[Ramkumar Chinchani (rchincha)]

What type of PR is this?

feature

What this PR does / why we need it:

Implements the GEP-1748 using Azure AFD as the L7 ingress to achieve Zero-Public-Exposure Ingress solution for highly regulated customer environments.

Which issue(s) this PR fixes:

Fixes #

Requirements:

• run make reviewable for basic local test
• Read and followed fleet-networking's Code of conduct.
• uses conventional commit messages
• includes documentation
• adds unit tests

How has this code been tested

Special notes for your reviewer

[codecov]

Codecov Report

❌ Patch coverage is 86.60674% with 298 lines in your changes missing coverage. Please review.
✅ Project coverage is 76.98%. Comparing base (76f455e) to head (05ea818).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/controllers/hub/gatewayresolver/route.go	70.83%	35 Missing and 14 partials ⚠️
pkg/controllers/hub/httproute/controller.go	65.09%	28 Missing and 9 partials ⚠️
cmd/member-net-controller-manager/main.go	32.43%	22 Missing and 3 partials ⚠️
pkg/providers/azure/frontdoor/backend_provision.go	87.56%	12 Missing and 12 partials ⚠️
pkg/controllers/hub/gateway/controller.go	89.84%	12 Missing and 8 partials ⚠️
pkg/controllers/hub/gateway/http_provisioning.go	82.10%	9 Missing and 8 partials ⚠️
pkg/controllers/hub/gatewayclass/controller.go	62.79%	12 Missing and 4 partials ⚠️
cmd/hub-gateway-controller-manager/main.go	85.98%	11 Missing and 4 partials ⚠️
pkg/controllers/hub/gateway/ownership.go	83.33%	6 Missing and 6 partials ⚠️
...kg/controllers/hub/gateway/reference_withdrawal.go	89.21%	6 Missing and 5 partials ⚠️
... and 15 more

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #400      +/-   ##
==========================================
+ Coverage   67.06%   76.98%   +9.92%     
==========================================
  Files          34       73      +39     
  Lines        3859     7165    +3306     
==========================================
+ Hits         2588     5516    +2928     
- Misses       1090     1301     +211     
- Partials      181      348     +167     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Ramkumar Chinchani (rchincha)]

https://github.com/rchincha/fleet-networking/blob/rchinchani/gep-1748-gateway-api/docs/howtos/gateway-api-afd-configuration.md

Controllers for the AFD private HTTP feature

Cluster	Controller manager	Relevant controllers / responsibility
Hub	hub-gateway-controller-manager (new, separate deployment)	GatewayClass, Gateway and HTTPRoute reconcilers. Manages AFD provisioning, approval observation, readiness, withdrawal and cleanup.
Hub	hub-net-controller-manager (existing)	Existing InternalServiceExport / ServiceImport processing supporting backend discovery and transport.
Each member	member-net-controller-manager (existing, extended)	Its serviceexport-controller discovers internal load balancer / Private Link Service metadata and publishes it through InternalServiceExport. No new member controller deployment.

Both feature gates default to off:

• Hub: --enable-afd=true
• Member: --enable-private-link-origin-discovery=true

These are implementation/component names—not confirmation that they are currently installed in your clusters.

Category	Signed Commit ID	Files Changed
Docs	f71c000	12
Controllers, tests and telemetry	962c2d9	93
Build artifacts, packaging and CI	765444e	16
Live-test preparation	05ea818	11
Total	4 commits	132

[Wei Weng (weng271190436)]

Can the new AFD tests be added in a way that you just do

export AZURE_SUBSCRIPTION_ID=""
export AZURE_RESOURCE_GROUP=""
export AZURE_NETWORK_SETTING=shared-vnet
export ENABLE_TRAFFIC_MANAGER=false
export ENABLE_AZURE_FRONT_DOOR=true

and then

make e2e-setup
make e2e-tests
make e2e-cleanup

will test the existing scenarios and the new AFD scenario end to end?

This will help people validating that their new changes don't break the new AFD scenario

[Wei Weng (weng271190436)]

I tried to run the test but the disabled endpoint never became DeploymentStatusSucceeded so everything after profile and endpoint are not getting created, such as route, origin groups, origin etc

Did this work for you?

Also wondering if Deployment Status Succeeded is a necessary gate. Someone on Microsoft Learn said no: https://learn.microsoft.com/en-us/answers/questions/5642906/azure-front-door-endpoint-deployment-stuck-at-nots

Gateway private HTTP proof [It] proves controller-owned private delivery, observed probes, withdrawal and cleanup [afd-private-http-proof]
/home/weiweng/fleet-networking/test/e2e/gateway_private_http_test.go:45

  [FAILED] Timed out after 600.000s.
  Expected success, but got an error:
      <*errors.errorString | 0x230d65eb4530>: 
      origin fleet-origin-e03c32ee1716ecbdb5a30cda2e9fecb3 is Missing, not an observed manual approval request
      {
          s: "origin fleet-origin-e03c32ee1716ecbdb5a30cda2e9fecb3 is Missing, not an observed manual approval request",
      }
  In [It] at: /home/weiweng/fleet-networking/test/e2e/gateway_private_http_test.go:116 @ 10/28/26 18:22:08.582

[Wei Weng (weng271190436)]

Also the Gateway status can be more specific to give more visibility to the users

For above issue, the condition is Programmed: False, and the message is "AFD private HTTP graph: Pending"

It seems that throughout the whole process, the message is either "AFD private HTTP graph: Pending" or "AFD private HTTP graph: Staging"

I wonder if the message can indicate that endpoint deployment status is "Not started"/"in progress" so we are waiting?