From 5a2addb073aacd8c2a1f79aa294b9ca37f81220a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Tailland?= Date: Wed, 26 Aug 2026 16:30:15 +0200 Subject: [PATCH] Source the control plane from Vault and use a stable ref name MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two hardcoded values tied this repo to one specific Konnect org, and replacing that org broke both. CONTROL_PLANE_ID was pasted into gateway-kustomization.yaml. It now comes from Vault through External Secrets, into a Secret in flux-system that postBuild.substituteFrom reads. flux-system is acceptable for the id — it is visible in the Konnect UI URL — but not for the token, which keeps going straight to the domain namespace as before. CONTROL_PLANE_REF_NAME held the random suffix the Gateway operator gives its auto-created mirror CR, looked up by hand. The new org recreated those CRs under new suffixes, so the ref named an object that no longer existed and the domain's Kong entities sat Programmed=False. It now names the ${NAME}-cp mirror declared in k8s-platform's dataplane-template — derived from NAME, stable across Gateway recreations and org changes. Co-Authored-By: Claude Opus 5 --- dev/ai-gateway-kustomization.yaml | 7 +++++- dev/externalsecret-control-plane.yaml | 34 +++++++++++++++++++++++++++ dev/proxy-kustomization.yaml | 2 +- 3 files changed, 41 insertions(+), 2 deletions(-) create mode 100644 dev/externalsecret-control-plane.yaml diff --git a/dev/ai-gateway-kustomization.yaml b/dev/ai-gateway-kustomization.yaml index f6b0735..980294b 100644 --- a/dev/ai-gateway-kustomization.yaml +++ b/dev/ai-gateway-kustomization.yaml @@ -14,8 +14,13 @@ spec: substitute: NAME: llm-dev NAMESPACE: llm - CONTROL_PLANE_ID: "61bd9456-7f3b-4312-bf1e-44e7e7f2dade" HOSTNAME: llm-dev.sttlab.local substituteFrom: - kind: ConfigMap name: dataplane-template-defaults + # CONTROL_PLANE_ID comes from Vault via ESO instead of being hardcoded + # here: a new Konnect org then needs no edit in this repo. Not a secret — + # the id is visible in the Konnect UI URL — so flux-system is fine for it, + # unlike the token. + - kind: Secret + name: llm-dev-control-plane diff --git a/dev/externalsecret-control-plane.yaml b/dev/externalsecret-control-plane.yaml new file mode 100644 index 0000000..a6370a9 --- /dev/null +++ b/dev/externalsecret-control-plane.yaml @@ -0,0 +1,34 @@ +# The Control Plane id, delivered to flux-system so gateway-kustomization.yaml +# can substitute it instead of carrying a hardcoded UUID. +# +# Why a second ExternalSecret rather than extra keys on the existing one: +# substituteFrom requires the Secret to sit in the same namespace as the Flux +# Kustomization, which is flux-system — a shared, broadly-readable namespace. +# The Konnect token must never go there. A Control Plane id is not a secret; +# it is visible in the Konnect UI URL. +# +# Terraform writes this path (see konnect-platform). Moving to a new Konnect +# org then needs no edit here at all. +apiVersion: external-secrets.io/v1 +kind: ExternalSecret +metadata: + name: llm-dev-control-plane + namespace: flux-system +spec: + refreshInterval: 1h + secretStoreRef: + kind: ClusterSecretStore + name: vault-kong-v2 + target: + name: llm-dev-control-plane + data: + # Key names are the Flux substitution variables verbatim: substituteFrom + # exposes each key as ${KEY}. + - secretKey: CONTROL_PLANE_ID + remoteRef: + key: kong-v2/llm/dev/control-plane + property: CONTROL_PLANE_ID + - secretKey: CONTROL_PLANE_NAME + remoteRef: + key: kong-v2/llm/dev/control-plane + property: CONTROL_PLANE_NAME diff --git a/dev/proxy-kustomization.yaml b/dev/proxy-kustomization.yaml index dcf3f51..0518ac2 100644 --- a/dev/proxy-kustomization.yaml +++ b/dev/proxy-kustomization.yaml @@ -17,7 +17,7 @@ spec: substitute: NAME: llm-dev NAMESPACE: llm - CONTROL_PLANE_REF_NAME: llm-dev-jzvxt + CONTROL_PLANE_REF_NAME: llm-dev-cp OIDC_ISSUER: https://keycloak.sttlab.eu/realms/sttlab AGENT_AUDIENCE: '["llm-proxy"]' OPENROUTER_UPSTREAM_URL: https://openrouter.ai/api/v1/chat/completions