Source per-domain Gateway TLS certs from Vault instead of cert-manager

cert-manager-issued Certificates never synced to Konnect as KongCertificate
objects through the Gateway API listener path, so dataplanes fell back to
Kong's default self-signed cert. Reuse the working kong-namespace pattern
(a static wildcard cert) via ExternalSecret instead.

dataplane-template/certificate.yaml

@@ -1,16 +0,0 @@
-# Not a self-signed cert hand-copied into a Secret like
-# ~/dev/kong/kube/gateway/apigw/secret.yaml does — issuer is per-domain/env
-# config (e.g. sttlab-local-ca ClusterIssuer for local, a real ACME issuer
-# for prod), not hardcoded here.
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: ${NAME}
-  namespace: ${NAMESPACE}
-spec:
-  secretName: ${NAME}-tls
-  dnsNames:
-    - ${HOSTNAME}
-  issuerRef:
-    kind: ${TLS_ISSUER_KIND}
-    name: ${TLS_ISSUER_NAME}

dataplane-template/externalsecret-tls.yaml

@@ -0,0 +1,23 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: ${NAME}-tls
+  namespace: ${NAMESPACE}
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault-kong-v2
+  target:
+    name: ${NAME}-tls
+    template:
+      type: kubernetes.io/tls
+  data:
+    - secretKey: tls.crt
+      remoteRef:
+        key: kong-v2/shared/tls/sttlab-local
+        property: tls.crt
+    - secretKey: tls.key
+      remoteRef:
+        key: kong-v2/shared/tls/sttlab-local
+        property: tls.key

dataplane-template/kustomization.yaml

@@ -4,4 +4,4 @@ resources:
   - konnectapiauthconfiguration.yaml
   - gatewayconfiguration.yaml
   - gateway.yaml
-  - certificate.yaml
+  - externalsecret-tls.yaml

kong-platform/dataplane-template-defaults.yaml

@@ -14,7 +14,6 @@ data:
   KONNECT_SERVER_URL: eu.api.konghq.com
   GATEWAY_IMAGE: kong/kong-gateway:3.15
   REPLICAS: "1"
-  TLS_ISSUER_KIND: ClusterIssuer
   OIDC_ISSUER: https://keycloak.sttlab.eu/realms/sttlab # Keycloak today, but this template shouldn't assume it stays that way
   CORS_ORIGINS: https://*.sttlab.local
   RATE_LIMIT_MINUTE: "300"