Installation on Envoy Gateway

Install with Helm

Mon, 01 Jan 0001 00:00:00 +0000

Helm is a package manager for Kubernetes that automates the release and management of software on Kubernetes.

Envoy Gateway can be installed via a Helm chart with a few simple steps, depending on if you are deploying for the first time, upgrading Envoy Gateway from an existing installation, or migrating from Envoy Gateway.

Before you begin

Compatibility Matrix

Refer to the Version Compatibility Matrix to learn more.

The Envoy Gateway Helm chart is hosted by DockerHub.

Install with Kubernetes YAML

Mon, 01 Jan 0001 00:00:00 +0000

This task walks you through installing Envoy Gateway in your Kubernetes cluster.

The manual install process does not allow for as much control over configuration as the Helm install method, so if you need more control over your Envoy Gateway installation, it is recommended that you use helm.

Before you begin

Envoy Gateway is designed to run in Kubernetes for production. The most essential requirements are:

Kubernetes 1.28 or later
The kubectl command-line tool

Compatibility Matrix

Refer to the Version Compatibility Matrix to learn more.

Install with YAML

Envoy Gateway is typically deployed to Kubernetes from the command line. If you don’t have Kubernetes, you should use kind to create one.

Install egctl

Mon, 01 Jan 0001 00:00:00 +0000

What is egctl?

egctl is a command line tool to provide additional functionality for Envoy Gateway users.

This task shows how to install the egctl CLI. egctl can be installed either from source, or from pre-built binary releases.

From The Envoy Gateway Project

The Envoy Gateway project provides two ways to fetch and install egctl. These are the official methods to get egctl releases. Installation through those methods can be found below the official methods.

Control Plane Authentication using custom certs

Mon, 01 Jan 0001 00:00:00 +0000

Envoy Gateway establishes a secure TLS connection for control plane communication between Envoy Gateway pods and the Envoy Proxy fleet. The TLS Certificates used here are self signed and generated using a job that runs before envoy gateway is created, and these certs and mounted on to the envoy gateway and envoy proxy pods.

This task will walk you through configuring custom certs for control plane auth.

Before you begin

We use Cert-Manager to manage the certificates. You can install it by following the official guide.

Gateway Addons Helm Chart

Mon, 01 Jan 0001 00:00:00 +0000

An Add-ons Helm chart for Envoy Gateway

Homepage: https://gateway.envoyproxy.io/

Maintainers

Name	Email	Url
envoy-gateway-steering-committee		https://github.com/envoyproxy/gateway/blob/main/GOVERNANCE.md
envoy-gateway-maintainers		https://github.com/envoyproxy/gateway/blob/main/CODEOWNERS

Source Code

https://github.com/envoyproxy/gateway

Requirements

Repository	Name	Version
https://fluent.github.io/helm-charts	fluent-bit	0.30.4
https://grafana.github.io/helm-charts	alloy	0.9.2
https://grafana.github.io/helm-charts	grafana	8.0.0
https://grafana.github.io/helm-charts	loki	4.8.0
https://grafana.github.io/helm-charts	tempo	1.3.1
https://open-telemetry.github.io/opentelemetry-helm-charts	opentelemetry-collector	0.108.0
https://prometheus-community.github.io/helm-charts	prometheus	25.21.0

Values

Key	Type	Default
alloy.alloy.configMap.content	string	"// Write your Alloy config here:\nlogging {\n level = \"info\"\n format = \"logfmt\"\n}\nloki.write \"alloy\" {\n endpoint {\n url = \"http://loki.monitoring.svc:3100/loki/api/v1/push\"\n }\n}\n// discovery.kubernetes allows you to find scrape targets from Kubernetes resources.\n// It watches cluster state and ensures targets are continually synced with what is currently running in your cluster.\ndiscovery.kubernetes \"pod\" {\n role = \"pod\"\n}\n\n// discovery.relabel rewrites the label set of the input targets by applying one or more relabeling rules.\n// If no rules are defined, then the input targets are exported as-is.\ndiscovery.relabel \"pod_logs\" {\n targets = discovery.kubernetes.pod.targets\n\n // Label creation - \"namespace\" field from \"__meta_kubernetes_namespace\"\n rule {\n source_labels = [\"__meta_kubernetes_namespace\"]\n action = \"replace\"\n target_label = \"namespace\"\n }\n\n // Label creation - \"pod\" field from \"__meta_kubernetes_pod_name\"\n rule {\n source_labels = [\"__meta_kubernetes_pod_name\"]\n action = \"replace\"\n target_label = \"pod\"\n }\n\n // Label creation - \"container\" field from \"__meta_kubernetes_pod_container_name\"\n rule {\n source_labels = [\"__meta_kubernetes_pod_container_name\"]\n action = \"replace\"\n target_label = \"container\"\n }\n\n // Label creation - \"app\" field from \"__meta_kubernetes_pod_label_app_kubernetes_io_name\"\n rule {\n source_labels = [\"__meta_kubernetes_pod_label_app_kubernetes_io_name\"]\n action = \"replace\"\n target_label = \"app\"\n }\n\n // Label creation - \"job\" field from \"__meta_kubernetes_namespace\" and \"__meta_kubernetes_pod_container_name\"\n // Concatenate values __meta_kubernetes_namespace/__meta_kubernetes_pod_container_name\n rule {\n source_labels = [\"__meta_kubernetes_namespace\", \"__meta_kubernetes_pod_container_name\"]\n action = \"replace\"\n target_label = \"job\"\n separator = \"/\"\n replacement = \"$1\"\n }\n\n // Label creation - \"container\" field from \"__meta_kubernetes_pod_uid\" and \"__meta_kubernetes_pod_container_name\"\n // Concatenate values __meta_kubernetes_pod_uid/__meta_kubernetes_pod_container_name.log\n rule {\n source_labels = [\"__meta_kubernetes_pod_uid\", \"__meta_kubernetes_pod_container_name\"]\n action = \"replace\"\n target_label = \"__path__\"\n separator = \"/\"\n replacement = \"/var/log/pods/$1/.log\"\n }\n\n // Label creation - \"container_runtime\" field from \"__meta_kubernetes_pod_container_id\"\n rule {\n source_labels = [\"__meta_kubernetes_pod_container_id\"]\n action = \"replace\"\n target_label = \"container_runtime\"\n regex = \"^(\\\\S+):\\\\/\\\\/.+$\"\n replacement = \"$1\"\n }\n}\n\n// loki.source.kubernetes tails logs from Kubernetes containers using the Kubernetes API.\nloki.source.kubernetes \"pod_logs\" {\n targets = discovery.relabel.pod_logs.output\n forward_to = [loki.process.pod_logs.receiver]\n}\n// loki.process receives log entries from other Loki components, applies one or more processing stages,\n// and forwards the results to the list of receivers in the component’s arguments.\nloki.process \"pod_logs\" {\n stage.static_labels {\n values = {\n cluster = \"envoy-gateway\",\n }\n }\n\n forward_to = [loki.write.alloy.receiver]\n}"
alloy.enabled	bool	`false`
alloy.fullnameOverride	string	`"alloy"`
fluent-bit.config.filters	string	`"[FILTER]\n Name kubernetes\n Match kube.\n Merge_Log On\n Keep_Log Off\n K8S-Logging.Parser On\n K8S-Logging.Exclude On\n\n[FILTER]\n Name grep\n Match kube.\n Regex $kubernetes['container_name'] ^envoy$\n\n[FILTER]\n Name parser\n Match kube.*\n Key_Name log\n Parser envoy\n Reserve_Data True\n"`
fluent-bit.config.inputs	string	`"[INPUT]\n Name tail\n Path /var/log/containers/.log\n multiline.parser docker, cri\n Tag kube.\n Mem_Buf_Limit 5MB\n Skip_Long_Lines On\n"`
fluent-bit.config.outputs	string	`"[OUTPUT]\n Name loki\n Match kube.*\n Host loki.monitoring.svc.cluster.local\n Port 3100\n Labels job=fluentbit, app=$kubernetes['labels']['app'], k8s_namespace_name=$kubernetes['namespace_name'], k8s_pod_name=$kubernetes['pod_name'], k8s_container_name=$kubernetes['container_name']\n"`
fluent-bit.config.service	string	`"[SERVICE]\n Daemon Off\n Flush {{ .Values.flush }}\n Log_Level {{ .Values.logLevel }}\n Parsers_File parsers.conf\n Parsers_File custom_parsers.conf\n HTTP_Server On\n HTTP_Listen 0.0.0.0\n HTTP_Port {{ .Values.metricsPort }}\n Health_Check On\n"`
fluent-bit.enabled	bool	`true`
fluent-bit.fullnameOverride	string	`"fluent-bit"`
fluent-bit.image.repository	string	`"fluent/fluent-bit"`
fluent-bit.podAnnotations.“fluentbit.io/exclude”	string	`"true"`
fluent-bit.podAnnotations.“prometheus.io/path”	string	`"/api/v1/metrics/prometheus"`
fluent-bit.podAnnotations.“prometheus.io/port”	string	`"2020"`
fluent-bit.podAnnotations.“prometheus.io/scrape”	string	`"true"`
fluent-bit.testFramework.enabled	bool	`false`
grafana.adminPassword	string	`"admin"`
grafana.dashboardProviders.“dashboardproviders.yaml”.apiVersion	int	`1`
grafana.dashboardProviders.“dashboardproviders.yaml”.providers[0].disableDeletion	bool	`false`
grafana.dashboardProviders.“dashboardproviders.yaml”.providers[0].editable	bool	`true`
grafana.dashboardProviders.“dashboardproviders.yaml”.providers[0].folder	string	`"envoy-gateway"`
grafana.dashboardProviders.“dashboardproviders.yaml”.providers[0].name	string	`"envoy-gateway"`
grafana.dashboardProviders.“dashboardproviders.yaml”.providers[0].options.path	string	`"/var/lib/grafana/dashboards/envoy-gateway"`
grafana.dashboardProviders.“dashboardproviders.yaml”.providers[0].orgId	int	`1`
grafana.dashboardProviders.“dashboardproviders.yaml”.providers[0].type	string	`"file"`
grafana.dashboardsConfigMaps.envoy-gateway	string	`"grafana-dashboards"`
grafana.datasources.“datasources.yaml”.apiVersion	int	`1`
grafana.datasources.“datasources.yaml”.datasources[0].name	string	`"Prometheus"`
grafana.datasources.“datasources.yaml”.datasources[0].type	string	`"prometheus"`
grafana.datasources.“datasources.yaml”.datasources[0].url	string	`"http://prometheus"`
grafana.enabled	bool	`true`
grafana.fullnameOverride	string	`"grafana"`
grafana.service.type	string	`"LoadBalancer"`
grafana.testFramework.enabled	bool	`false`
loki.backend.replicas	int	`0`
loki.deploymentMode	string	`"SingleBinary"`
loki.enabled	bool	`true`
loki.fullnameOverride	string	`"loki"`
loki.gateway.enabled	bool	`false`
loki.loki.auth_enabled	bool	`false`
loki.loki.commonConfig.replication_factor	int	`1`
loki.loki.compactorAddress	string	`"loki"`
loki.loki.memberlist	string	`"loki-memberlist"`
loki.loki.rulerConfig.storage.type	string	`"local"`
loki.loki.storage.type	string	`"filesystem"`
loki.monitoring.lokiCanary.enabled	bool	`false`
loki.monitoring.selfMonitoring.enabled	bool	`false`
loki.monitoring.selfMonitoring.grafanaAgent.installOperator	bool	`false`
loki.read.replicas	int	`0`
loki.singleBinary.replicas	int	`1`
loki.test.enabled	bool	`false`
loki.write.replicas	int	`0`
opentelemetry-collector.config.exporters.debug.verbosity	string	`"detailed"`
opentelemetry-collector.config.exporters.loki.endpoint	string	`"http://loki.monitoring.svc:3100/loki/api/v1/push"`
opentelemetry-collector.config.exporters.otlp.endpoint	string	`"tempo.monitoring.svc:4317"`
opentelemetry-collector.config.exporters.otlp.tls.insecure	bool	`true`
opentelemetry-collector.config.exporters.prometheus.endpoint	string	`"[${env:MY_POD_IP}]:19001"`
opentelemetry-collector.config.extensions.health_check.endpoint	string	`"[${env:MY_POD_IP}]:13133"`
opentelemetry-collector.config.processors.attributes.actions[0].action	string	`"insert"`
opentelemetry-collector.config.processors.attributes.actions[0].key	string	`"loki.attribute.labels"`
opentelemetry-collector.config.processors.attributes.actions[0].value	string	`"k8s.pod.name, k8s.namespace.name"`
opentelemetry-collector.config.receivers.datadog.endpoint	string	`"[${env:MY_POD_IP}]:8126"`
opentelemetry-collector.config.receivers.jaeger.protocols.grpc.endpoint	string	`"[${env:MY_POD_IP}]:14250"`
opentelemetry-collector.config.receivers.jaeger.protocols.thrift_compact.endpoint	string	`"[${env:MY_POD_IP}]:6831"`
opentelemetry-collector.config.receivers.jaeger.protocols.thrift_http.endpoint	string	`"[${env:MY_POD_IP}]:14268"`
opentelemetry-collector.config.receivers.otlp.protocols.grpc.endpoint	string	`"[${env:MY_POD_IP}]:4317"`
opentelemetry-collector.config.receivers.otlp.protocols.http.endpoint	string	`"[${env:MY_POD_IP}]:4318"`
opentelemetry-collector.config.receivers.prometheus.config.scrape_configs[0].job_name	string	`"opentelemetry-collector"`
opentelemetry-collector.config.receivers.prometheus.config.scrape_configs[0].scrape_interval	string	`"10s"`
opentelemetry-collector.config.receivers.prometheus.config.scrape_configs[0].static_configs[0].targets[0]	string	`"[${env:MY_POD_IP}]:8888"`
opentelemetry-collector.config.receivers.zipkin.endpoint	string	`"[${env:MY_POD_IP}]:9411"`
opentelemetry-collector.config.service.extensions[0]	string	`"health_check"`
opentelemetry-collector.config.service.pipelines.logs.exporters[0]	string	`"loki"`
opentelemetry-collector.config.service.pipelines.logs.processors[0]	string	`"attributes"`
opentelemetry-collector.config.service.pipelines.logs.receivers[0]	string	`"otlp"`
opentelemetry-collector.config.service.pipelines.metrics.exporters[0]	string	`"prometheus"`
opentelemetry-collector.config.service.pipelines.metrics.receivers[0]	string	`"datadog"`
opentelemetry-collector.config.service.pipelines.metrics.receivers[1]	string	`"otlp"`
opentelemetry-collector.config.service.pipelines.traces.exporters[0]	string	`"otlp"`
opentelemetry-collector.config.service.pipelines.traces.receivers[0]	string	`"datadog"`
opentelemetry-collector.config.service.pipelines.traces.receivers[1]	string	`"otlp"`
opentelemetry-collector.config.service.pipelines.traces.receivers[2]	string	`"zipkin"`
opentelemetry-collector.config.service.telemetry.metrics.address	string	`"[${env:MY_POD_IP}]:8888"`
opentelemetry-collector.enabled	bool	`false`
opentelemetry-collector.fullnameOverride	string	`"otel-collector"`
opentelemetry-collector.image.repository	string	`"otel/opentelemetry-collector-contrib"`
opentelemetry-collector.mode	string	`"deployment"`
prometheus.alertmanager.enabled	bool	`false`
prometheus.enabled	bool	`true`
prometheus.kube-state-metrics.enabled	bool	`false`
prometheus.prometheus-node-exporter.enabled	bool	`false`
prometheus.prometheus-pushgateway.enabled	bool	`false`
prometheus.server.fullnameOverride	string	`"prometheus"`
prometheus.server.global.scrape_interval	string	`"15s"`
prometheus.server.image.repository	string	`"prom/prometheus"`
prometheus.server.persistentVolume.enabled	bool	`false`
prometheus.server.readinessProbeInitialDelay	int	`0`
prometheus.server.securityContext	object	`{}`
prometheus.server.service.type	string	`"LoadBalancer"`
tempo.enabled	bool	`true`
tempo.fullnameOverride	string	`"tempo"`
tempo.service.type	string	`"LoadBalancer"`

Gateway Helm Chart

Mon, 01 Jan 0001 00:00:00 +0000

The Helm chart for Envoy Gateway

Homepage: https://gateway.envoyproxy.io/

Maintainers

Name	Email	Url
envoy-gateway-steering-committee		https://github.com/envoyproxy/gateway/blob/main/GOVERNANCE.md
envoy-gateway-maintainers		https://github.com/envoyproxy/gateway/blob/main/CODEOWNERS

Source Code

https://github.com/envoyproxy/gateway

Values

Key	Type	Default	Description
certgen	object	`{"job":{"affinity":{},"annotations":{},"nodeSelector":{},"resources":{},"securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsGroup":65534,"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}},"tolerations":[],"ttlSecondsAfterFinished":30},"rbac":{"annotations":{},"labels":{}}}`	Certgen is used to generate the certificates required by EnvoyGateway. If you want to construct a custom certificate, you can generate a custom certificate through Cert-Manager before installing EnvoyGateway. Certgen will not overwrite the custom certificate. Please do not manually modify `values.yaml` to disable certgen, it may cause EnvoyGateway OIDC,OAuth2,etc. to not work as expected.
config.envoyGateway.gateway.controllerName	string	`"gateway.envoyproxy.io/gatewayclass-controller"`
config.envoyGateway.logging.level.default	string	`"info"`
config.envoyGateway.provider.type	string	`"Kubernetes"`
createNamespace	bool	`false`
deployment.envoyGateway.image.repository	string	`""`
deployment.envoyGateway.image.tag	string	`""`
deployment.envoyGateway.imagePullPolicy	string	`""`
deployment.envoyGateway.imagePullSecrets	list	`[]`
deployment.envoyGateway.resources.limits.memory	string	`"1024Mi"`
deployment.envoyGateway.resources.requests.cpu	string	`"100m"`
deployment.envoyGateway.resources.requests.memory	string	`"256Mi"`
deployment.envoyGateway.securityContext.allowPrivilegeEscalation	bool	`false`
deployment.envoyGateway.securityContext.capabilities.drop[0]	string	`"ALL"`
deployment.envoyGateway.securityContext.privileged	bool	`false`
deployment.envoyGateway.securityContext.runAsGroup	int	`65532`
deployment.envoyGateway.securityContext.runAsNonRoot	bool	`true`
deployment.envoyGateway.securityContext.runAsUser	int	`65532`
deployment.envoyGateway.securityContext.seccompProfile.type	string	`"RuntimeDefault"`
deployment.pod.affinity	object	`{}`
deployment.pod.annotations.“prometheus.io/port”	string	`"19001"`
deployment.pod.annotations.“prometheus.io/scrape”	string	`"true"`
deployment.pod.labels	object	`{}`
deployment.pod.nodeSelector	object	`{}`
deployment.pod.tolerations	list	`[]`
deployment.pod.topologySpreadConstraints	list	`[]`
deployment.ports[0].name	string	`"grpc"`
deployment.ports[0].port	int	`18000`
deployment.ports[0].targetPort	int	`18000`
deployment.ports[1].name	string	`"ratelimit"`
deployment.ports[1].port	int	`18001`
deployment.ports[1].targetPort	int	`18001`
deployment.ports[2].name	string	`"wasm"`
deployment.ports[2].port	int	`18002`
deployment.ports[2].targetPort	int	`18002`
deployment.ports[3].name	string	`"metrics"`
deployment.ports[3].port	int	`19001`
deployment.ports[3].targetPort	int	`19001`
deployment.priorityClassName	string	`nil`
deployment.replicas	int	`1`
global.images.envoyGateway.image	string	`nil`
global.images.envoyGateway.pullPolicy	string	`nil`
global.images.envoyGateway.pullSecrets	list	`[]`
global.images.ratelimit.image	string	`"docker.io/envoyproxy/ratelimit:master"`
global.images.ratelimit.pullPolicy	string	`"IfNotPresent"`
global.images.ratelimit.pullSecrets	list	`[]`
kubernetesClusterDomain	string	`"cluster.local"`
podDisruptionBudget.minAvailable	int	`0`
service.annotations	object	`{}`

Migrating from Ingress Resources

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

Migrating from Ingress to Envoy Gateway involves converting existing Ingress resources into resources compatible with Envoy Gateway. The ingress2gateway tool simplifies this migration by transforming Ingress resources into Gateway API resources that Envoy Gateway can use. This guide will walk you through the prerequisites, installation of the ingress2gateway tool, and provide an example migration process.

Prerequisites

Before you start the migration, ensure you have the following: