chore: update ingress ownership defaults and streamline fallback handling

- Changed GitLab ingress default ownership in GKE/k8s mode from `operator` to `fallback` for explicit GCE ingress path anchoring.
- Added logic to clean up stale operator-managed ingresses when fallback ownership is selected.
- Simplified fallback ingress creation workflow by removing redundant skip logic.
- Updated relevant tests to reflect ownership changes and ingress handling enhancements.

etc/init_gitlab.sh

@@ -2400,11 +2400,9 @@ GITLAB_INGRESS_CLASS="${GITLAB_INGRESS_CLASS:-$_default_gitlab_ingress_class}"
 # Single GitLab front-door owner model.
 # - operator: GitLab chart/operator-managed ingress owns ${GITLAB_PUBLIC_HOSTS}
 # - fallback: custom fallback ingress (gitlab-kong-ingress) owns ${GITLAB_PUBLIC_HOSTS}
-# In k8s/GKE mode, default to operator ownership to avoid dual-ingress host claims.
+# In k8s/GKE mode, default to fallback ownership so GitLab frontdoor remains
+# anchored on the explicit GCE ingress path.
 _default_gitlab_frontdoor_owner="fallback"
-if [[ "$MODE" == "k8s" ]]; then
-  _default_gitlab_frontdoor_owner="operator"
-fi
 GITLAB_FRONTDOOR_OWNER="${GITLAB_FRONTDOOR_OWNER:-$_default_gitlab_frontdoor_owner}"
 GITLAB_FRONTDOOR_OWNER="${GITLAB_FRONTDOOR_OWNER,,}"
 case "$GITLAB_FRONTDOOR_OWNER" in
@@ -4386,16 +4384,20 @@ if [[ "$GITLAB_FRONTDOOR_OWNER" == "operator" ]]; then
       warn "Failed to delete stale fallback ingress ${NAMESPACE}/gitlab-kong-ingress."
   fi
 else
-  _skip_gitlab_fallback_ingress=0
   if assert_unique_ingress_host_claims "gitlab-kong-ingress" "$NAMESPACE" "$_gitlab_hosts_csv" "$GITLAB_RELEASE" "$WEBSERVICE_SVC"; then
     :
   else
     _ingress_claim_rc=$?
     case "$_ingress_claim_rc" in
       10)
-        _skip_gitlab_fallback_ingress=1
-        log "Operator-managed ingress already owns GitLab host/path in namespace '${NAMESPACE}': ${INGRESS_HOST_CLAIM_DETAILS}"
-        log "Skipping fallback ingress creation for GitLab release '${GITLAB_RELEASE}'."
+        log "GitLab-managed ingress already owns host/path in namespace '${NAMESPACE}': ${INGRESS_HOST_CLAIM_DETAILS}"
+        _operator_ingress_name="${GITLAB_RELEASE}-webservice-default"
+        if kubectl -n "$NAMESPACE" get ingress "$_operator_ingress_name" >/dev/null 2>&1; then
+          log "Fallback front-door owner selected; deleting stale operator ingress ${NAMESPACE}/${_operator_ingress_name}."
+          kubectl -n "$NAMESPACE" delete ingress "$_operator_ingress_name" --ignore-not-found >/dev/null || \
+            warn "Failed to delete stale operator ingress ${NAMESPACE}/${_operator_ingress_name}."
+        fi
+        unset _operator_ingress_name
         ;;
       *)
         die "Duplicate ingress host/path claim detected for GitLab ingress '${NAMESPACE}/gitlab-kong-ingress': ${INGRESS_HOST_CLAIM_DETAILS}"
@@ -4403,8 +4405,7 @@ else
     esac
   fi
 
-  if [[ "$_skip_gitlab_fallback_ingress" != "1" ]]; then
-    kubectl apply -f - <<EOF
+  kubectl apply -f - <<EOF
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -4419,7 +4420,6 @@ spec:
   ingressClassName: ${GITLAB_INGRESS_CLASS}
   rules:${GITLAB_INGRESS_RULES_YAML}
 EOF
-  fi
 fi
 
 # ---------------------------------------------------------------------------

tests/etc/test_init_gitlab_k8s_fails_on_foreign_ingress_host_conflict.sh

@@ -210,6 +210,7 @@ export GITLAB_OBJECT_STORAGE_REQUIRED=0
 export GITLAB_OIDC_CLIENT_ID="dummy-client-id"
 export GITLAB_OIDC_CLIENT_SECRET="dummy-client-secret"
 export GITLAB_REPAIR_BLOCKED_AUTOCLEAN=1
+export GITLAB_FRONTDOOR_OWNER=operator
 unset PROLE_MODE
 unset KUBE_CONTEXT_NAME
 unset KUBECTL_CONTEXT

tests/etc/test_init_gitlab_k8s_skips_fallback_ingress_when_operator_owns_host.sh

@@ -211,6 +211,7 @@ export GITLAB_OBJECT_STORAGE_REQUIRED=0
 export GITLAB_OIDC_CLIENT_ID="dummy-client-id"
 export GITLAB_OIDC_CLIENT_SECRET="dummy-client-secret"
 export GITLAB_REPAIR_BLOCKED_AUTOCLEAN=1
+export GITLAB_FRONTDOOR_OWNER=operator
 unset PROLE_MODE
 unset KUBE_CONTEXT_NAME
 unset KUBECTL_CONTEXT

tests/test_repair_update_and_supabase_flags.py

@@ -657,9 +657,9 @@ def test_init_gitlab_uses_single_frontdoor_owner_model_for_k8s():
     script = (REPO_ROOT / "etc" / "init_gitlab.sh").read_text(encoding="utf-8")
 
     assert 'GITLAB_FRONTDOOR_OWNER="${GITLAB_FRONTDOOR_OWNER:-$_default_gitlab_frontdoor_owner}"' in script
-    assert '_default_gitlab_frontdoor_owner="operator"' in script
+    assert '_default_gitlab_frontdoor_owner="fallback"' in script
     assert "GITLAB_WEBSERVICE_INGRESS_ENABLED=false" in script
-    assert "Deleting stale fallback ingress" in script
+    assert "deleting stale operator ingress" in script
 
 
 def test_init_gitlab_renders_ingress_class_from_config_without_hardcoded_kong():