Kubernetes

This tutorial is part of the Cloud Expert Series.

Back to Cloud Expert

Category: Advanced

Difficulty: 3 out of 5

Duration: 60 minutes

1. Overview 2. Creating a Cluster 3. Administering a Cluster 4. Scaling 5. Creating a Web Service 6. Installing Envoy Gateway

Find a mistake? Let us know the issue here.

Building Australia's Research Data Structure

Installing Envoy Gateway

In this section, we will install a Gateway API implementation based on Envoy Gateway. Envoy Gateway is an extension that introduces custom API resources to support advanced traffic management within a Kubernetes environment. Specifically, it enables features such as traffic splitting, rate limiting, and observability.

In this tutorial, we are creating a webserver deployment and use the Envoy Gateway API to direct traffic based on URL path.

Create a Web service deployment

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: httpd-html
data:
  index.html: |
    <html>
      <head><title>Welcome to HTTPD</title></head>
      <body><h1>Hello from HTTPD!</h1></body>
    </html>
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: httpd-backend
spec:
  replicas: 1
  selector:
    matchLabels:
      app: httpd-backend
  template:
    metadata:
      labels:
        app: httpd-backend
    spec:
      containers:
        - name: httpd
          image: httpd:latest
          ports:
            - containerPort: 80
          volumeMounts:
            - name: html-volume
              mountPath: /usr/local/apache2/htdocs/
      volumes:
        - name: html-volume
          configMap:
            name: httpd-html

kubectl apply -f web-server.yaml

Create a service to the httpd-backend web deployment.

---
apiVersion: v1
kind: Service
metadata:
  name: httpd-service
spec:
  type: ClusterIP
  ports:
    - port: 80
      targetPort: 80
  selector:
    app: httpd-backend

kubectl apply -f httpd-backend.yaml

Install the Gateway API CRDs and Envoy Gateway.

helm install eg oci://docker.io/envoyproxy/gateway-helm -n envoy-gateway-system --create-namespace

Please wait for Envoy Gateway to become available.

kubectl wait --timeout=5m -n envoy-gateway-system deployment/envoy-gateway --for=condition=Available

deployment.apps/envoy-gateway condition met

kubectl get all -n envoy-gateway-system

NAME                                 READY   STATUS    RESTARTS   AGE
pod/envoy-gateway-56dff69df6-xspzp   1/1     Running   0          34s

NAME                    TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                                   AGE
service/envoy-gateway   ClusterIP   172.31.191.184   <none>        18000/TCP,18001/TCP,18002/TCP,19001/TCP   34s

NAME                            READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/envoy-gateway   1/1     1            1           34s

NAME                                       DESIRED   CURRENT   READY   AGE
replicaset.apps/envoy-gateway-56dff69df6   1         1         1       34s

Create a cluster-scoped GatewayClass which is not tied to any namespace.

---
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: eg
spec:
  controllerName: gateway.envoyproxy.io/gatewayclass-controller

kubectl apply -f gateway-class.yaml

Define a basic Gateway configuration that includes a listener configured to accept HTTP traffic.

---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: gateway
  namespace: default
spec:
  gatewayClassName: eg
  listeners:
    - name: http
      protocol: HTTP
      port: 80
      allowedRoutes:
        namespaces:
          from: All

kubectl apply -f gateway.yaml

Define a HTTPRoute so the httpd-backend deployments could be exposed externally.

---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: httpd-route
  namespace: default
spec:
  parentRefs:
    - name: gateway
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: httpd-service
          port: 80

kubectl apply -f httpd-route.yaml

Wait till the httpd-backend route becomes ready.

kubectl describe httproute -n default httpd-route

You should see

Status:
 Parents:
   Conditions:
     Last Transition Time:  2025-07-21T23:01:18Z
     Message:               Route is accepted
     ....

Retrieve the external IP address assigned to your Gateway. When the Gateway is created, an Octavia load balancer is provisioned for it and its address appears in the ADDRESS column:
```
kubectl get gateway gateway -n default
```
```
NAME      CLASS   ADDRESS           PROGRAMMED   AGE
gateway   eg      160.250.232.111   True         2m
```

Verify whether Envoy Gateway can direct the HTTP requests to the correct backend Service, using the Gateway address from the previous step:

curl http://160.250.232.111

<!DOCTYPE html>
<html>
  <head><title>Welcome to HTTPD</title></head>
  <body><h1>Hello from HTTPD!</h1></body>
</html>

More information

For more information, refer to:

Envoy Gateway

Tutorial Complete!

You have completed this tutorial. Continue with the other tutorials in the Series or return to the tutorials home page.

Continue Series Return Home