### Install GatewayClass, Gateway, and HTTPRoute

Source: https://gateway.envoyproxy.io/docs/install/install-flux

This command applies a quickstart YAML file to install the GatewayClass, Gateway, and an example HTTPRoute, along with a sample application, into the 'default' namespace.

```bash
kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/v1.8.2/quickstart.yaml -n default

```

--------------------------------

### Install Gateway API CRDs and Example Application

Source: https://gateway.envoyproxy.io/docs/install/install-argocd

This command applies the necessary Gateway API CRDs and an example application using a quickstart YAML file from the Envoy Gateway GitHub releases. This is a convenient way to set up a basic Envoy Gateway environment for testing.

```bash
kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/v1.8.2/quickstart.yaml -n default
```

--------------------------------

### Install CoreDNS Example Backend

Source: https://gateway.envoyproxy.io/docs/tasks/traffic/udp-routing

Applies a Kubernetes manifest to install the example CoreDNS backend. Ensure CoreDNS is listening on UDP port 53.

```bash
kubectl apply -f https://raw.githubusercontent.com/envoyproxy/gateway/latest/examples/kubernetes/udp-routing-example-backend.yaml
```

--------------------------------

### Install HTTP Routing Example Resources

Source: https://gateway.envoyproxy.io/docs/tasks/traffic/http-routing

Applies the Kubernetes manifest to install the necessary resources for the HTTP routing example, including GatewayClass, Gateway, Deployments, Services, and HTTPRoutes.

```bash
kubectl apply -f https://raw.githubusercontent.com/envoyproxy/gateway/latest/examples/kubernetes/http-routing.yaml
```

--------------------------------

### Install TLS Termination Example Resources

Source: https://gateway.envoyproxy.io/docs/tasks/security/tls-termination

Apply the Kubernetes resources defined in the example YAML file to set up the TLS termination configuration.

```bash
kubectl apply -f https://raw.githubusercontent.com/envoyproxy/gateway/latest/examples/kubernetes/tls-termination.yaml
```

--------------------------------

### Install gRPC Routing Resources

Source: https://gateway.envoyproxy.io/docs/tasks/traffic/grpc-routing

Applies the Kubernetes manifest to install the GatewayClass, Gateway, Deployment, Service, and GRPCRoute for the gRPC routing example.

```bash
kubectl apply -f https://raw.githubusercontent.com/envoyproxy/gateway/latest/examples/kubernetes/grpc-routing.yaml
```

--------------------------------

### Install egctl using the Official Installer Script

Source: https://gateway.envoyproxy.io/docs/install/install-egctl

Fetch and execute the official installer script to automatically download and install the latest egctl release. The script is documented for review before execution.

```bash
curl -fsSL -o get-egctl.sh https://gateway.envoyproxy.io/get-egctl.sh
chmod +x get-egctl.sh
bash get-egctl.sh --help
```

--------------------------------

### Install Envoy Gateway with Backend API Enabled

Source: https://gateway.envoyproxy.io/docs/install/install-helm

Install Envoy Gateway and enable the Backend API using a direct --set flag.

```bash
helm install eg oci://docker.io/envoyproxy/gateway-helm --version v1.8.2 -n envoy-gateway-system --create-namespace --set config.envoyGateway.extensionApis.enableBackend=true
```

--------------------------------

### Apply Example Deployments and HTTPRoute

Source: https://gateway.envoyproxy.io/docs/tasks/traffic/zone-aware-routing

Apply the example manifests to create Kubernetes Deployments and an HTTPRoute for zone-aware routing testing. This includes Deployments with affinity and anti-affinity settings.

```bash
kubectl apply -f https://raw.githubusercontent.com/envoyproxy/gateway/latest/examples/kubernetes/zone-aware-routing.yaml -n default
```

--------------------------------

### Install Demo HTTP External Authorization Service

Source: https://gateway.envoyproxy.io/docs/tasks/security/ext-auth

Installs a demo HTTP service to be used as the external authorization service. This is a prerequisite for the subsequent configuration steps.

```bash
kubectl apply -f https://raw.githubusercontent.com/envoyproxy/gateway/latest/examples/kubernetes/ext-auth-http-service.yaml
```

