Repository: Kong/kubernetes-ingress-controller
Pull request #5816 (2024-04-04 15:39:45)

fix: do reconcile secrets with `konghq.com/credential` label
**What this PR does / why we need it**:

Do reconcile secrets with `konghq.com/credential` label.

**Which issue this PR fixes**:

Closes: #5398

**Special notes for your reviewer**:

<!-- Here you can add any open questions or notes that you might have for reviewers -->

**PR Readiness Checklist**:

Complete these before marking the PR as `ready to review`:

- [x] the `CHANGELOG.md` release notes have been updated to reflect any significant (and particularly user-facing) changes introduced by this PR


codecov[bot]: ## [Codecov](https://app.codecov.io/gh/Kong/kubernetes-ingress-controller/pull/5816?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Kong) Report
Attention: Patch coverage is `88.88889%` with `1 lines` in your changes are missing coverage. Please review.
> Project coverage is 73.9%. Comparing base [(`2570997`)](https://app.codecov.io/gh/Kong/kubernetes-ingress-controller/commit/25709972e8f7ce0ef4cbcb84c7faec6e5d8981d7?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Kong) to head [(`a9dcc45`)](https://app.codecov.io/gh/Kong/kubernetes-ingress-controller/pull/5816?dropdown=coverage&src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Kong).
> Report is 1 commits behind head on main.

| [Files](https://app.codecov.io/gh/Kong/kubernetes-ingress-controller/pull/5816?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Kong) | Patch % | Lines |
|---|---|---|
| [...ion/validation/consumers/credentials/validation.go](https://app.codecov.io/gh/Kong/kubernetes-ingress-controller/pull/5816?src=pr&el=tree&filepath=internal%2Fadmission%2Fvalidation%2Fconsumers%2Fcredentials%2Fvalidation.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Kong#diff-aW50ZXJuYWwvYWRtaXNzaW9uL3ZhbGlkYXRpb24vY29uc3VtZXJzL2NyZWRlbnRpYWxzL3ZhbGlkYXRpb24uZ28=) | 50.0% | [1 Missing :warning: ](https://app.codecov.io/gh/Kong/kubernetes-ingress-controller/pull/5816?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Kong) |

<details><summary>Additional details and impacted files</summary>


```diff
@@          Coverage Diff          @@
##            main   #5816   +/-   ##
=====================================
  Coverage   73.9%   73.9%           
=====================================
  Files        176     176           
  Lines      18207   18210    +3     
=====================================
+ Hits       13457   13469   +12     
+ Misses      3748    3738   -10     
- Partials    1002    1003    +1     
```



</details>

[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/Kong/kubernetes-ingress-controller/pull/5816?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Kong).   
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Kong).


Patch:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6932437f4..3fd3bf8e0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -105,6 +105,9 @@ Adding a new version? You'll need three changes:
 - `KongUpstreamPolicy` controller no longer requires existence of `HTTPRoute` CRD
   to start.
   [#5780](https://github.com/Kong/kubernetes-ingress-controller/pull/5780)
+- Reconcile Secrets with `konghq.com/credential` label instead of waiting for other
+  object to contain a reference to that Secrets
+  [#5816](https://github.com/Kong/kubernetes-ingress-controller/pull/5816)
 
 ## [3.1.2]
 
diff --git a/go.mod b/go.mod
index a40972cb3..d38c1be92 100644
--- a/go.mod
+++ b/go.mod
@@ -30,7 +30,7 @@ require (
 	github.com/google/uuid v1.6.0
 	github.com/jpillora/backoff v1.0.0
 	github.com/kong/go-database-reconciler v1.8.0
-	github.com/kong/go-kong v0.52.0
+	github.com/kong/go-kong v0.54.0
 	github.com/kong/kubernetes-telemetry v0.1.3
 	github.com/kong/kubernetes-testing-framework v0.46.0
 	github.com/lithammer/dedent v1.1.0
@@ -56,11 +56,13 @@ require (
 	k8s.io/component-base v0.29.3
 	sigs.k8s.io/controller-runtime v0.17.2
 	sigs.k8s.io/gateway-api v1.0.0
-	sigs.k8s.io/kustomize/api v0.16.0
-	sigs.k8s.io/kustomize/kyaml v0.16.0
+	sigs.k8s.io/kustomize/api v0.17.0
+	sigs.k8s.io/kustomize/kyaml v0.17.0
 	sigs.k8s.io/yaml v1.4.0
 )
 
