Add clusterRef to BindTSIGKey

TSIG keys were included in every cluster's keys.conf namespace-wide. When
multiple clusters share a namespace, that leaks keys across clusters. Add
spec.clusterRef so a key can target a specific BindCluster; empty keeps
the shared (all-clusters-in-namespace) behaviour.

- api: BindTSIGKey.spec.clusterRef (optional)
- BindCluster keys.conf now includes only keys with matching or empty
  clusterRef
- regenerate CRDs + install.yaml bundle

api/v1alpha1/bindtsigkey_types.go

@@ -16,6 +16,12 @@ const (
 // BindTSIGKeySpec defines a TSIG key. If no existing key material is imported,
 // the operator generates a random key and stores it in a Secret.
 type BindTSIGKeySpec struct {
+	// ClusterRef names the BindCluster this key is included in. When empty the
+	// key is shared with every cluster in the namespace (useful when multiple
+	// clusters share one namespace).
+	// +optional
+	ClusterRef string `json:"clusterRef,omitempty"`
+
 	// Algorithm is the HMAC algorithm. Defaults to hmac-sha256.
 	// +kubebuilder:default="hmac-sha256"
 	// +optional

config/crd/bases/bind.unkin.net_bindtsigkeys.yaml

@@ -66,6 +66,12 @@ spec:
                 - hmac-sha1
                 - hmac-md5
                 type: string
+              clusterRef:
+                description: |-
+                  ClusterRef names the BindCluster this key is included in. When empty the
+                  key is shared with every cluster in the namespace (useful when multiple
+                  clusters share one namespace).
+                type: string
               importExisting:
                 description: |-
                   ImportExisting, when true, means the referenced Secret already contains a

config/crd/install.yaml

@@ -2043,6 +2043,12 @@ spec:
                 - hmac-sha1
                 - hmac-md5
                 type: string
+              clusterRef:
+                description: |-
+                  ClusterRef names the BindCluster this key is included in. When empty the
+                  key is shared with every cluster in the namespace (useful when multiple
+                  clusters share one namespace).
+                type: string
               importExisting:
                 description: |-
                   ImportExisting, when true, means the referenced Secret already contains a

internal/controller/bindcluster_controller.go

@@ -128,7 +128,15 @@ func (r *BindClusterReconciler) reconcileKeysSecret(ctx context.Context, c *bind
 	if err := r.List(ctx, &keys, client.InNamespace(c.Namespace)); err != nil {
 		return err
 	}
-	items := append([]bindv1alpha1.BindTSIGKey(nil), keys.Items...)
+	// Include keys scoped to this cluster (spec.clusterRef == name) and shared
+	// keys (empty clusterRef). This keeps keys from leaking across clusters that
+	// share a namespace.
+	var items []bindv1alpha1.BindTSIGKey
+	for _, k := range keys.Items {
+		if k.Spec.ClusterRef == "" || k.Spec.ClusterRef == c.Name {
+			items = append(items, k)
+		}
+	}
 	sort.Slice(items, func(i, j int) bool { return items[i].Name < items[j].Name })
 
 	var b strings.Builder