feat: add multi-gateway namespace support with hybrid gateway capabil… #1325
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ities
This feature adds comprehensive multi-gateway support to the Envoy Gateway setup script,
enabling flexible deployments that can separate external and internal services with
appropriate security configurations.
Features:
- Configuration file mode (--config) for YAML-based multi-gateway setup
- Namespace isolation for each gateway (improved security and organization)
- Hybrid gateway support (external-only, internal-only, or both)
- Flexible certificate management (Let's Encrypt or self-signed per gateway)
- Route and listener processing for multiple gateways
- Support for multiple MetalLB pools per gateway
- Internal gateways accessible on port 443 (same as external)
- Backward compatibility with legacy single gateway mode
Configuration Format:
The new --config option accepts YAML files defining multiple gateways:
gateways:
- name: external-gateway
namespace: external-gateway
domain: cloud.example.com
type: [external]
metallb_pools:
external: gateway-api-external
issuer:
type: letsencrypt
email: [email protected]
routes:
- keystone
- nova
- neutron
Key Improvements:
- Each gateway runs in its own namespace for better isolation
- Routes are automatically created for each gateway type
- Listeners are applied to all gateways
- Support for multiple DNS providers (Cloudflare, Route53, Azure DNS, etc.)
- Comprehensive error handling and validation
Files Added:
- examples/gateway-config.yaml: Comprehensive example configuration
- examples/simple-gateway-config.yaml: Simple setup example
- docs/gateway-setup.md: Complete usage documentation
Files Modified:
- bin/setup-envoy-gateway.sh: Enhanced with multi-gateway support
Backward Compatibility:
- Legacy single gateway mode still works unchanged
- Existing --email, --domain, --challenge options preserved
- Interactive mode still available
- All DNS plugins supported in both modes
Contributor
Author
|
I've done all the testing I can. I need some help testing the different challenge modes. Also, I need to figure out how we want to create the "internal" ipaddresspools and l2advertisemnets for metallb. Right now we have to manually create that if we try to deploy with an internal httproute. |
Contributor
|
checks failing. please fix and resubmit your pr |
rackerchris
requested changes
Nov 24, 2025
Contributor
There was a problem hiding this comment.
please add --- to beginning of file.
| namespace: envoy-gateway | ||
| sectionName: longhorn-https | ||
| rules: | ||
| - backendRefs: |
Contributor
There was a problem hiding this comment.
incorrect indentation. You will need to run this pr through yamllint and correct any errors/warnings.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
…ities
This feature adds comprehensive multi-gateway support to the Envoy Gateway setup script, enabling flexible deployments that can separate external and internal services with appropriate security configurations.
Features:
Configuration Format:
The new --config option accepts YAML files defining multiple gateways:
gateways:
- name: external-gateway namespace: external-gateway domain: cloud.example.com type: [external] metallb_pools: external: gateway-api-external issuer: type: letsencrypt email: [email protected] routes: - keystone - nova - neutron
Key Improvements:
Files Added:
Files Modified:
Backward Compatibility: