Stéphane Tailland
9a889127ca
Point OTEL_TRACES_ENDPOINT at Tempo instead of Jaeger. The variable is a cluster-wide default, so this moves all five domains at once; Jaeger stays deployed but no longer receives anything. Tempo derives RED span metrics and the service graph from these traces on its own, and its trace ids correlate with the audit logs below. Add a Loki output to the audit collector. Kong's http-log payload is a JSON object per request and Loki has no endpoint that accepts it, so Fluent Bit is the translator between the two formats. The `domain` label comes from $TAG, which the http input derives from the request URI. That makes the path a domain posts to its identity here, so one output block covers every domain and onboarding the next one is a single AUDIT_LOG_ENDPOINT change on its side rather than another block. The file output stays on Match * so the on-disk audit trail continues for every domain, which keeps the switch reversible. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
k8s-platform
Platform-team owned, cluster-scoped only. Rare changes, cautious sync (not aggressive auto-sync).
Per-domain gateway infrastructure (Gateway, GatewayConfiguration,
KonnectAPIAuthConfiguration) does NOT live here — see the dedicated
dataplane-<domain> repos, to avoid write contention across domains.
flux/
The Flux Operator (flux-system namespace) that everything else in this
GitOps setup depends on. Installed 2026-08-19 on the local cluster.
The operator itself is installed manually via Helm — bootstrap problem, Flux can't deploy the thing that deploys it:
helm install flux-operator oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator \
--namespace flux-system --create-namespace
flux/fluxinstance.yaml configures the actual Flux controllers
(source-controller, kustomize-controller, helm-controller,
notification-controller) — tracked in git, applied via
kubectl apply -k flux/.
flux/gitrepository.yaml is what lets Flux clone this (k8s-platform)
repo so other repos' Kustomizations can reference paths inside it (e.g.
dataplane-template/). url is a PLACEHOLDER — this repo has no git
remote yet. Once it does, apply it manually once
(kubectl apply -f flux/gitrepository.yaml) — same bootstrap-chicken-egg
reasoning as the operator install above.
kong-platform/
Cluster-wide Kong foundations:
gatewayclass.yaml—GatewayClasskong-v2(deliberately not namedkong, to avoid touching the pre-existingkongGatewayClass that backs the unrelatedtasks/jira/openrouterGateway on this cluster).operator/—HelmRepository+HelmReleasefor the Kong Gateway Operator itself, matching the release already installed manually on this cluster (helm list -n kong: chartkong-operator-1.3.1,env.ENABLE_CONTROLLER_KONNECT: true).helm-controllercan adopt an existing release under the samereleaseName/targetNamespacerather than reinstalling.
dataplane-template/
The shared KonnectAPIAuthConfiguration + GatewayConfiguration + Gateway
Secrettemplate (one copy,${VAR}-parameterized) that every domain's FluxKustomizationbuilds viapostBuild.substitute— seedataplane-catalog/README.mdfor the full mechanism and the values/secret side of it.
Applying today (no git remote yet)
Nothing here reconciles from git automatically yet — flux/gitrepository.yaml
has no real URL. Apply directly:
kubectl apply -k flux/ # fluxinstance.yaml + gitrepository.yaml (the
# latter will just sit inert, PLACEHOLDER url)
kubectl apply -f kong-platform/gatewayclass.yaml
dataplane-template/ is never applied on its own — it only makes sense
built + substituted by a domain's flux-kustomization.yaml, which itself
can't reconcile yet (needs the real GitRepository, see above).