Envoy Gateway

https://gateway.envoyproxy.io/docs
Admin
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based...
Tokens:439,586
Snippets:3,313
Trust Score:10
Update:2 weeks ago
Show doc for...
Tokens:
Raw
### Install Quickstart Resources

Source: https://gateway.envoyproxy.io/docs/install/install-argocd

Installs the GatewayClass, Gateway, HTTPRoute, and example app from the quickstart.yaml file. Note that Envoy Gateway listens on port 80 and maps privileged ports internally.

```bash
kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/v1.9.2/quickstart.yaml -n default
```

--------------------------------

### Install Envoy Gateway and example app

Source: https://gateway.envoyproxy.io/docs/tasks/observability/proxy-accesslog

Installs Envoy Gateway and the example manifest. These commands are part of the prerequisites and must be run in order.

```bash
helm install eg oci://docker.io/envoyproxy/gateway-helm --version v1.9.2 -n envoy-gateway-system --create-namespace

```

```bash
kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/v1.9.2/quickstart.yaml -n default

```

--------------------------------

### Install Envoy Gateway and verify connectivity

Source: https://gateway.envoyproxy.io/docs/tasks/security/apikey-auth

Install Envoy Gateway v1.9.2, apply the quickstart manifest, and verify connectivity to the example backend. The commands set GATEWAY_HOST, ENVOY_SERVICE, and ENVOY_DEPLOYMENT environment variables, then curl the backend through the gateway (expected status 200). The final commands port-forward the Envoy service to localhost:8888 and curl again.

```bash
helm install eg oci://docker.io/envoyproxy/gateway-helm --version v1.9.2 -n envoy-gateway-system --create-namespace
```

```bash
kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/v1.9.2/quickstart.yaml -n default
```

```bash
export GATEWAY_HOST=$(kubectl get gateway/eg -o jsonpath='{.status.addresses[0].value}')
```

```bash
curl --verbose --header "Host: www.example.com" http://$GATEWAY_HOST/get
```

```bash
export ENVOY_SERVICE=$(kubectl get svc -n envoy-gateway-system --selector=gateway.envoyproxy.io/owning-gateway-namespace=default,gateway.envoyproxy.io/owning-gateway-name=eg -o jsonpath='{.items[0].metadata.name}')
```

```bash
export ENVOY_DEPLOYMENT=$(kubectl get deploy -n envoy-gateway-system --selector=gateway.envoyproxy.io/owning-gateway-namespace=default,gateway.envoyproxy.io/owning-gateway-name=eg -o jsonpath='{.items[0].metadata.name}')
```

```bash
kubectl -n envoy-gateway-system port-forward service/${ENVOY_SERVICE} 8888:80 &
```

```bash
curl --verbose --header "Host: www.example.com" http://localhost:8888/get
```

--------------------------------

### Install HTTP routing example resources

Source: https://gateway.envoyproxy.io/docs/tasks/traffic/http-routing

Applies the HTTP routing example manifest from the Envoy Gateway repository. This installs a GatewayClass, Gateway, four Deployments, four Services, and three HTTPRoute resources.

```bash
kubectl apply -f https://raw.githubusercontent.com/envoyproxy/gateway/latest/examples/kubernetes/http-routing.yaml
```

--------------------------------

### Install gRPC routing example resources

Source: https://gateway.envoyproxy.io/docs/tasks/traffic/grpc-routing

Applies the gRPC routing example manifest from the Envoy Gateway repository. Installs a GatewayClass, Gateway, Deployment, Service, and GRPCRoute. The GatewayClass uses the default controllerName 'gateway.envoyproxy.io/gatewayclass-controller'.

```bash
kubectl apply -f https://raw.githubusercontent.com/envoyproxy/gateway/latest/examples/kubernetes/grpc-routing.yaml
```

--------------------------------

### Query backends.example/get with curl

Source: https://gateway.envoyproxy.io/docs/tasks/traffic/http-request-mirroring

Sends a request to the example Gateway with the Host header set to backends.example. Expect a 200 response and output indicating the pod that handled the request. Since the quickstart deployment has only one pod, the same pod appears on all requests.

```bash
$ curl -v --header "Host: backends.example" "http://${GATEWAY_HOST}/get"
...
> GET /get HTTP/1.1
> Host: backends.example
> User-Agent: curl/7.81.0
> Accept: */*
> add-header: something
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< content-type: application/json
< x-content-type-options: nosniff
< content-length: 474
< x-envoy-upstream-service-time: 0
< server: envoy
<
...

 "namespace": "default",
 "ingress": "",
 "service": "",
 "pod": "backend-79665566f5-s589f"
...
```

--------------------------------

### Apply TLS termination example resources

Source: https://gateway.envoyproxy.io/docs/tasks/security/tls-termination

Installs the TLS Termination for TCP example resources from the Envoy Gateway repository.

```bash
kubectl apply -f https://raw.githubusercontent.com/envoyproxy/gateway/latest/examples/kubernetes/tls-termination.yaml

```

--------------------------------

### Install CoreDNS backend

Source: https://gateway.envoyproxy.io/docs/tasks/traffic/udp-routing

Applies the UDP routing example backend manifest from the Envoy Gateway repository to install CoreDNS in the cluster.

```bash
kubectl apply -f https://raw.githubusercontent.com/envoyproxy/gateway/latest/examples/kubernetes/udp-routing-example-backend.yaml
```

--------------------------------

### Install Envoy Gateway and Verify Connectivity

Source: https://gateway.envoyproxy.io/docs/tasks/observability/proxy-trace

Install Envoy Gateway via Helm, apply the quickstart manifest, set the GATEWAY_HOST environment variable, and test connectivity with curl. The curl command should return HTTP 200.

```bash
helm install eg oci://docker.io/envoyproxy/gateway-helm --version v1.9.2 -n envoy-gateway-system --create-namespace
```

```bash
kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/v1.9.2/quickstart.yaml -n default
```

```bash
export GATEWAY_HOST=$(kubectl get gateway/eg -o jsonpath='{.status.addresses[0].value}')
```

```bash
curl --verbose --header "Host: www.example.com" http://$GATEWAY_HOST/get
```

--------------------------------

### Create second backend instance via kubectl apply from stdin

Source: https://gateway.envoyproxy.io/docs/tasks/traffic/http-traffic-splitting

Applies a Kubernetes manifest from stdin to create a ServiceAccount, Service, and Deployment for the second backend instance (backend-2). This is the 'Apply from stdin' option for creating the second instance of the example app from the quickstart.

```bash
cat <<EOF | kubectl apply -f -
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: backend-2
---
apiVersion: v1
kind: Service
metadata:
  name: backend-2
  labels:
    app: backend-2
    service: backend-2
spec:
  ports:
    - name: http
      port: 3000
      targetPort: 3000
  selector:
    app: backend-2
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: backend-2
spec:
  replicas: 1
  selector:
    matchLabels:
      app: backend-2
      version: v1
  template:
    metadata:
      labels:
        app: backend-2
        version: v1
    spec:
      serviceAccountName: backend-2
      containers:
        - image: registry.k8s.io/gateway-api/echo-basic:v1.5.1
          imagePullPolicy: IfNotPresent
          name: backend-2
          ports:
            - containerPort: 3000
          env:
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
EOF
```

--------------------------------

### Create second backend instance via apply from file

Source: https://gateway.envoyproxy.io/docs/tasks/traffic/http-traffic-splitting

Kubernetes manifest to save and apply from a file to create the second backend instance (backend-2). This is the 'Apply from file' option for creating the second instance of the example app from the quickstart.

```yaml
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: backend-2
---
apiVersion: v1
kind: Service
metadata:
  name: backend-2
  labels:
    app: backend-2
    service: backend-2
spec:
  ports:
    - name: http
      port: 3000
      targetPort: 3000
  selector:
    app: backend-2
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: backend-2
spec:
  replicas: 1
  selector:
    matchLabels:
      app: backend-2
      version: v1
  template:
    metadata:
      labels:
        app: backend-2
        version: v1
    spec:
      serviceAccountName: backend-2
      containers:
        - image: registry.k8s.io/gateway-api/echo-basic:v1.5.1
          imagePullPolicy: IfNotPresent
          name: backend-2
          ports:
            - containerPort: 3000
          env:
            - name: POD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: NAMESPACE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.namespace
```

--------------------------------

### HTTPHeaderFilter addIfAbsent action example

Source: https://gateway.envoyproxy.io/docs/api/extension_types

Shows the input, config, and output for the 'addIfAbsent' action, which adds the header only if it does not already exist.

```http
GET /foo HTTP/1.1
my-header: foo
```

```yaml
addIfAbsent:
- name: "my-header"
  value: "bar"
```

```http
GET /foo HTTP/1.1
my-header: foo
```

--------------------------------

### HTTPHeaderFilter add action example

Source: https://gateway.envoyproxy.io/docs/api/extension_types

Shows the input, config, and output for the 'add' action, which appends the given header value to any existing values.

```http
GET /foo HTTP/1.1
my-header: foo
```

```yaml
add:
- name: "my-header"
  value: "bar,baz"
```

```http
GET /foo HTTP/1.1
my-header: foo,bar,baz
```

--------------------------------

### HTTPHeaderFilter remove action example

Source: https://gateway.envoyproxy.io/docs/api/extension_types

Shows the input, config, and output for the 'remove' action, which removes the specified headers from the request.

```http
GET /foo HTTP/1.1
my-header1: foo
my-header2: bar
my-header3: baz
```

```yaml
remove: ["my-header1", "my-header3"]
```

```http
GET /foo HTTP/1.1
my-header2: bar
```

--------------------------------

### HTTPHostnameModifier pathRegex example

Source: https://gateway.envoyproxy.io/docs/api/extension_types

Shows a pathRegex configuration that rewrites the Host header based on a regex match and substitution on the request path.

```yaml
pathRegex:
  pattern: "^/tenant/([a-z0-9-]+)/.*"
  substitution: "\1.example.internal"
```

--------------------------------

### HTTPHeaderFilter set action example

Source: https://gateway.envoyproxy.io/docs/api/extension_types

Shows the input, config, and output for the 'set' action, which overwrites the request header with the given name and value.

```http
GET /foo HTTP/1.1
my-header: foo
```

```yaml
set:
- name: "my-header"
  value: "bar"
```

```http
GET /foo HTTP/1.1
my-header: bar
```

--------------------------------

### Install Envoy Gateway and example manifest

Source: https://gateway.envoyproxy.io/docs/tasks/security/secure-gateways

Install the Gateway API CRDs and Envoy Gateway using Helm, then apply the GatewayClass, Gateway, HTTPRoute, and example app manifest. Requires OpenSSL and a Kubernetes cluster with Gateway API CRDs installed.

```bash
helm install eg oci://docker.io/envoyproxy/gateway-helm --version v1.9.2 -n envoy-gateway-system --create-namespace
```

```bash
kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/v1.9.2/quickstart.yaml -n default
```

--------------------------------

### Apply the example manifest

Source: https://gateway.envoyproxy.io/docs/tasks/traffic/backend-utilization

Applies the example Kubernetes manifest containing the Service, two Deployments, and HTTPRoute.

```bash
kubectl apply -f https://raw.githubusercontent.com/envoyproxy/gateway/latest/examples/kubernetes/backend-utilization.yaml -n default

```

--------------------------------

### Get Envoy Service Name

Source: https://gateway.envoyproxy.io/docs/tasks/security/mutual-tls

Gets the name of the Envoy service created by the example Gateway. This is used for port-forwarding.

```bash

export ENVOY_SERVICE=$(kubectl get svc -n envoy-gateway-system --selector=gateway.envoyproxy.io/owning-gateway-namespace=default,gateway.envoyproxy.io/owning-gateway-name=eg -o jsonpath='{.items[0].metadata.name}')

```

--------------------------------

### Build the example provider image

Source: https://gateway.envoyproxy.io/docs/tasks/extensibility/remote-infrastructure-provider

Builds a multi-arch image tagged `envoyproxy/gateway-remote-infra:latest` using the Makefile target.

```bash
make -C examples/remote-infra docker-buildx
```

--------------------------------

### Deploy merged-gateways example

Source: https://gateway.envoyproxy.io/docs/tasks/operations/deployment-mode

Deploys the merged-gateways example resources from the Envoy Gateway repository.

```bash
kubectl apply -f https://raw.githubusercontent.com/envoyproxy/gateway/latest/examples/kubernetes/merged-gateways.yaml
```

