Gateway API Application Stack on Kubernetes
Tags:
#Kubernetes#GatewayAPI#CloudNative#ProductionReady#ScalableArchitecture#K8sSecurity
Created by:
Mahmood
4 uses
The Kubernetes Ingress API handles basic HTTP routing but requires vendor-specific annotations for advanced features and mixes infrastructure and routing concerns into a single object. This template deploys a full application stack using the Kubernetes Gateway API, including a GatewayClass, a Gateway for HTTPS traffic, an HTTPRoute for L7 routing, automated TLS via cert-manager, and a ConfigMap-backed application service.
| Component | Type | Port | Role |
|---|---|---|---|
| GatewayClass | GatewayClass | - | Defines the infrastructure provider and gateway configuration standards |
| Gateway (prod-gateway) | Gateway | 443 | External HTTPS traffic entry point |
| HTTPRoute (main-app-route) | HTTPRoute | - | L7 routing rules directing traffic to backend services |
| ClusterIssuer | ClusterIssuer | - | Automated Let's Encrypt TLS certificate provisioning |
| TLS Secret | Secret | - | SSL/TLS certificate storage |
| App Secrets | Secret | - | Sensitive application configuration |
| ConfigMap (app-config) | ConfigMap | - | Non-sensitive environment variables |
| Service | Service | - | Stable DNS routing to application pods |
The GatewayClass defines the infrastructure provider and is cluster-scoped. The prod-gateway Gateway listens on port 443 and terminates TLS using a certificate provisioned by cert-manager via Let's Encrypt. HTTPRoutes attach to the Gateway and define L7 routing rules that direct traffic to the backend Service. Application configuration is split between a ConfigMap for non-sensitive values and a Kubernetes Secret for credentials.
Kubernetes Ingress was designed for simple HTTP routing and depends on vendor-specific annotations for anything beyond basic path and host matching. Over time, annotation sprawl makes Ingress configurations fragile and tightly coupled to a specific controller. Gateway API solves this by replacing annotations with structured Kubernetes objects and separating responsibilities across three layers: the GatewayClass is owned by the infrastructure provider or cluster admin, the Gateway is managed by the platform team, and HTTPRoutes are configured by application developers. This means each team manages only the objects within their scope, without touching shared infrastructure.
kubectl get gateway -n <namespace>.kubectl describe certificate -n <namespace>.curl -I https://<your-domain>.kubectl describe httproute -n <namespace>.This template configures a Kubernetes Gateway API application stack with HTTPS termination, automated TLS, and L7 routing separated across GatewayClass, Gateway, and HTTPRoute objects. For a full walkthrough, read Migrating from Ingress to Gateway API: The Modern Way to Expose Kubernetes Services