Policy attachment for Upstreams that will supersede KongIngress.spec.upstreams

[mflendrich]

Is there an existing issue for this?

• I have searched the existing issues

Problem Statement

We're deprecating KongIngress #2505 #2941.

Some of KongIngress fields can be migrated into annotations, some (that configure upstream behavior) require their own CRD.

Gateway API defines a framework for such CRDs called policy attachments (docs).

Proposed Solution

Define a policy attachment CRD (KongUpstreamPolicy) that will configure Upstreams in a way KongIngress does today.

Tasks

Preview Give feedback

1. Define KongUpstreamPolicy CRD API
2. Implement translation of KongUpstreamPolicy to kong.Upstream #4929
   area/feature +1
   
3. Add KongUpstreamPolicy CRD validation rules #4951
   area/feature +1
   
4. Implement KongUpstreamPolicy controller basic functionality #4930
   area/feature +1
   
5. Use KongUpstreamPolicies in Parser to modify Upstreams for Services #4931
   area/feature +1
   
6. Add changelog entry describing KongUpstreamPolicy addition
7. Write a new guide that will replace Using KongIngress resource
8. Update Configuring healthchecks guide to use KongUpstreamPolicy

Additional information

No response

Acceptance Criteria

• Policy attachments configure upstreams on par with KongIngress for Gateway API routes.
• Policy attachments configure upstreams on par with KongIngress for Ingress types.
• https://docs.konghq.com/kubernetes-ingress-controller/latest/guides/using-kongingress-resource/ is replaced with a guide that discusses the new resource.
• https://docs.konghq.com/kubernetes-ingress-controller/latest/guides/configuring-health-checks/ is updated to use the new resource. It should also cover GWAPI usage, though shouldn't need to do more than include the standard test route boilerplate. Upstreams apply to service configuration, and use the same Service resource for both GWAPI and Ingress.

[czeslavo]

As a result of the discussion under #4880 we concluded KongUpstreamPolicy will not strictly follow GEP-713. It will differ in terms of the way the attachment is defined - instead of using TargetRef (that allows only 1-1 attachment), we'll use annotations (konghq.com/upstream-policy: <name>).

[czeslavo]

Updated Configuring healthchecks guide: Kong/docs.konghq.com#6309.

[czeslavo]

Replacement for Using KongIngress resource guide: Kong/docs.konghq.com#6407