[ON-HOLD][POC] Gateway API

[kolodziejczak]

Important

This PR is PARKED

Date frozen: April 2026
Reason: Feature rethinking/redesign - not moving forward at this time with just installation and uninstallation in Istio module.
Decision: The implementation is complete, but need to be tested/double-checked the feature will not be merged in its current form.

If you are picking this up in the future, read this first:

What is done:

• GatewayAPICRDManager — Install / Uninstall logic in gateway_api_crds.go
• Ownership model via kyma-project.io/module=istio label
• Blocking CR detection in gateway_api_resources.go (only checks module-managed CRDs)
• GatewayAPICRsDangling condition on Istio CR when deletion is blocked
• ADR written: docs/contributor/adr/0017-support-for-gateway-api.md

What is NOT done / known gaps:

• spec.experimental.enableGatewayAPI *bool should be migrated to spec.experimental.gatewayAPI.enableCRD *bool sub-struct for future extensibility - as described in ADR
• Version and channel compatibility check between Gateway API CRD bundle version and running Istio version
• e2e tests for the full install/uninstall cycle - need to be double-checked
• checked on the cluster if installation and uninstallation works correctly in different edge cases - probably check for the blocking managed CR is blocking the uninstall (annotation lastAppliedCofig is being updated and module doesn't try to uninstall CRDs which were blocked by existing CRs)
• integration and unit tests written - current tests for gateway_api_crds.go weren't updated
• Feature not yet promoted out of experimental

Key decisions made (see ADR for full context):

• Label-based ownership, never touch unlabeled CRDs
• Blocking check is cluster-wide, scoped to module-managed CRDs only
• Nil vs false distinction on *bool is intentional - nil = never enabled, false = explicitly disabled

Pre-Merge Checklist

Consider all the following items. If your contribution violates any of them, or you are not sure about it, add a comment to the PR.

• The code coverage is acceptable.
• Release notes for the introduced changes are created.
• If Kubebuilder changes were made, you ran make manifests and committed the changes before the merge.
• Pre-existing managed resources are correctly handled.
• The change works on all hyperscalers supported by SAP BTP, Kyma runtime.
• There is no upgrade downtime.
• For infrastructure changes, you checked if the changes affect the hyperscaler's costs.
• RBAC settings are as restrictive as possible.
• If any new libraries are added, you verified license compliance and maintainability, and made a comment in the PR with details. We only allow stable releases to be included in the project.
• You checked if this change should be cherry-picked to active release branches.
• The configuration does not introduce any additional latency.
• You checked if Busola updates are needed.
• If you added a predicate for restarters, check if the lastAppliedConfiguration annotation is properly updated after the given restart is executed.

Related issues

• ADR
• Issue on the board
• knowledge-hub

[hyperspace-insights]

Control Panel

Hi, I'm an AI-powered Review Bot that helps you with summarizing and reviewing pull requests.
To interact with me, just use the following actions:

• 📝 Summarize PR
• 🔍 Review
• 🗑️ Delete all bot comments and reviews

---

💌 Have ideas or want to contribute? Create an issue and share your thoughts with us!
📑 Check out the documentation for more information.
📬 Subscribe to the Hyperspace PR Bot DL to get the latest announcements and pilot features!

Made with ❤️ by Hyperspace.