Certificates (required for mTLS and custom domains) must be loaded with gwa pg - there is no support in apply. As a result, teams who want to add certs need to use gwa pg for all their gateway config and then apply for other resources. apply should be a one-stop shop.
Certificates and SNIs (being Kong objects) should probably follow the way GatewayConfig is handled (declarative, replacement of existing resources). I think - confirm how to approach this!
AC
gwa apply supports kind: Certificate alongside other resources and gateway config.