User Story
As a Kubernetes platform operator, I want OpenShell to attach to a shared agentgateway Gateway so that several applications can use a platform-managed ingress data plane.
Problem Statement
Issue #2469 and PR #3714 use a dedicated, chart-owned agentgateway Gateway to match OpenShell's existing Envoy topology. The chart does not yet provide listener selection or ListenerSet support for a shared Gateway managed outside the OpenShell release.
Impact / Why This Matters
Operators that centralize ingress must maintain custom GRPCRoute and ListenerSet manifests or patch rendered chart output. That workaround separates routing configuration from the release and lacks shared ingress-topology E2E coverage.
Proposed Design
Add an optional shared-Gateway mode while keeping the controller and Gateway under platform ownership.
- Attach the OpenShell GRPCRoute to an existing Gateway in the same or another namespace.
- Support selecting a listener by
sectionName.
- Support an OpenShell-owned ListenerSet for frontend TLS when the shared Gateway permits it.
- Reuse BackendTLSPolicy for backend TLS re-encryption.
- Add shared plaintext, HA, frontend TLS, and backend TLS E2E coverage and documentation.
Acceptance Criteria
Alternatives Considered
Using only a dedicated Gateway remains supported by #2469 and PR #3714, but it does not meet platform-managed shared-ingress requirements. Managing all shared routing resources outside the chart remains possible but lacks release integration and tested defaults.
Agent Investigation
A working prototype from the earlier #2469 implementation is preserved at https://github.com/danehans/OpenShell/tree/3715-shared-agentgateway-gateway/danehans for follow-up after PR #3714 merges.
User Story
As a Kubernetes platform operator, I want OpenShell to attach to a shared agentgateway Gateway so that several applications can use a platform-managed ingress data plane.
Problem Statement
Issue #2469 and PR #3714 use a dedicated, chart-owned agentgateway Gateway to match OpenShell's existing Envoy topology. The chart does not yet provide listener selection or ListenerSet support for a shared Gateway managed outside the OpenShell release.
Impact / Why This Matters
Operators that centralize ingress must maintain custom GRPCRoute and ListenerSet manifests or patch rendered chart output. That workaround separates routing configuration from the release and lacks shared ingress-topology E2E coverage.
Proposed Design
Add an optional shared-Gateway mode while keeping the controller and Gateway under platform ownership.
sectionName.Acceptance Criteria
Alternatives Considered
Using only a dedicated Gateway remains supported by #2469 and PR #3714, but it does not meet platform-managed shared-ingress requirements. Managing all shared routing resources outside the chart remains possible but lacks release integration and tested defaults.
Agent Investigation
A working prototype from the earlier #2469 implementation is preserved at https://github.com/danehans/OpenShell/tree/3715-shared-agentgateway-gateway/danehans for follow-up after PR #3714 merges.