Stéphane Tailland
effdae1083
Real Konnect Control Plane 1dbd741c-0da2-4718-8c72-6f479530b371, PAT in Vault. Replaces the TODO stubs with the proven three-file pattern. JWT_AUDIENCE_WHITELIST includes mcp-workforce from the start since Layer 3 was built the same session — see STATUS.md section 23.
dataplane-workforce
Layer 2 (Gateway infrastructure) for the workforce bounded context
(domain team: workforce) — one Control Plane per environment, referenced
by ID (created manually in Konnect for now, never recreated here:
1dbd741c-0da2-4718-8c72-6f479530b371 for dev).
Same gateway-kustomization.yaml / externalsecret.yaml /
policies-kustomization.yaml three-file pattern as dataplane-catalog/
dataplane-customers/dataplane-payments/dataplane-sales — see
dataplane-catalog/README.md for the full explanation of each file's
role, identical here, not repeated.
IdP: https://keycloak.sttlab.local/realms/classic-models (local
in-cluster Keycloak), platform-wide default — see ../STATUS.md sections
15/16. JWT_AUDIENCE_WHITELIST set to ["workforce-api", "mcp-workforce"]
from the start — Layer 3 (REST + MCP) was built the same session, see
../STATUS.md section 23.
Only dev/ is real. staging/api-gateway/ and prod/api-gateway/
still hold the original TODO placeholder files, not converted, not
deployed.
Layer 3 is real here too: ../workforce-api (REST + MCP over Office
and Employee) was built and deployed the same session — Gateway workforce-dev: Programmed: True, DNS entry added to coredns-custom
(workforce-dev.sttlab.local → the dataplane-ingress-workforce-dev-*
Service ClusterIP, same manual per-domain step documented in
../STATUS.md section 17), all routes smoke-tested (401, not
404/502).
Self-service pipeline (../konnect-platform generating this content
automatically) does not exist yet — still a stub per ../STATUS.md.
Everything here is hand-maintained.