chore(gateway_api_crd): default Gateway API CRDs to v1.5.1

[sanmesh-kakade]

Why

NGINX Gateway Fabric 2.5.0+ requires Gateway API v1.5.x. This is the prerequisite CRD bump for the companion NGF 2.6.3 upgrade (separate PR in facets-utility-modules).

Scope

• Default version v1.4.1 → v1.5.1; enum extended (v1.5.1, v1.5.0 added; existing v1.4.x/v1.3.0/v1.2.0 retained).
• Channel stays experimental; install still uses kubectl apply --server-side.
• v1.5.1 over v1.5.0 = conformance/docs patch, zero CRD schema change.

CRDs are not vendored — only the version/channel strings change. The asset filenames are identical at v1.5.1, so the install URL shape is unchanged.

Breaking changes v1.4.1 → v1.5.1 and handling

Change	Detail	Impact / handling
ReferenceGrant v1 added	v1beta1 still served + storage; v1 added alongside	Safe/additive — existing v1beta1 CRs valid, no migration
TLSRoute promoted to v1 (standard); experimental storage v1alpha3→v1	alpha versions still served (experimental)	Only affects TLSRoute users — none here; pre-check kubectl get tlsroutes -A
XListenerSet → ListenerSet (v1)	old xlistenersets kind removed	Only affects XListenerSet users — none here; pre-check kubectl get xlistenersets -A
Gateway/GatewayClass/HTTPRoute/GRPCRoute	schemas grew (CORS, cert selection, client-cert)	All additive optional fields on the v1 storage schema — existing CRs not rejected
New safe-upgrades ValidatingAdmissionPolicy	blocks downgrade below 1.5.0 + standard↔experimental mixing	Forward upgrade unaffected; rollback below 1.5.0 requires deleting this VAP + binding first — note in runbook
Min Kubernetes	v1.5.x wants K8s ≥1.31 (TLSRoute CEL)	Satisfied — cluster nodes ≥1.31.3, CP 1.33

Apply ordering

Gateway API CRDs (this module) must be applied before the NGF controller upgrade.

Pre-flight

kubectl get tlsroutes,xlistenersets -A should be empty before upgrade (the only kinds with served-version loss / rename).

🤖 Generated with Claude Code

---

Pre-flight & operational caveats (verified against the real v1.5.1/v1.4.1 manifests)

Confirmed by downloading + diffing the actual install bundles:

• Served-version-loss scan across all 11 shared CRDs: none dropped, except the whole xlistenersets CRD (renamed → listenersets, kind XListenerSet→ListenerSet, group x-k8s.io→k8s.io). Not an in-place migration.
• ReferenceGrant v1beta1 stays served + storage (v1 added alongside) → existing CRs valid, zero migration.
• TLSRoute storage moves v1alpha3 → v1 (alpha still served).
• safe-upgrades ValidatingAdmissionPolicy ships in v1.5.1 (failurePolicy: Fail, action Deny): blocks experimental-on-standard and any rollback to ≤ v1.4.x until you kubectl delete validatingadmissionpolicy safe-upgrades.gateway.networking.k8s.io + its binding.
• --server-side is mandatory — the httproutes CRD alone is ~533 KB, past the 262 KB client-side annotation limit. Keep it.

Run before applying:

kubectl get tlsroutes,xlistenersets -A          # expect empty
kubectl get crd httproutes.gateway.networking.k8s.io \
  -o jsonpath='{range .metadata.managedFields[*]}{.manager}{"\n"}{end}'

If managedFields show kubectl-client-side-apply (or a conflicting non-kubectl manager), the install Job's kubectl apply --server-side (main.tf:100, no --force-conflicts, backoff_limit=3) errors on conflict → add --force-conflicts.

Apply these CRDs before the NGF 2.6.3 controller upgrade (companion PR Facets-cloud/facets-utility-modules#39).

Summary by CodeRabbit

• Updates
  • The default Gateway API Custom Resource Definition (CRD) has been upgraded from version v1.4.1 to v1.5.1. All new Gateway API installations now target this latest stable release by default, providing updated API specifications and enhanced compatibility features. Earlier versions remain available for backward compatibility.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)

• facets-saas

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2cd108f5-972c-4c5a-b8b2-7c48c53476d8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

Bumps the Gateway API CRD target version from v1.4.1 to v1.5.1. The facets.yaml schema updates the spec.version default value, adds v1.5.1 to the allowed enum, and updates the sample config. The main.tf locals fallback version is updated correspondingly.

Changes

Gateway API CRD v1.5.1 Version Bump

Layer / File(s)	Summary
Schema enum/default and Terraform local version update modules/gateway_api_crd/k8s/1.0/facets.yaml, modules/gateway_api_crd/k8s/1.0/main.tf	spec.properties.version default and enum updated to v1.5.1, sample config version set to v1.5.1, and local.version fallback in main.tf changed from v1.4.1 to v1.5.1.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: updating the default Gateway API CRD version from v1.4.1 to v1.5.1.
Description check	✅ Passed	The description thoroughly covers motivation, scope, breaking changes, and operational requirements, exceeding template expectations with detailed impact analysis.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch upgrade/gateway-api-crd-1.5.1

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sanmesh-kakade]

Superseded by #554 — consolidated the gateway_api_crd v1.5.1 bump and the legacy-module CP min_replicas fix into a single PR.