--------------------------------

### Check GATEWAY_HOST Environment Variable

Source: https://gateway.envoyproxy.io/docs/tasks/extensibility/dynamic-modules

Verify that the GATEWAY_HOST environment variable is set. If not, refer to the Quickstart guide.

```bash
echo $GATEWAY_HOST
```

--------------------------------

### Install Subctl

Source: https://gateway.envoyproxy.io/docs/tasks/traffic/multicluster-service

Download and install the subctl command-line tool, specifying the desired version.

```bash
curl -Ls https://get.submariner.io  | VERSION=v0.14.6 bash
```

--------------------------------

### Install Demo GRPC Service

Source: https://gateway.envoyproxy.io/docs/tasks/extensibility/ext-proc

Installs a demo GRPC service using kubectl. This is the first step in setting up the external processing service.

```bash
kubectl apply -f https://raw.githubusercontent.com/envoyproxy/gateway/latest/examples/kubernetes/ext-proc-grpc-service.yaml
```

--------------------------------

### Complex Envoy Gateway Installation with values.yaml

Source: https://gateway.envoyproxy.io/docs/install/install-helm

Example values.yaml configuration for customizing Envoy Gateway resources, ports, and logging levels.

```yaml
deployment:
  envoyGateway:
    resources:
      limits:
        cpu: 700m
        memory: 128Mi
      requests:
        cpu: 10m
        memory: 64Mi
  ports:
    - name: grpc
      port: 18005
      targetPort: 18000
    - name: ratelimit
      port: 18006
      targetPort: 18001

config:
  envoyGateway:
    logging:
      level:
        default: debug
```

--------------------------------

### Example Ingress Configuration

Source: https://gateway.envoyproxy.io/docs/install/migrating-to-envoy

An example of a Kubernetes Ingress resource with a host and a path-based rule pointing to a backend service.

```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: example-ingress
  namespace: default
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /foo
        pathType: Prefix
        backend:
          service:
            name: foo-service
            port:
              number: 80

```

--------------------------------

### Install Envoy Gateway using values.yaml

Source: https://gateway.envoyproxy.io/docs/install/install-helm

Install Envoy Gateway using a custom values.yaml file that enables the Backend API.

```bash
helm install eg oci://docker.io/envoyproxy/gateway-helm --version v1.8.2 -n envoy-gateway-system --create-namespace -f values.yaml
```

--------------------------------

### Query Example App via Gateway

Source: https://gateway.envoyproxy.io/docs/tasks/security/backend-tls

Send a request to the example application through the Gateway using its external IP. Inspect the response for TLS handshake details.

```bash
curl -v -HHost:www.example.com --resolve "www.example.com:80:${GATEWAY_HOST}" 
http://www.example.com:80/get
```

--------------------------------

### Install Envoy Gateway Add-ons

Source: https://gateway.envoyproxy.io/docs/tasks/observability/grafana-integration

Installs observability add-ons, including Grafana and Prometheus, using the Helm chart. Ensure the namespace 'monitoring' is created.

```bash
helm install eg-addons oci://docker.io/envoyproxy/gateway-addons-helm --version v1.8.2 -n monitoring --create-namespace
```

--------------------------------

### Query Example App Through Gateway

Source: https://gateway.envoyproxy.io/docs/tasks/security/secure-gateways

Tests connectivity to an example application via the gateway using its external IP. Requires a TLS certificate.

```bash
curl -v -HHost:www.example.com --resolve "www.example.com:443:${GATEWAY_HOST}" \
--cacert example.com.crt https://www.example.com/get
```

--------------------------------

### Install Latest egctl Release Directly via Script

Source: https://gateway.envoyproxy.io/docs/install/install-egctl

Use this command to pipe the installer script directly to bash, which will download and install the latest egctl release. Specify a VERSION if needed.

```bash
curl -fsSL https://gateway.envoyproxy.io/get-egctl.sh | VERSION=v1.8.2 bash
```

--------------------------------

### Apply Example Manifest

Source: https://gateway.envoyproxy.io/docs/tasks/traffic/backend-utilization

Applies the example Kubernetes manifest, which includes a Service, two Deployments (low and high utilization), and an HTTPRoute, to your cluster. Ensure you are in the 'default' namespace or adjust as needed.

```bash
kubectl apply -f https://raw.githubusercontent.com/envoyproxy/gateway/latest/examples/kubernetes/backend-utilization.yaml -n default
```

