First commit

dataplane-template/secret.yaml

@@ -0,0 +1,15 @@
+# konghq.com/secret: "true" is required — the Kong Operator's secret
+# watch/cache is scoped to that label; without it, references from
+# KonnectAPIAuthConfiguration.secretRef resolve to "does not exist" even
+# though the Secret is present (see ~/dev/kong/kube/gateway/apigw/secret.yaml).
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ${KONNECT_AUTH_SECRET_NAME}
+  namespace: ${NAMESPACE}
+  labels:
+    konghq.com/credential: konnect
+    konghq.com/secret: "true"
+type: Opaque
+stringData:
+  token: ${KONNECT_PAT_TOKEN}