Build sales-api REST + MCP layers (Layer 3), full build in one pass

14 routes: Order (single key, full CRUD + order-details sub-resource)
and Orderdetail (composite key ordernumber+productcode, own
top-level resource, mirrors backend's own URL structure). MCP layer
built with the corrected single-route pattern from the start
(STATUS.md section 18) — 7 tools, list/get read-only for all 5
roles, create-order/create-orderdetail for admin+customer+support
(verified against OrderPermission/OrderScopedPermission.check() —
support gets an unconditional class-level pass, the status-only
restriction is object-level and doesn't apply to create).

Keycloak (local): sales-api-audience + mcp-sales-audience client
scopes, sales-api + mcp-sales resource clients, attached to the
broker and librechat respectively. Deploy key and broker secret
reused/mirrored from catalog-api and the live broker client, same
pattern as customers-api/payments-api.

README.md

@@ -1,12 +1,63 @@
 # sales-api
 
-Placeholder component repo for the **sales** slice of
+Kong routing/policy layer for the **sales** slice of `classic-models-api`
-`classic-models-api` (see /Users/stephanetailland/git/classic-models-api),
+(see `/Users/stephanetailland/git/classic-models-api`), split out per the
-split out per the DDD decomposition documented in
+DDD decomposition in `../kong-konnect-deployment-strategy.md`. The backend
-`../kong-konnect-deployment-strategy.md`.
+stays a single monolith — only Kong does the domain split. Structure
+mirrors `../payments-api`/`../customers-api` — single MCP route, not
+`../catalog-api`'s original two-route pattern (see `../STATUS.md` section
+18).
 
-This repo does not yet contain migrated application code — only the
+Two resources, both with a REST surface and MCP tools:
-routing scaffold (layer 3: `HTTPRoute`/`KongPlugin`/`KongConsumer`,
+- **`Order`** (single key `ordernumber`) — full CRUD + an `order-details`
-alongside the eventual app manifests), targeting the Control Plane(s)
+  sub-resource (`GET /sales/v1/orders/{ordernumber}/order-details/`,
-provisioned for `sales` (see `../konnect-platform/domains/sales/`
+  mirrors the backend's own `@action` on `OrderViewSet`).
-and `../dataplane-sales`).
+- **`Orderdetail`** (**composite key** `ordernumber` + `productcode`,
+  exposed as its own top-level resource — the backend does this too, not
+  just nested under `Order`).
+
+| Route | Method | Backend path |
+|---|---|---|
+| `/sales/v1/orders/` | GET, POST | `/classic-models/api/v1/orders/` |
+| `/sales/v1/orders/{ordernumber}/` | GET, PUT, PATCH, DELETE | `/classic-models/api/v1/orders/{ordernumber}/` |
+| `/sales/v1/orders/{ordernumber}/order-details/` | GET | `/classic-models/api/v1/orders/{ordernumber}/order-details/` |
+| `/sales/v1/orderdetails/` | GET, POST | `/classic-models/api/v1/orderdetails/` |
+| `/sales/v1/orderdetails/{ordernumber}/{productcode}/` | GET, PUT, PATCH, DELETE | `/classic-models/api/v1/orderdetails/{ordernumber}/{productcode}/` |
+| `/sales-mcp` | GET, POST, DELETE | MCP streamable-http (tools call into the REST routes above) |
+
+## Auth & MCP tool ACLs
+
+`openid-connect` on both surfaces (`sales-api` REST audience, `mcp-sales`
+MCP audience), RFC 8693 exchange chain MCP → `sales-api` → `classic-models-api`,
+same shape as every other domain. IdP: local Keycloak
+(`https://keycloak.sttlab.local/realms/classic-models`).
+
+MCP write-tool ACLs (`create-order`, `create-orderdetail`) are **admin +
+customer + support** — deliberately different from `customers-api`'s/
+`payments-api`'s admin-only write tools, because it's what the real
+backend permission classes actually allow, verified directly against
+`authentication/permissions.py` rather than assumed by analogy:
+`OrderPermission.check()`/`OrderScopedPermission.check()` give `support`
+an unconditional pass at the class-level (`has_permission`) check — the
+"status-only" restriction usually associated with `support` is enforced
+at the *object* level (`has_object_permission`), which only applies to
+existing records (update/delete), not `create`. `read_only`/
+`product_manager` are excluded (both classes only pass those roles for
+`SAFE_METHODS`).
+
+**Correction to note**: `payments-api`'s `create-payment` tool (built
+earlier this session) restricted writes to `admin` only, described at the
+time as "verified against `PaymentPermission`'s actual logic" — but
+`PaymentPermission` extends this same `OrderScopedPermission` base class,
+so by the same reasoning above, `customer` and `support` should also have
+been included there. Not fixed as part of this domain's build (out of
+scope, and it's *more* restrictive than the backend rather than less, so
+not a safety issue) — flagged here and in `../STATUS.md` for whoever
+revisits `payments-api`'s MCP tool ACLs.
+
+## Structure
+
+Same `dev/` + `kong/rest/` + `kong/mcp/` layout as `payments-api`. Deploy
+key and broker secret follow the same reused/mirrored pattern (`catalog-api`'s
+deploy key, broker's real secret pulled live from Keycloak and copied to
+`kong-v2/sales-api/*` in Vault).

