欢迎访问 Envoy Gateway

• 1: 任务
• 1.1: 快速入门
• 1.2: GRPC 路由
• 1.3: JWT 身份验证
• 2: 安装
• 2.1: 使用 Helm 安装
• 2.2: 使用 Kubernetes YAML 安装
• 2.3: 使用自定义证书的控制平面身份验证
• 2.4: Gateway Addons Helm Chart
• 2.5: Gateway Helm Chart
• 2.6: 兼容性表格
• 3: API
• 3.1: API Reference
• 4: 版本
• 4.1: v1.0.2
• 4.2: v1.0.1
• 4.3: v1.0.0

1 - 任务

1.1 - 快速入门

本指南将帮助您通过几个简单的步骤开始使用 Envoy Gateway。

前置条件

一个 Kubernetes 集群。

注意： 请参考兼容性表格来查看所支持的 Kubernetes 版本。

注意： 如果您的 Kubernetes 集群没有负载均衡器实现，我们建议安装一个 ，以便 Gateway 资源能够关联一个地址。我们推荐使用 MetalLB。

安装

安装 Gateway API CRD 和 Envoy Gateway：

helm install eg oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest -n envoy-gateway-system --create-namespace

等待 Envoy Gateway 至可用后：

kubectl wait --timeout=5m -n envoy-gateway-system deployment/envoy-gateway --for=condition=Available

安装 GatewayClass，Gateway，HTTPRoute 和示例应用：

kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/latest/quickstart.yaml -n default

注意：quickstart.yaml 定义了 Envoy Gateway 将侦听其全局可路由 IP 地址上端口 80 上的流量，以便轻松使用浏览器测试 Envoy Gateway。当 Envoy Gateway 看到它的侦听器使用特权端口（<1024）， 它将在内部映射到非特权端口，因此 Envoy Gateway 不需要额外的特权。 了解此映射很重要，当您调试时您可能需要将其考虑在内。

测试配置

• 不使用负载均衡器
• 使用外部负载均衡器

export ENVOY_SERVICE=$(kubectl get svc -n envoy-gateway-system --selector=gateway.envoyproxy.io/owning-gateway-namespace=default,gateway.envoyproxy.io/owning-gateway-name=eg -o jsonpath='{.items[0].metadata.name}')

kubectl -n envoy-gateway-system port-forward service/${ENVOY_SERVICE} 8888:80 &

curl --verbose --header "Host: www.example.com" http://localhost:8888/get

export GATEWAY_HOST=$(kubectl get svc/${ENVOY_SERVICE} -n envoy-gateway-system -o jsonpath='{.status.loadBalancer.ingress[0].ip}')

curl --verbose --header "Host: www.example.com" http://$GATEWAY_HOST/get

接下来的探索？

在快速开始（本节），您将：

• 完成 Envoy Gateway 的安装
• 部署一个后端服务和一个网关
• 使用 Kubernetes Gateway API 资源 Gateway 和 HttpRoute 配置网关。将网关传入的 HTTP 请求转发到后端服务。

以下是建议的后续任务列表，可指导您探索 Envoy Gateway：

• HTTP 路由
• 流量拆分
• 安全网关
• 全局限流
• gRPC 路由

请查看与您使用情况相符的场景下的任务部分。Envoy Gateway 的任务按照流量管理、安全、扩展性、可观察性和运维等分类组织。

清理

请按照本节中的步骤将快速入门中的所有内容卸载。

删除 GatewayClass，Gateway，HTTPRoute 和示例应用：

kubectl delete -f https://github.com/envoyproxy/gateway/releases/download/latest/quickstart.yaml --ignore-not-found=true

删除 Gateway API CRD 和 Envoy Gateway：

helm uninstall eg -n envoy-gateway-system

接下来

浏览开发者指南 ，了解如何参与项目。

1.2 - GRPC 路由

GRPCRoute 资源允许用户通过匹配 HTTP/2 流量并将其转发到后端 gRPC 服务器来配置 gRPC 路由。 要了解有关 gRPC 路由的更多信息，请参阅Gateway API 文档。

先决条件

按照快速入门中的步骤安装 Envoy Gateway 和示例清单。 在继续之前，您应该能够使用 HTTP 查询示例程序后端。

安装

安装 gRPC 路由示例资源：

kubectl apply -f https://raw.githubusercontent.com/envoyproxy/gateway/latest/examples/kubernetes/grpc-routing.yaml

该清单安装 GatewayClass、Gateway、Deployment、Service 和 GRPCRoute 资源。 GatewayClass 是集群范围的资源，表示可以被实例化的一类 Gateway。

**注意：**Envoy Gateway 默认被配置为使用 controllerName: gateway.envoyproxy.io/gatewayclass-controller 管理 GatewayClass。

验证

检查 GatewayClass 的状态：

kubectl get gc --selector=example=grpc-routing

状态应反映为 Accepted=True，表示 Envoy Gateway 正在管理 GatewayClass。

Gateway 代表基础设施的配置。创建 Gateway 时，Envoy 代理基础设施由 Envoy Gateway 预配或配置。 gatewayClassName 定义此 Gateway 使用的 GatewayClass 的名称。检查 Gateway 状态：

kubectl get gateways --selector=example=grpc-routing

状态应反映为 Ready=True，表示 Envoy 代理基础设施已被配置。 该状态还提供 Gateway 的地址。该地址稍后用于测试与代理后端服务的连接。

检查 GRPCRoute 的状态：

kubectl get grpcroutes --selector=example=grpc-routing -o yaml

GRPCRoute 的状态应显示 Accepted=True 和引用示例 Gateway 的 parentRef。 example-route 匹配 grpc-example.com 的任何流量并将其转发到 yages 服务。

测试配置

在测试到 yages 后端的 GRPC 路由之前，请获取 Gateway 的地址。

export GATEWAY_HOST=$(kubectl get gateway/example-gateway -o jsonpath='{.status.addresses[0].value}')

使用 grpcurl 命令测试到 yages 后端的 GRPC 路由。

grpcurl -plaintext -authority=grpc-example.com ${GATEWAY_HOST}:80 yages.Echo/Ping

您应该看到以下响应：

{
  "text": "pong"
}

Envoy Gateway 还支持此配置的 gRPC-Web 请求。下面的 curl 命令可用于通过 HTTP/2 发送 grpc-Web 请求。 您应该收到与上一个命令相同的响应。

正文 AAAAAAA= 中的数据是 Ping RPC 接受的空消息（数据长度为 0）的 Base64 编码表示。

curl --http2-prior-knowledge -s ${GATEWAY_HOST}:80/yages.Echo/Ping -H 'Host: grpc-example.com'   -H 'Content-Type: application/grpc-web-text'   -H 'Accept: application/grpc-web-text' -XPOST -d'AAAAAAA=' | base64 -d

GRPCRoute 匹配

matches 字段可用于根据 GRPC 的服务和/或方法名称将路由限制到一组特定的请求。 它支持两种匹配类型：Exact（精准）和 RegularExpression（正则）。

精准

Exact（精准）匹配是默认匹配类型。

以下示例显示如何根据 grpc.reflection.v1alpha.ServerReflection/ServerReflectionInfo 的服务和方法名称来匹配请求， 以及如何在我们的部署中匹配方法名称为 Ping 且与 yages.Echo/Ping 匹配的所有服务。

• 通过标准输入应用
• 通过文件应用

cat <<EOF | kubectl apply -f -
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: GRPCRoute
metadata:
  name: yages
  labels:
    example: grpc-routing
spec:
  parentRefs:
    - name: example-gateway
  hostnames:
    - "grpc-example.com"
  rules:
    - matches:
      - method:
          method: ServerReflectionInfo
          service: grpc.reflection.v1alpha.ServerReflection
      - method:
          method: Ping
      backendRefs:
        - group: ""
          kind: Service
          name: yages
          port: 9000
          weight: 1
EOF

---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: GRPCRoute
metadata:
  name: yages
  labels:
    example: grpc-routing
spec:
  parentRefs:
    - name: example-gateway
  hostnames:
    - "grpc-example.com"
  rules:
    - matches:
      - method:
          method: ServerReflectionInfo
          service: grpc.reflection.v1alpha.ServerReflection
      - method:
          method: Ping
      backendRefs:
        - group: ""
          kind: Service
          name: yages
          port: 9000
          weight: 1

验证 GRPCRoute 状态：

kubectl get grpcroutes --selector=example=grpc-routing -o yaml

使用 grpcurl 命令测试到 yages 后端的 GRPC 路由。

grpcurl -plaintext -authority=grpc-example.com ${GATEWAY_HOST}:80 yages.Echo/Ping

正则

以下示例演示如何根据服务和方法名称将请求与匹配类型 RegularExpression 进行匹配。 它与模式 /.*.Echo/Pin.+ 匹配所有服务和方法，该模式与我们部署中的 yages.Echo/Ping 匹配。

• 通过标准输入应用
• 通过文件应用

cat <<EOF | kubectl apply -f -
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: GRPCRoute
metadata:
  name: yages
  labels:
    example: grpc-routing
spec:
  parentRefs:
    - name: example-gateway
  hostnames:
    - "grpc-example.com"
  rules:
    - matches:
      - method:
          method: ServerReflectionInfo
          service: grpc.reflection.v1alpha.ServerReflection
      - method:
          method: "Pin.+"
          service: ".*.Echo"
          type: RegularExpression
      backendRefs:
        - group: ""
          kind: Service
          name: yages
          port: 9000
          weight: 1
EOF

---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: GRPCRoute
metadata:
  name: yages
  labels:
    example: grpc-routing
spec:
  parentRefs:
    - name: example-gateway
  hostnames:
    - "grpc-example.com"
  rules:
    - matches:
      - method:
          method: ServerReflectionInfo
          service: grpc.reflection.v1alpha.ServerReflection
      - method:
          method: "Pin.+"
          service: ".*.Echo"
          type: RegularExpression
      backendRefs:
        - group: ""
          kind: Service
          name: yages
          port: 9000
          weight: 1

检查 GRPCRoute 状态：

kubectl get grpcroutes --selector=example=grpc-routing -o yaml

使用 grpcurl 命令测试到 yages 后端的 GRPC 路由。

grpcurl -plaintext -authority=grpc-example.com ${GATEWAY_HOST}:80 yages.Echo/Ping

1.3 - JWT 身份验证

此任务提供有关配置 JSON Web Token（JWT）身份验证的说明。 JWT 身份验证在将请求路由到后端服务之前检查传入请求是否具有有效的 JWT。 目前，Envoy Gateway 仅支持通过 HTTP 标头验证 JWT，例如 Authorization: Bearer <token>。

