Gateway Core Support

[mpstefan]

For our release of NGINX Gateway v1.0, we need at least core support for the Gateway API Object as defined in the Kubernetes Gateway API v1beta1. This epic will track all the enhancements that need to be made to the HTTPRoute to reach support for "core".

List of extended or implementation specific features that will NOT be implemented at this time:

• listener tls options
• requested addresses

Acceptance:

• Documentation is updated to reflect what extended features are still unsupported.

Stories

Beta Give feedback

1. Core API: AllowedRoutes nginx-kubernetes-gateway#475
   area/gateway/core enhancement refined +3
   
2. Set Programmed Condition in Gateway Status nginx-kubernetes-gateway#610
   area/gateway/core conformance enhancement refined +4
   
3. Nginx fails to reload due to long server name nginx-kubernetes-gateway#632
   area/nginx-configuration bug refined +3
   
4. Conformance: Set Accepted Condition Type on Gateway Status nginx-kubernetes-gateway#368
   area/gateway/core conformance enhancement refined +4
   
5. Conformance: Set the Address field in Gateway Status nginx-kubernetes-gateway#370
   area/gateway/core conformance enhancement refined +4
   
6. Dynamic secrets/certificate rotation nginx-kubernetes-gateway#553
   area/control-plane enhancement refined +3
   
7. Route and Listener wildcard hostnames nginx-kubernetes-gateway#478
   area/httproute/core enhancement refined +3
   
8. Update conformance documentation based on outcome of conformance tests nginx-kubernetes-gateway#687
   blocked documentation refined +3
   
9. Set Programmed Condition in Listener Status nginx-kubernetes-gateway#712
   area/gateway/core enhancement refined +3
   
10. Set ResolvedRefs/False/InvalidRouteKinds on Listeners with Invalid Route Kinds nginx-kubernetes-gateway#774
    area/gateway/core enhancement refined +3
    

For Discussion:

• Why would a listener be able to accept TCP, TLS, and UDP traffic without having the matching route? How do the Gateway conformance tests test for this?
  • The Kubernetes API specification for ProtocolType mentions implementations are not required to accept all the defined protocols, yet lists HTTP, HTTPS, TCP, TLS, and UDP as "core".
• Will Secrets be sufficient to store listener tls certificateRefs for core? The specification states:
  A single CertificateRef to a Kubernetes Secret has \"Core\" support. Implementations MAY choose to support attaching multiple certificates to a Listener, but this behavior is implementation-specific.
  Any additional detail around "partial support" for certificateRefs?
• GatewayStatus does not specify a support level. Is GatewayStatus included in the conformance tests? How necessary is its inclusion in our v1.0?