Kubernetes Gateway API với Envoy Gateway: Thay thế Ingress-NGINX bằng Định tuyến Lưu lượng Hiện đại

helm install envoy-gateway --namespace envoy-gateway --create-namespace oci://docker.io/envoyproxy/envoy-gateway-helm --version v0.0.0

kubectl get pods -n envoy-gateway

NAME                                READY   STATUS    RESTARTS   AGE
envoy-gateway-0000000000-xxxxx      1/1     Running   0          2m
envoy-gateway-xxxxxxxxx-xxxxx       1/1     Running   0          2m

## Installation and Initial Setup

This section outlines the deployment of Envoy Gateway and the initial configuration of Gateway API resources.

### Prerequisites

*   A running Kubernetes cluster (v1.24+).
*   `kubectl` configured to connect to your cluster.
*   `helm` (v3.x+) installed.

### Installing Envoy Gateway

Envoy Gateway is typically installed via Helm.

```bash
# 1. Thêm kho lưu trữ Helm của Envoy Gateway
helm repo add envoy-gateway https://envoyproxy.github.io/gateway/
helm repo update

# 2. Tạo một namespace cho Envoy Gateway
kubectl create namespace envoy-gateway-system

# 3. Cài đặt Envoy Gateway
helm install envoy-gateway envoy-gateway/envoy-gateway -n envoy-gateway-system --version v0.0.0 # Thay thế bằng phiên bản ổn định mới nhất

kubectl get pods -n envoy-gateway-system
# Kết quả mong đợi (ví dụ):
# NAME                                        READY   STATUS    RESTARTS   AGE
# envoy-gateway-7b8c7d4f5-abcde               1/1     Running   0          2m
# envoy-gateway-bootstrap-7b8c7d4f5-abcde     1/1     Running   0          2m
# eg-gateway-proxy-7b8c7d4f5-abcde            1/1     Running   0          2m

kubectl get gatewayclass
# Kết quả mong đợi:
# NAME         CONTROLLER                         ACCEPTED   AGE
# eg-standard  gateway.envoyproxy.io/gatewayclass-controller   True       2m

# gateway.yaml
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: eg-public-gateway
  namespace: envoy-gateway-system # Gateway thường được triển khai trong namespace của bộ điều khiển
spec:
  gatewayClassName: eg-standard
  listeners:
    - name: http
      protocol: HTTP
      port: 80
      allowedRoutes:
        namespaces:
          from: All # Cho phép HTTPRoutes từ bất kỳ namespace nào được đính kèm
    - name: https
      protocol: HTTPS
      port: 443
      tls:
        mode: Terminate
        certificateRefs:
          - kind: Secret
            name: default-tls-cert # Secret này sẽ được tạo sau với cert-manager
      allowedRoutes:
        namespaces:
          from: All # Cho phép HTTPRoutes từ bất kỳ namespace nào được đính kèm

kubectl apply -f gateway.yaml

kubectl get gateway eg-public-gateway -n envoy-gateway-system -w
# Kết quả mong đợi (ví dụ):
# NAME              CLASS         ADDRESS         READY   HTTP    HTTPS   AGE
# eg-public-gateway eg-standard   <pending>       False   80      443     10s
# ...
# eg-public-gateway eg-standard   192.0.2.123     True    80      443     2m

# services.yaml (ví dụ dịch vụ backend)
apiVersion: v1
kind: Service
metadata:
  name: my-api-service
spec:
  selector:
    app: my-api
  ports:
    - protocol: TCP
      port: 80
      targetPort: 8080
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-api-deployment
spec:
  selector:
    matchLabels:
      app: my-api
  template:
    metadata:
      labels:
        app: my-api
    spec:
      containers:
        - name: api
          image: nginxdemos/hello:latest # Ảnh giữ chỗ
          ports:
            - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: my-web-service
spec:
  selector:
    app: my-web
  ports:
    - protocol: TCP
      port: 80
      targetPort: 8080
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-web-deployment
spec:
  selector:
    matchLabels:
      app: my-web
  template:
    metadata:
      labels:
        app: my-web
    spec:
      containers:
        - name: web
