Support GW API Backend Protocol Selection

[DuncanDoyle]

kgateway version

1.18.4

Is your feature request related to a problem? Please describe.

According to GEP -1911, GW API implementations, as part of the 1.2.0 stable channel, extended support:

A Gateway implementation MUST recognize the Kubernetes Standard Application Protocols (KEP-3726) for specifying the protocol for a backend reference in a Gateway API *Route resource

Thus when a *Route points to a Kubernetes Service, implementations SHOULD honor the appProtocol field if it is set for the target Service Port.

We should add support for the K8S Service appProtocol directive in our implementation.

Describe the solution you'd like

n.a.

Describe alternatives you've considered

No response

Additional Context

No response

[DuncanDoyle]

Implemented in Gloo Gateway 1.19: https://github.com/solo-io/solo-projects/issues/7824

[DuncanDoyle]

Support for kubernetes.io/h2c app protocol implemented in: #10737

kubernetes.io/ws (WebSockets) and kubernetes.io/wss (WebSockets over TLS) (see: https://gateway-api.sigs.k8s.io/geps/gep-1911/#api-semantics) are not yet supported.

@davidjumani You mentioned that there has been a discussion that:

we don't have a good way to handle websockets to support kubernetes.io/ws && kubernetes.io/wss

Can you elaborate on that. Should I open another ticket to support those Standard Application Protocols?

[jenshu]

• Support for kubernetes.io/h2c was added in feat: support h2c app protocol #10737
  • With this, the HTTPRouteBackendProtocolH2C conformance test now passes
  • We can also add support for the http2, grpc, and grpc-web protocols used by istio, for parity with gloo (i.e. port over feat: support http2 and h2c app protocol solo-io/gloo#10687 from gloo) - I will open a PR for this in kgateway.
• Support for kubernetes.io/ws is being added in support: http upgrades #11198; I will help get this merged
  • With this, the HTTPRouteBackendProtocolWebSocket conformance test now passes
• For kubernetes.io/wss we don't know of anyone who urgently needs this now, so we will defer that to later

[lgadban]

from @yuval-k --
systemCA support for BackendTLSPolicy may help with wss support