Gateway API

Gateway API

The successor of Ingress: one HTTP(S) entry point, routing by host, path, header or weight - expressed as typed resources instead of annotations.

graph LR C[Browser<br/>shop.k8s.lab] --> GW[Gateway<br/>listener web] GW --> R1[HTTPRoute shop] GW --> R2[HTTPRoute wiki] R1 --> S1[Service shop] R2 --> S2[Service wiki] GC[GatewayClass traefik] -.-> GW

Three objects, three owners

ObjectAnswersOwned by
GatewayClasswhich implementation?cluster admin (installed with the controller)
Gatewaywhere does traffic enter - ports, protocols, TLS, who may attachplatform team
HTTPRoutewhich requests go to which Serviceapplication team

The route points up to its Gateway with parentRefs; the Gateway decides with allowedRoutes which namespaces may attach. Teams add routes without touching shared configuration.

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: shop
  namespace: shop
spec:
  parentRefs:
    - name: traefik-gateway
      namespace: traefik
  hostnames: ["shop.k8s.lab"]
  rules:
    - matches:
        - path: { type: PathPrefix, value: / }
      backendRefs:
        - name: shop
          port: 80

What Ingress could not express

  rules:
    - matches:                         # header match
        - headers: [{ name: x-version, value: beta }]
      backendRefs: [{ name: shop-v2, port: 80 }]
    - backendRefs:                     # canary 90/10
        - { name: shop,    port: 80, weight: 90 }
        - { name: shop-v2, port: 80, weight: 10 }
      filters:                         # typed filters, not annotations
        - type: RequestHeaderModifier
          requestHeaderModifier:
            add: [{ name: x-env, value: prod }]
  • Matching on path, host, header, method, query
  • Weights for canary / blue-green
  • Filters: header modification, redirects, URL rewrite, mirroring
  • Other protocols: GRPCRoute, TLSRoute, TCPRoute (experimental)
  • Cross-namespace backends only with an explicit ReferenceGrant

Status tells you what is wrong

ConditionOnMeaning
ProgrammedGatewaythe controller built the listener
AcceptedHTTPRoute (per parent)the Gateway took the route
ResolvedRefsHTTPRoutebackends exist and are allowed

Ingress had none of this - it just did nothing.

This cluster: Traefik

  • The Gateway API CRDs are not part of Kubernetes - install them first (v1.6.1, standard channel), then the controller.
  • The Traefik Helm chart creates the GatewayClass traefik and a Gateway traefik-gateway in namespace traefik.
  • A Traefik listener port is an entry point port: web = 8000 inside the Pod, exposed on NodePort 30080. A Gateway listener on port 80 would not match any entry point.

References