fix: add selector to shared dataplane Service for reliable endpoint discovery

The infrastructure reconciler creates the shared dataplane Service without a
selector and manages EndpointSlices directly via node snapshot version matching.
When the dataplane has not acknowledged the current snapshot version, no
EndpointSlices are created, leaving the Service without endpoints and blocking
Gateway convergence indefinitely.

Add the DataplaneSelector (app: nantian-gw-dataplane) to the shared Service spec
so the Kubernetes EndpointSlice controller creates endpoints independently.
Foreign EndpointSlices are no longer deleted for the shared Service, allowing
them to serve as a fallback when managed slices are not yet ready.

This fixes Gateway Programmed=False with 'Waiting for derived frontend
EndpointSlices to converge' on fresh deployments.

Author: mahmut-Abi

internal/infrastructure/reconciler.go

@@ -359,7 +359,10 @@ func (r *Reconciler) reconcileSharedService(
 	); err != nil {
 		return err
 	}
-	return deleteFrontendEndpointSlices(ctx, r.client, state.foreignSlices[serviceID])
+	// Foreign EndpointSlices (e.g. created by the Kubernetes EndpointSlice controller
+	// when the shared Service has a selector) are kept as a fallback; they ensure the
+	// Service has endpoints even when the dataplane snapshot version has not converged.
+	return nil
 }
 
 func (r *Reconciler) reconcileGatewayServices(

internal/infrastructure/reconciler_core_test.go

@@ -111,8 +111,8 @@ func TestReconcileCreatesGatewayInfrastructureServiceAndUpdatesSharedPorts(t *te
 	if shared.Spec.Type != corev1.ServiceTypeNodePort {
 		t.Fatalf("shared service type = %s, want NodePort", shared.Spec.Type)
 	}
-	if shared.Spec.Selector != nil {
-		t.Fatalf("shared service selector = %#v, want nil with managed EndpointSlices", shared.Spec.Selector)
+	if shared.Spec.Selector == nil || shared.Spec.Selector["app"] != "nantian-gw-dataplane" {
+		t.Fatalf("shared service selector = %#v, want map[app:nantian-gw-dataplane]", shared.Spec.Selector)
 	}
 	assertServicePort(t, shared.Spec.Ports, 80, corev1.ProtocolTCP, 30080)
 	assertServicePort(t, shared.Spec.Ports, 8080, corev1.ProtocolTCP, 32080)

internal/infrastructure/reconciler_mesh_test.go

@@ -970,8 +970,8 @@ func TestReconcileFrontsSharedAndGatewayServicesOnlyWithAckedCurrentSnapshotNode
 	if err != nil {
 		t.Fatalf("Get shared Service returned error: %v", err)
 	}
-	if sharedService.Spec.Selector != nil {
-		t.Fatalf("shared service selector = %#v, want nil with managed EndpointSlices", sharedService.Spec.Selector)
+	if sharedService.Spec.Selector == nil || sharedService.Spec.Selector["app"] != "nantian-gw-dataplane" {
+		t.Fatalf("shared service selector = %#v, want map[app:nantian-gw-dataplane]", sharedService.Spec.Selector)
 	}
 
 	gatewayService, err := mustGetService(

internal/infrastructure/services.go

@@ -59,6 +59,9 @@ func desiredSharedService(
 		desired.Spec.SessionAffinity = current.Spec.SessionAffinity
 	}
 
+	if len(options.DataplaneSelector) > 0 {
+		desired.Spec.Selector = options.DataplaneSelector
+	}
 	desired.Spec.Ports = assignSharedNodePorts(mergeServicePorts(current.Spec.Ports, ports, true))
 	return desired
 }