[RS-2260] Add GatewayAPI field to configure CRD management

api/v1/common_types.go

@@ -52,3 +52,11 @@ const (
 	LogSeverityDebug LogSeverity = "Debug"
 	LogSeverityTrace LogSeverity = "Trace"
 )
+
+// +kubebuilder:validation:Enum=Reconcile;PreferExisting
+type CRDManagement string
+
+const (
+	CRDManagementReconcile      CRDManagement = "Reconcile"
+	CRDManagementPreferExisting CRDManagement = "PreferExisting"
+)

api/v1/gatewayapi_types.go

@@ -1,4 +1,4 @@
-// Copyright (c) 2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2024-2025 Tigera, Inc. All rights reserved.
 /*
 
 Licensed under the Apache License, Version 2.0 (the "License");
@@ -32,6 +32,20 @@ type GatewayAPISpec struct {
 
 	// Allow optional customization of gateway deployments.
 	GatewayDeployment *GatewayDeployment `json:"gatewayDeployment,omitempty"`
+
+	// Configure how to manage and update Gateway API CRDs.  The default behaviour - which is
+	// used when this field is not set, or is set to "PreferExisting" - is that the Tigera
+	// operator will create the Gateway API CRDs if they do not already exist, but will not
+	// overwrite any existing Gateway API CRDs.  This setting may be preferable if the customer
+	// is using other implementations of the Gateway API concurrently with the Gateway API
+	// support in Calico Enterprise.  It is then the customer's responsibility to ensure that
+	// CRDs are installed that meet the needs of all the Gateway API implementations in their
+	// cluster.
+	//
+	// Alternatively, if this field is set to "Reconcile", the Tigera operator will keep the
+	// cluster's Gateway API CRDs aligned with those that it would install on a cluster that
+	// does not yet have any version of those CRDs.
+	CRDManagement *CRDManagement `json:"crdManagement,omitempty"`
 }
 
 //+kubebuilder:object:root=true

pkg/controller/gatewayapi/gatewayapi_controller.go

@@ -1,4 +1,4 @@
-// Copyright (c) 2024 Tigera, Inc. All rights reserved.
+// Copyright (c) 2024-2025 Tigera, Inc. All rights reserved.
 
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -18,7 +18,9 @@ import (
 	"context"
 	"fmt"
 
+	"k8s.io/apimachinery/pkg/api/errors"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -156,9 +158,45 @@ func (r *ReconcileGatewayAPI) Reconcile(ctx context.Context, request reconcile.R
 	// one that we are providing here.
 	crdComponent := render.NewPassthrough(render.GatewayAPICRDs(log)...)
 	handler := utils.NewComponentHandler(log, r.client, r.scheme, nil)
-	handler.SetCreateOnly()
+	if gatewayAPI.Spec.CRDManagement == nil || *gatewayAPI.Spec.CRDManagement == operatorv1.CRDManagementPreferExisting {
+		handler.SetCreateOnly()
+	}
 	err = handler.CreateOrUpdateOrDelete(ctx, crdComponent, nil)
-	if err != nil {
+	if gatewayAPI.Spec.CRDManagement == nil && (err == nil || errors.IsAlreadyExists(err)) {
+		// The GatewayAPI CR does not yet have a specified value for its CRDManagement
+		// field, and we can now infer a reasonable value.
+		if err == nil {
+			// None of the CRDs previously existed, and all of them were just created by
+			// us.  Therefore, in future we can consider the CRDs as Tigera
+			// operator-owned, and reconcile them so as to deliver future updates.
+			setting := operatorv1.CRDManagementReconcile
+			gatewayAPI.Spec.CRDManagement = &setting
+		} else {
+			// Some (i.e. at least one) of the CRDs already existed.  Therefore we have
+			// to assume that someone or something else is provisioning the CRDs in this
+			// cluster, and make sure not to clobber them.
+			setting := operatorv1.CRDManagementPreferExisting
+			gatewayAPI.Spec.CRDManagement = &setting
+		}
+		// Patch that value back into the datastore.
+		err = r.client.Patch(ctx, &operatorv1.GatewayAPI{
+			ObjectMeta: metav1.ObjectMeta{
+				Name: utils.DefaultTSEEInstanceKey.Name,
+			},
+			Spec: operatorv1.GatewayAPISpec{
+				CRDManagement: gatewayAPI.Spec.CRDManagement,
+			},
+		}, client.MergeFrom(&operatorv1.GatewayAPI{
+			Spec: operatorv1.GatewayAPISpec{
+				CRDManagement: nil,
+			},
+		}))
+		if err != nil {
+			r.status.SetDegraded(operatorv1.ResourceUpdateError, "Failed to patch CRDManagement field", err, reqLogger)
+			return reconcile.Result{}, err
+		}
+	}
+	if err != nil && !errors.IsAlreadyExists(err) {
 		r.status.SetDegraded(operatorv1.ResourceCreateError, "Error rendering GatewayAPI CRDs", err, log)
 		return reconcile.Result{}, err
 	}

