fix(openshift): add EnvoyFilter CRD stub for OCP ingress without Service Mesh

[matzew]

The mcp-gateway controller watches the EnvoyFilter CRD from networking.istio.io/v1alpha3 at startup. When deploying with USE_OCP_INGRESS=true (no Service Mesh), this CRD does not exist and the controller crashes in a loop:

no matches for kind "EnvoyFilter" in version "networking.istio.io/v1alpha3"

This adds a minimal stub CRD to the ocp-ingress kustomize overlay so the controller cache can sync without requiring a full Service Mesh install.

Summary by CodeRabbit

• New Features
  • Introduced EnvoyFilter Custom Resource Definition for OpenShift clusters, enabling traffic routing and networking configuration through Envoy proxies. Now available on clusters with or without Service Mesh installation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 97dadc39-5b73-47a6-bfe5-026b88a72736

📥 Commits

Reviewing files that changed from the base of the PR and between b7cc91e and a51603f.

📒 Files selected for processing (2)

• config/openshift/kustomize/ocp-ingress/base/envoyfilter-crd.yaml
• config/openshift/kustomize/ocp-ingress/base/kustomization.yaml

---

📝 Walkthrough

Walkthrough

Introduces a new EnvoyFilter CustomResourceDefinition for Istio networking in the OpenShift kustomize configuration, marking it as a namespaced resource with v1alpha3 version. The CRD is registered in the base kustomization resources.

Changes

Cohort / File(s)	Summary
EnvoyFilter CRD Configuration config/openshift/kustomize/ocp-ingress/base/envoyfilter-crd.yaml, config/openshift/kustomize/ocp-ingress/base/kustomization.yaml	Adds new EnvoyFilter CustomResourceDefinition manifest and registers it in kustomization resources for inclusion in cluster deployments.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and accurately describes the main change: adding an EnvoyFilter CRD stub for OCP ingress deployments without Service Mesh, matching the PR's core objective.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[maleck13]

When you say no mesh can you expand? Is it still the Istio control plane that is managing the gateways? Without the presence of an EnvoyFilter how is traffic reaching the ext_proc