feat(infrastructure): migrate application exposure from Ingress to Gateway API

The `application` template's exposure layer now emits
gateway.networking.k8s.io/v1 HTTPRoutes instead of networking.k8s.io/v1
Ingress objects.

- Template: two HTTPRoutes (one always, one /api-only in mode=none) attach
  to a platform Gateway via parentRefs; status reads from httpRoute.hostnames.
- Token seam: ${kedge.ingressClass} -> ${kedge.gatewayName} +
  ${kedge.gatewayNamespace}; env KEDGE_INGRESS_CLASS -> KEDGE_GATEWAY_NAME /
  KEDGE_GATEWAY_NAMESPACE. Defaults point at the cfgate Cloudflare Tunnel
  Gateway (cloudflare-tunnel / cfgate-system).
- ApplicationSpec.IngressClass -> ApplicationSpec.Gateway (GatewayRef);
  regenerated deepcopy + CRDs; chart values/deployment/operator-config;
  Makefile dev target; tests; provider doc + README.

sandbox-runner is unchanged (no Ingress; preview goes via the k8s service
proxy). Foundation for issue #351 (Core Kedge Gateway Endpoint broker).

Bundles unrelated in-flight working-tree changes: kedge-hub HTTPRoute
chart template + values, hub bootstrap tweak, provider portal bundles,
and local .claude settings.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: mjudeikis

.claude/settings.json

@@ -0,0 +1,7 @@
+{
+  "permissions": {
+    "additionalDirectories": [
+      "/Users/mjudeikis/go/src/github.com/kcp-dev/kcp/pkg/reconciler/apis/apibinding"
+    ]
+  }
+}

Makefile

@@ -899,7 +899,8 @@ run-provider-infrastructure: build-infrastructure-provider ## Run the infrastruc
 	KRO_KUBECONFIG=$${KRO_KUBECONFIG:-$$( [ -f "$(KRO_KIND_KUBECONFIG)" ] && echo "$(KRO_KIND_KUBECONFIG)" )} \
 	INFRASTRUCTURE_KUBECONFIG=$${INFRASTRUCTURE_KUBECONFIG:-$$( [ -f "$(INFRASTRUCTURE_RUNTIME_KUBECONFIG)" ] && echo "$(INFRASTRUCTURE_RUNTIME_KUBECONFIG)" )} \
 	KEDGE_APP_BASE_DOMAIN=$${KEDGE_APP_BASE_DOMAIN:-apps.127.0.0.1.sslip.io} \
-	KEDGE_INGRESS_CLASS=$${KEDGE_INGRESS_CLASS:-nginx} \
+	KEDGE_GATEWAY_NAME=$${KEDGE_GATEWAY_NAME:-cloudflare-tunnel} \
+	KEDGE_GATEWAY_NAMESPACE=$${KEDGE_GATEWAY_NAMESPACE:-cfgate-system} \
 		$(BINDIR)/infrastructure-provider
 
 run-provider-infrastructure-operator: build-infrastructure-provider ## Run the infrastructure provider in OPERATOR mode (bootstrap reconcile + serve from a provider + runtime kubeconfig)

deploy/charts/kedge-hub/templates/httproute.yaml

@@ -0,0 +1,23 @@
+{{- if .Values.httpRoute.enabled }}
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: {{ include "kedge-hub.fullname" . }}
+  labels:
+    {{- include "kedge-hub.labels" . | nindent 4 }}
+  {{- with .Values.httpRoute.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  parentRefs:
+    {{- toYaml .Values.httpRoute.parentRefs | nindent 4 }}
+  {{- with .Values.httpRoute.hostnames }}
+  hostnames:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  rules:
+    - backendRefs:
+        - name: {{ include "kedge-hub.fullname" . }}
+          port: {{ .Values.service.hub.port }}
+{{- end }}

deploy/charts/kedge-hub/values.yaml

@@ -132,6 +132,21 @@ ingress:
   #      - path: /
   #        pathType: ImplementationSpecific
 
+# -- HTTPRoute (Gateway API; e.g. for the cfgate Cloudflare Tunnel controller).
+# The hub serves HTTPS with a self-signed cert on service.hub.port, so when
+# attaching to cfgate set the origin annotations below so cloudflared opens a
+# TLS connection to the origin without verifying the cert.
+httpRoute:
+  enabled: false
+  parentRefs:
+    - name: cloudflare-tunnel
+      namespace: cfgate-system
+  annotations: {}
+  #  cfgate.io/origin-protocol: "https"
+  #  cfgate.io/origin-ssl-verify: "false"
+  hostnames: []
+  #  - kedge.example.com
+
 nodeSelector: {}
 tolerations: []
 affinity: {}

docs/application-template-architecture.md

@@ -1,6 +1,14 @@
 # Application template: 3-tier app with an OIDC-guarded URL
 
-Status: **Design proposal, not implemented.**
+Status: **Design proposal.** The exposure layer has since been implemented on
+**Gateway API** rather than the plain `Ingress` this proposal describes: the
+`application` template emits `gateway.networking.k8s.io/v1 HTTPRoute`s that
+attach to a platform Gateway (default the cfgate `cloudflare-tunnel` Gateway in
+`cfgate-system`), configured via `${kedge.gatewayName}` / `${kedge.gatewayNamespace}`
+(`KEDGE_GATEWAY_NAME` / `KEDGE_GATEWAY_NAMESPACE`). Where this document says
+`Ingress` / `ingressClassName` / `${kedge.ingressClass}` below, read HTTPRoute /
+`parentRefs` / `${kedge.gatewayName}`. The current operational reference is
+[providers/infrastructure/docs/application-template-architecture.md](../providers/infrastructure/docs/application-template-architecture.md).
 Author: 2026-06-12
 Related: `docs/infrastructure-architecture.md` (the platform/backend layer this builds on),
 `providers/infrastructure/install/templates/redis-cache.yaml` (the in-graph secret-generation

pkg/hub/kcp/bootstrap.go

@@ -79,7 +79,20 @@ type Bootstrapper struct {
 
 // NewBootstrapper creates a new bootstrapper.
 func NewBootstrapper(config *rest.Config) *Bootstrapper {
-	return &Bootstrapper{config: config}
+	// The hub admin client fans out across many kcp workspaces (every org, every
+	// child workspace, every provider export) and polls during provider Enable.
+	// client-go's default 5 QPS / 10 burst throttles that fan-out and surfaces as
+	// "client rate limiter Wait ... would exceed context deadline" mid-Enable
+	// (e.g. while waiting for a provider's APIExport in exportClaimIdentities).
+	// Give it generous headroom — matching the kuery controller's 50/100 — and
+	// force RateLimiter to nil so each per-path client (configForPath copies this
+	// config) builds its own limiter rather than sharing a single contended
+	// bucket inherited from e.g. a loopback config.
+	cfg := rest.CopyConfig(config)
+	cfg.QPS = 50
+	cfg.Burst = 100
+	cfg.RateLimiter = nil
+	return &Bootstrapper{config: cfg}
 }
 
 // WithEnabledProviders sets the subset of builtin providers the

providers/infrastructure/README.md

@@ -89,9 +89,11 @@ Values:
   image/appVersion).
 - `operator.application.*` — the `application` template's exposure layer:
   `baseDomain` (the zone apps are served under; **required to enable app
-  exposure**) and `ingressClass` (defaults to `cloudflare`). These render into
-  the CR's `spec.application` and become the serve container's
-  `KEDGE_APP_BASE_DOMAIN` / `KEDGE_INGRESS_CLASS`. See
+  exposure**) and `gateway.name` / `gateway.namespace` (the Gateway API parent
+  the generated HTTPRoutes attach to; default `cloudflare-tunnel` /
+  `cfgate-system`). These render into the CR's `spec.application` and become the
+  serve container's `KEDGE_APP_BASE_DOMAIN` / `KEDGE_GATEWAY_NAME` /
+  `KEDGE_GATEWAY_NAMESPACE`. See
   [docs/application-template-architecture.md](docs/application-template-architecture.md).
 
