Default Gateway hostname changes to avoid issues outlined in GEP-3567.

PROJECT

@@ -78,6 +78,7 @@ resources:
   version: v1
   webhooks:
     validation: true
+    defaulting: true
     webhookVersion: v1
 - domain: k8s.io
   external: true

cmd/main.go

@@ -35,7 +35,6 @@ import (
 	networkingv1alpha "go.datum.net/network-services-operator/api/v1alpha"
 	"go.datum.net/network-services-operator/internal/config"
 	"go.datum.net/network-services-operator/internal/controller"
-	"go.datum.net/network-services-operator/internal/validation"
 	networkingwebhook "go.datum.net/network-services-operator/internal/webhook"
 	networkinggatewayv1webhooks "go.datum.net/network-services-operator/internal/webhook/v1"
 	networkingv1alphawebhooks "go.datum.net/network-services-operator/internal/webhook/v1alpha"
@@ -239,14 +238,7 @@ func main() {
 		os.Exit(1)
 	}
 
-	validationOpts := validation.GatewayValidationOptions{
-		ControllerName:      serverConfig.Gateway.ControllerName,
-		PermittedTLSOptions: serverConfig.Gateway.PermittedTLSOptions,
-		ValidPortNumbers:    serverConfig.Gateway.ValidPortNumbers,
-		ValidProtocolTypes:  serverConfig.Gateway.ValidProtocolTypes,
-	}
-
-	if err := networkinggatewayv1webhooks.SetupGatewayWebhookWithManager(mgr, validationOpts); err != nil {
+	if err := networkinggatewayv1webhooks.SetupGatewayWebhookWithManager(mgr, serverConfig); err != nil {
 		setupLog.Error(err, "unable to create webhook", "webhook", "Gateway")
 		os.Exit(1)
 	}

config/dev/config.yaml

@@ -15,11 +15,10 @@ gateway:
   downstreamGatewayClassName: datum-downstream-gateway-e2e
   permittedTLSOptions:
     gateway.networking.datumapis.com/certificate-issuer: []
-
-httpProxy:
-  tlsOptions:
+  listenerTLSOptions:
     gateway.networking.datumapis.com/certificate-issuer: gateway-clusterissuer-selfsigned-ca
 
+
 downstreamResourceManagement:
   # TODO(jreese) remove this when we make the downstream resource strategy
   # configurable

config/dev/kustomization.yaml

@@ -2,8 +2,7 @@ namespace: kube-system
 namePrefix: network-services-operator-
 
 resources:
-  - ../crd
-  - ../crd/gateway
+  - ../upstream_resources
   - ../webhook
   - ../certmanager
 

config/dev/webhook_patch.yaml

@@ -27,18 +27,6 @@ patch: |-
   - op: remove
     path: /webhooks/0/clientConfig/service
 
-  - op: move
-    from: /webhooks/1/clientConfig/service/path
-    path: /webhooks/1/clientConfig/url
-  - op: remove
-    path: /webhooks/1/clientConfig/service
-
-  - op: move
-    from: /webhooks/2/clientConfig/service/path
-    path: /webhooks/2/clientConfig/url
-  - op: remove
-    path: /webhooks/2/clientConfig/service
-
 target:
   kind: MutatingWebhookConfiguration
 ---

config/webhook/manifests.yaml

@@ -1,5 +1,31 @@
 ---
 apiVersion: admissionregistration.k8s.io/v1
+kind: MutatingWebhookConfiguration
+metadata:
+  name: mutating-webhook-configuration
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: webhook-service
+      namespace: system
+      path: /mutate-gateway-networking-k8s-io-v1-gateway
+  failurePolicy: Fail
+  name: mgateway-v1.kb.io
+  rules:
+  - apiGroups:
+    - gateway.networking.k8s.io
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - gateways
+  sideEffects: None
+---
+apiVersion: admissionregistration.k8s.io/v1
 kind: ValidatingWebhookConfiguration
 metadata:
   name: validating-webhook-configuration

go.mod

@@ -5,10 +5,10 @@ go 1.24.0
 toolchain go1.24.2
 
 require (
-	github.com/go-logr/logr v1.4.3
 	github.com/google/go-cmp v0.7.0
 	github.com/google/uuid v1.6.0
 	github.com/onsi/ginkgo/v2 v2.23.4
+	github.com/onsi/gomega v1.37.0
 	github.com/stretchr/testify v1.10.0
 	go.miloapis.com/milo v0.1.0
 	golang.org/x/sync v0.15.0
@@ -36,6 +36,7 @@ require (
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.8.0 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-logr/zapr v1.3.0 // indirect
 	github.com/go-openapi/jsonpointer v0.21.1 // indirect
@@ -55,7 +56,6 @@ require (
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/onsi/gomega v1.37.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/client_golang v1.22.0 // indirect

internal/config/config.go

@@ -339,6 +339,11 @@ type GatewayConfig struct {
 	// needed for, or implement our own ACME integration.
 	PerGatewayCertificateIssuer bool `json:"perGatewayCertificateIssuer,omitempty"`
 
+	// ListenerTLSOptions specifies the TLS options to program on generated
+	// TLS listeners.
+	// +default={"gateway.networking.datumapis.com/certificate-issuer": "auto"}
+	ListenerTLSOptions map[gatewayv1.AnnotationKey]gatewayv1.AnnotationValue `json:"listenerTLSOptions"`
+
 	// ValidPortNumbers is a list of port numbers that are permitted on gateway
 	// listeners.
 	//
@@ -352,18 +357,17 @@ type GatewayConfig struct {
 	ValidProtocolTypes map[int][]gatewayv1.ProtocolType `json:"validProtocolTypes,omitempty"`
 }
 
+func (c *GatewayConfig) GatewayDNSAddress(gateway *gatewayv1.Gateway) string {
+	return fmt.Sprintf("%s.%s", gateway.UID, c.TargetDomain)
+}
+
 // +k8s:deepcopy-gen=true
 
 type HTTPProxyConfig struct {
 	// GatewayClassName specifies which GatewayClass to use when programming the
 	// underlying Gateway for an HTTPProxy.
 	// +default="datum-external-global-proxy"
 	GatewayClassName gatewayv1.ObjectName `json:"gatewayClassName"`
-
-	// GatewayTLSOptions specifies the TLS options to program on the underlying
-	// Gateway for an HTTPProxy.
-	// +default={"gateway.networking.datumapis.com/certificate-issuer": "auto"}
-	GatewayTLSOptions map[gatewayv1.AnnotationKey]gatewayv1.AnnotationValue `json:"tlsOptions"`
 }
 
 // +k8s:deepcopy-gen=true