+require gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
+
 require (
 	cloud.google.com/go/compute v1.24.0 // indirect
 	cloud.google.com/go/compute/metadata v0.2.3 // indirect
@@ -209,9 +211,8 @@ require (
 	google.golang.org/appengine v1.6.8 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20240314234333-6e1732d8331c // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240318140521-94a12d6c2237 // indirect
-	google.golang.org/grpc v1.62.1
+	google.golang.org/grpc v1.63.0
 	google.golang.org/protobuf v1.33.0 // indirect
-	gopkg.in/evanphx/json-patch.v5 v5.6.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
diff --git a/go.sum b/go.sum
index 7eef3bc31..dabab3248 100644
--- a/go.sum
+++ b/go.sum
@@ -251,8 +251,8 @@ github.com/klauspost/compress v1.17.0 h1:Rnbp4K9EjcDuVuHtd0dgA4qNuv9yKDYKK1ulpJw
 github.com/klauspost/compress v1.17.0/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
 github.com/kong/go-database-reconciler v1.8.0 h1:0NxfKGEJxcfmSJ3sECIAcW7dBnpHP0isQbZ5YIbZl4M=
 github.com/kong/go-database-reconciler v1.8.0/go.mod h1:8dVqldn0hnDsr4KL7M8pKdAz9WcFPBo0B3p7SIiHihI=
-github.com/kong/go-kong v0.52.0 h1:qQnYXTNpMpfLd2q61dy6MB2atN1f3+LjKCc5qkjcD58=
-github.com/kong/go-kong v0.52.0/go.mod h1:Uqahp6hm7+JrL768AiohkwzwPuqajzc0+6nBPB6SO6s=
+github.com/kong/go-kong v0.54.0 h1:HZkZJRREJs/azkgJxMWr2jANQQfg8xXsAiFKu+d1nrs=
+github.com/kong/go-kong v0.54.0/go.mod h1:51rSSjgSZKukXgn5nNYbJUx0Et/islqR+LTltwCyjG8=
 github.com/kong/kubernetes-telemetry v0.1.3 h1:Hz2tkHGIIUqbn1x46QRDmmNjbEtJyxyOvHSPne3uPto=
 github.com/kong/kubernetes-telemetry v0.1.3/go.mod h1:wB7o8dOKa5R396CyiU0sPa8am/g3c5DKd/qrn/Vmb+k=
 github.com/kong/kubernetes-testing-framework v0.46.0 h1:KDldlC2rMqXlojKa6PAfms1iKtj7oifRs5VZfdZkY4M=
@@ -611,8 +611,8 @@ google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyac
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
 google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.62.1 h1:B4n+nfKzOICUXMgyrNd19h/I9oH0L1pizfk1d4zSgTk=
-google.golang.org/grpc v1.62.1/go.mod h1:IWTG0VlJLCh1SkC58F7np9ka9mx/WNkjl4PGJaiq+QE=
+google.golang.org/grpc v1.63.0 h1:WjKe+dnvABXyPJMD7KDNLxtoGk5tgk+YFWN6cBWjZE8=
+google.golang.org/grpc v1.63.0/go.mod h1:WAX/8DgncnokcFUldAxq7GeB5DXHDbMF+lLvDomNkRA=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -631,8 +631,8 @@ gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8
 gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/evanphx/json-patch.v5 v5.6.0 h1:BMT6KIwBD9CaU91PJCZIe46bDmBWa9ynTQgJIOpfQBk=
-gopkg.in/evanphx/json-patch.v5 v5.6.0/go.mod h1:/kvTRh1TVm5wuM6OkHxqXtE/1nUZZpihg29RtuIyfvk=
+gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
+gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
@@ -681,10 +681,10 @@ sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMm
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
 sigs.k8s.io/kind v0.22.0 h1:z/+yr/azoOfzsfooqRsPw1wjJlqT/ukXP0ShkHwNlsI=
 sigs.k8s.io/kind v0.22.0/go.mod h1:aBlbxg08cauDgZ612shr017/rZwqd7AS563FvpWKPVs=
-sigs.k8s.io/kustomize/api v0.16.0 h1:/zAR4FOQDCkgSDmVzV2uiFbuy9bhu3jEzthrHCuvm1g=
-sigs.k8s.io/kustomize/api v0.16.0/go.mod h1:MnFZ7IP2YqVyVwMWoRxPtgl/5hpA+eCCrQR/866cm5c=
-sigs.k8s.io/kustomize/kyaml v0.16.0 h1:6J33uKSoATlKZH16unr2XOhDI+otoe2sR3M8PDzW3K0=
-sigs.k8s.io/kustomize/kyaml v0.16.0/go.mod h1:xOK/7i+vmE14N2FdFyugIshB8eF6ALpy7jI87Q2nRh4=
+sigs.k8s.io/kustomize/api v0.17.0 h1:AygX5EzZ+2NDxCWkeHy4IK2oftvl4odZZJmq1rK4HYU=
+sigs.k8s.io/kustomize/api v0.17.0/go.mod h1:ffn5491s2EiNrJSmgqcWGzQUVhc/pB0OKNI0HsT/0tA=
+sigs.k8s.io/kustomize/kyaml v0.17.0 h1:G2bWs03V9Ur2PinHLzTUJ8Ded+30SzXZKiO92SRDs3c=
+sigs.k8s.io/kustomize/kyaml v0.17.0/go.mod h1:6lxkYF1Cv9Ic8g/N7I86cvxNc5iinUo/P2vKsHNmpyE=
 sigs.k8s.io/structured-merge-diff/v4 v4.4.1 h1:150L+0vs/8DA78h1u02ooW1/fFq/Lwr+sGiqlzvrtq4=
 sigs.k8s.io/structured-merge-diff/v4 v4.4.1/go.mod h1:N8hJocpFajUSSeSJ9bOZ77VzejKZaXsTtZo4/u7Io08=
 sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=
diff --git a/internal/admission/validation/consumers/credentials/validation.go b/internal/admission/validation/consumers/credentials/validation.go
index 0c7addcc3..b3ce4a488 100644
--- a/internal/admission/validation/consumers/credentials/validation.go
+++ b/internal/admission/validation/consumers/credentials/validation.go
@@ -24,7 +24,7 @@ func ValidateCredentials(secret *corev1.Secret) error {
 	if credentialSource == util.CredentialTypeAbsent {
 		// this shouldn't occur, since we check this earlier in the admission controller's handleSecret function, but
 		// checking here also in case a refactor removes that
-		return fmt.Errorf("secret has no credential type, add a %s label", labels.LabelPrefix+labels.CredentialKey)
+		return fmt.Errorf("secret has no credential type, add a %s label", labels.CredentialTypeLabel)
 	}
 