--------------------------------

### Install GRPC External Authorization Service

Source: https://gateway.envoyproxy.io/docs/tasks/security/ext-auth

Apply the Kubernetes manifest to install the demo GRPC external authorization service.

```bash
kubectl apply -f https://raw.githubusercontent.com/envoyproxy/gateway/latest/examples/kubernetes/ext-auth-grpc-service.yaml
```

--------------------------------

### Install Envoy Gateway

Source: https://gateway.envoyproxy.io/docs/tasks/traffic/multicluster-service

Install Envoy Gateway using Helm in cluster1. Ensure the Envoy Gateway system namespace is created.

```bash
helm install eg oci://docker.io/envoyproxy/gateway-helm --version v1.8.2 -n envoy-gateway-system --create-namespace --kubeconfig output/kubeconfigs/kind-config-cluster1
```

--------------------------------

### Query Example App via Port Forwarded Envoy

Source: https://gateway.envoyproxy.io/docs/tasks/security/secure-gateways

Tests connectivity to the example application through the Envoy proxy using the port-forwarded connection. Requires the example.com.crt certificate.

```bash
curl -v -HHost:www.example.com --resolve "www.example.com:8443:127.0.0.1" \
--cacert example.com.crt https://www.example.com:8443/get -I
```

--------------------------------

### Query Example App via External Gateway

Source: https://gateway.envoyproxy.io/docs/tasks/security/secure-gateways

Tests connectivity to the example application through the Envoy proxy using the Gateway's external IP. Requires the example.com.crt certificate.

```bash
curl -v -HHost:www.example.com --resolve "www.example.com:443:${GATEWAY_HOST}" \
--cacert example.com.crt https://www.example.com/get -I
```

--------------------------------

### Curl Example App via Gateway

Source: https://gateway.envoyproxy.io/docs/tasks/security/tls-passthrough

Tests the example application by sending a request through the Gateway using curl. It resolves the passthrough domain to the Gateway's host and port.

```bash
curl -v -HHost:passthrough.example.com --resolve "passthrough.example.com:6443:${GATEWAY_HOST}" --cacert example.com.crt https://passthrough.example.com:6443/get
```

--------------------------------

### Query Example App Through Gateway without mTLS

Source: https://gateway.envoyproxy.io/docs/tasks/security/mutual-tls

Attempt to query the example application through the Gateway without providing client certificates. This connection should fail if mTLS is enforced.

```bash
curl -v -HHost:www.example.com --resolve "www.example.com:443:${GATEWAY_HOST}" --cacert example.com.crt https://www.example.com/get
```

--------------------------------

### Install Envoy Gateway for Marketing Namespace

Source: https://gateway.envoyproxy.io/docs/tasks/operations/deployment-mode

Installs the Envoy Gateway controller, configuring it to watch resources only within the 'marketing' namespace and setting a unique controller name for multi-tenancy.

```bash
helm install \
--set config.envoyGateway.gateway.controllerName=gateway.envoyproxy.io/marketing-gatewayclass-controller \
--set config.envoyGateway.provider.kubernetes.watch.type=Namespaces \
--set config.envoyGateway.provider.kubernetes.watch.namespaces={marketing} \
eg-marketing oci://docker.io/envoyproxy/gateway-helm \
--version v1.8.2 -n marketing --create-namespace

```

--------------------------------

### Curl Route to Quickstart Backend

Source: https://gateway.envoyproxy.io/docs/tasks/operations/deployment-mode

Sends a curl request to the Quickstart backend route through the Envoy proxy. It uses the previously obtained gateway host and expects a specific JSON response.

```bash
curl --header "Host: www.example.com" http://$DEFAULT_GATEWAY_HOST
```

```json
{
 "path": "/",
 "host": "www.example.com",
 "method": "GET",
 "proto": "HTTP/1.1",
 "headers": {
  "Accept": [
   "*/*"
  ],
  "User-Agent": [
   "curl/8.4.0"
  ],
  "X-Envoy-Internal": [
   "true"
  ],
  "X-Forwarded-For": [
   "172.18.0.2"
  ],
  "X-Forwarded-Proto": [
   "http"
  ],
  "X-Request-Id": [
   "70a40595-67a1-4776-955b-2dee361baed7"
  ]
 },
 "namespace": "default",
 "ingress": "",
 "service": "",
 "pod": "backend-96f75bbf-6w67z"
}
```

--------------------------------

### Query Example App Through Envoy Proxy

Source: https://gateway.envoyproxy.io/docs/tasks/security/secure-gateways

Tests connectivity to an example application directly through the Envoy proxy using port forwarding. Requires a TLS certificate.

```bash
curl -v -HHost:www.example.com --resolve "www.example.com:8443:127.0.0.1" \
--cacert example.com.crt https://www.example.com:8443/get
```

--------------------------------

### Curl Example App via HTTPS Listener

Source: https://gateway.envoyproxy.io/docs/tasks/traffic/http-redirect

Send a request to the example application through the HTTPS listener, using the self-signed CA certificate for verification. This verifies that HTTPS is working correctly.

```bash
curl -v -H 'Host:www.example.com' --resolve "www.example.com:443:$GATEWAY_HOST" \
--cacert CA.crt https://www.example.com:443/get
```

--------------------------------

### Start Envoy Gateway in Standalone Mode

Source: https://gateway.envoyproxy.io/docs/tasks/operations/standalone-deployment-mode

Starts the Envoy Gateway server using a standalone configuration file. This configuration specifies the file provider for resources and the host provider for infrastructure.

```bash
envoy-gateway server --config-path standalone.yaml
```

--------------------------------

### Delete Example Secrets

Source: https://gateway.envoyproxy.io/docs/tasks/security/secure-gateways

Deletes the example TLS secrets used for demonstration. Run this after completing the quickstart.

```bash
kubectl delete secret/example-cert
kubectl delete secret/foo-cert
```

--------------------------------

### Install Application and Export Service

Source: https://gateway.envoyproxy.io/docs/tasks/traffic/multicluster-service

Deploy a sample application to cluster2 and then export its service using subctl to make it available across the multicluster environment.

```bash
kubectl apply -f https://raw.githubusercontent.com/envoyproxy/gateway/latest/examples/kubernetes/application.yaml --kubeconfig output/kubeconfigs/kind-config-cluster2
subctl export service backend --namespace default --kubeconfig output/kubeconfigs/kind-config-cluster2
```

--------------------------------

### Generate Client Certificate and Key

Source: https://gateway.envoyproxy.io/docs/tasks/security/backend-mtls

Create a client certificate and private key for a specific domain (e.g., www.example.com) and sign it with the root CA. This certificate will be presented by the Gateway to the backend.

```bash
openssl req -new -newkey rsa:2048 -nodes -keyout client.key -out client.csr -subj "/CN=example-client/O=example organization"
openssl x509 -req -days 365 -CA clientca.crt -CAkey clientca.key -set_serial 0 -in client.csr -out client.crt
```

--------------------------------

### Example Non-Rate Limited GET Responses

Source: https://gateway.envoyproxy.io/docs/tasks/traffic/global-rate-limit

Illustrates the expected HTTP responses for GET requests, showing consistent successful responses without triggering rate limits.

```http
HTTP/1.1 200 OK
content-type: application/json
x-content-type-options: nosniff
date: Wed, 08 Feb 2023 02:33:35 GMT
content-length: 460
x-envoy-upstream-service-time: 4
server: envoy

HTTP/1.1 200 OK
content-type: application/json
x-content-type-options: nosniff
date: Wed, 08 Feb 2023 02:33:36 GMT
content-length: 460
x-envoy-upstream-service-time: 2
server: envoy

HTTP/1.1 200 OK
content-type: application/json
x-content-type-options: nosniff
date: Wed, 08 Feb 2023 02:33:37 GMT
content-length: 460
x-envoy-upstream-service-time: 0
server: envoy

HTTP/1.1 200 OK
content-type: application/json
x-content-type-options: nosniff
date: Wed, 08 Feb 2023 02:33:38 GMT
content-length: 460
x-envoy-upstream-service-time: 0
server: envoy
```

--------------------------------

### Customize Envoy Gateway Installation with Argo CD

Source: https://gateway.envoyproxy.io/docs/install/install-argocd

Example of customizing Envoy Gateway installation using the `valuesObject` field in an Argo CD Application manifest. This allows for fine-grained control over deployment resources.

```yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: envoy-gateway
  namespace: argocd
spec:
  project: default
  source:
    helm:
      valuesObject:
        deployment:
          envoyGateway:
            resources:
              limits:
                cpu: 700m
                memory: 256Mi
    chart: gateway-helm
    path: gateway-helm
    repoURL: docker.io/envoyproxy
    targetRevision: v1.8.2
  destination:
    namespace: envoy-gateway-system
    server: https://kubernetes.default.svc
  syncPolicy:
    syncOptions:
    - CreateNamespace=true
    - ServerSideApply=true
    automated:
      prune: true
      selfHeal: true

```

--------------------------------

### Benchmark Gateway Performance with Fortio

Source: https://gateway.envoyproxy.io/docs/tasks/security/private-key-provider

Executes a load test against the gateway using the Fortio tool.

```bash
fortio load -c 64 -k -qps 0 -t 30s -keepalive=false https://www.example.com:${NODE_PORT}
```

--------------------------------

### Get Envoy Deployment Name

Source: https://gateway.envoyproxy.io/docs/tasks/extensibility/dynamic-modules

Retrieves the name of the Envoy deployment created by the example Gateway configuration.

```bash
export ENVOY_DEPLOYMENT=$(kubectl get deploy -n envoy-gateway-system --selector=gateway.envoyproxy.io/owning-gateway-namespace=default,gateway.envoyproxy.io/owning-gateway-name=eg -o jsonpath='{.items[0].metadata.name}')

```

--------------------------------

### Get Envoy Service Name

Source: https://gateway.envoyproxy.io/docs/tasks/extensibility/dynamic-modules

Retrieves the name of the Envoy service created by the example Gateway configuration.

```bash
export ENVOY_SERVICE=$(kubectl get svc -n envoy-gateway-system --selector=gateway.envoyproxy.io/owning-gateway-namespace=default,gateway.envoyproxy.io/owning-gateway-name=eg -o jsonpath='{.items[0].metadata.name}')

```

--------------------------------

### Build Example Backend Image

Source: https://gateway.envoyproxy.io/docs/tasks/traffic/backend-utilization

Builds the Envoy Gateway backend utilization Docker image using make and docker-buildx. Ensure you have a checkout of the Envoy Gateway repository.

```bash
make -C examples/backend-utilization docker-buildx
```

--------------------------------

### Customize Envoy Gateway Installation with HelmRelease

Source: https://gateway.envoyproxy.io/docs/install/install-flux

Example of customizing Envoy Gateway installation by setting Helm chart values within the `values` field of a `HelmRelease` object. This is useful for configuring resource limits for the Envoy Gateway deployment.

```yaml
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: envoy-gateway
  namespace: envoy-gateway-system
spec:
  interval: 5m
  releaseName: eg
  chartRef:
    kind: OCIRepository
    name: gateway-helm
  upgrade:
    strategy:
      name: RetryOnFailure
      retryInterval: 5m
  values:
    deployment:
      envoyGateway:
        resources:
          limits:
            cpu: 700m
            memory: 256Mi

```

--------------------------------

### Verify Deployment Readiness

Source: https://gateway.envoyproxy.io/docs/tasks/traffic/zone-aware-routing

Check the status of the example Deployments to ensure they are ready. This confirms that the pods for both local and non-local zone-aware routing backends have been successfully scheduled and are running.

```bash
kubectl get deployment/zone-aware-routing-backend-local deployment/zone-aware-routing-backend-nonlocal -n default
```

--------------------------------

### Configure Hosts File

Source: https://gateway.envoyproxy.io/docs/tasks/security/private-key-provider

Adds an entry to the /etc/hosts file to map 'www.example.com' to '127.0.0.1'. This is often a prerequisite for local testing and benchmarking.

```bash
echo "127.0.0.1 www.example.com" >> /etc/hosts
```

--------------------------------

### Delete Envoy Gateway Resources

Source: https://gateway.envoyproxy.io/docs/tasks/security/oidc

Use these kubectl commands to remove the SecurityPolicy, secret, and HTTPRoute resources created during the example setup.

```bash
kubectl delete securitypolicy/oidc-example
kubectl delete secret/my-app-client-secret
kubectl delete httproute/myapp
kubectl delete httproute/foo
```