dev/externalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: sales-api-git-auth
+  namespace: sales
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kong-v2
+  target:
+    name: sales-api-git-auth
+  data:
+    - secretKey: identity
+      remoteRef:
+        key: kong-v2/sales-api/git-deploy-key
+        property: identity
+    - secretKey: identity.pub
+      remoteRef:
+        key: kong-v2/sales-api/git-deploy-key
+        property: identity.pub
+    - secretKey: known_hosts
+      remoteRef:
+        key: kong-v2/sales-api/git-deploy-key
+        property: known_hosts

dev/flux-kustomization.yaml

@@ -0,0 +1,32 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: sales-dev-api
+  namespace: sales
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: sales-api-dev
+  path: ./kong
+  prune: true
+  dependsOn:
+    - name: sales-dev-api-gateway
+      namespace: flux-system
+  postBuild:
+    substitute:
+      NAME: sales-dev
+      NAMESPACE: sales
+      CONTROL_PLANE_REF_NAME: sales-dev-pjdc7
+      BACKEND_HOST: classic-models-api.classic-models.svc.cluster.local
+      OIDC_ISSUER: https://keycloak.sttlab.local/realms/classic-models
+      API_AUDIENCE: '["sales-api"]'
+      BACKEND_AUDIENCE: '["classic-models-api"]'
+      BACKEND_SCOPES: '[]'
+      API_RATE_LIMIT_MINUTE: "60"
+      AUDIT_LOG_ENDPOINT: http://audit-log-collector.observability.svc.cluster.local/logs
+      REST_HOSTNAME: sales-dev.sttlab.local
+      TOKEN_EXCHANGE_CLIENT_ID: kong-token-exchange-broker
+    substituteFrom:
+      - kind: Secret
+        name: sales-token-exchange-broker

dev/gitrepository.yaml

@@ -0,0 +1,12 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: sales-api-dev
+  namespace: sales
+spec:
+  interval: 5m
+  url: ssh://git@gitea.sttlab.eu:2222/stt/kong-sales-api.git
+  secretRef:
+    name: sales-api-git-auth
+  ref:
+    branch: main

dev/token-exchange-broker-externalsecret.yaml

@@ -0,0 +1,17 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: sales-token-exchange-broker
+  namespace: sales
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kong-v2
+  target:
+    name: sales-token-exchange-broker
+  data:
+    - secretKey: TOKEN_EXCHANGE_CLIENT_SECRET
+      remoteRef:
+        key: kong-v2/sales-api/token-exchange-broker
+        property: client_secret

kong/httproute.yaml

@@ -1 +0,0 @@
-# TODO: HTTPRoute for sales's resources

kong/kongplugin.yaml

@@ -1 +0,0 @@
-# TODO: KongPlugin(s) specific to sales

kong/kustomization.yaml

@@ -0,0 +1,23 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - rest/service.yaml
+  - rest/routes.yaml
+  - rest/path-rewrite.yaml
+  - rest/path-rewrite-bindings.yaml
+  - rest/kongplugin.yaml
+  - rest/rate-limiting.yaml
+  - rest/proxy-cache.yaml
+  - rest/audit-log.yaml
+  - rest/audit-log-body-capture.yaml
+  - rest/audit-log-body-capture-bindings.yaml
+  - rest/pluginbindings.yaml
+  - mcp/service.yaml
+  - mcp/routes.yaml
+  - mcp/consumergroups.yaml
+  - mcp/ai-mcp-proxy.yaml
+  - mcp/openid-connect.yaml
+  - mcp/audit-log.yaml
+  - mcp/audit-log-body-capture.yaml
+  - mcp/audit-log-body-capture-bindings.yaml
+  - mcp/pluginbindings.yaml

