Skip to main content
Calico Open Source 3.33 (latest) documentation

Create an ingress gateway

Create an ingress gateway to manage ingress traffic with the Kubernetes Gateway API.

Creating an ingress gateway with Calico Ingress Gateway​

Calico Ingress Gateway is based on Envoy Gateway, an open-source implementation of the Gateway API. Calico provides a simple, convenient way to deploy and manage this implementation.

Creating an ingress gateway with Calico Ingress Gateway involves only a few steps. You need to do the following:

  • Enable Calico Ingress Gateway by creating a GatewayAPI resource.
  • Create a Gateway resource that references tigera-gateway-class, the name of the GatewayClass resource created by the Tigera Operator.
  • When you create your gateway routing resources, you refer to this Gateway resource.

Limitations​

  • Calico Ingress Gateway is not supported on Windows nodes.

Prerequisites​

  • You have an understanding of the Kubernetes Gateway API and know how you want to configure it for your system.
  • Calico was installed on your cluster using the Tigera Operator.
  • Your cluster is provisioned to support services of type LoadBalancer.

Create an ingress gateway​

  1. To enable Gateway API support, create a GatewayAPI resource with the name default:

    kubectl apply -f - <<EOF
    apiVersion: operator.tigera.io/v1
    kind: GatewayAPI
    metadata:
      name: default
    EOF

    The Tigera Operator pulls and sets up the hardened Envoy Gateway images. This gives you a set of Gateway API resources, including the GatewayClass resource you need to create your gateway.

    To verify, you can check to see if the GatewayClass resource is available:

    kubectl get gatewayclass
    Expected output
    NAME                   CONTROLLER                                      ACCEPTED   AGE
    tigera-gateway-class   gateway.envoyproxy.io/gatewayclass-controller   True       4m
    tip

    tigera-gateway-class is the name of the single default GatewayClass resource that is created when you enable Gateway API support. You can define additional gateway classes, along with other customizations, in the GatewayAPI resource.

  2. Create a Gateway resource that is linked to tigera-gateway-class, in the namespace where you want its proxy to run.

    Example snippet of a Gateway resource with default gatewayClassName
    apiVersion: gateway.networking.k8s.io/v1
    kind: Gateway
    metadata:
      name: <gateway-name>
      namespace: <gateway-namespace>
    spec:
      gatewayClassName: tigera-gateway-class
      ...

    Replace <gateway-name> with a name for your gateway, and <gateway-namespace> with the namespace where you want the gateway to run. You will refer to this gateway name for all services you want to use the gateway.

    The proxy, its Service, and its load balancer are created in the same namespace as this Gateway. To check that the proxy is running, list the pods in that namespace:

    kubectl get pods -n <gateway-namespace>

  3. If your cluster enforces a global default deny policy, apply a network policy in the Gateway namespace that lets the proxy pods reach the gateway controller and DNS. Without it, the proxy cannot start.

    apiVersion: projectcalico.org/v3
    kind: NetworkPolicy
    metadata:
      name: allow-tigera-gateway-proxy
      namespace: <gateway-namespace>
    spec:
      selector: 'app.kubernetes.io/name == "envoy"'
      types: [Ingress, Egress]
      ingress:
        - action: Allow
      egress:
        - action: Allow # DNS
          protocol: UDP
          destination:
            namespaceSelector: 'projectcalico.org/name == "kube-system"'
            selector: 'k8s-app == "kube-dns"'
            ports: [53]
        - action: Allow # configuration from the gateway controller
          protocol: TCP
          destination:
            namespaceSelector: 'projectcalico.org/name == "calico-system"'
            selector: 'app.kubernetes.io/name == "gateway-helm"'
            ports: [18000]

    Replace <gateway-namespace> with the namespace where you created the Gateway. Add egress rules for your own backends as needed.

  4. Create a gateway routing resource that refers to your Gateway resource as .spec.parentRefs:

    Example snippet of an HTTPRoute resource
    apiVersion: gateway.networking.k8s.io/v1
    kind: HTTPRoute
    metadata:
      name: example-httproute
    spec:
      parentRefs:
        - name: <gateway-name>
      ...

    Replace <gateway-name> with the name of your Gateway resource.

Additional resources​