chore: allow L4 upstream schemes (tcp/tls/udp) in ingress-controller CRDs

[AlinsRan]

Description

The gateway accepts tcp, tls and udp as upstream schemes for L4 proxying, and scheme: tls is what makes the gateway establish the TLS session with a stream upstream (plain TCP in from the client, TLS out to the backend). The CRDs bundled in this chart still restrict ApisixUpstream.spec.scheme and BackendTrafficPolicy.spec.scheme to the L7 set, so on a standard Helm installation the API server rejects tcp/tls/udp before the controller ever sees the resource.

This updates the three scheme fields in charts/ingress-controller/crds/apisix-crds.yaml (top-level and portLevelSettings of ApisixUpstream, plus BackendTrafficPolicy) to match what make helm-build-crds produces from the controller branch, and bumps the chart version.

Only the scheme blocks are touched; the rest of the bundle is left as-is and will be refreshed by the next controller bump.

Note on API7 EE: the Control Plane previously narrowed the stream upstream scheme to tcp/udp; tls is being enabled in api7/api7ee-3-control-plane#2869. Until a Control Plane image with that change is available, scheme: tls is usable against the APISIX provider only.

Summary by CodeRabbit

• New Features

  • Added support for TCP, TLS, and UDP upstream schemes in ingress configuration.
  • Extended protocol options for port-level upstream settings and backend traffic policies.
  • Clarified that Layer 4 protocols apply to stream routes and are not valid for HTTP routes.

• Chores

  • Updated the ingress controller chart version to 0.1.25.

[coderabbitai]

📝 Walkthrough

Walkthrough

The ingress-controller CRD schemas now allow tcp, tls, and udp schemes for upstream and backend traffic policy fields, with L4 stream-route usage documented. The Helm chart version and README badge are updated to 0.1.25.

Changes

Ingress controller scheme support

Layer / File(s)	Summary
Extend CRD scheme contracts charts/ingress-controller/crds/apisix-crds.yaml	ApisixUpstream and BackendTrafficPolicy scheme fields document L7 and L4 protocols and accept tcp, tls, and udp.
Update chart version metadata charts/ingress-controller/Chart.yaml, charts/ingress-controller/README.md	The chart version and README badge change from 0.1.24 to 0.1.25; the application version remains 2.1.0.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
E2e Test Quality Review	⚠️ Warning	No E2E/integration tests were added for the CRD admission and L4 stream flow; the PR only changes chart metadata and schema enums.	Add an isolated Kubernetes E2E that installs the chart, applies tcp/tls/udp in all three scheme fields, verifies admission, and exercises outbound TLS stream routing plus invalid HTTP/L4 combinations.

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The CRD updates address #2803 by allowing scheme: tls, plus tcp and udp, for declarative L4 upstream configuration.
Out of Scope Changes check	✅ Passed	All changes are related to the CRD schema update and its chart metadata version bump; no unrelated code changes are present.
Security Check	✅ Passed	Only chart metadata and three CRD scheme descriptions/enums changed; no logging, secret storage, authorization, ownership, shared-resource, secret-resolution, or TLS implementation code is modified.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: allowing L4 upstream schemes in the ingress-controller CRDs.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/l4-upstream-scheme

---

_{Comment @coderabbitai help to get the list of available commands.}