Stéphane Tailland
11d27c2655
postBuild.substituteFrom can only read a ConfigMap in its own namespace. dataplane-template-defaults existed only in flux-system, so every gateway Kustomization had to live in flux-system to reach it — a namespace the feature teams have no access to. Their own gateway configuration ended up outside their reach as a side effect of a substitution rule, not as a governance decision. Add a namespace-less copy of the ConfigMap under kong-platform/domain-defaults, plus one Kustomization per domain in flux/domain-defaults.yaml differing only by targetNamespace. One source file, one edit when a default changes, six copies that follow. Platform-owned deliberately: these are the defaults a team inherits, not ones it sets, so they stay in flux-system while everything a team does own moves out of it. This is the precondition, not the move itself. The flux-system copy stays until the gateway Kustomizations relocate, and they cannot be patched into a new namespace — that is a delete and recreate, with a window where the gateway is unreconciled. It also retires a workaround: platform-llm inlined OTEL_TRACES_ENDPOINT because its Kustomization had to sit in the llm namespace, holding real credentials it must not put in flux-system, and so could not read this ConfigMap. With the ConfigMap in llm, that inlining can go. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
30 lines
1.5 KiB
YAML
30 lines
1.5 KiB
YAML
# The dataplane-template ${VAR} defaults, WITHOUT a namespace.
|
|
#
|
|
# Flux's postBuild.substituteFrom can only read a ConfigMap in its own
|
|
# namespace. Keeping this only in flux-system is therefore what forced every
|
|
# gateway Kustomization into flux-system too — a namespace the feature teams
|
|
# have no access to. That was a side effect of the substitution rule, not a
|
|
# governance decision, and it left teams unable to touch their own gateway.
|
|
#
|
|
# So the same ConfigMap is placed in each domain namespace instead, by the
|
|
# Kustomizations in flux/domain-defaults.yaml, each setting targetNamespace.
|
|
# One source file, one edit when a default changes; the copies follow.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: dataplane-template-defaults
|
|
data:
|
|
KONNECT_SERVER_URL: eu.api.konghq.com
|
|
GATEWAY_IMAGE: kong/kong-gateway:3.15
|
|
REPLICAS: "1"
|
|
OIDC_ISSUER: https://keycloak.sttlab.eu/realms/sttlab # Keycloak today, but this template shouldn't assume it stays that way
|
|
CORS_ORIGINS: https://*.sttlab.local
|
|
RATE_LIMIT_MINUTE: "300"
|
|
REQUEST_MAX_BODY_SIZE: "10" # MB
|
|
# Tempo (OTLP-native), ns observability, cluster-wide — shared by every
|
|
# domain, not domain-specific. Replaced Jaeger on 2026-08-25: Tempo is the
|
|
# trace backend of the infra-observability stack, so its span metrics feed
|
|
# Prometheus and its traces correlate with the Loki logs from the same
|
|
# requests. Jaeger is still deployed but no longer receives anything.
|
|
OTEL_TRACES_ENDPOINT: http://tempo.observability.svc.cluster.local:4318/v1/traces
|