TLS Gateway listener with cert ref

Terminate TLS at the gateway via certificateRefs to a Secret

kubectl apply -f - <<'EOF'
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata: {name: gw, namespace: <ns>}
spec:
  gatewayClassName: <name>
  listeners:
    - name: https
      protocol: HTTPS
      port: 443
      tls:
        mode: Terminate
        certificateRefs: [{name: tls-cert}]
EOF

tool: gateway-api5 commands
tags: gateway-api tls security network

More gateway-api commands

Check HTTPRoute Accepted condition

kubectl describe httproute <name> -n <ns> | grep -A8 Conditions

Inspect Accepted/ResolvedRefs status to debug why a route is not attached
Inventory Gateway API resources

kubectl get gatewayclass,gateway,httproute -A

One-shot view of classes, gateways and routes across all namespaces
Weighted canary HTTPRoute

kubectl apply -f - <<'EOF' apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: {name: web, namespace: <ns>} spec: parentRefs: [{name: gw}] rules: - backendRefs: - {name: web-stable, port: 80, weight: 90} - {name: web-canary, port: 80, weight: 10} EOF

Split traffic 90/10 across stable and canary backends by weight
Allow cross-namespace route with ReferenceGrant

kubectl apply -f - <<'EOF' apiVersion: gateway.networking.k8s.io/v1beta1 kind: ReferenceGrant metadata: {name: allow-routes, namespace: backend} spec: from: [{group: gateway.networking.k8s.io, kind: HTTPRoute, namespace: edge}] to: [{group: "", kind: Service}] EOF

Permit HTTPRoute in edge ns to target Services in backend ns

all 5 gateway-api commands