Add Gateway API support for SolrCloud external addressability

Implements Kubernetes Gateway API as a new external addressability method,
enabling HTTPRoute-based routing for SolrCloud services.

- Add Gateway API types and controller logic
- Generate HTTPRoutes for common and per-node services
- Add RBAC for HTTPRoute and BackendTLSPolicy
- Update CRDs, Helm charts, and documentation
- Add E2E tests following existing Ingress test patterns

Author: chinmoysahu

api/v1beta1/solrcloud_types.go

@@ -563,11 +563,20 @@ type ExternalAddressability struct {
 	//
 	// +optional
 	IngressTLSTermination *SolrIngressTLSTermination `json:"ingressTLSTermination,omitempty"`
+
+	// Gateway defines settings for Kubernetes Gateway API routing.
+	//
+	// This option is only available when Method=Gateway.
+	// The referenced Gateway must already exist and be managed by your platform team.
+	// The Solr Operator only manages the HTTPRoute resources.
+	//
+	// +optional
+	Gateway *SolrGatewayOptions `json:"gateway,omitempty"`
 }
 
 // ExternalAddressabilityMethod is a string enumeration type that enumerates
 // all possible ways that a SolrCloud can be made addressable external to the kubernetes cluster.
-// +kubebuilder:validation:Enum=Ingress;ExternalDNS
+// +kubebuilder:validation:Enum=Ingress;ExternalDNS;Gateway
 type ExternalAddressabilityMethod string
 
 const (
@@ -577,6 +586,9 @@ const (
 	// Use ExternalDNS to make the Solr service(s) externally addressable
 	ExternalDNS ExternalAddressabilityMethod = "ExternalDNS"
 
+	// Use Gateway API to make the Solr service(s) externally addressable
+	Gateway ExternalAddressabilityMethod = "Gateway"
+
 	// Make Solr service(s) type:LoadBalancer to make them externally addressable
 	// NOTE: This option is not currently supported.
 	LoadBalancer ExternalAddressabilityMethod = "LoadBalancer"
@@ -626,6 +638,42 @@ type SolrIngressTLSTermination struct {
 	TLSSecret string `json:"tlsSecret,omitempty"`
 }
 
+// SolrGatewayOptions defines how a SolrCloud should be exposed via Kubernetes Gateway API
+type SolrGatewayOptions struct {
+	// ParentRefs specifies the Gateway(s) to attach HTTPRoutes to.
+	// This is required when using method=Gateway.
+	//
+	// The referenced Gateway must already exist and be managed by your platform team.
+	// The Solr Operator only manages the HTTPRoute resources.
+	//
+	// +kubebuilder:validation:MinItems=1
+	ParentRefs []GatewayParentReference `json:"parentRefs"`
+
+	// Annotations to add to HTTPRoute resources
+	// +optional
+	Annotations map[string]string `json:"annotations,omitempty"`
+
+	// Labels to add to HTTPRoute resources
+	// +optional
+	Labels map[string]string `json:"labels,omitempty"`
+}
+
+// GatewayParentReference identifies a parent Gateway resource to attach HTTPRoutes to
+type GatewayParentReference struct {
+	// Name of the Gateway resource
+	Name string `json:"name"`
+
+	// Namespace of the Gateway resource.
+	// If not specified, defaults to the HTTPRoute's namespace.
+	// +optional
+	Namespace *string `json:"namespace,omitempty"`
+
+	// SectionName refers to a specific listener on the Gateway.
+	// For example, "https" or "http".
+	// +optional
+	SectionName *string `json:"sectionName,omitempty"`
+}
+
 type SolrUpdateStrategy struct {
 	// Method defines the way in which SolrClouds should be updated when the podSpec changes.
 	// +optional
@@ -1297,6 +1345,16 @@ func (sc *SolrCloud) CommonIngressName() string {
 	return fmt.Sprintf("%s-solrcloud-common", sc.GetName())
 }
 
+// CommonHTTPRouteName returns the name of the common HTTPRoute for the cloud
+func (sc *SolrCloud) CommonHTTPRouteName() string {
+	return fmt.Sprintf("%s-solrcloud-common", sc.GetName())
+}
+
+// NodeHTTPRouteName returns the name of the HTTPRoute for a specific node
+func (sc *SolrCloud) NodeHTTPRouteName(nodeName string) string {
+	return nodeName
+}
+
 // ProvidedZookeeperName returns the provided zk cluster
 func (sc *SolrCloud) ProvidedZookeeperName() string {
 	return fmt.Sprintf("%s-solrcloud-zookeeper", sc.GetName())
@@ -1340,8 +1398,8 @@ func (sc *SolrCloud) UsesIndividualNodeServices() bool {
 }
 
 func (extOpts *ExternalAddressability) UsesIndividualNodeServices() bool {
-	// LoadBalancer and Ingress will not work with headless services if each pod needs to be exposed externally.
-	return extOpts != nil && !extOpts.HideNodes && (extOpts.Method == Ingress || extOpts.Method == LoadBalancer)
+	// LoadBalancer, Ingress, and Gateway will not work with headless services if each pod needs to be exposed externally.
+	return extOpts != nil && !extOpts.HideNodes && (extOpts.Method == Ingress || extOpts.Method == LoadBalancer || extOpts.Method == Gateway)
 }
 