kong/mcp/ai-mcp-proxy.yaml

@@ -0,0 +1,223 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-sales-mcp-ai-mcp-proxy
+  namespace: ${NAMESPACE}
+plugin: ai-mcp-proxy
+config:
+  mode: conversion-listener
+  include_consumer_groups: true
+  tools:
+    - name: list-orders
+      description: Retrieves a paginated list of orders in the classic-models CRM.
+      annotations:
+        title: List all orders
+        read_only_hint: true
+        idempotent_hint: true
+        destructive_hint: false
+        open_world_hint: false
+      acl:
+        allow:
+          - admin
+          - read_only
+          - product_manager
+          - customer
+          - support
+      method: GET
+      scheme: http
+      host: ${REST_HOSTNAME}
+      path: /sales/v1/orders/
+    - name: get-order
+      description: Retrieves a single order by order number.
+      annotations:
+        title: Get an order
+        read_only_hint: true
+        idempotent_hint: true
+        destructive_hint: false
+        open_world_hint: false
+      acl:
+        allow:
+          - admin
+          - read_only
+          - product_manager
+          - customer
+          - support
+      method: GET
+      scheme: http
+      host: ${REST_HOSTNAME}
+      path: /sales/v1/orders/{ordernumber}/
+      parameters:
+        - name: ordernumber
+          in: path
+          required: true
+          description: The order's unique number.
+          schema: {}
+    - name: get-order-orderdetails
+      description: Retrieves all line items for a specific order.
+      annotations:
+        title: Get order line items
+        read_only_hint: true
+        idempotent_hint: true
+        destructive_hint: false
+        open_world_hint: false
+      acl:
+        allow:
+          - admin
+          - read_only
+          - product_manager
+          - customer
+          - support
+      method: GET
+      scheme: http
+      host: ${REST_HOSTNAME}
+      path: /sales/v1/orders/{ordernumber}/order-details/
+      parameters:
+        - name: ordernumber
+          in: path
+          required: true
+          description: The order's unique number.
+          schema: {}
+    - name: create-order
+      description: Creates a new order in the CRM.
+      annotations:
+        title: Create an order
+        read_only_hint: false
+        idempotent_hint: false
+        destructive_hint: false
+        open_world_hint: false
+      # Verified against OrderPermission.check() (authentication/permissions.py):
+      # admin always passes; customer passes if get_customer_number(user) is
+      # not None; support passes unconditionally at this class-level check
+      # (object-level restricts support to status-only on *existing* orders,
+      # which doesn't apply to create — no object yet). read_only/
+      # product_manager only pass for SAFE_METHODS, excluded here.
+      acl:
+        allow:
+          - admin
+          - customer
+          - support
+      method: POST
+      scheme: http
+      host: ${REST_HOSTNAME}
+      path: /sales/v1/orders/
+      request_body:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                ordernumber:
+                  type: integer
+                orderdate:
+                  type: string
+                requireddate:
+                  type: string
+                shippeddate:
+                  type: string
+                status:
+                  type: string
+                comments:
+                  type: string
+                customernumber:
+                  type: integer
+              required:
+                - ordernumber
+                - orderdate
+                - requireddate
+                - status
+                - customernumber
+    - name: list-orderdetails
+      description: Retrieves a paginated list of order line items in the classic-models CRM.
+      annotations:
+        title: List all order line items
+        read_only_hint: true
+        idempotent_hint: true
+        destructive_hint: false
+        open_world_hint: false
+      acl:
+        allow:
+          - admin
+          - read_only
+          - product_manager
+          - customer
+          - support
+      method: GET
+      scheme: http
+      host: ${REST_HOSTNAME}
+      path: /sales/v1/orderdetails/
+    - name: get-orderdetail
+      description: Retrieves a single order line item by order number and product code.
+      annotations:
+        title: Get an order line item
+        read_only_hint: true
+        idempotent_hint: true
+        destructive_hint: false
+        open_world_hint: false
+      acl:
+        allow:
+          - admin
+          - read_only
+          - product_manager
+          - customer
+          - support
+      method: GET
+      scheme: http
+      host: ${REST_HOSTNAME}
+      path: /sales/v1/orderdetails/{ordernumber}/{productcode}/
+      parameters:
+        - name: ordernumber
+          in: path
+          required: true
+          description: The order's unique number.
+          schema: {}
+        - name: productcode
+          in: path
+          required: true
+          description: The product's unique code.
+          schema: {}
+    - name: create-orderdetail
+      description: Adds a new line item to an order.
+      annotations:
+        title: Create an order line item
+        read_only_hint: false
+        idempotent_hint: false
+        destructive_hint: false
+        open_world_hint: false
+      # Verified against OrderScopedPermission.check() (Orderdetail's base
+      # permission class) — same shape as create-order above: admin,
+      # customer (if get_customer_number is not None), support (class-level
+      # unconditional pass) allowed; read_only/product_manager excluded
+      # (SAFE_METHODS only).
+      acl:
+        allow:
+          - admin
+          - customer
+          - support
+      method: POST
+      scheme: http
+      host: ${REST_HOSTNAME}
+      path: /sales/v1/orderdetails/
+      request_body:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                ordernumber:
+                  type: integer
+                productcode:
+                  type: string
+                quantityordered:
+                  type: integer
+                priceeach:
+                  type: string
+                orderlinenumber:
+                  type: integer
+              required:
+                - ordernumber
+                - productcode
+                - quantityordered
+                - priceeach
+                - orderlinenumber

