Source per-domain Gateway TLS certs from Vault instead of cert-manager

cert-manager-issued Certificates never synced to Konnect as KongCertificate
objects through the Gateway API listener path, so dataplanes fell back to
Kong's default self-signed cert. Reuse the working kong-namespace pattern
(a static wildcard cert) via ExternalSecret instead.

dataplane-template/certificate.yaml

@@ -1,16 +0,0 @@
-# Not a self-signed cert hand-copied into a Secret like
-# ~/dev/kong/kube/gateway/apigw/secret.yaml does — issuer is per-domain/env
-# config (e.g. sttlab-local-ca ClusterIssuer for local, a real ACME issuer
-# for prod), not hardcoded here.
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: ${NAME}
-  namespace: ${NAMESPACE}
-spec:
-  secretName: ${NAME}-tls
-  dnsNames:
-    - ${HOSTNAME}
-  issuerRef:
-    kind: ${TLS_ISSUER_KIND}
-    name: ${TLS_ISSUER_NAME}

dataplane-template/externalsecret-tls.yaml

@@ -0,0 +1,23 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: ${NAME}-tls
+  namespace: ${NAMESPACE}
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kong-v2
+  target:
+    name: ${NAME}-tls
+    template:
+      type: kubernetes.io/tls
+  data:
+    - secretKey: tls.crt
+      remoteRef:
+        key: kong-v2/shared/tls/sttlab-local
+        property: tls.crt
+    - secretKey: tls.key
+      remoteRef:
+        key: kong-v2/shared/tls/sttlab-local
+        property: tls.key

dataplane-template/kustomization.yaml

@@ -4,4 +4,4 @@ resources:
   - konnectapiauthconfiguration.yaml
   - gatewayconfiguration.yaml
   - gateway.yaml
-  - certificate.yaml
+  - externalsecret-tls.yaml