# scope: GlobalInControlPlane — applies each plugin to all traffic in this
# domain's Control Plane, no route/service target needed (verified real
# mechanism, see tasks-rate-limiting-global-binding in
# ~/dev/kong/kube/apis/tasks-api/pluginbindings.yaml).
#
# controlPlaneRef.konnectNamespacedRef.name is ${CONTROL_PLANE_REF_NAME},
# NOT ${NAME} — the KonnectGatewayControlPlane object created by
# GatewayConfiguration's `mirror` is auto-named by the operator with a
# random suffix (e.g. catalog-dev-bkphl, not catalog-dev), so this value
# can't be derived from other vars. Currently looked up manually after the
# Gateway/GatewayConfiguration first reconcile and filled in per domain's
# kustomization.yaml — a two-phase step, same as the real reference
# implementation's kong-rc6s4. The self-service automation pipeline
# (terraform-konnect-control-plane / konnect-platform, still stubs) should
# populate this automatically once it exists — see STATUS.md.
apiVersion: configuration.konghq.com/v1alpha1
kind: KongPluginBinding
metadata:
  name: ${NAME}-openid-connect-binding
  namespace: ${NAMESPACE}
spec:
  controlPlaneRef:
    type: konnectNamespacedRef
    konnectNamespacedRef:
      name: ${CONTROL_PLANE_REF_NAME}
  pluginRef:
    name: ${NAME}-openid-connect
  scope: GlobalInControlPlane
---
apiVersion: configuration.konghq.com/v1alpha1
kind: KongPluginBinding
metadata:
  name: ${NAME}-rate-limiting-binding
  namespace: ${NAMESPACE}
spec:
  controlPlaneRef:
    type: konnectNamespacedRef
    konnectNamespacedRef:
      name: ${CONTROL_PLANE_REF_NAME}
  pluginRef:
    name: ${NAME}-rate-limiting
  scope: GlobalInControlPlane
---
apiVersion: configuration.konghq.com/v1alpha1
kind: KongPluginBinding
metadata:
  name: ${NAME}-cors-binding
  namespace: ${NAMESPACE}
spec:
  controlPlaneRef:
    type: konnectNamespacedRef
    konnectNamespacedRef:
      name: ${CONTROL_PLANE_REF_NAME}
  pluginRef:
    name: ${NAME}-cors
  scope: GlobalInControlPlane
---
apiVersion: configuration.konghq.com/v1alpha1
kind: KongPluginBinding
metadata:
  name: ${NAME}-request-size-limiting-binding
  namespace: ${NAMESPACE}
spec:
  controlPlaneRef:
    type: konnectNamespacedRef
    konnectNamespacedRef:
      name: ${CONTROL_PLANE_REF_NAME}
  pluginRef:
    name: ${NAME}-request-size-limiting
  scope: GlobalInControlPlane
---
apiVersion: configuration.konghq.com/v1alpha1
kind: KongPluginBinding
metadata:
  name: ${NAME}-correlation-id-binding
  namespace: ${NAMESPACE}
spec:
  controlPlaneRef:
    type: konnectNamespacedRef
    konnectNamespacedRef:
      name: ${CONTROL_PLANE_REF_NAME}
  pluginRef:
    name: ${NAME}-correlation-id
  scope: GlobalInControlPlane
---
apiVersion: configuration.konghq.com/v1alpha1
kind: KongPluginBinding
metadata:
  name: ${NAME}-hide-5xx-details-binding
  namespace: ${NAMESPACE}
spec:
  controlPlaneRef:
    type: konnectNamespacedRef
    konnectNamespacedRef:
      name: ${CONTROL_PLANE_REF_NAME}
  pluginRef:
    name: ${NAME}-hide-5xx-details
  scope: GlobalInControlPlane
---
apiVersion: configuration.konghq.com/v1alpha1
kind: KongPluginBinding
metadata:
  name: ${NAME}-prometheus-binding
  namespace: ${NAMESPACE}
spec:
  controlPlaneRef:
    type: konnectNamespacedRef
    konnectNamespacedRef:
      name: ${CONTROL_PLANE_REF_NAME}
  pluginRef:
    name: ${NAME}-prometheus
  scope: GlobalInControlPlane
---
apiVersion: configuration.konghq.com/v1alpha1
kind: KongPluginBinding
metadata:
  name: ${NAME}-opentelemetry-binding
  namespace: ${NAMESPACE}
spec:
  controlPlaneRef:
    type: konnectNamespacedRef
    konnectNamespacedRef:
      name: ${CONTROL_PLANE_REF_NAME}
  pluginRef:
    name: ${NAME}-opentelemetry
  scope: GlobalInControlPlane