Enable the Calico Ingress Gateway

Enable the Calico Ingress Gateway by creating a GatewayAPI custom resource. This triggers the tigera-operator to deploy the Envoy Gateway controller, install the Gateway API CRDs (HTTPRoute, TCPRoute, TLSRoute, GRPCRoute, UDPRoute), and create the GatewayClass.

Prerequisites

• The platform must be fully bootstrapped and the tigera-operator must be running. Confirm the operator pod shows READY 1/1 and STATUS Running:

  $ kubectl get pods -n tigera-operator
  NAME                               READY   STATUS    RESTARTS   AGE
  tigera-operator-7ccc7949dd-xxxxx   1/1     Running   0          ...
  

• Confirm all Calico components report AVAILABLE=True:

  $ kubectl get tigerastatus
  NAME      AVAILABLE   PROGRESSING   DEGRADED   SINCE   MESSAGE
  calico    True        False         False      ...     All objects available
  ippools   True        False         False      ...     All objects available
  

• The reference Kubernetes application service must be created before the API gateway routes are created. If a route references a non-existent service, it does not attach successfully.

Procedure

1. Create the GatewayAPI custom resource.

   $ kubectl apply -f - <<'EOF'
   apiVersion: operator.tigera.io/v1
   kind: GatewayAPI
   metadata:
     name: default
   spec:
     crdManagement: PreferExisting
     gatewayClasses:
     - name: tigera-gateway-class
   EOF
   

2. Wait for the gateway control plane to come up.

   $ kubectl wait --for=condition=established \
       crd/envoyproxies.gateway.envoyproxy.io --timeout=120s
   $ kubectl get pods -n tigera-gateway
   NAME                             READY   STATUS    RESTARTS   AGE
   envoy-gateway-...                1/1     Running   0          ...
   

3. Confirm the GatewayClass is accepted.

   $ kubectl get gatewayclass
   NAME                   CONTROLLER                                      ACCEPTED   AGE
   tigera-gateway-class   gateway.envoyproxy.io/gatewayclass-controller   True       ...
   

4. Check the Gatewayapi status.

   $ kubectl get tigerastatus
   NAME         AVAILABLE   PROGRESSING   DEGRADED   SINCE   MESSAGE
   calico       True        False         False      ...     All objects available
   gatewayapi   True        False         False      ...     All objects available
   ippools      True        False         False      ...     All objects available
   

The gatewayapi entry reports Available=True.

For IPv6-only or dual-stack clusters, additional configuration is required after enablement. See Calico Ingress Gateway IPv6 and Dual-Stack Setup.