fix(envoy-gateway): make module safe for upgrades, pin v1.9.2

[surrealwolf]

Why

terraform/modules/envoy_gateway could not be used to upgrade Envoy Gateway safely:

• Data-loss landmine: deploy-envoy-gateway.sh deleted all Gateway API CRDs when crd/gateways.gateway.networking.k8s.io didn't contain the string gateway.envoyproxy.io. None of the live clusters' CRDs do (checked on prd), so any re-run would have deleted every Gateway/HTTPRoute/TCPRoute/UDPRoute on prd (game servers + high-command).
• null_resource.deploy_envoy_gateway had no triggers, so bumping envoy_gateway_version was a no-op.
• kubectl apply ... | grep -v ... hid apply failures (no pipefail).
• gateway_api_version was unused and documented as v1.1.0.

What

• Download install.yaml, split CRDs from the rest; SSA-apply CRDs first and wait for Established, then the controller (EG 1.9 requires the Gateway API 1.6 CRDs before the controller is upgraded, otherwise TCP/UDP routes are silently skipped).
• Never delete CRDs.
• Delete the finished eg-gateway-helm-certgen Job before re-apply (its pod template is immutable). certgen does not pass --overwrite, so existing control-plane cert secrets are kept.
• set -o pipefail, kubectl rollout status for the controller, warning if the installed Gateway API bundle differs from gateway_api_version.
• triggers on envoy_gateway_version, gateway_api_version and the script hash (no destroy provisioner, so replacement only re-runs the idempotent install).
• Defaults/example: Envoy Gateway v1.9.2, Gateway API v1.6.1 (EG 1.7.x→GW API 1.4.1, 1.8.x→1.5.1, 1.9.x→1.6.1).
• docs/GATEWAY_API_SETUP.md: remove the "install standard-install v1.0.0 first" step, which would downgrade/strip the experimental CRDs.

Part of the UPGRADE_PLAN P0 item "Envoy Gateway + Gateway API CRDs". The live upgrade is done stepwise (1.7.5 → 1.8.5 → 1.9.2) using this script, then tfvars are bumped and reconciled with a targeted -refresh=false apply.

Testing

• terraform validate passes.
• bash -n passes; CRD/non-CRD splitter verified against v1.7.5, v1.8.5 and v1.9.2 manifests (all documents accounted for).
• All CRD versions currently in status.storedVersions (incl. tlsroutes v1alpha3, referencegrants v1beta1) are still served in each bundle.

Made with Cursor

[cursor]

Approved. Cursor Bugbot completed successfully and did not report findings that need human review. No approval policy required additional review.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}