VirtualGateway

Proto: virtual_gateway.proto

Package: networking.gloo.solo.io

A VirtualGateway custom resource represents a logical gateway configuration for one or more Istio ingress, egress, or east-west gateway workloads within the same workspace. The specification describes a set of ports that the VirtualGateway listens for incoming or outgoing HTTP/TCP connections, the type of protocol to use, SNI configuration, and more.

For more information, see the gateway listener overview in the Gloo Mesh Gateway docs.

Examples link

HTTP: This resource configures the gateway to listen for incoming HTTP requests on port 80, and delegate traffic requests for the *.bookinfo.com hostname. The VirtualGateway is applied to a specific set of gateway pods with the istio:ingressgateway label within the same workspace as the VirtualGateway resource.

  apiVersion: networking.gloo.solo.io/v2
kind: VirtualGateway
metadata:
  name: istio-ingressgateway
  namespace: bookinfo
spec:
  listeners:
    - http: {}
      port:
        number: 80
      allowedRouteTables:
        - host: '*.bookinfo.com'
  workloads:
    - selector:
        labels:
          istio: ingressgateway
  

HTTP with multiple hosts: This resource configures the gateway to listen for incoming HTTP requests on port 80, and delegate any *.foo.com requests to the RouteTable resource(s) provided by the foo-ws workspace. Further, on the same port 80, it also delegates any *.bar.com requests to the RouteTable resource(s) provided by the bar-ws workspace.

  apiVersion: networking.gloo.solo.io/v2
kind: VirtualGateway
metadata:
  name: my-gateway
  namespace: some-config-namespace
spec:
  listeners:
    - http: {}
      port:
        number: 80
      allowedRouteTables:
        - host: '*.foo.com'
          selector:
            workspace: foo-ws
        - host: '*.bar.com'
          selector:
            workspace: bar-ws
  workloads:
    - selector:
        labels:
          app: my-gateway-controller
  

Simple HTTPS/TLS: This resource configures the gateway to act as a load balancer listening on port 80 and 9080 (http), 443 (https), and 9443 (https) for ingress traffic. The VirtualGateway is applied to a specific set of gateway pods with the istio:ingressgateway label within the same workspace as the VirtualGateway resource. The RouteTable(s) associated with each port 80, 9443, and 443 must be provided by the foo-ws workspace, with hosts that match *.foo.com. The RouteTable(s) for port 9080 must be provided by the bar-ws workspace with hosts that match *.bar.com.

  apiVersion: networking.gloo.solo.io/v2
kind: VirtualGateway
metadata:
  name: istio-ingressgateway
  namespace: some-config-namespace
spec:
  listeners:
    - http: {}
      port:
        number: 80
      httpsRedirect: true
      allowedRouteTables:
        - host: '*.foo.com'
          selector:
            workspace: foo-ws
    - http: {}
      port:
        number: 443
      tls:
        mode: SIMPLE
        files:
          privateKey: /etc/certs/privatekey.pem
          serverCert: /etc/certs/servercert.pem
      allowedRouteTables:
        - host: '*.foo.com'
          selector:
            workspace: foo-ws
    - http: {}
      port:
        number: 9443
      tls:
        mode: SIMPLE
        secretName: my-secret
      allowedRouteTables:
        - host: '*.foo.com'
          selector:
            workspace: foo-ws
    - http: {}
      port:
        number: 9080
      allowedRouteTables:
        - host: '*.bar.com'
          selector:
            workspace: foo-ws
  workloads:
    - selector:
        labels:
          istio: ingressgateway
  

ListenerRouteTable link

A list of listener/RouteTable combinations showing which RouteTables are attached to which listeners.

TLSConfig link

Configure TLS settings for a virtual host or listener.

Configuration constraints:

• This field is required if `appProtocol` is `HTTPS` or `TLS`.
• This field is optional if `appProtocol` is unset.
• This field must be empty otherwise.

TLSConfig.Files link

Paths to certificates that can be read by the gateway proxy from its local filesystem.

Implementation notes: These files must be present on the filesystem.

TLSConfig.Parameters link

General TLS parameters. For more information about these values, see the Envoy docs.

VirtualGatewayReport link

The resources that the VirtualGateway selects after it is successfully applied.

VirtualGatewayReport.WorkspacesEntry link

VirtualGatewaySpec link

Specifications for the VirtualGateway resource.

VirtualGatewaySpec.Listener link

VirtualGatewaySpec.Listener.ExternalServiceFilter link

Filter ExternalServices that can attach to this VirtualGateway by hostname.

VirtualGatewaySpec.Listener.HTTPServer link

Serve HTTP routes for RouteTables that select this gateway.

VirtualGatewaySpec.Listener.RouteTableFilter link

Optional: Filter RouteTables that can bind to this listener by the hostnames and object metadata. Wildcard matching for hostnames is supported. If omitted, any RouteTable can bind to this VirtualGateway.

VirtualGatewaySpec.Listener.TCPServer link

Serve TCP routes for RouteTables that select this gateway. Make sure to open a TCP port on the backing Istio ingress gateway, which might require upgrading your IstioLifecycleManager or Helm installation.

VirtualGatewayStatus link

The status of the resource after it is applied to your Gloo environment.

TLSConfig.Parameters.ProtocolVersion link

TLSConfig.TLSMode link

TLS modes enforced by the gateway proxy.