Kubernetes Gateway API on Envoy Gateway

BackendTLSPolicy

Mon, 01 Jan 0001 00:00:00 +0000

The `BackendTLSPolicy` resource is Alpha and has been part of
the Experimental Channel since `v1.0.0`. For more information on release
channels, refer to our [versioning guide](https://gateway-api.sigs.k8s.io/concepts/versioning).

BackendTLSPolicy is a Gateway API type for specifying the TLS configuration of the connection from the Gateway to a backend pod/s via the Service API object.

Background

BackendTLSPolicy specifically addresses the configuration of TLS in order to convey HTTPS from the Gateway dataplane to the backend. This is referred to as “backend TLS termination” and enables the Gateway to know how to connect to a backend pod that has its own certificate.

Gateway

Mon, 01 Jan 0001 00:00:00 +0000

The `Gateway` resource is GA and has been part of the Standard Channel since
`v0.5.0`. For more information on release channels, refer to our [versioning
guide](https://gateway-api.sigs.k8s.io/concepts/versioning).

A Gateway is 1:1 with the lifecycle of the configuration of infrastructure. When a user creates a Gateway, some load balancing infrastructure is provisioned or configured (see below for details) by the GatewayClass controller. Gateway is the resource that triggers actions in this API. Other resources in this API are configuration snippets until a Gateway has been created to link the resources together.

GatewayClass

Mon, 01 Jan 0001 00:00:00 +0000

The `GatewayClass` resource is GA and has been part of the Standard Channel since
`v0.5.0`. For more information on release channels, refer to our [versioning
guide](https://gateway-api.sigs.k8s.io/concepts/versioning).

GatewayClass is cluster-scoped resource defined by the infrastructure provider. This resource represents a class of Gateways that can be instantiated.

Note: GatewayClass serves the same function as the networking.IngressClass resource.

kind: GatewayClass
metadata:
 name: cluster-gateway
spec:
 controllerName: "example.net/gateway-controller"

We expect that one or more GatewayClasses will be created by the infrastructure provider for the user. It allows decoupling of which mechanism (e.g. controller) implements the Gateways from the user. For instance, an infrastructure provider may create two GatewayClasses named internet and private to reflect Gateways that define Internet-facing vs private, internal applications.

GRPCRoute

Mon, 01 Jan 0001 00:00:00 +0000

The `GRPCRoute` resource is GA and has been part of the Standard Channel since
`v1.1.0`. For more information on release channels, refer to our [versioning
guide](https://gateway-api.sigs.k8s.io/concepts/versioning).

GRPCRoute is a Gateway API type for specifying routing behavior of gRPC requests from a Gateway listener to an API object, i.e. Service.

Background

While it is possible to route gRPC with HTTPRoutes or via custom, out-of-tree CRDs, in the long run, this leads to a fragmented ecosystem.

HTTPRoute

Mon, 01 Jan 0001 00:00:00 +0000

The `HTTPRoute` resource is GA and has been part of the Standard Channel since
`v0.5.0`. For more information on release channels, refer to our [versioning
guide](https://gateway-api.sigs.k8s.io/concepts/versioning).

HTTPRoute is a Gateway API type for specifying routing behavior of HTTP requests from a Gateway listener to an API object, i.e. Service.

Spec

The specification of an HTTPRoute consists of:

ParentRefs- Define which Gateways this Route wants to be attached to.
Hostnames (optional)- Define a list of hostnames to use for matching the Host header of HTTP requests.
Rules- Define a list of rules to perform actions against matching HTTP requests. Each rule consists of matches, filters (optional), backendRefs (optional), timeouts (optional), and name (optional) fields.

The following illustrates an HTTPRoute that sends all traffic to one Service:

ReferenceGrant

Mon, 01 Jan 0001 00:00:00 +0000

The `ReferenceGrant` resource is Beta and part of the
Standard Channel since `v0.6.0`. For more information on release
channels, refer to our [versioning guide](https://gateway-api.sigs.k8s.io/concepts/versioning).

This resource was originally named "ReferencePolicy". It was renamed
to "ReferenceGrant" to avoid any confusion with policy attachment.

A ReferenceGrant can be used to enable cross namespace references within Gateway API. In particular, Routes may forward traffic to backends in other namespaces, or Gateways may refer to Secrets in another namespace.