feat(gateway-api): GEP-713 — Phase 1 (ALB) + Phase 2 (NLB/L4)

.github/workflows/check-gitleaks.yml

@@ -12,7 +12,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-      - uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9
+      - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE}} # Only required for Organizations, not personal accounts.

.github/workflows/check-govulncheck.yml

@@ -9,11 +9,18 @@ jobs:
     if: contains(github.event.head_commit.message, '[build]')
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - name: Scan for Vulnerabilities in Code
-        # Pinned to master HEAD: latest v1.0.4 tag transitively pulls actions/checkout@v4.1.1
-        # and actions/setup-go@v5.0.0 (Node 20). master HEAD pins them to v6.0.2 / v6.2.0 (Node 24).
-        # Switch back to a tagged release once upstream cuts v1.0.5+.
-        uses: golang/govulncheck-action@31f7c5463448f83528bd771c2d978d940080c9fd # master @ 2026-02-26
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          go-version-input: 1.25.10
-          go-package: ./...
+          go-version: 1.25.11
+          check-latest: true
+      - name: Scan for Vulnerabilities in Code
+        # NB: govulncheck is pinned to v1.3.0 (NOT @latest). v1.4.0 links
+        # golang.org/x/tools@v0.46.0, whose SSA call-graph builder panics on
+        # generic code under Go 1.25 ("ForEachElement called on type containing
+        # *types.TypeParam"), crashing the default -scan symbol mode. v1.3.0
+        # links x/tools@v0.44.0 and scans cleanly. The golang/govulncheck-action
+        # only installs @latest, so we invoke govulncheck directly instead.
+        # Revisit once upstream ships a fixed x/tools (then bump or drop the pin).
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@v1.3.0
+          govulncheck -C . -format text ./...

.github/workflows/ci-dev.yml

@@ -20,14 +20,14 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Log in to the GHCR
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Log in to the vCR
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: vcr.vngcloud.vn
           username: ${{ secrets.VCR_USER }}
@@ -45,7 +45,7 @@ jobs:
           echo "COMMIT_SHORT_SHA=$calculatedSha" >> $GITHUB_ENV
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6.16.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           push: true

.github/workflows/publish.yaml

@@ -23,21 +23,21 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Log in to the GHCR
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Log in to the vCR HCM
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: vcr.vngcloud.vn
           username: ${{ secrets.VCR_USER_PRO }}
           password: ${{ secrets.VCR_PASSWORD_PRO }}
 
       - name: Log in to the vCR HAN
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: vcr-han.vngcloud.vn
           username: ${{ secrets.VCR_USER_HAN_PRO }}
@@ -53,7 +53,7 @@ jobs:
         run: echo ${{ github.ref_name }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6.16.0
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           push: true

.golangci.yml

@@ -33,6 +33,9 @@ linters:
         linters:
           - dupl
           - lll
+      - path: "_test\\.go"
+        linters:
+          - unparam
   settings:
     revive:
       rules:

Makefile

@@ -54,6 +54,7 @@ manifests: controller-gen ## Generate WebhookConfiguration, ClusterRole and Cust
 .PHONY: sync-embedded-crds
 sync-embedded-crds: ## Copy generated vks.vngcloud.vn CRDs into the binary-embedded location (pkg/k8s/apis/.../crds).
 	cp config/crd/bases/vks.vngcloud.vn_*.yaml pkg/k8s/apis/vks.vngcloud.vn/crds/
+	cp config/crd/bases/gateway.vks.vngcloud.vn_*.yaml pkg/k8s/apis/vks.vngcloud.vn/crds/ 2>/dev/null || true
 
 .PHONY: generate
 generate: controller-gen ## Generate code containing DeepCopy, DeepCopyInto, and DeepCopyObject method implementations.
@@ -76,6 +77,12 @@ test: manifests generate fmt vet envtest ## Run tests.
 test-e2e:
 	go test ./test/e2e/ -v -ginkgo.v
 
+.PHONY: test-e2e-gateway  # Run Gateway-API e2e against a REAL vngcloud cluster (opt-in).
+# Requires: a real cluster reachable via KUBECONFIG, with the controller already
+# deployed and --enable-gateway-api-alb set. Provisions and tears down real ALBs.
+test-e2e-gateway:
+	RUN_GATEWAY_E2E=true go test ./test/e2e/gateway/ -v -ginkgo.v -timeout 20m
+
 .PHONY: lint
 lint: golangci-lint ## Run golangci-lint linter
 	$(GOLANGCI_LINT) run
@@ -112,7 +119,8 @@ build-pro:
 .PHONY: run
 run: manifests generate fmt vet ## Run a controller from your host.
 	go run ./cmd/main.go --log-level=debug \
-	--metrics-bind-address=:8080 --metrics-secure=false
+	--metrics-bind-address=:8080 --metrics-secure=false \
+	--disable-alb-gateway-controller=false --disable-nlb-gateway-controller=false
 # 	--disable-service-controller \
 # 	--disable-load-balancer-config-controller \
 # 	--disable-ingress-controller \

README.md

@@ -18,6 +18,7 @@ Application Load Balancers automatically.
 
 - **L4 Load Balancing** — Network Load Balancers for `Service` resources of type `LoadBalancer`.
 - **L7 Load Balancing** — Application Load Balancers driven by Kubernetes `Ingress` resources.
+- **Gateway API** — Application Load Balancers driven by `Gateway`/`HTTPRoute`, and Network Load Balancers driven by `TCPRoute`/`UDPRoute`, customised via GEP-713 policy CRDs.
 - **`LoadBalancerConfig` CRD** — Fine-grained control over listeners, pools, policies, and TLS certificates.
 - **`NodeSecurityGroup` CRD** — Declarative management of node security-group rules.
 - **`GlobalLoadBalancerConfig` / `VngcloudGlobalLoadBalancer` CRDs** — Multi-region traffic distribution.
@@ -143,7 +144,7 @@ spec:
 
 More guides:
 
-- [Service (L4)](docs/guide/service.md) · [Ingress (L7)](docs/guide/ingress.md)
+- [Service (L4)](docs/guide/service.md) · [Ingress (L7)](docs/guide/ingress.md) · [Gateway API (ALB)](docs/guide/gateway-api.md) · [Gateway API (NLB)](docs/guide/gateway-nlb.md)
 - [`LoadBalancerConfig` CRD](docs/guide/load-balancer-config.md)
 - [`NodeSecurityGroup` CRD](docs/guide/node-security-group.md)
 - [Global Load Balancer](docs/guide/global-load-balancer.md)
@@ -157,7 +158,9 @@ sources live under [`docs/`](docs/).
 
 ## Roadmap
 
-- [ ] Gateway API support (design phase)
+- [x] Gateway API support — Phase 1: ALB (`Gateway` + `HTTPRoute` + policy CRDs)
+- [x] Gateway API Phase 2: NLB (`TCPRoute`/`UDPRoute`)
+- [ ] Gateway API Phase 3+: `TLSRoute`, `GRPCRoute`, conformance
 - [ ] End-to-end test suite
 - [ ] Validating / mutating webhooks
 - [ ] Out-of-band drift reconciliation (detect external load-balancer changes)

api/gateway/v1alpha1/doc.go

@@ -0,0 +1,4 @@
+// Package v1alpha1 contains API Schema definitions for the gateway.vks.vngcloud.vn v1alpha1 API group.
+// +kubebuilder:object:generate=true
+// +groupName=gateway.vks.vngcloud.vn
+package v1alpha1

api/gateway/v1alpha1/groupversion_info.go

@@ -0,0 +1,12 @@
+package v1alpha1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/controller-runtime/pkg/scheme"
+)
+
+var (
+	GroupVersion  = schema.GroupVersion{Group: "gateway.vks.vngcloud.vn", Version: "v1alpha1"}
+	SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion}
+	AddToScheme   = SchemeBuilder.AddToScheme
+)

api/gateway/v1alpha1/shared_types.go

@@ -0,0 +1,46 @@
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	gwv1alpha2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+)
+
+// LocalPolicyTargetReference is re-exported for convenience.
+// +kubebuilder:object:generate=false
+type LocalPolicyTargetReference = gwv1alpha2.LocalPolicyTargetReference
+
+// LocalPolicyTargetReferenceWithSectionName is re-exported for convenience.
+// +kubebuilder:object:generate=false
+type LocalPolicyTargetReferenceWithSectionName = gwv1alpha2.LocalPolicyTargetReferenceWithSectionName
+
+// PolicyAncestorStatus is re-exported for convenience.
+// +kubebuilder:object:generate=false
+type PolicyAncestorStatus = gwv1alpha2.PolicyAncestorStatus
+
+// CommonPolicyStatus is the embedded ancestor-status block carried by every VKS policy CRD.
+type CommonPolicyStatus struct {
+	// Ancestors records reconcile status per controller acting on this policy.
+	// +listType=atomic
+	// +kubebuilder:validation:MaxItems=16
+	Ancestors []PolicyAncestorStatus `json:"ancestors,omitempty"`
+}
+
+// PolicyConditionType collects the standard reasons used across all four VKS policy CRDs.
+const (
+	PolicyConditionAccepted   = "Accepted"
+	PolicyConditionProgrammed = "Programmed"
+
+	PolicyReasonAccepted          = "Accepted"
+	PolicyReasonConflicted        = "Conflicted"
+	PolicyReasonInvalid           = "Invalid"
+	PolicyReasonTargetNotFound    = "TargetNotFound"
+	PolicyReasonNoReadyController = "NoReadyController"
+	PolicyReasonProgrammed        = "Programmed"
+	PolicyReasonPending           = "Pending"
+)
+
+// CommonStatus is the common subset embedded into each policy's Status.
+type CommonStatus struct {
+	Conditions         []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
+	ObservedGeneration int64              `json:"observedGeneration,omitempty"`
+}

api/gateway/v1alpha1/status_accessors.go

@@ -0,0 +1,25 @@
+package v1alpha1
+
+// GetCommonStatus / GetCommonPolicyStatus expose the embedded status blocks so
+// a generic Direct-policy validator can read and write Conditions + Ancestors
+// uniformly across the four policy CRDs.
+
+func (p *VKSGatewayPolicy) GetCommonStatus() *CommonStatus { return &p.Status.CommonStatus }
+func (p *VKSGatewayPolicy) GetCommonPolicyStatus() *CommonPolicyStatus {
+	return &p.Status.CommonPolicyStatus
+}
+
+func (p *VKSBackendPolicy) GetCommonStatus() *CommonStatus { return &p.Status.CommonStatus }
+func (p *VKSBackendPolicy) GetCommonPolicyStatus() *CommonPolicyStatus {
+	return &p.Status.CommonPolicyStatus
+}
+
+func (p *VKSHealthCheckPolicy) GetCommonStatus() *CommonStatus { return &p.Status.CommonStatus }
+func (p *VKSHealthCheckPolicy) GetCommonPolicyStatus() *CommonPolicyStatus {
+	return &p.Status.CommonPolicyStatus
+}
+
+func (p *VKSRoutePolicy) GetCommonStatus() *CommonStatus { return &p.Status.CommonStatus }
+func (p *VKSRoutePolicy) GetCommonPolicyStatus() *CommonPolicyStatus {
+	return &p.Status.CommonPolicyStatus
+}

api/gateway/v1alpha1/vksbackendpolicy_types.go

@@ -0,0 +1,88 @@
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	pkggw "github.com/vngcloud/vngcloud-load-balancer-controller/pkg/gateway"
+)
+
+// +kubebuilder:object:root=true
+// +kubebuilder:subresource:status
+// +kubebuilder:resource:shortName=vksbpolicy,categories=gateway-api
+// +kubebuilder:metadata:labels=gateway.networking.k8s.io/policy=direct
+// +kubebuilder:printcolumn:name="Targets",type=string,JSONPath=`.spec.targetRefs[*].name`
+// +kubebuilder:printcolumn:name="Accepted",type=string,JSONPath=`.status.conditions[?(@.type=="Accepted")].status`
+// +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
+type VKSBackendPolicy struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	Spec   VKSBackendPolicySpec   `json:"spec,omitempty"`
+	Status VKSBackendPolicyStatus `json:"status,omitempty"`
+}
+
+// +kubebuilder:object:root=true
+type VKSBackendPolicyList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []VKSBackendPolicy `json:"items"`
+}
+
+type VKSBackendPolicySpec struct {
+	// +kubebuilder:validation:MinItems=1
+	// +kubebuilder:validation:MaxItems=16
+	TargetRefs []LocalPolicyTargetReference `json:"targetRefs"`
+
+	// TargetType selects which addresses the controller resolves into pool
+	// members. "ip" puts pod IPs in the pool (works on flat networks /
+	// Cilium native routing). "instance" puts node IPs + nodePort in the
+	// pool (works on overlay networks where pod IPs aren't routable from
+	// the cloud LB). Default is auto-detected from the cluster CNI — same
+	// rule the Ingress controller uses today (Cilium overlay → instance,
+	// native routing → ip).
+	//
+	// This is a controller-side translation toggle, not a vngcloud LB API
+	// field; the resulting member IPs are what gets stored on the cloud
+	// pool. See design spec §1.6.
+	//
+	// +kubebuilder:validation:Enum=instance;ip
+	TargetType *string `json:"targetType,omitempty"`
+
+	// +kubebuilder:validation:Enum=ROUND_ROBIN;LEAST_CONNECTIONS;SOURCE_IP
+	PoolAlgorithm *string `json:"poolAlgorithm,omitempty"`
+
+	// Stickiness enables sticky sessions on the pool. The vngcloud LB API
+	// exposes only an on/off flag; cookie name and TTL are not configurable.
+	Stickiness *bool `json:"stickiness,omitempty"`
+
+	EnableTLSEncryption *bool             `json:"enableTLSEncryption,omitempty"`
+	TargetNodeLabels    map[string]string `json:"targetNodeLabels,omitempty"`
+	ManageDFPMembers    *bool             `json:"manageDFPMembers,omitempty"`
+
+	// ProxyProtocol makes the cloud LB pool speak HAProxy PROXY protocol to its
+	// members, so an L4 (NLB) backend such as an HAProxy/nginx ingress
+	// controller can recover the real client IP behind the load balancer.
+	// Honored only on the NLB (L4) path and only for TCP pools (UDP is
+	// ignored). Mirrors the Service controller's
+	// `vks.vngcloud.vn/enable-proxy-protocol` annotation.
+	ProxyProtocol *bool `json:"proxyProtocol,omitempty"`
+}
+
+type VKSBackendPolicyStatus struct {
+	CommonStatus       `json:",inline"`
+	CommonPolicyStatus `json:",inline"`
+}
+
+// Matches reports whether this policy targets the given PolicyTarget.
+func (p *VKSBackendPolicy) Matches(t pkggw.PolicyTarget) bool {
+	for _, ref := range p.Spec.TargetRefs {
+		if pkggw.TargetRefMatches(ref, p.Namespace, t) {
+			return true
+		}
+	}
+	return false
+}
+
+func init() {
+	SchemeBuilder.Register(&VKSBackendPolicy{}, &VKSBackendPolicyList{})
+}