 	// verify that the credential type provided is valid
@@ -127,7 +127,7 @@ func (cs Index) ValidateCredentialsForUniqueKeyConstraints(secret *corev1.Secret
 	if credentialSource == util.CredentialTypeAbsent {
 		return fmt.Errorf(
 			"secret has no credential type, add a %s label",
-			labels.LabelPrefix+labels.CredentialKey,
+			labels.CredentialTypeLabel,
 		)
 	}
 
diff --git a/internal/controllers/configuration/secret_controller.go b/internal/controllers/configuration/secret_controller.go
index c8ba78f0f..ad58cbefc 100644
--- a/internal/controllers/configuration/secret_controller.go
+++ b/internal/controllers/configuration/secret_controller.go
@@ -19,6 +19,7 @@ import (
 
 	"github.com/kong/kubernetes-ingress-controller/v3/internal/controllers"
 	ctrlref "github.com/kong/kubernetes-ingress-controller/v3/internal/controllers/reference"
+	"github.com/kong/kubernetes-ingress-controller/v3/internal/labels"
 	"github.com/kong/kubernetes-ingress-controller/v3/internal/util"
 )
 
@@ -82,9 +83,15 @@ func (r *CoreV1SecretReconciler) shouldReconcileSecret(obj client.Object) bool {
 		return false
 	}
 
