fix(manifests): add gRPC Route for ambient-api-server on mpp-openshift (RHOAIENG-56775) (#1224)

## Summary

- Adds missing OpenShift Route `ambient-api-server-grpc` to
`components/manifests/overlays/mpp-openshift/ambient-api-server-route.yaml`
with `passthrough` TLS termination targeting the `grpc` service port
(9000)
- Extends `defaultOpenShiftPatterns` in the Go SDK
(`go-sdk/client/session_watch.go`) to include `paas.redhat.com`, so
`acpctl` correctly derives the gRPC Route hostname on MPP clusters
instead of falling back to unreachable pod-IP:9000

## Root Cause

The mpp-openshift overlay only exposed the HTTP Route (port 8000). The
gRPC port (9000) had no Route, causing `acpctl session messages -f` and
`acpctl get sessions -w` to time out. Additionally, the SDK hostname
detection did not recognize
`*.apps.int.spoke.dev.us-east-1.aws.paas.redhat.com` as an OpenShift
Route pattern.

## Test Plan

- [ ] Deploy `kubectl apply -k
components/manifests/overlays/mpp-openshift/` and verify
`ambient-api-server-grpc` Route is created
- [ ] Confirm Route hostname follows pattern
`ambient-api-server-grpc-<namespace>.apps.<cluster>.paas.redhat.com`
- [ ] Run `acpctl session messages -f <session-id>` against the MPP
cluster — should connect without timeout
- [ ] Run `acpctl get sessions -w` — should stream watch events

Fixes: RHOAIENG-56775

🤖 Generated with [Claude Code](https://claude.ai/code)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added a dedicated gRPC route for the API server that uses re-encrypt
TLS and redirects insecure edge traffic.
* Enabled gRPC TLS for the API server and configured it to use
secret-mounted certificates.

* **Infrastructure Updates**
* Extended OpenShift hostname matching to recognize additional cloud
environment domains.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Ambient Code Bot <bot@ambient-code.local>
Co-authored-by: Claude <noreply@anthropic.com>

Author: 3 people

components/ambient-sdk/go-sdk/client/session_watch.go

@@ -25,7 +25,7 @@ import (
 
 const grpcDefaultPort = "9000"
 
-var defaultOpenShiftPatterns = []string{"apps.rosa", "apps.ocp", "apps.openshift"}
+var defaultOpenShiftPatterns = []string{"apps.rosa", "apps.ocp", "apps.openshift", "paas.redhat.com"}
 
 // MessageWatcher streams session messages from a single session via gRPC.
 type MessageWatcher struct {

components/manifests/overlays/mpp-openshift/ambient-api-server-args-patch.yaml

@@ -31,5 +31,16 @@ spec:
             - --jwk-cert-file=/configs/authentication/jwks.json
             - --enable-grpc=true
             - --grpc-server-bindaddress=:9000
+            - --grpc-enable-tls=true
+            - --grpc-tls-cert-file=/etc/tls/tls.crt
+            - --grpc-tls-key-file=/etc/tls/tls.key
             - --alsologtostderr
             - -v=4
+          volumeMounts:
+            - name: tls-certs
+              mountPath: /etc/tls
+              readOnly: true
+      volumes:
+        - name: tls-certs
+          secret:
+            secretName: ambient-api-server-tls

components/manifests/overlays/mpp-openshift/ambient-api-server-route.yaml

@@ -16,3 +16,22 @@ spec:
   tls:
     termination: edge
     insecureEdgeTerminationPolicy: Redirect
+---
+apiVersion: route.openshift.io/v1
+kind: Route
+metadata:
+  name: ambient-api-server-grpc
+  namespace: ambient-code--runtime-int
+  labels:
+    app: ambient-api-server
+    component: grpc
+    shard: internal
+spec:
+  to:
+    kind: Service
+    name: ambient-api-server
+  port:
+    targetPort: grpc
+  tls:
+    termination: reencrypt
+    insecureEdgeTerminationPolicy: Redirect