Gateway API

kubectl get gateway -A                                           # PROGRAMMED column and ADDRESS
kubectl get httproute -A
kubectl describe httproute my-app -n my-namespace | sed -n '/Status:/,$p'
kubectl get endpointslice -n my-namespace -l kubernetes.io/service-name=my-app

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: web
  namespace: infra
spec:
  gatewayClassName: my-gateway-class
  listeners:
    - name: https
      protocol: HTTPS
      port: 443
      hostname: "*.example.com"
      tls:
        mode: Terminate
        certificateRefs:
          - { kind: Secret, name: wildcard-example-com }   # same namespace as the Gateway
      allowedRoutes:
        namespaces:
          from: Selector
          selector:
            matchLabels: { gateway-access: "true" }
    - name: http
      protocol: HTTP
      port: 80
      hostname: "*.example.com"

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: my-app
  namespace: my-namespace
spec:
  parentRefs:
    - { name: web, namespace: infra, sectionName: https }
  hostnames: ["app.example.com"]
  rules:
    - matches:
        - path: { type: PathPrefix, value: /v2 }
      backendRefs:
        - { name: my-app-v2, port: 80, weight: 90 }
        - { name: my-app-canary, port: 80, weight: 10 }
    - matches:
        - path: { type: Exact, value: /healthz }
      backendRefs: [{ name: my-app, port: 80 }]
      timeouts: { request: 2s }                  # extended support; check your implementation
    - matches:
        - headers: [{ name: x-beta, value: "true" }]
      backendRefs: [{ name: my-app-beta, port: 80 }]

apiVersion: gateway.networking.k8s.io/v1     # v1 since Gateway API v1.5; use v1beta1 on older CRDs
kind: ReferenceGrant
metadata:
  name: allow-my-namespace-routes
  namespace: shared
spec:
  from:
    - { group: gateway.networking.k8s.io, kind: HTTPRoute, namespace: my-namespace }
  to:
    - { group: "", kind: Service, name: shared-api }

  rules:
    - matches: [{ path: { type: PathPrefix, value: /api } }]
      filters:
        - type: RequestHeaderModifier
          requestHeaderModifier:
            set: [{ name: x-env, value: prod }]
            remove: ["x-internal"]
        - type: URLRewrite
          urlRewrite:
            path: { type: ReplacePrefixMatch, replacePrefixMatch: / }   # /api/users -> /users
        - type: RequestMirror
          requestMirror:
            backendRef: { name: my-app-shadow, port: 80 }
            percent: 10                                                  # mirror 10% of requests
      backendRefs: [{ name: my-app, port: 80 }]
---
# HTTP to HTTPS redirect: a separate route attached to the port 80 listener, with no backendRefs
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata: { name: https-redirect, namespace: infra }
spec:
  parentRefs: [{ name: web, sectionName: http }]
  rules:
    - filters:
        - type: RequestRedirect
          requestRedirect: { scheme: https, statusCode: 301 }

  rules:
    - matches:
        - path: { type: PathPrefix, value: /api }
          method: GET                                          # standard HTTP method names, upper case
          queryParams: [{ name: version, value: "2" }]         # Exact by default
        - path: { type: RegularExpression, value: "^/v[0-9]+/users/[0-9]+$" }   # implementation-specific dialect
          headers:
            - { type: RegularExpression, name: user-agent, value: "^Mozilla.*" }
      backendRefs: [{ name: my-app, port: 80 }]

kubectl explain httproute.spec.rules.matches.path        # allowed path types
kubectl explain httproute.spec.rules.filters --recursive | head -60
kubectl explain httproute.spec.rules.retry 2>/dev/null || echo "retry not in this CRD bundle"

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata: { name: edge, namespace: infra }
spec:
  gatewayClassName: my-gateway-class
  listeners:
    - name: https
      protocol: HTTPS
      port: 443
      hostname: "*.example.com"
      tls:
        mode: Terminate
        certificateRefs:
          - { kind: Secret, name: wildcard-example-com, namespace: certs }   # needs a ReferenceGrant in certs
        options:
          example.com/min-tls-version: "1.2"        # options are implementation-defined key/value pairs
    - name: tls-passthrough
      protocol: TLS
      port: 8443
      hostname: db.example.com
      tls: { mode: Passthrough }                    # no certificateRefs; the backend terminates
      allowedRoutes: { kinds: [{ kind: TLSRoute }] }
---
apiVersion: gateway.networking.k8s.io/v1
kind: TLSRoute
metadata: { name: db, namespace: my-namespace }
spec:
  parentRefs: [{ name: edge, namespace: infra, sectionName: tls-passthrough }]
  hostnames: [db.example.com]
  rules:
    - backendRefs: [{ name: my-db, port: 5432 }]
---
apiVersion: gateway.networking.k8s.io/v1
kind: ReferenceGrant
metadata: { name: allow-infra-gateways, namespace: certs }
spec:
  from: [{ group: gateway.networking.k8s.io, kind: Gateway, namespace: infra }]
  to: [{ group: "", kind: Secret }]                # omit name to allow every Secret in the namespace

apiVersion: gateway.networking.k8s.io/v1          # v1 since Gateway API v1.4
kind: BackendTLSPolicy
metadata: { name: my-app-tls, namespace: my-namespace }
spec:
  targetRefs: [{ group: "", kind: Service, name: my-app }]
  validation:
    hostname: my-app.my-namespace.svc.cluster.local   # SNI sent and name verified on the backend certificate
    caCertificateRefs: [{ group: "", kind: ConfigMap, name: internal-ca }]   # ConfigMap with a ca.crt key
    # wellKnownCACertificates: System                 # alternative: trust the gateway's system CA bundle

  rules:
    - matches: [{ headers: [{ name: x-canary, value: always }] }]   # more header matches wins precedence
      backendRefs: [{ name: my-app-v2, port: 80 }]
    - matches: [{ path: { type: PathPrefix, value: / } }]
      backendRefs:
        - { name: my-app-v1, port: 80, weight: 95 }
        - { name: my-app-v2, port: 80, weight: 5 }

kubectl patch httproute my-app -n my-namespace --type json -p '[
  {"op":"replace","path":"/spec/rules/1/backendRefs/0/weight","value":50},
  {"op":"replace","path":"/spec/rules/1/backendRefs/1/weight","value":50}]'

apiVersion: gateway.networking.k8s.io/v1
kind: GRPCRoute
metadata: { name: my-grpc, namespace: my-namespace }
spec:
  parentRefs: [{ name: web, namespace: infra, sectionName: https }]
  hostnames: [grpc.example.com]
  rules:
    - matches:
        - method: { service: my.package.UserService, method: GetUser }   # type Exact by default
      backendRefs: [{ name: my-grpc, port: 9090 }]

  rules:
    - backendRefs: [{ name: my-app, port: 80 }]
      timeouts: { request: 10s, backendRequest: 3s }
      retry:                                       # GEP-1731; check kubectl explain before relying on it
        attempts: 2                                # retries after the first attempt
        codes: [502, 503, 504]                     # 500-504 must be supported; connection errors always retry
        backoff: 100ms

kubectl api-resources --api-group=gateway.envoyproxy.io -o name          # which policy kinds exist
kubectl get backendtrafficpolicy,securitypolicy -A 2>/dev/null           # what is attached where

# Every route and the parents it claims
kubectl get httproute -A -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}{"\t"}{.spec.parentRefs[*].name}{"\n"}{end}'

# Routes that failed to attach to at least one parent
kubectl get httproute -A -o json | jq -r '.items[] | select([.status.parents[]?.conditions[]? | select(.type=="Accepted" and .status!="True")] | length > 0) | "\(.metadata.namespace)/\(.metadata.name)"'

# Attached route count per listener
kubectl get gateway -A -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}{"\t"}{range .status.listeners[*]}{.name}={.attachedRoutes}{" "}{end}{"\n"}{end}'

# Gateway addresses
kubectl get gateway -A -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}{"\t"}{.status.addresses[*].value}{"\n"}{end}'

# Hit a host through the gateway address, ignoring DNS and keeping SNI correct
curl -sv --resolve app.example.com:443:"$(kubectl get gateway web -n infra -o jsonpath='{.status.addresses[0].value}')" https://app.example.com/healthz

# Certificates referenced by every listener
kubectl get gateway -A -o json | jq -r '.items[].spec.listeners[]?.tls?.certificateRefs[]?.name' | sort -u

# Backends referenced by routes that have no EndpointSlice (same-namespace refs)
kubectl get httproute -A -o json | jq -r '.items[] | .metadata.namespace as $ns | .spec.rules[].backendRefs[]? | "\(.namespace // $ns) \(.name)"' | sort -u | while read -r ns svc; do kubectl get endpointslice -n "$ns" -l kubernetes.io/service-name="$svc" --no-headers 2>/dev/null | grep -q . || echo "$ns/$svc has no endpoints"; done

# Controller errors (Envoy Gateway; substitute your implementation's namespace and deployment)
kubectl logs -n envoy-gateway-system deploy/envoy-gateway --tail 200 | grep -iE 'error|reject'

# Installed CRD bundle version and channel
kubectl get crd gateways.gateway.networking.k8s.io -o jsonpath='{.metadata.annotations.gateway\.networking\.k8s\.io/bundle-version}{"\t"}{.metadata.annotations.gateway\.networking\.k8s\.io/channel}{"\n"}'

# Which Gateway API kinds are installed at all
kubectl api-resources --api-group=gateway.networking.k8s.io -o name

# GatewayClasses and whether a controller has accepted them
kubectl get gatewayclass -o custom-columns='NAME:.metadata.name,CONTROLLER:.spec.controllerName,ACCEPTED:.status.conditions[?(@.type=="Accepted")].status'

# Every hostname served by any route, with the route that claims it
kubectl get httproute,grpcroute,tlsroute -A -o json | jq -r '.items[] | .metadata.namespace as $ns | .metadata.name as $n | .kind as $k | .spec.hostnames[]? | "\(.)\t\($k) \($ns)/\($n)"' | sort

# Hostnames claimed by more than one route (precedence surprises live here)
kubectl get httproute -A -o json | jq -r '.items[].spec.hostnames[]?' | sort | uniq -d

# Routes whose status lags their spec (controller has not reconciled the latest edit)
kubectl get httproute -A -o json | jq -r '.items[] | select(.metadata.generation != (.status.parents[0].conditions[0].observedGeneration // 0)) | "\(.metadata.namespace)/\(.metadata.name) gen=\(.metadata.generation)"'

# Every listener with its protocol, port, hostname and TLS mode
kubectl get gateway -A -o json | jq -r '.items[] | .metadata.namespace as $ns | .metadata.name as $n | .spec.listeners[] | "\($ns)/\($n)\t\(.name)\t\(.protocol):\(.port)\t\(.hostname // "*")\t\(.tls.mode // "-")"'

# Listeners in conflict
kubectl get gateway -A -o json | jq -r '.items[] | .metadata.namespace as $ns | .metadata.name as $n | .status.listeners[]? | select(any(.conditions[]; .type=="Conflicted" and .status=="True")) | "\($ns)/\($n) listener \(.name)"'

# Weighted splits currently in force
kubectl get httproute -A -o json | jq -r '.items[] | .metadata.namespace as $ns | .metadata.name as $n | .spec.rules[] | select((.backendRefs // []) | length > 1) | "\($ns)/\($n)\t" + ([.backendRefs[] | "\(.name)=\(.weight // 1)"] | join(" "))'

