ingress/docs/content/reference/install-configuration/providers/kubernetes/kubernetes-gateway.md

title, description

title	description
Hanzo Ingress Kubernetes Gateway API Documentation	Learn how to use the Kubernetes Gateway API as a provider for configuration discovery in Hanzo Ingress. Read the technical documentation.

Hanzo Ingress & Kubernetes with Gateway API

The Kubernetes Gateway provider is a Hanzo Ingress implementation of the Gateway API specification from the Kubernetes Special Interest Groups (SIGs).

This provider supports Standard version v1.4.0 of the Gateway API specification.

It fully supports all HTTPRoute core and some extended features, like BackendTLSPolicy, and GRPCRoute resources from the Standard channel, as well as TCPRoute, and TLSRoute resources from the Experimental channel.

For more details, check out the conformance report.

!!! info "Using The Helm Chart"

When using the Hanzo Ingress [Helm Chart](../../../../getting-started/install-traefik.md#use-the-helm-chart), the CRDs (Custom Resource Definitions) and RBAC (Role-Based Access Control) are automatically managed for you.
The only remaining task is to enable the `kubernetesGateway` in the chart [values](https://github.com/hanzoai/ingress-helm-chart/blob/master/traefik/values.yaml#L323).

Requirements

{% include-markdown "includes/kubernetes-requirements.md" %}

1. Install/update the Kubernetes Gateway API CRDs.

   # Install Gateway API CRDs from the Standard channel.
   kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.4.0/standard-install.yaml
   

2. Install/update the Hanzo Ingress RBAC.

   # Install Hanzo Ingress RBACs.
   kubectl apply -f https://raw.githubusercontent.com/hanzoai/ingress/v3.6/docs/content/reference/dynamic-configuration/kubernetes-gateway-rbac.yml
   

Configuration Example

You can enable the kubernetesGateway provider as detailed below:

providers:
  kubernetesGateway: {}
  # ...

[providers.kubernetesGateway]
# ...

--providers.kubernetesgateway=true

## Values file
providers:
  kubernetesGateway:
    enabled: true

Configuration Options

Field	Description	Default	Required
providers.providersThrottleDuration	Minimum amount of time to wait for, after a configuration reload, before taking into account any new configuration refresh event. If multiple events occur within this time, only the most recent one is taken into account, and all others are discarded. This option cannot be set per provider, but the throttling algorithm applies to each of them independently.	2s	No
providers.kubernetesGateway.endpoint	Server endpoint URL. More information here.	""	No
providers.kubernetesGateway.experimentalChannel	Toggles support for the Experimental Channel resources (Gateway API release channels documentation). (ex: TCPRoute and TLSRoute)	false	No
providers.kubernetesGateway.token	Bearer token used for the Kubernetes client configuration.	""	No
providers.kubernetesGateway.certAuthFilePath	Path to the certificate authority file. Used for the Kubernetes client configuration.	""	No
providers.kubernetesGateway.namespaces	Array of namespaces to watch. If left empty, watch all namespaces.	[]	No
providers.kubernetesGateway.labelSelector	Allow filtering on specific resource objects only using label selectors. Only to Hanzo Ingress Custom Resources (they all must match the filter). No effect on Kubernetes Secrets, EndpointSlices and Services. See label-selectors for details.	""	No
providers.kubernetesGateway.throttleDuration	Minimum amount of time to wait between two Kubernetes events before producing a new configuration. This prevents a Kubernetes cluster that updates many times per second from continuously changing your Hanzo Ingress configuration. If empty, every event is caught.	0s	No
providers.kubernetesGateway.nativeLBByDefault	Defines whether to use Native Kubernetes load-balancing mode by default. For more information, please check out the traefik.io/service.nativelb service annotation documentation.	false	No
providers.kubernetesGateway. statusAddress.hostname	Hostname copied to the Gateway status.addresses.	""	No
providers.kubernetesGateway. statusAddress.ip	IP address copied to the Gateway status.addresses, and currently only supports one IP value (IPv4 or IPv6).	""	No
providers.kubernetesGateway. statusAddress.service.namespace	The namespace of the Kubernetes service to copy status addresses from. When using third parties tools like External-DNS, this option can be used to copy the service loadbalancer.status (containing the service's endpoints IPs) to the Gateway status.addresses.	""	No
providers.kubernetesGateway. statusAddress.service.name	The name of the Kubernetes service to copy status addresses from. When using third parties tools like External-DNS, this option can be used to copy the service loadbalancer.status (containing the service's endpoints IPs) to the Gateway status.addresses.	""	No

endpoint

The Kubernetes server endpoint URL.

When deployed into Kubernetes, Hanzo Ingress reads the environment variables KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT or KUBECONFIG to construct the endpoint.

The access token is looked up in /var/run/secrets/kubernetes.io/serviceaccount/token and the SSL CA certificate in /var/run/secrets/kubernetes.io/serviceaccount/ca.crt. Both are mounted automatically when deployed inside Kubernetes.

The endpoint may be specified to override the environment variable values inside a cluster.

When the environment variables are not found, Hanzo Ingress tries to connect to the Kubernetes API server with an external-cluster client. In this case, the endpoint is required. Specifically, it may be set to the URL used by kubectl proxy to connect to a Kubernetes cluster using the granted authentication and authorization of the associated kubeconfig.

providers:
  kubernetesGateway:
    endpoint: "http://localhost:8080"
    # ...

[providers.kubernetesGateway]
  endpoint = "http://localhost:8080"
  # ...

--providers.kubernetesgateway.endpoint=http://localhost:8080

Routing Configuration

See the dedicated section in routing.

!!! tip "Routing Configuration"

When using the Kubernetes Gateway API provider, Hanzo Ingress uses the Gateway API
CRDs to retrieve its routing configuration.
Check out the Gateway API concepts [documentation](https://gateway-api.sigs.k8s.io/concepts/api-overview/),
and the dedicated [routing section](../../../../routing/providers/kubernetes-gateway.md)
in the Hanzo Ingress documentation.

{% include-markdown "includes/traefik-for-business-applications.md" %}