Skip to content

Commit 55e4535

Browse files
cnvergencecnvergence
committed
add to 1.4
Signed-off-by: Karol Szwaj <[email protected]>
1 parent b16a97b commit 55e4535

File tree

2 files changed

+288
-2
lines changed

2 files changed

+288
-2
lines changed

‎site/content/en/v1.4/tasks/operations/deployment-mode.md‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,18 +4,22 @@ title: "Deployment Mode"
44
## Deployment modes
55

66
### One GatewayClass per Envoy Gateway Controller
7+
78
* An Envoy Gateway is associated with a single [GatewayClass][] resource under one controller.
89
This is the simplest deployment mode and is suitable for scenarios where each Gateway needs to have its own dedicated set of resources and configurations.
910

1011
### Multiple GatewayClasses per Envoy Gateway Controller
12+
1113
* An Envoy Gateway is associated with multiple [GatewayClass][] resources under one controller.
1214
* Support for accepting multiple GatewayClasses was added [here][issue1231].
1315

1416
### Separate Envoy Gateway Controllers
17+
1518
If you've instantiated multiple GatewayClasses, you can also run separate Envoy Gateway controllers in different namespaces, linking a GatewayClass to each of them for multi-tenancy.
1619
Please follow the example [Multi-tenancy](#multi-tenancy).
1720

1821
### Merged Gateways onto a single EnvoyProxy fleet
22+
1923
By default, each Gateway has its own dedicated set of Envoy Proxy and its configurations.
2024
However, for some deployments, it may be more convenient to merge listeners across multiple Gateways and deploy a single Envoy Proxy fleet.
2125

@@ -26,6 +30,14 @@ Setting the `mergeGateways` field in the EnvoyProxy resource linked to GatewayCl
2630

2731
Please follow the example [Merged gateways deployment](#merged-gateways-deployment).
2832

33+
### Gateway Namespace Mode
34+
35+
Gateway Namespace Mode is a deployment model for Envoy Gateway that creates Envoy Proxy infrastructure resources like Deployments, Services and ServiceAccounts in the namespace where each Gateway resource is defined, rather than in the Envoy Gateway controller namespace.
36+
37+
* Support for this deployment mode was added [here][issue2629].
38+
39+
Please follow the example [Gateway Namespace Mode][].
40+
2941
### Supported Modes
3042

3143
#### Kubernetes
@@ -34,7 +46,6 @@ Please follow the example [Merged gateways deployment](#merged-gateways-deployme
3446
and **creates** managed data plane resources such as EnvoyProxy `Deployment` in the **namespace where Envoy Gateway is running**.
3547
* Envoy Gateway also supports [Namespaced deployment mode][], you can watch resources in the specific namespaces by assigning
3648
`EnvoyGateway.provider.kubernetes.watch.namespaces` or `EnvoyGateway.provider.kubernetes.watch.namespaceSelector` and **creates** managed data plane resources in the **namespace where Envoy Gateway is running**.
37-
* Support for alternate deployment modes is being tracked [here][issue1117].
3849

3950
### Multi-tenancy
4051

@@ -1068,5 +1079,6 @@ curl --header "Host: www.merged3.com" http://$GATEWAY_HOST:8082/example3
10681079
[EnvoyProxy]: ../../api/extension_types#envoyproxy
10691080
[GatewayClass]: https://gateway-api.sigs.k8s.io/api-types/gatewayclass/
10701081
[Namespaced deployment mode]: ../../api/extension_types#kuberneteswatchmode
1082+
[Gateway Namespace Mode]: ./gateway-namespace-mode.md
10711083
[issue1231]: https://github.com/envoyproxy/gateway/issues/1231
1072-
[issue1117]: https://github.com/envoyproxy/gateway/issues/1117
1084+
[issue2629]: https://github.com/envoyproxy/gateway/issues/2629

‎site/content/en/v1.4/tasks/operations/gateway-namespace-mode.md‎

Lines changed: 274 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,274 @@
1+
---
2+
title: "Gateway Namespace Mode"
3+
---
4+
5+
{{% alert title="Notice" color="warning" %}}
6+
7+
Gateway Namespace Mode is currently an **alpha** feature. We recommend against using it in production workloads until it reaches beta status.
8+
9+
For status updates or to provide feedback, please follow our [GitHub issues](https://github.com/envoyproxy/gateway/issues).
10+
11+
{{% /alert %}}
12+
13+
# Overview
14+
15+
In standard deployment mode, Envoy Gateway creates all data plane resources in the controller namespace (typically `envoy-gateway-system`).
16+
17+
Gateway Namespace Mode changes this behavior by placing Envoy Proxy data plane resources like Deployments, Services and ServiceAccounts in each Gateway's namespace, providing stronger isolation and multi-tenancy.
18+
19+
Traditional deployment mode uses mTLS where both the client and server authenticate each other. However, in Gateway Namespace Mode, we've shifted to server-side TLS and JWT token validation between infra and control-plane.
20+
21+
* Only the CA certificate is available in pods running in Gateway namespaces
22+
* Client certificates are not mounted in these namespaces
23+
* The Envoy proxy still validates server certificates using the CA certificate
24+
25+
Gateway Namespace Mode uses projected service account JWT tokens for authentication.
26+
* Use short-lived, audience-specific JWT tokens. These tokens are automatically mounted into pods via the projected volume mechanism
27+
* JWT validation ensures that only authorized proxies can connect to the xDS server
28+
29+
{{% alert title="Note" color="warning" %}}
30+
31+
Currently it is not supported to run Gateway Namespace Mode with Merged Gateways deployments.
32+
33+
{{% /alert %}}
34+
35+
# Configuration
36+
37+
To enable Gateway Namespace Mode, configure the `provider.kubernetes.deploy.type` field in your Envoy Gateway ConfigMap:
38+
39+
```bash
40+
apiVersion: gateway.envoyproxy.io/v1alpha1
41+
kind: EnvoyGateway
42+
metadata:
43+
name: envoy-gateway
44+
namespace: envoy-gateway-system
45+
spec:
46+
provider:
47+
type: Kubernetes
48+
kubernetes:
49+
deploy:
50+
type: GatewayNamespace
51+
```
52+
53+
To install Envoy Gateway with Gateway Namespace Mode using Helm:
54+
55+
```bash
56+
helm install \
57+
--set config.envoyGateway.provider.kubernetes.deploy.type=GatewayNamespace \
58+
eg oci://docker.io/envoyproxy/gateway-helm \
59+
--version latest -n envoy-gateway-system --create-namespace
60+
```
61+
62+
## RBAC configuration
63+
64+
When using Gateway Namespace Mode, Envoy Gateway needs additional RBAC permissions to create and manage resources across different namespaces. The following RBAC resources are automatically created when installing Envoy Gateway Helm Chart with Gateway Namespace Mode enabled.
65+
66+
```bash
67+
apiVersion: rbac.authorization.k8s.io/v1
68+
kind: ClusterRole
69+
metadata:
70+
name: gateway-helm-cluster-infra-manager
71+
rules:
72+
- apiGroups: [""]
73+
resources: ["serviceaccounts", "services", "configmaps"]
74+
verbs: ["create", "get", "delete", "deletecollection", "patch"]
75+
- apiGroups: ["apps"]
76+
resources: ["deployments", "daemonsets"]
77+
verbs: ["create", "get", "delete", "deletecollection", "patch"]
78+
- apiGroups: ["autoscaling", "policy"]
79+
resources: ["horizontalpodautoscalers", "poddisruptionbudgets"]
80+
verbs: ["create", "get", "delete", "deletecollection", "patch"]
81+
- apiGroups: ["authentication.k8s.io"]
82+
resources: ["tokenreviews"]
83+
verbs: ["create"]
84+
---
85+
apiVersion: rbac.authorization.k8s.io/v1
86+
kind: ClusterRoleBinding
87+
metadata:
88+
name: gateway-helm-cluster-infra-manager
89+
roleRef:
90+
apiGroup: rbac.authorization.k8s.io
91+
kind: ClusterRole
92+
name: 'gateway-helm-cluster-infra-manager'
93+
subjects:
94+
- kind: ServiceAccount
95+
name: 'envoy-gateway'
96+
namespace: 'envoy-gateway-system'
97+
```
98+
99+
Envoy Gateway also supports configuration to you only watch resources in the specific namespaces by assigning
100+
`EnvoyGateway.provider.kubernetes.watch.namespaces` or `EnvoyGateway.provider.kubernetes.watch.namespaceSelector`.
101+
In this case, when you specify this configuration with Gateway Namespace Mode,Envoy Gateway will only watch for Gateway API resources in the specified namespaces and create needed Roles for infrastructure management in the specified namespaces.
102+
103+
# Using Gateway Namespace Mode
104+
105+
The following example demonstrates deploying two Gateways in different namespaces `team-a` and `team-b`.
106+
107+
## Create test namespaces
108+
109+
```shell
110+
kubectl create namespace team-a
111+
kubectl create namespace team-b
112+
```
113+
114+
## Deploy Gateway Namespace Mode Example
115+
116+
Deploy resources on your cluster from the example.
117+
118+
```shell
119+
kubectl apply -f https://raw.githubusercontent.com/envoyproxy/gateway/latest/examples/kubernetes/gateway-namespace-mode.yaml
120+
```
121+
122+
Verify that Gateways are deployed and programmed
123+
124+
```shell
125+
kubectl get gateways -n team-a
126+
127+
NAME CLASS ADDRESS PROGRAMMED AGE
128+
gateway-a eg 172.18.0.200 True 67s
129+
```
130+
131+
```shell
132+
kubectl get gateways -n team-b
133+
134+
NAME CLASS ADDRESS PROGRAMMED AGE
135+
gateway-b eg 172.18.0.201 True 67s
136+
```
137+
138+
Verify that HTTPRoutes are deployed
139+
140+
```shell
141+
kubectl get httproute -n team-a
142+
143+
NAME HOSTNAMES AGE
144+
team-a-route ["www.team-a.com"] 67s
145+
```
146+
147+
```shell
148+
kubectl get httproute -n team-b
149+
150+
NAME HOSTNAMES AGE
151+
team-b-route ["www.team-b.com"] 67s
152+
```
153+
154+
Envoy Proxy resources should be created now in the namespace of every Gateway.
155+
156+
```shell
157+
kubectl get pods -n team-a
158+
159+
NAME READY STATUS RESTARTS AGE
160+
envoy-team-a-gateway-a-b65c6264-d56f5d989-6dv5s 2/2 Running 0 65s
161+
team-a-backend-6f786fb76f-nx26p 1/1 Running 0 65s
162+
```
163+
164+
```shell
165+
kubectl get pods -n team-b
166+
167+
NAME READY STATUS RESTARTS AGE
168+
envoy-team-b-gateway-b-0ac91f5a-74f445884f-95pl8 2/2 Running 0 87s
169+
team-b-backend-966b5f47c-zxngl 1/1 Running 0 87s
170+
```
171+
172+
```shell
173+
kubectl get services -n team-a
174+
175+
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
176+
envoy-team-a-gateway-a-b65c6264 LoadBalancer 10.96.191.198 172.18.0.200 8080:30999/TCP 3m2s
177+
team-a-backend ClusterIP 10.96.92.226 <none> 3000/TCP 3m2s
178+
```
179+
180+
```shell
181+
kubectl get services -n team-b
182+
183+
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
184+
envoy-team-b-gateway-b-0ac91f5a LoadBalancer 10.96.144.13 172.18.0.201 8081:31683/TCP 3m43s
185+
team-b-backend ClusterIP 10.96.26.162 <none> 3000/TCP 3m43s
186+
```
187+
188+
## Testing the Configuration
189+
190+
Fetch external IPs of the services:
191+
192+
```shell
193+
export GATEWAY_HOST_A=$(kubectl get gateway/gateway-a -n team-a -o jsonpath='{.status.addresses[0].value}')
194+
```
195+
196+
```shell
197+
export GATEWAY_HOST_B=$(kubectl get gateway/gateway-b -n team-b -o jsonpath='{.status.addresses[0].value}')
198+
```
199+
200+
Curl the route team-a-route through Envoy proxy:
201+
202+
```shell
203+
curl --header "Host: www.team-a.com" http://$GATEWAY_HOST_A:8080/example
204+
```
205+
206+
```shell
207+
{
208+
"path": "/example",
209+
"host": "www.team-a.com",
210+
"method": "GET",
211+
"proto": "HTTP/1.1",
212+
"headers": {
213+
"Accept": [
214+
"*/*"
215+
],
216+
"User-Agent": [
217+
"curl/8.7.1"
218+
],
219+
"X-Envoy-External-Address": [
220+
"172.18.0.3"
221+
],
222+
"X-Forwarded-For": [
223+
"172.18.0.3"
224+
],
225+
"X-Forwarded-Proto": [
226+
"http"
227+
],
228+
"X-Request-Id": [
229+
"52f08a5c-7e07-43b7-bd23-44693c60fc0c"
230+
]
231+
},
232+
"namespace": "team-a",
233+
"ingress": "",
234+
"service": "",
235+
"pod": "team-a-backend-6f786fb76f-nx26p"
236+
```
237+
238+
Curl the route team-b-route through Envoy proxy:
239+
240+
```shell
241+
curl --header "Host: www.team-b.com" http://$GATEWAY_HOST_B:8081/example
242+
```
243+
244+
```shell
245+
{
246+
"path": "/example",
247+
"host": "www.team-b.com",
248+
"method": "GET",
249+
"proto": "HTTP/1.1",
250+
"headers": {
251+
"Accept": [
252+
"*/*"
253+
],
254+
"User-Agent": [
255+
"curl/8.7.1"
256+
],
257+
"X-Envoy-External-Address": [
258+
"172.18.0.3"
259+
],
260+
"X-Forwarded-For": [
261+
"172.18.0.3"
262+
],
263+
"X-Forwarded-Proto": [
264+
"http"
265+
],
266+
"X-Request-Id": [
267+
"62a06bd7-4754-475b-854a-dca3fc159e93"
268+
]
269+
},
270+
"namespace": "team-b",
271+
"ingress": "",
272+
"service": "",
273+
"pod": "team-b-backend-966b5f47c-d6jwj"
274+
```

0 commit comments

Comments
 (0)