kong/mcp/audit-log-body-capture-bindings.yaml

@@ -0,0 +1,35 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-sales-mcp-audit-capture-request-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-sales-mcp-audit-capture-request
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-sales-mcp
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-sales-mcp-audit-capture-response-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-sales-mcp-audit-capture-response
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-sales-mcp

kong/mcp/audit-log-body-capture.yaml

@@ -0,0 +1,23 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-sales-mcp-audit-capture-request
+  namespace: ${NAMESPACE}
+plugin: pre-function
+config:
+  access:
+    - "kong.ctx.shared.audit_request_body = kong.request.get_raw_body()"
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-sales-mcp-audit-capture-response
+  namespace: ${NAMESPACE}
+plugin: post-function
+config:
+  body_filter:
+    - |
+      local chunk = ngx.arg[1]
+      if chunk then
+        kong.ctx.shared.audit_response_body = (kong.ctx.shared.audit_response_body or "") .. chunk
+      end

kong/mcp/audit-log.yaml

@@ -0,0 +1,13 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-sales-mcp-audit-log
+  namespace: ${NAMESPACE}
+plugin: http-log
+config:
+  http_endpoint: ${AUDIT_LOG_ENDPOINT}
+  method: POST
+  content_type: application/json
+  custom_fields_by_lua:
+    request_body: "return kong.ctx.shared.audit_request_body"
+    response_body: "return kong.ctx.shared.audit_response_body"

kong/mcp/consumergroups.yaml

@@ -0,0 +1,59 @@
+apiVersion: configuration.konghq.com/v1beta1
+kind: KongConsumerGroup
+metadata:
+  name: ${NAME}-admin
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  name: admin
+---
+apiVersion: configuration.konghq.com/v1beta1
+kind: KongConsumerGroup
+metadata:
+  name: ${NAME}-read-only
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  name: read_only
+---
+apiVersion: configuration.konghq.com/v1beta1
+kind: KongConsumerGroup
+metadata:
+  name: ${NAME}-product-manager
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  name: product_manager
+---
+apiVersion: configuration.konghq.com/v1beta1
+kind: KongConsumerGroup
+metadata:
+  name: ${NAME}-customer
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  name: customer
+---
+apiVersion: configuration.konghq.com/v1beta1
+kind: KongConsumerGroup
+metadata:
+  name: ${NAME}-support
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  name: support

