Working with Gateway API

1. Installing Gateway API CRDs

kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.0/standard-install.yaml
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.0/experimental-install.yaml
ChannelContents
standardGA: Gateway, GatewayClass, HTTPRoute, ReferenceGrant
experimentalTCPRoute, TLSRoute, UDPRoute, GRPCRoute, BackendTLSPolicy

2. Creating GatewayClass Resource

apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata: { name: external }
spec:
  controllerName: gateway.envoyproxy.io/gatewayclass-controller
FieldDetail
controllerNameImplementation: Envoy Gateway, Istio, Contour, NGINX
parametersRefProvider-specific config

3. Creating Gateway Resource

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata: { name: prod }
spec:
  gatewayClassName: external
  listeners:
  - { name: http,  port: 80,  protocol: HTTP }
  - name: https
    port: 443
    protocol: HTTPS
    tls:
      mode: Terminate
      certificateRefs:
      - { kind: Secret, name: prod-tls }

4. Configuring HTTPRoute

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata: { name: api }
spec:
  parentRefs:
  - { name: prod, sectionName: https }
  hostnames: ["api.example.com"]
  rules:
  - matches:
    - { path: { type: PathPrefix, value: /v1 } }
    backendRefs:
    - { name: api-v1, port: 80, weight: 90 }
    - { name: api-v2, port: 80, weight: 10 }
Match TypeField
PathExact / PathPrefix / RegularExpression
Headername + value (Exact/Regex)
QueryParamname + value
MethodGET, POST, ...

5. Using TCPRoute

apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
metadata: { name: pg }
spec:
  parentRefs: [{ name: prod, sectionName: pg }]
  rules:
  - backendRefs: [{ name: postgres, port: 5432 }]
Use CaseDetail
Non-HTTPDatabases, message brokers
Listener protocolTCP

6. Using TLSRoute

apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TLSRoute
metadata: { name: passthrough }
spec:
  parentRefs: [{ name: prod, sectionName: https-pt }]
  hostnames: ["mqtt.example.com"]
  rules: [{ backendRefs: [{ name: mqtt, port: 8883 }] }]
TLS ModeDetail
PassthroughGateway routes by SNI; client-to-pod TLS
TerminateGateway decrypts (use HTTPRoute)

7. Setting Gateway Listeners

FieldDetail
nameUnique listener identifier
port / protocolHTTP, HTTPS, TCP, TLS, UDP
hostnameSNI / Host filter
allowedRoutesWhich Routes can attach (namespaces, kinds)

8. Configuring Backend References

FieldUse
name / portService reference
weightTraffic split (integer, relative)
group / kindCross-namespace requires ReferenceGrant

9. Using Request Matching

matches:
- headers:
  - { name: x-canary, value: "true" }
  path: { type: PathPrefix, value: /api }
filters:
- type: RequestHeaderModifier
  requestHeaderModifier: { add: [{ name: x-forwarded-by, value: gw }] }
FilterAction
RequestHeaderModifieradd/set/remove request headers
ResponseHeaderModifierModify response headers
RequestRedirect3xx redirect
URLRewriteRewrite host/path
RequestMirrorMirror to another backend

10. Implementing Traffic Splitting

backendRefs:
- { name: web-stable, port: 80, weight: 90 }
- { name: web-canary, port: 80, weight: 10 }
PatternStrategy
CanarySmall weight to new version
Blue/GreenSwitch 100% by editing weight
A/BHeader match → specific backend

11. Understanding Gateway API vs Ingress

Ingress

  • Single resource per app
  • Annotation-heavy for advanced features
  • HTTP/HTTPS only
  • Implementation-specific behavior

Gateway API

  • Role-oriented: GatewayClass (infra), Gateway (cluster ops), Routes (app dev)
  • Native L4/L7 (TCP, UDP, TLS, HTTP, gRPC)
  • Typed filters/policies — fewer annotations
  • Cross-namespace via ReferenceGrant