执行部署# https://gateway.envoyproxy.io/docs/install/install-helm/ # 安装网关 API CRD 和 Envoy 网关 helm install eg oci://docker.io/envoyproxy/gateway-helm --version v1.7.3 -n envoy-gateway-system --create-namespace创建测试应用kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/v1.7.3/quickstart.yaml -n default # 查看访问地址 cbyDESKTOP-IKRNJQE:~$ kubectl get svc -n envoy-gateway-system NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE envoy-default-eg-e41e7b31 LoadBalancer 10.68.120.80 192.168.1.15 80:32116/TCP 6s envoy-gateway ClusterIP 10.68.64.83 none 18000/TCP,18001/TCP,18002/TCP,19001/TCP,9443/TCP 30m cbyDESKTOP-IKRNJQE:~$测试访问cbyDESKTOP-IKRNJQE:~$ curl --verbose --header Host: www.example.com http://192.168.1.15/get * Trying 192.168.1.15:80... * Established connection to 192.168.1.15 (192.168.1.15 port 80) from 172.30.72.41 port 39072 * using HTTP/1.x GET /get HTTP/1.1 Host: www.example.com User-Agent: curl/8.18.0 Accept: */* * Request completely sent off HTTP/1.1 200 OK content-type: application/json x-content-type-options: nosniff date: Mon, 11 May 2026 13:51:37 GMT content-length: 475 { path: /get, host: www.example.com, method: GET, proto: HTTP/1.1, headers: { Accept: [ */* ], User-Agent: [ curl/8.18.0 ], X-Envoy-External-Address: [ 192.168.1.100 ], X-Forwarded-For: [ 192.168.1.100 ], X-Forwarded-Proto: [ http ], X-Request-Id: [ d30d74c9-2c8e-4249-8ca6-ee24156e3317 ] }, namespace: default, ingress: , service: , pod: backend-869c8646c5-s4426 * Connection #0 to host 192.168.1.15:80 left intact }cbyDESKTOP-IKRNJQE:~$其他可选实现:Envoy Gateway: Envoy 官方实现Istio: 服务网格方案Contour: VMware 维护的 Envoy 控制器Kong: Kong Ingress Controller步骤 3: 创建 GatewayClasscat gatewayclass.yaml EOF apiVersion: gateway.networking.k8s.io/v1 kind: GatewayClass metadata: name: nginx-gateway-class spec: controllerName: gateway.envoyproxy.io/gatewayclass-controller EOF应用配置:kubectl apply -f gatewayclass.yaml kubectl get gatewayclass cbyDESKTOP-IKRNJQE:~$ kubectl get gatewayclass gatewayclass.gateway.networking.k8s.io/nginx-gateway-class created NAME CONTROLLER ACCEPTED AGE eg gateway.envoyproxy.io/gatewayclass-controller True 19m nginx-gateway-class gateway.envoyproxy.io/gatewayclass-controller True 18s cbyDESKTOP-IKRNJQE:~$步骤 4: 部署示例应用创建两个简单的后端服务用于测试:cat demo-app.yaml EOF apiVersion: apps/v1 kind: Deployment metadata: name: web-app-v1 spec: replicas: 1 selector: matchLabels: app: web-app-v1 template: metadata: labels: app: web-app-v1 spec: containers: - name: web-app-v1 image: registry.cn-hangzhou.aliyuncs.com/chenby/cby:nginx-v1 ports: - containerPort: 80 --- apiVersion: apps/v1 kind: Deployment metadata: name: web-app-v2 spec: replicas: 1 selector: matchLabels: app: web-app-v2 template: metadata: labels: app: web-app-v2 spec: containers: - name: web-app-v2 image: registry.cn-hangzhou.aliyuncs.com/chenby/cby:nginx-v2 ports: - containerPort: 80 --- apiVersion: v1 kind: Service metadata: labels: app: web-app-v2 name: web-app-v2 spec: selector: app: web-app-v2 ports: - port: 80 protocol: TCP targetPort: 80 --- apiVersion: v1 kind: Service metadata: labels: app: web-app-v1 name: web-app-v1 spec: selector: app: web-app-v1 ports: - port: 80 protocol: TCP targetPort: 80 EOF同样创建 v2 版本,然后应用:kubectl apply -f demo-app.yaml测试查看cbyDESKTOP-IKRNJQE:~$ kubectl get pod NAME READY STATUS RESTARTS AGE backend-869c8646c5-s4426 1/1 Running 0 20m web-app-v1-844db9d88f-tjwzz 1/1 Running 0 22s web-app-v2-dd8d978b8-9stzg 1/1 Running 0 22s cbyDESKTOP-IKRNJQE:~$ cbyDESKTOP-IKRNJQE:~$ cbyDESKTOP-IKRNJQE:~$ cbyDESKTOP-IKRNJQE:~$ kubectl get svc NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE backend ClusterIP 10.68.86.118 none 3000/TCP 21m kubernetes ClusterIP 10.68.0.1 none 443/TCP 60d web-app-v1 ClusterIP 10.68.255.182 none 80/TCP 27s web-app-v2 ClusterIP 10.68.113.128 none 80/TCP 27s cbyDESKTOP-IKRNJQE:~$ cbyDESKTOP-IKRNJQE:~$ curl ^[[200~10.68.255.182~^C cbyDESKTOP-IKRNJQE:~$ cbyDESKTOP-IKRNJQE:~$ cbyDESKTOP-IKRNJQE:~$ curl 10.68.255.182 h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$ cbyDESKTOP-IKRNJQE:~$ curl 10.68.113.128 h1 stylecolor: #2196F3;Hello V2/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$步骤 5: 配置基本 HTTP 路由首先创建 Gateway:cat gateway.yaml EOF apiVersion: gateway.networking.k8s.io/v1 kind: Gateway metadata: name: production-gateway namespace: web-app spec: gatewayClassName: nginx-gateway-class listeners: - name: http port: 80 protocol: HTTP allowedRoutes: namespaces: from: All EOF创建 HTTPRoute:cat httproute-basic.yaml EOF apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: web-app-route namespace: default spec: parentRefs: - name: production-gateway namespace: web-app hostnames: - app.example.com rules: - matches: - path: type: PathPrefix value: / backendRefs: - name: web-app-v1 port: 80 - name: web-app-v2 port: 80 EOF应用配置:kubectl create namespace web-app kubectl apply -f gateway.yaml kubectl apply -f httproute-basic.yaml # 验证 kubectl get gateway -n web-app kubectl get httproute -n default cbyDESKTOP-IKRNJQE:~$ kubectl get gateway -n web-app NAME CLASS ADDRESS PROGRAMMED AGE production-gateway nginx-gateway-class 192.168.1.16 True 13s cbyDESKTOP-IKRNJQE:~$ cbyDESKTOP-IKRNJQE:~$ kubectl get httproute -n default NAME HOSTNAMES AGE backend [www.example.com] 26m web-app-route [app.example.com] 56s cbyDESKTOP-IKRNJQE:~$获取 LoadBalancer IP 并测试:curl -H Host: app.example.com http://192.168.1.16 cbyDESKTOP-IKRNJQE:~$ curl -H Host: app.example.com http://192.168.1.16 h1 stylecolor: #2196F3;Hello V2/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$ curl -H Host: app.example.com http://192.168.1.16 h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$ curl -H Host: app.example.com http://192.168.1.16 h1 stylecolor: #2196F3;Hello V2/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$ curl -H Host: app.example.com http://192.168.1.16 h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$ curl -H Host: app.example.com http://192.168.1.16 h1 stylecolor: #2196F3;Hello V2/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$ curl -H Host: app.example.com http://192.168.1.16 h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$步骤 6: 配置 TLS 终止6.1 创建自签名证书(测试用)openssl genrsa -out tls.key 2048 openssl req -new -key tls.key -out tls.csr -subj /CNapp.example.com openssl x509 -req -in tls.csr -signkey tls.key -out tls.crt -days 365 kubectl create secret tls app-tls-secret \ --certtls.crt \ --keytls.key \ -n web-app rm tls.key tls.csr tls.crt6.2 更新 Gateway 配置启用 HTTPScat gateway-with-tls.yaml EOF apiVersion: gateway.networking.k8s.io/v1 kind: Gateway metadata: name: production-gateway namespace: web-app spec: gatewayClassName: nginx-gateway-class listeners: - name: http port: 80 protocol: HTTP allowedRoutes: namespaces: from: All - name: https port: 443 protocol: HTTPS tls: mode: Terminate certificateRefs: - name: app-tls-secret kind: Secret group: allowedRoutes: namespaces: from: All EOF应用更新:kubectl apply -f gateway-with-tls.yaml测试 HTTPS 访问:curl -k -H Host: app.example.com https://192.168.1.16 cbyDESKTOP-IKRNJQE:~$ curl -k -H Host: app.example.com https://192.168.1.16 h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$ curl -k -H Host: app.example.com https://192.168.1.16 h1 stylecolor: #2196F3;Hello V2/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$ curl -k -H Host: app.example.com https://192.168.1.16 h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$ curl -k -H Host: app.example.com https://192.168.1.16 h1 stylecolor: #2196F3;Hello V2/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$ curl -k -H Host: app.example.com https://192.168.1.16 h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$步骤 7: 配置流量分割(金丝雀发布)创建将 90% 流量发送到 v1,10% 流量发送到 v2 的路由:cat httproute-canary.yaml EOF apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: web-app-canary-route namespace: default spec: parentRefs: - name: production-gateway namespace: web-app hostnames: - app.example.com rules: - matches: - path: type: PathPrefix value: / backendRefs: - name: web-app-v1 port: 80 weight: 90 - name: web-app-v2 port: 80 weight: 10 EOF应用配置:kubectl delete -f httproute-basic.yaml kubectl apply -f httproute-canary.yaml cbyDESKTOP-IKRNJQE:~$ kubectl get HTTPRoute NAMESPACE NAME HOSTNAMES AGE default backend [www.example.com] 45m default web-app-canary-route [app.example.com] 104s cbyDESKTOP-IKRNJQE:~$测试流量分割:for i in {1..20}; do curl -s -H Host: app.example.com http://192.168.1.16 done cbyDESKTOP-IKRNJQE:~$ for i in {1..20}; do curl -s -H Host: app.example.com http://192.168.1.16 done h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #2196F3;Hello V2/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #2196F3;Hello V2/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$步骤 8: 高级路由配置8.1 基于 Header 的路由cat httproute-header.yaml EOF apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: header-based-route namespace: default spec: parentRefs: - name: production-gateway namespace: web-app hostnames: - app.example.com rules: - matches: - headers: - name: x-version value: v2 backendRefs: - name: web-app-v2 port: 80 - matches: - path: type: PathPrefix value: / backendRefs: - name: web-app-v1 port: 80 EOF测试:kubectl delete -f httproute-canary.yaml kubectl apply -f httproute-header.yaml # 不带 Header,访问 v1 curl -H Host: app.example.com http://192.168.1.16 # 带 Header,访问 v2 curl -H Host: app.example.com -H x-version: v2 http://192.168.1.16 cbyDESKTOP-IKRNJQE:~$ curl -H Host: app.example.com http://192.168.1.16 h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$ cbyDESKTOP-IKRNJQE:~$ curl -H Host: app.example.com -H x-version: v2 http://192.168.1.16 h1 stylecolor: #2196F3;Hello V2/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$8.2 URL 重写cat httproute-rewrite.yaml EOF apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: rewrite-route namespace: default spec: parentRefs: - name: production-gateway namespace: web-app hostnames: - app.example.com rules: - matches: - path: type: PathPrefix value: /api/v1 filters: - type: URLRewrite urlRewrite: path: type: ReplacePrefixMatch replacePrefixMatch: / backendRefs: - name: web-app-v1 port: 80 - matches: - path: type: PathPrefix value: /api/v2 filters: - type: URLRewrite urlRewrite: path: type: ReplacePrefixMatch replacePrefixMatch: / backendRefs: - name: web-app-v2 port: 80 EOF测试使用kubectl delete -f httproute-header.yaml kubectl apply -f httproute-rewrite.yaml curl -H Host: app.example.com http://192.168.1.16/api/v1 curl -H Host: app.example.com http://192.168.1.16/api/v2 cbyDESKTOP-IKRNJQE:~$ curl -H Host: app.example.com http://192.168.1.16/api/v1 h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$ curl -H Host: app.example.com http://192.168.1.16/api/v2 h1 stylecolor: #2196F3;Hello V2/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$8.3 请求/响应头修改cat httproute-modify.yaml EOF apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: header-modify-route namespace: default spec: parentRefs: - name: production-gateway namespace: web-app hostnames: - app.example.com rules: - matches: - path: type: PathPrefix value: / filters: - type: RequestHeaderModifier requestHeaderModifier: add: - name: X-Forwarded-Gateway value: nginx-gateway set: - name: X-Custom-Header value: custom-value - type: ResponseHeaderModifier responseHeaderModifier: add: - name: X-Powered-By value: Gateway-API backendRefs: - name: web-app-v1 port: 80 EOFkubectl delete -f httproute-rewrite.yaml kubectl apply -f httproute-modify.yaml curl -v -H Host: app.example.com http://192.168.1.16/ cbyDESKTOP-IKRNJQE:~$ curl -v -H Host: app.example.com http://192.168.1.16/ * Trying 192.168.1.16:80... * Established connection to 192.168.1.16 (192.168.1.16 port 80) from 172.30.72.41 port 46798 * using HTTP/1.x GET / HTTP/1.1 Host: app.example.com User-Agent: curl/8.18.0 Accept: */* * Request completely sent off HTTP/1.1 200 OK server: nginx/1.29.8 date: Mon, 11 May 2026 14:54:24 GMT content-type: text/html content-length: 128 last-modified: Mon, 11 May 2026 14:02:13 GMT etag: 6a01e165-80 accept-ranges: bytes x-powered-by: Gateway-API h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p * Connection #0 to host 192.168.1.16:80 left intact cbyDESKTOP-IKRNJQE:~$最佳实践1. 安全管理1.1 使用 RBAC 限制权限为应用团队创建受限角色,只允许管理 Route 资源:apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: gateway-route-manager namespace: default rules: - apiGroups: [gateway.networking.k8s.io] resources: [httproutes, grpcroutes] verbs: [get, list, watch, create, update, patch]1.2 使用 ReferenceGrant 控制跨命名空间访问apiVersion: gateway.networking.k8s.io/v1beta1 kind: ReferenceGrant metadata: name: allow-tls-ref namespace: cert-manager spec: from: - group: gateway.networking.k8s.io kind: Gateway namespace: web-app to: - group: kind: Secret name: wildcard-tls-cert1.3 TLS 最佳实践使用通配符证书减少证书管理复杂度定期轮换证书,建议使用 cert-manager 自动化优先使用 TLS Terminate 模式强制 HTTPS,配置 HTTP 到 HTTPS 重定向2. 性能优化2.1 合理配置监听器限制允许的路由来源,减少配置复杂度:spec: listeners: - name: http port: 80 protocol: HTTP allowedRoutes: namespaces: from: Selector selector: matchLabels: allow-gateway-access: true2.2 避免过度复杂的路由规则合并相似的路由规则,减少配置数量使用最具体的匹配条件优先,提高匹配效率避免过多的 Header/Query 匹配,影响性能3. 