feat: Kubernetes Gateway API backend (experimental)

[danieloliveira079]

Summary

• Adds octops.io/router-backend: gateway as an opt-in alternative to the default Ingress backend
• When set, the controller creates one HTTPRoute per GameServer (instead of Ingress), attaching it to a pre-provisioned shared Gateway
• TLS is terminated at the Gateway listener using a single wildcard/hostname certificate — no per-server cert-manager requests, no Let's Encrypt rate limits
• Both domain and path routing modes are supported, matching the existing Ingress behaviour
• Ingress backend is unchanged; the two backends can run in the same cluster with separate Contour installations

Changes

• pkg/: GatewayReconciler, gatewayStore, functional options, GetRouterBackend() helper, RecordWarning event method
• deploy/install.yaml: added httproutes RBAC to the controller ClusterRole
• deploy/gateway/gatewayclass.yaml: GatewayClass for Contour Gateway Provisioner
• examples/gateway/: gateway.yaml, certificate.yaml, fleet-domain.yaml, fleet-path.yaml
• hack/: setup-infra.sh and teardown-infra.sh updated to install Gateway API CRDs, Contour Gateway Provisioner, and apply the required CRD patches for Contour v1.32.1 compatibility
• README.md: new Gateway API section with prerequisites, setup, annotation reference, and experimental notice
• AGENTS.md: local dev workflow, gateway sharp edges, updated deploy layout

Validation

Tested end-to-end on a local Docker Desktop cluster:

# Domain mode — each game server on its own subdomain
curl -H "Host: octops-gateway-domain-mhzh7-948k5.game.example.com" http://localhost:8080/
{"Name":"octops-gateway-domain-mhzh7-948k5","Address":"172.18.0.2:7265",...}

# Path mode — shared hostname, per-server path
curl -H "Host: game.example.com" http://localhost:8080/octops-gateway-path-8vvj4-jl6bs
{"Name":"octops-gateway-path-8vvj4-jl6bs","Address":"172.18.0.2:7643",...}

Gateway status: PROGRAMMED: True. All HTTPRoutes: Accepted=True, ResolvedRefs=True. Envoy routes each request to the correct game server.

Experimental — validated but not production-tested. Please report bugs at https://github.com/Octops/gameserver-ingress-controller/issues.

Test plan

• hack/setup-infra.sh runs clean on a fresh cluster
• Deploy examples/gateway/fleet-domain.yaml — verify one HTTPRoute per GameServer, Accepted=True
• Deploy examples/gateway/fleet-path.yaml — verify path-based HTTPRoute per GameServer
• curl with correct Host header reaches the right game server in both modes
• Deleting a GameServer cascades to HTTPRoute and Service cleanup via owner references
• Ingress backend fleets are unaffected when deployed alongside gateway fleets

🤖 Generated with Claude Code