From 01f873b7739e57c9b91bd861ee9d8aea324ae1ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Tailland?= <stephane.tailland@ibm.com>
Date: Fri, 21 Aug 2026 09:47:29 +0200
Subject: [PATCH] Bind the Gateway TLS secret to Konnect via
 KongCertificate/KongSNI
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Gateway API's listeners[].tls.certificateRefs never gets synced to
Konnect by the gateway operator in this setup — same working pattern
as every other resource here (KongService, KongRoute, ...): a
Kong-native CRD, not the Gateway API's own translation.
---
 kong/kustomization.yaml    |  1 +
 kong/rest/certificate.yaml | 23 +++++++++++++++++++++++
 2 files changed, 24 insertions(+)
 create mode 100644 kong/rest/certificate.yaml

diff --git a/kong/kustomization.yaml b/kong/kustomization.yaml
index da79e6f..7517f6f 100644
--- a/kong/kustomization.yaml
+++ b/kong/kustomization.yaml
@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - rest/service.yaml
+  - rest/certificate.yaml
   - rest/routes.yaml
   - rest/path-rewrite.yaml
   - rest/path-rewrite-bindings.yaml
diff --git a/kong/rest/certificate.yaml b/kong/rest/certificate.yaml
new file mode 100644
index 0000000..5f105bb
--- /dev/null
+++ b/kong/rest/certificate.yaml
@@ -0,0 +1,23 @@
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongCertificate
+metadata:
+  name: ${NAME}
+  namespace: ${NAMESPACE}
+spec:
+  controlPlaneRef:
+    type: konnectNamespacedRef
+    konnectNamespacedRef:
+      name: ${CONTROL_PLANE_REF_NAME}
+  type: secretRef
+  secretRef:
+    name: ${NAME}-tls
+---
+apiVersion: configuration.konghq.com/v1alpha1
+kind: KongSNI
+metadata:
+  name: ${NAME}
+  namespace: ${NAMESPACE}
+spec:
+  name: ${REST_HOSTNAME}
+  certificateRef:
+    name: ${NAME}