pkg/controller/gatewayapi/gatewayapi_controller_suite_test.go

@@ -0,0 +1,29 @@
+// Copyright (c) 2025 Tigera, Inc. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package gatewayapi
+
+import (
+	"testing"
+
+	. "github.com/onsi/ginkgo"
+	"github.com/onsi/ginkgo/reporters"
+	. "github.com/onsi/gomega"
+)
+
+func TestStatus(t *testing.T) {
+	RegisterFailHandler(Fail)
+	junitReporter := reporters.NewJUnitReporter("../../../report/ut/gatewayapi_controller_suite.xml")
+	RunSpecsWithDefaultAndCustomReporters(t, "pkg/controller/gatewayapi Suite", []Reporter{junitReporter})
+}

pkg/controller/gatewayapi/gatewayapi_controller_test.go

@@ -0,0 +1,153 @@
+// Copyright (c) 2025 Tigera, Inc. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package gatewayapi
+
+import (
+	"context"
+
+	. "github.com/onsi/ginkgo"
+	. "github.com/onsi/ginkgo/extensions/table"
+	. "github.com/onsi/gomega"
+	. "github.com/onsi/gomega/gstruct"
+	"github.com/stretchr/testify/mock"
+
+	admregv1 "k8s.io/api/admissionregistration/v1"
+	appsv1 "k8s.io/api/apps/v1"
+	batchv1 "k8s.io/api/batch/v1"
+	rbacv1 "k8s.io/api/rbac/v1"
+	apiextenv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+
+	operatorv1 "github.com/tigera/operator/api/v1"
+	"github.com/tigera/operator/pkg/apis"
+	"github.com/tigera/operator/pkg/controller/status"
+	"github.com/tigera/operator/pkg/controller/utils"
+	ctrlrfake "github.com/tigera/operator/pkg/ctrlruntime/client/fake"
+)
+
+var _ = Describe("Gateway API controller tests", func() {
+	var c client.Client
+	var ctx context.Context
+	var r *ReconcileGatewayAPI
+	var scheme *runtime.Scheme
+	var mockStatus *status.MockStatus
+	var installation *operatorv1.Installation
+
+	BeforeEach(func() {
+		// The schema contains all objects that should be known to the fake client when the test runs.
+		scheme = runtime.NewScheme()
+		Expect(apis.AddToScheme(scheme)).NotTo(HaveOccurred())
+		Expect(appsv1.SchemeBuilder.AddToScheme(scheme)).ShouldNot(HaveOccurred())
+		Expect(rbacv1.SchemeBuilder.AddToScheme(scheme)).ShouldNot(HaveOccurred())
+		Expect(batchv1.SchemeBuilder.AddToScheme(scheme)).ShouldNot(HaveOccurred())
+		Expect(operatorv1.SchemeBuilder.AddToScheme(scheme)).NotTo(HaveOccurred())
+		Expect(admregv1.SchemeBuilder.AddToScheme(scheme)).NotTo(HaveOccurred())
+
+		// Create a client that will have a CRUD interface of k8s objects.
+		c = ctrlrfake.DefaultFakeClientBuilder(scheme).Build()
+		ctx = context.Background()
+		installation = &operatorv1.Installation{
+			ObjectMeta: metav1.ObjectMeta{Name: "default"},
+			Spec: operatorv1.InstallationSpec{
+				Variant:  operatorv1.TigeraSecureEnterprise,
+				Registry: "some.registry.org/",
+			},
+			Status: operatorv1.InstallationStatus{
+				Variant: operatorv1.TigeraSecureEnterprise,
+				Computed: &operatorv1.InstallationSpec{
+					Registry: "my-reg",
+					// The test is provider agnostic.
+					KubernetesProvider: operatorv1.ProviderNone,
+				},
+			},
+		}
+		mockStatus = &status.MockStatus{}
