BUG/MINOR: gracefully handle missing RBAC for Gateway API CRDs

Update IsGatewayAPIInstalled to use standard k8s error helpers (IsForbidden and IsNotFound) when checking for the Gateway API CRD availability.

Previously, if the ingress controller lacked RBAC permissions to read CustomResourceDefinitions (resulting in a 403 Forbidden error), it logged a generic error. This change explicitly intercepts the 403 error to log a clear, descriptive warning about the missing RBAC permissions. It also ensures that any error when fetching the CRD correctly flags the Gateway API as disabled by returning false, improving both readability and log clarity in environments with restricted permissions.

Author: oktalz

pkg/controller/global_test.go

@@ -53,6 +53,26 @@ func TestGlobalCfgConvergesWithoutLogConfig(t *testing.T) {
 		"steady-state globalCfg must not request a reload when nothing changed")
 }
 
+// TestDefaultsCfgConvergesWithoutConfig guards the defaults path against the same
+// class of endless-reload bug: a steady-state sync must not request a reload.
+func TestDefaultsCfgConvergesWithoutConfig(t *testing.T) {
+	c := buildGlobalTestController(t)
+
+	require.NoError(t, c.haproxy.APIStartTransaction())
+	c.defaultsCfg()
+	require.NoError(t, c.haproxy.APICommitTransaction())
+	c.haproxy.APIDisposeTransaction()
+	instance.Reset()
+
+	require.NoError(t, c.haproxy.APIStartTransaction())
+	c.defaultsCfg()
+	require.NoError(t, c.haproxy.APICommitTransaction())
+	c.haproxy.APIDisposeTransaction()
+
+	require.False(t, instance.NeedReload(),
+		"steady-state defaultsCfg must not request a reload when nothing changed")
+}
+
 func buildGlobalTestController(t *testing.T) *HAProxyController {
 	t.Helper()
 	tempDir := t.TempDir()

pkg/k8s/main.go

@@ -422,11 +422,13 @@ func (k k8s) IsGatewayAPIInstalled(gatewayControllerName string) (installed bool
 	installed = true
 	gatewayCrd, err := k.crdClient.ApiextensionsV1().CustomResourceDefinitions().Get(context.Background(), "gateways.gateway.networking.k8s.io", metav1.GetOptions{})
 	if err != nil {
-		var errStatus *errGw.StatusError
-		if !errors.As(err, &errStatus) || errStatus.ErrStatus.Code != 404 {
+		// Missing CRD (404) or no RBAC to read CRDs (403) both mean Gateway API is unavailable.
+		if errGw.IsForbidden(err) {
+			logger.Warningf("Gateway API support disabled, missing RBAC to read CustomResourceDefinitions: %s", err)
+		} else if !errGw.IsNotFound(err) {
 			logger.Error(err)
-			return false
 		}
+		return false
 	}
 
 	if gatewayCrd.Name == "" {