Globol Policies template

2026-08-20 11:26:01 +02:00
parent bf9fcaecd3
commit 3879f775b8
4 changed files with 245 additions and 0 deletions
@@ -0,0 +1,118 @@
+# scope: GlobalInControlPlane — applies each plugin to all traffic in this
+# domain's Control Plane, no route/service target needed (verified real
+# mechanism, see tasks-rate-limiting-global-binding in
+# ~/dev/kong/kube/apis/tasks-api/pluginbindings.yaml).
+#
+# controlPlaneRef.konnectNamespacedRef.name is ${CONTROL_PLANE_REF_NAME},
+# NOT ${NAME} — the KonnectGatewayControlPlane object created by
+# GatewayConfiguration's `mirror` is auto-named by the operator with a
+# random suffix (e.g. catalog-dev-bkphl, not catalog-dev), so this value
+# can't be derived from other vars. Currently looked up manually after the
+# Gateway/GatewayConfiguration first reconcile and filled in per domain's
+# kustomization.yaml — a two-phase step, same as the real reference
+# implementation's kong-rc6s4. The self-service automation pipeline
+# (terraform-konnect-control-plane / konnect-platform, still stubs) should
+# populate this automatically once it exists — see STATUS.md.
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-openid-connect-binding
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-openid-connect
+  scope: GlobalInControlPlane
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-rate-limiting-binding
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-rate-limiting
+  scope: GlobalInControlPlane
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-cors-binding
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-cors
+  scope: GlobalInControlPlane
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-request-size-limiting-binding
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-request-size-limiting
+  scope: GlobalInControlPlane
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-correlation-id-binding
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-correlation-id
+  scope: GlobalInControlPlane
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-hide-5xx-details-binding
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-hide-5xx-details
+  scope: GlobalInControlPlane
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-prometheus-binding
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-prometheus
+  scope: GlobalInControlPlane
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-opentelemetry-binding
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-opentelemetry
+  scope: GlobalInControlPlane