Alibaba Cloud Service Mesh:Define routing rules with Gateway API

Create the Gateway

The following Gateway binds to your ingress gateway, creates a listener on port 80 (HTTP) for hosts matching *.aliyun.com, and allows routes from all namespaces.

Replace <ingress-gateway-name> with the name of your deployed ingress gateway.

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: gateway
  namespace: istio-system
spec:
  addresses:
  - type: Hostname
    value: istio-<ingress-gateway-name>.istio-system.svc.cluster.local
  gatewayClassName: istio
  listeners:
  - name: default
    hostname: '*.aliyun.com'    # To match all hosts, omit this field. Do not set it to *.
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: All

kubectl apply -f gateway.yaml

Create the HTTPRoute

The following HTTPRoute attaches to the Gateway above and routes requests with the path prefix /get to port 8000 of the httpbin service.

apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: http
  namespace: default
spec:
  parentRefs:
  - name: gateway
    namespace: istio-system
  hostnames: ["*.aliyun.com"]
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /get
    backendRefs:
    - name: httpbin
      port: 8000

By default, an HTTPRoute can only reference Services in the same namespace. To route to Services in other namespaces, configure a ReferenceGrant.

kubectl apply -f http-route.yaml

Verify the HTTP routing rule

Run the following command to access the httpbin application through the ingress gateway and check whether the HTTP routing rule takes effect. Replace <ingress-gateway-ip> with the IP address of the ingress gateway.

curl -I -HHost:httpbin.aliyun.com "http://<ingress-gateway-ip>:80/get"

Expected output:

HTTP/1.1 200 OK
server: istio-envoy
date: Fri, 12 May 2023 08:16:30 GMT
content-type: application/json
content-length: 516
access-control-allow-origin: *
access-control-allow-credentials: true
x-envoy-upstream-service-time: 4

A 200 OK response confirms that the HTTP routing rule is working.

Prepare a TLS certificate

Create a certificate for the a.aliyun.com host using the ASM certificate management feature. Set the certificate name to myexample-credential. For detailed steps, see Prepare server certificates and private keys.

Create the Gateway

The following Gateway binds to your ingress gateway, creates an HTTPS listener on port 443 for hosts matching *.aliyun.com, and terminates TLS using the myexample-credential certificate.

Replace <ingress-gateway-name> with the name of your deployed ingress gateway.

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: gateway-https
  namespace: istio-system
spec:
  addresses:
  - type: Hostname
    value: istio-<ingress-gateway-name>.istio-system.svc.cluster.local
  gatewayClassName: istio
  listeners:
  - name: https
    hostname: "*.aliyun.com"
    port: 443
    protocol: HTTPS
    tls:
      mode: Terminate
      certificateRefs:
      - name: myexample-credential
    allowedRoutes:
      namespaces:
        from: All

kubectl apply -f gateway-https.yaml

Create the HTTPRoute

The following HTTPRoute attaches to the HTTPS Gateway and routes requests with path prefixes /status or /delay to port 8000 of the httpbin service.

apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: httpbin-https
  namespace: default
spec:
  parentRefs:
  - name: gateway-https
    namespace: istio-system
  hostnames: ["*.aliyun.com"]
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /status
    - path:
        type: PathPrefix
        value: /delay
    backendRefs:
    - name: httpbin
      port: 8000

kubectl apply -f httpbin-https.yaml

Verify the HTTPS routing rule

Run the following command to access the httpbin application through the ingress gateway and check whether the HTTPS routing rule takes effect. Replace <ingress-gateway-ip> with the IP address of the deployed ingress gateway.

curl -k -HHost:a.aliyun.com --resolve a.aliyun.com:443:<ingress-gateway-ip> https://a.aliyun.com/status/418

Expected output:

   -=[ teapot ]=-

          _...._
        .'  _ _ `.
       | ."` ^ `". _,
       \_;`"---"`|//
         |       ;/
         \_     _/
           `"""`

The teapot ASCII art (HTTP 418) confirms that the HTTPS routing rule and TLS termination are working.