### Hello-World Service Response Example Source: https://kgateway.dev/docs/envoy/latest/traffic-management/weighted-routes Example output from the hello-world service when a request is successfully routed to it. ```txt HTTP/1.1 200 OK server: envoy date: Tue, 29 Jul 2025 20:07:36 GMT content-type: text/plain content-length: 167 expires: Tue, 29 Jul 2025 20:07:35 GMT cache-control: no-cache x-envoy-upstream-service-time: 0 Server address: 10.244.0.8:80 Server name: hello-world-669dfbd799-g4jkg Date: 29/Jul/2025:20:07:36 +0000 URI: /anything/a Request ID: 796644ce8bda8ae5ecc36c5f4117a590 ``` -------------------------------- ### Example Output of CRD Installation Source: https://kgateway.dev/docs/envoy/latest/install/helm Shows the expected console output after successfully applying Kubernetes Gateway API CRDs. ```console customresourcedefinition.apiextensions.k8s.io/gatewayclasses.gateway.networking.k8s.io created customresourcedefinition.apiextensions.k8s.io/gateways.gateway.networking.k8s.io created customresourcedefinition.apiextensions.k8s.io/httproutes.gateway.networking.k8s.io created customresourcedefinition.apiextensions.k8s.io/referencegrants.gateway.networking.k8s.io created customresourcedefinition.apiextensions.k8s.io/grpcroutes.gateway.networking.k8s.io created ``` -------------------------------- ### Execute OpenSSL Command with Path Source: https://kgateway.dev/docs/envoy/latest/setup/listeners/tls-passthrough Example of how to execute an OpenSSL command by specifying the full path to the binary, useful when multiple versions are installed or the default is not desired. ```bash /usr/local/opt/openssl@3/bin/openssl req -new -newkey rsa:4096 -x509 -sha256 -days 3650... ``` -------------------------------- ### Example Output of Initial Request Source: https://kgateway.dev/docs/envoy/latest/about/policies/global-attachment Example output showing a successful 200 OK response and the JSON payload from the httpbin service. ```txt HTTP/1.1 200 OK access-control-allow-credentials: true access-control-allow-origin: * content-type: application/json; encoding=utf-8 date: Tue, 29 Jul 2025 20:08:21 GMT content-length: 587 x-envoy-upstream-service-time: 1 server: envoy ``` ```json { "args": {}, "headers": { "Accept": [ "*/*" ], "Host": [ "www.example.com" ], "User-Agent": [ "curl/8.7.1" ], "X-Envoy-Expected-Rq-Timeout-Ms": [ "15000" ], "X-Envoy-External-Address": [ "127.0.0.1" ], "X-Forwarded-For": [ "10.244.0.7" ], "X-Forwarded-Proto": [ "http" ], "X-Request-Id": [ "7ec1f5f7-72b7-4053-b2e4-0117a2438d4c" ] }, "origin": "10.244.0.7", "url": "http://www.example.com/anything", "data": "", "files": null, "form": null, "json": null } ``` -------------------------------- ### Install Argo Rollouts Source: https://kgateway.dev/docs/envoy/latest/integrations/argo Create the 'argo-rollouts' namespace and apply the official Argo Rollouts installation manifest. This sets up the core controller. ```sh kubectl create namespace argo-rollouts kubectl apply -n argo-rollouts -f https://github.com/argoproj/argo-rollouts/releases/latest/download/install.yaml ``` -------------------------------- ### Example Output of kgateway Pods Source: https://kgateway.dev/docs/envoy/latest/quickstart This is an example of the expected output when checking the status of kgateway pods, indicating they are running. ```console NAME READY STATUS RESTARTS AGE kgateway-5495d98459-46dpk 1/1 Running 0 19s ``` -------------------------------- ### Install ingress2gateway to System Path Source: https://kgateway.dev/docs/envoy/latest/migrate/install/linux Install the ingress2gateway binary to /usr/local/bin with root ownership and execute permissions. Ensure /usr/local/bin is in your PATH. ```bash sudo install -o root -g root -m 0755 ingress2gateway /usr/local/bin/ingress2gateway ``` -------------------------------- ### Example Grafana Pod Output Source: https://kgateway.dev/docs/envoy/latest/observability/otel-stack Example output showing the status of Loki and Tempo pods after successful deployment. ```console NAME READY STATUS RESTARTS AGE loki-0 2/2 Running 0 3m45s loki-chunks-cache-0 2/2 Running 0 3m45s loki-results-cache-0 2/2 Running 0 3m45s tempo-0 1/1 Running 0 2m10s ``` -------------------------------- ### Install Node.js Dependencies Source: https://kgateway.dev/docs/envoy/latest/reference/contribution/preview Installs the necessary Node.js dependencies for the documentation build process. Requires Node.js and npm to be installed. ```shell npm install ``` -------------------------------- ### Example dig Output Source: https://kgateway.dev/docs/envoy/latest/integrations/external-dns-cert-manager This is an example of the expected output from the 'dig' command when a DNS record is successfully created. ```text ;; ANSWER SECTION: ${DOMAIN} 300 IN A 164.90.241.80 ``` -------------------------------- ### Example Output Showing Reserved Header Source: https://kgateway.dev/docs/envoy/latest/traffic-management/header-control/early-request-header-modifier Example JSON output from the httpbin app, illustrating that the 'X-User-Id' header was successfully received. ```json { "headers": { "Accept": [ "*/*" ], "Host": [ "www.example.com" ], "User-Agent": [ "curl/8.7.1" ], "X-Envoy-Expected-Rq-Timeout-Ms": [ "15000" ], "X-Envoy-External-Address": [ "127.0.0.1" ], "X-Forwarded-For": [ "10.244.0.7" ], "X-Forwarded-Proto": [ "http" ], "X-Request-Id": [ "d2076b1d-2e3e-49fb-a24f-703dbcd80665" ], "X-User-Id": [ "reserved-user" ] } } ``` -------------------------------- ### Test ingress2gateway Installation Source: https://kgateway.dev/docs/envoy/latest/migrate/install/macos Verify the installation by checking the version of the ingress2gateway binary. ```bash ingress2gateway version ``` -------------------------------- ### HTTP response example Source: https://kgateway.dev/docs/envoy/latest/install/sample-app Example of a successful HTTP response from the httpbin application, indicating a 200 OK status. ```txt HTTP/1.1 200 OK access-control-allow-credentials: true access-control-allow-origin: * content-type: application/json; encoding=utf-8 date: Thu, 13 Feb 2025 18:49:32 GMT content-length: 330 x-envoy-upstream-service-time: 4 server: envoy ``` -------------------------------- ### Install OpenSSL via Homebrew Source: https://kgateway.dev/docs/envoy/latest/setup/listeners/https Install the OpenSSL version using Homebrew if LibreSSL is detected or a compatible version is not available. ```bash brew install openssl ``` -------------------------------- ### Httpbin Service Response Example Source: https://kgateway.dev/docs/envoy/latest/traffic-management/weighted-routes Example JSON output from the httpbin service when a request is successfully routed to it. ```json { "args": {}, "headers": { "Accept": [ "*/*" ], "Host": [ "www.example.com" ], "User-Agent": [ "curl/8.7.1" ], "X-Envoy-Expected-Rq-Timeout-Ms": [ "15000" ], "X-Envoy-External-Address": [ "127.0.0.1" ], "X-Forwarded-For": [ "10.244.0.7" ], "X-Forwarded-Proto": [ "http" ], "X-Request-Id": [ "7ec1f5f7-72b7-4053-b2e4-0117a2438d4c" ] }, "origin": "10.244.0.7", "url": "http://www.example.com/anything", "data": "", "files": null, "form": null, "json": null } ``` -------------------------------- ### Example Output with Cross-Namespace Policy Source: https://kgateway.dev/docs/envoy/latest/about/policies/global-attachment Example output showing a 200 OK response, indicating that the path transformation did not occur because the policy was in a different namespace. ```txt HTTP/1.1 200 OK access-control-allow-credentials: true access-control-allow-origin: * content-type: application/json; encoding=utf-8 date: Tue, 29 Jul 2025 20:08:21 GMT content-length: 587 x-envoy-upstream-service-time: 1 server: envoy ``` ```json { "args": {}, "headers": { "Accept": [ "*/*" ], "Host": [ "www.example.com" ], "User-Agent": [ "curl/8.7.1" ], "X-Envoy-Expected-Rq-Timeout-Ms": [ "15000" ], "X-Envoy-External-Address": [ "127.0.0.1" ] } } ``` -------------------------------- ### Example Output of Request Headers Source: https://kgateway.dev/docs/envoy/latest/traffic-management/header-control/request-header This is an example of the JSON output received when a request is made, showing the dynamically set 'X-Client-Ip' header. ```json { "headers": { "Accept": [ "*/*" ], "Host": [ "headers.example:8080" ], "X-Client-Ip": [ "127.0.0.1" ], "X-Envoy-Expected-Rq-Timeout-Ms": [ "15000" ], "X-Forwarded-Proto": [ "http" ], "X-Request-Id": [ "f83bb750-67f7-47dc-8c79-4a582892034c" ] } } ``` -------------------------------- ### Example Successful Response Output Source: https://kgateway.dev/docs/envoy/latest/traffic-management/buffering Example JSON output from a successful httpbin '/anything' POST request with a small payload. ```json { "args": {}, "data": "{\"payload\": \"hello world\"}", "files": {}, "form": {}, "headers": { ... }, "json": { "payload": "hello world" }, "method": "POST", "origin": "...", "url": "https://$INGRESS_GW_ADDRESS:8080/anything" } ``` -------------------------------- ### Example Output After Transformation Source: https://kgateway.dev/docs/envoy/latest/about/policies/global-attachment Example output showing a 418 I'm a teapot response, indicating the path transformation was successful. ```txt HTTP/1.1 418 Unknown access-control-allow-credentials: true access-control-allow-origin: * x-more-info: http://tools.ietf.org/html/rfc2324 date: Wed, 30 Jul 2025 15:45:07 GMT content-length: 13 content-type: text/plain; charset=utf-8 x-envoy-upstream-service-time: 1 server: envoy I'm a teapot! ``` -------------------------------- ### Install kgateway Control Plane (Default) Source: https://kgateway.dev/docs/envoy/latest/install/helm Installs the kgateway control plane using Helm version v2.3.1 into the 'kgateway-system' namespace. Assumes default configuration. ```sh helm upgrade -i -n kgateway-system kgateway oci://cr.kgateway.dev/kgateway-dev/charts/kgateway \ --version v2.3.1 ``` -------------------------------- ### Test GET Request Source: https://kgateway.dev/docs/envoy/latest/traffic-management/match/method Sends a GET request to the httpbin app on the 'match.example' domain and verifies a 200 OK response. This tests the HTTP method matching rule. ```sh curl -vi http://$INGRESS_GW_ADDRESS:8080/get -H "host: match.example:8080" ``` ```sh curl -vi localhost:8080/get -H "host: match.example" ``` -------------------------------- ### JSON response headers example Source: https://kgateway.dev/docs/envoy/latest/install/sample-app Example JSON output detailing the headers received by the httpbin application, including host, user-agent, and request ID. ```json { "headers": { "Accept": [ "*/*" ], "Host": [ "www.example.com" ], "User-Agent": [ "curl/8.7.1" ], "X-Envoy-Expected-Rq-Timeout-Ms": [ "15000" ], "X-Forwarded-Proto": [ "http" ], "X-Request-Id": [ "26be0bcd-d941-48f4-ac3b-d5ac288ac46f" ] } } ``` -------------------------------- ### Create HTTPRoute for GET Method Source: https://kgateway.dev/docs/envoy/latest/traffic-management/match/method Defines an HTTPRoute resource that matches incoming GET requests for the 'match.example' domain and forwards them to the httpbin service. ```yaml apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: httpbin-match namespace: httpbin spec: parentRefs: - name: http namespace: kgateway-system hostnames: - match.example rules: - matches: - method: "GET" backendRefs: - name: httpbin port: 8000 ``` -------------------------------- ### Example Envoy HTTP Protocol Options Output Source: https://kgateway.dev/docs/envoy/latest/setup/http10 This is an example output from querying the Envoy admin interface, showing that the accept_http_10 setting is enabled. ```json "http_protocol_options": { "accept_http_10": true } ``` -------------------------------- ### Deploy Hello-World Deployment and Service Source: https://kgateway.dev/docs/envoy/latest/traffic-management/weighted-routes Deploys a sample application to demonstrate backend responses for routing tests. This setup is required before configuring HTTPRoute rules. ```yaml apiVersion: apps/v1 kind: Deployment metadata: name: hello-world namespace: httpbin spec: replicas: 1 selector: matchLabels: app: hello-world template: metadata: labels: app: hello-world spec: containers: - name: hello-world image: nginxdemos/hello:plain-text ports: - containerPort: 80 --- apiVersion: v1 kind: Service metadata: name: hello-world namespace: httpbin spec: selector: app: hello-world ports: - port: 80 targetPort: 80 ``` -------------------------------- ### Get Helm Values Source: https://kgateway.dev/docs/envoy/latest/about/policies/global-attachment Retrieve the current Helm values for your kgateway installation to modify them. ```sh helm get values kgateway -n kgateway-system -o yaml > kgateway.yaml open kgateway.yaml ``` -------------------------------- ### Successful Reviews App Response Example Source: https://kgateway.dev/docs/envoy/latest/resiliency/retry/retry Example output demonstrating a successful HTTP 200 OK response from the reviews application, including the response body with review details. ```text HTTP/1.1 200 OK ... {"id": "1","podname": "reviews-v1-598b896c9d-l7d8l","clustername": "null","reviews": [{ "reviewer": "Reviewer1", "text": "An extremely entertaining play by Shakespeare. The slapstick humour is refreshing!"},{ "reviewer": "Reviewer2", "text": "Absolutely fun and entertaining. The play lacks thematic depth when compared to other plays by Shakespeare."}]} ``` -------------------------------- ### Cleanup Envoy mTLS Resources Source: https://kgateway.dev/docs/envoy/latest/setup/listeners/mtls Removes the Kubernetes resources and local files created during the mTLS setup guide. ```sh kubectl delete httproute httpbin-https -n httpbin kubectl delete gateway mtls -n kgateway-system kubectl delete secret https-cert -n kgateway-system kubectl delete configmap ca-cert -n kgateway-system rm -rf ../example_certs ``` -------------------------------- ### Example httpbin Pod Output Source: https://kgateway.dev/docs/envoy/latest/traffic-management/route-delegation/label Sample output demonstrating the expected status of httpbin pods after successful deployment. Shows pod names, readiness, status, restarts, and age. ```text NAME READY STATUS RESTARTS AGE httpbin-f46cc8b9b-bzl9z 3/3 Running 0 7s NAME READY STATUS RESTARTS AGE httpbin-f46cc8b9b-nhtmg 3/3 Running 0 6s ``` -------------------------------- ### Send Request to Verify Response Header (Local) Source: https://kgateway.dev/docs/envoy/latest/traffic-management/header-control/response-header Send a curl request to the httpbin app to verify the added response header. This example assumes a local setup. ```sh curl -vi localhost:8080/response-headers -H "host: headers.example" ``` -------------------------------- ### Deploy Helloworld Sample Apps Source: https://kgateway.dev/docs/envoy/latest/traffic-management/traffic-split Apply the Kubernetes manifest to deploy three versions of the Helloworld sample application within the specified namespace. ```sh kubectl -n helloworld apply -f https://raw.githubusercontent.com/solo-io/gloo-edge-use-cases/main/docs/sample-apps/helloworld.yaml ``` -------------------------------- ### Send Request to Verify Header Addition (Local) Source: https://kgateway.dev/docs/envoy/latest/traffic-management/header-control/request-header Send a curl request to verify that the 'my-header: hello' was successfully added to the request. This example assumes a local gateway setup. ```sh curl -vi localhost:8080/headers -H "host: headers.example" ``` -------------------------------- ### Folder Structure Example Source: https://kgateway.dev/docs/envoy/latest/reference/contribution/add-docs Illustrates the structure for creating folders and index files to organize documentation, where '_index.md' provides overview information. ```markdown |-- security |----- _index.md // provides conceptional security information |----- access-logging.md // guide for how to set up access logging |----- cors.md // guide for how to set up CORS |----- csrf.md // guide for how to set up CSRF ``` -------------------------------- ### Create IAM Policy for Lambda Actions Source: https://kgateway.dev/docs/envoy/latest/traffic-management/destination-types/backends/lambda/service-accounts Define and create an IAM policy that grants permissions for listing, invoking, getting, and asynchronously invoking Lambda functions. This policy can be split into discovery and invocation policies in more advanced setups. ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "lambda:ListFunctions", "lambda:InvokeFunction", "lambda:GetFunction", "lambda:InvokeAsync" ], "Resource": "*" } ] } ``` ```shell cat >policy.json < service.name: Str(http.kgateway-system) -> service.namespace: Str(kgateway-system) -> k8s.pod.name: Str(http-...) -> k8s.namespace.name: Str(kgateway-system) ``` -------------------------------- ### Example Prometheus Metrics Output Source: https://kgateway.dev/docs/envoy/latest/observability/gateway-metrics This is an example of the output you can expect from the Prometheus statistics endpoint, showing cluster request counts. ```text # TYPE envoy_cluster_external_upstream_rq counter envoy_cluster_external_upstream_rq{envoy_response_code="200",envoy_cluster_name="kube_httpbin_httpbin_8000"} 5 ``` -------------------------------- ### Build and Serve Documentation Locally Source: https://kgateway.dev/docs/envoy/latest/reference/contribution/preview Builds the Envoy documentation site locally and starts a development server for live previewing. The site will be available at http://localhost:1313. ```shell hugo server -D ``` -------------------------------- ### Install cert-manager Source: https://kgateway.dev/docs/envoy/latest/traffic-management/destination-types/backends/lambda/service-accounts Installs cert-manager, a prerequisite for the EKS Pod Identity Webhook. Download the YAML configuration and apply it using kubectl. ```sh wget https://github.com/cert-manager/cert-manager/releases/download/v1.12.4/cert-manager.yaml kubectl apply -f cert-manager.yaml ``` -------------------------------- ### Deploy Petstore Sample App Source: https://kgateway.dev/docs/envoy/latest/setup/listeners/sni Deploys the Petstore sample application using kubectl, which is used to demonstrate SNI routing capabilities. ```sh kubectl apply -f https://raw.githubusercontent.com/solo-io/gloo/v1.16.x/example/petstore/petstore.yaml ``` -------------------------------- ### Verify Response Headers Source: https://kgateway.dev/docs/envoy/latest/traffic-management/transformations/inject-response-headers Example output demonstrating the expected response headers after applying the transformations. Verify that injected headers like x-podname, x-season, x-gateway-response, x-response-raw, and x-replace are present and correctly set. ```console ... < HTTP/1.1 200 OK HTTP/1.1 200 OK < access-control-allow-credentials: true access-control-allow-credentials: true < access-control-allow-origin: * access-control-allow-origin: * < content-type: application/json; encoding=utf-8 content-type: application/json; encoding=utf-8 < content-length: 3 content-length: 3 < x-envoy-upstream-service-time: 2 x-envoy-upstream-service-time: 2 < server: envoy server: envoy < x-envoy-decorator-operation: httpbin.httpbin.svc.cluster.local:8000/* x-envoy-decorator-operation: httpbin.httpbin.svc.cluster.local:8000/* < x-envoy-upstream-service-time: 1 < x-podname: http-85d5775587-tkxmt x-podname: http-85d5775587-tkxmt < x-replace: zljPMhO86gJCFc69jZ0+kQ x-replace: zljPMhO86gJCFc69jZ0+kQ < x-response-raw: hello x-response-raw: hello < x-gateway-response: my custom request header x-gateway-response: my custom request header < x-season: summer x-season: summer ``` -------------------------------- ### Test /anything/a Route (Specific Match) Source: https://kgateway.dev/docs/envoy/latest/traffic-management/weighted-routes Sends a request to the '/anything/a' path. This should route to the hello-world service due to the more specific path match taking precedence. ```sh curl -i http://$INGRESS_GW_ADDRESS:8080/anything/a -H "host: www.example.com:8080" ``` ```sh curl -i localhost:8080/anything/a -H "host: www.example.com" ``` -------------------------------- ### Example ACL Denied Metrics Output Source: https://kgateway.dev/docs/envoy/latest/security/acl An example of the output from querying ACL denied metrics, showing the count of blocked requests. ```console dev.kgateway.http.acl.blocked: 3 ``` -------------------------------- ### Generate TLS Certificate for petstore.example.com Source: https://kgateway.dev/docs/envoy/latest/setup/listeners/sni Creates a Certificate Signing Request (CSR) and then a signed TLS certificate for the petstore.example.com domain using the previously generated root certificate. ```shell openssl req -out example_certs/petstore.example.com.csr -newkey rsa:2048 -nodes -keyout example_certs/petstore.example.com.key -subj "/CN=petstore.example.com/O=petstore organization" openssl x509 -req -sha256 -days 365 -CA example_certs/example.com.crt -CAkey example_certs/example.com.key -set_serial 1 -in example_certs/petstore.example.com.csr -out example_certs/petstore.example.com.crt ``` -------------------------------- ### Example Envoy Config with Idle Timeout Source: https://kgateway.dev/docs/envoy/latest/resiliency/timeouts/idle This is an example output from the config dump, showing the http_connection_manager configuration with the idle_timeout set to '30s'. ```json { "name": "envoy.filters.network.http_connection_manager", "typed_config": { "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager", "stat_prefix": "http", "rds": { "config_source": { "ads": {}, "resource_api_version": "V3" }, "route_config_name": "listener~8080" }, "http_filters": [ { "name": "envoy.filters.http.router", "typed_config": { "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router" } } ], "use_remote_address": true, "normalize_path": true, "merge_slashes": true, "common_http_protocol_options": { "idle_timeout": "30s" } } } ``` -------------------------------- ### Deploy Sample Application for Failure Simulation Source: https://kgateway.dev/docs/envoy/latest/resiliency/retry/retry Deploy the Bookinfo reviews app with a sleep command to simulate failures. This allows for testing retry mechanisms. ```yaml --- apiVersion: v1 kind: Service metadata: name: reviews namespace: default labels: app: reviews service: reviews spec: ports: - port: 9080 name: http selector: app: reviews --- apiVersion: v1 kind: ServiceAccount metadata: name: bookinfo-reviews namespace: default labels: account: reviews --- apiVersion: apps/v1 kind: Deployment metadata: name: reviews-v1 namespace: default labels: app: reviews version: v1 spec: replicas: 1 selector: matchLabels: app: reviews version: v1 template: metadata: labels: app: reviews version: v1 spec: serviceAccountName: bookinfo-reviews containers: - name: reviews image: docker.io/istio/examples-bookinfo-reviews-v1:1.20.3 imagePullPolicy: IfNotPresent env: - name: LOG_DIR value: "/tmp/logs" ports: - containerPort: 9080 volumeMounts: - name: tmp mountPath: /tmp - name: wlp-output mountPath: /opt/ibm/wlp/output volumes: - name: wlp-output emptyDir: {} - name: tmp emptyDir: {} ``` -------------------------------- ### Create HTTPRoute for httpbin.example.com (Gateway API) Source: https://kgateway.dev/docs/envoy/latest/setup/listeners/sni Apply this HTTPRoute to direct traffic for httpbin.example.com to the httpbin service. Ensure the parent gateway 'sni' is correctly referenced. ```yaml apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: httpbin-https namespace: httpbin spec: parentRefs: - name: sni namespace: kgateway-system hostnames: - "httpbin.example.com" rules: - backendRefs: - name: httpbin port: 8000 ``` -------------------------------- ### Example Circuit Breaker Output Source: https://kgateway.dev/docs/envoy/latest/resiliency/circuit-breakers Example output from verifying circuit breaker configuration, showing the applied limits for a specific cluster. ```json { "name": "kube_httpbin_httpbin_8000", "connect_timeout": "5s", "max_connections": 1000, "max_pending_requests": 500, "max_requests": 2000, "max_retries": 10 } ``` -------------------------------- ### Example JSON Response Source: https://kgateway.dev/docs/envoy/latest/traffic-management/route-delegation/header-query This is an example of a successful HTTP 200 OK response after sending a request with inherited and custom headers and query parameters. ```json { "args": { "query2": [ "val2" ], "queryX": [ "valX" ] }, "headers": { "Accept": [ "*/*" ], "Header2": [ "val2" ], "Headerx": [ "valX" ], "Host": [ "delegation.example:8080" ], "User-Agent": [ "curl/8.7.1" ], "X-Envoy-Expected-Rq-Timeout-Ms": [ "15000" ], "X-Forwarded-Proto": [ "http" ], "X-Request-Id": [ "30dfc350-d546-4f53-857d-cb3edab68ebd" ] }, "origin": "10.0.64.27:50590", "url": "http://delegation.example:8080/anything/team2/bar?queryX=valX&query2=val2", "data": "", "files": null, "form": null, "json": null } ``` -------------------------------- ### Create OpenSSL Configuration for Gateway Certificate Source: https://kgateway.dev/docs/envoy/latest/integrations/aws-elb/nlb Generates an OpenSSL configuration file required for creating a custom TLS