[gateway] support direct HTTPRoute backendRefs to VPCService

Routes can now reference a VPCService directly via a backendRef with
group vpc.apoxy.dev and kind VPCService, without a wrapper Backend
object. The translator resolves the reference to the service's
overlay FQDN (<hostname>.<network>.vpc.apoxy.net) and marks the
destination InputDerived so the datapath patcher applies as before.

Add spec.appProtocol to VPCService with the GEP-1911 vocabulary
(kubernetes.io/h2c, grpc) to select the upstream protocol; empty
means HTTP/1.1. The dedicated-mode gateway controller gathers
referenced VPCServices with per-route-kind field indexes and
retranslates on spec changes.

Author: dilyevsky

api/generated/zz_generated.openapi.go

@@ -34,8 +34,24 @@ type VPCServiceSpec struct {
 	// connect; the relay stamps them onto Tunnel metadata labels).
 	// +required
 	Selector *metav1.LabelSelector `json:"selector"`
+
+	// The application protocol the members speak, using the Gateway API
+	// (GEP-1911) vocabulary: "kubernetes.io/h2c" for cleartext HTTP/2 and
+	// "grpc" for gRPC (which implies h2c). Empty means HTTP/1.1. Routes that
+	// reference this service use it to pick the upstream protocol.
+	// +optional
+	AppProtocol string `json:"appProtocol,omitempty"`
 }
 
+// Application protocol values accepted in spec.appProtocol.
+const (
+	// AppProtocolH2C selects cleartext HTTP/2 (GEP-1911 standard value).
+	AppProtocolH2C = "kubernetes.io/h2c"
+
+	// AppProtocolGRPC selects gRPC, which is carried over cleartext HTTP/2.
+	AppProtocolGRPC = "grpc"
+)
+
 // MembershipSelector converts spec.selector into the label selector used to
 // pick member Tunnels, and is the single definition of which selectors are
 // usable as a membership rule.

api/vpc/v1alpha1/vpcservice_types.go

@@ -87,5 +87,15 @@ func (s *VPCService) validate() field.ErrorList {
 		}
 	}
 
+	// The protocol vocabulary is closed (GEP-1911): a value the route
+	// translator does not know would silently fall back to HTTP/1.1, which
+	// for a gRPC backend is a runtime failure with no admission-time signal.
+	switch s.Spec.AppProtocol {
+	case "", AppProtocolH2C, AppProtocolGRPC:
+	default:
+		errs = append(errs, field.NotSupported(field.NewPath("spec", "appProtocol"),
+			s.Spec.AppProtocol, []string{AppProtocolH2C, AppProtocolGRPC}))
+	}
+
 	return errs
 }

api/vpc/v1alpha1/vpcservice_validate.go

@@ -32,6 +32,7 @@ import (
 	extensionsv1alpha2 "github.com/apoxy-dev/apoxy/api/extensions/v1alpha2"
 	gatewayv1 "github.com/apoxy-dev/apoxy/api/gateway/v1"
 	gatewayv1alpha2 "github.com/apoxy-dev/apoxy/api/gateway/v1alpha2"
+	vpcv1alpha1 "github.com/apoxy-dev/apoxy/api/vpc/v1alpha1"
 )
 
 func Install(scheme *runtime.Scheme) {
@@ -54,6 +55,11 @@ const (
 	serviceTLSRouteIndex  = "serviceTLSRouteIndex"
 	gatewayInfraRefIndex  = "gatewayInfraRefIndex"
 	edgeFunctionLiveIndex = "edgeFunctionLiveIndex"
+
+	vpcServiceHTTPRouteIndex = "vpcServiceHTTPRouteIndex"
+	vpcServiceTCPRouteIndex  = "vpcServiceTCPRouteIndex"
+	vpcServiceUDPRouteIndex  = "vpcServiceUDPRouteIndex"
+	vpcServiceTLSRouteIndex  = "vpcServiceTLSRouteIndex"
 )
 
