Figure out Gateway API version compatibility strategy

[ciarams87]

OpenShift often ships with older versions of the Gateway API that are not in sync with our stated compatibility.

We need to figure out a compatibility strategy and possibly update our codebase to reflect this.

The current supported Gateway API version on the latest Openshift (4.19) is v1.2.1. We submitted a conformance profile for v2.0.2 against v1.2.1 kubernetes-sigs/gateway-api#3954

We may want to do the same for v2.2.0 if possible, or at least as new an NGF version as we can.

Going forward, we need to keep this compatibility in mind when updating to newer versions of the Gateway API

[ciarams87]

I ran the 1.2.1 conformance tests against our current Operator deployed NGF - it passed with some caveats

1. GatewayStaticAddresses is not supported in 1.2.1 so that needed to be removed from the extended features
2. HTTPRouteServiceTypes needs to be skipped in an OpenShift environment due to security restrictions
3. We need to amend SCC permissions for the gateway infra service account

These will be documented. For submitting the conformance profile, we should run against a non-OpenShift environment so that we don't need to skip a core test

apiVersion: gateway.networking.k8s.io/v1
date: "2025-10-01T12:41:47Z"
gatewayAPIChannel: standard
gatewayAPIVersion: v1.2.1
implementation:
  contact:
  - https://github.com/nginx/nginx-gateway-fabric/discussions/new/choose
  organization: nginx
  project: nginx-gateway-fabric
  url: https://github.com/nginx/nginx-gateway-fabric
  version: edge
kind: ConformanceReport
mode: default
profiles:
- core:
    result: partial
    skippedTests:
    - HTTPRouteServiceTypes
    statistics:
      Failed: 0
      Passed: 32
      Skipped: 1
  extended:
    result: success
    statistics:
      Failed: 0
      Passed: 18
      Skipped: 0
    supportedFeatures:
    - GatewayHTTPListenerIsolation
    - GatewayInfrastructurePropagation
    - GatewayPort8080
    - HTTPRouteBackendProtocolWebSocket
    - HTTPRouteDestinationPortMatching
    - HTTPRouteHostRewrite
    - HTTPRouteMethodMatching
    - HTTPRouteParentRefPort
    - HTTPRoutePathRedirect
    - HTTPRoutePathRewrite
    - HTTPRoutePortRedirect
    - HTTPRouteQueryParamMatching
    - HTTPRouteRequestMirror
    - HTTPRouteRequestMultipleMirrors
    - HTTPRouteResponseHeaderModification
    - HTTPRouteSchemeRedirect
    unsupportedFeatures:
    - GatewayStaticAddresses
    - HTTPRouteBackendProtocolH2C
    - HTTPRouteBackendRequestHeaderModification
    - HTTPRouteBackendTimeout
    - HTTPRouteRequestTimeout
  name: GATEWAY-HTTP
  summary: Core tests partially succeeded with 1 test skips. Extended tests succeeded.
- core:
    result: success
    statistics:
      Failed: 0
      Passed: 12
      Skipped: 0
  extended:
    result: success
    statistics:
      Failed: 0
      Passed: 1
      Skipped: 0
    supportedFeatures:
    - GatewayHTTPListenerIsolation
    - GatewayInfrastructurePropagation
    - GatewayPort8080
    unsupportedFeatures:
    - GatewayStaticAddresses
  name: GATEWAY-GRPC
  summary: Core tests succeeded. Extended tests succeeded.
succeededProvisionalTests:
- GatewayInfrastructure