Builtin name reference transformer config should include Gateway `certificateRefs`

Author: peterhirnCreated Jun 12, 2026Updated Sep 14, 2026

Labelskind/featuretriage/under-consideration

Eschewed features

This issue is not requesting templating, unstuctured edits, build-time side-effects from args or env vars, or any other eschewed feature.

What would you like to have added?

yaml

nameReference:
  - kind: Secret
    version: v1
    fieldSpecs:
      - path: spec/listeners/tls/certificateRefs/name
        kind: Gateway

(and maybe the same for kind: ConfigMap)

Why is this needed?

yaml

secretGenerator:
  - name: tls-certificate
    type: kubernetes.io/tls
    files:
      - tls.crt=secrets/cert.pem
      - tls.key=secrets/key.pem

yaml

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: gateway-web
spec:
  gatewayClassName: traefik
  listeners:
    - name: web
      port: 8000
      protocol: HTTP
      allowedRoutes:
        namespaces:
          from: Same
    - name: websecure
      protocol: HTTPS
      port: 8443
      allowedRoutes:
        namespaces:
          from: Same
      tls:
        certificateRefs:
          - kind: Secret
            name: tls-certificate

Can you accomplish the motivating task without this feature, and if so, how?

What other solutions have you considered?

Anything else we should know?

No response

Feature ownership

I am interested in contributing this feature myself!

Source: kubernetes-sigs/kustomize

View original on GitHub View discussion on GitHub