Allow cross-namespace route with ReferenceGrant

Permit HTTPRoute in edge ns to target Services in backend ns

kubectl apply -f - <<'EOF' apiVersion: gateway.networking.k8s.io/v1beta1 kind: ReferenceGrant metadata: {name: allow-routes, namespace: backend} spec: from: [{group: gateway.networking.k8s.io, kind: HTTPRoute, namespace: edge}] to: [{group: "", kind: Service}] EOF
tool
gateway-api5 commands
tags
gateway-apinetworksecurityk8s

More gateway-api commands

  • TLS Gateway listener with cert ref
    kubectl apply -f - <<'EOF' apiVersion: gateway.networking.k8s.io/v1 kind: Gateway metadata: {name: gw, namespace: <ns>} spec: gatewayClassName: <name> listeners: - name: https protocol: HTTPS port: 443 tls: mode: Terminate certificateRefs: [{name: tls-cert}] EOF

    Terminate TLS at the gateway via certificateRefs to a Secret

  • Check HTTPRoute Accepted condition
    kubectl describe httproute <name> -n <ns> | grep -A8 Conditions

    Inspect Accepted/ResolvedRefs status to debug why a route is not attached

  • Inventory Gateway API resources
    kubectl get gatewayclass,gateway,httproute -A

    One-shot view of classes, gateways and routes across all namespaces

  • Weighted canary HTTPRoute
    kubectl apply -f - <<'EOF' apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: {name: web, namespace: <ns>} spec: parentRefs: [{name: gw}] rules: - backendRefs: - {name: web-stable, port: 80, weight: 90} - {name: web-canary, port: 80, weight: 10} EOF

    Split traffic 90/10 across stable and canary backends by weight

all 5 gateway-api commands