[ArnobKumarSaha]

OpenShift 4.19+ owns the gateway.networking.k8s.io group. The ingress operator goes Degraded (GatewayAPICRDsDegraded) when unmanaged CRDs exist. TCPRoute isn't managed in any OpenShift release, and BackendTLSPolicy is only managed from 4.22.

OpenShift only (detected with the existing distro.openshift helper):

• ace:

  • Drop the nats-tcp/s3proxy-tcp Gateway listeners and the NATS TCPRoute.
  • Add the <fullname>-nats-lb LoadBalancer Service (4222).
  • Point the /nats HTTPRoute at an Envoy Gateway Backend with spec.tls, instead of using BackendTLSPolicy.

• s3proxy:

  • Drop the TCPRoute.
  • Add the <fullname>-lb LoadBalancer Service (4224).
  • Point the HTTPRoute at a Backend with spec.tls, instead of using BackendTLSPolicy.

• acaas: set TLS on the existing Backend instead of using BackendTLSPolicy.

• New value gateway.loadBalancer.annotations (ace, s3proxy): set the same IP-sharing annotations as the Envoy Service (service-gateway-presets envoy.service.annotations) so all three LoadBalancer Services share one IP. Clients still use platform.host:4222/4224. Examples:

  • MetalLB: metallb.universe.tf/loadBalancerIPs: <ip> + metallb.universe.tf/allow-shared-ip: ace
  • Azure/ARO: service.beta.kubernetes.io/azure-load-balancer-ipv4: <ip>
  • spec.loadBalancerIP is deliberately not exposed (deprecated since Kubernetes 1.24).
  • AWS NLB can't share an IP across Services; not handled here.

• ace pgpool:

  • Run pgpool with runAsGroup: 0. Pod and container runAsGroup are no longer the namespace UID.
  • Set the exporter securityContext to the namespace UID range (restricted SCC).

All platforms:

• enableBackend: true under config.envoyGateway.extensionApis, set for:

  • opscenter-features voyager-gateway (the cluster gateway)
  • service-gateway and service-gateway-presets (the per-namespace gateway.voyagermesh.com/ace gateway that serves the ace/s3proxy/acaas routes). Without it, /nats fails with ResolvedRefs=False: Backend is disabled in Envoy Gateway configuration.

• catalog: regenerated by make refresh (editor charts v0.38.0 → v0.39.0).

Depends on:

• voyagermesh/crd-manager#30: installs the backends.gateway.envoyproxy.io CRD.
• voyagermesh/gateway#458: envoy-gateway starts without the TCPRoute, TLSRoute, ListenerSet and BackendTLSPolicy CRDs.

Verification (helm template):

• Non-OpenShift ace/acaas: output is identical to the base branch, apart from randomly generated secrets.
• OpenShift: no TCPRoute/BackendTLSPolicy is rendered.