-	labels := secret.Labels
-	if labels != nil && labels[CACertLabelKey] == "true" {
-		return true
+	l := secret.Labels
+	if l != nil {
+		if l[CACertLabelKey] == "true" {
+			return true
+		}
+
+		if _, ok := l[labels.CredentialTypeLabel]; ok {
+			return true
+		}
 	}
 
 	referred, err := r.ReferenceIndexers.ObjectReferred(secret)
diff --git a/internal/controllers/gateway/gateway_controller.go b/internal/controllers/gateway/gateway_controller.go
index c81e39c6e..0d86fe83e 100644
--- a/internal/controllers/gateway/gateway_controller.go
+++ b/internal/controllers/gateway/gateway_controller.go
@@ -368,7 +368,7 @@ func (r *GatewayReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ct
 			debug(log, gateway, "Reconciliation triggered but gateway does not exist, deleting it in dataplane")
 			return ctrl.Result{}, r.DataplaneClient.DeleteObject(gateway)
 		}
-		return ctrl.Result{Requeue: true}, err
+		return ctrl.Result{}, err
 	}
 
 	debug(log, gateway, "Processing gateway")
@@ -495,7 +495,7 @@ func (r *GatewayReconciler) reconcileUnmanagedGateway(ctx context.Context, log l
 				"name", gateway.Name,
 				"service", ref,
 			)
-			return ctrl.Result{Requeue: true}, err
+			return ctrl.Result{}, err
 		}
 		if svc != nil {
 			gatewayServices = append(gatewayServices, svc)
diff --git a/internal/labels/labels.go b/internal/labels/labels.go
index ed0100ff5..98981d7f3 100644
--- a/internal/labels/labels.go
+++ b/internal/labels/labels.go
@@ -8,4 +8,7 @@ const (
 
 	// CredentialKey is the key used to indicate a Secret's credential type.
 	CredentialKey = "/credential" //nolint:gosec
+
+	// CredentialTypeLabel is the label used to indicate a Secret's credential type.
+	CredentialTypeLabel = LabelPrefix + CredentialKey
 )
diff --git a/internal/util/credential.go b/internal/util/credential.go
index b0ab4eedf..1f7ad7804 100644
--- a/internal/util/credential.go
+++ b/internal/util/credential.go
@@ -23,7 +23,7 @@ const (
 // ExtractKongCredentialType returns the credential type of a Secret and a code indicating whether the credential type
 // was obtained from a label, field, or not at all. Labels take precedence over fields if both are present.
 func ExtractKongCredentialType(secret *corev1.Secret) (string, CredentialTypeSource) {
-	credType, labelOk := secret.Labels[labels.LabelPrefix+labels.CredentialKey]
+	credType, labelOk := secret.Labels[labels.CredentialTypeLabel]
 	if !labelOk {
 		// if no label, fall back to the deprecated field
 		credBytes, fieldOk := secret.Data["kongCredType"]


