feat(gateway): expose gatewayAPI.gateway.infrastructure passthrough (#939)

Render Gateway spec.infrastructure (labels/annotations) so Gateway API
controllers propagate the metadata onto the provisioned Service/Deployment,
e.g. AWS internal NLB annotations. Purely additive: guarded by `with`, so
the default {} renders no change.

- spire-lib: toYaml passthrough in the shared Gateway helper
- spire, spire-nested: add the values param; regenerate READMEs
- tests/unit: cover the positive passthrough case

Signed-off-by: sabsari <[email protected]>
Co-authored-by: Claude Opus 4.8 <[email protected]>

charts/spire-lib/templates/_helpers.tpl

@@ -589,6 +589,10 @@ metadata:
   {{- end }}
 spec:
   gatewayClassName: {{ required "gatewayAPI.gateway.className is required to render the shared Gateway" $obj.className | quote }}
+  {{- with $obj.infrastructure }}
+  infrastructure:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
   allowedListeners:
     namespaces:
       from: {{ default "All" $obj.allowedListenersNamespaces }}

charts/spire-nested/README.md

@@ -243,6 +243,7 @@ Now you can interact with the Spire agent socket from your own application. The
 | `gatewayAPI.gateway.enabled`                                             | Render the shared Gateway object                                                                                                                                                                                                       | `false`                               |
 | `gatewayAPI.gateway.className`                                           | gatewayClassName for the shared Gateway (e.g. "eg"). Required when enabled.                                                                                                                                                            | `""`                                  |
 | `gatewayAPI.gateway.annotations`                                         | Annotations for the Gateway object                                                                                                                                                                                                     | `{}`                                  |
+| `gatewayAPI.gateway.infrastructure`                                      | Metadata (labels/annotations) propagated to the provisioned Gateway Service/Deployment. Use for cloud LB annotations, e.g. internal NLB.                                                                                               | `{}`                                  |
 | `gatewayAPI.gateway.allowedListenersNamespaces`                          | From which namespaces ListenerSets may attach to the Gateway. One of All, Same, Selector.                                                                                                                                              | `All`                                 |
 | `gatewayAPI.gateway.allowedRoutesNamespaces`                             | From which namespaces routes may attach directly to the base listener (used when ListenerSet management is off). One of All, Same, Selector.                                                                                           | `All`                                 |
 | `gatewayAPI.gateway.extraListeners`                                      | Additional listeners to add to the Gateway                                                                                                                                                                                             | `[]`                                  |

charts/spire-nested/values.yaml

@@ -138,6 +138,8 @@ gatewayAPI:
     className: ""
     ## @param gatewayAPI.gateway.annotations [object] Annotations for the Gateway object
     annotations: {}
+    ## @param gatewayAPI.gateway.infrastructure [object] Metadata (labels/annotations) propagated to the provisioned Gateway Service/Deployment. Use for cloud LB annotations, e.g. internal NLB.
+    infrastructure: {}
     ## @param gatewayAPI.gateway.allowedListenersNamespaces From which namespaces ListenerSets may attach to the Gateway. One of All, Same, Selector.
     allowedListenersNamespaces: All
     ## @param gatewayAPI.gateway.allowedRoutesNamespaces From which namespaces routes may attach directly to the base listener (used when ListenerSet management is off). One of All, Same, Selector.

charts/spire/README.md

@@ -328,6 +328,7 @@ Now you can interact with the Spire agent socket from your own application. The
 | `gatewayAPI.gateway.enabled`                    | Render the shared Gateway object                                                                                                             | `false` |
 | `gatewayAPI.gateway.className`                  | gatewayClassName for the shared Gateway (e.g. "eg"). Required when enabled.                                                                  | `""`    |
 | `gatewayAPI.gateway.annotations`                | Annotations for the Gateway object                                                                                                           | `{}`    |
+| `gatewayAPI.gateway.infrastructure`             | Metadata (labels/annotations) propagated to the provisioned Gateway Service/Deployment. Use for cloud LB annotations, e.g. internal NLB.     | `{}`    |
 | `gatewayAPI.gateway.allowedListenersNamespaces` | From which namespaces ListenerSets may attach to the Gateway. One of All, Same, Selector.                                                    | `All`   |
 | `gatewayAPI.gateway.allowedRoutesNamespaces`    | From which namespaces routes may attach directly to the base listener (used when ListenerSet management is off). One of All, Same, Selector. | `All`   |
 | `gatewayAPI.gateway.extraListeners`             | Additional listeners to add to the Gateway                                                                                                   | `[]`    |

charts/spire/values.yaml

@@ -159,6 +159,8 @@ gatewayAPI:
     className: ""
     ## @param gatewayAPI.gateway.annotations [object] Annotations for the Gateway object
     annotations: {}
+    ## @param gatewayAPI.gateway.infrastructure [object] Metadata (labels/annotations) propagated to the provisioned Gateway Service/Deployment. Use for cloud LB annotations, e.g. internal NLB.
+    infrastructure: {}
     ## @param gatewayAPI.gateway.allowedListenersNamespaces From which namespaces ListenerSets may attach to the Gateway. One of All, Same, Selector.
     allowedListenersNamespaces: All
     ## @param gatewayAPI.gateway.allowedRoutesNamespaces From which namespaces routes may attach directly to the base listener (used when ListenerSet management is off). One of All, Same, Selector.

tests/unit/spire_test.go

@@ -985,4 +985,21 @@ spire-server:
 			Expect(serverResource).Should(ContainSubstring("name: my-ro-db-secret"))
 		})
 	})
+	Describe("gatewayAPI.gateway.infrastructure", func() {
+		It("passes infrastructure through to the shared Gateway spec when set", func() {
+			objs, err := ValueStringRender(chart, `
+gatewayAPI:
+  gateway:
+    enabled: true
+    className: istio
+    infrastructure:
+      annotations:
+        service.beta.kubernetes.io/aws-load-balancer-scheme: internal
+`)
+			Expect(err).Should(Succeed())
+			gateway := objs["spire/templates/gateway.yaml"]
+			Expect(gateway).Should(ContainSubstring("infrastructure:"))
+			Expect(gateway).Should(ContainSubstring("service.beta.kubernetes.io/aws-load-balancer-scheme: internal"))
+		})
+	})
 })