 ### Verify

providers/infrastructure/apis/v1alpha1/types_infrastructureprovider.go

@@ -85,16 +85,17 @@ type InfrastructureProviderSpec struct {
 	Provider ProviderServeSpec `json:"provider"`
 
 	// Application configures the `application` template's exposure layer — the
-	// public URL apps are served on and which ingress controller fulfils it.
-	// Maps onto the serve container's KEDGE_APP_BASE_DOMAIN / KEDGE_INGRESS_CLASS
-	// env vars. Optional; without it app exposure stays off (see ApplicationSpec).
+	// public URL apps are served on and the Gateway API parent that fulfils it.
+	// Maps onto the serve container's KEDGE_APP_BASE_DOMAIN / KEDGE_GATEWAY_NAME
+	// / KEDGE_GATEWAY_NAMESPACE env vars. Optional; without it app exposure stays
+	// off (see ApplicationSpec).
 	// +optional
 	Application ApplicationSpec `json:"application,omitempty"`
 }
 
-// ApplicationSpec configures the `application` template exposure layer. The two
-// fields map 1:1 to the serve container's KEDGE_APP_BASE_DOMAIN and
-// KEDGE_INGRESS_CLASS environment variables. See
+// ApplicationSpec configures the `application` template exposure layer. The
+// fields map 1:1 to the serve container's KEDGE_APP_BASE_DOMAIN,
+// KEDGE_GATEWAY_NAME and KEDGE_GATEWAY_NAMESPACE environment variables. See
 // docs/application-template-architecture.md.
 type ApplicationSpec struct {
 	// BaseDomain is the DNS zone apps are served under, e.g. "apps.example.com".
@@ -105,12 +106,25 @@ type ApplicationSpec struct {
 	// +optional
 	BaseDomain string `json:"baseDomain,omitempty"`
 
-	// IngressClass is the ingress controller that fulfils the generated Ingress
-	// (its spec.ingressClassName). It is substituted for the
-	// ${kedge.ingressClass} token in a Template's backendConfig before the kro
-	// RGD is authored. Empty → "cloudflare" (the in-binary default).
+	// Gateway identifies the Gateway API parent the generated HTTPRoutes attach
+	// to. Its name/namespace are substituted for the ${kedge.gatewayName} /
+	// ${kedge.gatewayNamespace} tokens in a Template's backendConfig before the
+	// kro RGD is authored. Empty fields fall back to the in-binary default
+	// ("cloudflare-tunnel" in "cfgate-system").
 	// +optional
-	IngressClass string `json:"ingressClass,omitempty"`
+	Gateway GatewayRef `json:"gateway,omitempty"`
+}
+
+// GatewayRef points at the platform Gateway (gateway.networking.k8s.io) the
+// `application` template's HTTPRoutes attach to via parentRefs.
+type GatewayRef struct {
+	// Name of the Gateway. Empty → "cloudflare-tunnel" (the in-binary default).
+	// +optional
+	Name string `json:"name,omitempty"`
+
+	// Namespace of the Gateway. Empty → "cfgate-system" (the in-binary default).
+	// +optional
+	Namespace string `json:"namespace,omitempty"`
 }
 
 // SecretKeyRef points at one key in a Secret in the operator's namespace.

providers/infrastructure/apis/v1alpha1/zz_generated.deepcopy.go

@@ -53,32 +53,44 @@ type Backend struct {
 	// pointed at by KRO_KUBECONFIG.
 	runtime dynamic.Interface
 
