## Summary The GitLab chart currently supports smartcard authentication exclusively through NGINX Ingress. To achieve full Gateway API support, we need to extend smartcard authentication capabilities to Envoy Gateway and the Kubernetes Gateway API. This requires implementing mutual TLS (mTLS) handling and ensuring client certificates are properly passed to the Rails application. ## Acceptance Criteria - [x] Smartcard authentication is fully functional via Envoy Gateway using the Kubernetes Gateway API https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4850 - [x] client certificate validation handled by Envoy https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4850 - [x] client certificates are correctly passed to the Rails application backend https://gitlab.com/gitlab-org/gitlab/-/merge_requests/226021 - [x] Configuration documentation is updated with Gateway API smartcard setup instructions https://gitlab.com/gitlab-org/charts/gitlab/-/merge_requests/4850 - [x] Existing NGINX Ingress smartcard functionality remains unchanged and continues to work ## Related Documentation - [GitLab Smartcard Authentication](https://docs.gitlab.com/administration/auth/smartcard/) - [Kubernetes Gateway API](https://gateway-api.sigs.k8s.io/) - [Envoy Gateway Documentation](https://gateway.envoyproxy.io/) - [GDK Smartcard instructions](https://gitlab-org.gitlab.io/gitlab-development-kit/howto/smartcard/)