Calico Ingress Gateway Advanced Configurations

This section describes advanced Calico Ingress Gateway configurations: TLS termination, weighted traffic splitting, TCP routing, and TLS passthrough.

Add HTTPS (TLS termination)

1. Create a TLS secret.

   $ kubectl create secret tls my-tls-secret --cert=tls.crt --key=tls.key
   

2. Add an HTTPS listener to the Gateway.

   apiVersion: gateway.networking.k8s.io/v1
   kind: Gateway
   metadata:
     name: my-gateway
   spec:
     gatewayClassName: tigera-gateway-class
     listeners:
       - name: http
         protocol: HTTP
         port: 80
       - name: https
         protocol: HTTPS
         port: 443
         tls:
           mode: Terminate
           certificateRefs:
             - name: my-tls-secret
   

   $ kubectl apply -f gateway.yaml
   

3. Create an HTTPRoute that targets the HTTPS listener.

   apiVersion: gateway.networking.k8s.io/v1
   kind: HTTPRoute
   metadata:
     name: my-secure-route
   spec:
     parentRefs:
       - name: my-gateway
         sectionName: https
     hostnames:
       - "secure.example.com"
     rules:
       - backendRefs:
           - name: my-service
             port: 80
   

   $ kubectl apply -f secure-route.yaml
   

4. Test HTTPS connectivity.

   $ curl -k -H "Host: secure.example.com" https://<node-ip>:<https-nodeport>/
   

Weighted Traffic Splitting (canary)

Route a percentage of traffic to a new version of a service by assigning weights to multiple backendRefs.

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: canary-route
spec:
  parentRefs:
    - name: my-gateway
  hostnames:
    - "app.example.com"
  rules:
    - backendRefs:
        - name: my-service-v1
          port: 80
          weight: 90
        - name: my-service-v2
          port: 80
          weight: 10

This sends 90% of traffic to v1 and 10% to v2. Adjust the weights to shift traffic progressively during a rollout.

TCP Routing

For non-HTTP workloads (for example, databases), use a TCPRoute.

1. Add a TCP listener to the Gateway.

   apiVersion: gateway.networking.k8s.io/v1
   kind: Gateway
   metadata:
     name: my-gateway
   spec:
     gatewayClassName: tigera-gateway-class
     listeners:
       - name: http
         protocol: HTTP
         port: 80
       - name: tcp
         protocol: TCP
         port: 5432
   

   $ kubectl apply -f gateway.yaml
   

2. Create the TCPRoute.

   apiVersion: gateway.networking.k8s.io/v1alpha2
   kind: TCPRoute
   metadata:
     name: my-tcp-route
   spec:
     parentRefs:
       - name: my-gateway
         sectionName: tcp
     rules:
       - backendRefs:
           - name: my-tcp-service
             port: 5432
   

   $ kubectl apply -f tcproute.yaml
   

TLS Passthrough

For workloads that handle their own TLS termination, use TLS passthrough mode. The gateway forwards encrypted traffic directly to the backend without decrypting it.

1. Add a TLS passthrough listener.

   apiVersion: gateway.networking.k8s.io/v1
   kind: Gateway
   metadata:
     name: my-gateway
   spec:
     gatewayClassName: tigera-gateway-class
     listeners:
       - name: tls-passthrough
         protocol: TLS
         port: 443
         tls:
           mode: Passthrough
   

2. Create a TLSRoute.

   apiVersion: gateway.networking.k8s.io/v1
   kind: TLSRoute
   metadata:
     name: my-tls-passthrough-route
   spec:
     parentRefs:
       - name: my-gateway
         sectionName: tls-passthrough
     hostnames:
       - "backend.example.com"
     rules:
       - backendRefs:
           - name: my-tls-backend
             port: 8443
   

Cleanup (Delete, Remove, or Uninstall Resources)

Remove resources in reverse order (routes first, then the gateway, then optionally disable the gateway infrastructure).

$ kubectl delete httproute my-route
$ kubectl delete httproute my-secure-route
$ kubectl delete tcproute my-tcp-route
$ kubectl delete gateway my-gateway

To disable the entire ingress gateway infrastructure:

$ kubectl delete gatewayapi default

Note

Deleting the GatewayAPI custom resource removes the GatewayClass, the Envoy Gateway controller, and all Gateway API CRDs. Deleting a Gateway causes all attached routes to become detached. Application services and deployments are not affected.