feat(controller): reconcile optional HTTPRoute

Add a reconcileHTTPRoute step using controllerutil.CreateOrUpdate over an
unstructured object, deleting the route when disabled and reporting via
the HTTPRouteReady condition. Add a +kubebuilder:rbac marker for
gateway.networking.k8s.io httproutes and keep the generated ClusterRole
and Helm chart RBAC in sync.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: stubbi

charts/hermes-operator/templates/clusterrole.yaml

@@ -20,6 +20,9 @@ rules:
   - apiGroups: [batch]
     resources: [cronjobs, jobs]
     verbs: [create, delete, get, list, patch, update, watch]
+  - apiGroups: [gateway.networking.k8s.io]
+    resources: [httproutes]
+    verbs: [create, delete, get, list, patch, update, watch]
   - apiGroups: [hermes.agent]
     resources: [hermesclusterdefaults]
     verbs: [get, list, patch, update, watch]

config/rbac/role.yaml

@@ -67,6 +67,18 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - gateway.networking.k8s.io
+  resources:
+  - httproutes
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - hermes.agent
   resources:

internal/controller/hermesinstance_controller.go

@@ -76,6 +76,7 @@ const (
 // +kubebuilder:rbac:groups=apps,resources=statefulsets,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups="",resources=services;configmaps;persistentvolumeclaims;secrets;serviceaccounts;events,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=networking.k8s.io,resources=networkpolicies;ingresses,verbs=get;list;watch;create;update;patch;delete
+// +kubebuilder:rbac:groups=gateway.networking.k8s.io,resources=httproutes,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=policy,resources=poddisruptionbudgets,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=autoscaling,resources=horizontalpodautoscalers,verbs=get;list;watch;create;update;patch;delete
 // +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles;rolebindings,verbs=get;list;watch;create;update;patch;delete
@@ -131,6 +132,7 @@ func (r *HermesInstanceReconciler) Reconcile(ctx context.Context, req ctrl.Reque
 		{"PDB", hermesv1.ConditionTypePDBReady, r.reconcilePDB},
 		{"HPA", hermesv1.ConditionTypeHPAReady, r.reconcileHPA},
 		{"Ingress", hermesv1.ConditionTypeIngressReady, r.reconcileIngress},
+		{"HTTPRoute", hermesv1.ConditionTypeHTTPRouteReady, r.reconcileHTTPRoute},
 		{"ServiceMonitor", hermesv1.ConditionTypeServiceMonitorReady, r.reconcileServiceMonitor},
 		{"PrometheusRule", hermesv1.ConditionTypePrometheusRuleReady, r.reconcilePrometheusRule},
 		{"GrafanaDashboard", hermesv1.ConditionTypeGrafanaDashboardReady, r.reconcileGrafanaDashboards},
@@ -392,6 +394,34 @@ func (r *HermesInstanceReconciler) reconcileIngress(ctx context.Context, inst *h
 	return err
 }
 
+func (r *HermesInstanceReconciler) reconcileHTTPRoute(ctx context.Context, inst *hermesv1.HermesInstance) error {
+	spec := inst.Spec.Networking.HTTPRoute
+	enabled := spec != nil && resources.BoolValue(spec.Enabled)
+	if !enabled {
+		obj := &unstructured.Unstructured{}
+		obj.SetGroupVersionKind(resources.HTTPRouteGVK())
+		obj.SetName(resources.HTTPRouteName(inst))
+		obj.SetNamespace(inst.Namespace)
+		return r.deleteIfExists(ctx, obj)
+	}
+	desired := resources.BuildHTTPRoute(inst)
+	if err := controllerutil.SetControllerReference(inst, desired, r.Scheme); err != nil {
+		return err
+	}
+	obj := &unstructured.Unstructured{}
+	obj.SetGroupVersionKind(resources.HTTPRouteGVK())
+	obj.SetName(desired.GetName())
+	obj.SetNamespace(desired.GetNamespace())
+	_, err := controllerutil.CreateOrUpdate(ctx, r.Client, obj, func() error {
+		obj.Object["spec"] = desired.Object["spec"]
+		obj.SetLabels(resources.MergePreservingForeign(obj.GetLabels(), desired.GetLabels(), operatorLabelPrefix))
+		obj.SetAnnotations(resources.MergePreservingForeign(obj.GetAnnotations(), desired.GetAnnotations(), operatorLabelPrefix))
+		obj.SetOwnerReferences(desired.GetOwnerReferences())
+		return nil
+	})
+	return err
+}
+
 func (r *HermesInstanceReconciler) reconcileServiceMonitor(ctx context.Context, inst *hermesv1.HermesInstance) error {
 	// If the Prometheus Operator CRDs are not present there is nothing to manage:
 	// no ServiceMonitor can exist, so skip entirely (don't even try to delete).