 func (sc *SolrCloud) CommonExternalPrefix() string {
@@ -1435,11 +1493,13 @@ func (sc *SolrCloud) ExternalNodeUrl(nodeName string, domainName string, withPor
 		url = fmt.Sprintf("%s.%s", sc.NodeIngressPrefix(nodeName), domainName)
 	} else if sc.Spec.SolrAddressability.External.Method == ExternalDNS {
 		url = fmt.Sprintf("%s.%s", nodeName, sc.ExternalDnsDomain(domainName))
+	} else if sc.Spec.SolrAddressability.External.Method == Gateway {
+		url = fmt.Sprintf("%s.%s", sc.NodeIngressPrefix(nodeName), domainName)
 	}
 	// TODO: Add LoadBalancer stuff here
 
-	if withPort && sc.Spec.SolrAddressability.External.Method != Ingress {
-		// Ingress does not require a port, since the port is whatever the ingress is listening on (80 and 443)
+	if withPort && sc.Spec.SolrAddressability.External.Method != Ingress && sc.Spec.SolrAddressability.External.Method != Gateway {
+		// Ingress and Gateway do not require a port, since the port is whatever the ingress/gateway is listening on (80 and 443)
 		url += sc.NodePortSuffix(true)
 	}
 	return url
@@ -1450,11 +1510,13 @@ func (sc *SolrCloud) ExternalCommonUrl(domainName string, withPort bool) (url st
 		url = fmt.Sprintf("%s.%s", sc.CommonExternalPrefix(), domainName)
 	} else if sc.Spec.SolrAddressability.External.Method == ExternalDNS {
 		url = fmt.Sprintf("%s.%s", sc.CommonServiceName(), sc.ExternalDnsDomain(domainName))
+	} else if sc.Spec.SolrAddressability.External.Method == Gateway {
+		url = fmt.Sprintf("%s.%s", sc.CommonExternalPrefix(), domainName)
 	}
 	// TODO: Add LoadBalancer stuff here
 
-	if withPort && sc.Spec.SolrAddressability.External.Method != Ingress {
-		// Ingress does not require a port, since the port is whatever the ingress is listening on (80 and 443)
+	if withPort && sc.Spec.SolrAddressability.External.Method != Ingress && sc.Spec.SolrAddressability.External.Method != Gateway {
+		// Ingress and Gateway do not require a port, since the port is whatever the ingress/gateway is listening on (80 and 443)
 		url += sc.CommonPortSuffix(true)
 	}
 	return url

api/v1beta1/zz_generated.deepcopy.go

@@ -9889,6 +9889,56 @@ spec:
                           For the LoadBalancer method, this field is optional and will only be used when useExternalAddress=true.
                           If used with the LoadBalancer method, you will need DNS routing to the LoadBalancer IP address through the url template given above.
                         type: string
+                      gateway:
+                        description: |-
+                          Gateway defines settings for Kubernetes Gateway API routing.
+
+                          This option is only available when Method=Gateway.
+                          The referenced Gateway must already exist and be managed by your platform team.
+                          The Solr Operator only manages the HTTPRoute resources.
+                        properties:
+                          annotations:
+                            additionalProperties:
+                              type: string
+                            description: Annotations to add to HTTPRoute resources
+                            type: object
+                          labels:
+                            additionalProperties:
+                              type: string
+                            description: Labels to add to HTTPRoute resources
+                            type: object
+                          parentRefs:
+                            description: |-
+                              ParentRefs specifies the Gateway(s) to attach HTTPRoutes to.
+                              This is required when using method=Gateway.
+
+                              The referenced Gateway must already exist and be managed by your platform team.
+                              The Solr Operator only manages the HTTPRoute resources.
+                            items:
+                              description: GatewayParentReference identifies a parent
+                                Gateway resource to attach HTTPRoutes to
+                              properties:
+                                name:
+                                  description: Name of the Gateway resource
+                                  type: string
+                                namespace:
+                                  description: |-
+                                    Namespace of the Gateway resource.
+                                    If not specified, defaults to the HTTPRoute's namespace.
+                                  type: string
+                                sectionName:
+                                  description: |-
+                                    SectionName refers to a specific listener on the Gateway.
+                                    For example, "https" or "http".
+                                  type: string
+                              required:
+                              - name
+                              type: object
+                            minItems: 1
+                            type: array
+                        required:
+                        - parentRefs
+                        type: object
                       hideCommon:
                         description: |-
                           Do not expose the common Solr service externally. This affects a single service.
@@ -9928,6 +9978,7 @@ spec:
                         enum:
                         - Ingress
                         - ExternalDNS
+                        - Gateway
                         type: string
                       nodePortOverride:
                         description: |-

config/crd/bases/solr.apache.org_solrclouds.yaml

@@ -82,6 +82,24 @@ rules:
   - statefulsets/status
   verbs:
   - get
+- apiGroups:
+  - gateway.networking.k8s.io
+  resources:
+  - httproutes
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - gateway.networking.k8s.io
+  resources:
+  - httproutes/status
+  verbs:
+  - get
 - apiGroups:
   - networking.k8s.io
   resources: