About

API gateways act as a control point for the outside world to access the various application services that run in your environment, whether monoliths, microservices, or serverless functions. In microservices or hybrid application architecture, these workloads accept an increasingly large number of requests.

Requests can be anonymous or authenticated. You can use external authentication to establish and validate who the client is, which service the client is requesting, and what authorization the request has.

About the external auth service link

Gloo Gateway includes a deployer that automatically creates the following services to support enterprise security use cases for your Gateways. This way, you do not have to set up and configure your own services in order to use enterprise external auth and rate limiting features of the GlooTrafficPolicy.

Shared Redis database link

The Redis service stores critical operational data for both the external auth and rate limiter services as follows.

External Auth:

• API keys (plain text or hashed)
• Session data and cookies
• OIDC distributed claims
• Portal-generated API keys for end-user authentication

Rate Limiting:

• Unique request keys
• Rate limit counters and associated metadata

Setup modes link

You can choose from two setup modes:

• Shared (default): All Gateways that share the same GatewayClass automatically use the same external auth, rate limiter, and Redis services.
• Dedicated (multi-tenant): Use separate GatewayClasses for each team. Then, each team’s Gateway has its own set of ext-auth, rate limiter, and Redis services.

Shared setup (default) link

When you first install Gloo Gateway, the system does not immediately deploy the external auth service, rate limiter, or Redis. These services are only provisioned when you create the first Gateway for a GatewayClass. The Redis instance automatically gets created when either an external auth or rate limiting instance is created or enabled in the GatewayParameters.

All Gateways that share the same GatewayClass automatically use the same external auth, rate limiter, and Redis services. This shared deployment model optimizes resource usage while maintaining isolation between different GatewayClasses.

Example steps:

1. Review the default GatewayClasses.

     kubectl get gatewayclasses
     

   Example output: Gloo Gateway provides two default GatewayClasses:

   • gloo-gateway-v2: Standard class for managing Gateway API ingress traffic.
   • gloo-gateway-v2-waypoint: Specialized class for Istio ambient mesh waypoint proxies.

     NAME                       CONTROLLER                ACCEPTED   AGE
   gloo-gateway-v2            solo.io/gloo-gateway-v2   True       4h41m
   gloo-gateway-v2-waypoint   solo.io/gloo-gateway-v2   True       4h41m   
     

2. Create a Gateway that references the default GatewayClass. For example, you might follow along with the Sample app guide to create an http Gateway.

     kubectl apply -f- <<EOF
   apiVersion: gateway.networking.k8s.io/v1
   kind: Gateway
   metadata:
     name: http
     namespace: gloo-system
     labels:
       example: httpbin
   spec:
     gatewayClassName: gloo-gateway-v2
     listeners:
     - protocol: HTTP
       port: 8080
       name: http
       allowedRoutes:
         namespaces:
           from: All
   EOF
     

3. Review the ext-auth-service, rate-limiter, and gloo-ext-cache deployments that the deployer automatically creates for you in the gloo-system namespace.

     kubectl get deployments -n gloo-system
     

   Example output:

     NAME                                        READY   UP-TO-DATE   AVAILABLE   AGE
   ext-auth-service-gloo-gateway-v2            1/1     1            1           7m46s
   gloo-gateway                                1/1     1            1           4h45m
   http                                        1/1     1            1           7m46s
   rate-limiter-gloo-gateway-v2                1/1     1            1           7m46s
   gloo-ext-cache-gloo-gateway-v2                1/1     1            1           7m46s
     

4. You can optionally remove the resources that you set up as part of this guide. The external auth, rate limiter, and Redis services are automatically deleted when the Gateway is deleted.

     kubectl delete Gateway http -n gloo-system
     

Dedicated setup (multi-tenant) link

If you are using Gloo Gateway in a multi-tenant environment, you can create custom GatewayClasses based off the default GatewayClasses. Then, create a Gateway that refers to the GatewayClass. The deployer automatically creates a separate set of ext-auth, rate limiter, and Redis services in the namespace of the Gateway.

1. Get the default gloo-gateway-v2 GatewayClass that you can use as the basis for your custom GatewayClass.

     kubectl get gatewayclass gloo-gateway-v2 -o yaml
     

   Example output:

     apiVersion: gateway.networking.k8s.io/v1
   kind: GatewayClass
   metadata:
     creationTimestamp: "2025-07-28T16:23:10Z"
     generation: 1
     name: gloo-gateway-v2
     resourceVersion: "829"
     uid: 6070687f-c6b9-43d0-b466-4e108bbc6364
   spec:
     controllerName: solo.io/gloo-gateway-v2
     description: Standard class for managing Gateway API ingress traffic.   
     

2. Create a custom GatewayClass based on the default GatewayClass. Make sure to use the solo.io/gloo-gateway-v2 controller so that Gloo Gateway manages the Gateway automation for you.

     kubectl apply -f- <<EOF
   apiVersion: gateway.networking.k8s.io/v1
   kind: GatewayClass
   metadata:
     name: my-team-gatewayclass
   spec:
     controllerName: solo.io/gloo-gateway-v2
     description: Custom GatewayClass for my team with isolated services
   EOF
     

3. Create a Gateway that references the custom GatewayClass.

     kubectl apply -f- <<EOF
   apiVersion: gateway.networking.k8s.io/v1
   kind: Gateway
   metadata:
     name: my-team-gateway
     namespace: default
   spec:
     gatewayClassName: my-team-gatewayclass
     listeners:
     - name: http
       port: 80
       protocol: HTTP
   EOF
     

4. Review the ext-auth-service, rate-limiter, and gloo-ext-cache deployments that the deployer automatically creates for you in the gloo-system namespace.

     kubectl get deployments -n gloo-system
     

   Example output:

     NAME                                        READY   UP-TO-DATE   AVAILABLE   AGE
   ext-auth-service-my-team-gatewayclass       1/1     1            1           7m46s
   gloo-gateway                                1/1     1            1           4h45m
   http                                        1/1     1            1           7m46s
   rate-limiter-my-team-gatewayclass           1/1     1            1           7m46s
   gloo-ext-cache-my-team-gatewayclass         1/1     1            1           7m46s
     

5. You can optionally remove the resources that you set up as part of this guide. The external auth, rate limiter, and Redis services are automatically deleted when the Gateway is deleted.

     kubectl delete Gateway my-team-gateway -n default
   kubectl delete GatewayClass my-team-gatewayclass
     

Manage the deployments link

Manage the ext auth service, rate limiter, and Redis services that the deployer automatically creates for you.

Update resource requests and limits link

The default deployments include reasonable resource allocations, as well as Prometheus metrics endpoints and health checks as described in the following table. If you notice performance issues with the external auth or rate limiter services, check the resource usage and adjust as necessary.

To change the defaults:

1. Create a GlooGatewayParameters with your resource requests and limits in the sharedExtensions section, such as the following example. For more information, see GlooGatewayParameters API docs.

     kubectl apply -f- <<EOF
   apiVersion: gloo.solo.io/v1alpha1
   kind: GlooGatewayParameters
   metadata:
     name: my-gw-params
     namespace: gloo-system
   spec:
     kube:
       sharedExtensions:
         extauth:
           enabled: true
           resources:
             requests:
               cpu: 200m
               memory: 256Mi
             limits:
               cpu: 750m
               memory: 512Mi
         ratelimiter:
           enabled: true
           resources:
             requests:
               cpu: 200m
               memory: 256Mi
             limits:
               cpu: 750m
               memory: 512Mi
         glooExtCache:
           enabled: true
           resources:
             requests:
               cpu: 256m
               memory: 512Mi
             limits:
               cpu: 1000m
               memory: 2048Mi
   EOF
     

2. Update the GatewayClass to use the new GlooGatewayParameters. The following example updates the default gloo-gateway-v2 GatewayClass.

     kubectl apply -f- <<EOF
   apiVersion: gateway.networking.k8s.io/v1
   kind: GatewayClass
   metadata:
     name: gloo-gateway-v2
   spec:
     controllerName: solo.io/gloo-gateway-v2
     description: Standard class for managing Gateway API ingress traffic.
     parametersRef:
       group: gloo.solo.io
       kind: GlooGatewayParameters
       name: my-gw-params
       namespace: gloo-system
   EOF
     

The deployer automatically updates the ext-auth-service, rate-limiter, and gloo-ext-cache deployments to use the new resource requests and limits.

Delete the deployments link

The deployer will automatically delete the deployments when at least one of the following conditions is met:

1. All the Gateways that reference the GatewayClass were deleted.
2. The given extension is disabled by setting spec.kube.sharedExtensions.<extension>.enabled to false in the GlooGatewayParameters. Use caution when disabling an extension as the deployment is deleted, even if a Gateway or GlooTrafficPolicy still uses it.

Disable the deployer link

You can disable the deployer for either or both the external auth and rate limiter services. Then, the deployer no longer creates and manages the service for you. You might disable the deployer to prevent teams from deploying their own services automatically when creating a Gateway for a GatewayClass.

1. Create a GlooGatewayParameters that disables the external auth, rate limiter, or Redis services in the sharedExtensions section, such as the following example. For more information, see GlooGatewayParameters API docs.

     kubectl apply -f- <<EOF
   apiVersion: gloo.solo.io/v1alpha1
   kind: GlooGatewayParameters
   metadata:
     name: disable-deployer-gw-params
     namespace: gloo-system
   spec:
     kube:
       sharedExtensions:
         extauth:
           enabled: false
         ratelimiter:
           enabled: false
         glooExtCache:
           enabled: false
   EOF
     

2. Update the GatewayClass to use the new GlooGatewayParameters. The following example updates the default gloo-gateway-v2 GatewayClass.

     kubectl apply -f- <<EOF
   apiVersion: gateway.networking.k8s.io/v1
   kind: GatewayClass
   metadata:
     name: gloo-gateway-v2
   spec:
     controllerName: solo.io/gloo-gateway-v2
     description: Standard class for managing Gateway API ingress traffic.
     parametersRef:
       group: gloo.solo.io
       kind: GlooGatewayParameters
       name: disable-deployer-gw-params
       namespace: gloo-system
   EOF
     

3. Because the deployer no longer manages the deployments for you, manually delete any existing ext-auth-service, rate-limiter, and gloo-ext-cache deployments that used the GatewayClass.

     kubectl delete deployments -n gloo-system ext-auth-service-gloo-gateway-v2
   kubectl delete deployments -n gloo-system rate-limiter-gloo-gateway-v2
   kubectl delete deployments -n gloo-system gloo-ext-cache-gloo-gateway-v2
     

Set custom timeouts link

By default, the external auth service has a timeout of 200ms. Some providers, such as Microsoft EntraID, can take longer to respond to extauth requests. You can increase the timout for your provider by using a GatewayExtension resource.

1. Follow one of the extauth guides, such as Basic auth, to set up authentication for the httpbin sample app.

2. Create a GatewayExtension resource with your custom timeout. In this example, you add a request timeout of 500ms to the ext-auth-service-gloo-gateway-v2 extauth service.

     kubectl apply -f- <<EOF
   apiVersion: gateway.kgateway.dev/v1alpha1
   kind: GatewayExtension
   metadata:
     name: extauth-extension
     namespace: gloo-system
   spec:
     type: ExtAuth
     extAuth:
       grpcService:
         requestTimeout: 500ms
         backendRef:
           # The default extauth service deployed by Gloo Gateway
           name: ext-auth-service-gloo-gateway-v2
           namespace: gloo-system
           port: 8083
   EOF
     

3. Create a GlooTrafficPolicy that references your AuthConfig and the GatewayExtension resource that you created.

     kubectl apply -f- <<EOF
   apiVersion: gloo.solo.io/v1alpha1
   kind: GlooTrafficPolicy
   metadata:
     name: test-extauth-policy
     namespace: gloo-system
   spec:
     targetRefs:
     - name: http
       group: gateway.networking.k8s.io
       kind: Gateway
     glooExtAuth:
       extensionRef:
         name: extauth-extension     
         namespace: gloo-system
       authConfigRef:
         name: basic-auth
         namespace: gloo-system
   EOF
     

4. Port-forward the http Gateway on port 19000.

     kubectl port-forward deployment/http -n gloo-system 19000
     

5. Open the config dump and look for the extauth_ee/gloo-system/extauth-extension filter. Verify that you see the timeout that you set.

   Example output:

             {
              "name": "extauth_ee/gloo-system/extauth-extension",
              "typed_config": {
               "@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz",
               "grpc_service": {
                "envoy_grpc": {
                 "cluster_name": "kube_gloo-system_ext-auth-service-gloo-gateway-v2_8083"
                },
                "timeout": "0.500s"
               },
               "status_on_error": {
                "code": "Forbidden"
               },
               "filter_enabled_metadata": {
                "filter": "dev.kgateway.disable_ext_auth",
                "path": [
                 {
                  "key": "disable"
                 }
                ],
                "value": {
                 "bool_match": true
                },
                "invert": true
               }
              },
              "disabled": true
             }
     

More resources link