How to Deploy Gateway API with TLS Encryption on Kubernetes

The Kubernetes Gateway API is a standard interface for managing service networking within Kubernetes clusters. It succeeds the Ingress API by offering a more expressive and extensible resource model (comprising GatewayClass, Gateway, and HTTPRoute) to handle advanced traffic routing, role-oriented management, and cross-namespace connectivity natively.

This article outlines the process of exposing a web application securely using the Gateway API. It covers the installation of Envoy Gateway as the controller and configuration of cert-manager for automated TLS certificate provisioning from Let's Encrypt.

Prerequisites

Before you begin, you need to:

• Have a Kubernetes cluster.
• Install and Configure Kubectl on your workstation to access your Kubernetes cluster.
• Install Helm on your workstation.
• Have a domain name, such as app.example.com.

Install Envoy Gateway

The Gateway API requires an implementation controller to function. Envoy Gateway translates Gateway API resources into configuration for the Envoy Proxy data plane.

1. Install the Gateway API CRDs and the Envoy Gateway controller using the OCI Helm registry.

   CONSOLE

   Copy

   $ helm install eg oci://docker.io/envoyproxy/gateway-helm --version v1.6.1 -n envoy-gateway-system --create-namespace

   Explain Code

   Powered by Vultr AgentBeta

2. Wait for the controller to report as available.

   CONSOLE

   Copy

   $ kubectl wait --timeout=5m -n envoy-gateway-system deployment/envoy-gateway --for=condition=Available

   Explain Code

   Powered by Vultr AgentBeta

3. Create the GatewayClass resource to register the Envoy Gateway controller.

   CONSOLE

   Copy

   $ kubectl apply -f - <<EOF
   apiVersion: gateway.networking.k8s.io/v1
   kind: GatewayClass
   metadata:
     name: eg
   spec:
     controllerName: gateway.envoyproxy.io/gatewayclass-controller
   EOF

   Explain Code

   Powered by Vultr AgentBeta

Install cert-manager

Deploy the cert-manager operator with the Gateway API feature gate enabled. This configuration ensures the certificate controller can communicate with the Gateway API to route Let's Encrypt validation traffic correctly.

1. Install the cert-manager Helm chart with Gateway API support enabled.

   CONSOLE

   Copy

   $ helm upgrade --install cert-manager oci://quay.io/jetstack/charts/cert-manager \
       --namespace cert-manager \
       --create-namespace \
       --version v1.19.2 \
       --set config.apiVersion=controller.config.cert-manager.io/v1alpha1 \
       --set config.kind=ControllerConfiguration \
       --set config.enableGatewayAPI=true \
       --set crds.enabled=true

   Explain Code

   Powered by Vultr AgentBeta

2. Verify that the cert-manager pods enter the Running state.

   CONSOLE

   Copy

   $ kubectl wait --for=condition=Ready pods --all -n cert-manager

   Explain Code

   Powered by Vultr AgentBeta

Configure the ClusterIssuer

A ClusterIssuer represents a certificate authority capable of issuing TLS certificates cluster-wide. Register the cluster with Let's Encrypt to automate certificate management. This ClusterIssuer configuration enables the ACME HTTP-01 solver, which allows cert-manager to prove domain ownership.

1. Create a ClusterIssuer manifest.

   CONSOLE

   Copy

   $ nano cluster-issuer.yaml

   Explain Code

   Powered by Vultr AgentBeta

2. Add the following configuration. Replace admin@example.com with your valid email address.

   YAML

   Copy

   apiVersion: cert-manager.io/v1
   kind: ClusterIssuer
   metadata:
     name: letsencrypt-prod
   spec:
     acme:
       server: https://acme-v02.api.letsencrypt.org/directory
       email: admin@example.com
       privateKeySecretRef:
         name: letsencrypt-prod
       solvers:
         - http01:
             gatewayHTTPRoute:
               parentRefs:
                 - name: web-gateway
                   kind: Gateway

   Explain Code

   Powered by Vultr AgentBeta

   Save and close the file.

3. Apply the ClusterIssuer manifest.

   CONSOLE

   Copy

   $ kubectl apply -f cluster-issuer.yaml

   Explain Code

   Powered by Vultr AgentBeta

Deploy a Sample Web Application

To verify traffic routing, deploy a simple web application using the nginxdemos/hello image.

1. Create a deployment for the web application.

   CONSOLE

   Copy

   $ kubectl create deployment web-app --image=nginxdemos/hello --replicas=2

   Explain Code

   Powered by Vultr AgentBeta

2. Expose the deployment internally as a Service.

   CONSOLE

   Copy

   $ kubectl expose deployment web-app --port=80 --target-port=80

   Explain Code

   Powered by Vultr AgentBeta

Initialize the Gateway

Deploy the Gateway resource to provision a cloud LoadBalancer and assign a public IP address. This resource defines how the cluster handles traffic for your domain.

1. Create the Gateway manifest file.

   CONSOLE

   Copy

   $ nano gateway.yaml

   Explain Code

   Powered by Vultr AgentBeta

2. Add the following configuration. Replace app.example.com with your actual domain name.

   YAML

   Copy

   apiVersion: gateway.networking.k8s.io/v1
   kind: Gateway
   metadata:
     name: web-gateway
     annotations:
       cert-manager.io/cluster-issuer: letsencrypt-prod
   spec:
     gatewayClassName: eg
     listeners:
       - name: http
         protocol: HTTP
         port: 80
         hostname: "app.example.com"
         allowedRoutes:
           namespaces:
             from: Same
       - name: https
         protocol: HTTPS
         port: 443
         hostname: "app.example.com"
         tls:
           mode: Terminate
           certificateRefs:
             - kind: Secret
               name: web-app-tls-secret
         allowedRoutes:
           namespaces:
             from: Same

   Explain Code

   Powered by Vultr AgentBeta

   Save and close the file.

3. Apply the Gateway manifest.

   CONSOLE

   Copy

   $ kubectl apply -f gateway.yaml

   Explain Code

   Powered by Vultr AgentBeta

4. Retrieve the Gateway external IP address.

   CONSOLE

   Copy

   $ kubectl get gateway web-gateway

   Explain Code

   Powered by Vultr AgentBeta

5. Update your domain’s DNS A record to point to the assigned IP address.

6. Verify the TLS certificate status.

   CONSOLE

   Copy

   $ kubectl get certificate

   Explain Code

   Powered by Vultr AgentBeta

   The certificate may take a few minutes to update to True.

Configure Secure Application Routing

Define the routing rules to direct traffic from the Gateway to your backend service. Attach this route exclusively to the HTTPS listener to enforce encryption and prevent insecure access.

1. Create the HTTPRoute manifest file.

   CONSOLE

   Copy

   $ nano http-route.yaml

   Explain Code

   Powered by Vultr AgentBeta

2. Add the following configuration:

   YAML

   Copy

   apiVersion: gateway.networking.k8s.io/v1
   kind: HTTPRoute
   metadata:
     name: web-app-route
   spec:
     parentRefs:
       - name: web-gateway
         sectionName: https
     hostnames:
       - "app.example.com"
     rules:
       - backendRefs:
           - name: web-app
             port: 80

   Explain Code

   Powered by Vultr AgentBeta

   Save and close the file.

3. Apply the HTTPRoute manifest.

   CONSOLE

   Copy

   $ kubectl apply -f http-route.yaml

   Explain Code

   Powered by Vultr AgentBeta

4. Open a web browser and navigate to your domain name https://app.example.com. Verify that the browser displays a padlock icon next to the URL, indicating a valid certificate, and loads the application successfully.

Conclusion

You have deployed a Gateway API setup with Envoy Gateway and cert-manager. The web application is now secure and accessible via HTTPS using the Gateway API. Envoy Gateway manages the traffic routing, while cert-manager automates the lifecycle of Let's Encrypt certificates. Refer to the official Gateway API documentation for advanced routing and traffic management features.