Enhance Envoy Gateway multi-gateway config mode

[japerezjr]

Summary

This PR enhances the Envoy Gateway deployment path so operators can opt into a config-driven internal/external Gateway API layout while preserving the existing default behavior when no new flags or config file are provided.

What changed

• Added config-file support for bin/install-envoy-gateway.sh and bin/setup-envoy-gateway.sh.
• Added support for separate external and internal gateways.
• Added per-gateway GatewayClass rendering, including external-eg and internal-eg.
• Added route exposure controls so HTTPRoutes can be external only, internal only, or both.
• Added optional ACME HTTP01 issuer generation for config-mode deployments.
• Added config-mode kustomize resources for Envoy Gateway prerequisites.
• Added hyperconverged lab support for Envoy config mode, including internal MetalLB pool generation and allowed-address reconciliation.
• Added HYPERCONVERGED_ENVOY_GATEWAY_ACME=true / --envoy-gateway-acme for lab testing with external per-service HTTPS listeners and Let us Encrypt issuer config.
• Added an example multi-gateway config at examples/envoy-multi-gateway-config.yaml.
• Ignored local agent/bead metadata so .beads/, AGENTS.md, and .gitattributes do not enter future commits.

Backward compatibility

The existing no-config path is preserved. Running the Envoy setup/install scripts without the new config options keeps the legacy flex-gateway deployment behavior.

Hyperconverged lab usage

Default config-mode lab:

export HYPERCONVERGED_DEV=true
export HYPERCONVERGED_ENVOY_GATEWAY_CONFIG=true
./scripts/hyperconverged-lab.sh kubespray

ACME-oriented lab mode with per-service external listeners:

export HYPERCONVERGED_DEV=true
export HYPERCONVERGED_ENVOY_GATEWAY_CONFIG=true
export HYPERCONVERGED_ENVOY_GATEWAY_ACME=true
export GATEWAY_DOMAIN=<real-domain>
export ACME_EMAIL=<email>
./scripts/hyperconverged-lab.sh kubespray

Validation

• bash -n bin/setup-envoy-gateway.sh
• bash -n bin/install-envoy-gateway.sh
• bash -n scripts/lib/hyperconverged-common.sh
• shellcheck bin/setup-envoy-gateway.sh bin/install-envoy-gateway.sh
• Render smoke test for hyperconverged Envoy ACME config confirmed:
  • external-eg
  • internal-eg
  • external issuer: letsencrypt-prod
  • internal issuer: flex-gateway-issuer
  • per-service sections such as keystone-https and nova-https

Notes

Wildcard certificates still require DNS01 if Let us Encrypt wildcard issuance is needed. The ACME config added here is intended for HTTP01 and per-service hostnames/listeners.

[japerezjr]

Added an HTTPRoute cutover cleanup helper in bin/cleanup-envoy-httproutes.sh.

Usage before cutover:

sudo /opt/genestack/bin/cleanup-envoy-httproutes.sh snapshot \
  --output /etc/genestack/envoy-httproutes-before-cutover.json

After cutover, preview cleanup:

sudo /opt/genestack/bin/cleanup-envoy-httproutes.sh cleanup \
  --snapshot /etc/genestack/envoy-httproutes-before-cutover.json

Execute cleanup:

sudo /opt/genestack/bin/cleanup-envoy-httproutes.sh cleanup \
  --snapshot /etc/genestack/envoy-httproutes-before-cutover.json \
  --execute

The cleanup is naming-agnostic: it deletes only pre-cutover HTTPRoutes from the snapshot that still have the same UID and still reference the legacy Gateway, defaulting to flex-gateway. This avoids relying on route name patterns and skips routes that were recreated or already moved to a new Gateway.

[japerezjr]

Moved the HTTPRoute cutover cleanup helper from bin/ to scripts/ so it follows the repository convention that bin/ is reserved for install/setup entrypoints.

Updated path:

sudo /opt/genestack/scripts/cleanup-envoy-httproutes.sh snapshot \
  --output /etc/genestack/envoy-httproutes-before-cutover.json

sudo /opt/genestack/scripts/cleanup-envoy-httproutes.sh cleanup \
  --snapshot /etc/genestack/envoy-httproutes-before-cutover.json

sudo /opt/genestack/scripts/cleanup-envoy-httproutes.sh cleanup \
  --snapshot /etc/genestack/envoy-httproutes-before-cutover.json \
  --execute

[rackerchris]

LGTM +1