Gateways

Procedure

1. Create namespace called httpbin by running the following command:

   $ oc create namespace httpbin

2. Enable sidecar injection in the namespace. If you are using the InPlace upgrade strategy, run the following command:

   $ oc label namespace httpbin istio-injection=enabled

   Note

   If you are using the RevisionBased upgrade strategy, run the following commands:

   1. To find your <revision-name>, run the following command:

      $ oc get istiorevisions.sailoperator.io

      You will get an output similar to the following example:

   NAME      TYPE    READY   STATUS    IN USE   VERSION   AGE
   default   Local   True    Healthy   True    v1.24.3   3m33s

   1. Label the namespace with the revision name to enable sidecar injection:

      $ oc label namespace httpbin istio.io/rev=default

3. Deploy a sample service named httpbin by running the following command:

   $ oc apply -n httpbin -f https://raw.githubusercontent.com/openshift-service-mesh/istio/refs/heads/master/samples/httpbin/httpbin.yaml

4. Create a YAML file named httpbin-gw.yaml that defines an Istio Gateway resource. This resource configures gateway proxies to expose port 80 (HTTP) for the host, httpbin.example.com.

   apiVersion: networking.istio.io/v1
   kind: Gateway
   metadata:
     name: httpbin-gateway
     namespace: httpbin
   spec:
     selector:
       istio: <gateway_name> 

   1

   
     servers:
     - port:
         number: 80
         name: http
         protocol: HTTP
       hosts:
       - httpbin.example.com 

   2

   1

   Set the selector to the unique label or set of labels specified in the pod template of the gateway proxy Deployment. By default, the Istio Gateway resource configuration will apply to matching gateway pods in all namespaces.

   2

   Using the hosts field, specify a list of addresses that can be used by clients when attempting to access a mesh service at the associated port.

5. Apply the YAML file by running the following command:

   $ oc apply -f httpbin-gw.yaml

6. Create a YAML file named httpbin-vs.yaml for a VirtualService. The VirtualService defines the rules that route traffic from the gateway proxy to the httpbin service.

   apiVersion: networking.istio.io/v1
   kind: VirtualService
   metadata:
     name: httpbin
     namespace: httpbin
   spec:
     hosts:
     - httpbin.example.com 

   1

   
     gateways:
     - httpbin-gateway 

   2

   
     http:
     - match:
       - uri:
           prefix: /status
       - uri:
           prefix: /headers
       route:
       - destination: 

   3

   
           port:
             number: 8000
           host: httpbin

   1

   Specify the hosts that the routing rules of the VirtualService will be applied to. The hosts specified must be exposed by the Istio Gateway resource the VirtualService is bound to.

   2

   Bind the VirtualService to the Istio Gateway resource created in the previous step by adding the Gateway name to the list of gateways.

   3

   Route matching traffic to the httpbin service deployed earlier by defining a destination that includes the host and port of the httpbin Service.

7. Apply the YAML file by running the following command:

   $ oc apply -f httpbin-vs.yaml

8. For verification purposes, create a namespace for a curl client by running the following command:

   $ oc create namespace curl

9. Deploy the curl client by running the following command:

   $ oc apply -n curl -f https://raw.githubusercontent.com/openshift-service-mesh/istio/refs/heads/master/samples/curl/curl.yaml

10. Set a CURL_POD variable with the name of the curl pod by running the following command:

    $ CURL_POD=$(oc get pods -n curl -l app=curl -o jsonpath='{.items[*].metadata.name}')

11. Using the curl client, send a request to the /headers endpoint of the httpbin application through the ingress gateway Service resource. Set the Host header of the request to httpbin.example.com to match the host that the Istio Gateway and VirtualService resources specify. Run the following curl command to send the request:

    $ oc exec $CURL_POD -n curl -- \
      curl -s -I \
        -H Host:httpbin.example.com \
        <gateway_name>.<gateway_namespace>.svc.cluster.local/headers

12. The response should have a 200 OK HTTP status indicating that the request was successful.

    HTTP/1.1 200 OK
    server: istio-envoy
    ...

13. Send a curl request to an endpoint that does not have a corresponding URI prefix match defined in the httpbin VirtualService by running the following command:

    $ oc exec $CURL_POD -n curl -- \
      curl -s -I \
        -H Host:httpbin.example.com \
        <gateway_name>.<gateway_namespace>.svc.cluster.local/get

    The response should return a 404 Not Found status. This is expected because the /get endpoint does not have a matching URI prefix in the httpbin VirtualService resource.

    HTTP/1.1 404 Not Found
    server: istio-envoy
    ...

14. Expose the gateway proxy to traffic outside the cluster by setting the Service type to LoadBalancer:

    $ oc patch service <gateway_name> -n <gateway_namespace> -p '{"spec": {"type": "LoadBalancer"}}'

    Note

    A gateway can also be exposed to traffic outside the cluster by using OpenShift Routes. For more information, see "Exposing a gateway to traffic outside the cluster using OpenShift Routes".

15. Verify that httpbin service can be accessed from outside the cluster when using the external hostname or IP address of the gateway Service resource. Ensure that you set the INGRESS_HOST variable appropriately for the environment that your cluster is running in.

    1. If the cluster runs on AWS, set the INGRESS_HOST variable by running the following command:

       $ INGRESS_HOST=$(oc get service <gateway_name> -n <gateway_namespace> -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')

    2. If the cluster runs on GCP or Azure, set the INGRESS_HOST variable by running the following command:

       $ INGRESS_HOST=$(oc get service <gateway_name> -n <gateway_namespace> -o jsonpath='{.status.loadBalancer.ingress[0].ip}')

    3. Send a curl request to the httpbin service using the host of the gateway by running the following command:

       $ curl -s -I -H Host:httpbin.example.com http://$INGRESS_HOST/headers

16. Verify that the response has the HTTP/1.1 200 OK status, which indicates that the request was successful.

Procedure

1. Create a namespace called httpbin by running the following command:

   $ oc create namespace httpbin

2. When using sidecar injection instead of ambient mode, you must enable the sidecar injection in the namespace:

   1. For the InPlace upgrade strategy, run the following command:

      $ oc label namespace httpbin istio-injection=enabled

   2. For the RevisionBased upgrade strategy, run the following command:

      $ oc label namespace httpbin istio.io/rev=<revision-name>

3. Deploy a sample service named httpbin by running the following command:

   $ oc apply -n httpbin -f https://raw.githubusercontent.com/openshift-service-mesh/istio/refs/heads/master/samples/httpbin/httpbin.yaml

4. Create a YAML file named httpbin-gw.yaml that defines a Kubernetes Gateway resource, similar to the following example:

   apiVersion: gateway.networking.k8s.io/v1
   kind: Gateway
   metadata:
     name: httpbin-gateway
     namespace: httpbin
   spec:
     gatewayClassName: istio
     listeners:
     - name: default
       hostname: "httpbin.example.com"
       port: 80
       protocol: HTTP
       allowedRoutes:
         namespaces:
           from: All

   "httpbin.example.com"

   Specifies the virtual hostname that clients use when attempting to access a mesh service on the associated port.

   The HTTPRoute resource specifies the rules that route traffic from the gateway proxy to the httpbin service.

5. Apply the YAML file by running the following command:

   $ oc apply -f httpbin-gw.yaml

6. Create a YAML file named httpbin-ingress-hr.yaml that defines an HTTPRoute resource for the ingress gateway, similar to the following example:

   apiVersion: gateway.networking.k8s.io/v1
   kind: HTTPRoute
   metadata:
     name: httpbin-ingress
     namespace: httpbin
   spec:
     parentRefs:
     - name: httpbin-gateway
       namespace: httpbin
     hostnames:
     - "httpbin.example.com"
     rules:
     - matches:
       - path:
           type: PathPrefix
           value: /status
       - path:
           type: PathPrefix
           value: /headers
     - backendRefs:
       - name: httpbin
         port: 8000

   • spec.parentRefs binds the HTTPROUTE resource to the Kubernetes Gateway resource that was created in the earlier step.
   • spec.rules.backendRefs routes the matching traffic to the httpbin service by defining a backendRefs that includes the name and port of the httpbin service.

   The HTTPRoute resource specifies the rules that route traffic from the gateway proxy to the httpbin service.

7. Apply the YAML file by running the following command:

   $ oc apply -f httpbin-ingress-hr.yaml

8. Ensure that the Gateway API service is ready, and that an address is allocated to the service, by running the following command:

   $ oc wait --for=condition=programmed gtw httpbin-gateway -n httpbin

Verification

1. Create a namespace for a curl client by running the following command:

   $ oc create namespace curl

2. Deploy a curl client by running the following command:

   $ oc apply -n curl -f https://raw.githubusercontent.com/openshift-service-mesh/istio/refs/heads/master/samples/curl/curl.yaml

3. Set a CURL_POD variable with the name of the curl pod by running the following command:

   $ CURL_POD=$(oc get pods -n curl -l app=curl -o jsonpath='{.items[*].metadata.name}')

4. Using the curl client, send a request to the /headers endpoint of the httpbin application through the ingress gateway Service resource. Set the Host header of the request to httpbin.example.com to match the host that the Kubernetes Gateway and HTTPROUTE resources specify. Send the curl request by running the following command:

   $ oc exec $CURL_POD -n curl -- \
     curl -s -I \
       -H Host:httpbin.example.com \
       <gateway_name>-istio.<gateway_namespace>.svc.cluster.local/headers

   The response should return a 200 OK HTTP status, which indicates that the request was successful, similar to the following example:

   HTTP/1.1 200 OK
   server: istio-envoy
   ...