--------------------------------

### Marketing Service Response (404)

Source: https://gateway.envoyproxy.io/docs/tasks/operations/deployment-mode

Example verbose output of a failed GET request to the marketing service, showing HTTP status 404 Not Found.

```text
*   Trying 127.0.0.1:8889...
* Connected to localhost (127.0.0.1) port 8889 (#0)
> GET /get HTTP/1.1
> Host: www.marketing.example.com
> User-Agent: curl/7.86.0
> Accept: */*
>
Handling connection for 8889
* Mark bundle as not supporting multiuse
< HTTP/1.1 404 Not Found
< date: Thu, 20 Apr 2023 19:22:13 GMT
< server: envoy
< content-length: 0
< 
* Connection #0 to host localhost left intact


```

--------------------------------

### Product Service Response

Source: https://gateway.envoyproxy.io/docs/tasks/operations/deployment-mode

Example verbose output of a successful GET request to the product service, showing HTTP status 200 OK and JSON response body.

```text
*   Trying 127.0.0.1:8889...
* Connected to localhost (127.0.0.1) port 8889 (#0)
> GET /get HTTP/1.1
> Host: www.product.example.com
> User-Agent: curl/7.86.0
> Accept: */*
>
Handling connection for 8889
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< content-type: application/json
< x-content-type-options: nosniff
< date: Thu, 20 Apr 2023 19:20:17 GMT
< content-length: 517
< x-envoy-upstream-service-time: 0
< server: envoy
< 
{
 "path": "/get",
 "host": "www.product.example.com",
 "method": "GET",
 "proto": "HTTP/1.1",
 "headers": {
  "Accept": [
   "*/*"
  ],
  "User-Agent": [
   "curl/7.86.0"
  ],
  "X-Envoy-Expected-Rq-Timeout-Ms": [
   "15000"
  ],
  "X-Envoy-Internal": [
   "true"
  ],
  "X-Forwarded-For": [
   "10.1.0.156"
  ],
  "X-Forwarded-Proto": [
   "http"
  ],
  "X-Request-Id": [
   "39196453-2250-4331-b756-54003b2853c2"
  ]
 },
 "namespace": "product",
 "ingress": "",
 "service": "",
 "pod": "backend-74888f465f-64fjs"
* Connection #0 to host localhost left intact


```

--------------------------------

### Deploy Intel QAT Device Plugin

Source: https://gateway.envoyproxy.io/docs/tasks/security/private-key-provider

Installs the Intel QAT device plugin into the Kubernetes cluster.

```bash
kubectl apply -k 'https://github.com/intel/intel-device-plugins-for-kubernetes/deployments/qat_plugin?ref=main'
```

--------------------------------

### Query Example App Through Gateway with mTLS

Source: https://gateway.envoyproxy.io/docs/tasks/security/mutual-tls

Query the example application through the Gateway using curl, with client certificates for mutual TLS authentication. Ensure you have the necessary certificates (client.example.com.crt, client.example.com.key, example.com.crt) in the current directory.

```bash
curl -v -HHost:www.example.com --resolve "www.example.com:443:${GATEWAY_HOST}" --cert client.example.com.crt --key client.example.com.key --cacert example.com.crt https://www.example.com/get
```

--------------------------------

### Route traffic to 'bar' service on port 8089

Source: https://gateway.envoyproxy.io/docs/tasks/traffic/tcp-routing

Send a request to port 8089 to route traffic to the 'bar' service. This example uses `curl` to send an HTTP GET request.

```bash
curl -i "http://${GATEWAY_HOST}:8089"
```

--------------------------------

### Install cert-manager with Helm

Source: https://gateway.envoyproxy.io/docs/tasks/security/tls-cert-manager

Installs cert-manager using Helm, enabling Gateway API support. Ensure Gateway API CRDs are installed beforehand or restart the cert-manager Deployment after installation.

```bash
$ helm repo add jetstack https://charts.jetstack.io
$ helm install \
  cert-manager jetstack/cert-manager \
  --version v1.17.0 \
  --create-namespace --namespace cert-manager \
  --set config.apiVersion="controller.config.cert-manager.io/v1alpha1" \
  --set config.kind="ControllerConfiguration" \
  --set config.enableGatewayAPI=true

```

--------------------------------

### Benchmark Gateway with Fortio

Source: https://gateway.envoyproxy.io/docs/tasks/security/private-key-provider

Runs a load test against the Envoy Gateway using fortio. Adjust parameters like connection count (-c), query per second (-qps), and duration (-t) as needed.

```bash
fortio load -c 10 -k -qps 0 -t 30s -keepalive=false https://www.example.com:${NODE_PORT}
```

--------------------------------

### Install Envoy Gateway

Source: https://gateway.envoyproxy.io/docs/tasks/operations/egctl

Installs Envoy Gateway, including workload resources and CRDs by default. Use flags to customize the installation.

```bash
egctl x install
```

```bash
egctl x install --skip-crds
```

```bash
egctl x install --only-crds
```

```bash
egctl x install --name shop-backend --namespace shop
```

--------------------------------

### Install GatewayClass and TCP Gateway

Source: https://gateway.envoyproxy.io/docs/tasks/traffic/tcp-routing

This snippet installs the necessary GatewayClass and a Gateway resource configured for TCP listeners on ports 8088 and 8089. Ensure the controllerName matches your installation.

```yaml
cat <<EOF | kubectl apply -f -
kind: GatewayClass
apiVersion: gateway.networking.k8s.io/v1
metadata:
  name: eg
spec:
  controllerName: gateway.envoyproxy.io/gatewayclass-controller
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: tcp-gateway
spec:
  gatewayClassName: eg
  listeners:
  - name: foo
    protocol: TCP
    port: 8088
    allowedRoutes:
      kinds:
      - kind: TCPRoute
  - name: bar
    protocol: TCP
    port: 8089
    allowedRoutes:
      kinds:
      - kind: TCPRoute
EOF

```

--------------------------------

### Install Main Envoy Gateway Helm Chart

Source: https://gateway.envoyproxy.io/docs/install/install-helm

After installing CRDs separately, install the main Envoy Gateway Helm chart using the `--skip-crds` flag to avoid re-applying CRDs.

```bash
helm install eg oci://docker.io/envoyproxy/gateway-helm \
  --version v1.8.2 \
  -n envoy-gateway-system \
  --create-namespace \
  --skip-crds
```

--------------------------------

### Test HTTP Routing to example-svc

Source: https://gateway.envoyproxy.io/docs/tasks/traffic/http-routing

Tests routing to the 'example-svc' backend by sending a request with the 'example.com' Host header to the Gateway. Expects a 200 status code and a response from the example backend.

```bash
curl -vvv --header "Host: example.com" "http://${GATEWAY_HOST}/"
```

--------------------------------

### Query Example App via Envoy Proxy (Local)

Source: https://gateway.envoyproxy.io/docs/tasks/security/tls-termination

Send a request to the example application through the locally port-forwarded Envoy proxy. This tests the TLS termination and routing when accessing via localhost.

```bash
curl -v -HHost:www.example.com --resolve "www.example.com:8443:127.0.0.1" --cacert example.com.crt https://www.example.com:8443/get
```

--------------------------------

### Install egctl using Homebrew

Source: https://gateway.envoyproxy.io/docs/install/install-egctl

Install egctl conveniently using the Homebrew package manager on macOS and Linux.

```bash
brew install egctl
```

--------------------------------

### Generate Client Certificate and Key

Source: https://gateway.envoyproxy.io/docs/tasks/security/mutual-tls

Creates a certificate signing request and signs it with the root certificate to generate a client certificate and private key for `client.example.com`. This is used for client authentication in Mutual TLS.

```bash
openssl req -out client.example.com.csr -newkey rsa:2048 -nodes -keyout client.example.com.key -subj "/CN=client.example.com/O=example organization"
openssl x509 -req -days 365 -CA example.com.crt -CAkey example.com.key -set_serial 0 -in client.example.com.csr -out client.example.com.crt
```

--------------------------------

### Install Add-ons with OpenTelemetry Collector Enabled

Source: https://gateway.envoyproxy.io/docs/tasks/observability/grafana-integration

Installs the observability add-ons with the OpenTelemetry Collector enabled by setting the corresponding Helm value.

```bash
helm install eg-addons oci://docker.io/envoyproxy/gateway-addons-helm --version v1.8.2 --set opentelemetry-collector.enabled=true -n monitoring --create-namespace
```