 var (
@@ -173,6 +179,9 @@ func (r *GatewayReconciler) Reconcile(ctx context.Context, request reconcile.Req
 		if err := r.reconcileBackends(clog.IntoContext(ctx, log), res); err != nil {
 			log.Error(err, "Failed to reconcile BackendRefs for GatewayClass", "name", gwc.Name)
 		}
+		if err := r.reconcileVPCServices(clog.IntoContext(ctx, log), res); err != nil {
+			log.Error(err, "Failed to reconcile VPCServices for GatewayClass", "name", gwc.Name)
+		}
 		if r.watchK8s {
 			if err := r.reconcileServices(clog.IntoContext(ctx, log), res); err != nil {
 				log.Error(err, "Failed to reconcile Services for GatewayClass", "name", gwc.Name)
@@ -616,6 +625,66 @@ func (r *GatewayReconciler) reconcileBackends(
 	return nil
 }
 
+// reconcileVPCServices collects the VPCServices referenced by at least one
+// route into the translation snapshot. The translator only reads the spec
+// (hostname, networkRef, appProtocol) to mint the vpc-zone FQDN; membership
+// changes flow through the endpoint plane and do not pass through here.
+func (r *GatewayReconciler) reconcileVPCServices(
+	ctx context.Context,
+	res *gatewayapi.Resources,
+) error {
+	log := clog.FromContext(ctx)
+
+	var vsl vpcv1alpha1.VPCServiceList
+	if err := r.List(ctx, &vsl); err != nil {
+		return fmt.Errorf("failed to list VPCServices: %w", err)
+	}
+
+	for _, s := range vsl.Items {
+		if !s.DeletionTimestamp.IsZero() {
+			log.Info("VPCService is being deleted", "name", s.Name)
+			continue
+		}
+
+		var hasRouteRef bool
+
+		var hrsl gatewayv1.HTTPRouteList
+		if err := r.List(ctx, &hrsl, client.MatchingFields{vpcServiceHTTPRouteIndex: string(s.Name)}); err != nil {
+			return fmt.Errorf("failed to list HTTPRoutes for VPCService %s: %w", s.Name, err)
+		}
+		hasRouteRef = hasRouteRef || len(hrsl.Items) > 0
+
+		var trsl gatewayv1alpha2.TCPRouteList
+		if err := r.List(ctx, &trsl, client.MatchingFields{vpcServiceTCPRouteIndex: string(s.Name)}); err != nil {
+			return fmt.Errorf("failed to list TCPRoutes for VPCService %s: %w", s.Name, err)
+		}
+		hasRouteRef = hasRouteRef || len(trsl.Items) > 0
+
+		var ursl gatewayv1alpha2.UDPRouteList
+		if err := r.List(ctx, &ursl, client.MatchingFields{vpcServiceUDPRouteIndex: string(s.Name)}); err != nil {
+			return fmt.Errorf("failed to list UDPRoutes for VPCService %s: %w", s.Name, err)
+		}
+		hasRouteRef = hasRouteRef || len(ursl.Items) > 0
+
+		var tlsrsl gatewayv1alpha2.TLSRouteList
+		if err := r.List(ctx, &tlsrsl, client.MatchingFields{vpcServiceTLSRouteIndex: string(s.Name)}); err != nil {
+			return fmt.Errorf("failed to list TLSRoutes for VPCService %s: %w", s.Name, err)
+		}
+		hasRouteRef = hasRouteRef || len(tlsrsl.Items) > 0
+
+		if !hasRouteRef {
+			log.V(1).Info("No matching Route objects found for VPCService", "name", s.Name)
+			continue
+		}
+
+		log.V(1).Info("Reconciling VPCService", "name", s.Name)
+
+		res.VPCServices = append(res.VPCServices, &s)
+	}
+
+	return nil
+}
+
 func (r *GatewayReconciler) reconcileServices(
 	ctx context.Context,
 	res *gatewayapi.Resources,
@@ -845,6 +914,64 @@ func (r *GatewayReconciler) SetupWithManager(ctx context.Context, mgr ctrl.Manag
 			return fmt.Errorf("failed to setup field indexer: %w", err)
 		}
 	}
+	// Indexes each route type by the name of the referenced VPCService
+	// object, mirroring the Backend indexes above.
+	if err := mgr.GetFieldIndexer().IndexField(ctx, &gatewayv1.HTTPRoute{}, vpcServiceHTTPRouteIndex, func(obj client.Object) []string {
+		route := obj.(*gatewayv1.HTTPRoute)
+		var services []string
+		for _, rule := range route.Spec.Rules {
+			for _, backend := range rule.BackendRefs {
+				if backend.Kind != nil && *backend.Kind == "VPCService" {
+					services = append(services, string(backend.Name))
+				}
+			}
+		}
+		return services
+	}); err != nil {
+		return fmt.Errorf("failed to setup field indexer: %w", err)
+	}
+	if err := mgr.GetFieldIndexer().IndexField(ctx, &gatewayv1alpha2.TCPRoute{}, vpcServiceTCPRouteIndex, func(obj client.Object) []string {
+		route := obj.(*gatewayv1alpha2.TCPRoute)
+		var services []string
+		for _, rule := range route.Spec.Rules {
+			for _, backend := range rule.BackendRefs {
+				if backend.Kind != nil && *backend.Kind == "VPCService" {
+					services = append(services, string(backend.Name))
+				}
+			}
+		}
+		return services
+	}); err != nil {
+		return fmt.Errorf("failed to setup field indexer: %w", err)
+	}
+	if err := mgr.GetFieldIndexer().IndexField(ctx, &gatewayv1alpha2.UDPRoute{}, vpcServiceUDPRouteIndex, func(obj client.Object) []string {
+		route := obj.(*gatewayv1alpha2.UDPRoute)
+		var services []string
+		for _, rule := range route.Spec.Rules {
+			for _, backend := range rule.BackendRefs {
+				if backend.Kind != nil && *backend.Kind == "VPCService" {
+					services = append(services, string(backend.Name))
+				}
+			}
+		}
+		return services
+	}); err != nil {
+		return fmt.Errorf("failed to setup field indexer: %w", err)
+	}
+	if err := mgr.GetFieldIndexer().IndexField(ctx, &gatewayv1alpha2.TLSRoute{}, vpcServiceTLSRouteIndex, func(obj client.Object) []string {
+		route := obj.(*gatewayv1alpha2.TLSRoute)
+		var services []string
+		for _, rule := range route.Spec.Rules {
+			for _, backend := range rule.BackendRefs {
+				if backend.Kind != nil && *backend.Kind == "VPCService" {
+					services = append(services, string(backend.Name))
+				}
+			}
+		}
+		return services
+	}); err != nil {
+		return fmt.Errorf("failed to setup field indexer: %w", err)
+	}
 	// Index EdgeFunction objects that are ready.
 	if err := mgr.GetFieldIndexer().IndexField(ctx, &extensionsv1alpha2.EdgeFunction{}, edgeFunctionLiveIndex, func(obj client.Object) []string {
 		if obj.(*extensionsv1alpha2.EdgeFunction).Status.LiveRevision != "" {
@@ -905,6 +1032,11 @@ func (r *GatewayReconciler) SetupWithManager(ctx context.Context, mgr ctrl.Manag
 			handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
 			builder.WithPredicates(generationOrDeletion),
 		).
+		Watches(
+			&vpcv1alpha1.VPCService{},
+			handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+			builder.WithPredicates(generationOrDeletion),
+		).
 		Watches(
 			&extensionsv1alpha2.EdgeFunction{},
 			handler.EnqueueRequestsFromMapFunc(r.enqueueClass),

pkg/apiserver/gateway/gateway.go

@@ -22,6 +22,7 @@ import (
 
 	corev1alpha2 "github.com/apoxy-dev/apoxy/api/core/v1alpha2"
 	extensionsv1alpha2 "github.com/apoxy-dev/apoxy/api/extensions/v1alpha2"
+	vpcv1alpha1 "github.com/apoxy-dev/apoxy/api/vpc/v1alpha1"
 )
 
