[feat: gw api] Add Rules CRD for customizing Gateway API L7 routes

[shraddhabang]

Add ListenerRuleConfiguration CRD for customizing Gateway API L7 routes with ELB-specific features

Summary

This PR introduces a new custom resource definition (CRD) called ListenerRuleConfiguration that extends Gateway API's HTTPRoute capabilities with AWS Application Load Balancer (ALB) specific features. This implementation bridges the functionality gap between Gateway API's current feature set and AWS ALB's advanced capabilities.

Problem Statement

While Gateway API provides a standardized way to manage ingress traffic across Kubernetes clusters, it currently lacks native support for several AWS ALB-specific features that customers rely on, such as:

• Authentication (OIDC and Cognito)
• Fixed response actions
• Target group stickiness
• Source IP conditions
• Advanced redirect capabilities (query parameter manipulation)

Solution

We've implemented a new RuleConfiguration CRD that can be attached to HTTPRoutes using an ExtensionRef filter. This approach:

1. Preserves Gateway API compatibility while extending functionality
2. Focuses exclusively on features not natively supported by Gateway API
3. Maintains a clean separation between standard and AWS-specific configurations
4. Follows the same pattern established by our existing LoadBalancerConfiguration and TargetGroupConfiguration CRDs

The CRD allows users to configure:

• Authentication actions (OIDC and Cognito)
• Fixed response actions with custom status codes, content types and bodies
• Forward actions with target group stickiness
• Redirect actions with query parameter support
• Source IP conditions for rule matching

Design Considerations

• We've limited the scope to features that don't overlap with Gateway API's native capabilities
• The implementation follows the existing pattern of our other Configuration CRDs for consistency
• The CRD includes appropriate validation rules to ensure configurations meet AWS requirements
• Documentation clearly indicates which fields are supported and which require native Gateway API configuration

Usage

Users can reference the ListenerRuleConfiguration in their HTTPRoutes:

apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: auth-oidc-http-route namespace: example-ns spec: parentRefs: - name: test-alb-1 sectionName: http-1 hostnames: - example.com rules: - backendRefs: - name: echoserver port: 80 filters: - type: ExtensionRef extensionRef: group: gateway.k8s.aws kind: RuleConfiguration name: cognito-auth-example

With a corresponding RuleConfiguration:

apiVersion: gateway.k8s.aws/v1beta1 kind: ListenerRuleConfiguration metadata: name: cognito-auth-example namespace: example-ns spec: actions: - type: authenticate-cognito authenticateCognitoConfig: userPoolID: "us-east-1_USUcEHSmh" userPoolClientID: "1q4ba1iri8o1va2tlsq5cj7nc6" userPoolDomain: "us-east-1usucehsmh" scope: "openid" sessionCookieName: "AWSELBAuthSessionCookie" sessionTimeout: 604800 onUnauthenticatedRequest: "authenticate" tags: Environment: production Service: echoserver

Documentation

• Added CRD reference documentation

Checklist

• Added tests that cover your change (if possible)
• Added/modified documentation as required (such as the README.md, or the docs directory)
• Manually tested
• Made sure the title of the PR is a good description that can go into the release notes

BONUS POINTS checklist: complete for good vibes and maybe prizes?! 🤯

• Backfilled missing tests for code in same general area 🎉
• Refactored something and made the world a better place 🌟

[shuqz]

you might wanna fix unit test

[zac-nixon]

I added comments originally, but I see the intent now to specifically support Auth actions.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: shraddhabang, zac-nixon

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [shraddhabang,zac-nixon]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment