BindTSIGKey: add secretTemplate for labels/annotations on the managed Secret

The operator-generated TSIG Secret previously carried only the managed-by
label, so it could not be mirrored to another namespace by emberstack
reflector (which requires reflection-allowed annotations on the source).

Add spec.secretTemplate.{annotations,labels}, applied both when the Secret
is first generated and reconciled onto the existing Secret when the CR
changes (imported secrets are left untouched so we don't fight their
external manager). This lets the external-dns TSIG key be managed in
bind-internal and reflected into the externaldns namespace.

config/crd/bases/bind.unkin.net_bindtsigkeys.yaml

@@ -87,6 +87,23 @@ spec:
                   SecretName is the Secret the key material is written to (or read from when
                   ImportExisting is set). Defaults to "<name>-tsig".
                 type: string
+              secretTemplate:
+                description: |-
+                  SecretTemplate customizes metadata written onto the managed key Secret.
+                  Useful, for example, to let secret-reflection tooling mirror the key into
+                  another namespace. Operator-managed labels are always preserved.
+                properties:
+                  annotations:
+                    additionalProperties:
+                      type: string
+                    description: Annotations to set on the Secret.
+                    type: object
+                  labels:
+                    additionalProperties:
+                      type: string
+                    description: Labels to set on the Secret.
+                    type: object
+                type: object
             type: object
           status:
             description: BindTSIGKeyStatus reports observed TSIG key state.

config/crd/install.yaml

@@ -2376,6 +2376,23 @@ spec:
                   SecretName is the Secret the key material is written to (or read from when
                   ImportExisting is set). Defaults to "<name>-tsig".
                 type: string
+              secretTemplate:
+                description: |-
+                  SecretTemplate customizes metadata written onto the managed key Secret.
+                  Useful, for example, to let secret-reflection tooling mirror the key into
+                  another namespace. Operator-managed labels are always preserved.
+                properties:
+                  annotations:
+                    additionalProperties:
+                      type: string
+                    description: Annotations to set on the Secret.
+                    type: object
+                  labels:
+                    additionalProperties:
+                      type: string
+                    description: Labels to set on the Secret.
+                    type: object
+                type: object
             type: object
           status:
             description: BindTSIGKeyStatus reports observed TSIG key state.

config/samples/00-tsigkeys.yaml

@@ -11,7 +11,9 @@ spec:
   algorithm: hmac-sha256
 ---
 # TSIG key permitting external-dns (and DNSRecord objects) to send RFC2136
-# dynamic updates to the dynamic cluster's primary.
+# dynamic updates to the dynamic cluster's primary. secretTemplate mirrors the
+# generated Secret into the external-dns namespace via emberstack reflector, so
+# external-dns presents exactly the key the primary's allow-update accepts.
 apiVersion: bind.unkin.net/v1alpha1
 kind: BindTSIGKey
 metadata:
@@ -19,3 +21,9 @@ metadata:
   namespace: bind-externaldns
 spec:
   algorithm: hmac-sha256
+  secretTemplate:
+    annotations:
+      reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
+      reflector.v1.k8s.emberstack.com/reflection-allowed-namespaces: "externaldns"
+      reflector.v1.k8s.emberstack.com/reflection-auto-enabled: "true"
+      reflector.v1.k8s.emberstack.com/reflection-auto-namespaces: "externaldns"