Traffic In: Gateway API, cert-manager, and ExternalDNS

1. 1

   Install Envoy Gateway through Argo CD

   Envoy Gateway is a CNCF Gateway API implementation built on Envoy (Networking course, HAProxy & Envoy). The chart installs the Gateway API CRDs too. The pattern for every add-on is the same: an Application pinned to a chart version.

   apiVersion: argoproj.io/v1alpha1
   kind: Application
   metadata:
     name: envoy-gateway
     namespace: argocd
     annotations: { argocd.argoproj.io/sync-wave: "-5" }
   spec:
     project: default
     source:
       repoURL: docker.io/envoyproxy
       chart: gateway-helm
       targetRevision: v1.5.1
     destination:
       server: https://kubernetes.default.svc
       namespace: envoy-gateway-system
     syncPolicy:
       automated: { prune: true, selfHeal: true }
       syncOptions: [CreateNamespace=true, ServerSideApply=true]

2. 2

   Install cert-manager and a Let's Encrypt ClusterIssuer

   Add cert-manager-app.yaml the same way (chart cert-manager from https://charts.jetstack.io, crds.enabled: true, and config.enableGatewayAPI: true). The ClusterIssuer uses the DNS-01 challenge through Route 53, which works for wildcard certificates and private load balancers. cert-manager's service account gets an IAM role (Pod Identity) allowed to change only the shoplite.dev zone.

   Use Let's Encrypt's STAGING server first: production has strict rate limits, and a misconfigured issuer retrying in a loop can lock you out for a week.

   apiVersion: cert-manager.io/v1
   kind: ClusterIssuer
   metadata:
     name: letsencrypt
   spec:
     acme:
       server: https://acme-v02.api.letsencrypt.org/directory
       # server: https://acme-staging-v02.api.letsencrypt.org/directory   # test first
       email: platform@shoplite.dev
       privateKeySecretRef: { name: letsencrypt-account-key }
       solvers:
         - dns01:
             route53: { region: ap-south-1 }
           selector:
             dnsZones: ["shoplite.dev"]

3. 3

   Install ExternalDNS for Route 53

   Chart external-dns from https://kubernetes-sigs.github.io/external-dns/. The values that matter: watch Gateway API routes, limit to your zone, and mark ownership.

   apiVersion: argoproj.io/v1alpha1
   kind: Application
   metadata:
     name: external-dns
     namespace: argocd
   spec:
     project: default
     source:
       repoURL: https://kubernetes-sigs.github.io/external-dns/
       chart: external-dns
       targetRevision: 1.19.0
       helm:
         valuesObject:
           provider: { name: aws }
           sources: [service, gateway-httproute]
           domainFilters: [shoplite.dev]
           policy: upsert-only
           txtOwnerId: shoplite-prod-eks
           serviceAccount:
             name: external-dns     # bound to an IAM role with route53:ChangeResourceRecordSets on this zone
     destination:
       server: https://kubernetes.default.svc
       namespace: external-dns
     syncPolicy:
       automated: { prune: true, selfHeal: true }
       syncOptions: [CreateNamespace=true]

4. 4

   The shared Gateway, owned by the platform

   One Gateway with an HTTPS listener for *.shoplite.dev. The cert-manager.io/cluster-issuer annotation makes cert-manager create the wildcard certificate Secret the listener references. allowedRoutes lets only namespaces labelled shoplite.dev/expose: "true" attach routes, which is a guardrail the platform controls.

   apiVersion: gateway.networking.k8s.io/v1
   kind: GatewayClass
   metadata: { name: envoy }
   spec:
     controllerName: gateway.envoyproxy.io/gatewayclass-controller
   ---
   apiVersion: gateway.networking.k8s.io/v1
   kind: Gateway
   metadata:
     name: shop-gw
     namespace: gateway
     annotations:
       cert-manager.io/cluster-issuer: letsencrypt
   spec:
     gatewayClassName: envoy
     listeners:
       - name: https
         protocol: HTTPS
         port: 443
         hostname: "*.shoplite.dev"
         tls:
           mode: Terminate
           certificateRefs: [{ name: wildcard-shoplite-dev }]
         allowedRoutes:
           namespaces:
             from: Selector
             selector:
               matchLabels: { shoplite.dev/expose: "true" }
       - name: http
         protocol: HTTP
         port: 80
         hostname: "*.shoplite.dev"
         allowedRoutes: { namespaces: { from: Same } }

5. 5

   A team exposes its service with one HTTPRoute

   This file lives in the TEAM's config (the GitOps repo from the GitOps course). The platform handles the certificate, DNS, and load balancer. The team only states hostname, path, and backend.

   apiVersion: gateway.networking.k8s.io/v1
   kind: HTTPRoute
   metadata:
     name: checkout
   spec:
     parentRefs:
       - { name: shop-gw, namespace: gateway, sectionName: https }
     hostnames: ["checkout.shoplite.dev"]
     rules:
       - matches: [{ path: { type: PathPrefix, value: / } }]
         backendRefs: [{ name: checkout, port: 80 }]

   terminalcopy cmd

   $ kubectl label ns checkout shoplite.dev/expose=true

   kubectl -n checkout get httproute checkout -o jsonpath='{.status.parents[0].conditions[?(@.type=="Accepted")].status}'; echo

   kubectl -n gateway get certificate

   kubectl -n external-dns logs deploy/external-dns | grep -m1 checkout

   curl -sI https://checkout.shoplite.dev/healthz | head -1

   ── expected output ──

   True

   NAME READY SECRET AGE

   wildcard-shoplite-dev True wildcard-shoplite-dev 6m

   level=info msg="Desired change: CREATE checkout.shoplite.dev A" profile=default zoneName=shoplite.dev.

   HTTP/2 200

Make each change, run the command, and read the error before revealing the diagnosis. Recognising these messages on sight is what makes you fast on a real team. Undo the change afterwards.