Gateway CRD reference-Alibaba Cloud Service Mesh-阿里云帮助中心

A gateway rule defines a set of logical gateways that include exposed ports, protocol types, and Server Name Indication (SNI) configurations for the load balancer. A gateway rule is applied to an ASM gateway to configure a listener. To specify traffic forwarding rules, you must also configure a virtual service. This topic provides a configuration example and field descriptions for the Gateway Custom Resource Definition (CRD).

Configuration example

The following gateway rule configuration exposes ports 80, 9080, 443, and 9443 on the gateway. This rule applies to pods that have the istio: ingressgateway label.

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: my-gateway
  namespace: some-config-namespace
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - test1.com
    - test2.com
    tls:
      httpsRedirect: true
  - port:
      number: 443
      name: https-443
      protocol: HTTPS
    hosts:
    - uk.bookinfo.com
    - eu.bookinfo.com
    tls:
      mode: SIMPLE
      serverCertificate: /etc/certs/servercert.pem
      privateKey: /etc/certs/privatekey.pem
  - port:
      number: 9443
      name: https-9443
      protocol: HTTPS
    hosts:
    - "bookinfo-namespace/*.bookinfo.com"
    tls:
      mode: SIMPLE
      credentialName: bookinfo-secret
  - port:
      number: 9080
      name: http-wildcard
      protocol: HTTP
    hosts:
    - "*"

Field descriptions

Gateway

Field	Type	Required	Description
servers	Server[]	Yes	A list of logical gateways.
selector	map<string, string>	Yes	One or more labels that specify a set of ASM gateway pods to which the gateway rule applies. By default, the gateway rule uses the label selector to search for workloads in all namespaces. For example, a gateway rule in the `foo` namespace can select pods in the `bar` namespace based on labels. If the selector is empty, the gateway rule applies to all workloads.

Server

A Server describes the properties of the proxy for a specific load balancer port.

Field	Type	Required	Description
port	Port	Yes	The port on which the server listens.
bind	string	No	The IP address or Unix domain socket that the listener should bind to. The format can be `X.X.X.X`, `unix:///path/to/udsor`, or `unix://@foobar` (Linux abstract namespace). When you use a Unix domain socket, the port number must be 0. This configuration can limit the server's reachability to within the gateway only. This is often used when a gateway communicates with another mesh service, for example, to publish metrics. In this scenario, external clients cannot access the server created with the specified bind.
hosts	string[]	Yes	One or more hosts that are exposed. This can be used for HTTP services or TCP services with SNI over TLS. This field can contain multiple DNS names with an optional namespace or prefix. DNS names are specified in Fully Qualified Domain Name (FQDN) format and can optionally include a wildcard character in the leftmost part, such as `prod/.example.com`. Set the DNS name to `` to select all hosts from the specified namespace, such as `prod/`. The namespace can be set to `` or `.` to select all namespaces or the current namespace. For example, `/foo.example.com` allows access to this host from all namespaces. `./foo.example.com` allows access to this host only from services in the current namespace. If the namespace is not specified, the default is `/`, which selects services from any namespace. DestinationRule resources in the selected namespace still apply. The gateway rule must have a corresponding virtual service. The virtual service must have one or more hosts that match the hosts specified in the server. The match can be an exact match or a suffix match with the server's host. For example, if the server's host is `.example.com`, the VirtualService can be configured with `dev.example.com` or `prod.example.com`. However, a host such as `example.com` or `newexample.com` in the virtual service does not match hosts within the `.example.com` range. Note This field can only reference virtual services that are exported to the gateway's namespace. If a virtual service is not exported to the gateway's namespace, this configuration is invalid. The service export scope is controlled by the exportTo field. For more information, see the configurations for Virtual Service, Destination Rule, and Service Entry.
tls	ServerTLSSettings	No	A set of options that manage TLS-related settings for the server, such as redirecting HTTP requests to HTTPS and specifying the TLS mode.
name	string	No	An optional name for the server. The name must be unique among all servers. It can be used to prefix statistics generated with this name.

Port

A Port describes the properties of a specific port of a service.

Field	Type	Required	Description
number	uint32	Yes	A valid non-negative integer port number.
protocol	string	Yes	The protocol exposed on the port. Valid values are HTTP, HTTPS, GRPC, HTTP2, TCP, or TLS. TLS can be used to terminate non-HTTP based connections on a specific port, or to route traffic to a destination based on the SNI header without terminating the TLS connection.
name	string	Yes	The label assigned to the port.