Envoy Gateway 引入了一个名为 SecurityPolicy 的新 CRD，允许用户配置 JWT 身份验证。 该实例化资源可以链接到 Gateway、HTTPRoute 或 GRPCRoute 资源。

先决条件

按照快速入门中的步骤安装 Envoy Gateway 和示例清单。 对于 GRPC - 请按照 GRPC 路由示例中的步骤操作。 在继续之前，您应该能够使用 HTTP 或 GRPC 查询示例程序后端。

配置

通过创建 SecurityPolicy 并将其附加到示例 HTTPRoute 或 GRPCRoute，允许使用具有有效 JWT 的请求。

HTTPRoute

kubectl apply -f https://raw.githubusercontent.com/envoyproxy/gateway/latest/examples/kubernetes/jwt/jwt.yaml

已创建两个 HTTPRoute，一个用于 /foo，另一个用于 /bar。 已创建 SecurityPolicy 并以 HTTPRoute foo 为目标来验证对 /foo 的请求。 HTTPRoute bar 不是 SecurityPolicy 的目标，并且将允许未经身份验证的请求发送到 /bar。

验证 HTTPRoute 配置和状态：

kubectl get httproute/foo -o yaml
kubectl get httproute/bar -o yaml

SecurityPolicy 配置为 JWT 身份验证，并使用单个 JSON Web Key Set（JWKS）提供程序来对 JWT 进行身份验证。

验证 SecurityPolicy 配置：

kubectl get securitypolicy/jwt-example -o yaml

GRPCRoute

kubectl apply -f https://raw.githubusercontent.com/envoyproxy/gateway/latest/examples/kubernetes/jwt/grpc-jwt.yaml

已创建 SecurityPolicy 并针对 GRPCRoute yages 来验证 yages 服务的所有请求。

验证 GRPCRoute 配置和状态：

kubectl get grpcroute/yages -o yaml

SecurityPolicy 配置为 JWT 身份验证，并使用单个 JSON Web Key Set（JWKS）提供程序来对 JWT 进行身份验证。

验证 SecurityPolicy 配置：

kubectl get securitypolicy/jwt-example -o yaml

测试

确保设置了快速入门 中的 GATEWAY_HOST 环境变量。如果没有，请按照快速入门说明设置变量。

echo $GATEWAY_HOST

HTTPRoute

验证在没有 JWT 的情况下对 /foo 的请求是否被拒绝：

curl -sS -o /dev/null -H "Host: www.example.com" -w "%{http_code}\n" http://$GATEWAY_HOST/foo

应返回一个 401 HTTP 响应码。

获取用于测试请求身份验证的 JWT：

TOKEN=$(curl https://raw.githubusercontent.com/envoyproxy/gateway/main/examples/kubernetes/jwt/test.jwt -s) && echo "$TOKEN" | cut -d '.' -f2 - | base64 --decode

**注意：**上述命令解码并返回令牌的有效内容。您可以将 f2 替换为 f1 来查看令牌的标头。

验证是否允许使用有效 JWT 向 /foo 发出请求：

curl -sS -o /dev/null -H "Host: www.example.com" -H "Authorization: Bearer $TOKEN" -w "%{http_code}\n" http://$GATEWAY_HOST/foo

应返回一个 200 HTTP 响应码。

验证是否允许在没有 JWT 的情况下向 /bar 发出请求：

curl -sS -o /dev/null -H "Host: www.example.com" -w "%{http_code}\n" http://$GATEWAY_HOST/bar

GRPCRoute

验证是否在没有 JWT 的情况下拒绝对 yages 服务的请求：

grpcurl -plaintext -authority=grpc-example.com ${GATEWAY_HOST}:80 yages.Echo/Ping

您应该看到以下响应：

Error invoking method "yages.Echo/Ping": rpc error: code = Unauthenticated desc = failed to query for service descriptor "yages.Echo": Jwt is missing

获取用于测试请求身份验证的 JWT：

TOKEN=$(curl https://raw.githubusercontent.com/envoyproxy/gateway/main/examples/kubernetes/jwt/test.jwt -s) && echo "$TOKEN" | cut -d '.' -f2 - | base64 --decode

**注意：**上述命令解码并返回令牌的有效内容。您可以将 f2 替换为 f1 来查看令牌的标头。

验证是否允许使用有效 JWT 向 yages 服务发出请求：

grpcurl -plaintext -H "authorization: Bearer $TOKEN" -authority=grpc-example.com ${GATEWAY_HOST}:80 yages.Echo/Ping

您应该看到以下响应：

{
  "text": "pong"
}

清理

按照快速入门 中的步骤卸载 Envoy Gateway 和示例清单。

删除 SecurityPolicy：

kubectl delete securitypolicy/jwt-example

后续步骤

查看开发者指南参与该项目。

2 - 安装

2.1 - 使用 Helm 安装

Helm 是 Kubernetes 的包管理器，可自动在 Kubernetes 上发布和管理软件。

Envoy Gateway 可以通过 Helm Chart 经过几个简单的步骤进行安装， 具体取决于您是首次部署、从现有安装升级 Envoy Gateway 还是从 Envoy Gateway 迁移。

