A Gateway is a Kubernetes network entry point for traffic arriving from outside the cluster. It defines where connections are accepted; separate Route objects decide which backend services receive them. Unlike an Ingress, a Gateway does not need to contain all the routing rules itself. Cluster administrators can manage gateways while application developers manage routes. section 13.1.1 section 13.8
Before creating a Gateway, check that the Gateway API resources and a controller are installed. Choose an available GatewayClass: every Gateway must name one, and the class identifies the controller that manages it. For example, `kubectl get gatewayclasses` can show an `istio` class. section 13.1.3 section 13.2.1
Listing 13.1 Defining a Gateway with a single listener
apiVersion: gateway.networking.k8s.io/v1 #1
kind: Gateway #1
metadata:
name: kiada #2
labels:
suite: kiada
spec:
gatewayClassName: istio #3
listeners: #4
- name: http #5
port: 80 #6
protocol: HTTP #7
hostname: '*.example.com' #8
This minimal manifest names the `istio` GatewayClass and defines one HTTP listener on port 80 for hostnames in `example.com`. A listener is the logical endpoint where the gateway accepts connections. section 13.2.2
Apply the manifest with `kubectl apply -f gtw.kiada.yaml`, then run `kubectl get gtw` to see its class, assigned address, and `PROGRAMMED` status. An address need not be requested in the spec; the implementation may assign one. The controller commonly creates a LoadBalancer Service and a pod for the gateway. section 13.2.2
A listener accepts traffic but does not, by itself, choose a backend. Attach an HTTPRoute for HTTP traffic or a TCPRoute for TCP traffic. Other route kinds cover TLS, gRPC, and UDP. For example, a TCP listener on port 200 accepts connections, but needs a TCPRoute to send them to a backend service. section 13.5.1 section 13.8
To accept HTTPS and decrypt it at the gateway, add an HTTPS listener with `tls.mode: Terminate` and a `certificateRefs` entry naming a Secret containing the certificate and private key. Alternatively, TLS traffic can pass through for termination at the backend. section 13.4 section 13.4.1
Check `kubectl get gtw <name> -o yaml` when a gateway does not behave as expected. `status.addresses` reports where it can be reached; conditions such as `Accepted` and `Programmed` report controller progress. Listener status also shows attached routes. For a false condition, inspect its reason and message. section 13.2.3
A Gateway can serve routes from other namespaces, but its listeners must permit them. The default permits routes only from the same namespace; `allowedRoutes.namespaces.from` can instead allow `All` namespaces or a label-selected set. A cross-namespace route must also name the Gateway’s namespace in `parentRefs`. section 13.6.1
