Register a dedicated cozystack.gateway-api-crds PackageSource and wire
it into the system bundle before networking/cert-manager load. Without
this the host cluster has no gateway.networking.k8s.io CRDs, Cilium's
Gateway API controller cannot bootstrap (no GatewayClass registered),
and cert-manager's gateway-shim controller silently disables Gateway
API certificate automation.
- New PackageSource cozystack.gateway-api-crds → installs
packages/system/gateway-api-crds into namespace cozy-gateway-api.
- cozystack.networking (variants cilium, cilium-kilo, cilium-generic,
kubeovn-cilium, kubeovn-cilium-generic) dependsOn
cozystack.gateway-api-crds so Cilium only starts once the CRDs are
present.
- cozystack.cert-manager dependsOn cozystack.gateway-api-crds, closing
the startup race that the #2208 discussion flagged — cert-manager's
gateway-shim discovers CRDs at process start, so racing with CRD
install left Gateway API solvers permanently disabled until the pod
was restarted.
- system bundle loads cozystack.gateway-api-crds unconditionally for
every variant (isp-full, isp-hosted, isp-full-generic).
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
7f2354170e