Alibaba Cloud Service Mesh:Define routing rules with Gateway API

How it works

Traffic flows through the following path:

Client request --> Ingress gateway (Gateway resource) --> HTTPRoute --> Backend service (httpbin)

1. A Gateway resource binds to a pre-deployed ingress gateway and creates a listener on a specified port and hostname pattern.

2. An HTTPRoute attaches to the Gateway and routes matching requests to a backend service.

Unlike upstream Istio, where a Gateway resource automatically provisions a data plane, ASM requires you to bind the Gateway to a pre-deployed ingress gateway through the spec.addresses field. This enables resource reuse and centralized management across clusters.

Version compatibility

In multi-cluster mode, gateway resources with the same name in the same namespace across two data plane clusters overwrite each other. The last-applied resource takes precedence.

Prerequisites

Before you begin, make sure that you have:

• An ASM instance of v1.18 or later with a Container Service for Kubernetes (ACK) cluster added. For more information, see Add a cluster to an ASM instance

• An ingress gateway deployed with ports 80 and 443 enabled. For more information, see Create an ingress gateway

• The httpbin application deployed. For more information, see Step 1 in Deploy the httpbin application

Step 1: Verify that Gateway API CRDs exist in the ACK cluster

ACK clusters v1.24 and later automatically include Gateway API CustomResourceDefinitions (CRDs). Verify that the CRDs exist and check their versions.

1. Check whether the CRDs exist: If the CRDs are present, the output resembles the following:

      kubectl get crds | grep gateway.networking.k8s.io

      gatewayclasses.gateway.networking.k8s.io                         2023-05-10T02:51:33Z
      gateways.gateway.networking.k8s.io                               2023-05-10T02:51:33Z
      httproutes.gateway.networking.k8s.io                             2023-05-10T02:51:33Z
      referencegrants.gateway.networking.k8s.io                        2023-05-10T02:51:33Z

2. Verify the CRD bundle version: Expected output:

      kubectl get crds -o yaml | grep 'gateway.networking.k8s.io/bundle-version'

      gateway.networking.k8s.io/bundle-version: v0.6.0
      gateway.networking.k8s.io/bundle-version: v0.6.0
      gateway.networking.k8s.io/bundle-version: v0.6.0
      gateway.networking.k8s.io/bundle-version: v0.6.0

If the CRDs are missing, install the Gateway API component from the Add-ons page in the ACK console. For more information, see Manage components.

Step 2: Enable Gateway API for the ASM instance

Connect to the ASM instance with kubectl using its kubeconfig file, then set enableGatewayAPI to true in the ASMMeshConfig resource:

apiVersion: istio.alibabacloud.com/v1beta1
kind: ASMMeshConfig
metadata:
  name: default
spec:
  enableGatewayAPI: true

After you apply this configuration, the ASM control plane generates the corresponding Gateway API CRDs.

Step 3: Configure an HTTP routing rule

Create a Gateway and an HTTPRoute in the ACK cluster to expose the httpbin application over HTTP through the ingress gateway.

Apply the following YAML to the ACK cluster. Replace <ingress-gateway-name> with the name of your deployed ingress gateway.

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: gateway
  namespace: istio-system
spec:
  addresses:
  - type: Hostname
    value: istio-<ingress-gateway-name>.istio-system.svc.cluster.local  # Binds to the pre-deployed ingress gateway
  gatewayClassName: istio
  listeners:
  - name: default
    hostname: '*.aliyun.com'   # To match all hosts, omit this field. A wildcard (*) alone is not allowed.
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: All              # Allows HTTPRoutes from any namespace to attach
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: http
  namespace: default
spec:
  parentRefs:
  - name: gateway
    namespace: istio-system     # Attaches to the Gateway created above
  hostnames: ["*.aliyun.com"]
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /get
    backendRefs:
    - name: httpbin              # Routes to the httpbin service in the same namespace
      port: 8000

Save the content as gateway-http.yaml and apply it:

kubectl apply -f gateway-http.yaml

curl -I -HHost:httpbin.aliyun.com "http://<ingress-gateway-ip>:80/get"

HTTP/1.1 200 OK
server: istio-envoy
date: Fri, 12 May 2023 08:16:30 GMT
content-type: application/json
content-length: 516
access-control-allow-origin: *
access-control-allow-credentials: true
x-envoy-upstream-service-time: 4

Step 4: Configure an HTTPS routing rule with TLS termination

Create a Gateway and HTTPRoute that expose the httpbin application over HTTPS. TLS terminates at the ingress gateway, so backend traffic remains unencrypted.

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: gateway-https
  namespace: istio-system
spec:
  addresses:
  - type: Hostname
    value: istio-<ingress-gateway-name>.istio-system.svc.cluster.local
  gatewayClassName: istio
  listeners:
  - name: https
    hostname: "*.aliyun.com"
    port: 443
    protocol: HTTPS
    tls:
      mode: Terminate              # TLS terminates at the ingress gateway
      certificateRefs:
      - name: myexample-credential # References the certificate created above
    allowedRoutes:
      namespaces:
        from: All
---
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: httpbin-https
  namespace: default
spec:
  parentRefs:
  - name: gateway-https
    namespace: istio-system
  hostnames: ["*.aliyun.com"]
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /status
    - path:
        type: PathPrefix
        value: /delay
    backendRefs:
    - name: httpbin
      port: 8000

kubectl apply -f gateway-https.yaml

curl -k -H Host:a.aliyun.com \
  --resolve a.aliyun.com:443:<ingress-gateway-ip> \
  https://a.aliyun.com/status/418

-=[ teapot ]=-

       _...._
     .'  _ _ `.
    | ."` ^ `". _,
    \_;`"---"`|//
      |       ;/
      \_     _/
        `"""`

Differences from Istio APIs

If you are migrating from Istio VirtualService and Gateway resources, the following differences apply:

Placeholder reference

Replace the following placeholders in the examples with your actual values: