Chapter 3. Connectivity Link platform engineer workflow

Procedure

1. If your Gateway namespace does not already exist, create it as follows:

   kubectl create ns ${gatewayNS}

2. If the secret for your DNS provider credentials was not already created when installing Connectivity Link, create this secret in your Gateway namespace as follows:

   kubectl -n ${gatewayNS} create secret generic aws-credentials \
     --type=kuadrant.io/aws \
     --from-literal=AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID \
     --from-literal=AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY

3. Before adding a TLS issuer, you must also create the credentials secret in the cert-manager namespace as follows:

   kubectl -n cert-manager create secret generic aws-credentials \
     --type=kuadrant.io/aws \
     --from-literal=AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID \
     --from-literal=AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY

Procedure

1. Enter the following command to define a TLS issuer. This example uses Let’s Encrypt, which you must also apply to all clusters:

   kubectl apply -f - <<EOF
   apiVersion: cert-manager.io/v1
   kind: ClusterIssuer
   metadata:
     name: ${clusterIssuerName}
   spec:
     acme:
       email: ${EMAIL}
       privateKeySecretRef:
         name: le-secret
       server: https://acme-v02.api.letsencrypt.org/directory
       solvers:
         - dns01:
             route53:
               hostedZoneID: ${zid}
               region: ${AWS_REGION}
               accessKeyIDSecretRef:
                 key: AWS_ACCESS_KEY_ID
                 name: aws-credentials
               secretAccessKeySecretRef:
                 key: AWS_SECRET_ACCESS_KEY
                 name: aws-credentials
   EOF

2. Wait for the ClusterIssuer to become ready as follows:

   kubectl wait clusterissuer/${clusterIssuerName} --for=condition=ready=true

Procedure

1. Enter the following command to create the Gateway:

   kubectl apply -f - <<EOF
   apiVersion: gateway.networking.k8s.io/v1
   kind: Gateway
   metadata:
     name: ${gatewayName}
     namespace: ${gatewayNS}
     labels:
       kuadrant.io/gateway: "true"
   spec:
       gatewayClassName: istio
       listeners:
       - allowedRoutes:
           namespaces:
             from: Same
         hostname: "*.${rootDomain}"
         name: api
         port: 443
         protocol: HTTPS
         tls:
           certificateRefs:
           - group: ""
             kind: Secret
             name: api-${gatewayName}-tls
           mode: Terminate
   EOF

2. Check the status of your Gateway as follows:

   kubectl get gateway ${gatewayName} -n ${gatewayNS} -o=jsonpath='{.status.conditions[?(@.type=="Accepted")].message}'
   kubectl get gateway ${gatewayName} -n ${gatewayNS} -o=jsonpath='{.status.conditions[?(@.type=="Programmed")].message}'

   Your Gateway should be accepted and programmed, which means valid and assigned an external address.

3. However, if you check your HTTPS listener status as follows, you will see that it is not yet programmed or ready to accept traffic due to bad TLS configuration:

   kubectl get gateway ${gatewayName} -n ${gatewayNS} -o=jsonpath='{.status.listeners[0].conditions[?(@.type=="Programmed")].message}'

   Connectivity Link can help with this by using a TLSPolicy, which is described in the next step.

Procedure

1. To distribute this Gateway across multiple clusters, repeat this setup process for each cluster.

   By default, this will implement a round-robin DNS strategy to distribute traffic evenly across the different clusters. Setting up your Gateways to serve clients based on their geographic location is straightforward with your current configuration.

2. Assuming that you have deployed Gateway instances across multiple clusters as per this guide, the next step involves updating the DNS controller with the geographic regions of the visible Gateways.

   For instance, if you have one cluster in North America and another in the EU, you can direct traffic to these Gateways based on their location by configuring the appropriate policy. For your North American cluster, you can create a DNSPolicy and set the loadBalancing:geo field to US.