开始之前

Envoy Gateway Helm Chart 托管在 DockerHub 中。

它发布在 oci://docker.io/envoyproxy/gateway-helm。

使用 Helm 安装

Envoy Gateway 通常从命令行部署到 Kubernetes。如果您没有 Kubernetes，则应该使用 kind 来创建一个。

安装 Gateway API CRD 和 Envoy Gateway：

helm install eg oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest -n envoy-gateway-system --create-namespace

等待 Envoy Gateway 变为可用：

kubectl wait --timeout=5m -n envoy-gateway-system deployment/envoy-gateway --for=condition=Available

安装 GatewayClass、Gateway、HTTPRoute 和示例应用程序：

kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/latest/quickstart.yaml -n default

注意：quickstart.yaml 定义 Envoy Gateway 将侦听 80 端口及其全局可路由 IP 地址的流量， 以便轻松使用浏览器测试 Envoy Gateway。当 Envoy Gateway 发现其侦听器正在使用特权端口（<1024）时， 它会在内部将其映射到非特权端口，以便 Envoy Gateway 不需要额外的特权。了解此映射很重要，因为您在调试时可能需要考虑它。

自定义 Helm Chart

下面是使用 helm install 命令进行 Envoy Gateway 安装的一些快速方法。

增加副本数

helm install eg oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest -n envoy-gateway-system --create-namespace --set deployment.replicas=2

更改 kubernetesClusterDomain 名称

如果您使用不同的域名安装了集群，则可以使用以下命令。

helm install eg oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest -n envoy-gateway-system --create-namespace --set kubernetesClusterDomain=<domain name>

**注意：**以上是我们可以直接用于自定义安装的一些方法。但如果您正在寻找更复杂的更改， values.yaml 可以帮助您。

使用 values.yaml 文件进行复杂安装

deployment:
  envoyGateway:
    resources:
      limits:
        cpu: 700m
        memory: 128Mi
      requests:
        cpu: 10m
        memory: 64Mi
  ports:
    - name: grpc
      port: 18005
      targetPort: 18000
    - name: ratelimit
      port: 18006
      targetPort: 18001

config:
  envoyGateway:
    logging:
      level:
        default: debug

在这里，我们对 value.yaml 文件进行了三处更改。将 CPU 的资源限制增加到 700m， 将 gRPC 的端口更改为 18005，将限流端口更改为 18006，并将日志记录级别更新为 debug。

您可以通过以下命令使用 value.yaml 文件安装 Envoy Gateway。

helm install eg oci://docker.io/envoyproxy/gateway-helm --version v0.0.0-latest -n envoy-gateway-system --create-namespace -f values.yaml

开放端口

这些是 Envoy Gateway 和托管 Envoy 代理使用的端口。

Envoy Gateway

EnvoyProxy

2.2 - 使用 Kubernetes YAML 安装

此任务将引导您完成在 Kubernetes 集群中安装 Envoy Gateway。

手动安装过程不允许像 Helm 安装方法那样对配置进行更多控制， 因此如果您需要对 Envoy Gateway 安装进行更多控制，建议您使用 Helm。

开始之前

Envoy Gateway 设计为在 Kubernetes 中运行以进行生产。最重要的要求是：

• Kubernetest 1.25+ 版本
• kubectl 命令行工具

使用 YAML 安装

Envoy Gateway 通常从命令行部署到 Kubernetes。如果您没有 Kubernetes，则应该使用 kind 来创建一个。

1. 在终端中，运行以下命令：

   kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/latest/install.yaml
   

2. 后续步骤

   Envoy Gateway 现在应该已成功安装并运行，但是为了体验 Envoy Gateway 的更多功能，您可以参考任务。

2.3 - 使用自定义证书的控制平面身份验证

Envoy Gateway 为 Envoy Gateway Pod 和 Envoy 代理队列之间的控制平面通信建立了安全的 TLS 连接。 此处使用的 TLS 证书是自签名的，并使用在创建 Envoy Gateway 之前运行的 Job 生成， 并且这些证书被安装到 Envoy Gateway 和 Envoy 代理 Pod 上。

此任务将引导您完成为控制平面身份验证配置自定义证书。

开始之前

我们使用 Cert-Manager 来管理证书。 您可以按照官方指南安装它。

为控制平面配置自定义证书

1. 首先您需要设置 CA 颁发者，在此任务中，我们以 selfsigned-issuer 为例。

   您不应在生产中使用自签名颁发者，您应该使用真实的 CA 颁发者。

   cat <<EOF | kubectl apply -f -
   apiVersion: cert-manager.io/v1
   kind: Issuer
   metadata:
     labels:
       app.kubernetes.io/name: envoy-gateway
     name: selfsigned-issuer
     namespace: envoy-gateway-system
   spec:
     selfSigned: {}
   ---
   apiVersion: cert-manager.io/v1
   kind: Certificate
   metadata:
     name: envoy-gateway-ca
     namespace: envoy-gateway-system
   spec:
     isCA: true
     commonName: envoy-gateway
     secretName: envoy-gateway-ca
     privateKey:
       algorithm: RSA
       size: 2048
     issuerRef:
       name: selfsigned-issuer
       kind: Issuer
       group: cert-manager.io
   ---
   apiVersion: cert-manager.io/v1
   kind: Issuer
   metadata:
     labels:
       app.kubernetes.io/name: envoy-gateway
     name: eg-issuer
     namespace: envoy-gateway-system
   spec:
     ca:
       secretName: envoy-gateway-ca
   EOF
   

2. 为 Envoy Gateway 控制器创建一个证书，该证书将存储在 envoy-gatewy Secret 中。

   cat<<EOF | kubectl apply -f -
   apiVersion: cert-manager.io/v1
   kind: Certificate
   metadata:
     labels:
       app.kubernetes.io/name: envoy-gateway
     name: envoy-gateway
     namespace: envoy-gateway-system
   spec:
     commonName: envoy-gateway
     dnsNames:
     - "envoy-gateway"
     - "envoy-gateway.envoy-gateway-system"
     - "envoy-gateway.envoy-gateway-system.svc"
     - "envoy-gateway.envoy-gateway-system.svc.cluster.local"
     issuerRef:
       kind: Issuer
       name: eg-issuer
     usages:
     - "digital signature"
     - "data encipherment"
     - "key encipherment"
     - "content commitment"
     secretName: envoy-gateway
   EOF
   

3. 为 Envoy 代理创建一个证书，该证书将存储在 envoy Secret 中。

   cat<<EOF | kubectl apply -f -
   apiVersion: cert-manager.io/v1
   kind: Certificate
   metadata:
     labels:
       app.kubernetes.io/name: envoy-gateway
     name: envoy
     namespace: envoy-gateway-system
   spec:
     commonName: "*"
     dnsNames:
     - "*.envoy-gateway-system"
     issuerRef:
       kind: Issuer
       name: eg-issuer
     usages:
     - "digital signature"
     - "data encipherment"
     - "key encipherment"
     - "content commitment"
     secretName: envoy
   EOF
   

4. 创建限流证书，该证书将存储在 envoy-rate-limit Secret 中。

   cat<<EOF | kubectl apply -f -
   apiVersion: cert-manager.io/v1
   kind: Certificate
   metadata:
     labels:
       app.kubernetes.io/name: envoy-gateway
     name: envoy-rate-limit
     namespace: envoy-gateway-system
   spec:
     commonName: "*"
     dnsNames:
     - "*.envoy-gateway-system"
     issuerRef:
       kind: Issuer
       name: eg-issuer
     usages:
     - "digital signature"
     - "data encipherment"
     - "key encipherment"
     - "content commitment"
     secretName: envoy-rate-limit
   EOF
   

5. 现在您可以按照 helm Chart 安装指南使用自定义证书安装 Envoy Gateway。

2.4 - Gateway Addons Helm Chart

An Add-ons Helm chart for Envoy Gateway

Homepage: https://gateway.envoyproxy.io/

Maintainers

Source Code

• https://github.com/envoyproxy/gateway

Requirements

Values

2.5 - Gateway Helm Chart

The Helm chart for Envoy Gateway

Homepage: https://gateway.envoyproxy.io/

Maintainers

Source Code

• https://github.com/envoyproxy/gateway

Values

2.6 - 兼容性表格

Envoy Gateway 依赖于 Envoy Proxy 和 Gateway API，并在 Kubernetes 集群中运行。 这些产品的所有版本并非都可以与 Envoy Gateway 一起运行。下面列出了支持的版本组合； 粗体类型表示实际编译到每个 Envoy Gateway 版本中的 Envoy Proxy 和 Gateway API 的版本。

3 - API

3.1 - API Reference

Packages

• gateway.envoyproxy.io/v1alpha1

gateway.envoyproxy.io/v1alpha1

Package v1alpha1 contains API schema definitions for the gateway.envoyproxy.io API group.

Resource Types

• Backend
• BackendTrafficPolicy
• ClientTrafficPolicy
• EnvoyExtensionPolicy
• EnvoyGateway
• EnvoyPatchPolicy
• EnvoyProxy
• HTTPRouteFilter
• SecurityPolicy

ALPNProtocol

Underlying type: string

ALPNProtocol specifies the protocol to be negotiated using ALPN

Appears in:

• BackendTLSConfig
• ClientTLSSettings
• TLSSettings

ALSEnvoyProxyAccessLog

ALSEnvoyProxyAccessLog defines the gRPC Access Log Service (ALS) sink. The service must implement the Envoy gRPC Access Log Service streaming API: https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/accesslog/v3/als.proto Access log format information is passed in the form of gRPC metadata when the stream is established.

Appears in:

• ProxyAccessLogSink

ALSEnvoyProxyAccessLogType

Underlying type: string

Appears in:

• ALSEnvoyProxyAccessLog

ALSEnvoyProxyHTTPAccessLogConfig

Appears in:

• ALSEnvoyProxyAccessLog

ActiveHealthCheck

ActiveHealthCheck defines the active health check configuration. EG supports various types of active health checking including HTTP, TCP.

Appears in:

• HealthCheck

ActiveHealthCheckPayload

ActiveHealthCheckPayload defines the encoding of the payload bytes in the payload.

Appears in:

• HTTPActiveHealthChecker
• TCPActiveHealthChecker

ActiveHealthCheckPayloadType

Underlying type: string

ActiveHealthCheckPayloadType is the type of the payload.

Appears in:

• ActiveHealthCheckPayload

ActiveHealthCheckerType

Underlying type: string

ActiveHealthCheckerType is the type of health checker.