          image: nginxdemos/hello:latest # Ảnh giữ chỗ
          ports:
            - containerPort: 8080

# httproute-path.yaml
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: path-routing-example
  namespace: default
spec:
  parentRefs:
    - name: eg-public-gateway
      namespace: envoy-gateway-system
  hostnames:
    - "app.example.com"
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /api/v1
      backendRefs:
        - name: my-api-service
          port: 80
    - matches:
        - path:
            type: PathPrefix
            value: /web
      backendRefs:
        - name: my-web-service
          port: 80

kubectl apply -f services.yaml
kubectl apply -f httproute-path.yaml

# httproute-header.yaml
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: header-routing-example
  namespace: default
spec:
  parentRefs:
    - name: eg-public-gateway
      namespace: envoy-gateway-system
  hostnames:
    - "app.example.com"
  rules:
    - matches:
        - headers:
            - name: X-Internal-User
              value: "true"
          path:
            type: PathPrefix
            value: /admin
      backendRefs:
        - name: my-admin-service # Giả sử dịch vụ này tồn tại
          port: 80
    - matches:
        - path:
            type: PathPrefix
            value: /admin
      backendRefs:
        - name: my-public-service # Giả sử dịch vụ này tồn tại
          port: 80

# grpc-service.yaml (ví dụ backend gRPC)
apiVersion: v1
kind: Service
metadata:
  name: my-grpc-service
spec:
  selector:
    app: my-grpc-app
  ports:
    - protocol: TCP
      port: 50051
      targetPort: 50051
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-grpc-deployment
spec:
  selector:
    matchLabels:
      app: my-grpc-app
  template:
    metadata:
      labels:
        app: my-grpc-app
    spec:
      containers:
        - name: grpc-server
          image: grpc/go-grpc-example-server:latest # Máy chủ gRPC giữ chỗ
          ports:
            - containerPort: 50051

# grpcroute.yaml
apiVersion: gateway.networking.k8s.io/v1
kind: GRPCRoute
metadata:
  name: grpc-routing-example
  namespace: default
spec:
  parentRefs:
    - name: eg-public-gateway
      namespace: envoy-gateway-system
  hostnames:
    - "grpc.example.com"
  rules:
    - matches:
        - method:
            service: "helloworld.Greeter" # Tên dịch vụ gRPC
            method: "SayHello" # Tên phương thức gRPC
            type: Exact
      backendRefs:
        - name: my-grpc-service
          port: 50051
    - matches:
        - method:
            service: "helloworld.Greeter"
            type: Exact # Khớp với bất kỳ phương thức nào trong dịch vụ Greeter
      backendRefs:
        - name: my-grpc-service
          port: 50051

kubectl apply -f grpc-service.yaml
kubectl apply -f grpcroute.yaml

# tls-service.yaml (ví dụ backend TLS)
apiVersion: v1
kind: Service
metadata:
  name: my-secure-service
spec:
  selector:
    app: my-secure-app
  ports:
    - protocol: TCP
      port: 8443
      targetPort: 8443
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-secure-deployment
spec:
  selector:
    matchLabels:
      app: my-secure-app
  template:
    metadata:
      labels:
        app: my-secure-app
    spec:
      containers:
        - name: secure-app
          image: nginxdemos/hello:latest # Giữ chỗ, phải là ứng dụng hỗ trợ TLS
          ports:
            - containerPort: 8443

# tlsroute.yaml
apiVersion: gateway.networking.k8s.io/v1
kind: TLSRoute
metadata:
  name: tls-routing-example
  namespace: default
spec:
  parentRefs:
    - name: eg-public-gateway
      namespace: envoy-gateway-system
      sectionName: https # Đính kèm vào listener HTTPS
  hostnames:
    - "secure.example.com"
  rules:
    - backendRefs:
        - name: my-secure-service
          port: 8443

kubectl apply -f tls-service.yaml
kubectl apply -f tlsroute.yaml