This commit is doing nothing but just add a flag for enabling Gateway API
support. The permission for operator clusterrole is updated as required.

Signed-off-by: Tam Mach <tam.mach@cilium.io>

This is just to add a simple reconciliation loop, which will just check
controller name and update the status accordingly.

Currently, there is no support of GatewayClass configuration from either
custom resource or configmap (preferred), hence the Accepted condition
will be just updated to True. Future improvement can be done with different
set of configuration parameters (e.g. internal vs external, etc).

Signed-off-by: Tam Mach <tam.mach@cilium.io>

For HTTPRoute resources, the reconciliation should start if any of below
event happens:

- Changes in HTTPRoute itself
- Changes in related backend services
- Changes in parent Gateway spec (e.g. allowedRoutes)

The current reconciliation loop is trying its best to make sure that HTTPRoute
is attachable to Gateway. If all validations are passed, then the Accepted
condition will be updated to True, which signals the reconciliation loop for
parent Gateway resources.

Signed-off-by: Tam Mach <tam.mach@cilium.io>

This commit is to support headers and query params matching, also add
weightage attribute for backends as well.

The goal is to prepare for supporting more options in HTTPRoute from
Gateway API in subsequent changes.

Signed-off-by: Tam Mach <tam.mach@cilium.io>

This commit is just to lift and shift existing shared translator (used in
Ingress) to higher level, so that it can be re-used naturally for both
Ingress and Gateway API.

Signed-off-by: Tam Mach <tam.mach@cilium.io>

This commit is to support multiple TLS secrets, which can be useful for
some use cases in Gateway API.

Signed-off-by: Tam Mach <tam.mach@cilium.io>

This commit is to support hostnames in route level, mainly for the
stricter domain validation compared to listener domain. For example,
listener might have wildcard domain such as *.example.com, but each
route might have its own sub-domains such as route1.example.com or
route2.example.com. If nothing is specified in route level, the
value from listener will be honoured.

Signed-off-by: Tam Mach <tam.mach@cilium.io>

This is to support the scenario, in which no backend is valid or
available.

Signed-off-by: Tam Mach <tam.mach@cilium.io>

This commit is to convert gateway api resource to our internal
representation. The logic is pretty simple, just few things to highlight
compared to Ingress:

- Query match, header match are supported.
- Request header filter is supported for operations Set, Add and Remove.

Signed-off-by: Tam Mach <tam.mach@cilium.io>

This commit is to our internal representation to CEC, LB Service and
Endpoints. The logic is exactly the same compared to default translator,
except a few tweaks:

- hostname matching is suffix based
- multiple listeners might have a same port number (e.g. 80 or 443), so
  we need to consider only unique values.

Signed-off-by: Tam Mach <tam.mach@cilium.io>

For gateway resources, the reconciliation should start if any of below
events happens:

- Changes in related GatewayClass
- Changes in any of HTTPRoute status
- Changes in owning LB services status
- Changes in owning CEC (as currently we don't have status subresource)
- Changes in any Secret used in TLS

As we are using the same LB service for all listeners, it's all or
nothing for ListenerStatus.

Signed-off-by: Tam Mach <tam.mach@cilium.io>

This commit is to make sure that any TLS related secret will be synced
to cilium-secrets namespace, so that the agent's permission is scoped
down to single namespace instead of cluster-wide. The same approach is
used in Ingress. However, it's better to keep it separate due to:

- underlying framework is different (e.g. controller-runtime)
- placeholder to support ReferenceGrant API later.

Signed-off-by: Tam Mach <tam.mach@cilium.io>

This commit is add gateway api conformance test from upstream. The goal
is to have it running on every PR, so that we can catch any issue due to
regression, refactoring or adding new features.

The upstream conformance, by default, is not configured with query param
matching feature. To reduce the coupling with upstream, the
conformance_test.go is added for flexibility, for example, query param
tests are enabled.

Signed-off-by: Tam Mach <tam.mach@cilium.io>