Appears in:

• ActiveHealthCheck

AppProtocolType

Underlying type: string

AppProtocolType defines various backend applications protocols supported by Envoy Gateway

Appears in:

• BackendSpec

Authorization

Authorization defines the authorization configuration.

Note: if neither Rules nor DefaultAction is specified, the default action is to deny all requests.

Appears in:

• SecurityPolicySpec

AuthorizationAction

Underlying type: string

AuthorizationAction defines the action to be taken if a rule matches.

Appears in:

• Authorization
• AuthorizationRule

AuthorizationRule

AuthorizationRule defines a single authorization rule.

Appears in:

• Authorization

BackOffPolicy

Appears in:

• PerRetryPolicy

Backend

Backend allows the user to configure the endpoints of a backend and the behavior of the connection from Envoy Proxy to the backend.

BackendCluster

BackendCluster contains all the configuration required for configuring access to a backend. This can include multiple endpoints, and settings that apply for managing the connection to all these endpoints.

Appears in:

• ALSEnvoyProxyAccessLog
• ExtProc
• GRPCExtAuthService
• HTTPExtAuthService
• OIDCProvider
• OpenTelemetryEnvoyProxyAccessLog
• ProxyOpenTelemetrySink
• TracingProvider

BackendConnection

BackendConnection allows users to configure connection-level settings of backend

Appears in:

• BackendTrafficPolicySpec
• ClusterSettings

BackendEndpoint

BackendEndpoint describes a backend endpoint, which can be either a fully-qualified domain name, IP address or unix domain socket corresponding to Envoy’s Address: https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/address.proto#config-core-v3-address

Appears in:

• BackendSpec
• ExtensionService

BackendRef

BackendRef defines how an ObjectReference that is specific to BackendRef.

Appears in:

• ALSEnvoyProxyAccessLog
• BackendCluster
• ExtProc
• GRPCExtAuthService
• HTTPExtAuthService
• OIDCProvider
• OpenTelemetryEnvoyProxyAccessLog
• ProxyOpenTelemetrySink
• TracingProvider

BackendSpec

BackendSpec describes the desired state of BackendSpec.

Appears in:

• Backend

BackendStatus

BackendStatus defines the state of Backend

Appears in:

• Backend

BackendTLSConfig

BackendTLSConfig describes the BackendTLS configuration for Envoy Proxy.

Appears in:

• EnvoyProxySpec

BackendTrafficPolicy

BackendTrafficPolicy allows the user to configure the behavior of the connection between the Envoy Proxy listener and the backend service.

BackendTrafficPolicySpec

BackendTrafficPolicySpec defines the desired state of BackendTrafficPolicy.

Appears in:

• BackendTrafficPolicy

BasicAuth

BasicAuth defines the configuration for the HTTP Basic Authentication.

Appears in:

• SecurityPolicySpec

BootstrapType

Underlying type: string

BootstrapType defines the types of bootstrap supported by Envoy Gateway.

Appears in:

• ProxyBootstrap

CIDR

Underlying type: string

CIDR defines a CIDR Address range. A CIDR can be an IPv4 address range such as “192.168.1.0/24” or an IPv6 address range such as “2001:0db8:11a3:09d7::/64”.

Appears in:

• Principal
• XForwardedForSettings

CORS

CORS defines the configuration for Cross-Origin Resource Sharing (CORS).

Appears in:

• SecurityPolicySpec

CircuitBreaker

CircuitBreaker defines the Circuit Breaker configuration.

Appears in:

• BackendTrafficPolicySpec
• ClusterSettings

ClaimToHeader

ClaimToHeader defines a configuration to convert JWT claims into HTTP headers

Appears in:

• JWTProvider

ClientConnection

ClientConnection allows users to configure connection-level settings of client

Appears in:

• ClientTrafficPolicySpec

ClientIPDetectionSettings

ClientIPDetectionSettings provides configuration for determining the original client IP address for requests.

Appears in:

• ClientTrafficPolicySpec

ClientTLSSettings

Appears in:

• ClientTrafficPolicySpec

ClientTimeout

Appears in:

• ClientTrafficPolicySpec

ClientTrafficPolicy

ClientTrafficPolicy allows the user to configure the behavior of the connection between the downstream client and Envoy Proxy listener.

ClientTrafficPolicySpec

ClientTrafficPolicySpec defines the desired state of ClientTrafficPolicy.

Appears in:

• ClientTrafficPolicy

ClientValidationContext

ClientValidationContext holds configuration that can be used to validate the client initiating the TLS connection to the Gateway. By default, no client specific configuration is validated.

Appears in:

• ClientTLSSettings

ClusterSettings

ClusterSettings provides the various knobs that can be set to control how traffic to a given backend will be configured.

Appears in:

• ALSEnvoyProxyAccessLog
• BackendCluster
• BackendTrafficPolicySpec
• ExtProc
• GRPCExtAuthService
• HTTPExtAuthService
• OIDCProvider
• OpenTelemetryEnvoyProxyAccessLog
• ProxyOpenTelemetrySink
• TracingProvider

Compression

Compression defines the config of enabling compression. This can help reduce the bandwidth at the expense of higher CPU.

Appears in:

• BackendTrafficPolicySpec
• ProxyPrometheusProvider

CompressorType

Underlying type: string

CompressorType defines the types of compressor library supported by Envoy Gateway.

