feat: add Gateway certificateRefs to builtin nameReference config

[anneheartrecord]

What this does

Adds a fieldSpec to the builtin nameReference transformer config (api/internal/konfig/builtinpluginconsts/namereference.go) under the Secret kind so the transformer updates a Gateway listener's spec/listeners/tls/certificateRefs/name when the referenced Secret is renamed (by namePrefix, nameSuffix, or secretGenerator hash suffix).

- path: spec/listeners/tls/certificateRefs/name
  kind: Gateway
  group: gateway.networking.k8s.io

The fieldSpec is scoped to group gateway.networking.k8s.io so it only matches the Gateway API resource and not unrelated CRDs named Gateway (e.g. Istio's gateway.networking.istio.io). It mirrors the existing Ingress spec/tls/secretName entry just above it.

Why

When a TLS cert Secret is produced by secretGenerator (which appends a content hash) or renamed by prefix/suffix, a referencing Gateway's certificateRefs[].name is left pointing at the original name, breaking the reference. This matches the motivating use case in the issue.

Changes

• api/internal/konfig/builtinpluginconsts/namereference.go: add the Gateway certificateRefs fieldSpec.
• examples/transformerconfigs/README.md: keep the documented builtin config in sync (enforced by the LINT.IfChange / LINT.ThenChange directive on the const).
• api/krusty/namereference_test.go: add TestNameReferenceGatewayCertificateRefs, an integration test that uses a secretGenerator + a Gateway referencing the secret via certificateRefs, and asserts the reference is updated to the hashed Secret name.

Testing

go test ./krusty/ -run TestNameReferenceGatewayCertificateRefs passes. The test fails before the const change (the Gateway's certificateRefs.name stays tls-certificate while the Secret becomes tls-certificate-8gkh55dgdg) and passes after.

Fixes #6161

The builtin nameReference transformer now updates `spec.listeners.tls.certificateRefs.name` on `gateway.networking.k8s.io` Gateway resources, so Gateway TLS certificate references follow Secret renames from namePrefix, nameSuffix, and secretGenerator hashing.

[k8s-ci-robot]

Welcome @anneheartrecord!

It looks like this is your first PR to kubernetes-sigs/kustomize 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/kustomize has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

[k8s-ci-robot]

Hi @anneheartrecord. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: anneheartrecord
Once this PR has been reviewed and has the lgtm label, please assign varshaprasad96 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[anneheartrecord]

This adds Gateway certificateRefs to the builtin nameReference transformer config so Secret references in Gateway resources are updated on rename/prefix/suffix. Ready for review.
/cc @KnVerey @koba1t

[kubernetes-prow]

@anneheartrecord: GitHub didn't allow me to request PR reviews from the following users: knverey.

Note that only kubernetes-sigs members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

This adds Gateway certificateRefs to the builtin nameReference transformer config so Secret references in Gateway resources are updated on rename/prefix/suffix. Ready for review.
/cc @KnVerey @koba1t

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.