Give the Konnect control-plane ref a stable, derived name

Every Kong entity names its control plane through
controlPlaneRef.konnectNamespacedRef (this operator version exposes no
konnectID ref type), and the only mirror CR available was the one the
Gateway operator auto-creates with a random suffix. That suffix was
looked up by hand and pasted into CONTROL_PLANE_REF_NAME in 11 places
across 11 repos, where it went stale silently whenever the Gateway was
recreated. Replacing the Konnect org did exactly that: all 11 refs named
CRs that no longer existed and every service, route and plugin binding
sat Programmed=False.

Declare a mirror CR named ${NAME}-cp instead, so the refs are derived
from NAME and never need touching again. source: Mirror adopts an
existing control plane rather than owning it — deleting the CR leaves
the control plane in Konnect intact (verified: count unchanged across a
delete), so it coexists with the operator's own mirror of the same id.

The id itself comes from Vault via External Secrets, so a new Konnect
org now needs no edit in any repo.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

dataplane-template/controlplane-mirror.yaml

@@ -0,0 +1,34 @@
+# A stably-named mirror of the domain's Konnect control plane.
+#
+# Why this exists: the Gateway operator also creates a mirrored
+# KonnectGatewayControlPlane of its own, but auto-names it "${NAME}-<random>".
+# Every KongService/KongRoute/KongPluginBinding has to name its control plane
+# through controlPlaneRef.konnectNamespacedRef (this operator version has no
+# konnectID ref type), so that random suffix used to be looked up by hand and
+# pasted into CONTROL_PLANE_REF_NAME in each domain repo. It silently went
+# stale whenever the Gateway was recreated — which is exactly what happened
+# when the Konnect org was replaced: all 11 refs pointed at CRs that no longer
+# existed and every entity sat Programmed=False.
+#
+# This CR is declared with a derived, stable name instead, so the refs never
+# need touching again. It is source: Mirror, which adopts an existing control
+# plane rather than owning its lifecycle — deleting this CR does NOT delete the
+# control plane in Konnect (verified: count unchanged across a delete), so it
+# coexists safely with the operator's own mirror of the same id.
+#
+# CONTROL_PLANE_ID is substituted from the ${NAME}-control-plane Secret that
+# External Secrets materializes from Vault — see the domain's
+# gateway-kustomization.yaml.
+apiVersion: konnect.konghq.com/v1alpha2
+kind: KonnectGatewayControlPlane
+metadata:
+  name: ${NAME}-cp
+  namespace: ${NAMESPACE}
+spec:
+  source: Mirror
+  konnect:
+    authRef:
+      name: ${NAME}
+  mirror:
+    konnect:
+      id: ${CONTROL_PLANE_ID}

dataplane-template/kustomization.yaml

@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - konnectapiauthconfiguration.yaml
+  - controlplane-mirror.yaml
   - gatewayconfiguration.yaml
   - gateway.yaml
   - externalsecret-tls.yaml