Test patch:
diff --git a/internal/admission/validation/consumers/credentials/validation_test.go b/internal/admission/validation/consumers/credentials/validation_test.go
index 1c5d84ec2..8f0f1f396 100644
--- a/internal/admission/validation/consumers/credentials/validation_test.go
+++ b/internal/admission/validation/consumers/credentials/validation_test.go
@@ -78,7 +78,7 @@ func TestValidateCredentials(t *testing.T) {
 					Name:      "secret",
 					Namespace: "default",
 					Labels: map[string]string{
-						labels.LabelPrefix + labels.CredentialKey: "key-auth",
+						labels.CredentialTypeLabel: "key-auth",
 					},
 				},
 				Data: map[string][]byte{
@@ -94,7 +94,7 @@ func TestValidateCredentials(t *testing.T) {
 					Name:      "secret",
 					Namespace: "default",
 					Labels: map[string]string{
-						labels.LabelPrefix + labels.CredentialKey: "jwt",
+						labels.CredentialTypeLabel: "jwt",
 					},
 				},
 				Data: map[string][]byte{
@@ -112,7 +112,7 @@ func TestValidateCredentials(t *testing.T) {
 					Name:      "secret",
 					Namespace: "default",
 					Labels: map[string]string{
-						labels.LabelPrefix + labels.CredentialKey: "jwt",
+						labels.CredentialTypeLabel: "jwt",
 					},
 				},
 				Data: map[string][]byte{
@@ -130,7 +130,7 @@ func TestValidateCredentials(t *testing.T) {
 					Name:      "secret",
 					Namespace: "default",
 					Labels: map[string]string{
-						labels.LabelPrefix + labels.CredentialKey: "jwt",
+						labels.CredentialTypeLabel: "jwt",
 					},
 				},
 				Data: map[string][]byte{
@@ -163,7 +163,7 @@ func TestValidateCredentials(t *testing.T) {
 					Name:      "secret",
 					Namespace: "default",
 					Labels: map[string]string{
-						labels.LabelPrefix + labels.CredentialKey: "bee-auth",
+						labels.CredentialTypeLabel: "bee-auth",
 					},
 				},
 				Data: map[string][]byte{
@@ -183,7 +183,7 @@ func TestValidateCredentials(t *testing.T) {
 					"key": []byte("little-rabbits-be-good"),
 				},
 			},
-			wantErr: fmt.Errorf("secret has no credential type, add a %s label", labels.LabelPrefix+labels.CredentialKey),
+			wantErr: fmt.Errorf("secret has no credential type, add a %s label", labels.CredentialTypeLabel),
 		},
 		{
 			name: "missing required field",
@@ -192,7 +192,7 @@ func TestValidateCredentials(t *testing.T) {
 					Name:      "secret",
 					Namespace: "default",
 					Labels: map[string]string{
-						labels.LabelPrefix + labels.CredentialKey: "key-auth",
+						labels.CredentialTypeLabel: "key-auth",
 					},
 				},
 				Data: map[string][]byte{
@@ -208,7 +208,7 @@ func TestValidateCredentials(t *testing.T) {
 					Name:      "secret",
 					Namespace: "default",
 					Labels: map[string]string{
-						labels.LabelPrefix + labels.CredentialKey: "key-auth",
+						labels.CredentialTypeLabel: "key-auth",
 					},
 				},
 				Data: map[string][]byte{
diff --git a/internal/controllers/configuration/secret_controller_test.go b/internal/controllers/configuration/secret_controller_test.go
new file mode 100644
index 000000000..973156c79
--- /dev/null
+++ b/internal/controllers/configuration/secret_controller_test.go
@@ -0,0 +1,84 @@
+package configuration
+
+import (
+	"testing"
+
+	"github.com/go-logr/logr"
+	"github.com/stretchr/testify/require"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	ctrlref "github.com/kong/kubernetes-ingress-controller/v3/internal/controllers/reference"
+	"github.com/kong/kubernetes-ingress-controller/v3/internal/labels"
+)
+
+func TestCoreV1SecretReconciler_shouldReconcileSecret(t *testing.T) {
+	tests := []struct {
+		name   string
+		secret *corev1.Secret
+		want   bool
+	}{
+		{
+			name: "Secret with no labels",
+			secret: &corev1.Secret{
+				ObjectMeta: metav1.ObjectMeta{},
+			},
+			want: false,
+		},
+		{
+			name: "Secret with konghq.com/ca-cert:true label",
+			secret: &corev1.Secret{
+				ObjectMeta: metav1.ObjectMeta{
+					Labels: map[string]string{
+						"konghq.com/ca-cert": "true",
+					},
+				},
+			},
+			want: true,
+		},
+		{
+			name: "Secret with konghq.com/ca-cert:false label",
+			secret: &corev1.Secret{
+				ObjectMeta: metav1.ObjectMeta{
+					Labels: map[string]string{
+						"konghq.com/ca-cert": "false",
+					},
+				},
+			},
+			want: false,
+		},
+		{
+			name: "Secret without konghq.com/ca-cert label",
+			secret: &corev1.Secret{
+				ObjectMeta: metav1.ObjectMeta{
+					Labels: map[string]string{
+						"some-other-label": "true",
+					},
+				},
+			},
+			want: false,
+		},
+		{
+			name: "Secret with labels.CredentialTypeLabel label",
+			secret: &corev1.Secret{
+				ObjectMeta: metav1.ObjectMeta{
+					Labels: map[string]string{
+						labels.CredentialTypeLabel: "jwt",
+					},
+				},
+			},
+			want: true,
+		},
+	}
+
+	r := &CoreV1SecretReconciler{
+		ReferenceIndexers: ctrlref.NewCacheIndexers(logr.Discard()),
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := r.shouldReconcileSecret(tt.secret)
+			require.Equal(t, tt.want, got)
+		})
+	}
+}
diff --git a/internal/dataplane/kongstate/kongstate_test.go b/internal/dataplane/kongstate/kongstate_test.go
index 7c4b9b893..9961c6fc1 100644
--- a/internal/dataplane/kongstate/kongstate_test.go
+++ b/internal/dataplane/kongstate/kongstate_test.go
@@ -515,7 +515,7 @@ func TestFillConsumersAndCredentials(t *testing.T) {
 				Name:      "labeledSecret",
 				Namespace: "default",
 				Labels: map[string]string{
-					labels.LabelPrefix + labels.CredentialKey: "key-auth",
+					labels.CredentialTypeLabel: "key-auth",
 				},
 			},
 			Data: map[string][]byte{
@@ -527,7 +527,7 @@ func TestFillConsumersAndCredentials(t *testing.T) {
 				Name:      "labeledSecretWithCredField",
 				Namespace: "default",
 				Labels: map[string]string{
-					labels.LabelPrefix + labels.CredentialKey: "key-auth",
+					labels.CredentialTypeLabel: "key-auth",
 				},
 			},
 			Data: map[string][]byte{
@@ -540,7 +540,7 @@ func TestFillConsumersAndCredentials(t *testing.T) {
 				Name:      "badTypeLabeledSecret",
 				Namespace: "default",
 				Labels: map[string]string{
-					labels.LabelPrefix + labels.CredentialKey: "bee-auth",
+					labels.CredentialTypeLabel: "bee-auth",
 				},
 			},
 			Data: map[string][]byte{
diff --git a/internal/util/credential_test.go b/internal/util/credential_test.go
index fbd7379d3..e1337f8ab 100644
--- a/internal/util/credential_test.go
+++ b/internal/util/credential_test.go
@@ -24,7 +24,7 @@ func TestExtractKongCredentialType(t *testing.T) {
 					Name:      "secret",
 					Namespace: "default",
 					Labels: map[string]string{
-						labels.LabelPrefix + labels.CredentialKey: "key-auth",
+						labels.CredentialTypeLabel: "key-auth",
 					},
 				},
 				Data: map[string][]byte{
@@ -58,7 +58,7 @@ func TestExtractKongCredentialType(t *testing.T) {
 					Name:      "secret",
 					Namespace: "default",
 					Labels: map[string]string{
-						labels.LabelPrefix + labels.CredentialKey: "key-auth",
+						labels.CredentialTypeLabel: "key-auth",
 					},
 				},
 				Data: map[string][]byte{
diff --git a/test/integration/isolated/grpc_test.go b/test/integration/isolated/grpc_test.go
index b901945ba..fbaf3d3d2 100644
--- a/test/integration/isolated/grpc_test.go
+++ b/test/integration/isolated/grpc_test.go
@@ -191,7 +191,7 @@ func TestGRPCRouteEssentials(t *testing.T) {
 				return err == nil
 			}, consts.IngressWait, consts.WaitTick)
 
