The API server defaults group on allowedRoutes.kinds and certificateRefs,
and group, kind and weight on the TCPRoute backendRefs. Omitting them left
both ArgoCD apps permanently OutOfSync against the live objects. Matches
what authentik-httproute.yaml already does.
Adds the LDAP outpost deployment and routes ports 389 and 636 on
gateway-internal to it. 636 is a TLS listener in Terminate mode so
cert-manager renews the LDAPS certificate automatically, and both
listeners forward to the outpost's plaintext 3389.
allowedRoutes.kinds is set explicitly on both listeners: a TCP listener
permits no route kinds by default and a TLS listener defaults to
TLSRoute, so the TCPRoute would not attach otherwise.
Jeffrey