可靠性保障3.1 渐进式发布策略金丝雀发布流程:部署新版本服务(v2)配置 5% 流量到 v2监控错误率和延迟逐步增加流量比例(10% → 25% → 50% → 100%)确认稳定后,移除旧版本# 阶段 1: 5% 流量 backendRefs: - name: web-app-v1 weight: 95 - name: web-app-v2 weight: 5 # 阶段 2: 25% 流量 backendRefs: - name: web-app-v1 weight: 75 - name: web-app-v2 weight: 25 # 阶段 3: 100% 流量 backendRefs: - name: web-app-v2 weight: 1003.2 蓝绿部署通过快速切换权重实现蓝绿部署:# 初始状态: 100% 蓝色环境 backendRefs: - name: blue-service weight: 100 - name: green-service weight: 0 # 切换时: 快速切换到绿色环境 backendRefs: - name: blue-service weight: 0 - name: green-service weight: 1004. 多租户隔离4.1 命名空间隔离策略spec: listeners: - name: http port: 80 protocol: HTTP allowedRoutes: namespaces: from: Selector selector: matchLabels: environment: production5. 调试和故障排查5.1 常见问题诊断清单问题 1: Gateway 状态为 Not Accepted检查步骤:# 1. 检查 GatewayClass 是否存在且有效 kubectl get gatewayclass # 2. 检查 Controller 是否运行 kubectl get pods -n controller-namespace # 3. 查看 Gateway 事件 kubectl describe gateway name -n namespace # 4. 检查控制器日志 kubectl logs -n controller-namespace -l appcontroller-name问题 2: HTTPRoute 未被接受检查步骤:# 1. 验证 parentRefs 是否正确 kubectl get httproute name -o yaml # 2. 检查 Gateway 是否允许该命名空间的路由 kubectl describe gateway gateway-name -n namespace # 3. 验证后端服务是否存在 kubectl get svc backend-service-name # 4. 检查 ReferenceGrant (如果跨命名空间) kubectl get referencegrant -A问题 3: 流量未正确路由检查步骤:# 1. 验证路由规则匹配条件 kubectl describe httproute name # 2. 测试后端服务直接访问 kubectl run test --rm -i --tty --imagecurlimages/curl -- \ curl http://service-name.namespace.svc.cluster.local # 3. 检查 Gateway 外部 IP kubectl get gateway name -o jsonpath{.status.addresses} # 4. 使用详细输出测试 curl -v -H Host: hostname http://gateway-ippath6. 生产环境建议6.1 高可用架构部署多个 Controller 副本实现控制器高可用使用多个 Gateway 实例分散负载配置跨区域部署提高灾难恢复能力spec: replicas: 3 strategy: type: RollingUpdate rollingUpdate: maxSurge: 1 maxUnavailable: 06.2 备份和恢复定期备份 Gateway API 资源配置使用 GitOps 工具(如 ArgoCD、Flux)管理配置建立配置变更审批流程# 备份所有 Gateway API 资源 kubectl get gatewayclass,gateway,httproute,tcproute,referencegrant -A -o yaml gateway-backup.yaml6.3 容量规划关键监控指标:每秒请求数 (RPS)平均/ P95/P99 延迟错误率 (4xx, 5xx)活跃连接数带宽使用率6.4 版本升级策略先在测试环境验证新版本阅读发行说明,了解破坏性变更灰度升级,先升级部分节点保留回滚方案7. 常见应用场景场景 1: 多域名托管apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: multi-domain-route spec: parentRefs: - name: production-gateway hostnames: - app1.example.com - app2.example.com - app3.example.com rules: - matches: - path: type: PathPrefix value: / backendRefs: - name: shared-backend port: 80场景 2: API 网关apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: api-gateway-route spec: parentRefs: - name: production-gateway hostnames: - api.example.com rules: - matches: - path: type: PathPrefix value: /users backendRefs: - name: user-service port: 8080 - matches: - path: type: PathPrefix value: /orders backendRefs: - name: order-service port: 8080 - matches: - path: type: PathPrefix value: /payments backendRefs: - name: payment-service port: 8080场景 3: A/B 测试apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: ab-test-route spec: parentRefs: - name: production-gateway hostnames: - app.example.com rules: - matches: - path: type: PathPrefix value: / backendRefs: - name: variant-a port: 80 weight: 50 - name: variant-b port: 80 weight: 50常见问题与故障排查FAQQ1: Gateway API 和 Ingress 可以共存吗?A: 可以。它们使用不同的资源类型,可以同时在集群中运行。建议逐步迁移,先在新服务中使用 Gateway API。