Example: Using Envoy Gateway for ingress

How to install and use Envoy's Gateway implementation to manage ingress for Subsalt.

Envoy Gateway

If you don't already have a Gateway implementation in your cluster, we recommend using Envoy's. It's straightforward to install and manage.

Install

1. Create the Envoy Gateway namespace

kubectl create namespace envoy-gateway-system

2. Create the registry pull secret

Envoy Gateway runs from Subsalt's hardened wrapper image in subsaltprod.azurecr.io. Create a pull secret in the Envoy Gateway namespace using the registry credentials Subsalt provided:

kubectl create secret docker-registry subsalt-registry-auth \
  --namespace envoy-gateway-system \
  --docker-server=subsaltprod.azurecr.io \
  --docker-username='<your-subsaltprod-username>' \
  --docker-password='<your-subsaltprod-password>'

3. Install the Envoy Gateway control plane

Install the upstream chart from its OCI registry, pinned to the version that matches your Subsalt release, and point the control-plane image at Subsalt's hardened image. Replace <subsalt-version> with the version tag of your Subsalt platform (the Envoy Gateway image is published under the same tag as the rest of your Subsalt images).

helm install envoy-gateway oci://docker.io/envoyproxy/gateway-helm \
  --version v1.8.2 \
  --namespace envoy-gateway-system \
  --set fullnameOverride=envoy-gateway \
  --set deployment.envoyGateway.image.repository=subsaltprod.azurecr.io/envoy-gateway \
  --set deployment.envoyGateway.image.tag=v1.0.0 \
  --set deployment.envoyGateway.imagePullSecrets[0].name=subsalt-registry-auth \
  --wait

4. Create the GatewayClass

The GatewayClass binds Gateways to the Envoy Gateway controller. It is operator-managed (the analog of an IngressClass) and is not created by the chart.

kubectl apply -f - <<'EOF'
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: envoy-gateway
spec:
  controllerName: gateway.envoyproxy.io/gatewayclass-controller
EOF

5. Create the Gateway

Create the Gateway in the same namespace as the Subsalt services and TLS secrets (subsalt here). Choose one option only. Both examples declare subsalt-frontend-gateway.

Public Gateway

Use a public Gateway when the portal, authentication, and MCP hostnames resolve publicly. Replace each example hostname and secret name with your own values.

kubectl apply -f - <<'EOF'
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: subsalt-frontend-gateway
  namespace: subsalt
spec:
  gatewayClassName: envoy-gateway
  listeners:
    - name: portal-https
      protocol: HTTPS
      port: 443
      hostname: portal.example.com
      tls:
        mode: Terminate
        certificateRefs:
          - kind: Secret
            name: portal-tls
      allowedRoutes:
        namespaces:
          from: Same
    - name: auth-https
      protocol: HTTPS
      port: 443
      hostname: auth.example.com
      tls:
        mode: Terminate
        certificateRefs:
          - kind: Secret
            name: auth-tls
      allowedRoutes:
        namespaces:
          from: Same
    - name: mcp-https
      protocol: HTTPS
      port: 443
      hostname: mcp.example.com
      tls:
        mode: Terminate
        certificateRefs:
          - kind: Secret
            name: mcp-tls
      allowedRoutes:
        namespaces:
          from: Same
EOF

Private Gateway (Azure)

Use a private Gateway when these hostnames must resolve to an RFC 1918 address within your VNet. It is reachable through your private network, such as VPN, ExpressRoute, a peered VNet, or a jump host.

kubectl apply -f - <<'EOF'
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyProxy
metadata:
  name: internal-frontend
  namespace: subsalt
spec:
  provider:
    type: Kubernetes
    kubernetes:
      envoyService:
        type: LoadBalancer
        annotations:
          service.beta.kubernetes.io/azure-load-balancer-internal: "true"
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: subsalt-frontend-gateway
  namespace: subsalt
spec:
  gatewayClassName: envoy-gateway
  infrastructure:
    parametersRef:
      group: gateway.envoyproxy.io
      kind: EnvoyProxy
      name: internal-frontend
  listeners:
    - name: portal-https
      protocol: HTTPS
      port: 443
      hostname: portal.example.com
      tls:
        mode: Terminate
        certificateRefs:
          - kind: Secret
            name: portal-tls
      allowedRoutes:
        namespaces:
          from: Same
    - name: auth-https
      protocol: HTTPS
      port: 443
      hostname: auth.example.com
      tls:
        mode: Terminate
        certificateRefs:
          - kind: Secret
            name: auth-tls
      allowedRoutes:
        namespaces:
          from: Same
    - name: mcp-https
      protocol: HTTPS
      port: 443
      hostname: mcp.example.com
      tls:
        mode: Terminate
        certificateRefs:
          - kind: Secret
            name: mcp-tls
      allowedRoutes:
        namespaces:
          from: Same
EOF

The EnvoyProxy configuration applies to this Gateway only. Azure provisions one internal load balancer for Envoy. The listeners share port 443 and route by hostname.

6. Create the HTTPRoutes

These routes send the three frontend hostnames to their Subsalt services. Use the same hostnames configured in the Gateway.

kubectl apply -f - <<'EOF'
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: subsalt-portal
  namespace: subsalt
spec:
  parentRefs:
    - name: subsalt-frontend-gateway
      sectionName: portal-https
  hostnames:
    - portal.example.com
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: subsalt-portal-http
          port: 80
      # Extended timeout for long-running query operations.
      timeouts:
        request: "3600s"
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: subsalt-auth
  namespace: subsalt
spec:
  parentRefs:
    - name: subsalt-frontend-gateway
      sectionName: auth-https
  hostnames:
    - auth.example.com
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: subsalt-keycloak
          port: 80
      timeouts:
        request: "3600s"
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: subsalt-mcp
  namespace: subsalt
spec:
  parentRefs:
    - name: subsalt-frontend-gateway
      sectionName: mcp-https
  hostnames:
    - mcp.example.com
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: subsalt-mcp-server
          port: 80
      timeouts:
        request: "3600s"
EOF