feat(helm): gateway API support

[iainsproat]

Description & motivation

At present, Speckle provide a Helm Chart for deployment of Speckle server to Kubernetes. This Helm Chart includes an Nginx Ingress definition.

Nginx Ingress will be deprecated as of March 2026.

The Kubernetes' recommended equivalent is the Gateway API. This PR provides a Gateway API implementation for Speckle server.

The Gateway API is disabled by default, but can be enabled by amending the helm configuration as follows:

```
ingress:
  enabled: false
gatewayAPI:
  enabled: true
```

An example Helm release configuration for deployment of Gateway API on GKE:

```
gatewayAPI:
  enabled: true
  gateway:
    enabled: true
    gatewayClassName: "gke-l7-rilb" # Internal Application Load Balancer(s) built on https://docs.cloud.google.com/load-balancing/docs/l7-internal
    defaultListenerName: speckle-server-gateway-https
    name: speckle-server-gateway
    tls:
      enabled: true # TLS can be disabled by setting to 'false'
      certificateRefs: [] # if creating a Kubernetes Secret https://docs.cloud.google.com/kubernetes-engine/docs/how-to/secure-gateway#secure-using-secret
      options:
        networking.gke.io/pre-shared-certs: my-ilb-cert # if creating an SSL certificate https://docs.cloud.google.com/kubernetes-engine/docs/how-to/secure-gateway#secure-using-ssl-certificate
```

If deploying your own Gateway, perhaps a shared gateway for multiple namespaces & applications, the configuration would look similar to the following:

```
gatewayAPI:
  enabled: true
  gateway:
    enabled: false # We are deploying the Gateway elsewhere
    name: shared-gateway # reference to the existing Gateway
    namespace: shared-gateway-namespace # reference to the existing Gateway's namespace
```

Changes:

• Gateway API implementation of both Gateway and HttpRoute resources.
• All ingress paths have been ported to HttpRoutes
• Refactored the Helm Chart file structure to place the ingress in a sub-directory.

Validation of changes:

• Validated by deployment to a GKE cluster

Additional Notes:

For GKE on Google Cloud, the Gateway API is not in itself sufficient. GKE Health Check Policies must also be enabled.

Example policies are as follows:

apiVersion: networking.gke.io/v1
kind: HealthCheckPolicy
metadata:
  name: speckle-frontend-2
spec:
  default:
    checkIntervalSec: 15  # The default value is 15 seconds.
    timeoutSec: 5
    healthyThreshold: 2
    unhealthyThreshold: 2
    logConfig:
      enabled: true
    config:
      type: HTTP
      httpHealthCheck:
        portSpecification: USE_SERVING_PORT
        requestPath: /api/status
  # Attach to a Service in the cluster.
  targetRef:
    group: ""
    kind: Service
    name: speckle-frontend-2
---
apiVersion: networking.gke.io/v1
kind: HealthCheckPolicy
metadata:
  name: speckle-objects
spec:
  default:
    checkIntervalSec: 15  # The default value is 15 seconds.
    timeoutSec: 5
    healthyThreshold: 2
    unhealthyThreshold: 2
    logConfig:
      enabled: true
    config:
      type: HTTP
      httpHealthCheck:
        portSpecification: USE_SERVING_PORT
        requestPath: /readiness
  # Attach to a Service in the cluster.
  targetRef:
    group: ""
    kind: Service
    name: speckle-objects
 ---
 apiVersion: networking.gke.io/v1
kind: HealthCheckPolicy
metadata:
  name: speckle-server
spec:
  default:
    checkIntervalSec: 15  # The default value is 15 seconds.
    timeoutSec: 5
    healthyThreshold: 2
    unhealthyThreshold: 2
    logConfig:
      enabled: true
    config:
      type: HTTP
      httpHealthCheck:
        portSpecification: USE_SERVING_PORT
        requestPath: /readiness
  # Attach to a Service in the cluster.
  targetRef:
    group: ""
    kind: Service
    name: speckle-server

References

• https://www.kubernetes.dev/blog/2025/11/12/ingress-nginx-retirement/
• https://gateway-api.sigs.k8s.io/guides/getting-started/

[linear]

CXPLA-343 Gateway API