Gateway API (Cilium): no supported knob to enable proxyProtocol on the publishing path #3030

Problem

When publishing through the Cilium Gateway API path (added in v1.5.0), there is no supported way for an operator to enable PROXY protocol on the Gateway listeners. The functionality exists in Cilium (gatewayAPI.enableProxyProtocol, default false), but Cozystack exposes no knob to turn it on, and the value cannot be reached through normal configuration.

The host ingress-nginx path already has a first-class switch for this — publishing.proxyProtocol — but it only drives ingress-nginx (plus Ouroboros) and does not touch the Gateway path. So an operator who publishes via Gateway API and needs PROXY protocol (e.g. to preserve the client source IP behind an L4 load balancer that injects PROXY headers) has no equivalent.

Why it cannot be set today

Cilium is installed as the cilium component of the cozystack.networking package. The platform chart builds that component's values from a fixed set of keys and passes nothing else through:

# packages/core/platform/templates/bundles/system.yaml
{{- $ciliumValues := dict "cilium" (dict
  "k8sServiceHost" "localhost"
  "k8sServicePort" "7445"
  "cgroup" (dict "autoMount" (dict "enabled" false))) -}}
{{- $_ := set $networkingComponents "cilium" (dict "values" $ciliumValues) -}}

There is no operator-facing override hook in packages/core/platform/values.yaml for arbitrary cilium values, and cozystack.networking is reconciled by helm-controller (managed-by Helm, helm.sh/resource-policy: keep), so editing the rendered Package spec by hand is reverted on the next reconcile. The result is that cilium.gatewayAPI.enableProxyProtocol is effectively unreachable without forking the platform chart.

Proposed solution

Add a first-class switch for PROXY protocol on the Gateway publishing path, mirroring publishing.proxyProtocol for ingress-nginx — when enabled, it sets cilium.gatewayAPI.enableProxyProtocol: true on the networking package's cilium component.

A lighter alternative (or a complement) is a generic passthrough for cilium component values in the platform config, so operators can set advanced Cilium options without a fork.

Caveats worth documenting alongside the feature

• gatewayAPI.enableProxyProtocol is cluster-wide for all Gateway listeners: once enabled, Envoy accepts PROXY-framed traffic only, so an upstream L4 load balancer that injects the PROXY header is required, otherwise all Gateway traffic breaks (same failure mode as the ingress-nginx switch).
• If the goal is only client source-IP preservation, externalTrafficPolicy: Local on the Gateway's LoadBalancer Service is usually enough and avoids the all-or-nothing PROXY requirement.

Environment

Cozystack v1.5.0 (Cilium 1.19.3), gatewayAPI.enabled: true shipped by default; gatewayAPI.enableProxyProtocol left at the Cilium default of false.