5. Send a curl request to an endpoint that does not have a corresponding Uniform Resource Identifier (URI) prefix match defined in the httpbin HTTPROUTE by running the following command:

   $ oc exec $CURL_POD -n curl -- \
     curl -s -I \
       -H Host:httpbin.example.com \
       <gateway_name>-istio.<gateway_namespace>.svc.cluster.local/get

   The response returns a 404 Not Found status, as expected, because the /get endpoint does not have a matching URI prefix in the httpbin HTTPROUTE resource, similar to the following example:

   HTTP/1.1 404 Not Found
   server: istio-envoy
   ...

6. Expose the gateway proxy to traffic outside the cluster by setting the Service type to LoadBalancer. Run the following command:

   $ oc patch service <gateway_name>-istio -n <gateway_namespace> -p '{"spec": {"type": "LoadBalancer"}}'

   Note

   A gateway can also be exposed to traffic outside the cluster by using OpenShift Routes. For more information, see "Exposing a gateway to traffic outside the cluster using OpenShift Routes".

7. Verify that the httpbin service can be accessed from outside the cluster when using the external hostname or IP address of the gateway Service resource. Ensure that you set the INGRESS_HOST variable appropriately for the environment in which your cluster is running.

   1. Set the INGRESS_HOST variable by running the following command:

      $ export INGRESS_HOST=$(oc get gtw <gateway_name> -n <gateway_namespace> -o jsonpath='{.status.addresses[0].value}')

   2. Set the INGRESS_PORT variable by running the following command:

      $ INGRESS_PORT=$(oc get gtw <gateway_name> -n <gateway_namespace> -o jsonpath='{.spec.listeners[?(@.name=="http")].port}')

   3. Using the gateway host, send a curl request to the httpbin service by running the following command:

      $ curl -s -I -H Host:httpbin.example.com http://$INGRESS_HOST:$INGRESS_PORT/headers

8. Verify that the response has the HTTP/1.1 200 OK status, which indicates that the request was successful.

Procedure

1. Create a namespace called httpbin by running the following command:

   $ oc create namespace httpbin

2. Apply the label for ambient mode by running the following command:

   $ oc label namespace httpbin istio.io/dataplane-mode=ambient

3. Deploy a sample service named httpbin by running the following command:

   $ oc apply -n httpbin -f https://raw.githubusercontent.com/openshift-service-mesh/istio/refs/heads/master/samples/httpbin/httpbin.yaml

4. Deploy a waypoint proxy by creating a YAML file named httpbin-waypoint.yaml, similar to the following example:

   apiVersion: gateway.networking.k8s.io/v1
   kind: Gateway
   metadata:
     name: httpbin-waypoint
     namespace: httpbin
     labels:
       istio.io/waypoint-for: service
   spec:
     gatewayClassName: istio-waypoint
     listeners:
     - name: mesh
       port: 15008
       protocol: HBONE

5. Apply the YAML file by running the following command:

   $ oc apply -f httpbin-waypoint.yaml

6. Enable ingress waypoint routing on the httpbin service by running the following command:

   $ oc label service httpbin -n httpbin istio.io/ingress-use-waypoint=true

   The label ensures that traffic from the ingress gateway routes through the waypoint proxy and the Layer 7 (L7) policies configured on the waypoint proxy are applied to the ingress traffic, before it reaches the httpbin service.

7. Apply the waypoint label to the namespace so that all the services inside the namespace routes through the waypoint, by running the following command:

   $ oc label ns httpbin istio.io/use-waypoint=httpbin-waypoint

8. Create a YAML file named httpbin-gw.yaml that defines a Kubernetes Gateway resource. This resource configures gateway proxies to expose port 80 (HTTP) for the host, httpbin.example.com.

   apiVersion: gateway.networking.k8s.io/v1
   kind: Gateway
   metadata:
     name: httpbin-gateway
     namespace: httpbin
   spec:
     gatewayClassName: istio
     listeners:
     - name: default
       hostname: "httpbin.example.com"
       port: 80
       protocol: HTTP
       allowedRoutes:
         namespaces:
           from: All

   "httpbin.example.com"

   Specifies the virtual hostname that clients use when attempting to access a mesh service on the associated port.

9. Apply the YAML file by running the following command:

   $ oc apply -f httpbin-gw.yaml

10. Create a YAML file named httpbin-ingress-hr.yaml that defines an HTTPRoute resource for the ingress gateway, similar to the following example:

    apiVersion: gateway.networking.k8s.io/v1
    kind: HTTPRoute
    metadata:
      name: httpbin-ingress
      namespace: httpbin
    spec:
      parentRefs:
      - name: httpbin-gateway
        namespace: httpbin
      hostnames:
      - "httpbin.example.com"
      rules:
      - backendRefs:
        - name: httpbin
          port: 8000

    • spec.parentRefs binds the HTTPROUTE resource to the Kubernetes Gateway resource that was created in the earlier step.
    • spec.rules.backendRefs routes the matching traffic to the httpbin service by defining a backendRefs that includes the name and port of the httpbin service.

    The HTTPRoute resource specifies the rules that route traffic from the gateway proxy to the httpbin service.

11. Apply the YAML file by running the following command:

    $ oc apply -f httpbin-ingress-hr.yaml

12. Create a YAML file named httpbin-waypoint-hr.yaml that defines an HTTPRoute resource for the waypoint proxy.

    apiVersion: gateway.networking.k8s.io/v1
    kind: HTTPRoute
    metadata:
      name: httpbin-waypoint-route
      namespace: httpbin
    spec:
      parentRefs:
      - group: ""
        kind: service
        name: httpbin
        namespace: httpbin
      rules:
      - matches:
        - path:
            type: PathPrefix
            value: /status
        - path:
            type: PathPrefix
            value: /headers
        backendRefs:
        - name: httpbin
          port: 8000

    • spec.parentRefs binds the HTTPRoute resource to the httpbin service. When combined with the istio.io/ingress-use-waypoint=true label on the service, the HTTPRoute configures the L7 routing rules that the waypoint proxy will enforce for traffic destined to that service.
    • spec.rules.backendRefs routes the matching traffic to the httpbin service by defining a backendRefs that includes the name and port of the httpbin service.

13. Apply the YAML file by running the following command:

    $ oc apply -f httpbin-waypoint-hr.yaml

    Note

    In this example use case, traffic from the ingress gateway flows through the waypoint proxy because of the istio.io/ingress-use-waypoint=true label. The HTTPRoute resource then applies path-based routing policies before the traffic reaches the httpbin service.

14. Ensure that the waypoint proxy is ready by running the following command:

    $ oc wait --for=condition=programmed gtw httpbin-waypoint -n httpbin

Verification

1. Create a namespace for a curl client by running the following command:

   $ oc create namespace curl

2. Deploy a curl client by running the following command:

   $ oc apply -n curl -f https://raw.githubusercontent.com/openshift-service-mesh/istio/refs/heads/master/samples/curl/curl.yaml

3. Apply the label for ambient mode to the curl namespace by running the following command:

   $ oc label namespace curl istio.io/dataplane-mode=ambient

4. Set a CURL_POD variable with the name of the curl pod by running the following command:

   $ CURL_POD=$(oc get pods -n curl -l app=curl -o jsonpath='{.items[*].metadata.name}')

5. Using the curl client, send a request to the /headers endpoint of the httpbin application through the ingress gateway Service resource. Set the Host header of the request to httpbin.example.com to match the host that the Kubernetes Gateway and HTTPROUTE resources specify. Send the curl request by running the following command:

   $ oc exec $CURL_POD -n curl -- \
     curl -s -I \
       -H Host:httpbin.example.com \
       httpbin-gateway-istio.httpbin.svc.cluster.local/headers

   The response should return a 200 OK HTTP status, which indicates that the request was successful, similar to the following example:

   HTTP/1.1 200 OK
   server: istio-envoy
   ...

6. Send a curl request to an endpoint that does not have a corresponding Uniform Resource Identifier (URI) prefix match defined in the httpbin HTTPROUTE by running the following command:

   $ oc exec $CURL_POD -n curl -- \
     curl -s -I \
       -H Host:httpbin.example.com \
       httpbin-gateway-istio.httpbin.svc.cluster.local/get

   The response returns a 404 Not Found status, as expected, because the /get endpoint does not have a matching URI prefix in the httpbin HTTPROUTE resource, similar to the following example:

   HTTP/1.1 404 Not Found
   server: istio-envoy
   ...

