feat: Support Cilium Gateway API

README.md

@@ -76,6 +76,17 @@ This repository contains a Terraform module for creating a Kubernetes cluster wi
 > [!IMPORTANT]  
 > The Cilium version (`cilium_version`) has to be compatible with the Kubernetes (`kubernetes_version`) version.
 
+
+#### Cilium Gateway API
+To use Cilium as [Gateway API](https://gateway-api.sigs.k8s.io/) implementation, set `cilium_enable_gateway_api`
+variable. This will install the required dependencies. When you configure a gateway later on, the Cilium operator
+will provision an hcloud Load Balancer using Hcloud Controller Manager.
+> [!IMPORTANT] 
+> This step will fail if the load balancer
+> is not configured with the right [annotations](https://github.com/hetznercloud/hcloud-cloud-controller-manager/blob/main/docs/guides/load-balancer/quickstart.md) 
+> and the gateway will not provision endpoints.
+
+
 ### [Hcloud Cloud Controller Manager](https://github.com/hetznercloud/hcloud-cloud-controller-manager)
 
 - Updates the `Node` objects with information about the server from the Cloud , like instance Type, Location,

manifest_cilium.tf

@@ -84,6 +84,13 @@ data "helm_template" "cilium_default" {
     {
       name  = "operator.prometheus.serviceMonitor.enabled"
       value = var.cilium_enable_service_monitors ? "true" : "false"
+    },
+    { name  = "l7proxy.enabled"
+      value = "true"
+    },
+    {
+      name  = "gatewayAPI.enabled"
+      value = var.cilium_enable_gateway_api ? "true" : "false"
     }
   ]
 }
@@ -107,11 +114,26 @@ data "kubectl_file_documents" "cilium" {
   )
 }
 
+data "http" "gateway_api_crds" {
+  url = "https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/experimental-install.yaml"
+}
+
+data "kubectl_file_documents" "gateway_api_crds_yamls" {
+  content = data.http.gateway_api_crds.response_body
+}
+
+resource "kubectl_manifest" "gateway_api_crds" {
+  for_each   = var.cilium_enable_gateway_api ? data.kubectl_file_documents.gateway_api_crds_yamls.manifests : {}
+  yaml_body  = each.value
+  apply_only = true
+  depends_on = [data.http.talos_health]
+}
+
 resource "kubectl_manifest" "apply_cilium" {
   for_each   = var.control_plane_count > 0 ? data.kubectl_file_documents.cilium.manifests : {}
   yaml_body  = each.value
   apply_only = true
-  depends_on = [data.http.talos_health]
+  depends_on = [data.http.talos_health, resource.kubectl_manifest.gateway_api_crds]
 }
 
 

variables.tf

@@ -405,6 +405,18 @@ variable "cilium_version" {
   EOF
 }
 
+variable "cilium_enable_gateway_api" {
+  type        = bool
+  default     = false
+  description = <<EOF
+    If true, the Gateway API will be enabled by:
+    - Installing preqreuisite CRDs https://docs.cilium.io/en/stable/network/servicemesh/gateway-api/gateway-api/
+    - Installing tlsroute CRD
+    - Enabling Gateway API
+    This variable is incompatible with `cilium_values`. If the latter is set, this variable isn't used
+  EOF
+}
+
 variable "cilium_values" {
   type        = list(string)
   default     = null