--------------------------------

### Install Intel QAT Device Plugin

Source: https://gateway.envoyproxy.io/docs/tasks/security/private-key-provider

Installs the Intel QAT Device Plugin for Kubernetes using kustomize.

```bash
kubectl apply -k 'https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/qat_plugin?ref=main'

```

--------------------------------

### Delete OIDC example resources

Source: https://gateway.envoyproxy.io/docs/tasks/security/oidc

Clean up the OIDC example resources created in the Quickstart. Run these commands to delete the SecurityPolicy, the secret, and the HTTPRoutes.

```bash
kubectl delete securitypolicy/oidc-example
kubectl delete secret/my-app-client-secret
kubectl delete httproute/myapp
kubectl delete httproute/foo

```

--------------------------------

### Build the example backend image

Source: https://gateway.envoyproxy.io/docs/tasks/traffic/backend-utilization

Builds the example backend Docker image from the Envoy Gateway repository using the make target.

```bash
make -C examples/backend-utilization docker-buildx

```

--------------------------------

### Delete Quickstart Resources

Source: https://gateway.envoyproxy.io/docs/tasks/quickstart

Deletes the GatewayClass, Gateway, HTTPRoute, and example app from the quickstart. The --ignore-not-found=true flag prevents errors if resources are already deleted.

```bash
kubectl delete -f https://github.com/envoyproxy/gateway/releases/download/v1.9.2/quickstart.yaml --ignore-not-found=true
```

--------------------------------

### Get HTTPRoute status

Source: https://gateway.envoyproxy.io/docs/tasks/traffic/http-redirect

Checks the status of the HTTPRoute to confirm it has been accepted and bound to the example Gateway.

```bash
kubectl get httproute/http-to-https-filter-redirect -o yaml

```

--------------------------------

### Query example app through Gateway

Source: https://gateway.envoyproxy.io/docs/tasks/security/tls-termination

Queries the example app through the Gateway using the external IP and the generated certificate.

```bash
curl -v -HHost:www.example.com --resolve "www.example.com:443:${GATEWAY_HOST}" \
--cacert example.com.crt https://www.example.com/get

```

--------------------------------

### Copy example file to trigger update

Source: https://gateway.envoyproxy.io/docs/tasks/operations/standalone-deployment-mode

Copies an example file into the watched directory to trigger a resource update.

```bash
cp examples/standalone/quickstart.yaml /tmp/envoy-gateway-test/quickstart.yaml
```

--------------------------------

### Get Gateway External IP

Source: https://gateway.envoyproxy.io/docs/tasks/extensibility/ext-proc

Exports the external IP of the example Gateway to the GATEWAY_HOST environment variable.

```bash
export GATEWAY_HOST=$(kubectl get gateway/eg -o jsonpath='{.status.addresses[0].value}')

```

--------------------------------

### Create root certificate and private key

Source: https://gateway.envoyproxy.io/docs/tasks/traffic/http-redirect

Creates a root certificate and private key, then generates a certificate signing request and private key for example.com. Use these as prerequisites for signing the wildcard certificate.

```bash
openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -subj '/CN=example.com' -keyout CA.key -out CA.crt
openssl req -out example.com.csr -newkey rsa:2048 -nodes -keyout tls.key -subj "/CN=example.com"
```

--------------------------------

### Install add-ons and configure Loki LoadBalancer

Source: https://gateway.envoyproxy.io/docs/tasks/observability/proxy-accesslog

Installs the default add-ons Helm chart without OpenTelemetry Collector (disabled by default), changes the Loki service type to LoadBalancer for further usage, and exposes the endpoint by getting its IP.

```bash
helm install eg-addons oci://docker.io/envoyproxy/gateway-addons-helm --version v1.9.2 -n monitoring --create-namespace

```

```bash
kubectl patch service loki -n monitoring -p '{"spec": {"type": "LoadBalancer"}}'

```

```bash
LOKI_IP=$(kubectl get svc loki -n monitoring -o jsonpath='{.status.loadBalancer.ingress[0].ip}')

```

--------------------------------

### Benchmark gateway with fortio

Source: https://gateway.envoyproxy.io/docs/tasks/security/private-key-provider

Benchmarks the gateway with fortio after enabling the private key provider. Uses 64 connections, disables keep-alive, and runs for 30 seconds against the example service on the node port.

```bash
fortio load -c 64 -k -qps 0 -t 30s -keepalive=false https://www.example.com:${NODE_PORT}
```

--------------------------------

### Get Envoy Deployment Name

Source: https://gateway.envoyproxy.io/docs/tasks/extensibility/ext-proc

Exports the name of the Envoy deployment created by the example Gateway to the ENVOY_DEPLOYMENT environment variable.

```bash
export ENVOY_DEPLOYMENT=$(kubectl get deploy -n envoy-gateway-system --selector=gateway.envoyproxy.io/owning-gateway-namespace=default,gateway.envoyproxy.io/owning-gateway-name=eg -o jsonpath='{.items[0].metadata.name}')

```

--------------------------------

### Generate client certificate for client.example.com

Source: https://gateway.envoyproxy.io/docs/tasks/security/mutual-tls

Creates a certificate and private key for the client client.example.com, signed by the root certificate. This client certificate is used to authenticate to the Gateway.

```bash
openssl req -out client.example.com.csr -newkey rsa:2048 -nodes -keyout client.example.com.key -subj "/CN=client.example.com/O=example organization"
openssl x509 -req -days 365 -CA example.com.crt -CAkey example.com.key -set_serial 0 -in client.example.com.csr -out client.example.com.crt

```

--------------------------------

### Generate client certificate and private key for www.example.com

Source: https://gateway.envoyproxy.io/docs/tasks/security/backend-mtls

Creates a client certificate and private key for the Gateway to authenticate against the backend. The certificate is signed by the client CA and is valid for 365 days.

```bash
openssl req -new -newkey rsa:2048 -nodes -keyout client.key -out client.csr -subj "/CN=example-client/O=example organization"
openssl x509 -req -days 365 -CA clientca.crt -CAkey clientca.key -set_serial 0 -in client.csr -out client.crt
```

--------------------------------

### Get Envoy Service Name

Source: https://gateway.envoyproxy.io/docs/tasks/extensibility/ext-proc

Exports the name of the Envoy service created by the example Gateway to the ENVOY_SERVICE environment variable.

```bash
export ENVOY_SERVICE=$(kubectl get svc -n envoy-gateway-system --selector=gateway.envoyproxy.io/owning-gateway-namespace=default,gateway.envoyproxy.io/owning-gateway-name=eg -o jsonpath='{.items[0].metadata.name}')

```

--------------------------------

### Query example app through Envoy proxy (port-forward)

Source: https://gateway.envoyproxy.io/docs/tasks/security/secure-gateways

Sends a HEAD request to the example app via the port-forwarded Envoy service using the example.com certificate.

```bash
curl -v -HHost:www.example.com --resolve "www.example.com:8443:127.0.0.1" \
--cacert example.com.crt https://www.example.com:8443/get -I
```

--------------------------------

### Install demo HTTP external authorization service

Source: https://gateway.envoyproxy.io/docs/tasks/security/ext-auth

Applies the demo HTTP service manifest from the Envoy Gateway examples repository.

```bash
kubectl apply -f https://raw.githubusercontent.com/envoyproxy/gateway/latest/examples/kubernetes/ext-auth-http-service.yaml

```

--------------------------------

### Download and run the egctl installer script

Source: https://gateway.envoyproxy.io/docs/install/install-egctl

Downloads the egctl installer script and makes it executable, then runs it with the --help flag to display usage information. This is the recommended way to install the latest release of egctl.

```bash
curl -fsSL -o get-egctl.sh https://gateway.envoyproxy.io/get-egctl.sh

chmod +x get-egctl.sh

# get help info of the 
bash get-egctl.sh --help
```

--------------------------------

### Install demo gRPC external processing service

Source: https://gateway.envoyproxy.io/docs/tasks/extensibility/ext-proc

Applies the demo gRPC service manifest from the Envoy Gateway examples repository.

```bash
kubectl apply -f https://raw.githubusercontent.com/envoyproxy/gateway/latest/examples/kubernetes/ext-proc-grpc-service.yaml
```
Tokens:
Raw