Exposing a service via Kubernetes Gateway API

You can use the Kubernetes Gateway API to create Gateway and HTTPRoute resources to deploy a gateway. These resources configure the gateway to make a service inside the mesh accessible to traffic from outside. You can then change the gateway's Service to LoadBalancer to expose it to traffic external to the cluster.

Prerequisites

Alauda Service Mesh v2 Operator is installed.
An Istio control plane is deployed.

Procedure

Create a new namespace named httpbin with the following command:
```
kubectl create namespace httpbin
```

Deploy the httpbin sample service with this command:

kubectl apply -n httpbin -f https://raw.githubusercontent.com/istio/istio/refs/heads/master/samples/httpbin/httpbin.yaml

Create a file named httpbin-k8s-gw.yaml that defines a Kubernetes Gateway resource. This will configure gateway proxies to expose port 80 (HTTP) for the httpbin.example.com host.

Automated deployment
By default, each Gateway will automatically provision a Service and Deployment. These will be named <Gateway name>-<GatewayClass name> (with the exception of the istio-waypoint GatewayClass, which does not append a suffix). These configurations will be updated automatically if the Gateway changes (for example, if a new port is added).

Example gateway resource file
```
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  annotations:
    networking.istio.io/service-type: ClusterIP
  name: httpbin-gateway
  namespace: httpbin
spec:
  gatewayClassName: istio
  listeners:
    - name: http
      hostname: "httpbin.example.com"
      port: 80
      protocol: HTTP
      allowedRoutes:
        namespaces:
          from: All
```
1. Specifies the gateway's Service type; defaults to LoadBalancer.
2. Specifies the gateway's name.
3. Specifies the gateway's namespace.
4. Specifies the virtual hostname for clients to use when accessing a mesh service on this port.
Apply the YAML file with this command:
```
kubectl apply -f httpbin-k8s-gw.yaml
```

Create a YAML file named httpbin-hr.yaml that defines an HTTPRoute resource. This resource specifies the rules for routing traffic from the gateway proxy to the httpbin service.

Example HTTPRoute file

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: httpbin
  namespace: httpbin
spec:
  parentRefs:
  - name: httpbin-gateway
    namespace: httpbin
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /status
    - path:
        type: PathPrefix
        value: /headers
    backendRefs:
    - name: httpbin
      port: 8000

Links the HTTPROUTE resource to the Kubernetes Gateway created previously by adding the gateway's name to the list of gateways.
Directs matching traffic to the httpbin service by defining a backendRefs entry that includes the name and port of the httpbin Service.

Apply the YAML file by executing this command:
```
kubectl apply -f httpbin-hr.yaml
```
Confirm that the Gateway API service is ready and has an allocated address by running this command:
```
kubectl wait --for=condition=programmed gtw httpbin-gateway -n httpbin
```

Verification

Create a namespace for a curl client by executing this command:
```
kubectl create namespace curl
```

Deploy a curl client using the command below:

kubectl apply -n curl -f https://raw.githubusercontent.com/istio/istio/refs/heads/master/samples/curl/curl.yaml

Set a CURL_POD variable with the name of the curl pod with this command:

CURL_POD=$(kubectl get pods -n curl -l app=curl -o jsonpath='{.items[*].metadata.name}')

From the curl client, send a request to the /headers endpoint of the httpbin application via the ingress gateway Service. Set the Host header to httpbin.example.com to match the host specified in the Kubernetes Gateway and HTTPROUTE resources. Run the following curl command:
```
kubectl exec $CURL_POD -n curl -- \
  curl -s -I \
    -H Host:httpbin.example.com \
    httpbin-gateway-istio.httpbin.svc.cluster.local/headers
```
The response should show a 200 OK HTTP status, indicating a successful request.

Example output
```
HTTP/1.1 200 OK
server: istio-envoy
...
```
Send a curl request to an endpoint without a matching Uniform Resource Identifier (URI) prefix in the httpbin HTTPROUTE by running this command:
```
kubectl exec $CURL_POD -n curl -- \
  curl -s -I \
    -H Host:httpbin.example.com \
    httpbin-gateway-istio.httpbin.svc.cluster.local/get
```
The response will be a 404 Not Found status. This is expected, as the /get endpoint does not have a matching URI prefix defined in the httpbin HTTPROUTE resource.

Example output
```
HTTP/1.1 404 Not Found
server: istio-envoy
...
```
Expose the gateway proxy to external traffic by setting its Service type to the default LoadBalancer. Run this command:
```
kubectl -n httpbin annotate gtw httpbin-gateway networking.istio.io/service-type-
```
Verify that the httpbin service is accessible from outside the cluster by using the external hostname or IP address of the gateway Service. Ensure the INGRESS_HOST variable is set appropriately for your cluster's environment.

a. Set the INGRESS_HOST variable by running this command:
```
export INGRESS_HOST=$(kubectl get gtw httpbin-gateway -n httpbin -o jsonpath='{.status.addresses[0].value}')
```
b. Set the INGRESS_PORT variable by running this command:
```
INGRESS_PORT=$(kubectl get gtw httpbin-gateway -n httpbin -o jsonpath='{.spec.listeners[?(@.name=="http")].port}')
```
c. Using the gateway host, send a curl request to the httpbin service with this command:
```
curl -s -I -H Host:httpbin.example.com http://$INGRESS_HOST:$INGRESS_PORT/headers
```
Verify that the response shows the HTTP/1.1 200 OK status, which confirms the request was successful.

#Exposing a service via Kubernetes Gateway API

#TOC

#Prerequisites

#Procedure

#Verification

Exposing a service via Kubernetes Gateway API

TOC

Prerequisites

Procedure

Verification