Gateway API migration — remaining Ingress surfaces (upstream + cozystack-local) #2490

Tracking issue for migrating cozystack ingress surfaces to Gateway API.

PR #2470 introduced per-tenant Gateway API and migrated the core exposed services (dashboard, keycloak, cozystack-api, vm-exportproxy, cdi-uploadproxy) plus harbor/bucket via cozystack-local wrappers. This issue tracks the remaining Ingress resources across the platform, grouped by ownership so follow-up PRs land in the right place.

In cozystack (our own templates — follow-up PRs to this repo)

• packages/apps/kubernetes/templates/ingress.yaml — tenant-managed Kubernetes app dashboard. Add per-tenant HTTPRoute next to the existing Ingress, gated on _namespace.gateway.
• packages/extra/bootbox/templates/matchbox/ingress.yaml — matchbox provisioning UI. Single HTTPRoute alongside Ingress.
• packages/extra/seaweedfs/templates/ingress.yaml — per-tenant seaweedfs UI wrapper. Mirror the bucket pattern.
• packages/system/linstor-gui/templates/ingress.yaml — linstor UI. Single HTTPRoute on publishing tenant.
• packages/system/monitoring/templates/alerta/alerta.yaml — alerta UI. Single HTTPRoute on publishing tenant.

Each follows the pattern established in PR #2470 on dashboard/keycloak: gate the existing Ingress with {{- if ne (index .Values._cluster "gateway-enabled") "true" }} (or {{- if not .Values._namespace.gateway }} for per-tenant apps), add a templates/httproute.yaml rendered when Gateway API is on, pin the listener with sectionName: https.

Vendored upstream charts that already ship Gateway API support — toggle it on

• goharbor/harbor-helm — upstream chart already has templates/gateway-apis/route.yaml. Configure the vendored chart in cozystack to render that path instead of templates/ingress/ingress.yaml when gateway.enabled=true. Fold into / supersede the cozystack-local wrapper in packages/apps/harbor/templates/httproute.yaml once switched.
• openbao/openbao-helm — upstream values already expose a Gateway API toggle (templates/_helpers.tpl has routing helpers). Enable it in cozystack's values override.

Vendored upstream charts without Gateway API support — file upstream PRs or issues

• cilium/cilium — install/kubernetes/cilium/templates/hubble-ui/ingress.yaml. Needs hubble.ui.gateway (or hubble.ui.expose: gateway) with HTTPRoute rendering.
• bloomberg/goldpinger — the Helm chart's ingress template renders a classic Ingress only. Add a Gateway API path.
• fluent/helm-charts (fluent-bit) — charts/fluent-bit/templates/ingress.yaml is Ingress-only. Needs a parallel HTTPRoute.
• nats-io/k8s — helm/charts/nats/files/ingress.yaml is Ingress-only. Add Gateway API option.
• opencost/opencost-helm-chart — templates/ingress.yaml is Ingress-only.
• qdrant/qdrant-helm — charts/qdrant/templates/ingress.yaml is Ingress-only.
• seaweedfs/seaweedfs (Helm chart) — four Ingress templates (admin, filer, master, s3). Each needs a Gateway API sibling.

Out of scope here

• packages/system/cert-manager-crds/templates/crd-*.yaml — CRD definitions, not instance Ingress resources.
• packages/system/gateway-api-crds/templates/crds-experimental.yaml — CRDs, not runtime objects.
• packages/system/cozystack-api/templates/api-ingress.yaml, packages/system/dashboard/templates/ingress.yaml, packages/system/keycloak/templates/ingress.yaml, packages/system/kubevirt/templates/vm-exportproxy-ingress.yaml, packages/system/kubevirt-cdi/templates/cdi-uploadproxy-ingress.yaml, packages/system/bucket/templates/ingress.yaml, packages/apps/harbor/templates/ingress.yaml — already migrated in PR feat(networking): Gateway API support via Cilium (supersedes #2213) #2470.

References

• PR feat(networking): Gateway API support via Cilium (supersedes #2213) #2470 — per-tenant Gateway API / wrapper pattern.
• packages/extra/gateway/README.md — security model and operator notes.
• docs/agents/contributing.md — commit/PR conventions (use empty-commit retries per PR docs(agents): retry CI via empty commit, not gh run rerun #2489).