Appears in:

• Compression

ConnectionLimit

Appears in:

• ClientConnection

ConsistentHash

ConsistentHash defines the configuration related to the consistent hash load balancer policy.

Appears in:

• LoadBalancer

ConsistentHashType

Underlying type: string

ConsistentHashType defines the type of input to hash on.

Appears in:

• ConsistentHash

Cookie

Cookie defines the cookie hashing configuration for consistent hash based load balancing.

Appears in:

• ConsistentHash

CustomHeaderExtensionSettings

CustomHeaderExtensionSettings provides configuration for determining the client IP address for a request based on a trusted custom HTTP header. This uses the the custom_header original IP detection extension. Refer to https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/http/original_ip_detection/custom_header/v3/custom_header.proto for more details.

Appears in:

• ClientIPDetectionSettings

CustomResponse

CustomResponse defines the configuration for returning a custom response.

Appears in:

• ResponseOverride

CustomResponseBody

CustomResponseBody

Appears in:

• CustomResponse
• HTTPDirectResponseFilter

CustomResponseMatch

CustomResponseMatch defines the configuration for matching a user response to return a custom one.

Appears in:

• ResponseOverride

CustomTag

Appears in:

• ProxyTracing

CustomTagType

Underlying type: string

Appears in:

• CustomTag

DNS

Appears in:

• BackendTrafficPolicySpec
• ClusterSettings

EnvironmentCustomTag

EnvironmentCustomTag adds value from environment variable to each span.

Appears in:

• CustomTag

EnvoyExtensionPolicy

EnvoyExtensionPolicy allows the user to configure various envoy extensibility options for the Gateway.

EnvoyExtensionPolicySpec

EnvoyExtensionPolicySpec defines the desired state of EnvoyExtensionPolicy.

Appears in:

• EnvoyExtensionPolicy

EnvoyFilter

Underlying type: string

EnvoyFilter defines the type of Envoy HTTP filter.

Appears in:

• FilterPosition

EnvoyGateway

EnvoyGateway is the schema for the envoygateways API.

EnvoyGatewayAdmin

EnvoyGatewayAdmin defines the Envoy Gateway Admin configuration.

Appears in:

• EnvoyGateway
• EnvoyGatewaySpec

EnvoyGatewayAdminAddress

EnvoyGatewayAdminAddress defines the Envoy Gateway Admin Address configuration.

Appears in:

• EnvoyGatewayAdmin

EnvoyGatewayCustomProvider

EnvoyGatewayCustomProvider defines configuration for the Custom provider.

Appears in:

• EnvoyGatewayProvider

EnvoyGatewayFileResourceProvider

EnvoyGatewayFileResourceProvider defines configuration for the File Resource provider.

Appears in:

• EnvoyGatewayResourceProvider

EnvoyGatewayHostInfrastructureProvider

EnvoyGatewayHostInfrastructureProvider defines configuration for the Host Infrastructure provider.

Appears in:

• EnvoyGatewayInfrastructureProvider

EnvoyGatewayInfrastructureProvider

EnvoyGatewayInfrastructureProvider defines configuration for the Custom Infrastructure provider.

Appears in:

• EnvoyGatewayCustomProvider

EnvoyGatewayKubernetesProvider

EnvoyGatewayKubernetesProvider defines configuration for the Kubernetes provider.

Appears in:

• EnvoyGatewayProvider

EnvoyGatewayLogComponent

Underlying type: string

EnvoyGatewayLogComponent defines a component that supports a configured logging level.

Appears in:

• EnvoyGatewayLogging

EnvoyGatewayLogging

EnvoyGatewayLogging defines logging for Envoy Gateway.

Appears in:

• EnvoyGateway
• EnvoyGatewaySpec

EnvoyGatewayMetricSink

EnvoyGatewayMetricSink defines control plane metric sinks where metrics are sent to.

Appears in:

• EnvoyGatewayMetrics

EnvoyGatewayMetrics

EnvoyGatewayMetrics defines control plane push/pull metrics configurations.

Appears in:

• EnvoyGatewayTelemetry

EnvoyGatewayOpenTelemetrySink

Appears in:

• EnvoyGatewayMetricSink

EnvoyGatewayPrometheusProvider

EnvoyGatewayPrometheusProvider will expose prometheus endpoint in pull mode.

Appears in:

• EnvoyGatewayMetrics

EnvoyGatewayProvider

EnvoyGatewayProvider defines the desired configuration of a provider.

Appears in:

• EnvoyGateway
• EnvoyGatewaySpec

EnvoyGatewayResourceProvider

EnvoyGatewayResourceProvider defines configuration for the Custom Resource provider.

Appears in:

• EnvoyGatewayCustomProvider

EnvoyGatewaySpec

EnvoyGatewaySpec defines the desired state of Envoy Gateway.

Appears in:

• EnvoyGateway

EnvoyGatewayTelemetry

EnvoyGatewayTelemetry defines telemetry configurations for envoy gateway control plane. Control plane will focus on metrics observability telemetry and tracing telemetry later.

Appears in:

• EnvoyGateway
• EnvoyGatewaySpec

EnvoyJSONPatchConfig

EnvoyJSONPatchConfig defines the configuration for patching a Envoy xDS Resource using JSONPatch semantic

Appears in:

• EnvoyPatchPolicySpec

EnvoyPatchPolicy

EnvoyPatchPolicy allows the user to modify the generated Envoy xDS resources by Envoy Gateway using this patch API

EnvoyPatchPolicySpec

EnvoyPatchPolicySpec defines the desired state of EnvoyPatchPolicy.

