Lesson 11 — Gateway API

Lesson 11 · Slide 1

Gateway API

The next generation of Kubernetes traffic management — more expressive, role-oriented, and portable than Ingress.

Why Gateway API replaces Ingress
Key resources: GatewayClass, Gateway, HTTPRoute
Role-based separation of concerns
Filters, cross-namespace routing, and ReferenceGrant
Templating Gateway API resources in Helm
Implementations: Envoy Gateway, Istio, Cilium, nginx-gateway-fabric

Lesson 11 · Slide 2

Gateway API vs Ingress

Feature	Ingress	Gateway API
API maturity	v1 (frozen)	v1 (actively evolving)
Protocol support	HTTP/HTTPS only	HTTP, TLS, TCP, gRPC, UDP
Role separation	None	Infrastructure / Cluster / App developer
Header manipulation	Annotation hacks	Native filters
Traffic splitting	Not standard	Built-in backendRefs weights
Cross-namespace	Not supported	ReferenceGrant
Portability	Annotation-dependent	Portable core spec

Notes: Ingress is not deprecated but is frozen at v1. The Gateway API is the recommended path forward for all new projects.

Lesson 11 · Slide 3

Role Separation Model

Infrastructure Provider

Manages GatewayClass — defines which controller handles Gateways (e.g. Envoy, Istio).

Cluster Operator

Manages Gateway — configures listeners, ports, TLS certificates, and which namespaces can attach routes.

Application Developer

Manages HTTPRoute / TLSRoute / GRPCRoute — defines how traffic reaches their services.

# Infrastructure Provider
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: envoy
spec:
  controllerName: gateway.envoyproxy.io/gatewayclass-controller
  parametersRef:
    group: gateway.envoyproxy.io
    kind: EnvoyProxy
    name: custom-proxy

Lesson 11 · Slide 4

Gateway Resource

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: {{ include "mychart.fullname" . }}
  namespace: {{ .Release.Namespace }}
spec:
  gatewayClassName: {{ .Values.gateway.className }}
  listeners:
    - name: http
      port: 80
      protocol: HTTP
      hostname: "*.{{ .Values.gateway.domain }}"
      allowedRoutes:
        namespaces:
          from: Selector
          selector:
            matchLabels:
              gateway-access: "true"
    - name: https
      port: 443
      protocol: HTTPS
      hostname: "*.{{ .Values.gateway.domain }}"
      tls:
        mode: Terminate
        certificateRefs:
          - name: {{ .Values.gateway.tlsSecretName }}
      allowedRoutes:
        namespaces:
          from: All

Notes: allowedRoutes.namespaces.from can be All, Same, or Selector — controlling which namespaces may attach routes to this listener.

Lesson 11 · Slide 5

HTTPRoute

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: {{ include "mychart.fullname" . }}
spec:
  parentRefs:
    - name: {{ .Values.gateway.name }}
      namespace: {{ .Values.gateway.namespace }}
      sectionName: https
  hostnames:
    - {{ .Values.httpRoute.hostname }}
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /api
          headers:
            - name: x-api-version
              value: v2
      filters:
        - type: RequestHeaderModifier
          requestHeaderModifier:
            add:
              - name: x-routed-by
                value: gateway-api
      backendRefs:
        - name: {{ include "mychart.fullname" . }}-api
          port: {{ .Values.service.port }}
          weight: 90
        - name: {{ include "mychart.fullname" . }}-api-canary
          port: {{ .Values.service.port }}
          weight: 10

Notes: Weighted backendRefs enable canary deployments natively — no annotation gymnastics required.

Lesson 11 · Slide 6

ReferenceGrant & Filters

ReferenceGrant

apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: allow-from-web
  namespace: backend
spec:
  from:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: web
  to:
    - group: ""
      kind: Service

Allows HTTPRoutes in the web namespace to reference Services in the backend namespace.

Common Filters

RequestHeaderModifier — add, set, or remove request headers
ResponseHeaderModifier — modify response headers
URLRewrite — rewrite hostname or path
RequestRedirect — HTTP redirects (301/302)
RequestMirror — duplicate traffic to a second backend
ExtensionRef — implementation-specific filters

Lesson 11 · Slide 7

Installing CRDs & Implementations

# Install Gateway API CRDs (standard channel)
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.0/standard-install.yaml

# Or experimental channel (includes TCPRoute, TLSRoute, GRPCRoute)
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.0/experimental-install.yaml

Popular Implementations

Implementation	Controller Name	Notes
Envoy Gateway	`gateway.envoyproxy.io/gatewayclass-controller`	Reference implementation, Envoy-based
Istio	`istio.io/gateway-controller`	Service mesh integration
Cilium	`io.cilium/gateway-controller`	eBPF-powered, high performance
NGINX Gateway Fabric	`gateway.nginx.org/nginx-gateway-controller`	NGINX-based, F5 supported

Lesson 11 · Slide 8

Summary

Gateway API — the successor to Ingress: role-oriented, multi-protocol, portable
GatewayClass — infrastructure provider defines the controller
Gateway — cluster operator configures listeners, TLS, and namespace policies
HTTPRoute — app developer defines routing rules, matches, filters, and weighted backends
ReferenceGrant — explicit cross-namespace permission model
Filters — native header modification, rewrites, redirects, and mirroring
Helm templating — same patterns (values, helpers, conditionals) apply to Gateway API resources

Next: Lesson 12 — NetworkPolicies