k8s-platform

Platform-team owned, cluster-scoped only. Rare changes, cautious sync (not aggressive auto-sync).

Per-domain gateway infrastructure (Gateway, GatewayConfiguration, KonnectAPIAuthConfiguration) does NOT live here — see the dedicated dataplane-<domain> repos, to avoid write contention across domains.

flux/

The Flux Operator (flux-system namespace) that everything else in this GitOps setup depends on. Installed 2026-08-19 on the local cluster.

The operator itself is installed manually via Helm — bootstrap problem, Flux can't deploy the thing that deploys it:

helm install flux-operator oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator \
  --namespace flux-system --create-namespace

flux/fluxinstance.yaml configures the actual Flux controllers (source-controller, kustomize-controller, helm-controller, notification-controller) — tracked in git, applied via kubectl apply -k flux/.

flux/gitrepository.yaml is what lets Flux clone this (k8s-platform) repo so other repos' Kustomizations can reference paths inside it (e.g. dataplane-template/). url is a PLACEHOLDER — this repo has no git remote yet. Once it does, apply it manually once (kubectl apply -f flux/gitrepository.yaml) — same bootstrap-chicken-egg reasoning as the operator install above.

kong-platform/

Cluster-wide Kong foundations:

• gatewayclass.yaml — GatewayClass kong-v2 (deliberately not named kong, to avoid touching the pre-existing kong GatewayClass that backs the unrelated tasks/jira/openrouter Gateway on this cluster).
• operator/ — HelmRepository + HelmRelease for the Kong Gateway Operator itself, matching the release already installed manually on this cluster (helm list -n kong: chart kong-operator-1.3.1, env.ENABLE_CONTROLLER_KONNECT: true). helm-controller can adopt an existing release under the same releaseName/targetNamespace rather than reinstalling.

dataplane-template/

The shared KonnectAPIAuthConfiguration + GatewayConfiguration + Gateway

• Secret template (one copy, ${VAR}-parameterized) that every domain's Flux Kustomization builds via postBuild.substitute — see dataplane-catalog/README.md for the full mechanism and the values/secret side of it.

Applying today (no git remote yet)

Nothing here reconciles from git automatically yet — flux/gitrepository.yaml has no real URL. Apply directly:

kubectl apply -k flux/           # fluxinstance.yaml + gitrepository.yaml (the
                                  # latter will just sit inert, PLACEHOLDER url)
kubectl apply -f kong-platform/gatewayclass.yaml

dataplane-template/ is never applied on its own — it only makes sense built + substituted by a domain's flux-kustomization.yaml, which itself can't reconcile yet (needs the real GitRepository, see above).