Add Gateway API (HTTPRoute) support to Console Helm chart and CRD

[w1ndhunter]

Summary

Adds support for Kubernetes Gateway API HTTPRoute resources to the Console chart and operator, allowing users to expose Console via Gateway API controllers (e.g. Envoy Gateway, Istio, Cilium) as an alternative to classic Ingress.

Gateway and Ingress are mutually exclusive — only one may be enabled at a time. Attempting to enable both will result in a validation error.

Closes #1308

Changes

Console Helm Chart

• New gateway values block alongside existing ingress block
• New gateway.go with HTTPRoute() rendering function
• HTTPRoute added to Render() manifest list and Types() scheme registration
• gatewayv1.Install(Scheme) for Gateway API type serialization
• Updated notes.go to show Gateway URLs (mutually exclusive with Ingress)
• Validation in NewRenderState rejects both gateway and ingress enabled simultaneously
• New test cases: gateway-only, mutual exclusion validation, gateway removal/switch scenarios
• Regenerated schema, golden files, and templates

Operator (Console CRD)

• New GatewayConfig and GatewayParentReference types in console_types.go
• Gateway field added to ConsoleValues and RedpandaConsole structs
• Auto-generated conversion (goverter) from CRD types → chart partial values
• RBAC: added gateway.networking.k8s.io/httproutes permissions
• Registered gatewayv1 types in V2 scheme
• Bumped sigs.k8s.io/gateway-api from v1.4.1 → v1.5.1
• Regenerated deepcopy, conversion, and CRD manifests

Usage Examples

Helm Chart — Gateway API

# values.yaml
gateway:
  enabled: true
  annotations:
    example.com/owner: my-team
  parentRefs:
    - name: my-gateway
      namespace: gateway-system
      sectionName: https
  hostnames:
    - console.example.com
  path: /
  pathType: PathPrefix

helm install console redpanda/console -f values.yaml

Helm Chart — Classic Ingress (unchanged)

# values.yaml
ingress:
  enabled: true
  hosts:
    - host: console.example.com
      paths:
        - path: /
          pathType: Prefix

Note: Enabling both ingress.enabled: true and gateway.enabled: true will fail with: ingress and gateway cannot both be enabled; use one or the other

Console CRD (Operator) — Gateway API

apiVersion: cluster.redpanda.com/v1alpha2
kind: Console
metadata:
  name: my-console
  namespace: redpanda
spec:
  clusterSource:
    clusterRef:
      name: my-cluster
  gateway:
    enabled: true
    annotations:
      example.com/owner: my-team
    parentRefs:
      - name: my-gateway
        namespace: gateway-system
        sectionName: https
    hostnames:
      - console.example.com
    path: /
    pathType: PathPrefix

Console CRD (Operator) — Switching from Gateway to Ingress

To switch, remove the gateway stanza and add ingress:

apiVersion: cluster.redpanda.com/v1alpha2
kind: Console
metadata:
  name: my-console
  namespace: redpanda
spec:
  clusterSource:
    clusterRef:
      name: my-cluster
  ingress:
    enabled: true
    hosts:
      - host: console.example.com
        paths:
          - path: /
            pathType: Prefix

The operator will remove the HTTPRoute and create an Ingress instead.

Test plan

• go build ./... passes in operator/ and charts/console/
• go test ./... passes in charts/console/ — includes:
  • TestIngressGatewayMutualExclusion — both enabled → error
  • TestGatewayRemoval/gateway_removed_from_config — no gateway stanza → no HTTPRoute
  • TestGatewayRemoval/gateway_explicitly_disabled — enabled: false → no HTTPRoute
  • TestGatewayRemoval/switch_from_gateway_to_ingress — gateway→ingress produces Ingress, no HTTPRoute
  • TestTemplate golden tests (gateway-templating case)
• CRD schema includes gateway field with correct OpenAPI validation
• Deploy Console CRD with gateway.enabled: true → HTTPRoute created
• Deploy via Helm with gateway.enabled: true → HTTPRoute created
• Enabling both ingress and gateway → validation error

🤖 Generated with Claude Code

[CLAassistant]

All committers have signed the CLA.

[david-yu]

@w1ndhunter Thanks for the PR. I think we'd also like to expose in the Operator, if you're ok with it I can take a swag at modifying this PR to provide support in the Operator as well.

[david-yu]

It looks like I'll need to close and reopen a new PR but Ill make sure to preserve your commits go in the new PR to run the tests.

[david-yu]

Closing this fork-based PR and recreating from an upstream branch to trigger CI. All commits from @w1ndhunter are preserved. See the new PR linked below.

[david-yu]

Recreated as #1329 from an upstream branch to enable CI.