Gateway API Overview

Gateway API is the Kubernetes API for routing and load balancing. It provides a unified, extensible model for configuring north-south (external-to-internal) and east-west (service-to-service) traffic routing, load balancing, and traffic governance. Gateway API supersedes the Ingress API as the foundational configuration layer for cloud-native gateways.

Compared with traditional ingresses, Gateway API offers multi-tenant isolation, fine-grained routing, multi-protocol support, enhanced extensibility, and clearer separation of concerns. It represents the mainstream evolution direction for traffic gateways in cloud-native scenarios.

Install Envoy Gateway in CCE clusters to deploy an Envoy-backed Gateway API implementation.

Core Concepts

GatewayClass (infrastructure layer): defines the controller implementation for a gateway, analogous to IngressClass.
Gateway (cluster running layer): defines a deployed gateway instance, including listener configuration (such as port 80 or 443), protocols, and certificates.
HTTPRoute (service application layer): defines traffic routing rules, including path matching, header filters, weight-based traffic splitting, and query parameter matching, and binds them to backend Services.

How It Works

The following describes the Envoy Gateway operational flow:

Upon installation, Envoy Gateway automatically creates a GatewayClass resource in your cluster.
Create Gateway API resources such as Gateway and HTTPRoute.
1. Create a Gateway referencing the GatewayClass, and define its behavior, for example, configuring a listener on port 80 to handle HTTP traffic.
2. Create HTTPRoute resources and bind them to a specific Gateway, defining how external requests are routed to backend Services.
The Envoy Gateway controller continuously watches Gateway API resources. On any change, it performs the following:
1. Deploys Envoy Proxy instances and creates a LoadBalancer Service to expose them as the traffic entry point based on Gateway specifications.
2. Converts Gateway and HTTPRoute resources into Envoy-specific configuration and pushes it dynamically to the proxy instances.
External traffic enters through the LoadBalancer, is processed by the Envoy Proxy according to the active routing rules, and is forwarded to the appropriate backend Services.