Appears in:

• EnvoyPatchPolicy

EnvoyPatchType

Underlying type: string

EnvoyPatchType specifies the types of Envoy patching mechanisms.

Appears in:

• EnvoyPatchPolicySpec

EnvoyProxy

EnvoyProxy is the schema for the envoyproxies API.

EnvoyProxyKubernetesProvider

EnvoyProxyKubernetesProvider defines configuration for the Kubernetes resource provider.

Appears in:

• EnvoyProxyProvider

EnvoyProxyProvider

EnvoyProxyProvider defines the desired state of a resource provider.

Appears in:

• EnvoyProxySpec

EnvoyProxySpec

EnvoyProxySpec defines the desired state of EnvoyProxy.

Appears in:

• EnvoyProxy

EnvoyProxyStatus

EnvoyProxyStatus defines the observed state of EnvoyProxy. This type is not implemented until https://github.com/envoyproxy/gateway/issues/1007 is fixed.

Appears in:

• EnvoyProxy

EnvoyResourceType

Underlying type: string

EnvoyResourceType specifies the type URL of the Envoy resource.

Appears in:

• EnvoyJSONPatchConfig

ExtAuth

ExtAuth defines the configuration for External Authorization.

Appears in:

• SecurityPolicySpec

ExtProc

ExtProc defines the configuration for External Processing filter.

Appears in:

• EnvoyExtensionPolicySpec

ExtProcBodyProcessingMode

Underlying type: string

Appears in:

• ProcessingModeOptions

ExtProcProcessingMode

ExtProcProcessingMode defines if and how headers and bodies are sent to the service. https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_proc/v3/processing_mode.proto#envoy-v3-api-msg-extensions-filters-http-ext-proc-v3-processingmode

Appears in:

• ExtProc

ExtensionAPISettings

ExtensionAPISettings defines the settings specific to Gateway API Extensions.

Appears in:

• EnvoyGateway
• EnvoyGatewaySpec

ExtensionHooks

ExtensionHooks defines extension hooks across all supported runners

Appears in:

• ExtensionManager

ExtensionManager

ExtensionManager defines the configuration for registering an extension manager to the Envoy Gateway control plane.

Appears in:

• EnvoyGateway
• EnvoyGatewaySpec

ExtensionService

ExtensionService defines the configuration for connecting to a registered extension service.

Appears in:

• ExtensionManager

ExtensionTLS

ExtensionTLS defines the TLS configuration when connecting to an extension service

Appears in:

• ExtensionService

FQDNEndpoint

FQDNEndpoint describes TCP/UDP socket address, corresponding to Envoy’s Socket Address https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/address.proto#config-core-v3-socketaddress

Appears in:

• BackendEndpoint
• ExtensionService

FaultInjection

FaultInjection defines the fault injection policy to be applied. This configuration can be used to inject delays and abort requests to mimic failure scenarios such as service failures and overloads

Appears in:

• BackendTrafficPolicySpec

FaultInjectionAbort

FaultInjectionAbort defines the abort fault injection configuration

Appears in:

• FaultInjection

FaultInjectionDelay

FaultInjectionDelay defines the delay fault injection configuration

Appears in:

• FaultInjection

FileEnvoyProxyAccessLog

Appears in:

• ProxyAccessLogSink

FilterPosition

FilterPosition defines the position of an Envoy HTTP filter in the filter chain.

Appears in:

• EnvoyProxySpec

GRPCActiveHealthChecker

GRPCActiveHealthChecker defines the settings of the GRPC health check.

Appears in:

• ActiveHealthCheck

GRPCExtAuthService

GRPCExtAuthService defines the gRPC External Authorization service The authorization request message is defined in https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/auth/v3/external_auth.proto

Appears in:

• ExtAuth

Gateway

Gateway defines the desired Gateway API configuration of Envoy Gateway.

Appears in:

• EnvoyGateway
• EnvoyGatewaySpec

GlobalRateLimit

GlobalRateLimit defines global rate limit configuration.

Appears in:

• RateLimitSpec

GroupVersionKind

GroupVersionKind unambiguously identifies a Kind. It can be converted to k8s.io/apimachinery/pkg/runtime/schema.GroupVersionKind

Appears in:

• ExtensionManager

GzipCompressor

GzipCompressor defines the config for the Gzip compressor. The default values can be found here: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/compression/gzip/compressor/v3/gzip.proto#extension-envoy-compression-gzip-compressor

Appears in:

• Compression

HTTP10Settings

HTTP10Settings provides HTTP/1.0 configuration on the listener.

Appears in:

• HTTP1Settings

HTTP1Settings

HTTP1Settings provides HTTP/1 configuration on the listener.

Appears in:

• ClientTrafficPolicySpec

HTTP2Settings

HTTP2Settings provides HTTP/2 configuration for listeners and backends.

Appears in:

• BackendTrafficPolicySpec
• ClientTrafficPolicySpec
• ClusterSettings

HTTP3Settings

HTTP3Settings provides HTTP/3 configuration on the listener.

Appears in:

• ClientTrafficPolicySpec

HTTPActiveHealthChecker