Adding Envoy Gateway to a Talos Kubernetes Homelab: Gateway API Listeners per Tier Beside ingress-nginx

Overview

ingress-nginx has been the cluster's only front door since V2, and the public tier had to mirror its wildcard into every namespace that used it. This article stands up Envoy Gateway beside it, the same implementation the edge already runs. It adds one Gateway with a listener per tier, both wildcard Certificates issued again next to it, and a second MetalLB address. Nothing moves off ingress-nginx here. When the article ends, the Gateway answers a 404 with the right certificate on each tier, and the conversions follow as their own appendices.