Gateway API：Kubernetes 流量管理的未来标准

apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: envoy
spec:
  controllerName: gateway.envoyproxy.io/gatewayclass-controller

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: main-gateway
  namespace: infra-gw
spec:
  gatewayClassName: envoy
  listeners:
  - name: https
    protocol: HTTPS
    port: 443
    tls:
      mode: Terminate
      certificateRefs:
      - name: wildcard-cert
        namespace: cert-store
    allowedRoutes:
      namespaces:
        from: Selector
        selector:
          matchLabels:
            gateway-access: "true"

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: shop-route
  namespace: app-team-a
spec:
  parentRefs:
  - name: main-gateway
    namespace: infra-gw
    sectionName: https
  hostnames:
  - "shop.example.com"
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /api
    backendRefs:
    - name: shop-api
      port: 8080

apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: istio
spec:
  controllerName: istio.io/gateway-controller
  parametersRef:
    group: config.istio.io
    kind: IstioOperator
    name: default

rules:
- matches:
  - path:
      type: PathPrefix
      value: /v2
    headers:
    - name: x-canary
      value: "true"
  backendRefs:
  - name: api-v2
    port: 8080
- matches:
  - path:
      type: PathPrefix
      value: /v2
  backendRefs:
  - name: api-v1
    port: 8080
    weight: 90
  - name: api-v2
    port: 8080
    weight: 10

apiVersion: gateway.networking.k8s.io/v1
kind: GRPCRoute
metadata:
  name: grpc-route
  namespace: app
spec:
  parentRefs:
  - name: main-gateway
    namespace: infra-gw
  rules:
  - matches:
    - method:
        service: com.example.UserService
        method: GetUser
    backendRefs:
    - name: user-service
      port: 9090

apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TLSRoute
metadata:
  name: tls-passthrough
spec:
  parentRefs:
  - name: main-gateway
    sectionName: tls-passthrough
  hostnames:
  - "secure.example.com"
  rules:
  - backendRefs:
    - name: secure-backend
      port: 8443
---
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
metadata:
  name: mysql-route
spec:
  parentRefs:
  - name: main-gateway
    sectionName: mysql
  rules:
  - backendRefs:
    - name: mysql-primary
      port: 3306

apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: allow-app-team-a
  namespace: backend-shared
spec:
  from:
  - group: gateway.networking.k8s.io
    kind: HTTPRoute
    namespace: app-team-a
  to:
  - group: ""
    kind: Service

rules:
- filters:
  - type: RequestHeaderModifier
    requestHeaderModifier:
      add:
      - name: x-request-id
        value: "generated-by-gateway"
  - type: URLRewrite
    urlRewrite:
      path:
        type: ReplacePrefixMatch
        replacePrefixMatch: /v2

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: BackendTrafficPolicy
metadata:
  name: timeout-policy
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: shop-route
  timeout:
    http:
      connectionIdleTimeout: 60s
      requestTimeout: 15s
  retry:
    numRetries: 3
    retryOn:
    - gateway-error
    - connection-failure

rules:
- backendRefs:
  - name: app-stable
    port: 8080
    weight: 95
  - name: app-canary
    port: 8080
    weight: 5

rules:
- matches:
  - headers:
    - name: x-env
      value: staging
  backendRefs:
  - name: app-staging
    port: 8080
- matches:
  - path:
      type: PathPrefix
      value: /
  backendRefs:
  - name: app-production
    port: 8080

rules:
- matches:
  - path:
      type: PathPrefix
      value: /api/v1
  filters:
  - type: URLRewrite
    urlRewrite:
      path:
        type: ReplacePrefixMatch
        replacePrefixMatch: /v1
  backendRefs:
  - name: api-server
    port: 8080

filters:
- type: RequestMirror
  requestMirror:
    backendRef:
      name: app-shadow
      port: 8080

filters:
- type: RequestHeaderModifier
  requestHeaderModifier:
    set:
    - name: x-forwarded-proto
      value: https
    remove:
    - x-internal-token

