[EPIC] Waypoint Support

[stevenctl]

Waypoint Support

Istio supports telling zTunnel to send PROXY protocol to arbitrary L7 proxies as waypoints, this is colloquially known as sandwiching as that proxy does not need to implement mTLS or HBONE (H2 CONNECT). We can use our Gateway API conformant L7 proxy as a Waypoint.

To deploy a kgateway, Waypoint, one will simply use a separate gateway class: kgateway-waypoint. All the usual Istio APIs for Waypoint configuration will still apply (istio.io/use-waypoint, etc).

Our API support goals are:

• Parity with Istio
  • HTTPRoute - already mostly implemented AND we have delgation
  • AuthorizationPolicy - critical
  • ServiceEntry/WorkloadEntry - critical
  • DestinationRule - currently only have failover
  • VirtualService - this one might be questionable
  • TCPRoute/TLSRoute (only recently merged for Istio waypoint Implement TCPRoute for waypoints istio/istio#55198)

---

Work Items