The API server defaults group on allowedRoutes.kinds and certificateRefs, and group, kind and weight on the TCPRoute backendRefs. Omitting them left both ArgoCD apps permanently OutOfSync against the live objects. Matches what authentik-httproute.yaml already does.