kong/mcp/openid-connect.yaml

@@ -0,0 +1,27 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-sales-mcp-openid-connect
+  namespace: ${NAMESPACE}
+plugin: openid-connect
+config:
+  issuer: ${OIDC_ISSUER}
+  audience_required: ${API_AUDIENCE}
+  auth_methods:
+    - bearer
+  display_errors: false
+  ssl_verify: true
+  consumer_groups_claim:
+    - realm_access
+    - roles
+  client_id:
+    - ${TOKEN_EXCHANGE_CLIENT_ID}
+  client_secret:
+    - ${TOKEN_EXCHANGE_CLIENT_SECRET}
+  token_exchange:
+    subject_token_issuers:
+      - issuer: ${OIDC_ISSUER}
+        conditions: {}
+    request:
+      audience: ${API_AUDIENCE}
+      scopes: []

kong/mcp/pluginbindings.yaml

@@ -0,0 +1,53 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-sales-mcp-openid-connect-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-sales-mcp-openid-connect
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-sales-mcp
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-sales-mcp-ai-mcp-proxy-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-sales-mcp-ai-mcp-proxy
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-sales-mcp
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-sales-mcp-audit-log-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-sales-mcp-audit-log
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-sales-mcp

kong/mcp/routes.yaml

@@ -0,0 +1,22 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-sales-mcp
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-sales-mcp
+  name: sales-mcp
+  hosts:
+    - ${REST_HOSTNAME}
+  methods:
+    - GET
+    - POST
+    - DELETE
+  paths:
+    - /sales-mcp
+  strip_path: false
+  tags:
+    - sales

kong/mcp/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongService
+metadata:
+  name: ${NAME}-sales-mcp
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  name: sales-mcp
+  host: ${REST_HOSTNAME}
+  port: 80
+  protocol: http
+  path: /
+  tags:
+    - sales

kong/rest/audit-log-body-capture-bindings.yaml

@@ -0,0 +1,35 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-sales-api-audit-capture-request-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-sales-api-audit-capture-request
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-sales-api
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-sales-api-audit-capture-response-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-sales-api-audit-capture-response
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-sales-api

kong/rest/audit-log-body-capture.yaml

@@ -0,0 +1,23 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-sales-api-audit-capture-request
+  namespace: ${NAMESPACE}
+plugin: pre-function
+config:
+  access:
+    - "kong.ctx.shared.audit_request_body = kong.request.get_raw_body()"
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-sales-api-audit-capture-response
+  namespace: ${NAMESPACE}
+plugin: post-function
+config:
+  body_filter:
+    - |
+      local chunk = ngx.arg[1]
+      if chunk then
+        kong.ctx.shared.audit_response_body = (kong.ctx.shared.audit_response_body or "") .. chunk
+      end

kong/rest/audit-log.yaml

@@ -0,0 +1,13 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-sales-api-audit-log
+  namespace: ${NAMESPACE}
+plugin: http-log
+config:
+  http_endpoint: ${AUDIT_LOG_ENDPOINT}
+  method: POST
+  content_type: application/json
+  custom_fields_by_lua:
+    request_body: "return kong.ctx.shared.audit_request_body"
+    response_body: "return kong.ctx.shared.audit_response_body"

kong/rest/kongplugin.yaml

@@ -0,0 +1,30 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-sales-api-openid-connect
+  namespace: ${NAMESPACE}
+plugin: openid-connect
+config:
+  issuer: ${OIDC_ISSUER}
+  audience_required: ${BACKEND_AUDIENCE}
+  auth_methods:
+    - bearer
+  display_errors: false
+  ssl_verify: true
+  consumer_claims:
+    - - sub
+  consumer_by:
+    - custom_id
+    - username
+  consumer_optional: true
+  client_id:
+    - ${TOKEN_EXCHANGE_CLIENT_ID}
+  client_secret:
+    - ${TOKEN_EXCHANGE_CLIENT_SECRET}
+  token_exchange:
+    subject_token_issuers:
+      - issuer: ${OIDC_ISSUER}
+        conditions: {}
+    request:
+      audience: ${BACKEND_AUDIENCE}
+      scopes: ${BACKEND_SCOPES}

