fix(cert-manager): enable the Gateway API solver in the host cert-manager - #4039

Verdict

NOT LGTM

Reviewed at 7951cf4db against merge-base a5d12e78d. The code change is sound, well-scoped and well-tested; the one blocker is the commit trailer, which is failing a required CI gate.

The implementation is correct. The platform threads a ControllerConfiguration{enableGatewayAPI: true} into the host cert-manager Package's component values rather than making it a chart default, and that split is both correct and complete: the vendored chart renders the config only when .Values.config is set, so tenant installs of the same chart (where the Gateway API CRDs are opt-in) keep the solver off, and the third unit test pins that default. The change is genuinely needed, not cosmetic: packages/system/cert-manager-issuers/templates/cluster-issuers.yaml:44 renders an http01.gatewayHTTPRoute solver whenever the host runs with gateway-enabled=true, and cert-manager refuses that solver unless the flag is on, so today every ACME challenge on such a host fails with "gateway api is not enabled".

A few things I checked specifically:

• HTTP-01 / DNS-01 are not affected. enableGatewayAPI only adds the Gateway API solver path; it does not remove or alter the ingress or DNS-01 solvers, and the ingress/DNS RBAC rules are untouched.
• No RBAC expansion. The gateway RBAC the solver needs (gateway.networking.k8s.io httproutes on the challenges role, gateways/httproutes/listenersets on the ingress-shim role) is already granted unconditionally in the vendored chart (rbac.yaml:262-263, 311-315), so this PR correctly does not touch RBAC. No wildcard, no new verb, no new subject.
• Ordering holds. cozystack.gateway-api-crds is emitted on every host variant with helm.sh/resource-policy: keep and dependsOn: [], and the cert-manager PackageSource already dependsOn it (pre-existing, sources/cert-manager.yaml:16), so the CRDs are present before the controller starts with the flag.

CI on the reviewed head:

• "Commit trailers" is red because the commit carries Assisted-By: Claude <[email protected]>. The repo's checker requires the attribution value to be exactly LLM (Assisted-by: LLM). This is the single blocking item; amend the trailer and the gate goes green. See the finding.
• "E2E (in-tree)" is red on an unrelated suite, chainsaw/clickhouse-1-backup-contracts (the ClickHouse backup sidecar could not reach the server on localhost:9000, and the clickhouse-operator logged Update Service ... just recreate the service in case of service type change ''=>'ClusterIP'). This is not caused by this change: in the same run cert-manager installed cleanly with the new config (Helm install succeeded for release cozy-cert-manager/cert-manager.v1, components carrying enableGatewayAPI). I am not blocking on it, but it needs a re-run to go green before merge.

One thing I could not verify hermetically (Caveat, not a blocker): the existing-install upgrade. On an already-running host cert-manager, this change makes the controller Deployment gain the --config arg plus a config volume/volumeMount, which triggers a rolling restart, and creates a brand-new cert-manager ConfigMap. Reasoned through, that is a normal podTemplate roll with no SSA-ownership or immutable-field hazard, and the Gateway API CRDs are already present on an existing cluster, so the restarted controller does not crashloop. But the live upgrade restart was not exercised (the E2E run is a fresh install). Recommend a cozystack-pr-test upgrade run against a disposable dev cluster before merge to close it.

Findings not anchored to changed lines

These reference code outside this PR's diff (unchanged files, or lines outside a hunk), so GitHub cannot render them inline.

[MAJOR] commit 7951cf4db (message trailer):? Commit AI-attribution trailer uses a disallowed form, failing the required Commit trailers CI gate

The commit trailer is Assisted-By: Claude <[email protected]>. cozystack's trailer checker requires the attribution value to be exactly LLM, i.e. Assisted-by: LLM. The "Commit trailers" check is red on the reviewed head because of this, so the PR cannot merge until the trailer is amended (and the commit re-signed with the existing Signed-off-by: Aleksei Sviridkin <[email protected]>). This is a one-line commit amend; no code change is implied.

$ git log -1 --format='%B' 7951cf4db | tail -3
Signed-off-by: Aleksei Sviridkin <[email protected]>
Assisted-By: Claude <[email protected]>

$ gh api repos/cozystack/cozystack/actions/jobs/111977505811/logs | grep -A1 -i 'attribution trailer'
  Assisted-By: Claude <[email protected]>
      attribution trailer value must be exactly LLM
    Assisted-by: LLM
##[error]Process completed with exit code 1.

LGTM. enableGatewayAPI matches cert-manager v1.20.2, and the Gateway API CRDs are ordered ahead of cert-manager via dependsOn: cozystack.gateway-api-crds. helm unittest green.

The red E2E is unrelated: it timed out at computeplane-lifecycle on a cilium dependency with no cert-manager error in the log; needs a re-run.