+		mockStatus.On("OnCRFound").Return()
+		mockStatus.On("AddDaemonsets", mock.Anything).Return()
+		mockStatus.On("AddDeployments", mock.Anything).Return()
+		mockStatus.On("IsAvailable").Return(true)
+		mockStatus.On("AddStatefulSets", mock.Anything).Return()
+		mockStatus.On("AddCronJobs", mock.Anything)
+		mockStatus.On("OnCRNotFound").Return()
+		mockStatus.On("ClearDegraded")
+		mockStatus.On("SetDegraded", "Waiting for LicenseKeyAPI to be ready", "").Return().Maybe()
+		mockStatus.On("ReadyToMonitor")
+		mockStatus.On("SetMetaData", mock.Anything).Return()
+
+		r = &ReconcileGatewayAPI{
+			client: c,
+			scheme: scheme,
+			status: mockStatus,
+		}
+	})
+
+	DescribeTable("CRD management",
+		func(gwapiMod func(*operatorv1.GatewayAPI), expectReplace bool) {
+			Expect(c.Create(ctx, installation)).NotTo(HaveOccurred())
+
+			By("installing a pre-existing Gateway CRD with an improbable version")
+			crdName := "gateways.gateway.networking.k8s.io"
+			existingCRD := &apiextenv1.CustomResourceDefinition{
+				ObjectMeta: metav1.ObjectMeta{Name: crdName},
+				Spec: apiextenv1.CustomResourceDefinitionSpec{
+					Versions: []apiextenv1.CustomResourceDefinitionVersion{{
+						Name: "v0123456789",
+					}},
+				},
+			}
+			Expect(c.Create(ctx, existingCRD)).NotTo(HaveOccurred())
+
+			By("applying the GatewayAPI CR to the fake cluster")
+			gwapi := &operatorv1.GatewayAPI{
+				ObjectMeta: metav1.ObjectMeta{Name: "tigera-secure"},
+				Spec:       operatorv1.GatewayAPISpec{},
+			}
+			gwapiMod(gwapi)
+			Expect(c.Create(ctx, gwapi)).NotTo(HaveOccurred())
+
+			By("triggering a reconcile")
+			_, err := r.Reconcile(ctx, reconcile.Request{})
+			Expect(err).ShouldNot(HaveOccurred())
+
+			By("examining the Gateway CRD that is now present")
+			gatewayCRD := &apiextenv1.CustomResourceDefinition{}
+			Expect(c.Get(ctx, client.ObjectKey{Name: crdName}, gatewayCRD)).NotTo(HaveOccurred())
+			if expectReplace {
+				Expect(gatewayCRD.Spec.Versions).NotTo(ContainElement(MatchFields(IgnoreExtras, Fields{"Name": Equal("v0123456789")})))
+			} else {
+				Expect(gatewayCRD.Spec.Versions).To(ContainElement(MatchFields(IgnoreExtras, Fields{"Name": Equal("v0123456789")})))
+			}
+
+			if gwapi.Spec.CRDManagement == nil {
+				By("checking that CRDManagement field has been updated to PreferExisting")
+				Expect(c.Get(ctx, utils.DefaultTSEEInstanceKey, gwapi)).NotTo(HaveOccurred())
+				Expect(gwapi.Spec.CRDManagement).NotTo(BeNil())
+				Expect(*gwapi.Spec.CRDManagement).To(Equal(operatorv1.CRDManagementPreferExisting))
+			}
+		},
+		Entry("default", func(_ *operatorv1.GatewayAPI) {}, false),
+		Entry("Reconcile", func(gwapi *operatorv1.GatewayAPI) {
+			setting := operatorv1.CRDManagementReconcile
+			gwapi.Spec.CRDManagement = &setting
+		}, true),
+		Entry("PreferExisting", func(gwapi *operatorv1.GatewayAPI) {
+			setting := operatorv1.CRDManagementPreferExisting
+			gwapi.Spec.CRDManagement = &setting
+		}, false),
+	)
+})

