Gateway API: Recommend the config approach rather than extraArgs

[maelvls]

The config approach is much more convenient than to have to concatenate flags in the extraFlags field. The config approach isn't immediately obvious to users, as seen in cert-manager/cert-manager#7121 where we found that there was no need for adding an extra helm value: one could simply use config.enableGatewayAPI.

[maelvls]

@wallrj Can you take a look? Thanks!

[netlify]

✅ Deploy Preview for cert-manager ready!

Built without sensitive environment variables

Name	Link
🔨 Latest commit	ff1e41a
🔍 Latest deploy log	https://app.netlify.com/sites/cert-manager/deploys/66b4899ac4bfdb00082d8699
😎 Deploy Preview	https://deploy-preview-1517--cert-manager.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[wallrj]

Thanks @maelvls

This looks like a nicer way to configure that feature, but it won't work until the next cert-manager release, right?
It depends on cert-manager/cert-manager@1b9c02e which has not been backported or released yet.

And since this documentation relates to the next version of cert-manager, it should be merged into release-next, along with the release note for the change which makes this possible.

And the DCO check seems to be failing.

[hongbo-miao]

Thanks @maelvls @wallrj for the info. It would be great to document the difference. Right now I noticed there are 3 methods in Helm chart:

featureGates: ExperimentalGatewayAPISupport=true

extraArgs:
  - --feature-gates=ExperimentalGatewayAPISupport=true

3. This method current lists in Helm values.yaml

config:
  featureGates:
    ExperimentalGatewayAPISupport: true

[maelvls]

I'll clarify further why and what the recommended approaches are depending on the cert-manager version. Thanks for the feedback!

[maelvls]

Here would be my recommendation depending on whether you are using 1.14 or below, 1.15, or 1.16 and above:

If you are using 1.15 and above, you no longer have to set a feature flag, but you still need to enable the feature. The recommended way to turn on the Gateway API support in 1.15 is to use the file-based configuration using the config Helm value:

config:
  apiVersion: controller.config.cert-manager.io/v1alpha1
  kind: ControllerConfiguration
  enableGatewayAPI: true

If you are using 1.16 and above, it is even simpler:

config:
  enableGatewayAPI: true

Another less practical way is to rely on the command line flag --enable-gateway-api:

extraArgs:
  - --enable-gateway-api

---

If you are using 1.14 and below, you will have to use the feature flag to turn on the Gateway API support. The recommended way is to use the featureGates Helm value:

Another way is to use the config Helm value:

config:
  apiVersion: controller.config.cert-manager.io/v1alpha1
  kind: ControllerConfiguration
  featureGates:
    ExperimentalGatewayAPISupport: true

A less readable way (as it requires a comma-separated list of feature flags) is to use the featureGates Helm value:

featureGates: ExperimentalGatewayAPISupport=true

which is equivalent to:

extraArgs:
  - --feature-gates=ExperimentalGatewayAPISupport=true

I'm not sure how to put that into the documentation. Should I only talk about the latest version, or can I explain how to set up Gateway API depending on the version? @wallrj

[maelvls]

Discussed in this morning's open standup:

• I will only keep the 1.15 instructions, and only show the config approach since it's the most sensible one (we think).
• I will add a note that explains that the feature flag that existed in 1.14 no longer exists and was replaced with a configuration option enableGatewayAPI.

[wallrj]

I spotted a minor typo which you can ignore if you like, by unholding.
I didn't test this, but I expect you have.

/approve
/lgtm
/hold

[maelvls]

I didn't test this, but I expect you have.

I had forgotten to test it... and found multiple typos in the commands. 🤦

I fixed them, it should be good to go now.

[maelvls]

/unhold

[wallrj]

/approve
/lgtm

[cert-manager-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: wallrj

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [wallrj]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[maelvls]

Now that cert-manager 1.16 has been released, --set config.enableGatewayAPI=true is now the recommended approach for projects that show instructions on how to enable cert-manager's gateway API support, especially on visible projects like Cilium: https://docs.cilium.io/en/latest/network/servicemesh/tls-termination/

I opened #1586 to track this issue.