7. Expose the gateway proxy to traffic outside the cluster by setting the Service type to LoadBalancer. Run the following command:

   $ oc patch service httpbin-gateway-istio -n httpbin -p '{"spec": {"type": "LoadBalancer"}}'

   Note

   A gateway can also be exposed to traffic outside the cluster by using OpenShift Routes. For more information, see "Exposing a gateway to traffic outside the cluster using OpenShift Routes".

8. Verify that the httpbin service can be accessed from outside the cluster when using the external hostname or IP address of the gateway Service resource. Ensure that you set the INGRESS_HOST variable appropriately for the environment in which your cluster is running.

   1. Set the INGRESS_HOST variable by running the following command:

      $ export INGRESS_HOST=$(oc get gtw httpbin-gateway -n httpbin -o jsonpath='{.status.addresses[0].value}')

   2. Set the INGRESS_PORT variable by running the following command:

      $ INGRESS_PORT=$(oc get gtw httpbin-gateway -n httpbin -o jsonpath='{.spec.listeners[?(@.name=="http")].port}')

   3. Using the gateway host, send a curl request to the httpbin service by running the following command:

      $ curl -s -I -H Host:httpbin.example.com http://$INGRESS_HOST:$INGRESS_PORT/headers

9. Verify that the response has the HTTP/1.1 200 OK status, which indicates that the request was successful.

Procedure

1. Create a namespace called curl by running the following command:

   $ oc create namespace curl

2. Depending on the update strategy you are using, enable sidecar injection in the namespace by running the appropriate commands:

   1. If you are using the InPlace update strategy, run the following command:

      $ oc label namespace curl istio-injection=enabled

   2. If you are using the RevisionBased update strategy, run the following commands:

      1. Display the revision name by running the following command:

         $ oc get istiorevisions.sailoperator.io

         Example output

         NAME     TYPE    READY   STATUS    IN USE   VERSION   AGE
         default  Local   True    Healthy   True     v1.24.3   3m33s

      2. Label the namespace with the revision name to enable sidecar injection by running the following command:

         $ oc label namespace curl istio.io/rev=default

3. Deploy a curl application by running the following command:

   $ oc apply -n curl -f https://raw.githubusercontent.com/openshift-service-mesh/istio/refs/heads/master/samples/curl/curl.yaml

4. Export a CURL_POD environment variable that has been initialized with the name of the curl pod:

   $ export CURL_POD=$(oc get pod -n curl -l app=curl -o jsonpath='{.items[0].metadata.name}')

5. Create a YAML file named http-se.yaml that directs traffic from the mesh to an external service. The following example defines a ServiceEntry for a URL.

   apiVersion: networking.istio.io/v1
   kind: ServiceEntry
   metadata:
     name: egress-se
     namespace: curl
   spec:
     hosts:
       - docs.redhat.com
     ports:
       - number: 80
         name: http-port
         protocol: HTTP
     location: MESH_EXTERNAL
     resolution: DNS

6. Apply the YAML file by running the following command:

   $ oc apply -f http-se.yaml

7. Ensure the ServiceEntry configuration was applied correctly. Send an HTTP request to the host that you specified in the previous step by running the following command:

   $ oc exec "$CURL_POD" -n curl -c curl -- curl -sSL -o /dev/null -D - http://docs.redhat.com

   This command should return HTTP status codes, such as 301 (redirect) or 200 (success), indicating that the connection works.

8. Create a YAML file named http-gtw.yaml that creates an egress Gateway and routes traffic from the mesh to the host specified for the external service.

   apiVersion: networking.istio.io/v1alpha3
   kind: Gateway
   metadata:
     name: egress-gw
     namespace: <gateway_namespace> # Namespace where the egress gateway is deployed
   spec:
     selector:
       istio: <gateway_name> # Selects the egress-gateway instance to handle this traffic
     servers:
       - port:
           number: 80
           name: http
           protocol: HTTP
         hosts:
           - docs.redhat.com # External service host, not a full URL.
   ---
   apiVersion: networking.istio.io/v1alpha3
   kind: DestinationRule
   metadata:
     name: egress-dr
     namespace: <gateway_namespace> # Namespace where the egress gateway is deployed
   spec:
     host: <gateway_name>.<gateway_namespace>.svc.cluster.local
     subsets:
       - name: rh-docs

9. Apply the YAML file by running the following command:

   $ oc apply -f http-gtw.yaml

10. Create a YAML file named http-vs.yaml that sets up a VirtualService to manage the flow of traffic from the application sidecars through the egress gateway to the external host.

