From bebe2a6009e96f4cb8c64306bfd5a16f8cf43813 Mon Sep 17 00:00:00 2001 From: Markus Pesch Date: Wed, 2 Sep 2026 22:16:50 +0200 Subject: [PATCH] [Close #1106] feat(gatewayAPI)!: migrate TCPRoute to gateway.networking.k8s.io/v1 TCPRoute graduated to GA with Gateway API v1.4, so the chart no longer needs to render the experimental v1alpha2 version. Staying on an alpha API means depending on the Experimental CRD channel, which many clusters do not install and which upstream may remove in a future release. Moving to the stable version lets the chart work with the Standard CRD channel and aligns TCPRoute with HTTPRoute and BackendTLSPolicy, which the chart already renders as v1. The resource schema is unchanged between v1alpha2 and v1, so no field or value in gatewayAPI.core.tcpRoute needs to be adjusted by users. BREAKING CHANGE: TCPRoute is now rendered as gateway.networking.k8s.io/v1. Clusters must have Gateway API CRDs v1.4 or newer installed when gatewayAPI.core.tcpRoute.enabled is true --- docs/gateway-api.md | 4 ++-- templates/gitea/tcpRoute.yaml | 2 +- unittests/helm/gatewayAPI/tcpRoute.yaml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/gateway-api.md b/docs/gateway-api.md index 0f3f806..2f1d1ce 100644 --- a/docs/gateway-api.md +++ b/docs/gateway-api.md @@ -18,7 +18,7 @@ The chart does **not** render a `Gateway` resource — provisioning and managing | Resource | API version | Status (as of writing) | | ---------------------- | ------------------------------------ | ---------------------- | | `HTTPRoute` | `gateway.networking.k8s.io/v1` | GA | -| `TCPRoute` | `gateway.networking.k8s.io/v1alpha2` | Experimental | +| `TCPRoute` | `gateway.networking.k8s.io/v1` | GA (v1.4+) | | `BackendTLSPolicy` | `gateway.networking.k8s.io/v1` | GA (v1.2+) | | `ClientSettingsPolicy` | `gateway.nginx.org/v1alpha1` | NGINX Gateway Fabric | @@ -262,6 +262,6 @@ Likewise, `ROOT_URL` becomes `https://` if any of these terminate TLS: `route.tl ## SSH considerations -- `TCPRoute` is still experimental. Many production-grade implementations support it (Envoy Gateway, Istio, Kgateway, NGINX Gateway Fabric), but you should verify before relying on it. +- `TCPRoute` is GA since Gateway API v1.4. Older CRD bundles only ship the `v1alpha2` version, so make sure the installed CRDs are at least v1.4. - If your Gateway implementation does not support `TCPRoute`, keep using `service.ssh.type: LoadBalancer` (or `NodePort`) and only enable `httpRoute` for HTTP traffic. - The default TCPRoute rule points at the Gitea SSH `Service` on `service.ssh.port` (typically 22), which itself proxies to `gitea.config.server.SSH_LISTEN_PORT` inside the pod. diff --git a/templates/gitea/tcpRoute.yaml b/templates/gitea/tcpRoute.yaml index 26c2cac..dcd1360 100644 --- a/templates/gitea/tcpRoute.yaml +++ b/templates/gitea/tcpRoute.yaml @@ -1,6 +1,6 @@ {{- if eq (include "gitea.tcpRoute.enabled" .) "true" -}} --- -apiVersion: gateway.networking.k8s.io/v1alpha2 +apiVersion: gateway.networking.k8s.io/v1 kind: TCPRoute metadata: {{- with (include "gitea.tcpRoute.annotations" .) }} diff --git a/unittests/helm/gatewayAPI/tcpRoute.yaml b/unittests/helm/gatewayAPI/tcpRoute.yaml index 5a2082a..af5d2d3 100644 --- a/unittests/helm/gatewayAPI/tcpRoute.yaml +++ b/unittests/helm/gatewayAPI/tcpRoute.yaml @@ -44,7 +44,7 @@ tests: of: TCPRoute - equal: path: apiVersion - value: gateway.networking.k8s.io/v1alpha2 + value: gateway.networking.k8s.io/v1 - equal: path: metadata.name value: gitea-unittests