-			client, closeGrpcConn, err := grpcBinClient(ctx, grpcAddr, testHostname, true)
+			client, closeGrpcConn, err := grpcBinClient(grpcAddr, testHostname, true)
 			assert.NoError(t, err)
 			t.Cleanup(func() {
 				err := closeGrpcConn()
@@ -232,7 +232,7 @@ func TestGRPCRouteEssentials(t *testing.T) {
 }
 
 func grpcEchoResponds(ctx context.Context, url, hostname, input string, enableTLS bool) error {
-	client, closeConn, err := grpcBinClient(ctx, url, hostname, enableTLS)
+	client, closeConn, err := grpcBinClient(url, hostname, enableTLS)
 	if err != nil {
 		return err
 	}
@@ -251,7 +251,7 @@ func grpcEchoResponds(ctx context.Context, url, hostname, input string, enableTL
 	return nil
 }
 
-func grpcBinClient(ctx context.Context, url, hostname string, enableTLS bool) (pb.GRPCBinClient, func() error, error) {
+func grpcBinClient(url, hostname string, enableTLS bool) (pb.GRPCBinClient, func() error, error) {
 	opts := []grpc.DialOption{grpc.WithTransportCredentials(insecure.NewCredentials()), grpc.WithAuthority(hostname)}
 	if enableTLS {
 		opts = []grpc.DialOption{grpc.WithTransportCredentials(credentials.NewTLS(
@@ -261,7 +261,7 @@ func grpcBinClient(ctx context.Context, url, hostname string, enableTLS bool) (p
 			},
 		))}
 	}
-	conn, err := grpc.DialContext(ctx, url, opts...)
+	conn, err := grpc.NewClient(url, opts...)
 	if err != nil {
 		return nil, nil, fmt.Errorf("failed to dial GRPC server: %w", err)
 	}