Implement IngressSpec for Kong gateway

[birdmanmandbir]

Summary

IngressSpec is defined in the CRD but not implemented in the controller. The operator does not create Kubernetes Ingress resources even when spec.kong.ingress.enabled: true is set.

Current State

The type is defined with CEL validation:

// +kubebuilder:validation:XValidation:rule="!self.enabled || self.host != ''",message="host is required when ingress is enabled"
type IngressSpec struct {
    Enabled       bool              `json:"enabled"`
    ClassName     string            `json:"className,omitempty"`
    Host          string            `json:"host,omitempty"`
    TLS           bool              `json:"tls,omitempty"`
    TLSSecretName string            `json:"tlsSecretName,omitempty"`
    Annotations   map[string]string `json:"annotations,omitempty"`
}

But there is no code in the controller to:

1. Check if ingress is enabled
2. Build an Ingress resource
3. Create/update the Ingress via the Kubernetes API

Priority

Low - Most users use cloudflared tunnels or external ingress controllers configured outside the operator.

Implementation Notes

When implemented, the controller should:

• Create a networking.k8s.io/v1 Ingress resource
• Route to the Kong service on port 8000
• Support TLS termination with cert-manager or pre-existing secrets
• Apply user-specified annotations (for ingress controller configuration)

Example CR

spec:
  kong:
    ingress:
      enabled: true
      className: nginx
      host: api.example.com
      tls: true
      tlsSecretName: api-tls
      annotations:
        cert-manager.io/cluster-issuer: letsencrypt-prod