From fa7abfe5bd0ca1deb8f1b2b5cb741077d62b77f2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Tailland?= <stephane.tailland@ibm.com>
Date: Fri, 21 Aug 2026 09:51:23 +0200
Subject: [PATCH] Drop the manual KongCertificate/KongSNI workaround

Turned out unnecessary: the real blocker was the missing
konghq.com/secret=true label on the Vault-sourced Secret, not a gap
in the Gateway API TLS translation itself. Once that label was added
(k8s-platform), the operator's own auto-generated KongCertificate/SNI
started working and this manual one just collided with it.
---
 kong/kustomization.yaml    |  1 -
 kong/rest/certificate.yaml | 23 -----------------------
 2 files changed, 24 deletions(-)
 delete mode 100644 kong/rest/certificate.yaml

diff --git a/kong/kustomization.yaml b/kong/kustomization.yaml
index 7517f6f..da79e6f 100644
--- a/kong/kustomization.yaml
+++ b/kong/kustomization.yaml
@@ -2,7 +2,6 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - rest/service.yaml
-  - rest/certificate.yaml
   - rest/routes.yaml
   - rest/path-rewrite.yaml
   - rest/path-rewrite-bindings.yaml
diff --git a/kong/rest/certificate.yaml b/kong/rest/certificate.yaml
deleted file mode 100644
index 5f105bb..0000000
--- a/kong/rest/certificate.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-apiVersion: configuration.konghq.com/v1alpha1
-kind: KongCertificate
-metadata:
-  name: ${NAME}
-  namespace: ${NAMESPACE}
-spec:
-  controlPlaneRef:
-    type: konnectNamespacedRef
-    konnectNamespacedRef:
-      name: ${CONTROL_PLANE_REF_NAME}
-  type: secretRef
-  secretRef:
-    name: ${NAME}-tls
----
-apiVersion: configuration.konghq.com/v1alpha1
-kind: KongSNI
-metadata:
-  name: ${NAME}
-  namespace: ${NAMESPACE}
-spec:
-  name: ${REST_HOSTNAME}
-  certificateRef:
-    name: ${NAME}