# A stably-named mirror of the domain's Konnect control plane.
#
# Why this exists: the Gateway operator also creates a mirrored
# KonnectGatewayControlPlane of its own, but auto-names it "${NAME}-<random>".
# Every KongService/KongRoute/KongPluginBinding has to name its control plane
# through controlPlaneRef.konnectNamespacedRef (this operator version has no
# konnectID ref type), so that random suffix used to be looked up by hand and
# pasted into CONTROL_PLANE_REF_NAME in each domain repo. It silently went
# stale whenever the Gateway was recreated — which is exactly what happened
# when the Konnect org was replaced: all 11 refs pointed at CRs that no longer
# existed and every entity sat Programmed=False.
#
# This CR is declared with a derived, stable name instead, so the refs never
# need touching again. It is source: Mirror, which adopts an existing control
# plane rather than owning its lifecycle — deleting this CR does NOT delete the
# control plane in Konnect (verified: count unchanged across a delete), so it
# coexists safely with the operator's own mirror of the same id.
#
# CONTROL_PLANE_ID is substituted from the ${NAME}-control-plane Secret that
# External Secrets materializes from Vault — see the domain's
# gateway-kustomization.yaml.
apiVersion: konnect.konghq.com/v1alpha2
kind: KonnectGatewayControlPlane
metadata:
  name: ${NAME}-cp
  namespace: ${NAMESPACE}
spec:
  source: Mirror
  konnect:
    authRef:
      name: ${NAME}
  mirror:
    konnect:
      id: ${CONTROL_PLANE_ID}