Define routing rules with the Gateway API

Notes

• Version compatibility:

  • ASM 1.18 supports Gateway API v0.6.0.

  • ASM 1.22 and later supports Gateway API v1.1 and adds support for GRPCRoute.

  • ASM 1.24 and later supports Gateway API v1.2.0.

• In multi-cluster mode, if you apply Gateway API resources with the same name to the same namespace in multiple data plane clusters, the last resource applied overwrites the previous ones.

Step 1: Verify Gateway API CRDs

The Gateway API component CRDs are installed by default in Container Service for Kubernetes (ACK) clusters v1.24 and later.

To verify that the CRDs exist in your ACK cluster, run the following command.

kubectl get crds | grep gateway.networking.k8s.io

Step 2: Enable Gateway API support

In the kubeconfig environment for your ASM instance, add the enableGatewayAPI: true field to the ASMMeshConfig resource named default.

apiVersion: istio.alibabacloud.com/v1beta1
kind: ASMMeshConfig
metadata:
  name: default
spec:
  enableGatewayAPI: true

After you enable the enableGatewayAPI switch, the control plane generates the relevant Gateway API CRDs. Both the Gateway API and Istio define a resource named Gateway, which can cause conflicts when you use kubectl. To resolve this, use the kubectl get gtw command to retrieve Gateway resources from the Gateway API and use the kubectl get gw command to retrieve Gateway resources from Istio.

Step 3: Configure an HTTP routing rule

Use the Gateway API to configure an HTTP routing rule that exposes the httpbin application via the gateway. You need to create Gateway and HTTPRoute resources in your ACK cluster.

1. Create a Gateway resource.

   1. Create a file named gateway.yaml with the following content.

      This configuration applies the Gateway resource to the specified ASM gateway. It creates a listener on port 80 that uses the HTTP protocol and sets the hostname to *.aliyun.com, which allows routing rules from all namespaces to attach to this listener. In the YAML file, replace ${ASM_GATEWAY_NAME} with the name of your ASM gateway.

      gateway.yaml

      apiVersion: gateway.networking.k8s.io/v1beta1
      kind: Gateway
      metadata:
        name: gateway
        namespace: istio-system
      spec:
        addresses:  # Specifies the ASM gateway Service. This can be applied to the services of multiple ASM gateways.
        - type: Hostname
          value: istio-${ASM_GATEWAY_NAME}.istio-system.svc.cluster.local
        gatewayClassName: istio
        listeners:
        - allowedRoutes:
            namespaces:
              from: All
          hostname: '*.aliyun.com'  # Direct matching on "*" is not supported. To match all hosts, do not specify this field.
          name: default
          port: 80
          protocol: HTTP

   2. In the kubeconfig environment for your ACK cluster, run the following command to deploy the Gateway.

      kubectl apply -f gateway.yaml

2. Create an HTTPRoute resource.

   1. Create a file named http-route.yaml with the following content.

      This configuration attaches the HTTPRoute to the gateway resource in the istio-system namespace. Because no specific listener is named, the rule applies to all compatible listeners on the gateway. Requests with the /get path prefix are routed to port 8000 of the httpbin service in the same namespace.

      http-route.yaml

      apiVersion: gateway.networking.k8s.io/v1beta1
      kind: HTTPRoute
      metadata:
        name: http
        namespace: default
      spec:
        parentRefs:  # This route can also be attached to different Gateways.
        - name: gateway
          namespace: istio-system
        hostnames: ["*.aliyun.com"]
        rules:
        - matches:
          - path:
              type: PathPrefix
              value: /get
          backendRefs:  # By default, you can reference only services in the same namespace. To use services in different namespaces, configure a ReferenceGrant resource. For more information, see https://gateway-api.sigs.k8s.io/api-types/referencegrant/
          - name: httpbin 
            port: 8000

   2. In the kubeconfig environment for your ACK cluster, run the following command to deploy the HTTPRoute.

      kubectl apply -f http-route.yaml

3. Run the following command to access the httpbin application through the ingress gateway and verify that the HTTP routing rule is active. Replace {INGRESS_GATEWAY_IP} with the IP address of your ingress gateway.

   curl -I -HHost:httpbin.aliyun.com "http://{INGRESS_GATEWAY_IP}:80/get"

   Expected output:

   HTTP/1.1 200 OK
   server: istio-envoy
   date: Fri, 12 May 2023 08:16:30 GMT
   content-type: application/json
   content-length: 516
   access-control-allow-origin: *
   access-control-allow-credentials: true
   x-envoy-upstream-service-time: 4

   A 200 OK response confirms that the HTTP routing rule is active.

Step 4: Configure an HTTPS routing rule

Use the Gateway API to configure an HTTPS routing rule. This rule exposes the httpbin application and performs TLS termination at the ASM gateway. You need to create Gateway and HTTPRoute resources in the ACK cluster.

1. Use the global certificate management feature of ASM to create an HTTPS certificate for a.aliyun.com. Name the certificate myexample-credential. For more information, see Step 1: Prepare server certificates and private keys for multiple hosts.

2. Create a Gateway resource.

   1. Create a file named gateway-https.yaml with the following content.

      In the YAML file, replace ${ASM_GATEWAY_NAME} with the name of your ASM gateway.

      gateway-https.yaml

      apiVersion: gateway.networking.k8s.io/v1beta1
      kind: Gateway
      metadata:
        name: gateway-https
        namespace: istio-system
      spec:
        addresses:  # Specifies the ASM gateway Service. This can be applied to the services of multiple ASM gateways.
        - type: Hostname
          value: istio-${ASM_GATEWAY_NAME}.istio-system.svc.cluster.local
        gatewayClassName: istio
        listeners:
        - name: https
          hostname: "*.aliyun.com"
          port: 443
          protocol: HTTPS
          tls:
            mode: Terminate
            certificateRefs:
            - name: myexample-credential
          allowedRoutes:
            namespaces:
              from: All

   2. In the kubeconfig environment for your ACK cluster, run the following command to deploy the Gateway.

      kubectl apply -f gateway-https.yaml

3. Create an HTTPRoute resource.

   1. Create a file named httpbin-https.yaml with the following content.

      httpbin-https.yaml

      apiVersion: gateway.networking.k8s.io/v1beta1
      kind: HTTPRoute
      metadata:
        name: httpbin-https
        namespace: default
      spec:
        parentRefs:
        - name: gateway-https
          namespace: istio-system
        hostnames: ["*.aliyun.com"]
        rules:
        - matches:
          - path:
              type: PathPrefix
              value: /status
          - path:
              type: PathPrefix
              value: /delay
          backendRefs:
          - name: httpbin
            port: 8000

   2. In the kubeconfig environment for your ACK cluster, run the following command to deploy the HTTPRoute.

      kubectl apply -f httpbin-https.yaml

4. Run the following command to access the httpbin application through the ingress gateway and verify that the HTTPS routing rule is active. Replace {INGRESS_GATEWAY_IP} with the IP address of your ingress gateway.

   curl -k -H Host:a.aliyun.com --resolve a.aliyun.com:443:{INGRESS_GATEWAY_IP} https://a.aliyun.com/status/418

   Expected output:

       -=[ teapot ]=-
   
          _...._
        .'  _ _ `.
       | ."` ^ `". _,
       \_;`"---"`|//
         |       ;/
         \_     _/
           `"""`

   The output confirms that the HTTPS routing rule is active.