Gateway API¶

The Kubernetes Gateway API replaces the Ingress resource, implemented by Cilium for both load balancing and TLS termination. The improvement is the split in ownership: the cluster owns the Gateway — addresses, certificates, ports — and each app owns its own HTTPRoute.

At a glance¶

Configuration¶

Two Gateways in kube-system, each with a dedicated address from the Cilium L2 pool, defined in gateways.yaml:

Both terminate TLS with cert-manager's wildcard certificates, so a new hostname needs no certificate of its own and nothing to renew. Port 80 is accepted from all namespaces only so the central rule in http-redirect.yaml can send it to HTTPS.

Usage¶

Create an HTTPRoute in the app's namespace referencing the right Gateway; external-dns creates the record and the wildcard covers the name:

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: my-app
  namespace: my-app
spec:
  parentRefs:
    - name: apps-gateway
      namespace: kube-system
      sectionName: https
  hostnames:
    - "my-app.k8s.wlkr.ch"
  rules:
    - backendRefs:
        - name: my-app-svc
          port: 80

Use infra-gateway with a *.infra.k8s.wlkr.ch hostname for platform tools.

Health check¶

Check that each HTTP listener carries only the redirect — http should show exactly 1:

kubectl get gateway infra-gateway -n kube-system \
  -o jsonpath='{range .status.listeners[*]}{.name}={.attachedRoutes}{"\n"}{end}'

Pitfalls¶