ServerTLSSettings

Field	Type	Required	Description
httpsRedirect	bool	No	If set to true, the load balancer sends an HTTP 301 status code for all HTTP connections, which requires the client to use HTTPS.
mode	TLSmode	No	Specifies whether to use TLS to secure connections to this port. The value of this field determines the TLS mode used for the connection.
serverCertificate	string	No	The file path to the server certificate. This field is required if the TLS mode is SIMPLE or MUTUAL. Note Use the credentialName field.
privateKey	string	No	The file path to the private key. This field is required if the mode is SIMPLE or MUTUAL. Note Use the credentialName field.
caCertificates	string	No	The file path to the certification authority (CA) certificate used to validate the provided client certificate. This field is required if the mode is MUTUAL. Note Use the credentialName field.
credentialName	string	No	For gateways running on Kubernetes, you can directly configure the Secret name here. The Secret must store the TLS certificate or CA certificate. This applies only to Kubernetes. The Secret (of the Generic type) must contain the following keys and values: `Key: <privateKey>` `Cert: <serverCert>` For mutual TLS (mTLS), you can also set `Cacert: <CACertificate>`, or specify it separately in a Secret named <secret>-cacert. Secrets of the TLS type are also supported. You can configure the ca.cert field in the Secret to specify the CA certificate. Note You can mount certificates in one of two ways. Use the credentialName field. Method 1: Mount a volume in the pod and use the serverCertificate, privateKey, and caCertificates fields. Method 2: Directly reference a Secret resource and use the credentialName field. For ASM instances of version 1.17 or later, you can specify the name of a certificate from the global certificate management (ASMCredential). For more information, see ASMCredential CRD reference.
subjectAltNames	string[]	No	A list of subject alternative names used to verify the identity of the subject in the client-provided certificate.
verifyCertificateSpki	string[]	No	An optional list of SHA-256 hashes of the authorized client certificate's Subject Public Key Info (SPKI). The hashes must be Base64-encoded. Note If both verify_certificate_hash and verify_certificate_spki are specified, a hash that matches either value causes the certificate to be accepted.
verifyCertificateHash	string[]	No	An optional list of SHA-256 hashes of the authorized client certificate. The hashes must be hexadecimal-encoded. The format can be continuous or separated by colons (:). Note If both verify_certificate_hash and verify_certificate_spki are specified, a hash that matches either value causes the certificate to be accepted.
minProtocolVersion	TLSProtocol	No	The minimum TLS version. The default is TLSV1_2. TLS versions earlier than TLSv1.2 do not include compatible ciphers. You can use the cipherSuites setting to set compatible ciphers. Important Using TLS versions earlier than TLSv1.2 poses a critical security risk. Use a later version. For ASM instances earlier than version 1.14, this field defaults to TLSV1_0. Starting from ASM version 1.14, the default value changes to TLSV1_2. If you use a TLS version earlier than TLSv1.2, you must explicitly set this field to the corresponding TLS version and configure the cipherSuites field before you upgrade to version 1.14.
maxProtocolVersion	TLSProtocol	No	The maximum TLS version.
cipherSuites	string[]	No	The default is the list of default ciphers supported by Envoy. If specified, only the specified list of ciphers is supported.

TLSmode

The TLS mode enforced by the proxy.

Field	Description
PASSTHROUGH	The SNI string provided by the client is used as a matching criterion in VirtualService TLS routing to determine the target service from the service registry.
SIMPLE	A secure connection using standard TLS semantics.
MUTUAL	Uses bidirectional TLS to secure the connection with the downstream entity. The server authenticates itself by providing a certificate.
AUTO_PASSTHROUGH	Similar to the PASSTHROUGH mode, but this mode does not require a configuration in the virtual service that can route to a specific service through SNI. Destination details such as the service, subset, and port are encoded in the SNI value. The proxy forwards traffic to the specified upstream Envoy cluster (a set of endpoints) through SNI. This server is typically used to provide connections between services in different L3 networks that would otherwise not have a direct connection between their respective endpoints. Using this mode assumes that both the source and destination use Istio mTLS to secure traffic.
ISTIO_MUTUAL	Uses bidirectional TLS to secure the connection from the downstream entity. The server authenticates itself by providing a certificate. Unlike MUTUAL mode, this mode uses a certificate that represents the gateway's identity to communicate with the client. Istio automatically generates this certificate for mTLS authentication. When you use this mode, all other TLS-related field configurations must be empty.

TLSProtocol

The TLS version.

Name	Description
TLS_AUTO	Automatically selects the best TLS version.
TLSV1_0	TLS version 1.0.
TLSV1_1	TLS version 1.1.
TLSV1_2	TLS version 1.2.
TLSV1_3	TLS version 1.3.

上一篇: ASMEgressTrafficPolicy CRD reference 下一篇: ASMCredential field reference