[Close #1106] feat(gatewayAPI)!: migrate TCPRoute to gateway.networking.k8s.io/v1

TCPRoute graduated to GA with Gateway API v1.4, so the chart no longer needs to render the experimental
v1alpha2 version. Staying on an alpha API means depending on the Experimental CRD channel, which many
clusters do not install and which upstream may remove in a future release. Moving to the stable version
lets the chart work with the Standard CRD channel and aligns TCPRoute with HTTPRoute and BackendTLSPolicy,
which the chart already renders as v1.

The resource schema is unchanged between v1alpha2 and v1, so no field or value in
gatewayAPI.core.tcpRoute needs to be adjusted by users.

BREAKING CHANGE: TCPRoute is now rendered as gateway.networking.k8s.io/v1. Clusters must have Gateway API
CRDs v1.4 or newer installed when gatewayAPI.core.tcpRoute.enabled is true

docs/gateway-api.md

@@ -18,7 +18,7 @@ The chart does **not** render a `Gateway` resource — provisioning and managing
 | Resource               | API version                          | Status (as of writing) |
 | ---------------------- | ------------------------------------ | ---------------------- |
 | `HTTPRoute`            | `gateway.networking.k8s.io/v1`       | GA                     |
-| `TCPRoute`             | `gateway.networking.k8s.io/v1alpha2` | Experimental           |
+| `TCPRoute`             | `gateway.networking.k8s.io/v1`       | GA (v1.4+)             |
 | `BackendTLSPolicy`     | `gateway.networking.k8s.io/v1`       | GA (v1.2+)             |
 | `ClientSettingsPolicy` | `gateway.nginx.org/v1alpha1`         | NGINX Gateway Fabric   |
 
@@ -262,6 +262,6 @@ Likewise, `ROOT_URL` becomes `https://` if any of these terminate TLS: `route.tl
 
 ## SSH considerations
 
-- `TCPRoute` is still experimental. Many production-grade implementations support it (Envoy Gateway, Istio, Kgateway, NGINX Gateway Fabric), but you should verify before relying on it.
+- `TCPRoute` is GA since Gateway API v1.4. Older CRD bundles only ship the `v1alpha2` version, so make sure the installed CRDs are at least v1.4.
 - If your Gateway implementation does not support `TCPRoute`, keep using `service.ssh.type: LoadBalancer` (or `NodePort`) and only enable `httpRoute` for HTTP traffic.
 - The default TCPRoute rule points at the Gitea SSH `Service` on `service.ssh.port` (typically 22), which itself proxies to `gitea.config.server.SSH_LISTEN_PORT` inside the pod.

templates/gitea/tcpRoute.yaml

@@ -1,6 +1,6 @@
 {{- if eq (include "gitea.tcpRoute.enabled" .) "true" -}}
 ---
-apiVersion: gateway.networking.k8s.io/v1alpha2
+apiVersion: gateway.networking.k8s.io/v1
 kind: TCPRoute
 metadata:
   {{- with (include "gitea.tcpRoute.annotations" .) }}

unittests/helm/gatewayAPI/tcpRoute.yaml

@@ -44,7 +44,7 @@ tests:
           of: TCPRoute
       - equal:
           path: apiVersion
-          value: gateway.networking.k8s.io/v1alpha2
+          value: gateway.networking.k8s.io/v1
       - equal:
           path: metadata.name
           value: gitea-unittests