Pull request overview

Adds Kubernetes Gateway API (gateway.networking.k8s.io/v1) support to ShenYu’s k8s controller/starter, alongside existing Ingress support, and introduces a new integrated test workflow to validate Gateway API routing.

Changes:

• Adds Spring Boot auto-configuration and controllers/reconcilers for GatewayClass, Gateway, and HTTPRoute.
• Implements HttpRouteParser + GatewayRouteCache to translate HTTPRoute specs into ShenYu selector/rule config and track bindings.
• Introduces a new k8s Gateway API integrated test module and GitHub Actions workflow to run it on kind.

Reviewed changes

Copilot reviewed 26 out of 26 changed files in this pull request and generated 7 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Pull request overview

Copilot reviewed 26 out of 26 changed files in this pull request and generated 5 comments.

Thanks for this — the Gateway API support is a solid addition and the test scaffolding is appreciated. A few correctness/operational issues before merge:

Blocker — non-idempotent HTTPRoute reconcile. HTTPRouteReconciler.reconcile (HTTPRouteReconciler.java:2192-2195) unconditionally does deleteConfig → parse → applyConfig on every pass, and HttpRouteParser allocates fresh selector/rule IDs from a monotonic AtomicLong on each parse (GatewayRouteCache.java:1127-1133). Because the informer resyncs every 1 min (GatewayApiControllerConfiguration, withResyncPeriod(Duration.ofMinutes(1))), every HTTPRoute is re-reconciled each minute: the old selector/rule IDs are deleted and new ones created even when the spec is unchanged. ShenyuCacheRepository.saveOrUpdateSelectorData then pushes delete+create into the live data-plane cache, so there's a brief window per route per minute where matching requests find no selector. The Ingress reconciler avoids this by only re-applying when needUpdate(old, current) is true (IngressReconciler.java:175). Suggest either reusing deterministic IDs derived from (namespace, routeName, ruleIndex, hostname) or skipping re-apply when the parsed config is unchanged, and adding a test that asserts IDs are stable across two reconcile() calls.

Blocker — own e2e is red. The new it-k8s-gateway-api workflow fails on this head (build (shenyu-integrated-test-k8s-gateway-api-http) FAILURE, run 29428497010). Please grab the controller logs from the workflow's debug step and fix or explain.

Should fix.

• GatewayReconciler.isShenyuGateway compares spec.gatewayClassName to the literal "shenyu" instead of resolving the GatewayClass and checking its spec.controllerName (GatewayClassReconciler already has the correct check). Gateways whose GatewayClass has any other name are silently ignored even when that class is ShenYu-owned.
• Cross-namespace parentRefs are accepted without a ReferenceGrant check, and ResolvedRefs=True is reported unconditionally — including when backend endpoints are missing/unresolvable (HttpRouteParser.parseBackendRefs logs and skips, then updateHTTPRouteStatus still emits ResolvedRefs=True). The latter also programs a divide selector with handle="[]", so requests 5xx while status claims healthy.
• bindToGateway binds to non-ShenYu parents too, and the Gateway deletion path calls deleteAssociatedRoutes without verifying the deleted Gateway was ShenYu-managed — deleting a non-ShenYu gateway of the same name can wipe selectors for a route still served by a ShenYu gateway.
• GatewayReconciler.requeueAffectedHTTPRoutes does a full cluster-wide HTTPRoute scan on every (resync) reconcile; should only run when the Gateway actually changed.
• No leader election; multi-replica deployments will race on status patches and double-reconcile. Either wire leader election or document single-replica-only.
• Wildcard hostnames (*.example.com) are matched with OperatorEnum.EQ (HttpRouteParser.processRule:1340-1348) — they will never match subdomains. Please emit a domain pattern operator for wildcard hostnames.
• GatewayClassReconciler.updateGatewayClassAcceptedStatus rebuilds the conditions array from scratch; merge-patch replaces arrays wholesale, so it clobbers conditions set by other controllers. Mirror the preservation logic already used for Gateway status.

Minor: the MapUtils.isEmpty → isNotEmpty fix in IngressControllerConfiguration.tcpSslContextSpec is a real and correct bug fix (current master is inverted), but it's unrelated to the Gateway API feature — please split into its own commit/PR for traceability.

For reference I reviewed the full diff (head 19e8bd8) plus the existing IngressReconciler/ShenyuCacheRepository in the local tree; did not modify anything.