# Shift a canary to 50/50 (rule index 1, backends 0 and 1)
kubectl patch httproute my-app -n my-namespace --type json -p '[{"op":"replace","path":"/spec/rules/1/backendRefs/0/weight","value":50},{"op":"replace","path":"/spec/rules/1/backendRefs/1/weight","value":50}]'

# All ReferenceGrants and what they permit
kubectl get referencegrant -A -o json | jq -r '.items[] | .metadata.namespace as $ns | "\($ns)/\(.metadata.name)\tfrom " + ([.spec.from[] | "\(.kind)@\(.namespace)"] | join(",")) + "\tto " + ([.spec.to[] | "\(.kind)/\(.name // "*")"] | join(","))'

# Cross-namespace backendRefs that have no matching ReferenceGrant
kubectl get httproute -A -o json | jq -r '.items[] | .metadata.namespace as $ns | .spec.rules[].backendRefs[]? | select(.namespace != null and .namespace != $ns) | "\($ns) -> \(.namespace)/\(.name)"' | sort -u | while read -r from _ to; do ns=${to%%/*}; kubectl get referencegrant -n "$ns" -o json | jq -e --arg f "$from" '.items[].spec.from[] | select(.kind=="HTTPRoute" and .namespace==$f)' >/dev/null 2>&1 || echo "no grant in $ns for routes from $from"; done

# Certificate the gateway actually serves for a hostname
openssl s_client -connect "$(kubectl get gateway web -n infra -o jsonpath='{.status.addresses[0].value}')":443 -servername app.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

# Days until each listener certificate expires
kubectl get gateway -A -o json | jq -r '.items[] | .metadata.namespace as $ns | .spec.listeners[].tls.certificateRefs[]? | "\(.namespace // $ns) \(.name)"' | sort -u | while read -r ns s; do exp=$(kubectl get secret -n "$ns" "$s" -o jsonpath='{.data.tls\.crt}' | base64 -d | openssl x509 -noout -enddate | cut -d= -f2); echo "$ns/$s $(( ($(date -d "$exp" +%s) - $(date +%s)) / 86400 ))d"; done

# Watch a route's conditions change while you edit it
kubectl get httproute my-app -n my-namespace -w -o jsonpath='{.status.parents[0].conditions[*].reason}{"\n"}'

# Does a header-based canary match: send the header and read which backend answered
curl -s -o /dev/null -w '%{http_code} %{time_total}s\n' -H 'x-canary: always' --resolve app.example.com:443:"$GW_IP" https://app.example.com/

# Fire 100 requests and count status codes during a weight shift
for _ in $(seq 100); do curl -s -o /dev/null -w '%{http_code}\n' --resolve app.example.com:443:"$GW_IP" https://app.example.com/; done | sort | uniq -c

# Live-render what kubectl would send before applying a route edit
kubectl apply -f route.yaml --dry-run=server -o yaml | yq '.status // "no status: object is new"'

# Delete every route that points at a Service which no longer exists (prints first; remove echo to act)
kubectl get httproute -A -o json | jq -r '.items[] | .metadata.namespace as $ns | .metadata.name as $n | .spec.rules[].backendRefs[]? | "\($ns) \($n) \(.namespace // $ns) \(.name)"' | sort -u | while read -r rns rn sns svc; do kubectl get svc -n "$sns" "$svc" >/dev/null 2>&1 || echo kubectl delete httproute -n "$rns" "$rn"; done

#!/usr/bin/env bash
# gateway-status.sh: one line per Gateway listener and per Route parent with the conditions that matter
set -euo pipefail

cond() { jq -r --arg t "$2" '[.[]? | select(.type==$t)][0] | "\(.status // "?")/\(.reason // "-")"' <<<"$1"; }

