feat: support allowed gateways in tenant namespace rules

[Copilot]

Capsule previously only restricted GatewayClass usage at the tenant level. This adds per-namespace enforcement of which Gateway objects HTTPRoute resources may reference, plus optional default Gateway injection.

New types (pkg/api/gateway_rule.go)

• GatewayNamespacedName — namespaced ref to a Gateway
• AllowedGatewaySpec — explicit allow list, label selector, and optional default Gateway
• GatewayRuleSpec — top-level gateway enforcement rule for a namespace

API extension

• NamespaceRuleEnforceBody gains a gateways *GatewayRuleSpec field; gateway rules use last-wins merge semantics across matching namespace rules (consistent with how a single constraint is applied, vs. registries which aggregate)

HTTPRoute validation webhook (internal/webhook/httproute/)

• Validates HTTPRoute.spec.parentRefs against the resolved namespace rule; denies routes referencing Gateways not in the allow list or label selector
• Follows the TypedTenantWithRulesetHandler pattern used by pod/registry validation

HTTPRoute default mutation (internal/webhook/defaults/httproute.go)

• Injects the configured default Gateway parentRef when an HTTPRoute has no parentRefs

Helm chart

• Added httproutes validating and mutating webhook configs (mirroring the gateways structure)
• Added missing reinvocationPolicy to existing gateways mutating webhook values
• Updated CRD schemas for tenants and rulestatuses

Example

spec:
  rules:
    - enforce:
        gateways:
          gateway:
            default:
              name: tenant-default
              namespace: tenant-system-ns
            matchLabels:
              env: production
            allowed:
              - name: my-gateway
                namespace: gateway-ns

---

📱 Kick off Copilot coding agent tasks wherever you are with GitHub Mobile, available on iOS and Android.