Add support to Gateway checks in Polaris

test/checks/gatewayAllowedRoutesAll/failure.yaml

@@ -0,0 +1,13 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: unrestricted
+spec:
+  gatewayClassName: kgateway
+  listeners:
+  - name: https
+    protocol: HTTPS
+    port: 443
+    allowedRoutes:
+      namespaces:
+        from: All

test/checks/gatewayAllowedRoutesAll/success.yaml

@@ -0,0 +1,16 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: restricted
+spec:
+  gatewayClassName: kgateway
+  listeners:
+  - name: https
+    protocol: HTTPS
+    port: 443
+    allowedRoutes:
+      namespaces:
+        from: Selector
+        selector:
+          matchLabels:
+            gateway-access: "true"

test/checks/gatewayCrossNamespaceCertificateRef/failure.yaml

@@ -0,0 +1,15 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: public
+  namespace: infra
+spec:
+  gatewayClassName: kgateway
+  listeners:
+  - name: https
+    protocol: HTTPS
+    port: 443
+    tls:
+      certificateRefs:
+      - name: wildcard
+        namespace: certificates

test/checks/gatewayCrossNamespaceCertificateRef/success.yaml

@@ -0,0 +1,30 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: public
+  namespace: infra
+spec:
+  gatewayClassName: kgateway
+  listeners:
+  - name: https
+    protocol: HTTPS
+    port: 443
+    tls:
+      certificateRefs:
+      - name: wildcard
+        namespace: certificates
+---
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: ReferenceGrant
+metadata:
+  name: allow-infra-gateway
+  namespace: certificates
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: infra
+  to:
+  - group: ""
+    kind: Secret
+    name: wildcard

test/checks/gatewayInsecureFrontendValidation/failure.yaml

@@ -0,0 +1,15 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: fail-open
+spec:
+  gatewayClassName: kgateway
+  tls:
+    frontend:
+      default:
+        validation:
+          mode: AllowInsecureFallback
+  listeners:
+  - name: https
+    protocol: HTTPS
+    port: 443

test/checks/gatewayInsecureFrontendValidation/success.yaml

@@ -0,0 +1,15 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: fail-closed
+spec:
+  gatewayClassName: kgateway
+  tls:
+    frontend:
+      default:
+        validation:
+          mode: AllowValidOnly
+  listeners:
+  - name: https
+    protocol: HTTPS
+    port: 443

test/checks/gatewayTLSMissing/failure.missing-tls.yaml

@@ -0,0 +1,10 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: missing-tls
+spec:
+  gatewayClassName: kgateway
+  listeners:
+  - name: https
+    protocol: HTTPS
+    port: 443

test/checks/gatewayTLSMissing/failure.yaml

@@ -0,0 +1,13 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: insecure
+spec:
+  gatewayClassName: kgateway
+  listeners:
+  - name: https
+    protocol: HTTPS
+    port: 443
+    tls:
+      mode: Terminate
+      certificateRefs: []

test/checks/gatewayTLSMissing/success.yaml

@@ -0,0 +1,22 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: secure
+spec:
+  gatewayClassName: kgateway
+  listeners:
+  - name: http
+    protocol: HTTP
+    port: 80
+  - name: https
+    protocol: HTTPS
+    port: 443
+    tls:
+      mode: Terminate
+      certificateRefs:
+      - name: example-tls
+  - name: passthrough
+    protocol: TLS
+    port: 8443
+    tls:
+      mode: Passthrough

test/checks/httpRouteBackendTLSMissing/failure.yaml

@@ -0,0 +1,12 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: plaintext-to-tls-backend
+  namespace: app
+spec:
+  hostnames:
+  - app.example.com
+  rules:
+  - backendRefs:
+    - name: api
+      port: 443

test/checks/httpRouteBackendTLSMissing/success.kgateway.yaml

@@ -0,0 +1,39 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: secure-kgateway-backend
+  namespace: app
+spec:
+  hostnames:
+  - app.example.com
+  rules:
+  - backendRefs:
+    - group: gateway.kgateway.dev
+      kind: Backend
+      name: external-api
+---
+apiVersion: gateway.kgateway.dev/v1alpha1
+kind: Backend
+metadata:
+  name: external-api
+  namespace: app
+spec:
+  type: Static
+  static:
+    hosts:
+    - host: api.example.com
+      port: 443
+---
+apiVersion: gateway.kgateway.dev/v1alpha1
+kind: BackendConfigPolicy
+metadata:
+  name: external-api-tls
+  namespace: app
+spec:
+  targetRefs:
+  - group: gateway.kgateway.dev
+    kind: Backend
+    name: external-api
+  tls:
+    sni: api.example.com
+    wellKnownCACertificates: System

test/checks/httpRouteBackendTLSMissing/success.yaml

@@ -0,0 +1,26 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: secure-backend
+  namespace: app
+spec:
+  hostnames:
+  - app.example.com
+  rules:
+  - backendRefs:
+    - name: api
+      port: 443
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: BackendTLSPolicy
+metadata:
+  name: api-tls
+  namespace: app
+spec:
+  targetRefs:
+  - group: ""
+    kind: Service
+    name: api
+  validation:
+    hostname: api.app.svc.cluster.local
+    wellKnownCACertificates: System

test/checks/httpRouteCrossNamespaceBackendRef/failure.yaml

@@ -0,0 +1,13 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: shared-api
+  namespace: app
+spec:
+  hostnames:
+  - app.example.com
+  rules:
+  - backendRefs:
+    - name: api
+      namespace: shared
+      port: 8080

test/checks/httpRouteCrossNamespaceBackendRef/success.yaml

@@ -0,0 +1,28 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: shared-api
+  namespace: app
+spec:
+  hostnames:
+  - app.example.com
+  rules:
+  - backendRefs:
+    - name: api
+      namespace: shared
+      port: 8080
+---
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: ReferenceGrant
+metadata:
+  name: allow-app-route
+  namespace: shared
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    namespace: app
+  to:
+  - group: ""
+    kind: Service
+    name: api

test/checks/httpRouteInsecureListener/failure.yaml

@@ -0,0 +1,31 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: plaintext
+  namespace: app
+spec:
+  parentRefs:
+  - name: public
+    namespace: infra
+    sectionName: http
+  hostnames:
+  - app.example.com
+  rules:
+  - backendRefs:
+    - name: app
+      port: 8080
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: public
+  namespace: infra
+spec:
+  gatewayClassName: kgateway
+  listeners:
+  - name: http
+    protocol: HTTP
+    port: 80
+    allowedRoutes:
+      namespaces:
+        from: All

test/checks/httpRouteInsecureListener/success.unattached-http.yaml

@@ -0,0 +1,31 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: secure-host-only
+  namespace: app
+spec:
+  parentRefs:
+  - name: public
+  hostnames:
+  - app.example.com
+  rules:
+  - backendRefs:
+    - name: app
+      port: 8080
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: public
+  namespace: app
+spec:
+  gatewayClassName: kgateway
+  listeners:
+  - name: unrelated-http
+    hostname: other.example.com
+    protocol: HTTP
+    port: 80
+  - name: app-https
+    hostname: app.example.com
+    protocol: HTTPS
+    port: 443

test/checks/httpRouteInsecureListener/success.yaml

@@ -0,0 +1,37 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: redirect
+  namespace: app
+spec:
+  parentRefs:
+  - name: public
+    namespace: infra
+    sectionName: http
+  hostnames:
+  - app.example.com
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    filters:
+    - type: RequestRedirect
+      requestRedirect:
+        scheme: https
+        statusCode: 301
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: public
+  namespace: infra
+spec:
+  gatewayClassName: kgateway
+  listeners:
+  - name: http
+    protocol: HTTP
+    port: 80
+    allowedRoutes:
+      namespaces:
+        from: All

test/checks/httpRouteWildcardOrEmptyHost/failure.empty.yaml

@@ -0,0 +1,9 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: every-host
+spec:
+  rules:
+  - backendRefs:
+    - name: api
+      port: 8080

test/checks/httpRouteWildcardOrEmptyHost/failure.yaml

@@ -0,0 +1,11 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: wildcard-host
+spec:
+  hostnames:
+  - "*.example.com"
+  rules:
+  - backendRefs:
+    - name: api
+      port: 8080

test/checks/httpRouteWildcardOrEmptyHost/success.yaml

@@ -0,0 +1,11 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: explicit-host
+spec:
+  hostnames:
+  - api.example.com
+  rules:
+  - backendRefs:
+    - name: api
+      port: 8080

test/checks/kgatewayBackendTLSVerificationDisabled/failure.yaml

@@ -0,0 +1,11 @@
+apiVersion: gateway.kgateway.dev/v1alpha1
+kind: BackendConfigPolicy
+metadata:
+  name: unverified
+spec:
+  targetRefs:
+  - group: ""
+    kind: Service
+    name: api
+  tls:
+    insecureSkipVerify: true

test/checks/kgatewayBackendTLSVerificationDisabled/success.yaml

@@ -0,0 +1,12 @@
+apiVersion: gateway.kgateway.dev/v1alpha1
+kind: BackendConfigPolicy
+metadata:
+  name: verified
+spec:
+  targetRefs:
+  - group: ""
+    kind: Service
+    name: api
+  tls:
+    sni: api.example.com
+    wellKnownCACertificates: System