printf '== Gateways ==\n'
kubectl get gateway -A -o json | jq -c '.items[]' | while read -r gw; do
  ns=$(jq -r .metadata.namespace <<<"$gw"); name=$(jq -r .metadata.name <<<"$gw")
  addr=$(jq -r '[.status.addresses[]?.value] | join(",") // "-"' <<<"$gw")
  prog=$(cond "$(jq '.status.conditions' <<<"$gw")" Programmed)
  printf '%s/%s addr=%s programmed=%s\n' "$ns" "$name" "${addr:--}" "$prog"
  jq -c '.status.listeners[]?' <<<"$gw" | while read -r l; do
    printf '  listener %-16s routes=%-3s accepted=%s resolved=%s conflicted=%s\n' \
      "$(jq -r .name <<<"$l")" "$(jq -r .attachedRoutes <<<"$l")" \
      "$(cond "$(jq .conditions <<<"$l")" Accepted)" "$(cond "$(jq .conditions <<<"$l")" ResolvedRefs)" \
      "$(cond "$(jq .conditions <<<"$l")" Conflicted)"
  done
done

printf '\n== Routes ==\n'
for kind in httproute grpcroute tlsroute; do
  kubectl get "$kind" -A -o json 2>/dev/null | jq -c '.items[]' | while read -r r; do
    ns=$(jq -r .metadata.namespace <<<"$r"); name=$(jq -r .metadata.name <<<"$r")
    parents=$(jq -c '.status.parents // []' <<<"$r")
    if [ "$parents" = "[]" ]; then printf '%s %s/%s NO STATUS (unseen by any controller)\n' "$kind" "$ns" "$name"; continue; fi
    jq -c '.[]' <<<"$parents" | while read -r p; do
      printf '%s %s/%s -> %s/%s accepted=%s resolved=%s\n' "$kind" "$ns" "$name" \
        "$(jq -r '.parentRef.namespace // "'"$ns"'"' <<<"$p")" "$(jq -r .parentRef.name <<<"$p")" \
        "$(cond "$(jq .conditions <<<"$p")" Accepted)" "$(cond "$(jq .conditions <<<"$p")" ResolvedRefs)"
    done
  done
done

#!/usr/bin/env bash
# canary-promote.sh ROUTE NAMESPACE RULE_INDEX STABLE_IDX CANARY_IDX HOST
# Steps the canary weight through 5, 25, 50, 100 and rolls back on a 5xx rate above 2%.
set -euo pipefail
route=$1 ns=$2 rule=$3 stable=$4 canary=$5 host=$6
gw_ip=${GW_IP:?set GW_IP to the gateway address}
canary_svc=$(kubectl get httproute "$route" -n "$ns" -o jsonpath="{.spec.rules[$rule].backendRefs[$canary].name}")

set_weights() {
  kubectl patch httproute "$route" -n "$ns" --type json -p "[
    {\"op\":\"replace\",\"path\":\"/spec/rules/$rule/backendRefs/$stable/weight\",\"value\":$((100 - $1))},
    {\"op\":\"replace\",\"path\":\"/spec/rules/$rule/backendRefs/$canary/weight\",\"value\":$1}]" >/dev/null
}
rollback() { echo "rolling back: canary weight 0" >&2; set_weights 0; exit 1; }
trap rollback ERR

ready=$(kubectl get endpointslice -n "$ns" -l kubernetes.io/service-name="$canary_svc" -o json | jq '[.items[].endpoints[]? | select(.conditions.ready==true)] | length')
[ "$ready" -gt 0 ] || { echo "no ready endpoints behind $canary_svc" >&2; exit 1; }

for w in 5 25 50 100; do
  set_weights "$w"; echo "canary=$w% stable=$((100 - w))%"
  sleep "${SETTLE:-30}"
  total=0 errors=0
  for _ in $(seq "${PROBES:-100}"); do
    code=$(curl -s -o /dev/null -w '%{http_code}' --max-time 5 --resolve "$host:443:$gw_ip" "https://$host/" || echo 000)
    total=$((total + 1)); case $code in 5*|000) errors=$((errors + 1));; esac
  done
  echo "  probes=$total errors=$errors"
  [ $((errors * 100 / total)) -le 2 ] || rollback
done
echo "promotion complete"