First commit

dataplane-template/gateway.yaml

@@ -0,0 +1,24 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: ${NAME}
+  namespace: ${NAMESPACE}
+spec:
+  gatewayClassName: kong-v2
+  infrastructure:
+    parametersRef:
+      group: gateway-operator.konghq.com
+      kind: GatewayConfiguration
+      name: ${NAME}
+  listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+    - name: https
+      protocol: HTTPS
+      port: 443
+      hostname: ${HOSTNAME}
+      tls:
+        certificateRefs:
+          - kind: Secret
+            name: ${TLS_SECRET_NAME}

dataplane-template/gatewayconfiguration.yaml

@@ -0,0 +1,21 @@
+apiVersion: gateway-operator.konghq.com/v2beta1
+kind: GatewayConfiguration
+metadata:
+  name: ${NAME}
+  namespace: ${NAMESPACE}
+spec:
+  dataPlaneOptions:
+    deployment:
+      replicas: ${REPLICAS}
+      podTemplateSpec:
+        spec:
+          containers:
+            - name: proxy
+              image: ${GATEWAY_IMAGE}
+  konnect:
+    authRef:
+      name: ${NAME}
+    source: Mirror
+    mirror:
+      konnect:
+        id: ${CONTROL_PLANE_ID}

dataplane-template/konnectapiauthconfiguration.yaml

@@ -0,0 +1,10 @@
+apiVersion: konnect.konghq.com/v1alpha1
+kind: KonnectAPIAuthConfiguration
+metadata:
+  name: ${NAME}
+  namespace: ${NAMESPACE}
+spec:
+  type: secretRef
+  secretRef:
+    name: ${KONNECT_AUTH_SECRET_NAME}
+  serverURL: ${KONNECT_SERVER_URL}

dataplane-template/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - konnectapiauthconfiguration.yaml
+  - gatewayconfiguration.yaml
+  - gateway.yaml
+  - secret.yaml

dataplane-template/secret.yaml

@@ -0,0 +1,15 @@
+# konghq.com/secret: "true" is required — the Kong Operator's secret
+# watch/cache is scoped to that label; without it, references from
+# KonnectAPIAuthConfiguration.secretRef resolve to "does not exist" even
+# though the Secret is present (see ~/dev/kong/kube/gateway/apigw/secret.yaml).
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ${KONNECT_AUTH_SECRET_NAME}
+  namespace: ${NAMESPACE}
+  labels:
+    konghq.com/credential: konnect
+    konghq.com/secret: "true"
+type: Opaque
+stringData:
+  token: ${KONNECT_PAT_TOKEN}