Change shared extensions

Use built-in fields and overlays to customize the ext-auth, rate-limiter, and ext-cache deployments that the deployer automatically creates for your Gateways.

About shared extensions

When you create a Gateway, the deployer automatically provisions the following shared extension deployments in the same namespace:

ext-auth-service – Handles external authentication for protected routes.
rate-limiter – Enforces global rate limits on requests.
ext-cache – A Redis-backed store used by both ext-auth and rate-limiter.

You can customize these deployments by using built-in fields or overlays in the spec.kube.sharedExtensions section of the EnterpriseKgatewayParameters resource, and then attaching the resource to a GatewayClass.

Note

Extension settings are shared across all Gateways that use the same GatewayClass. Attach the EnterpriseKgatewayParameters resource to a GatewayClass, not to individual Gateways.

Before you begin

Follow the Get started guide to install Solo Enterprise for kgateway.
Follow the Sample app guide to create a gateway proxy with an HTTP listener and deploy the httpbin sample app.

Get the external address of the gateway and save it in an environment variable.

export INGRESS_GW_ADDRESS=$(kubectl get svc -n kgateway-system http -o jsonpath="{.status.loadBalancer.ingress[0]['hostname','ip']}")
echo $INGRESS_GW_ADDRESS

kubectl port-forward deployment/http -n kgateway-system 8080:8080

Customize shared extensions

Choose between the following options to customize your extensions:

Built-in customization

Overlays

Built-in customization

Use the built-in resources field to set CPU and memory requests and limits for an extension.

Create a EnterpriseKgatewayParameters resource with your resource settings in the sharedExtensions section. The following example updates the resource requests and limits for a shared extension.

kubectl apply -f- <<EOF
apiVersion: enterprisekgateway.solo.io/v1alpha1
kind: EnterpriseKgatewayParameters
metadata:
  name: ext-params
  namespace: kgateway-system
spec:
  kube:
    sharedExtensions:
      extauth:
        enabled: true
        resources:
          requests:
            cpu: 200m
            memory: 256Mi
          limits:
            cpu: 750m
            memory: 512Mi
      ratelimiter:
        enabled: true
        resources:
          requests:
            cpu: 200m
            memory: 256Mi
          limits:
            cpu: 750m
            memory: 512Mi
      extCache:
        enabled: true
        resources:
          requests:
            cpu: 256m
            memory: 512Mi
          limits:
            cpu: 1000m
            memory: 2048Mi
EOF

Update the GatewayClass to reference the new EnterpriseKgatewayParameters resource.

kubectl apply -f- <<EOF
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: enterprise-kgateway
spec:
  controllerName: solo.io/enterprise-kgateway
  parametersRef:
    group: enterprisekgateway.solo.io
    kind: EnterpriseKgatewayParameters
    name: ext-params
    namespace: kgateway-system
EOF

Verify that the resource changes are applied to the deployments.

Use labels to select the Deployments instead of exact Deployment names. The app labels are present across versions, while the rate-limiter and ext-cache Deployment names can include a selector-revision suffix after an upgrade.

echo "ext-auth-service"
kubectl get deployment -l app=ext-auth-service \
  -n kgateway-system \
  -o json | jq '.items[].spec.template.spec.containers[0].resources'

echo "ext-cache"
kubectl get deployment -l app=ext-cache \
  -n kgateway-system \
  -o json | jq '.items[].spec.template.spec.containers[0].resources'

echo "rate-limiter"
kubectl get deployment -l app=rate-limiter \
  -n kgateway-system \
  -o json | jq '.items[].spec.template.spec.containers[0].resources'

Example output:

ext-auth-service
{
 "limits": {
   "cpu": "750m",
   "memory": "512Mi"
 },
 "requests": {
   "cpu": "200m",
   "memory": "256Mi"
 }
}
ext-cache
{
 "limits": {
   "cpu": "1",
   "memory": "2Gi"
 },
 "requests": {
   "cpu": "256m",
   "memory": "512Mi"
 }
}
rate-limiter
{
 "limits": {
   "cpu": "750m",
   "memory": "512Mi"
 },
 "requests": {
   "cpu": "200m",
   "memory": "256Mi"
 }
}

Overlays

Use overlay fields to apply a strategic merge patch to the generated extension Kubernetes resources. For more examples, see the Overlay examples.

Create a EnterpriseKgatewayParameters resource with your overlay settings. In this example, you use the deploymentOverlay option to add custom labels and annotations to the ext-auth-service and rate-limiter deployments.

kubectl apply --server-side -f- <<'EOF'
apiVersion: enterprisekgateway.solo.io/v1alpha1
kind: EnterpriseKgatewayParameters
metadata:
  name: ext-params
  namespace: kgateway-system
spec:
  kube:
    sharedExtensions:
      extauth:
        enabled: true
        deploymentOverlay:
          metadata:
            labels:
              team: security
              environment: production
          spec:
            template:
              metadata:
                annotations:
                  app.kubernetes.io/part-of: "api-gateway"
                  support-channel: "slack://security-alerts"
      ratelimiter:
        enabled: true
        deploymentOverlay:
          metadata:
            labels:
              team: platform
EOF

Update the GatewayClass to reference the new EnterpriseKgatewayParameters resource.

kubectl apply -f- <<EOF
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: enterprise-kgateway
spec:
  controllerName: solo.io/enterprise-kgateway
  parametersRef:
    group: enterprisekgateway.solo.io
    kind: EnterpriseKgatewayParameters
    name: ext-params
    namespace: kgateway-system
EOF

Verify that the labels and annotations are applied to the ext-auth-service and rate-limiter Deployments.

kubectl get deployment -l app=ext-auth-service \
  -n kgateway-system \
  -o json | jq '.items[].metadata.labels'

kubectl get deployment -l app=ext-auth-service \
  -n kgateway-system \
  -o json | jq '.items[].spec.template.metadata.annotations'

kubectl get deployment -l app=rate-limiter \
  -n kgateway-system \
  -o json | jq '.items[].metadata.labels'

Example output:

{
  "app": "ext-auth-service",
  "environment": "production",
  "gateway.solo.io/extension": "solo-ext-auth",
  "gateway.solo.io/gatewayclass": "enterprise-kgateway",
  "team": "security"
}
{
  "app.kubernetes.io/part-of": "api-gateway",
  "prometheus.io/path": "/metrics",
  "prometheus.io/port": "9091",
  "prometheus.io/scrape": "true",
  "support-channel": "slack://security-alerts"
}
{
  "app": "rate-limiter",
  "gateway.solo.io/extension": "solo-rate-limiter",
  "gateway.solo.io/gatewayclass": "enterprise-kgateway",
  "team": "platform"
}

Cleanup

You can optionally remove the resources that you set up as part of this guide.

Remove the parametersRef from the GatewayClass to restore the default configuration.

kubectl apply -f- <<EOF
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: enterprise-kgateway
spec:
  controllerName: solo.io/enterprise-kgateway
EOF

Delete the EnterpriseKgatewayParameters resource.

kubectl delete EnterpriseKgatewayParameters ext-params -n kgateway-system

Overlay examples BYO Redis for extensions

Was this page helpful?