From e4642b372c2909afcf95dbf0595ba077009d5753 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Tailland?= <stephane.tailland@ibm.com>
Date: Fri, 21 Aug 2026 09:49:41 +0200
Subject: [PATCH] Label the Vault-sourced TLS secret konghq.com/secret=true

The Kong Gateway Operator only watches Secrets carrying this label,
same as the existing Konnect PAT ExternalSecret already does.
---
 dataplane-template/externalsecret-tls.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/dataplane-template/externalsecret-tls.yaml b/dataplane-template/externalsecret-tls.yaml
index a4f408c..3d5992b 100644
--- a/dataplane-template/externalsecret-tls.yaml
+++ b/dataplane-template/externalsecret-tls.yaml
@@ -12,6 +12,9 @@ spec:
     name: ${NAME}-tls
     template:
       type: kubernetes.io/tls
+      metadata:
+        labels:
+          konghq.com/secret: "true"
   data:
     - secretKey: tls.crt
       remoteRef: