Support for Hetzner Load Balancer setup for Cilium Gateway API

[safizn]

Description

When replacing Kubernetes' native Gateway API controller or Ingress controller with Cilium Gateway API, the Hetzner Cloud load balancer is no longer being created and configured automatically with Cilium's gateway. Because Cilium Gateway doesn't rely on controllers as in the standard setup it lacks support for this feature (as explained in https://docs.cilium.io/en/stable/network/servicemesh/gateway-api/gateway-api/#how-cilium-ingress-and-gateway-api-differ-from-other-ingress-controllers).

The issue turned out to be in the CRDs being missing and are strictly required before the installation of Cillium begins.

[safizn]

The Cilium Helm values configuration I use. Still trying to figure out how to set it up correctly wit Hetzner load balancer, or maybe change the mode of Cilium's operation.

# https://github.com/cilium/cilium/blob/main/install/kubernetes/cilium/values.yaml

# Enable Kubernetes host-scope IPAM mode (required for K3s + Hetzner CCM)
ipam:
  mode: kubernetes
k8s:
  requireIPv4PodCIDR: true

# Replace kube-proxy with Cilium
kubeProxyReplacement: true
l7Proxy: true

# Enable health check server (healthz) for the kube-proxy replacement
kubeProxyReplacementHealthzBindAddr: "0.0.0.0:10256"

# Access to Kube API Server (mandatory if kube-proxy is disabled)
k8sServiceHost: "127.0.0.1"
k8sServicePort: "6444"

# Set Tunnel Mode or Native Routing Mode (supported by Hetzner CCM Route Controller)
routingMode: "native"
# Set the native routable CIDR
ipv4NativeRoutingCIDR: "10.42.0.0/16"

# Bypass iptables Connection Tracking for Pod traffic (only works in Native Routing Mode)
installNoConntrackIptablesRules: true

endpointRoutes:
  # Enable use of per endpoint routes instead of routing via the cilium_host interface.
  enabled: true

loadBalancer:
  # Enable LoadBalancer & NodePort XDP Acceleration (direct routing (routingMode=native) is recommended to achieve optimal performance)
  acceleration: native

bpf:
  # Enable eBPF-based Masquerading ("The eBPF-based implementation is the most efficient implementation")
  masquerade: true

hubble:
  relay:
    enabled: true
  ui:
    enabled: true
  # https://docs.cilium.io/en/stable/observability/metrics/#hubble-metrics
  metrics:
    enabled:
      # HTTP Metrics
      - "httpV2:sourceContext=workload-name|app|pod;destinationContext=workload-name|app|pod|dns;labelsContext=source_namespace,destination_namespace"
      # Policy Metrics
      - "policy:sourceContext=workload-name|app|pod;destinationContext=workload-name|app|pod|dns;labelsContext=source_namespace,destination_namespace"
  tls:
    auto:
      enabled: true
      method: cronJob # generate certificates using hubble's hubblecertgen (check the hubblecertgen section for more details in cilium's helm values file)
      certValidityDuration: 1095

MTU: 1450

gatewayAPI:
  enabled: true

[safizn]

postinstall_exec and preinstall_exec both produce errors. It seems I better just patch the init.tf file adding extra commands to install in the appropriate place.

postinstall_exec = [
    "printf 'Installing Cilium Gateway API controller...\n'",
    "kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/gateway-api/v1.1.0/config/crd/standard/gateway.networking.k8s.io_gatewayclasses.yaml",
    "kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/gateway-api/v1.1.0/config/crd/standard/gateway.networking.k8s.io_gateways.yaml",
    "kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/gateway-api/v1.1.0/config/crd/standard/gateway.networking.k8s.io_httproutes.yaml",
    "kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/gateway-api/v1.1.0/config/crd/standard/gateway.networking.k8s.io_referencegrants.yaml",
    "kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/gateway-api/v1.1.0/config/crd/standard/gateway.networking.k8s.io_grpcroutes.yaml",
    "kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/gateway-api/v1.1.0/config/crd/experimental/gateway.networking.k8s.io_tlsroutes.yaml",
  ]

[mysticaltech]

@safizn That's just a config issue, try both chatgpt o1 and deepseek search.

[safizn]

Could be it doesn't matter. Just created a patch script that runs before Terraform. Thanks