Gateway API

Overview

This package installs the Gateway API custom resource definitions. It installs no runtime components — no controllers, workloads, or services — and the chart has no configurable values.

The Gateway API is the successor to the Kubernetes Ingress API. It splits what Ingress expressed in a single resource into role-oriented resources.

Installing the CRDs does not by itself route any traffic. An implementation must be present to act on the resources. In Big Bang that implementation is Istio.

What gets installed

The chart renders the upstream standard channel bundle, which contains ten CRDs:

Resource	Purpose
GatewayClass	Cluster-scoped template identifying the controller that implements a Gateway
Gateway	A traffic entry point — listeners, ports, protocols, TLS
HTTPRoute	HTTP routing rules attached to a Gateway
GRPCRoute	gRPC routing rules
TCPRoute	TCP routing rules
TLSRoute	Routes TLS streams matched on SNI hostname; Passthrough listeners are core support
UDPRoute	UDP routing rules
ListenerSet	Additional listeners attached to an existing Gateway, which must opt in via allowedListeners
ReferenceGrant	Explicit permission for a cross-namespace reference
BackendTLSPolicy	TLS settings for connections from a gateway to a backend

It also installs a ValidatingAdmissionPolicy and its binding, both named safe-upgrades.gateway.networking.k8s.io. These come from upstream and reject two things: installing experimental channel CRDs on top of standard channel CRDs, and installing CRDs annotated v1.5.x or older. In both cases the policy’s own message directs you to uninstall the policy if you need to proceed.

Note that the reverse migration is allowed: replacing experimental channel CRDs with standard channel ones passes the policy.

Channels

Upstream publishes two release channels. This package ships the standard channel only — the experimental channel bundle is deliberately not vendored. See DEVELOPMENT_MAINTENANCE.md for how the chart is maintained and upgraded.