Update API, Helm, and Metrics reference docs for all versions

assets/kgw-docs/pages/reference/helm/2.4.x/kgateway.md

@@ -64,6 +64,7 @@
 | controller.xds.tls.enabled | bool | Enable TLS encryption for xDS communication. When enabled, the xDS server (port 9977) uses TLS. You must create a Secret named 'kgateway-xds-cert' in the kgateway installation namespace. The Secret must be of type 'kubernetes.io/tls' with 'tls.crt', 'tls.key', and 'ca.crt' data fields present. | `false` |
 | deploymentAnnotations | object | Add annotations to the kgateway deployment. | `{}` |
 | discoveryNamespaceSelectors | list | List of namespace selectors (OR'ed): each entry can use 'matchLabels' or 'matchExpressions' (AND'ed within each entry if used together). Kgateway includes the selected namespaces in config discovery. For more information, see the docs https://kgateway.dev/docs/envoy/latest/install/advanced/#namespace-discovery. | `[]` |
+| enableRouteSourceMetadata | bool | Enable attaching dev.kgateway.route_source filter metadata to every Envoy route. This metadata includes the Kubernetes source object (kind, group, name, namespace, rule) for each route, which helps correlate Envoy routes with their originating Kubernetes resources. Default is false (disabled). Note: This feature is experimental and subject to breaking changes in future releases. | `false` |
 | fullnameOverride | string | Override the full name of resources created by the Helm chart, which is 'kgateway'. If you set 'fullnameOverride: "foo", the full name of the resources that the Helm release creates become 'foo', such as the deployment, service, and service account for the kgateway control plane in the kgateway-system namespace. | `""` |
 | gatewayClassParametersRefs | object | Map of GatewayClass names to GatewayParameters references that will be set on    the default GatewayClasses managed by kgateway. Each entry must define both the    name and namespace of the GatewayParameters resource.    The default GatewayClasses managed by kgateway are:    - kgateway    - kgateway-waypoint    Example:    gatewayClassParametersRefs:      kgateway:        name: shared-gwp        namespace: kgateway-system | `{}` |
 | image | object | Configure the default container image for the components that Helm deploys. You can override these settings for each particular component in that component's section, such as 'controller.image' for the kgateway control plane. If you use your own private registry, make sure to include the imagePullSecrets. | `{"pullPolicy":"IfNotPresent","registry":"cr.kgateway.dev/kgateway-dev","tag":""}` |
@@ -76,6 +77,7 @@
 | podAnnotations | object | Add annotations to the kgateway pods. This field is deprecated in favor of controller.podAnnotations and will be removed in v3.0. | `{}` |
 | podSecurityContext | object | Set the pod-level security context. For example, 'fsGroup: 2000' sets the filesystem group to 2000. This field is deprecated in favor of controller.podSecurityContext and will be removed in v3.0. | `{}` |
 | policyMerge | object | Policy merging settings. Currently, TrafficPolicy's extAuth, extProc, and transformation policies support deep merging. E.g., to enable deep merging of extProc policy in TrafficPolicy: policyMerge:   trafficPolicy:     extProc: DeepMerge | `{}` |
+| rbac | object | Configure RBAC resources (ClusterRole and ClusterRoleBinding) for the deployment. | `{"create":true}` |
 | resources | object | Configure resource requests and limits for the container, such as 'limits.cpu: 100m' or 'requests.memory: 128Mi'. This field is deprecated in favor of controller.resources and will be removed in v3.0. | `{}` |
 | securityContext | object | Set the container-level security context, such as 'runAsNonRoot: true'. This field is deprecated in favor of controller.securityContext and will be removed in v3.0. | `{}` |
 | serviceAccount | object | Configure the service account for the deployment. | `{"annotations":{},"create":true,"name":""}` |

assets/kgw-docs/snippets/main/metrics-control-plane.md

@@ -3,6 +3,10 @@ Name|Type|Labels|Help
 kgateway_controller_reconcile_duration_seconds|histogram|controller, name, namespace|Reconcile duration for controller
 kgateway_controller_reconciliations_running|gauge|controller, name, namespace|Number of reconciliations currently running
 kgateway_controller_reconciliations_total|counter|controller, name, namespace, result|Total number of controller reconciliations
+kgateway_ec2_discovery_endpoints_active|gauge|namespace, name|Current number of active Envoy endpoints discovered for an EC2 Backend
+kgateway_ec2_discovery_error_state|gauge|namespace, name|Whether the most recent EC2 discovery poll for a Backend failed (1) or succeeded (0)
+kgateway_ec2_discovery_poll_duration_seconds|histogram|namespace, name, result|Duration of EC2 endpoint discovery polls per Backend
+kgateway_ec2_discovery_poll_total|counter|namespace, name, result, reason|Total number of EC2 endpoint discovery refresh attempts per Backend
 kgateway_envoy_xds_rejects_active|gauge|gateway_namespace, gateway_name, type_url|Number of xDS responses currently rejected by envoy proxy
 kgateway_envoy_xds_rejects_total|counter|gateway_namespace, gateway_name, type_url|Total number of xDS responses rejected by envoy proxy
 kgateway_resources_managed|gauge|namespace, parent, resource|Current number of resources managed