pkg/controller/utils/component.go

@@ -34,6 +34,7 @@ import (
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
@@ -50,6 +51,12 @@ type ComponentHandler interface {
 
 	// Set this component handler to "create only" operation - i.e. it only creates resources if
 	// they do not already exist, and never tries to correct existing resources.
+	//
+	// When a component handler is "create only", and some of the objects that it is asked to
+	// create already exist, but no other error occurs, the CreateOrUpdateOrDelete() method will
+	// return an error that satisfies `errors.IsAlreadyExists`.  If a more serious error occurs,
+	// the method will return that more serious error instead.  If none of the objects already
+	// exist, and no other errors occur, the method will return nil.
 	SetCreateOnly()
 }
 
@@ -151,7 +158,13 @@ func (c *componentHandler) createOrUpdateObject(ctx context.Context, obj client.
 	if c.createOnly {
 		// This component handler only creates resources if they do not already exist.
 		logCtx.Info("Create-only operation, ignoring existing object")
-		return nil
+		return errors.NewAlreadyExists(
+			schema.GroupResource{
+				Group:    obj.GetObjectKind().GroupVersionKind().Group,
+				Resource: obj.GetObjectKind().GroupVersionKind().Kind,
+			},
+			obj.GetName(),
+		)
 	}
 
 	// The object exists. Update it, unless the user has marked it as "ignored".
@@ -290,22 +303,30 @@ func (c *componentHandler) CreateOrUpdateOrDelete(ctx context.Context, component
 	objsToCreate, objsToDelete := component.Objects()
 	osType := component.SupportedOSType()
 
+	var alreadyExistsErr error = nil
+
 	for _, obj := range objsToCreate {
 		key := client.ObjectKeyFromObject(obj)
 
 		// Pass in a DeepCopy so any modifications made by createOrUpdateObject won't be included
 		// if we need to retry the function
+		alreadyRetriedConflict := false
+	conflictRetry:
 		err := c.createOrUpdateObject(ctx, obj.DeepCopyObject().(client.Object), osType)
-		if err != nil && errors.IsConflict(err) {
-			// If the error is a resource Conflict, try the update again
-			cmpLog.WithValues("key", key, "conflict_message", err).Info("Failed to update object, retrying.")
-			err = c.createOrUpdateObject(ctx, obj, osType)
-			if err != nil {
+		if err != nil {
+			if errors.IsAlreadyExists(err) {
+				// Remember that we've had an "already exists" error, but otherwise
+				// carry on.
+				alreadyExistsErr = err
+			} else if errors.IsConflict(err) && !alreadyRetriedConflict {
+				// If the error is a resource Conflict, try the update again.
+				cmpLog.WithValues("key", key, "conflict_message", err).Info("Failed to update object, retrying.")
+				alreadyRetriedConflict = true
+				goto conflictRetry
+			} else {
+				cmpLog.Error(err, "Failed to create or update object", "key", key)
 				return err
 			}
-		} else if err != nil {
-			cmpLog.Error(err, "Failed to create or update object", "key", key)
-			return err
 		}
 
 		// Keep track of some objects so we can report on their status.
@@ -367,7 +388,10 @@ func (c *componentHandler) CreateOrUpdateOrDelete(ctx context.Context, component
 	if status != nil {
 		status.ReadyToMonitor()
 	}
-	return nil
+
+	// alreadyExistsErr is only non-nil if this component handler is in "create only" mode and
+	// one (or more) of objsToCreate already existed.
+	return alreadyExistsErr
 }
 
 // skipAddingOwnerReference returns true if owner is a namespaced resource and