    apiVersion: networking.istio.io/v1alpha3
    kind: VirtualService
    metadata:
      name: egress-vs
      namespace: curl # Namespace where the curl pod is running
    spec:
      hosts:
        - docs.redhat.com # External service host, not a full URL.
      gateways:
        - mesh
        - <gateway_namespace>/egress-gw # Egress gateway name defined in the file that you used in the previous step.
      http:
        - match:
            - gateways:
                - mesh
              port: 80
          route:
            - destination:
                host: <gateway_name>.<gateway_namespace>.svc.cluster.local
                subset: rh-docs
                port:
                  number: 80
              weight: 100
        - match:
            - gateways:
                - <gateway_namespace>/egress-gw # Egress gateway name defined in the file that you used in the previous step.
              port: 80
          route:
            - destination:
                host: docs.redhat.com
                port:
                  number: 80
              weight: 100

11. Apply the YAML file by running the following command:

    $ oc apply -f http-vs.yaml

12. Resend the HTTP request to the URL:

    $ oc exec "$CURL_POD" -n curl -c curl -- curl -sSL -o /dev/null -D - http://docs.redhat.com

    The terminal should display information similar to the following output:

    ...
    HTTP/1.1 301 Moved Permanently
    ...
    location: <example_url>
    ...
    
    HTTP/2 200
    Content-Type: text/html; charset=utf-8

13. Ensure that the request was routed through the gateway by running the following command:

    $ oc logs deployment/<gateway_name> -n <gateway_namespace> | tail -1

    Note

    Access logging must be enabled for this verification step to work. You can enable access logging to the standard output by setting the spec.values.meshConfig.accessLogFile field to /dev/stdout in the Istio resource.

    The terminal should display information similar to the following output:

    [2024-11-07T14:35:52.428Z] "GET / HTTP/2" 301 - via_upstream - "-" 0 0 24 24 "10.128.2.30" "curl/8.11.0" "79551af2-341b-456d-b414-9220b487a03b" "docs.redhat.com" "23.55.176.201:80" outbound|80||docs.redhat.com 10.128.2.29:49766 10.128.2.29:80 10.128.2.30:38296 -

Procedure

1. Optional: Enable the Kubernetes Gateway API custom resource definitions (CRDs).

   Note

   As of Kubernetes 1.28 and OpenShift Container Platform 4.18 or earlier version of Red Hat OpenShift Service Mesh, the Kubernetes Gateway API CRDs are not available by default and you must install the CRDs before you can use them. OpenShift Container Platform 4.19 and later versions install the CRDs by default.

   1. Create a YAML file named gateway-cr.yaml that enables the Kubernetes Gateway API CRDs.

      apiVersion: gateway.networking.k8s.io/v1
      kind: Gateway
      metadata:
        name: bookinfo-gateway
      spec:
        gatewayClassName: istio
        listeners:
        - name: http
          port: 80
          protocol: HTTP
          allowedRoutes:
            namespaces:
              from: Same
      ---
      apiVersion: gateway.networking.k8s.io/v1
      kind: HTTPRoute
      metadata:
        name: bookinfo
      spec:
        parentRefs:
        - name: bookinfo-gateway
        rules:
        - matches:
          - path:
              type: Exact
              value: /productpage
          - path:
              type: PathPrefix
              value: /static
          - path:
              type: Exact
              value: /login
          - path:
              type: Exact
              value: /logout
          - path:
              type: PathPrefix
              value: /api/v1/products
          backendRefs:
          - name: productpage
            port: 9080

