# konghq.com/secret: "true" is required — the Kong Operator's secret
# watch/cache is scoped to that label; without it, references from
# KonnectAPIAuthConfiguration.secretRef resolve to "does not exist" even
# though the Secret is present (see ~/dev/kong/kube/gateway/apigw/secret.yaml).
apiVersion: v1
kind: Secret
metadata:
  name: ${NAME}-konnect-auth
  namespace: ${NAMESPACE}
  labels:
    konghq.com/credential: konnect
    konghq.com/secret: "true"
type: Opaque
stringData:
  token: ${KONNECT_PAT_TOKEN}