fix: add selectors to gateway-specific Services for reliable endpoints

The infrastructure reconciler creates gateway-specific ClusterIP Services
without selectors and manages EndpointSlices via snapshot version matching.
When the dataplane has not acknowledged the current snapshot, no EndpointSlices
are created, blocking Gateway convergence.

Add 'app: nantian-gw-dataplane' selector to gateway Services so the Kubernetes
EndpointSlice controller creates endpoints independently. Foreign EndpointSlices
are no longer deleted for gateway Services, allowing them to serve as fallback
when managed slices are not yet ready.

Author: mahmut-Abi

internal/infrastructure/reconciler.go

@@ -450,9 +450,8 @@ func (r *Reconciler) reconcileGatewayServices(
 		); err != nil {
 			return err
 		}
-		if err := deleteFrontendEndpointSlices(ctx, r.client, state.foreignSlices[serviceID]); err != nil {
-			return err
-		}
+		// Foreign EndpointSlices (e.g. created by Kubernetes when the Service
+		// has a selector) are kept as a fallback for snapshot convergence.
 	}
 
 	for _, service := range services.Items {

internal/infrastructure/reconciler_core_test.go

@@ -156,8 +156,8 @@ func TestReconcileCreatesGatewayInfrastructureServiceAndUpdatesSharedPorts(t *te
 	if gatewayService.Annotations["example.com/trace"] != "enabled" {
 		t.Fatalf("expected propagated annotation, got %#v", gatewayService.Annotations)
 	}
-	if gatewayService.Spec.Selector != nil {
-		t.Fatalf("gateway service selector = %#v, want nil with managed EndpointSlices", gatewayService.Spec.Selector)
+	if gatewayService.Spec.Selector == nil || gatewayService.Spec.Selector["app"] != "nantian-gw-dataplane" {
+		t.Fatalf("gateway service selector = %#v, want map[app:nantian-gw-dataplane]", gatewayService.Spec.Selector)
 	}
 	assertServicePort(t, gatewayService.Spec.Ports, 8080, corev1.ProtocolTCP, 0)
 	assertServicePort(t, gatewayService.Spec.Ports, 5300, corev1.ProtocolUDP, 0)

internal/infrastructure/reconciler_mesh_test.go

@@ -982,8 +982,8 @@ func TestReconcileFrontsSharedAndGatewayServicesOnlyWithAckedCurrentSnapshotNode
 	if err != nil {
 		t.Fatalf("Get gateway Service returned error: %v", err)
 	}
-	if gatewayService.Spec.Selector != nil {
-		t.Fatalf("gateway service selector = %#v, want nil with managed EndpointSlices", gatewayService.Spec.Selector)
+	if gatewayService.Spec.Selector == nil || gatewayService.Spec.Selector["app"] != "nantian-gw-dataplane" {
+		t.Fatalf("gateway service selector = %#v, want map[app:nantian-gw-dataplane]", gatewayService.Spec.Selector)
 	}
 
 	var sharedSlices discoveryv1.EndpointSliceList

internal/infrastructure/reconciler_parameters_test.go

@@ -314,8 +314,8 @@ allocateLoadBalancerNodePorts: false
 	if service.Spec.Type != corev1.ServiceTypeLoadBalancer {
 		t.Fatalf("service type = %s, want LoadBalancer", service.Spec.Type)
 	}
-	if service.Spec.Selector != nil {
-		t.Fatalf("gateway service selector = %#v, want nil with managed EndpointSlices", service.Spec.Selector)
+	if service.Spec.Selector == nil || service.Spec.Selector["app"] != "nantian-gw-dataplane" {
+		t.Fatalf("gateway service selector = %#v, want map[app:nantian-gw-dataplane]", service.Spec.Selector)
 	}
 	if service.Spec.ExternalTrafficPolicy != corev1.ServiceExternalTrafficPolicyLocal {
 		t.Fatalf("externalTrafficPolicy = %s, want Local", service.Spec.ExternalTrafficPolicy)
@@ -574,8 +574,8 @@ func TestReconcileIgnoresInvalidGatewayInfrastructureParametersRef(t *testing.T)
 	if service.Spec.Type != corev1.ServiceTypeClusterIP {
 		t.Fatalf("service type = %s, want ClusterIP fallback", service.Spec.Type)
 	}
-	if service.Spec.Selector != nil {
-		t.Fatalf("gateway service selector = %#v, want nil with managed EndpointSlices", service.Spec.Selector)
+	if service.Spec.Selector == nil || service.Spec.Selector["app"] != "nantian-gw-dataplane" {
+		t.Fatalf("gateway service selector = %#v, want map[app:nantian-gw-dataplane]", service.Spec.Selector)
 	}
 	if service.Spec.ExternalTrafficPolicy != "" {
 		t.Fatalf("externalTrafficPolicy = %q, want empty", service.Spec.ExternalTrafficPolicy)
@@ -687,8 +687,8 @@ allocateLoadBalancerNodePorts: false
 	if service.Spec.Type != corev1.ServiceTypeLoadBalancer {
 		t.Fatalf("service type = %s, want LoadBalancer", service.Spec.Type)
 	}
-	if service.Spec.Selector != nil {
-		t.Fatalf("gateway service selector = %#v, want nil with managed EndpointSlices", service.Spec.Selector)
+	if service.Spec.Selector == nil || service.Spec.Selector["app"] != "nantian-gw-dataplane" {
+		t.Fatalf("gateway service selector = %#v, want map[app:nantian-gw-dataplane]", service.Spec.Selector)
 	}
 	if service.Spec.ExternalTrafficPolicy != corev1.ServiceExternalTrafficPolicyLocal {
 		t.Fatalf("externalTrafficPolicy = %s, want Local", service.Spec.ExternalTrafficPolicy)
@@ -783,8 +783,8 @@ func TestReconcileResetsGatewayServiceFieldsWhenParametersRefRemoved(t *testing.
 	if service.Spec.Type != corev1.ServiceTypeClusterIP {
 		t.Fatalf("service type = %s, want ClusterIP", service.Spec.Type)
 	}
-	if service.Spec.Selector != nil {
-		t.Fatalf("gateway service selector = %#v, want nil with managed EndpointSlices", service.Spec.Selector)
+	if service.Spec.Selector == nil || service.Spec.Selector["app"] != "nantian-gw-dataplane" {
+		t.Fatalf("gateway service selector = %#v, want map[app:nantian-gw-dataplane]", service.Spec.Selector)
 	}
 	if service.Spec.ExternalTrafficPolicy != "" {
 		t.Fatalf("externalTrafficPolicy = %q, want empty", service.Spec.ExternalTrafficPolicy)

internal/infrastructure/services.go

@@ -98,7 +98,8 @@ func desiredGatewayService(
 			OwnerReferences: desiredGatewayServiceOwnerReferences(gateway),
 		},
 		Spec: corev1.ServiceSpec{
-			Type: corev1.ServiceTypeClusterIP,
+			Type:     corev1.ServiceTypeClusterIP,
+			Selector: map[string]string{"app": "nantian-gw-dataplane"},
 		},
 	}