   2. Apply the YAML file by running the following command:

      $ oc apply -f gateway-cr.yaml

2. Create a namespace called egress-gateway by running the following command:

   $ oc create namespace egress-gateway

3. Apply the istio-injection label to the namespace by running the following command:

   $ oc label namespace egress-gateway istio-injection=enabled

4. Create a YAML file named egress-gateway-cr.yaml that defines the egress gateway.

   # ServiceEntry to allow traffic to httpbin.org
   apiVersion: networking.istio.io/v1
   kind: ServiceEntry
   metadata:
     name: httpbin-ext
   spec:
     hosts:
     - httpbin.org
     ports:
     - number: 80
       name: http
       protocol: HTTP
     location: MESH_EXTERNAL
     resolution: DNS
   ---
   # Gateway API Gateway for egress
   apiVersion: gateway.networking.k8s.io/v1
   kind: Gateway
   metadata:
     name: httpbin-egress-gateway
     annotations:
       networking.istio.io/service-type: ClusterIP
   spec:
     gatewayClassName: istio
     listeners:
     - name: http
       hostname: httpbin.org
       port: 80
       protocol: HTTP
       allowedRoutes:
         namespaces:
           from: Same
   ---
   # HTTPRoute to direct traffic from sidecars to the egress gateway
   apiVersion: gateway.networking.k8s.io/v1
   kind: HTTPRoute
   metadata:
     name: direct-httpbin-to-egress-gateway
   spec:
     parentRefs:
     - kind: ServiceEntry
       group: networking.istio.io
       name: httpbin-ext
     rules:
     - backendRefs:
       - name: httpbin-egress-gateway-istio
         port: 80
   ---
   # HTTPRoute to forward traffic from the egress gateway to httpbin.org
   apiVersion: gateway.networking.k8s.io/v1
   kind: HTTPRoute
   metadata:
     name: forward-httpbin-from-egress-gateway
   spec:
     parentRefs:
     - name: httpbin-egress-gateway
     hostnames:
     - httpbin.org
     rules:
     - backendRefs:
       - kind: Hostname
         group: networking.istio.io
         name: httpbin.org
         port: 80

   1. Apply the YAML file by running the following command:

      $ oc apply -f egress-gateway-cr.yaml

Verification

1. Verify the status of the gateway configuration by running the following command:

   $ oc describe gateway -n egress-gateway

   Desired output is indicated by Programmed showing in the Status column.

2. Create a curl pod in the egress-gateway namespace by running the following command:

   $ oc run test-pod --image=curlimages/curl:latest -n egress-gateway --rm -it --restart=Never -- sh

3. By using the curl client, verify that you can access httpbin.org through the egress gateway by entering following command:

   $ curl -v http://httpbin.org/get

   Desired output shows a response from httpbin.org that indicates egress traffic routes through the configured gateway.

Procedure

1. Optional: Enable the {k8} Gateway API custom resource definitions (CRDs).

   Note

   As of Kubernetes 1.28 and OpenShift Container Platform 4.18 or earlier version of Red Hat OpenShift Service Mesh, the Kubernetes Gateway API CRDs are not available by default and you must install the CRDs before you can use them. OpenShift Container Platform 4.19 and later versions install the CRDs by default.

2. Create a namespace called egress-gateway by running the following command:

   $ oc create namespace egress-gateway

3. Apply the ambient mode label to the namespace by running the following command:

   $ oc label namespace egress-gateway istio.io/dataplane-mode=ambient

4. Create a YAML file named egress-se.yaml that defines the ServiceEntry.

   apiVersion: networking.istio.io/v1
   kind: ServiceEntry
   metadata:
     name: httpbin-ext
     namespace: egress-gateway
     labels:
       istio.io/use-waypoint: waypoint
   spec:
     hosts:
     - httpbin.org
     ports:
     - number: 80
       name: http
       protocol: HTTP
     resolution: DNS

   1. Apply the YAML file by running the following command:

      $ oc apply -f egress-se.yaml

   2. Create a YAML file named waypoint.yaml that creates a waypoint proxy in egress-gateway namespace similar to the following example:

      apiVersion: gateway.networking.k8s.io/v1
      kind: Gateway
      metadata:
        name: waypoint
        namespace: egress-gateway
        labels:
          istio.io/gateway-for: service
      spec:
        gatewayClassName: istio-waypoint
        listeners:
        - name: mesh
          port: 15008
          protocol: HBONE

   3. Apply the YAML file by running the following command:

      $ oc apply -f waypoint.yaml

Verification

1. Verify the status of the gateway configuration by running the following command:

   $ oc get gateways.gateway.networking.k8s.io waypoint -n egress-gateway

   The PROGRAMMED column shows True when the configuration succeeds, similar to the following example:

   NAME       CLASS            ADDRESS          PROGRAMMED   AGE
   waypoint   istio-waypoint   172.30.227.148   True         9s

2. Create a curl pod in the egress-gateway namespace by running the following command:

   $ oc run test-pod --image=curlimages/curl:latest -n egress-gateway --rm -it --restart=Never -- sh

3. By using the curl client, verify that you can access httpbin.org through the egress gateway by running the following command:

   $ curl -v http://httpbin.org/get

   The output shows a response from httpbin.org service that indicates egress traffic routes through the configured gateway. The ztunnel logs should show traffic routed through the waypoint. The terminal should display information similar to the following output:

   2025-10-24T08:08:35.242159Z info access connection complete src.addr=[fd01:0:0:5::b0]:56288 src.workload="test-pod" src.namespace="egress-gateway" src.identity="spiffe://cluster.local/ns/egress-gateway/sa/default" dst.addr=[fd01:0:0:5::af]:15008 dst.hbone_addr=[2001:2::2]:80 dst.service="httpbin.org" dst.workload="waypoint-5b668759d5-vrnx8" dst.namespace="egress-gateway" dst.identity="spiffe://cluster.local/ns/egress-gateway/sa/waypoint" direction="outbound" bytes_sent=78 bytes_recv=540 duration="957ms"

Procedure

1. Create a directory for your certificates by running the following command:

   $ mkdir certs

2. Generate the certificates for your gateway similar to the following examples:

   • Create the first certificate by running the following command:

     $ openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 \
       -subj '/O=example Inc./CN=example.com' \
       -keyout certs/example.com.key \
       -out certs/example.com.crt

   • Create the second certificate by running the following command:

     $ openssl req -out certs/httpbin.example.com.csr -newkey rsa:2048 -nodes \
       -keyout certs/httpbin.example.com.key \
       -subj "/CN=httpbin.example.com/O=httpbin organization"

   • Create the third certificate by running the following command:

     $ openssl x509 -req -sha256 -days 365 \
       -CA certs/example.com.crt -CAkey certs/example.com.key \
       -set_serial 0 -in certs/httpbin.example.com.csr \
       -out certs/httpbin.example.com.crt

3. Create a secret containing the TLS certificate for your gateway by running the following command:

   $ oc create -n istio-system secret tls httpbin-credential \
       --key=certs/httpbin.example.com.key \
       --cert=certs/httpbin.example.com.crt

Procedure

1. Deploy a gateway using the Kubernetes Gateway API by running the following command:

   $ oc apply -f - <<EOF
   apiVersion: gateway.networking.k8s.io/v1beta1
   kind: Gateway
   metadata:
    name: pqc-gateway
    namespace: istio-system
   spec:
    gatewayClassName: istio
    listeners:
    - name: https
      port: 443
      protocol: HTTPS
      tls:
        mode: Terminate
        certificateRefs:
        - name: httpbin-credential
          namespace: istio-system
      allowedRoutes:
        namespaces:
          from: All
   ---
   apiVersion: gateway.networking.k8s.io/v1beta1
   kind: HTTPRoute
   metadata:
    name: httpbin-route
    namespace: default
   spec:
    parentRefs:
    - name: pqc-gateway
      namespace: istio-system
    hostnames:
    - "httpbin.example.com"
    rules:
    - matches:
      - path:
          type: PathPrefix
          value: /
      backendRefs:
      - name: httpbin
        port: 8000
   EOF

2. Add the istio-injection=enabled label to the default namespace by running the following command:

   $ oc label ns default istio-injection=enabled

3. Deploy the backend server by running the following command:

   $ oc apply -n default -f \
   https://raw.githubusercontent.com/openshift-service-mesh/istio/master/samples/httpbin/httpbin.yaml

Procedure

1. Retrieve the external address based on the type of load balancer:

   1. Retrieve the external address for your hostname-based load balancer by running the following command:

      $ INGRESS_ADDR=$(oc get svc pqc-gateway-istio \
      -n istio-system \
      -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')

   2. Retrieve the external address for your IP-based load balancer by running the following command:

      $ INGRESS_ADDR=$(oc get svc pqc-gateway-istio \
      -n istio-system \
      -o jsonpath='{.status.loadBalancer.ingress[0].ip}')

2. Test the connection with the PQC-enabled client by running the following command:

   $ podman run --rm -it \
     -v ./certs/example.com.crt:/etc/certs/example.com.crt \
     docker.io/openquantumsafe/curl \
     curl -vk "https://$INGRESS_ADDR:443/headers" \
     -H "Host: httpbin.example.com" \
     --curves X25519MLKEM768 \
     --cacert /etc/certs/example.com.crt

   The request should succeed, and you should receive the HTTP status as 200.

3. Verify that the connection fails with a standard curl client by running the following command:

   $ curl -vk "https://$INGRESS_ADDR:443/headers" \
     -H "Host: httpbin.example.com" \
     --cacert ./certs/example.com.crt

   You will get errors similar to the following example:

   * TLSv1.3 (OUT), TLS handshake, Client hello (1):
   * TLSv1.3 (IN), TLS alert, handshake failure (552):
   * TLS connect error: error:0A000410:SSL routines::ssl/tls alert handshake failure
   * closing connection #0
   curl: (35) TLS connect error: error:0A000410:SSL routines::ssl/tls alert handshake failure