certificate for the gateway. Ensure all `example.com` references are replaced with your actual domain. ```sh cat <<'EOF' > example_certs/gateway.cnf [ req ] default_bits = 2048 prompt = no default_md = sha256 distinguished_name = dn req_extensions = req_ext [ dn ] CN = *.example.com O = any domain [ req_ext ] subjectAltName = @alt_names [ alt_names ] DNS.1 = *.example.com DNS.2 = example.com EOF ``` -------------------------------- ### Example Gateway Status Output Source: https://kgateway.dev/docs/envoy/latest/traffic-management/destination-types/kube-services/grpc-services An example of the expected status output for a successfully deployed Gateway resource, indicating acceptance and programming by the controller. ```yaml status: addresses: - type: IPAddress value: ${INGRESS_GW_ADDRESS} conditions: - lastTransitionTime: "2024-11-20T16:01:25Z" message: "" observedGeneration: 2 reason: Accepted status: "True" type: Accepted - lastTransitionTime: "2024-11-20T16:01:25Z" message: "" observedGeneration: 2 reason: Programmed status: "True" type: Programmed ``` -------------------------------- ### Verify Certificate and Key Files Source: https://kgateway.dev/docs/envoy/latest/setup/listeners/sni Lists the generated certificate and key files to confirm their successful creation. This is a verification step before proceeding to store them. ```shell ls example_cert* ``` -------------------------------- ### Example Output of Attached Policies Source: https://kgateway.dev/docs/envoy/latest/traffic-management/destination-types/backends/lambda/service-accounts This is an example of the JSON output when verifying attached policies to an IAM role, showing the policy name and ARN. ```json { "AttachedPolicies": [ { "PolicyName": "lambda-policy", "PolicyArn": "arn:aws:iam::111122223333:policy/lambda-policy" } ] } ``` -------------------------------- ### HTTPS Request Output Example Source: https://kgateway.dev/docs/envoy/latest/setup/listeners/https Example output from a curl request to an HTTPS endpoint, showing the TLS handshake details and HTTP response. ```text * ALPN, offering h2 * ALPN, offering http/1.1 * successfully set certificate verify locations: * CAfile: /etc/ssl/cert.pem * CApath: none * TLSv1.2 (OUT), TLS handshake, Client hello (1): * TLSv1.2 (IN), TLS handshake, Server hello (2): * TLSv1.2 (IN), TLS handshake, Certificate (11): * TLSv1.2 (IN), TLS handshake, Server key exchange (12): * TLSv1.2 (IN), TLS handshake, Server finished (14): * TLSv1.2 (OUT), TLS handshake, Client key exchange (16): * TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1): * TLSv1.2 (OUT), TLS handshake, Finished (20): * TLSv1.2 (IN), TLS change cipher, Change cipher spec (1): * TLSv1.2 (IN), TLS handshake, Finished (20): * SSL connection using TLSv1.2 / ECDHE-RSA-CHACHA20-POLY1305 * ALPN, server accepted to use h2 * Server certificate: * subject: CN=*; O=gateway * start date: Nov 5 01:54:04 2023 GMT * expire date: Nov 2 01:54:04 2033 GMT * issuer: CN=*; O=root * SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway. * Using HTTP2, server supports multi-use * Connection state changed (HTTP/2 confirmed) * Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0 * Using Stream ID: 1 (easy handle 0x15200e800) * > GET /status/200 HTTP/2 * > Host: https.example.com * > user-agent: curl/7.77.0 * > accept: */* * > * * Connection state changed (MAX_CONCURRENT_STREAMS == 2147483647)! * < HTTP/2 200 * HTTP/2 200 * ... ``` -------------------------------- ### Example Access Log JSON Output Source: https://kgateway.dev/docs/envoy/latest/security/access-logging This is an example of the structured JSON output for an access log entry. It contains details about the request and response. ```json { "authority": "www.example.com:8080", "bytes_received": 0, "bytes_sent": 0, "method": "GET", "path": "/status/200", "protocol": "HTTP/1.1", "req_x_forwarded_for": null, "request_id": "a6758866-0f26-4c95-95d9-4032c365c498", "resp_backend_service_time": "0", "response_code": 200, "response_flags": "-", "start_time": "2024-08-19T20:57:57.511Z", "total_duration": 1, "backendCluster": "kube-svc:httpbin-httpbin-8000_httpbin", "backendHost": "10.36.0.14:8080", "user_agent": "curl/7.77.0" } ```