Users want support for Gateway API beyond 1.2.1

[kflynn]

What is the issue?

Up through Linkerd 2.19, the presence of Gateway API HTTPRoutes with the CORS filter cause deserialization failures in the Linkerd control plane. 🙁 Given Gateway API's stated desire to move more quickly, this kind of situation is likely to recur as new stanzas get added to Gateway API resources and users install newer versions of Gateway API.

Note that this is not saying that we need to support all the new stanzas (CORS, for example, isn't meant to be interpreted by mesh implementations at all), simply that we need to make sure that we don't error on unknown stanzas.

We also need to update documentation to not say that any extant Linkerd version supports Gateway API beyond 1.2.1.

How can it be reproduced?

Install Gateway API 1.3.0 or 1.4.0.
Create an HTTPRoute that uses the CORS filter.
Install Linkerd.
Observe difficulties. 🙁

Logs, error output, etc

N/A

output of linkerd check -o short

N/A

Environment

Any K8s version using Gateway API newer than 1.2.1 with the CORS or ExternalAuth filter (or, likely, the useDefaultGateways stanza)
Any extant version of Linkerd

Possible solution

No response

Additional context

No response

Would you like to work on fixing this bug?

None

[patst]

Ran into this as well and had to fallback to a SecurityPolicy provided by Envoy Gateway.
Would be great to be able to use the standard GatewayAPI approach for the CORS policy.

Instead of always staying up-to-date with the CRDs, maybe another option is to be more graceful while parsing and checking the HTTPRoutes for parentRefs which are not relevant for LinkerD (e.g. Gateways?) and then ignore further checks in the validation hook

[alpeb]

Please note that as of edge-26.1.2 the policy controller no longer fails when encountering unsupported stanzas in a resource, and simply skips the resource. Also the docs have been updated to reflect the maximum Gateway API compatible version, 1.2.1.