-	// ingressClass is the value substituted for the reserved
-	// ${kedge.ingressClass} token in a Template's backendConfig before the
-	// RGD is authored. It's a platform-wide setting (the exposure-layer
-	// controller, e.g. "cloudflare"), so it belongs on the backend, not in
-	// per-tenant data. See substituteTokens in rgd.go.
-	ingressClass string
+	// gatewayName / gatewayNamespace are the values substituted for the
+	// reserved ${kedge.gatewayName} / ${kedge.gatewayNamespace} tokens in a
+	// Template's backendConfig before the RGD is authored. They identify the
+	// platform-wide Gateway API parent the generated HTTPRoutes attach to
+	// (the exposure-layer Gateway, e.g. cfgate's "cloudflare-tunnel"), so they
+	// belong on the backend, not in per-tenant data. See substituteTokens in
+	// rgd.go.
+	gatewayName      string
+	gatewayNamespace string
 }
 
 var _ backend.Backend = (*Backend)(nil)
 
-// DefaultIngressClass is used when KEDGE_INGRESS_CLASS is unset. Cloudflare
-// Tunnel is the exposure layer we ship with (reverse tunnels, edge TLS).
-const DefaultIngressClass = "cloudflare"
+// DefaultGatewayName / DefaultGatewayNamespace are used when
+// KEDGE_GATEWAY_NAME / KEDGE_GATEWAY_NAMESPACE are unset. They point at the
+// cfgate Cloudflare Tunnel Gateway we ship with (the Gateway API exposure
+// layer: reverse tunnels, edge TLS).
+const (
+	DefaultGatewayName      = "cloudflare-tunnel"
+	DefaultGatewayNamespace = "cfgate-system"
+)
 
 // New constructs the kro backend against the runtime cluster's dynamic
 // client. The caller (controller_manager) builds it from KRO_KUBECONFIG.
-// The exposure-layer ingress class is read from KEDGE_INGRESS_CLASS
-// (defaulting to "cloudflare") and substituted into backendConfig at RGD
-// build time, so swapping ingress controllers is a config change, not a
-// template edit.
+// The exposure-layer Gateway parent is read from KEDGE_GATEWAY_NAME /
+// KEDGE_GATEWAY_NAMESPACE (defaulting to "cloudflare-tunnel" in
+// "cfgate-system") and substituted into backendConfig at RGD build time, so
+// pointing apps at a different Gateway is a config change, not a template edit.
 func New(runtime dynamic.Interface) *Backend {
-	ingressClass := os.Getenv("KEDGE_INGRESS_CLASS")
-	if ingressClass == "" {
-		ingressClass = DefaultIngressClass
+	gatewayName := os.Getenv("KEDGE_GATEWAY_NAME")
+	if gatewayName == "" {
+		gatewayName = DefaultGatewayName
+	}
+	gatewayNamespace := os.Getenv("KEDGE_GATEWAY_NAMESPACE")
+	if gatewayNamespace == "" {
+		gatewayNamespace = DefaultGatewayNamespace
 	}
-	return &Backend{runtime: runtime, ingressClass: ingressClass}
+	return &Backend{runtime: runtime, gatewayName: gatewayName, gatewayNamespace: gatewayNamespace}
 }
 
 // Name returns "kro".
@@ -89,7 +101,7 @@ func (b *Backend) Name() string { return Name }
 // error (malformed schema/backendConfig) is returned so the Template
 // controller surfaces BackendError; a successful apply reports Ready=true.
 func (b *Backend) SetupTemplate(ctx context.Context, tmpl *infrav1alpha1.Template) (backend.TemplateStatus, error) {
-	rgd, err := buildRGD(tmpl, b.ingressClass)
+	rgd, err := buildRGD(tmpl, b.gatewayName, b.gatewayNamespace)
 	if err != nil {
 		return backend.TemplateStatus{Ready: false, Message: err.Error()}, err
 	}