Allow setting healthCheckNodePort in GatewayAPI

[sebhoss]

In our setup, we do not rely upon node ports. We can already set gatewayService.spec.allocateLoadBalancerNodePorts: false to close one node port, however the healthCheckNodePort is still opened. Since it cannot be closed, how about allowing setting the HCNP port manually instead of letting Kubernetes pick a random port number. The manually selected port number is easier to use in network policies. Something like this would be perfect for us:

apiVersion: operator.tigera.io/v1
kind: GatewayAPI
metadata:
  name: default
spec:
  gatewayClasses:
    - name: calico
      gatewayService:
        spec:
          healthCheckNodePort: 12345

[electricjesus]

Thanks for filing this.

The Tigera operator renders an Envoy Gateway EnvoyProxy resource, and the fields we expose under gatewayService.spec map directly to upstream KubernetesServiceSpec. As of envoy-gateway main, that struct exposes type, loadBalancerClass, allocateLoadBalancerNodePorts, loadBalancerSourceRanges, loadBalancerIP, and externalTrafficPolicy but not healthCheckNodePort. So even if we added the field to our CRD today, there's nothing to pipe it through; the envoy-gateway service translator never sets it, and kube-apiserver picks next available from cluster nodeport range.

I couldn't find any existing issue or PR on envoyproxy/gateway tracking this.

Path forward:

1. An issue filed or a PR against envoyproxy/gateway to add HealthCheckNodePort *int32 to KubernetesServiceSpec, with CEL validation restricting it to type: LoadBalancer + externalTrafficPolicy: Local (matching k8s rules).
2. Once that's merged and a release is cut, we'll bump the envoy-gateway dependency here and expose the new field on GatewayServiceSpec.

Change seems small; I'll look into driving it and will keep this issue open for tracking. If you'd like to help on the upstream PR, happy to coordinate.

EDIT: Please see the issue (+ PR) I opened below

[sebhoss]

Thanks @electricjesus, this is awesome!