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: BackendTrafficPolicy
metadata:
  name: resilience
  namespace: app
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: shop-route
  timeout:
    http:
      requestTimeout: 10s
  retry:
    numRetries: 3
    perRetry:
      timeout: 3s
    retryOn:
    - "5xx"
    - connect-failure
  circuitBreaker:
    maxConnections: 1024
    maxPendingRequests: 128

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: reviews-canary
  namespace: bookinfo
spec:
  parentRefs:
  - group: ""
    kind: Service
    name: reviews
  rules:
  - backendRefs:
    - name: reviews-v1
      port: 9080
      weight: 90
    - name: reviews-v2
      port: 9080
      weight: 10

kubectl get ingress -A -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}: {.metadata.annotations}{"\n"}{end}'

# Ingress
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: simple
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  ingressClassName: nginx
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /old-api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80

# 等效 HTTPRoute
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: simple
spec:
  parentRefs:
  - name: main-gateway
    namespace: infra-gw
  hostnames:
  - "app.example.com"
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /old-api
    filters:
    - type: URLRewrite
      urlRewrite:
        path:
          type: ReplacePrefixMatch
          replacePrefixMatch: /
    backendRefs:
    - name: api-service
      port: 80

go install github.com/kubernetes-sigs/ingress2gateway@latest
ingress2gateway print --all-resources
ingress2gateway print --providers=ingress-nginx

cat <<EOF | kind create cluster --config=-
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
- role: control-plane
- role: worker
- role: worker
EOF

kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.0/standard-install.yaml

helm install eg oci://docker.io/envoyproxy/gateway-helm \
  --version v1.2.0 -n envoy-gateway-system --create-namespace

kubectl wait --timeout=5m -n envoy-gateway-system \
  deployment/envoy-gateway --for=condition=Available

apiVersion: apps/v1
kind: Deployment
metadata:
  name: app-stable
  namespace: demo
spec:
  replicas: 2
  selector:
    matchLabels: {app: demo, version: stable}
  template:
    metadata:
      labels: {app: demo, version: stable}
    spec:
      containers:
      - name: app
        image: hashicorp/http-echo:0.2.3
        args: ["-text=stable-v1"]
        ports: [{containerPort: 5678}]
---
apiVersion: v1
kind: Service
metadata:
  name: app-stable
  namespace: demo
spec:
  selector: {app: demo, version: stable}
  ports: [{port: 8080, targetPort: 5678}]
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: app-canary
  namespace: demo
spec:
  replicas: 1
  selector:
    matchLabels: {app: demo, version: canary}
  template:
    metadata:
      labels: {app: demo, version: canary}
    spec:
      containers:
      - name: app
        image: hashicorp/http-echo:0.2.3
        args: ["-text=canary-v2"]
        ports: [{containerPort: 5678}]
---
apiVersion: v1
kind: Service
metadata:
  name: app-canary
  namespace: demo
spec:
  selector: {app: demo, version: canary}
  ports: [{port: 8080, targetPort: 5678}]

kubectl create namespace demo && kubectl apply -f app.yaml

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: demo-gateway
  namespace: demo
spec:
  gatewayClassName: eg
  listeners:
  - name: http
    protocol: HTTP
    port: 80
    allowedRoutes:
      namespaces:
        from: Same

kubectl apply -f gateway.yaml

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: demo-route
  namespace: demo
spec:
  parentRefs:
  - name: demo-gateway
  hostnames:
  - "demo.example.com"
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
      headers:
      - name: x-canary
        value: "true"
    backendRefs:
    - name: app-canary
      port: 8080
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: app-stable
      port: 8080
      weight: 90
    - name: app-canary
      port: 8080
      weight: 10

kubectl apply -f route-canary.yaml

GW_IP=$(kubectl get gateway -n demo demo-gateway \
  -o jsonpath='{.status.addresses[0].value}')

# 普通请求：按 90/10 权重路由
for i in $(seq 1 100); do
  curl -s -H "Host: demo.example.com" http://${GW_IP}/
done | sort | uniq -c | sort -rn

# 带 canary header：100% 走 canary
curl -s -H "Host: demo.example.com" -H "x-canary: true" http://${GW_IP}/

kubectl delete namespace demo
kind delete cluster