kong/rest/path-rewrite-bindings.yaml

@@ -0,0 +1,233 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-sales-api-rewrite-listorders-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-sales-api-rewrite-listorders
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-sales-api-listorders
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-sales-api-rewrite-createorder-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-sales-api-rewrite-createorder
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-sales-api-createorder
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-sales-api-rewrite-getorder-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-sales-api-rewrite-getorder
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-sales-api-getorder
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-sales-api-rewrite-updateorder-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-sales-api-rewrite-updateorder
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-sales-api-updateorder
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-sales-api-rewrite-patchorder-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-sales-api-rewrite-patchorder
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-sales-api-patchorder
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-sales-api-rewrite-deleteorder-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-sales-api-rewrite-deleteorder
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-sales-api-deleteorder
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-sales-api-rewrite-getorderorderdetails-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-sales-api-rewrite-getorderorderdetails
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-sales-api-getorderorderdetails
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-sales-api-rewrite-listorderdetails-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-sales-api-rewrite-listorderdetails
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-sales-api-listorderdetails
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-sales-api-rewrite-createorderdetail-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-sales-api-rewrite-createorderdetail
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-sales-api-createorderdetail
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-sales-api-rewrite-getorderdetail-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-sales-api-rewrite-getorderdetail
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-sales-api-getorderdetail
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-sales-api-rewrite-updateorderdetail-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-sales-api-rewrite-updateorderdetail
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-sales-api-updateorderdetail
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-sales-api-rewrite-patchorderdetail-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-sales-api-rewrite-patchorderdetail
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-sales-api-patchorderdetail
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-sales-api-rewrite-deleteorderdetail-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-sales-api-rewrite-deleteorderdetail
+  targets:
+    routeRef:
+      group: configuration.konghq.com
+      kind: KongRoute
+      name: ${NAME}-sales-api-deleteorderdetail

kong/rest/path-rewrite.yaml

@@ -0,0 +1,129 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-sales-api-rewrite-listorders
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/orders/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-sales-api-rewrite-createorder
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/orders/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-sales-api-rewrite-getorder
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/orders/$(uri_captures.ordernumber)/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-sales-api-rewrite-updateorder
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/orders/$(uri_captures.ordernumber)/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-sales-api-rewrite-patchorder
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/orders/$(uri_captures.ordernumber)/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-sales-api-rewrite-deleteorder
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/orders/$(uri_captures.ordernumber)/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-sales-api-rewrite-getorderorderdetails
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/orders/$(uri_captures.ordernumber)/order-details/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-sales-api-rewrite-listorderdetails
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/orderdetails/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-sales-api-rewrite-createorderdetail
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/orderdetails/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-sales-api-rewrite-getorderdetail
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/orderdetails/$(uri_captures.ordernumber)/$(uri_captures.productcode)/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-sales-api-rewrite-updateorderdetail
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/orderdetails/$(uri_captures.ordernumber)/$(uri_captures.productcode)/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-sales-api-rewrite-patchorderdetail
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/orderdetails/$(uri_captures.ordernumber)/$(uri_captures.productcode)/
+---
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-sales-api-rewrite-deleteorderdetail
+  namespace: ${NAMESPACE}
+plugin: request-transformer-advanced
+config:
+  replace:
+    uri: /classic-models/api/v1/orderdetails/$(uri_captures.ordernumber)/$(uri_captures.productcode)/

kong/rest/pluginbindings.yaml

@@ -0,0 +1,71 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-sales-api-openid-connect-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-sales-api-openid-connect
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-sales-api
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-sales-api-rate-limiting-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-sales-api-rate-limiting
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-sales-api
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-sales-api-proxy-cache-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-sales-api-proxy-cache
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-sales-api
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongPluginBinding
+metadata:
+  name: ${NAME}-sales-api-audit-log-binding
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  pluginRef:
+    name: ${NAME}-sales-api-audit-log
+  targets:
+    serviceRef:
+      group: configuration.konghq.com
+      kind: KongService
+      name: ${NAME}-sales-api

kong/rest/proxy-cache.yaml

@@ -0,0 +1,16 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-sales-api-proxy-cache
+  namespace: ${NAMESPACE}
+plugin: proxy-cache-advanced
+config:
+  strategy: memory
+  request_method:
+    - GET
+    - HEAD
+  response_code:
+    - 200
+  content_type:
+    - application/json
+  cache_ttl: 60

kong/rest/rate-limiting.yaml

@@ -0,0 +1,14 @@
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-sales-api-rate-limiting
+  namespace: ${NAMESPACE}
+plugin: rate-limiting-advanced
+config:
+  limit:
+    - ${API_RATE_LIMIT_MINUTE}
+  window_size:
+    - 60
+  identifier: consumer
+  sync_rate: -1
+  strategy: local

kong/rest/routes.yaml

@@ -0,0 +1,259 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-sales-api-listorders
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-sales-api
+  name: sales-api_listorders
+  methods:
+    - GET
+    - OPTIONS
+  paths:
+    - /sales/v1/orders/
+  strip_path: false
+  tags:
+    - sales
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-sales-api-createorder
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-sales-api
+  name: sales-api_createorder
+  methods:
+    - POST
+    - OPTIONS
+  paths:
+    - /sales/v1/orders/
+  strip_path: false
+  tags:
+    - sales
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-sales-api-getorder
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-sales-api
+  name: sales-api_getorder
+  methods:
+    - GET
+    - OPTIONS
+  paths:
+    - ~/sales/v1/orders/(?<ordernumber>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - sales
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-sales-api-updateorder
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-sales-api
+  name: sales-api_updateorder
+  methods:
+    - PUT
+    - OPTIONS
+  paths:
+    - ~/sales/v1/orders/(?<ordernumber>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - sales
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-sales-api-patchorder
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-sales-api
+  name: sales-api_patchorder
+  methods:
+    - PATCH
+    - OPTIONS
+  paths:
+    - ~/sales/v1/orders/(?<ordernumber>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - sales
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-sales-api-deleteorder
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-sales-api
+  name: sales-api_deleteorder
+  methods:
+    - DELETE
+    - OPTIONS
+  paths:
+    - ~/sales/v1/orders/(?<ordernumber>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - sales
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-sales-api-getorderorderdetails
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-sales-api
+  name: sales-api_getorderorderdetails
+  methods:
+    - GET
+    - OPTIONS
+  paths:
+    - ~/sales/v1/orders/(?<ordernumber>[^#?/]+)/order-details/$
+  strip_path: false
+  tags:
+    - sales
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-sales-api-listorderdetails
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-sales-api
+  name: sales-api_listorderdetails
+  methods:
+    - GET
+    - OPTIONS
+  paths:
+    - /sales/v1/orderdetails/
+  strip_path: false
+  tags:
+    - sales
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-sales-api-createorderdetail
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-sales-api
+  name: sales-api_createorderdetail
+  methods:
+    - POST
+    - OPTIONS
+  paths:
+    - /sales/v1/orderdetails/
+  strip_path: false
+  tags:
+    - sales
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-sales-api-getorderdetail
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-sales-api
+  name: sales-api_getorderdetail
+  methods:
+    - GET
+    - OPTIONS
+  paths:
+    - ~/sales/v1/orderdetails/(?<ordernumber>[^#?/]+)/(?<productcode>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - sales
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-sales-api-updateorderdetail
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-sales-api
+  name: sales-api_updateorderdetail
+  methods:
+    - PUT
+    - OPTIONS
+  paths:
+    - ~/sales/v1/orderdetails/(?<ordernumber>[^#?/]+)/(?<productcode>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - sales
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-sales-api-patchorderdetail
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-sales-api
+  name: sales-api_patchorderdetail
+  methods:
+    - PATCH
+    - OPTIONS
+  paths:
+    - ~/sales/v1/orderdetails/(?<ordernumber>[^#?/]+)/(?<productcode>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - sales
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongRoute
+metadata:
+  name: ${NAME}-sales-api-deleteorderdetail
+  namespace: ${NAMESPACE}
+spec:
+  serviceRef:
+    type: namespacedRef
+    namespacedRef:
+      name: ${NAME}-sales-api
+  name: sales-api_deleteorderdetail
+  methods:
+    - DELETE
+    - OPTIONS
+  paths:
+    - ~/sales/v1/orderdetails/(?<ordernumber>[^#?/]+)/(?<productcode>[^#?/]+)/$
+  strip_path: false
+  tags:
+    - sales

kong/rest/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongService
+metadata:
+  name: ${NAME}-sales-api
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  name: sales-api
+  host: ${BACKEND_HOST}
+  port: 8000
+  protocol: http
+  path: /
+  tags:
+    - sales