 const (
@@ -63,6 +64,7 @@ type Resources struct {
 	EdgeFunctionBackends  []*extensionsv1alpha2.EdgeFunction         `json:"edgeFunctionBackends,omitempty" yaml:"edgeFunctionBackends,omitempty"`
 	EdgeFunctionRevisions []*extensionsv1alpha2.EdgeFunctionRevision `json:"edgeFunctionFilters,omitempty" yaml:"edgeFunctionFilters,omitempty"`
 	Backends              []*corev1alpha2.Backend                    `json:"backends,omitempty" yaml:"backends,omitempty"`
+	VPCServices           []*vpcv1alpha1.VPCService                  `json:"vpcServices,omitempty" yaml:"vpcServices,omitempty"`
 	Proxies               []*corev1alpha2.Proxy                      `json:"proxies,omitempty" yaml:"proxies,omitempty"`
 	DirectResponses       []*extensionsv1alpha2.DirectResponse       `json:"directResponses,omitempty" yaml:"directResponses,omitempty"`
 }
@@ -171,6 +173,15 @@ func (r *Resources) GetBackend(name string) *corev1alpha2.Backend {
 	return nil
 }
 
+func (r *Resources) GetVPCService(name string) *vpcv1alpha1.VPCService {
+	for _, svc := range r.VPCServices {
+		if svc.Name == name {
+			return svc
+		}
+	}
+	return nil
+}
+
 func (r *Resources) GetProxy(name string) (*corev1alpha2.Proxy, bool) {
 	for _, proxy := range r.Proxies {
 		if proxy.Name == name {

pkg/gateway/gatewayapi/resource.go

@@ -30,6 +30,7 @@ import (
 	v1alpha2 "github.com/apoxy-dev/apoxy/api/core/v1alpha2"
 	extensionsv1alpha2 "github.com/apoxy-dev/apoxy/api/extensions/v1alpha2"
 	agwapiv1a1 "github.com/apoxy-dev/apoxy/api/gateway/v1"
+	vpcv1alpha1 "github.com/apoxy-dev/apoxy/api/vpc/v1alpha1"
 )
 
 const (
@@ -1355,6 +1356,19 @@ func (t *Translator) processDestination(
 			return nil
 		}
 		ds.Filters = t.processDestinationFilters(routeType, backendRefContext, parentRef, route, resources)
+	case KindVPCService:
+		var err error
+		ds, err = t.processVPCServiceDestinationSetting(backendRef.BackendObjectReference, protocol, resources)
+		if err != nil {
+			log.Errorf("failed to process VPCService ref %s: %v", backendRef.Name, err)
+			parentRef.SetCondition(route,
+				gwapiv1.RouteConditionResolvedRefs,
+				metav1.ConditionFalse,
+				gwapiv1a2.RouteReasonResolvedRefs,
+				err.Error())
+			return nil
+		}
+		ds.Filters = t.processDestinationFilters(routeType, backendRefContext, parentRef, route, resources)
 	case KindEdgeFunction:
 		log.DefaultLogger.Debug("Processing edge function backend ref", "name", backendRef.Name)
 
@@ -1702,6 +1716,49 @@ func (t *Translator) processBackendDestinationSetting(backendRef gwapiv1.Backend
 	return &ds, nil
 }
 
+// processVPCServiceDestinationSetting resolves a backendRef of kind
+// VPCService into the service's vpc-zone FQDN
+// (<hostname>.<network>.vpc.apoxy.net). The FQDN is the whole contract: the
+// translator emits a STRICT_DNS cluster for it and the cloud xDS patch layer
+// rewrites vpc-zone clusters to overlay EDS. The service's member endpoints
+// are therefore not read here. The upstream protocol comes from
+// spec.appProtocol (GEP-1911 vocabulary); the port must come from the
+// backendRef because a VPCService carries no port of its own.
+func (t *Translator) processVPCServiceDestinationSetting(
+	backendRef gwapiv1.BackendObjectReference,
+	protocol ir.AppProtocol,
+	resources *Resources,
+) (*ir.DestinationSetting, error) {
+	if backendRef.Port == nil {
+		return nil, errors.New("port is required for VPCService reference")
+	}
+	port := int(*backendRef.Port)
+	if port < 1 || port > 65535 {
+		return nil, fmt.Errorf("invalid port %d", port)
+	}
+	svc := resources.GetVPCService(string(backendRef.Name))
+	if svc == nil {
+		return nil, fmt.Errorf("VPCService %q not found", backendRef.Name)
+	}
+
+	switch svc.Spec.AppProtocol {
+	case vpcv1alpha1.AppProtocolH2C:
+		protocol = ir.HTTP2
+	case vpcv1alpha1.AppProtocolGRPC:
+		protocol = ir.GRPC
+	}
+
+	return &ir.DestinationSetting{
+		InputDerived: true,
+		Protocol:     protocol,
+		AddressType:  ptr.To(ir.FQDN),
+		Endpoints: []*ir.DestinationEndpoint{{
+			Host: apoxynet.VPCServiceFQDN(svc.DNSHostname(), svc.Spec.NetworkRef.Name),
+			Port: uint32(port),
+		}},
+	}, nil
+}
+
 func (t *Translator) processEdgeFunctionDestinationSetting(
 	backendRef gwapiv1.BackendObjectReference,
 	protocol ir.AppProtocol,

pkg/gateway/gatewayapi/route.go

@@ -30,13 +30,15 @@ const (
 	KindService             = "Service"
 	KindServiceImport       = "ServiceImport"
 	KindBackend             = "Backend"
+	KindVPCService          = "VPCService"
 	KindEdgeFunction        = "EdgeFunction"
 	KindSecret              = "Secret"
 	KindSecurityPolicy      = "SecurityPolicy"
 
 	GroupApoxyCore           = "core.apoxy.dev"
 	GroupApoxyExtensions     = "extensions.apoxy.dev"
 	GroupApoxyCompute        = "compute.apoxy.dev"
+	GroupApoxyVPC            = "vpc.apoxy.dev"
 	GroupMultiClusterService = "multicluster.x-k8s.io"
 
 	// OwningGatewayNamespaceLabel is the owner reference label used for managed infra.

pkg/gateway/gatewayapi/translator.go

@@ -69,7 +69,7 @@ func (t *Translator) validateBackendRef(backendRefContext BackendRefContext, par
 }
 
 func (t *Translator) validateBackendRefGroup(backendRef *gwapiv1a2.BackendRef, parentRef *RouteParentContext, route RouteContext) bool {
-	accepted := []string{GroupApoxyCore, GroupApoxyExtensions, GroupApoxyCompute, GroupMultiClusterService}
+	accepted := []string{GroupApoxyCore, GroupApoxyExtensions, GroupApoxyCompute, GroupApoxyVPC, GroupMultiClusterService}
 	if backendRef.Group != nil &&
 		*backendRef.Group != "" &&
 		!sets.NewString(accepted...).Has(string(*backendRef.Group)) {
@@ -86,7 +86,7 @@ func (t *Translator) validateBackendRefGroup(backendRef *gwapiv1a2.BackendRef, p
 }
 
 func (t *Translator) validateBackendRefKind(backendRef *gwapiv1a2.BackendRef, parentRef *RouteParentContext, route RouteContext) bool {
-	accepted := []string{KindService, KindServiceImport, KindBackend, KindEdgeFunction}
+	accepted := []string{KindService, KindServiceImport, KindBackend, KindEdgeFunction, KindVPCService}
 	if backendRef.Kind != nil && !sets.NewString(accepted...).Has(string(*backendRef.Kind)) {
 		parentRef.SetCondition(route,
 			gwapiv1.RouteConditionResolvedRefs,