From a392e09ae599fbe92d3efe633d88400a9e958ea6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Tailland?= Date: Wed, 26 Aug 2026 16:30:02 +0200 Subject: [PATCH] Give the Konnect control-plane ref a stable, derived name MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every Kong entity names its control plane through controlPlaneRef.konnectNamespacedRef (this operator version exposes no konnectID ref type), and the only mirror CR available was the one the Gateway operator auto-creates with a random suffix. That suffix was looked up by hand and pasted into CONTROL_PLANE_REF_NAME in 11 places across 11 repos, where it went stale silently whenever the Gateway was recreated. Replacing the Konnect org did exactly that: all 11 refs named CRs that no longer existed and every service, route and plugin binding sat Programmed=False. Declare a mirror CR named ${NAME}-cp instead, so the refs are derived from NAME and never need touching again. source: Mirror adopts an existing control plane rather than owning it — deleting the CR leaves the control plane in Konnect intact (verified: count unchanged across a delete), so it coexists with the operator's own mirror of the same id. The id itself comes from Vault via External Secrets, so a new Konnect org now needs no edit in any repo. Co-Authored-By: Claude Opus 5 --- .../global-policies-pluginbindings.yaml | 20 ++++++----- dataplane-template/controlplane-mirror.yaml | 34 +++++++++++++++++++ dataplane-template/kustomization.yaml | 1 + 3 files changed, 46 insertions(+), 9 deletions(-) create mode 100644 dataplane-template/controlplane-mirror.yaml diff --git a/dataplane-globalpolicy-template/global-policies-pluginbindings.yaml b/dataplane-globalpolicy-template/global-policies-pluginbindings.yaml index fc34dbd..e3181e8 100644 --- a/dataplane-globalpolicy-template/global-policies-pluginbindings.yaml +++ b/dataplane-globalpolicy-template/global-policies-pluginbindings.yaml @@ -4,15 +4,17 @@ # ~/dev/kong/kube/apis/tasks-api/pluginbindings.yaml). # # controlPlaneRef.konnectNamespacedRef.name is ${CONTROL_PLANE_REF_NAME}, -# NOT ${NAME} — the KonnectGatewayControlPlane object created by -# GatewayConfiguration's `mirror` is auto-named by the operator with a -# random suffix (e.g. catalog-dev-bkphl, not catalog-dev), so this value -# can't be derived from other vars. Currently looked up manually after the -# Gateway/GatewayConfiguration first reconcile and filled in per domain's -# kustomization.yaml — a two-phase step, same as the real reference -# implementation's kong-rc6s4. The self-service automation pipeline -# (terraform-konnect-control-plane / konnect-platform, still stubs) should -# populate this automatically once it exists — see STATUS.md. +# NOT ${NAME}. The KonnectGatewayControlPlane the operator creates from +# GatewayConfiguration's `mirror` is auto-named with a random suffix +# (catalog-dev-bkphl, not catalog-dev), so this value used to be looked up by +# hand after the first reconcile and pasted in per domain — and it went stale +# without warning every time the Gateway was recreated. +# +# It now names the mirror CR declared in +# k8s-platform/dataplane-template/controlplane-mirror.yaml, whose name IS +# derived from ${NAME} (${NAME}-cp) and therefore stable. The operator's own +# auto-named mirror still exists alongside it; both point at the same control +# plane id and neither owns its lifecycle. apiVersion: configuration.konghq.com/v1alpha1 kind: KongPluginBinding metadata: diff --git a/dataplane-template/controlplane-mirror.yaml b/dataplane-template/controlplane-mirror.yaml new file mode 100644 index 0000000..412bc01 --- /dev/null +++ b/dataplane-template/controlplane-mirror.yaml @@ -0,0 +1,34 @@ +# A stably-named mirror of the domain's Konnect control plane. +# +# Why this exists: the Gateway operator also creates a mirrored +# KonnectGatewayControlPlane of its own, but auto-names it "${NAME}-". +# Every KongService/KongRoute/KongPluginBinding has to name its control plane +# through controlPlaneRef.konnectNamespacedRef (this operator version has no +# konnectID ref type), so that random suffix used to be looked up by hand and +# pasted into CONTROL_PLANE_REF_NAME in each domain repo. It silently went +# stale whenever the Gateway was recreated — which is exactly what happened +# when the Konnect org was replaced: all 11 refs pointed at CRs that no longer +# existed and every entity sat Programmed=False. +# +# This CR is declared with a derived, stable name instead, so the refs never +# need touching again. It is source: Mirror, which adopts an existing control +# plane rather than owning its lifecycle — deleting this CR does NOT delete the +# control plane in Konnect (verified: count unchanged across a delete), so it +# coexists safely with the operator's own mirror of the same id. +# +# CONTROL_PLANE_ID is substituted from the ${NAME}-control-plane Secret that +# External Secrets materializes from Vault — see the domain's +# gateway-kustomization.yaml. +apiVersion: konnect.konghq.com/v1alpha2 +kind: KonnectGatewayControlPlane +metadata: + name: ${NAME}-cp + namespace: ${NAMESPACE} +spec: + source: Mirror + konnect: + authRef: + name: ${NAME} + mirror: + konnect: + id: ${CONTROL_PLANE_ID} diff --git a/dataplane-template/kustomization.yaml b/dataplane-template/kustomization.yaml index c9f028c..aa036a7 100644 --- a/dataplane-template/kustomization.yaml +++ b/dataplane-template/kustomization.yaml @@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - konnectapiauthconfiguration.yaml + - controlplane-mirror.yaml - gatewayconfiguration.yaml - gateway.yaml - externalsecret-tls.yaml