refactor: remove the dedicated per-account Kura gateway (server + controller + CRD)

What

Removes the dedicated per-account Kura gateway feature end to end. A dedicated gateway was a per-account cloud LoadBalancer — a KuraGateway CR the Go controller reconciled into an ingress-nginx Deployment + Hetzner LB.

Server (Elixir): dropped gateway_assignment, gateway_manifest, and every dedicated-only helper (dedicated_gateway?, hosted_enterprise_account? + the :dedicated_kura_gateway entitlement check, gateway_name/gateway_account_hash/opaque_hash, dedicated_gateway_account_handles, dedicated_gateway_ingress_class_name, gateway_controller_image/gateway_replicas/maybe_put_host_network, gateway_load_balancer_annotations, gateway_name_for_instance, delete_gateway_if_present), the manifest gateway arg, Environment.kura_dedicated_gateway_account_handles (+ env var), the regions.ex config, and Client.delete_kura_gateway + the KuraGateway manifest path. rollout applies only the KuraInstance; destroy just deletes it.

Controller + chart (Go / Helm): the server was the only producer of KuraGateway CRs, so the reconciler is dead — removed kuragateway_controller.go, kuragateway_types.go + its deepcopy funcs, the KuraGatewayReconciler wiring + --gateway-service-account-name flag in main.go, the KuraGateway CRD, the kuragateways RBAC rules, and the gateway-only tests. KuraInstance is now the only Kura CRD.

~1560 lines removed across ~17 files.

Why

Every customer Kura region is now bare-metal host-network (us-east, us-west, eu-central, ca-east). On host-network there is no cloud LB — the gateway binds :443 directly on the box — so gateway_assignment already returned nil for all of them: no dedicated gateway is created anywhere in production. Dead code. It also left an orphan KuraGateway (created before eu-central flipped to host-network) whose pods sit Pending forever on the :443 the shared regional gateway holds. Bare-metal isolation is delivered by the per-account KuraInstance, the per-account egress budget, and per-account failover-IP/DNS — a dedicated box, not a per-account LB.

Safety

• Regional gateways are untouched. They are Helm ingress-nginx releases (kura-<region>-ingress-nginx), not KuraGateway CRs — this can’t affect the gateways carrying customer traffic.
• No deploy-ordering hazard. The deployed server already never creates KuraGateway CRs on host-network regions (#11605), so removing the controller can’t race it.
• No cascade. Helm doesn’t delete CRDs on upgrade — the live CRD and the one orphan CR persist untouched.
• The :dedicated_kura_gateway entitlement is referenced nowhere else (no plan/UI/billing grants it).
• gateway_host_network? is kept (it drives the KuraInstance host-network signals).

One remaining manual step

The live orphan is cleaned once, out of band (read-only kubectl can’t delete): kubectl delete kuragateway kgw-799b0dea3467-eu-central -n kura (deletes the CR; the — now removed — controller had owner refs, so kubectl delete deployment kgw-799b0dea3467-eu-central-controller -n kura also works). The live CRD can be dropped afterward with kubectl delete crd kuragateways.kura.tuist.dev.

Validation

• Server: mix compile clean; mix test .../kubernetes_controller_test.exs → 38 tests, 0 failures (rewritten to assert rollout applies only the KuraInstance and the manifest uses the shared regional ingress class).
• Controller: go build + go vet clean; go test ./... ok in infra/kura-controller.

🤖 Generated with Claude Code

No GitHub comments yet.