Kubernetes Gateway API

https://gateway-api.sigs.k8s.io/
Admin
The Kubernetes Gateway API is a collection of API resources that model Service networking in...
Tokens:602,767
Snippets:3,437
Trust Score:9.4
Update:23 hours ago
Show doc for...
Tokens:
Raw
### HTTPRoute example with backendRefs

Source: https://gateway-api.sigs.k8s.io/geps/gep-718/

A complete HTTPRoute example using backendRefs with weighted traffic splitting between two services.

```yaml
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: HTTPRoute
metadata:
  name: bar-route
  labels:
    gateway: prod-web-gw
spec:
  hostnames:
  - "bar.example.com"
  rules:
  - matches:
    - headers:
        type: Exact
        values:
          env: canary
    backendRefs:
    - name: foo-service-v1
      port: 80
      weight: 80
    - name: foo-service-canary
      port: 80
      weight: 20
```

--------------------------------

### XMesh resource example

Source: https://gateway-api.sigs.k8s.io/geps/gep-3949/

Example of the XMesh resource with required controllerName and optional parametersRef. The controllerName must be domain-prefixed and non-empty. The parametersRef is optional and references implementation-specific configuration.

```yaml
apiVersion: gateway.networking.x-k8s.io/v1alpha1
kind: XMesh
metadata:
  name: one-mesh-to-mesh-them-all
spec:
  # required, must be domain-prefixed
  controllerName: one-mesh.example.com/one-mesh
  parametersRef:
    # optional ParametersReference
    ...
```

--------------------------------

### Traefik CORS Middleware Example (YAML)

Source: https://gateway-api.sigs.k8s.io/geps/gep-1767/

Example Middleware resource that configures CORS headers to allow cross-origin requests from https://foo.example and http://foo.example using GET, OPTIONS, and PUT methods. It sets Access-Control-Allow-Credentials to true, allows all headers, sets a preflight cache of 100 seconds, and adds the Vary header.

```yaml
apiVersion: traefik.io/v1alpha1
kind: Middleware
metadata:
  name: cors-header
spec:
  headers:
    accessControlAllowMethods:
      - "GET"
      - "OPTIONS"
      - "PUT"
    accessControlAllowHeaders:
      - "*"
    accessControlAllowOriginList:
      - "https://foo.example"
      - "http://foo.example"
     accessControlAllowCredentials: true
    accessControlMaxAge: 100
    addVaryHeader: true

```

--------------------------------

### Gateway and HTTPRoute example for traffic matching

Source: https://gateway-api.sigs.k8s.io/docs/concepts/traffic-matching/

This YAML example shows a Gateway with two HTTP Listeners (specific and wildcard) and two HTTPRoutes (specific and wildcard). It demonstrates that traffic for specific.example.com must be captured by the specific HTTPRoute, otherwise it returns a 404.

```yaml
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: example-com
  namespace: default
spec:
  listeners:
    - name: specific
      hostname: specific.example.com
      protocol: HTTP
      port: 80
    - name: wildcard
      hostname: *.example.com
      protocol: HTTP
      port: 80
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: specific
  namespace: default
spec:
  parentRefs:
    - name: example-com
  rules:
    - matches:
      - path:
          type: Exact
          value: /specific
      backendRefs:
      - name: specific
        port: 8080
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: wildcard
  namespace: default
spec:
  parentRefs:
    - name: example-com
  rules:
    - matches:
      - path:
          type: prefix
          value: /
      backendRefs:
      - name: prefix
        port: 8080
```

--------------------------------

### Controller Selection Scheme

Source: https://gateway-api.sigs.k8s.io/reference/api-types/gatewayclass/

Example scheme for controller versioning using domain/path combinations.

```text
example.net/gateway/v1   // Use version 1
example.net/gateway/v2.1 // Use version 2.1
example.net/gateway      // Use the default version
```

--------------------------------

### HTTPRouteMatch example: path prefix and header match

Source: https://gateway-api.sigs.k8s.io/reference/api-spec/1.6/spec/

Shows an HTTPRouteMatch that matches requests with a path starting with /foo and a header named version with value v1. Multiple match types are ANDed together, so all conditions must be satisfied.

```yaml
match:

	path:
	  value: "/foo"
	headers:
	- name: "version"
	  value "v1"
```

--------------------------------

### HTTPRoutes for home and login Services in site-ns

Source: https://gateway-api.sigs.k8s.io/guides/user-guides/multiple-ns/

Deploys two HTTPRoutes in the 'site-ns' namespace: 'home' acts as a default route matching all traffic to 'foo.example.com/*' and sends it to the 'home' Service; 'login' routes '/login' traffic to 'login-v1' and 'login-v2' with weights 90 and 10 respectively. Both attach to the 'shared-gateway' Gateway in 'infra-ns'.

```yaml
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: home
  namespace: site-ns
spec:
  parentRefs:
  - name: shared-gateway
    namespace: infra-ns
  rules:
  - backendRefs:
    - name: home
      port: 8080
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: login
  namespace: site-ns
spec:
  parentRefs:
  - name: shared-gateway
    namespace: infra-ns
  rules:
  - matches:
    - path:
        value: /login
    backendRefs:
    - name: login-v1
      port: 8080
      weight: 90
    - name: login-v2
      port: 8080
      weight: 10

```

--------------------------------

### HTTPRoute with BackendRefs and match criteria

Source: https://gateway-api.sigs.k8s.io/reference/api-types/httproute/

Forwards requests for path prefix /bar to my-service1, and requests with header magic: foo, query param great: example, path prefix /some/thing, and method GET to my-service2. Includes GatewayClass and Gateway definitions.

```yaml
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: example
spec:
  controllerName: acme.io/gateway-controller
  parametersRef:
    name: example
    group: acme.io
    kind: Parameters
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: my-gateway
spec:
  gatewayClassName: example
  listeners:  # Use GatewayClass defaults for listener definition.
  - name: http
    protocol: HTTP
    port: 80
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: http-app-1
spec:
  parentRefs:
  - name: my-gateway
  hostnames:
  - "foo.com"
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /bar
    backendRefs:
    - name: my-service1
      port: 8080
  - matches:
    - headers:
      - type: Exact
        name: magic
        value: foo
      queryParams:
      - type: Exact
        name: great
        value: example
      path:
        type: PathPrefix
        value: /some/thing
      method: GET
    backendRefs:
    - name: my-service2
      port: 8080
```

--------------------------------

### Gateway configuration with Passthrough and Terminate TLS listeners

Source: https://gateway-api.sigs.k8s.io/guides/user-guides/tls-routing/

Defines a Gateway with two TLS listeners: 'tls' on port 443 in Passthrough mode and 'tls-terminate' on port 8443 in Terminate mode with a certificate reference. This setup is required to support both TLS modes for the TLSRoute examples.

```yaml
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: example-gateway
spec:
  gatewayClassName: example-gateway-class
  listeners:
  - name: tls
    protocol: TLS
    port: 443
    tls:
      mode: Passthrough
  - name: tls-terminate
    protocol: TLS
    port: 8443
    tls:
      mode: Terminate
      certificateRefs:
      - name: tls-terminate-certificate
```

--------------------------------

### Define HTTPRoute for foo.example.com

Source: https://gateway-api.sigs.k8s.io/guides/getting-started/migrating-from-ingress/

Defines an HTTPRoute for the foo.example.com hostname, attaching to the https listener of the example-gateway Gateway. It includes routing rules for the root path and /orders path, with backendRefs to foo-app and foo-orders-app respectively.

```yaml
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: foo
spec:
  parentRefs:
  - name: example-gateway
    sectionName: https
  hostnames:
  - foo.example.com
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: foo-app
      port: 80
  - matches:
    - path:
        type: PathPrefix
        value: /orders
    backendRefs:
    - name: foo-orders-app
      port: 80

```

--------------------------------

### Multiple GatewayClass Examples

Source: https://gateway-api.sigs.k8s.io/reference/api-types/gatewayclass/

Two GatewayClass examples named 'internet' and 'private' to illustrate different classes for different use cases.

```yaml
kind: GatewayClass
metadata:
  name: internet
  ...
---
kind: GatewayClass
metadata:
  name: private
  ...
```

--------------------------------

### Implementation example: Gateway, Backend with inline TLS, and HTTPRoute

Source: https://gateway-api.sigs.k8s.io/geps/gep-4894/

Shows a Gateway with TLS certificate, a Backend resource with inline TLS for an external hostname, and an HTTPRoute referencing the Backend. The Backend uses type ExternalHostname and tls mode ClientAndServer with a client certificate reference.

```yaml
# Gateway-level TLS remains authoritative for incoming connections
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
spec:
  listeners:
  - name: https
    protocol: HTTPS
    tls:
      certificateRefs:
      - name: gateway-cert
---
# Backend resource with inline TLS for external destination
apiVersion: gateway.networking.k8s.io/v1alpha1
kind: Backend
metadata:
  name: openai-api
  namespace: ai-apps
spec:
  type: ExternalHostname
  externalHostname:
    hostname: api.openai.com
  tls:
    mode: ClientAndServer
    clientCertificateRef:
      name: openai-client-cert
  port:
    number: 443

---
# HTTPRoute referencing Backend
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
spec:
  rules:
  - backendRefs:
    - name: openai-api
      kind: Backend
      group: gateway.networking.k8s.io
```
Tokens:
Raw