Three bats test cases verify the end-to-end infrastructure brought up
by this PR:
1. Gateway API CRDs are installed (gatewayclasses, gateways, httproutes)
and the 'cilium' GatewayClass is Accepted by the controller —
proves gateway-api-crds installed and cilium.gatewayAPI.enabled
propagated.
2. A minimal Gateway in tenant-test reconciles to Programmed and the
controller materialises its cilium-gateway-<name> LoadBalancer
Service — proves envoy.enabled kicked in and the data-plane wiring
is live.
3. An HTTPRoute with a matching parentRef reaches Accepted status —
proves Cilium's HTTPRoute attachment logic works.
Not covered (because the test harness has no reachable Let's Encrypt
endpoint and no way to flip cluster-wide gateway.enabled mid-pipeline
without trampling other tests):
- cert-manager HTTP-01 solver via gatewayHTTPRoute.
- The ValidatingAdmissionPolicy that enforces tenant hostname
ownership (installed only when gateway.enabled=true at platform
level).
- Full tenant.spec.gateway=true flow with extra/gateway chart and
CiliumLoadBalancerIPPool.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
9505b08dd2