feat: integration of gateway api

[jvlxz]

Summary

Integrates Kubernetes Gateway API support into Yggdrasil.

This adds support for discovering and translating Gateway, HTTPRoute, GatewayClass, and ReferenceGrant resources into Envoy configuration, alongside existing Ingress support. It also introduces a source-agnostic route policy model shared by Ingress annotations, HTTPRoute annotations, and the new YggdrasilPolicy CRD.

Changes

• Add Gateway API informers when gatewayClasses are configured, and skip them when the Gateway API CRDs are absent (no crash on clusters without them).
• Convert valid HTTPRoute resources into Yggdrasil ingress-like routing config.
• Support Gateway listener matching, hostnames, sectionName, and AllowedRoutes namespace policies.
• Support cross-namespace TLS secret references through ReferenceGrant.
• Add a shared RoutePolicy model (pkg/policy): Ingress/HTTPRoute annotations and the new YggdrasilPolicy CRD are parsed into one model; Envoy generation consumes RoutePolicy only, never raw annotations.
• Add the YggdrasilPolicy CRD (yggdrasil.uswitch.com/v1alpha1) to attach policy to an HTTPRoute via targetRef, plus generated clients/informers/listers.
• Honor HTTPRoute TLS precedence over Ingress, and drop a stale upstream SNI on clusters.
• Add Gateway API source metadata in metrics with source_kind="HTTPRoute", while preserving the existing source_kind="Ingress" label.
• Keep existing Ingress behavior unchanged.

Policy sources

Yggdrasil route behavior (timeouts, healthcheck, retry, upstream http version, weight, connection limits, sticky sessions) can come from three sources, all parsed into the shared RoutePolicy:

• Ingress annotations (yggdrasil.uswitch.com/*) — unchanged legacy behavior.
• HTTPRoute annotations (yggdrasil.uswitch.com/*) — used as a fallback when no YggdrasilPolicy targets the route.
• YggdrasilPolicy CRD — preferred for HTTPRoutes. A policy targets a same-namespace HTTPRoute via spec.targetRef (group: gateway.networking.k8s.io, kind: HTTPRoute). When one exists, the HTTPRoute's own annotations are ignored for policy.

Parsing strictness differs by source, on purpose:

• Annotations: an invalid individual value is skipped with a diagnostic; the rest of the source still applies (historical behavior).
• YggdrasilPolicy: a malformed spec rejects the whole policy source, so partial application never happens.
• If multiple YggdrasilPolicy objects target the same HTTPRoute, all are ignored and a diagnostic is emitted.

Policy conflict / precedence behavior

Conflicts are detected per host, per source kind, using a deterministic policy Signature() (weight is excluded — it is upstream weighting, not host policy; empty signatures are skipped).

• Same source kind on the same host, divergent signatures (Ingress vs Ingress, or HTTPRoute vs HTTPRoute)

  • The conflicting hosts are dropped from those routes and surfaced as Gateway diagnostics ("same source kind policy conflict").
  • This resolution lives in the k8s conversion layer (resolvePolicyConflicts); Envoy translation does not duplicate it.

• Ingress + HTTPRoute on the same host

  • They are merged into the same Envoy host/cluster (not treated as a conflict — different source kinds).
  • HTTPRoute-derived resources are applied after Ingress-derived resources, so HTTPRoute policy (and TLS cert) wins over Ingress on that host.

Note: for a Gateway API route, policy comes from the YggdrasilPolicy targeting the HTTPRoute (or, absent that, from the HTTPRoute's own annotations) — not from the Gateway metadata. A healthcheck-path set on the Gateway has no effect; set it on the YggdrasilPolicy/HTTPRoute instead.

[SoulKyu]

@jvlxz tu peux documenter les nouvelles permissions necessaire pour les gateway api ?

D'autant plus, que yggdrasil crash si pas dispo :

informersSynced = append(informersSynced,
  gatewayClassInformer.HasSynced, gatewayInformer.HasSynced, httpRouteInformer.HasSynced,
  referenceGrantInformer.HasSynced, serviceInformer.HasSynced, namespaceInformer.HasSynced)

[SoulKyu]

ConvertGatewayResources returning an err makes GetIngresses return nil, err — aborting the entire snapshot rebuild, including every healthy Ingress. One bad gateway object could stall reconciliation for everything.

[SoulKyu]

Different source kinds are not treated as conflicting, so both are kept and their upstreams merged; ordering is implicit (sourcePriority sorts Ingress first). Which source's annotations/timeouts win is not explicit.

[SoulKyu]

CertificateRefs[0] only — multi-cert listeners unsupported. Document the limitation.

[Aluxima]

Could you add the mention of gateway resources in README? Or possibly all at once in #18 with CRD examples?