Stéphane Tailland
11d27c2655
postBuild.substituteFrom can only read a ConfigMap in its own namespace. dataplane-template-defaults existed only in flux-system, so every gateway Kustomization had to live in flux-system to reach it — a namespace the feature teams have no access to. Their own gateway configuration ended up outside their reach as a side effect of a substitution rule, not as a governance decision. Add a namespace-less copy of the ConfigMap under kong-platform/domain-defaults, plus one Kustomization per domain in flux/domain-defaults.yaml differing only by targetNamespace. One source file, one edit when a default changes, six copies that follow. Platform-owned deliberately: these are the defaults a team inherits, not ones it sets, so they stay in flux-system while everything a team does own moves out of it. This is the precondition, not the move itself. The flux-system copy stays until the gateway Kustomizations relocate, and they cannot be patched into a new namespace — that is a delete and recreate, with a window where the gateway is unreconciled. It also retires a workaround: platform-llm inlined OTEL_TRACES_ENDPOINT because its Kustomization had to sit in the llm namespace, holding real credentials it must not put in flux-system, and so could not read this ConfigMap. With the ConfigMap in llm, that inlining can go. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
5 lines
112 B
YAML
5 lines
112 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
- dataplane-template-defaults.yaml
|