Revert TenantGateway port-443 allowedRoutes.kinds workaround once Cilium ≥1.20 lands #3087

Context

To work around cilium/cilium#45559 (divergent per-listener allowedRoutes.kinds on the same port make Cilium collapse the listeners and silently drop HTTPRoutes), the TenantGateway controller forces every port-443 listener — both HTTPS-terminate and TLS-passthrough — to advertise an identical kinds set [HTTPRoute, TLSRoute]. See #3070 for the bug and #3084 for the workaround. Cozystack currently ships Cilium 1.19.x, which has the bug.

Why this needs reverting later

cilium/cilium#45559 is fixed upstream in Cilium 1.20 via cilium/cilium#45693. Once Cozystack bumps to Cilium ≥1.20, the natural per-protocol kinds work again — [HTTPRoute] on HTTPS-terminate listeners, [TLSRoute] on TLS-passthrough listeners — and the shared-kinds workaround is no longer needed.

The revert is not automatic on the bump. The upstream fix lives only in the route-side check (routechecks/gateway_checks.go); it does not touch the listener-status path (setListenerStatus / getSupportedRouteKinds). So the workaround keeps producing a permanent cosmetic ResolvedRefs=False / InvalidRouteKinds condition on every port-443 listener (each lists one kind unsupported for its protocol). This is harmless to traffic, security, and TenantGateway readiness, but it misreports listener status on the raw Gateway and will confuse future debugging and monitoring. Reverting to per-protocol kinds removes that noise.

Trigger

When Cozystack bumps Cilium to ≥1.20.

Action

Restore per-protocol allowedRoutes.kinds in renderGateway (drop the shared port443Kinds slice), and update the TenantGateway reconciler tests to pin the per-protocol sets again.

References

#3070, #3084, cilium/cilium#45559, cilium/cilium#45693