service ClusterIP, same manual per-domain step documented in
../STATUS.md section 17), all routes smoke-tested (401, not
404/502).
Self-service pipeline (../konnect-platform generating this content
automatically) does not exist yet — still a stub per ../STATUS.md.
Everything here is hand-maintained.