feat: release apisix-ingress-controller 2.2.0

[AlinsRan]

Description

Releases apisix-ingress-controller 2.2.0, tagged as 2.2.0.

• Chart.yaml: appVersion 2.1.0 -> 2.2.0, chart version 1.2.2 -> 1.3.0
• values.yaml and the generated README.md: controller image tag 2.2.0. The ADC sidecar stays at 0.27.1, which is what the release pins.
• crds/: regenerated with make helm-build-crds from the 2.2.0 tag.

Gateway API 1.6.0

The controller moved to Gateway API 1.6.0 in this release, so the bundled CRDs move with it, from v1.3.0. Two things come along with the standard channel that the v1.3.0 bundle did not carry:

• ListenerSet, a new CRD.
• safe-upgrades, a ValidatingAdmissionPolicy and its binding. admissionregistration.k8s.io/v1 is GA from Kubernetes 1.30, and 2.2.0 declares 1.31+ as its supported version, so this is inside the supported range. It does mean a cluster older than 1.30 that could install the previous chart cannot install this one.

RBAC the release needs and the chart did not grant

Comparing the rendered ClusterRole against config/rbac/role.yaml at the 2.2.0 tag turned up three missing resources, all of which would fail quietly:

• l4routepolicies and l4routepolicies/status, for the L4RoutePolicy CRD #2791 adds. The CRD would install and the controller would never reconcile it.
• configmaps, which downstream mTLS #2792 reads the CA from. frontendValidation would fail to resolve its caCertificateRefs.

After the change the rendered role covers everything the controller declares. The three resources the chart grants beyond it (tokenreviews, subjectaccessreviews, endpoints) are the chart's own metrics authentication and endpoint access, unchanged.

Webhook paths the release moved

#2839 reads the L4 routes through gateway.networking.k8s.io/v1, and the webhook paths moved with them. The chart still sent the API server to the v1alpha2 paths, which 2.2.0 does not answer, so every TCPRoute and UDPRoute admission would fail against a path that is not there:

	before	after
name	vtcproute-v1alpha2.kb.io	vtcproute-v1.kb.io
path	/validate-gateway-networking-k8s-io-v1alpha2-tcproute	…-v1-tcproute
rule	apiVersions: ["v1alpha2"]	apiVersions: ["v1"]

Same for udproute. The rendered configuration now matches config/webhook/manifests.yaml at the 2.2.0 tag exactly, all twelve webhooks.

Verification

helm lint passes, helm template renders apache/apisix-ingress-controller:2.2.0 and ghcr.io/api7/adc:0.27.1, the CRD bundles parse and carry 12 and 10 CustomResourceDefinitions with gateway.networking.k8s.io/bundle-version: v1.6.0, and l4routepolicies is present in the bundle. The rendered ClusterRole and ValidatingWebhookConfiguration were both diffed against their sources at the 2.2.0 tag rather than eyeballed.