feat(httproute): add Gateway API HTTPRoute support

[abelhoula]

No description provided.

[netlify]

✅ Deploy Preview for docs-kargo-io ready!

Name	Link
🔨 Latest commit	de42e24
🔍 Latest deploy log	https://app.netlify.com/projects/docs-kargo-io/deploys/6969ef34ae8462000847f001
😎 Deploy Preview	https://deploy-preview-5447.docs.kargo.io
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 55.99%. Comparing base (901c8b1) to head (de42e24).
⚠️ Report is 306 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5447      +/-   ##
==========================================
+ Coverage   55.07%   55.99%   +0.92%     
==========================================
  Files         426      423       -3     
  Lines       31528    32131     +603     
==========================================
+ Hits        17363    17991     +628     
+ Misses      13161    13087      -74     
- Partials     1004     1053      +49     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[krancour]

@abelhoula thanks for working on this and for your patience waiting for an in-depth review. I think this is a really worthwhile feature, ideally, I'd like to see this land in v1.11.0.

My main ask would be for better parity with what's already supported with Ingress today. Our policy is for the chart to be more secure than not by default. This means I'd like to keep api.tls.enabled: true as a default, as it is today, which is incompatible with an HTTPRoute unless it uses a BackendTLSPolicy to re-establish TLS between the gateway and the backend. I realize that many people, in practice, terminate TLS at the gateway and that's that. And that's fine. But I want people to opt into relaxing security instead of opting into tightening it.

So, basically, what I'm saying is instead of api.tls.enabled: true with api.httproute.enabled: true leading to invalid configuration, I'd rather that combination just lead automatically to the creation of a BackendTLSPolicy to make everything work correctly with TLS end-to-end. This would require surfacing options in api.httpRoute.tls like those in api.ingress.tls.

Other varied feedback I have is more targeted, so I'll leave comments inline with the diffs.

[krancour]

I think it's GA now, but you can double-check me on that.

[krancour]

Somewhere in the comment above, it may be worth mentioning that setting this to true requires you to have the Gateway API CRDs installed on your cluster.

[krancour]

Same comments from the other httproute section apply here as well.

[krancour]

I would suggest doing it like this so that empty/undefined .Values.api.httproute.parentRefs doesn't leave us with a key without a value here.

Suggested change

	parentRefs:
	{{- with .Values.api.httproute.parentRefs }}
	{{- toYaml . | nindent 4 }}
	{{- end }}
	{{- with .Values.api.httproute.parentRefs }}
	parentRefs:
	{{- toYaml . | nindent 4 }}
	{{- end }}

[krancour]

This is an enhancement I'm really supportive of if/when the feedback's been addressed. I'll leave it open, but I'm removing it from the v1.11.0 milestone since this is not critical for that release and progress on the PR seems to have stalled.

@abelhoula if you don't intend to resume work on this, please let me know so I have find someone else to take it over.