Add support for K8S Gateway API (httpRoute config)
#3661
Conversation
From https://gateway-api.sigs.k8s.io/ > When using the Gateway API to manage ingress traffic, the Gateway resource defines a point of access at which traffic can be routed across multiple contexts -- for example, from outside the cluster to inside the cluster (north/south traffic).
|
|
||
| test-gateway-ingress: | ||
| # The main test configures autohttps, but this conflicts with testing | ||
| # ingress/gateway which assume they can directly connect to proxy-public |
There was a problem hiding this comment.
In theory it should be possible to have autohttps working, but that would only be used for internal connections between the traefik ingress/gateway controller and the autohttps/proxy pod which effectively means it's no use, since the certificate is designed for external connections.
The certificate for external connections has to be managed by the gateway or ingress controller, not autohttps.
https://gateway-api.sigs.k8s.io/guides/tls/
I don't think autohttps is useful unless using a TCP LoadBalancer which passes network traffic straight through.
There was a problem hiding this comment.
Rereading https://gateway-api.sigs.k8s.io/guides/tls/#tls-configuration there's a Passthrough mode, but this is Experimental and I don't see what benefit it offers for autohttps- it adds unnecessary complexity.
consideRatio
changed the title
httpRoute config)
There was a problem hiding this comment.
Thank you @Kyrremann and @manics! This looks right and sound!
I pushed two commits and think this could be ready to merge. What do you think?
I was thinking if it made sense to allow both ingress and httproute, but I think it does - right? I'm thinking there could be an ingress controller next to a gateway controller, and they both could help facilitate inbound connections to some k8s Service's endpoints.
|
Thanks for the additions! Both gateway and ingress can be used together, in the same way that you can have multiple ingresses for the same service. It'll be confusing for other admins so not recommended unless you really need it. |
jupyterhub/zero-to-jupyterhub-k8s#3661 Merge pull request #3661 from manics/gateway
@Kyrremann I hope you don't mind, but I've rebased your PR #3222 and updated it with v1 instead of v1beta, removed the GKE specific resource, and added some tests.