--------------------------------

### Configure GRUB for IOMMU and VFIO

Source: https://gateway.envoyproxy.io/docs/tasks/security/private-key-provider

Updates the GRUB configuration to enable IOMMU and bind QAT devices to vfio-pci.

```bash
cat /etc/default/grub:
GRUB_CMDLINE_LINUX="intel_iommu=on vfio-pci.ids=[QAT device id]"
update-grub
reboot
```

--------------------------------

### Apply HTTPRoute and Backend Resources

Source: https://gateway.envoyproxy.io/docs/tasks/security/backend-skip-tls-verification

Apply the HTTPRoute and Backend resources to your cluster. This example sets up a route to a TLS-enabled backend service.

```yaml
---apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: backend
spec:
  parentRefs:
    - name: eg
  hostnames:
    - "www.example.com"
  rules:
    - backendRefs:
        - group: gateway.envoyproxy.io
          kind: Backend
          name: tls-backend
      matches:
        - path:
            type: PathPrefix
            value: "/"
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: Backend
metadata:
  name: tls-backend
  namespace: default
spec:
  endpoints:
    - fqdn:
        hostname: tls-backend.default.svc.cluster.local
        port: 443

```

--------------------------------

### Path Rewrite with Regex Substitution (Example 2)

Source: https://gateway.envoyproxy.io/docs/api/extension_types

This example shows a simple regex substitution where 'one' is replaced by 'two' in the path.

```yaml
replaceRegexMatch:
  pattern: "one"
  substitution: "two"
```

--------------------------------

### Build Extension Server Image

Source: https://gateway.envoyproxy.io/docs/tasks/extensibility/extension-server

Builds the Docker image for the example extension server. Note: The default tag is 'extension-server:latest'.

```bash
make image
```

--------------------------------

### Start Local HTTP Server

Source: https://gateway.envoyproxy.io/docs/tasks/operations/standalone-deployment-mode

Starts a simple Python HTTP server on port 3000 to act as a local endpoint for testing.

```python
python3 -m http.server 3000
```

--------------------------------

### Query Example App via Gateway with HTTP/3

Source: https://gateway.envoyproxy.io/docs/tasks/traffic/http3

Use a custom Docker image with an HTTP/3-enabled curl binary to query the example application through the Gateway. This requires the Gateway's external IP and assumes the application is accessible via HTTPS on port 443.

```bash
docker run --net=host --rm ghcr.io/macbre/curl-http3 curl -kv --http3 -HHost:www.example.com --resolve "www.example.com:443:${GATEWAY_HOST}" https://www.example.com/get
```

--------------------------------

### Deploy Merged Gateways Resources

Source: https://gateway.envoyproxy.io/docs/tasks/operations/deployment-mode

Applies the Kubernetes resources for the merged gateways example to your cluster.

```bash
kubectl apply -f https://raw.githubusercontent.com/envoyproxy/gateway/latest/examples/kubernetes/merged-gateways.yaml
```

--------------------------------

### egctl Status Output Example

Source: https://gateway.envoyproxy.io/docs/troubleshooting/configuration

Example output from egctl x status all -A, showing the status of GatewayClass, Gateway, and HTTPRoute resources.

```text
NAME              TYPE       STATUS    REASON
gatewayclass/eg   Accepted   True      Accepted

NAMESPACE   NAME         TYPE         STATUS    REASON
default     gateway/eg   Programmed   True      Programmed
                         Accepted     True      Accepted

NAMESPACE   NAME                TYPE           STATUS    REASON
default     httproute/backend   ResolvedRefs   False     BackendNotFound
                                Accepted       True      Accepted

```

--------------------------------

### Load test without connection limits

Source: https://gateway.envoyproxy.io/docs/tasks/traffic/connection-limit

Use `hey` to simulate 10 concurrent connections with 1 request per second for 10 seconds to test the gateway's behavior without any connection limits.

```bash
hey -c 10 -q 1 -z 10s  -host "www.example.com" http://${GATEWAY_HOST}/get

```

--------------------------------

### Delete JWT Example SecurityPolicy

Source: https://gateway.envoyproxy.io/docs/tasks/security/jwt-authentication

Use this command to remove the JWT authentication example SecurityPolicy. Ensure you have kubectl configured to interact with your cluster.

```bash
kubectl delete securitypolicy/jwt-example
```