Give the Konnect control-plane ref a stable, derived name

Every Kong entity names its control plane through
controlPlaneRef.konnectNamespacedRef (this operator version exposes no
konnectID ref type), and the only mirror CR available was the one the
Gateway operator auto-creates with a random suffix. That suffix was
looked up by hand and pasted into CONTROL_PLANE_REF_NAME in 11 places
across 11 repos, where it went stale silently whenever the Gateway was
recreated. Replacing the Konnect org did exactly that: all 11 refs named
CRs that no longer existed and every service, route and plugin binding
sat Programmed=False.

Declare a mirror CR named ${NAME}-cp instead, so the refs are derived
from NAME and never need touching again. source: Mirror adopts an
existing control plane rather than owning it — deleting the CR leaves
the control plane in Konnect intact (verified: count unchanged across a
delete), so it coexists with the operator's own mirror of the same id.

The id itself comes from Vault via External Secrets, so a new Konnect
org now needs no edit in any repo.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

dataplane-globalpolicy-template/global-policies-pluginbindings.yaml

@@ -4,15 +4,17 @@
 # ~/dev/kong/kube/apis/tasks-api/pluginbindings.yaml).
 #
 # controlPlaneRef.konnectNamespacedRef.name is ${CONTROL_PLANE_REF_NAME},
-# NOT ${NAME} — the KonnectGatewayControlPlane object created by
+# NOT ${NAME}. The KonnectGatewayControlPlane the operator creates from
-# GatewayConfiguration's `mirror` is auto-named by the operator with a
+# GatewayConfiguration's `mirror` is auto-named with a random suffix
-# random suffix (e.g. catalog-dev-bkphl, not catalog-dev), so this value
+# (catalog-dev-bkphl, not catalog-dev), so this value used to be looked up by
-# can't be derived from other vars. Currently looked up manually after the
+# hand after the first reconcile and pasted in per domain — and it went stale
-# Gateway/GatewayConfiguration first reconcile and filled in per domain's
+# without warning every time the Gateway was recreated.
-# kustomization.yaml — a two-phase step, same as the real reference
+#
-# implementation's kong-rc6s4. The self-service automation pipeline
+# It now names the mirror CR declared in
-# (terraform-konnect-control-plane / konnect-platform, still stubs) should
+# k8s-platform/dataplane-template/controlplane-mirror.yaml, whose name IS
-# populate this automatically once it exists — see STATUS.md.
+# derived from ${NAME} (${NAME}-cp) and therefore stable. The operator's own
+# auto-named mirror still exists alongside it; both point at the same control
+# plane id and neither owns its lifecycle.
 apiVersion: configuration.konghq.com/v1alpha1
 kind: KongPluginBinding
 metadata:

dataplane-template/controlplane-mirror.yaml

@@ -0,0 +1,34 @@
+# A stably-named mirror of the domain's Konnect control plane.
+#
+# Why this exists: the Gateway operator also creates a mirrored
+# KonnectGatewayControlPlane of its own, but auto-names it "${NAME}-<random>".
+# Every KongService/KongRoute/KongPluginBinding has to name its control plane
+# through controlPlaneRef.konnectNamespacedRef (this operator version has no
+# konnectID ref type), so that random suffix used to be looked up by hand and
+# pasted into CONTROL_PLANE_REF_NAME in each domain repo. It silently went
+# stale whenever the Gateway was recreated — which is exactly what happened
+# when the Konnect org was replaced: all 11 refs pointed at CRs that no longer
+# existed and every entity sat Programmed=False.
+#
+# This CR is declared with a derived, stable name instead, so the refs never
+# need touching again. It is source: Mirror, which adopts an existing control
+# plane rather than owning its lifecycle — deleting this CR does NOT delete the
+# control plane in Konnect (verified: count unchanged across a delete), so it
+# coexists safely with the operator's own mirror of the same id.
+#
+# CONTROL_PLANE_ID is substituted from the ${NAME}-control-plane Secret that
+# External Secrets materializes from Vault — see the domain's
+# gateway-kustomization.yaml.
+apiVersion: konnect.konghq.com/v1alpha2
+kind: KonnectGatewayControlPlane
+metadata:
+  name: ${NAME}-cp
+  namespace: ${NAMESPACE}
+spec:
+  source: Mirror
+  konnect:
+    authRef:
+      name: ${NAME}
+  mirror:
+    konnect:
+      id: ${CONTROL_PLANE_ID}

dataplane-template/kustomization.yaml

@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - konnectapiauthconfiguration.yaml
+  - controlplane-mirror.yaml
   - gatewayconfiguration.yaml
   - gateway.yaml
   - externalsecret-tls.yaml