Installation

Gateway API Objects

GatewayClass

GatewayClass aggregates a group of Gateway objects, similar to how IngressClass aggregates a group of Ingress objects. GatewayClasses formalizes types of load balancing implementations, which can be different for different load-balancing vendors (Avi/Nginx/HAProxy, and so on).

AKO

identifies GatewayClasses that point to

ako.vmware.com/avi-lb

as the

.spec.controllerName

value in the GatewayClass object.

A sample GatewayClass object looks as shown below:

apiVersion: gateway.networking.k8s.io/v1beta1
kind: GatewayClass
metadata:
  name: avi-lb
spec:
  controllerName: "ako.vmware.com/avi-lb"

It is important that the

.spec.controllerName

value specified must match

ako.vmware.com/avi-lb

for

AKO

to honour the GatewayClass and corresponding Gateway API objects.

A GatewayClass named

avi-lb

will get installed as part of the helm install or upgrade when the user enables the Gateway API feature.

Gateway

The Gateway object represents an instance of a service-traffic handling infrastructure by binding Listeners to a set of IP addresses. The

AKO

validates the Gateway object and updates the status as

Accepted

. Then, the

AKO

translates the Gateway and its configuration as a Parent virtual service. The listeners in Gateway will be translated as listeners in the Parent virtual service, and secrets will be configured as Certificates in the

NSX Advanced Load Balancer Controller

and will be referenced in the same Parent virtual service.

AKO

updates the status of Gateway as

programmed

with the VIP of the Parent virtual service once the virtual service creation is completed.

The AKO created parent virtual service uses the name convention:

ako-gw-<cluster-name>--<namespace of the gateway>-<name of the gateway>-EVH

.

A sample Gateway object is shown below:

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: my-gateway
spec:
  gatewayClassName: avi-lb
  listeners:
  - name: foo-http
    protocol: HTTP
    port: 80
    hostname: "*.example.com"
  - name: bar-https
    protocol: HTTPS
    port: 443
    hostname: "*.example.com"
    tls:
      certificateRefs:
      - kind: Secret
        group: ""
        name: bar-example-com-cert

The above Gateway object would correspond to a single Layer 7 virtual service in the

NSX Advanced Load Balancer Controller

, with two ports (80, 443) exposed and a

sslKeyAndCertificate

created based on the secret

bar-example-com-cert

.

The hostname field

.spec.listeners[i].hostname

is mandatory. It can be configured with or without a wildcard, but cannot be only

*

.

Starting with version 1.11.1,

AKO

supports HTTP and HTTPS as protocol and Secret kind for certificateRefs.

Users can also configure a user-preferred static IPv4 address in the Gateway Object using the

.spec.addresses

field, as shown below. This would configure the Layer 7 virtual service with a static IP, as mentioned in the Gateway Object.

spec:
  addresses:
  - type: IPAddress
    value: 10.1.1.10

Starting with

AKO

version 1.11.1, a single address of type IPAddress is supported. The Gateway must be re-created to update the address.

HTTPRoute

The HTTPRoute object provides a way to route HTTP requests. The AKO models a child virtual service based on this object. Starting with version 1.11.1,

AKO

supports match requests based on the hostname, path, and header specified. The filters to specify additional processing of the requests will be added as policy in the child virtual service by the

AKO

. The filters of type

RequestHeaderModifier

,

RequestRedirect

, and

ResponseHeaderModifier

are supported.

A sample HTTPRoute object is as shown below:

apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: my-http-app
spec:
  parentRefs:
  - name: my-gateway
  hostnames:
  - "foo.example.com"
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /bar
    backendRefs:
    - name: my-service1
      port: 8080
  - filters:
    - type: RequestHeaderModifier
      requestHeaderModifier:
        add:
          - name: my-header
            value: foo
    matches:
    - headers:
      - type: Exact
        name: magic
        value: foo
      path:
        type: PathPrefix
        value: /foo
    backendRefs:
    - name: my-service2
      port: 8080
      weight: 1
    - name: my-service3
      port: 8081
      weight: 2

The above HTTPRoute object gets translated to two child virtual service in the

NSX Advanced Load Balancer Controller

. One child virtual service with match criteria as the path begins with

/bar

and a single Pool Group with a single pool and another child virtual service with match criteria as path begins with

/foo

, a single Pool Group with two pools, and an HTTP Request policy to add

my-header

to the HTTP request forwarded to the back-ends.

Hostnames are mandatory and cannot contain wildcard.

Starting with version 1.11.1,

AKO

does not support filters within backendRefs.

Gateway must be created before an HTTPRoute is created. If Gateways are created after creating HTTPRoute, then the HTTPRoute needs to be updated to trigger the informer.

HTTP Traffic Splitting

Status of Gateway API objects

status:
  addresses:
  - type: IPAddress
    value: 10.1.1.12
  conditions:
  - lastTransitionTime: "2023-08-31T15:04:14Z"
    message: Gateway configuration is valid
    observedGeneration: 1
    reason: Accepted
    status: "True"
    type: Accepted
  - lastTransitionTime: "2023-08-31T15:04:16Z"
    message: Virtual service configured/updated
    observedGeneration: 1
    reason: Programmed
    status: "True"
    type: Programmed
  listeners:
  - attachedRoutes: 1
    conditions:
    - lastTransitionTime: "2023-08-31T15:07:35Z"
      message: Listener is valid
      observedGeneration: 1
      reason: Accepted
      status: "True"
      type: Accepted
    name: http
    supportedKinds:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute

status:
  parents:
  - conditions:
    - lastTransitionTime: "2023-09-06T11:49:06Z"
      message: Parent reference is valid
      observedGeneration: 1
      reason: Accepted
      status: "True"
      type: Accepted
    controllerName: ako.vmware.com/avi-lb
    parentRef:
      group: gateway.networking.k8s.io
      kind: Gateway
      name: my-gateway
      namespace: default
      sectionName: http

Conditions and Caveats

Gateway Limitations
AKO
accepts the following Gateway configuration:
Gateway must contain at least one listener configuration in it.
Gateway must not contain protocols other than HTTP or HTTPS.
Gateway must contain a hostname. Hostname as
*
is not supported, and
*.domain
is supported.
Gateway must not contain TLS modes other than
Terminate
.
HTTPRoute Limitations
AKO
accepts the following HTTPRoute configuration:
HTTPRoute must contain at least one parent reference.
HTTPRoute must not contain
*
as hostname.
HTTPRoute must contain at least one hostname match with parent Gateway.
Resource Creation
For the Tech preview,
AKO
imposes a restriction on the order of GatewayAPI object creation. An object that is referenced must be created first. For example, GatewayClass must be created before Gateway and Gateway before HTTPRoute creation. This restriction is only applicable to the Gateway API objects.
High Availability Support
For the Tech Preview, High Availability is not supported.
Configuring Static IP address
The
AKO
supports Gateway objects with a single IPv4 address. The user can configure their preferred static IPv4 address by specifying
spec.addresses
in the Gateway object.
A sample configuration is as shown below:
spec:
  addresses:
  - type: IPAddress
    value: 10.1.1.10
Currently, the address of type IPAddress is only supported. The length of the addresses is also limited to a single address.