diff --git a/networking/v1alpha3/gateway.pb.go b/networking/v1alpha3/gateway.pb.go
index 9c1a60d1803..f465343ee5b 100644
--- a/networking/v1alpha3/gateway.pb.go
+++ b/networking/v1alpha3/gateway.pb.go
@@ -1013,7 +1013,8 @@ type ServerTLSSettings struct {
 	// For gateways running on Kubernetes, the name of the secret that
 	// holds the TLS certs including the CA certificates. Applicable
 	// only on Kubernetes. An Opaque secret should contain the following
-	// keys and values: `key: <privateKey>` and `cert: <serverCert>`.
+	// keys and values: `tls.key: <privateKey>` and `tls.crt: <serverCert>` or
+	// `key: <privateKey>` and `cert: <serverCert>`.
 	// For mutual TLS, `cacert: <CACertificate>` and `crl: <CertificateRevocationList>`
 	// can be provided in the same secret or a separate secret named `<secret>-cacert`.
 	// A TLS secret for server certificates with an additional `tls.ocsp-staple` key
diff --git a/networking/v1alpha3/gateway.pb.html b/networking/v1alpha3/gateway.pb.html
index a2dfa29667e..581fd94b712 100644
--- a/networking/v1alpha3/gateway.pb.html
+++ b/networking/v1alpha3/gateway.pb.html
@@ -722,7 +722,8 @@ <h2 id="ServerTLSSettings">ServerTLSSettings</h2>
 <p>For gateways running on Kubernetes, the name of the secret that
 holds the TLS certs including the CA certificates. Applicable
 only on Kubernetes. An Opaque secret should contain the following
-keys and values: <code>key: &lt;privateKey&gt;</code> and <code>cert: &lt;serverCert&gt;</code>.
+keys and values: <code>tls.key: &lt;privateKey&gt;</code> and <code>tls.crt: &lt;serverCert&gt;</code> or
+<code>key: &lt;privateKey&gt;</code> and <code>cert: &lt;serverCert&gt;</code>.
 For mutual TLS, <code>cacert: &lt;CACertificate&gt;</code> and <code>crl: &lt;CertificateRevocationList&gt;</code>
 can be provided in the same secret or a separate secret named <code>&lt;secret&gt;-cacert</code>.
 A TLS secret for server certificates with an additional <code>tls.ocsp-staple</code> key
diff --git a/networking/v1alpha3/gateway.proto b/networking/v1alpha3/gateway.proto
index 319539c900c..a823e08620c 100644
--- a/networking/v1alpha3/gateway.proto
+++ b/networking/v1alpha3/gateway.proto
@@ -684,7 +684,8 @@ message ServerTLSSettings {
   // For gateways running on Kubernetes, the name of the secret that
   // holds the TLS certs including the CA certificates. Applicable
   // only on Kubernetes. An Opaque secret should contain the following
-  // keys and values: `key: <privateKey>` and `cert: <serverCert>`.
+  // keys and values: `tls.key: <privateKey>` and `tls.crt: <serverCert>` or
+  // `key: <privateKey>` and `cert: <serverCert>`.
   // For mutual TLS, `cacert: <CACertificate>` and `crl: <CertificateRevocationList>`
   // can be provided in the same secret or a separate secret named `<secret>-cacert`.
   // A TLS secret for server certificates with an additional `tls.ocsp-staple` key
diff --git a/networking/v1beta1/gateway.pb.go b/networking/v1beta1/gateway.pb.go
index e3b6cdc53af..e0f314b00fb 100644
--- a/networking/v1beta1/gateway.pb.go
+++ b/networking/v1beta1/gateway.pb.go
@@ -1013,7 +1013,8 @@ type ServerTLSSettings struct {
 	// For gateways running on Kubernetes, the name of the secret that
 	// holds the TLS certs including the CA certificates. Applicable
 	// only on Kubernetes. An Opaque secret should contain the following
-	// keys and values: `key: <privateKey>` and `cert: <serverCert>`.
+	// keys and values: `tls.key: <privateKey>` and `tls.crt: <serverCert>` or
+	// `key: <privateKey>` and `cert: <serverCert>`.
 	// For mutual TLS, `cacert: <CACertificate>` and `crl: <CertificateRevocationList>`
 	// can be provided in the same secret or a separate secret named `<secret>-cacert`.
 	// A TLS secret for server certificates with an additional `tls.ocsp-staple` key
diff --git a/networking/v1beta1/gateway.proto b/networking/v1beta1/gateway.proto
index c289154e08d..10ab056791d 100644
--- a/networking/v1beta1/gateway.proto
+++ b/networking/v1beta1/gateway.proto
@@ -684,7 +684,8 @@ message ServerTLSSettings {
   // For gateways running on Kubernetes, the name of the secret that
   // holds the TLS certs including the CA certificates. Applicable
   // only on Kubernetes. An Opaque secret should contain the following
-  // keys and values: `key: <privateKey>` and `cert: <serverCert>`.
+  // keys and values: `tls.key: <privateKey>` and `tls.crt: <serverCert>` or
+  // `key: <privateKey>` and `cert: <serverCert>`.
   // For mutual TLS, `cacert: <CACertificate>` and `crl: <CertificateRevocationList>`
   // can be provided in the same secret or a separate secret named `<secret>-cacert`.
   // A TLS secret for server certificates with an additional `tls.ocsp-staple` key