For the complete documentation index, see llms.txt. This page is also available as Markdown.

Example: Using Envoy Gateway for ingress

How to install and use Envoy's Gateway implementation to manage ingress for Subsalt.

Envoy Gateway

If you don't already have a Gateway implementation in your cluster, we recommend using Envoy's. It's straightforward to install and manage.

Install

1. Create the Envoy Gateway namespace

kubectl create namespace envoy-gateway-system

2. Create the registry pull secret

Envoy Gateway runs from Subsalt's hardened wrapper image in subsaltprod.azurecr.io. Create a pull secret in the Envoy Gateway namespace using the registry credentials Subsalt provided:

kubectl create secret docker-registry subsalt-registry-auth \
  --namespace envoy-gateway-system \
  --docker-server=subsaltprod.azurecr.io \
  --docker-username='<your-subsaltprod-username>' \
  --docker-password='<your-subsaltprod-password>'

3. Install the Envoy Gateway control plane

Install the upstream chart from its OCI registry, pinned to the version that matches your Subsalt release, and point the control-plane image at Subsalt's hardened image. Replace <subsalt-version> with the version tag of your Subsalt platform (the Envoy Gateway image is published under the same tag as the rest of your Subsalt images).

helm install envoy-gateway oci://docker.io/envoyproxy/gateway-helm \
  --version v1.8.2 \
  --namespace envoy-gateway-system \
  --set fullnameOverride=envoy-gateway \
  --set deployment.envoyGateway.image.repository=subsaltprod.azurecr.io/envoy-gateway \
  --set deployment.envoyGateway.image.tag=v1.0.0 \
  --set deployment.envoyGateway.imagePullSecrets[0].name=subsalt-registry-auth \
  --wait

4. Create the GatewayClass

The GatewayClass binds Gateways to the Envoy Gateway controller. It is operator-managed (the analog of an IngressClass) and is not created by the chart.

5. Create the Gateway

Create the Gateway in the same namespace as the Subsalt services and TLS secrets (subsalt here). Choose one option only. Both examples declare subsalt-frontend-gateway.

Use a public Gateway when the portal, authentication, and MCP hostnames resolve publicly. Replace each example hostname and secret name with your own values.

Use a private Gateway when these hostnames must resolve to an RFC 1918 address within your VNet. It is reachable through your private network, such as VPN, ExpressRoute, a peered VNet, or a jump host.

The EnvoyProxy configuration applies to this Gateway only. Azure provisions one internal load balancer for Envoy. The listeners share port 443 and route by hostname.

6. Create the HTTPRoutes

These routes send the three frontend hostnames to their Subsalt services. Use the same hostnames configured in the Gateway.

Last updated