Chapter 3. Connectivity Link technologies and patterns

Gateways play an essential role in application connectivity and security. In Kubernetes-based environments, Gateway API is the new standard for deploying ingress Gateways and managing application networking.

Gateway API provides standardized APIs for ingress traffic management and support for multiple protocols. Gateway API is user persona role-oriented by design, and provides configuration flexibility and portability. You can use Gateway API to set up ingress policies on each OpenShift cluster to be identical, consistent, and implemented with minimum effort.

Figure 3.1. Gateway API user persona-based design

Typically, the infrastructure owner is responsible for the infrastructure that hosts multiple clusters, for example, based on a cloud provider such as Amazon Web Services or Google Cloud Platform.

The platform engineer is responsible for managing the clusters to meet user requirements, for example, managing Gateways, policies, network access, and application permissions. While the application developer is responsible for creating and managing the applications running in a cluster, for example, managing application authentication, rate limits, timeouts, and routing to backend services.

By using Connectivity Link policies defined as Kubernetes custom resource definitions (CRDs), platform engineers and application developers can easily secure, protect, and connect their applications and infrastructure. Connectivity Link provides policies for managing TLS, authentication and authorization, rate limiting, and DNS.

The policy attachment pattern provides a way to add behavior to a Kubernetes object by using configuration that cannot be described in the object spec field. Policy attachments also provide the concept of defaults and overrides, which allow different roles to operate with policy APIs at different levels of the object hierarchy. These policies are then merged with specific rules and strategies to form an effective policy.

The following simple example of a rate limiting policy configures a specified limit of 5 requests per 10 seconds for every listener defined in the target Gateway that does not have its own rate limiting policy defined:

apiVersion: kuadrant.io/v1
kind: RateLimitPolicy
metadata:
  name: gw-rlp
spec:
  targetRef: # Specifies Gateway API policy attachment
    group: gateway.networking.k8s.io
    kind: Gateway
    name: external
  defaults: # Means it can be overridden
    limits: # Limitador component configuration
      "global":
        rates:
        - limit: 5
          window: 10s

apiVersion: kuadrant.io/v1
kind: RateLimitPolicy
metadata:
  name: gw-rlp
spec:
  targetRef: # Specifies Gateway API policy attachment
    group: gateway.networking.k8s.io
    kind: Gateway
    name: external
  defaults: # Means it can be overridden
    limits: # Limitador component configuration
      "global":
        rates:
        - limit: 5
          window: 10s

Unlike other connectivity management systems, Connectivity Link is not a standalone Gateway. Connectivity Link is a WebAssembly (WASM) plug-in, which is developed for the Envoy proxy. This means that users of OpenShift Service Mesh, Istio, or Envoy for ingress do not require major changes to their existing ingress objects and policies to begin using Connectivity Link.

The WebAssembly plug-in design also means that Connectivity Link is lightweight, fast, hardware independent, non-intrusive, and secure.

Connectivity Link uses multicluster configuration mirroring across multicloud and hybrid cloud environments to ensure that you can deploy your routing, configuration, and policies wherever they are required. You are no longer required to set different policies in different ways based on the cloud service provider. Instead, you can configure and deploy your policies in a consistent way with Connectivity Link.

You can also ensure that your development, test, and production environments are set in the same way to prevent surprises later. In this way, Connectivity Link provides consistency, simplicity, unified experience, global administration, and security compliance.

Figure 3.2. Multicluster configuration mirroring across multicloud and hybrid cloud environments

Connectivity Link provides a next-generation approach to API management that extends beyond traditional API management capabilities provided by other products.

API management requires connectivity, and Connectivity Link provides scalable multicluster and multi-Gateway connectivity management, along with API management features such as API observability, authentication, and rate limiting.

Figure 3.3. Connectivity Link API management and connectivity