From 11d27c265583e12a3c42cf3a6dc3da4c80000179 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Tailland?= Date: Thu, 27 Aug 2026 14:31:11 +0200 Subject: [PATCH] Place the dataplane defaults in every domain namespace MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit postBuild.substituteFrom can only read a ConfigMap in its own namespace. dataplane-template-defaults existed only in flux-system, so every gateway Kustomization had to live in flux-system to reach it — a namespace the feature teams have no access to. Their own gateway configuration ended up outside their reach as a side effect of a substitution rule, not as a governance decision. Add a namespace-less copy of the ConfigMap under kong-platform/domain-defaults, plus one Kustomization per domain in flux/domain-defaults.yaml differing only by targetNamespace. One source file, one edit when a default changes, six copies that follow. Platform-owned deliberately: these are the defaults a team inherits, not ones it sets, so they stay in flux-system while everything a team does own moves out of it. This is the precondition, not the move itself. The flux-system copy stays until the gateway Kustomizations relocate, and they cannot be patched into a new namespace — that is a delete and recreate, with a window where the gateway is unreconciled. It also retires a workaround: platform-llm inlined OTEL_TRACES_ENDPOINT because its Kustomization had to sit in the llm namespace, holding real credentials it must not put in flux-system, and so could not read this ConfigMap. With the ConfigMap in llm, that inlining can go. Co-Authored-By: Claude Opus 5 --- flux/domain-defaults.yaml | 102 ++++++++++++++++++ .../dataplane-template-defaults.yaml | 29 +++++ .../domain-defaults/kustomization.yaml | 4 + 3 files changed, 135 insertions(+) create mode 100644 flux/domain-defaults.yaml create mode 100644 kong-platform/domain-defaults/dataplane-template-defaults.yaml create mode 100644 kong-platform/domain-defaults/kustomization.yaml diff --git a/flux/domain-defaults.yaml b/flux/domain-defaults.yaml new file mode 100644 index 0000000..9fd4687 --- /dev/null +++ b/flux/domain-defaults.yaml @@ -0,0 +1,102 @@ +# One Kustomization per domain, all pointing at the same source file and +# differing only by targetNamespace. This is what puts +# dataplane-template-defaults inside each domain namespace, which is the +# precondition for a domain's own gateway Kustomization to live there too — +# postBuild.substituteFrom reads only from its own namespace. +# +# Platform-owned on purpose: these are the defaults a feature team inherits, +# not ones it sets. They stay in flux-system, and everything a team does own +# moves out of it. +# +# The flux-system copy stays for now: the gateway Kustomizations still read it +# from there and only stop once they move. + +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: domain-defaults-catalog + namespace: flux-system +spec: + interval: 10m + sourceRef: + kind: GitRepository + name: k8s-platform + path: ./kong-platform/domain-defaults + targetNamespace: catalog + prune: true + +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: domain-defaults-customers + namespace: flux-system +spec: + interval: 10m + sourceRef: + kind: GitRepository + name: k8s-platform + path: ./kong-platform/domain-defaults + targetNamespace: customers + prune: true + +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: domain-defaults-payments + namespace: flux-system +spec: + interval: 10m + sourceRef: + kind: GitRepository + name: k8s-platform + path: ./kong-platform/domain-defaults + targetNamespace: payments + prune: true + +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: domain-defaults-sales + namespace: flux-system +spec: + interval: 10m + sourceRef: + kind: GitRepository + name: k8s-platform + path: ./kong-platform/domain-defaults + targetNamespace: sales + prune: true + +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: domain-defaults-workforce + namespace: flux-system +spec: + interval: 10m + sourceRef: + kind: GitRepository + name: k8s-platform + path: ./kong-platform/domain-defaults + targetNamespace: workforce + prune: true + +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: domain-defaults-llm + namespace: flux-system +spec: + interval: 10m + sourceRef: + kind: GitRepository + name: k8s-platform + path: ./kong-platform/domain-defaults + targetNamespace: llm + prune: true diff --git a/kong-platform/domain-defaults/dataplane-template-defaults.yaml b/kong-platform/domain-defaults/dataplane-template-defaults.yaml new file mode 100644 index 0000000..79be5f6 --- /dev/null +++ b/kong-platform/domain-defaults/dataplane-template-defaults.yaml @@ -0,0 +1,29 @@ +# The dataplane-template ${VAR} defaults, WITHOUT a namespace. +# +# Flux's postBuild.substituteFrom can only read a ConfigMap in its own +# namespace. Keeping this only in flux-system is therefore what forced every +# gateway Kustomization into flux-system too — a namespace the feature teams +# have no access to. That was a side effect of the substitution rule, not a +# governance decision, and it left teams unable to touch their own gateway. +# +# So the same ConfigMap is placed in each domain namespace instead, by the +# Kustomizations in flux/domain-defaults.yaml, each setting targetNamespace. +# One source file, one edit when a default changes; the copies follow. +apiVersion: v1 +kind: ConfigMap +metadata: + name: dataplane-template-defaults +data: + KONNECT_SERVER_URL: eu.api.konghq.com + GATEWAY_IMAGE: kong/kong-gateway:3.15 + REPLICAS: "1" + OIDC_ISSUER: https://keycloak.sttlab.eu/realms/sttlab # Keycloak today, but this template shouldn't assume it stays that way + CORS_ORIGINS: https://*.sttlab.local + RATE_LIMIT_MINUTE: "300" + REQUEST_MAX_BODY_SIZE: "10" # MB + # Tempo (OTLP-native), ns observability, cluster-wide — shared by every + # domain, not domain-specific. Replaced Jaeger on 2026-08-25: Tempo is the + # trace backend of the infra-observability stack, so its span metrics feed + # Prometheus and its traces correlate with the Loki logs from the same + # requests. Jaeger is still deployed but no longer receives anything. + OTEL_TRACES_ENDPOINT: http://tempo.observability.svc.cluster.local:4318/v1/traces diff --git a/kong-platform/domain-defaults/kustomization.yaml b/kong-platform/domain-defaults/kustomization.yaml new file mode 100644 index 0000000..0a517ae --- /dev/null +++ b/kong-platform/domain-defaults/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - dataplane-template-defaults.yaml