Place the dataplane defaults in every domain namespace

postBuild.substituteFrom can only read a ConfigMap in its own namespace.
dataplane-template-defaults existed only in flux-system, so every gateway
Kustomization had to live in flux-system to reach it — a namespace the
feature teams have no access to. Their own gateway configuration ended up
outside their reach as a side effect of a substitution rule, not as a
governance decision.

Add a namespace-less copy of the ConfigMap under
kong-platform/domain-defaults, plus one Kustomization per domain in
flux/domain-defaults.yaml differing only by targetNamespace. One source
file, one edit when a default changes, six copies that follow.

Platform-owned deliberately: these are the defaults a team inherits, not
ones it sets, so they stay in flux-system while everything a team does own
moves out of it.

This is the precondition, not the move itself. The flux-system copy stays
until the gateway Kustomizations relocate, and they cannot be patched into
a new namespace — that is a delete and recreate, with a window where the
gateway is unreconciled.

It also retires a workaround: platform-llm inlined OTEL_TRACES_ENDPOINT
because its Kustomization had to sit in the llm namespace, holding real
credentials it must not put in flux-system, and so could not read this
ConfigMap. With the ConfigMap in llm, that inlining can go.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

flux/domain-defaults.yaml

@@ -0,0 +1,102 @@
+# One Kustomization per domain, all pointing at the same source file and
+# differing only by targetNamespace. This is what puts
+# dataplane-template-defaults inside each domain namespace, which is the
+# precondition for a domain's own gateway Kustomization to live there too —
+# postBuild.substituteFrom reads only from its own namespace.
+#
+# Platform-owned on purpose: these are the defaults a feature team inherits,
+# not ones it sets. They stay in flux-system, and everything a team does own
+# moves out of it.
+#
+# The flux-system copy stays for now: the gateway Kustomizations still read it
+# from there and only stop once they move.
+
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: domain-defaults-catalog
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: k8s-platform
+  path: ./kong-platform/domain-defaults
+  targetNamespace: catalog
+  prune: true
+
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: domain-defaults-customers
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: k8s-platform
+  path: ./kong-platform/domain-defaults
+  targetNamespace: customers
+  prune: true
+
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: domain-defaults-payments
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: k8s-platform
+  path: ./kong-platform/domain-defaults
+  targetNamespace: payments
+  prune: true
+
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: domain-defaults-sales
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: k8s-platform
+  path: ./kong-platform/domain-defaults
+  targetNamespace: sales
+  prune: true
+
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: domain-defaults-workforce
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: k8s-platform
+  path: ./kong-platform/domain-defaults
+  targetNamespace: workforce
+  prune: true
+
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: domain-defaults-llm
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: k8s-platform
+  path: ./kong-platform/domain-defaults
+  targetNamespace: llm
+  prune: true

kong-platform/domain-defaults/dataplane-template-defaults.yaml

@@ -0,0 +1,29 @@
+# The dataplane-template ${VAR} defaults, WITHOUT a namespace.
+#
+# Flux's postBuild.substituteFrom can only read a ConfigMap in its own
+# namespace. Keeping this only in flux-system is therefore what forced every
+# gateway Kustomization into flux-system too — a namespace the feature teams
+# have no access to. That was a side effect of the substitution rule, not a
+# governance decision, and it left teams unable to touch their own gateway.
+#
+# So the same ConfigMap is placed in each domain namespace instead, by the
+# Kustomizations in flux/domain-defaults.yaml, each setting targetNamespace.
+# One source file, one edit when a default changes; the copies follow.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: dataplane-template-defaults
+data:
+  KONNECT_SERVER_URL: eu.api.konghq.com
+  GATEWAY_IMAGE: kong/kong-gateway:3.15
+  REPLICAS: "1"
+  OIDC_ISSUER: https://keycloak.sttlab.eu/realms/sttlab # Keycloak today, but this template shouldn't assume it stays that way
+  CORS_ORIGINS: https://*.sttlab.local
+  RATE_LIMIT_MINUTE: "300"
+  REQUEST_MAX_BODY_SIZE: "10" # MB
+  # Tempo (OTLP-native), ns observability, cluster-wide — shared by every
+  # domain, not domain-specific. Replaced Jaeger on 2026-08-25: Tempo is the
+  # trace backend of the infra-observability stack, so its span metrics feed
+  # Prometheus and its traces correlate with the Loki logs from the same
+  # requests. Jaeger is still deployed but no longer receives anything.
+  OTEL_TRACES_ENDPOINT: http://tempo.observability.svc.cluster.local:4318/v1/traces

kong-platform/domain-defaults/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - dataplane-template-defaults.yaml