Q2: 如何选择 Gateway Controller 实现?A: 考虑因素:功能需求:是否需要 gRPC、TCP 等高级功能性能要求:吞吐量、延迟指标生态系统:与现有工具链的集成社区活跃度:维护频率、问题响应速度企业支持:是否需要商业支持推荐选择:通用场景: Envoy Gateway、NGINX Gateway Fabric服务网格: Istio高性能: Envoy Gateway简单易用: ContourQ3: Gateway API 的性能如何?A: Gateway API 本身是控制平面,性能取决于数据平面实现(Envoy/Nginx 等)、配置复杂度和硬件资源。现代实现(如 Envoy)可以达到数十万 QPS,延迟在毫秒级。Q4: 如何处理 WebSocket 连接?A: HTTPRoute 天然支持 WebSocket,无需特殊配置。确保后端服务正确处理 Upgrade 头即可。Q5: 可以实现速率限制吗?A: Gateway API v1 标准不直接支持速率限制,但可以通过以下方式实现:Controller 特定扩展(如 Envoy Gateway 的 RateLimitFilter)在服务网格层实现(Istio)使用外部速率限制服务Q6: 如何迁移现有的 Ingress 配置?A: 迁移步骤:分析现有 Ingress 资源映射 Ingress 规则到 HTTPRoute创建对应的 Gateway 资源测试新配置逐步切换流量删除旧 Ingress 资源可以使用官方工具ingress2gateway辅助转换:kubectl get ingress -A -o yaml | ingress2gateway -f -Q7: Gateway API 支持哪些 Kubernetes 版本?A: Gateway API v1 需要 Kubernetes 1.22,推荐使用最新的稳定版 Kubernetes 以获得最佳支持。Q8: 如何实现灰度发布的自动化?A: 结合以下工具:Argo Rollouts:渐进式交付Flagger:自动化的金丝雀分析自定义控制器:根据监控指标自动调整权重总结Kubernetes Gateway API 代表了 Kubernetes 流量管理的未来方向。通过本教程,您应该已经掌握了:核心概念:理解了 GatewayClass、Gateway、HTTPRoute 等资源的作用和关系架构原理:了解了控制平面和数据平面的交互机制实践能力:能够从零搭建 Gateway API 环境并配置各种路由场景最佳实践:学会了安全管理、性能优化、可靠性保障等生产环境技巧下一步学习建议:深入研究特定 Gateway Controller 的文档探索服务网格与 Gateway API 的集成学习 GitOps 工作流管理 Gateway 配置祝您在 Kubernetes Gateway API 的学习之路上取得成功!关于小陈运维关于 - 小陈运维CSDN、GitHub、知乎、开源中国、思否、掘金、简书、华为云、阿里云、腾讯云、哔哩哔哩、今日头条、新浪微博、个人博客全网可搜《小陈运维》文章主要发布于微信公众号分类: Kubernetes免责声明本内容来自平台创作者博客园系信息发布平台仅提供信息存储空间服务。好文要顶 关注我 收藏该文 微信分享小陈运维粉丝 - 15 关注 - 0加关注00升级成为会员« 上一篇 二进制安装Kubernetesk8sv1.36.0posted 2026-05-12 12:21 小陈运维 阅读(159) 评论(0) 收藏 举报
安装 Envoy Gateway
发布时间：2026/6/26 3:24:46
执行部署# https://gateway.envoyproxy.io/docs/install/install-helm/ # 安装网关 API CRD 和 Envoy 网关 helm install eg oci://docker.io/envoyproxy/gateway-helm --version v1.7.3 -n envoy-gateway-system --create-namespace创建测试应用kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/v1.7.3/quickstart.yaml -n default # 查看访问地址 cbyDESKTOP-IKRNJQE:~$ kubectl get svc -n envoy-gateway-system NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE envoy-default-eg-e41e7b31 LoadBalancer 10.68.120.80 192.168.1.15 80:32116/TCP 6s envoy-gateway ClusterIP 10.68.64.83 none 18000/TCP,18001/TCP,18002/TCP,19001/TCP,9443/TCP 30m cbyDESKTOP-IKRNJQE:~$测试访问cbyDESKTOP-IKRNJQE:~$ curl --verbose --header Host: www.example.com http://192.168.1.15/get * Trying 192.168.1.15:80... * Established connection to 192.168.1.15 (192.168.1.15 port 80) from 172.30.72.41 port 39072 * using HTTP/1.x GET /get HTTP/1.1 Host: www.example.com User-Agent: curl/8.18.0 Accept: */* * Request completely sent off HTTP/1.1 200 OK content-type: application/json x-content-type-options: nosniff date: Mon, 11 May 2026 13:51:37 GMT content-length: 475 { path: /get, host: www.example.com, method: GET, proto: HTTP/1.1, headers: { Accept: [ */* ], User-Agent: [ curl/8.18.0 ], X-Envoy-External-Address: [ 192.168.1.100 ], X-Forwarded-For: [ 192.168.1.100 ], X-Forwarded-Proto: [ http ], X-Request-Id: [ d30d74c9-2c8e-4249-8ca6-ee24156e3317 ] }, namespace: default, ingress: , service: , pod: backend-869c8646c5-s4426 * Connection #0 to host 192.168.1.15:80 left intact }cbyDESKTOP-IKRNJQE:~$其他可选实现:Envoy Gateway: Envoy 官方实现Istio: 服务网格方案Contour: VMware 维护的 Envoy 控制器Kong: Kong Ingress Controller步骤 3: 创建 GatewayClasscat gatewayclass.yaml EOF apiVersion: gateway.networking.k8s.io/v1 kind: GatewayClass metadata: name: nginx-gateway-class spec: controllerName: gateway.envoyproxy.io/gatewayclass-controller EOF应用配置:kubectl apply -f gatewayclass.yaml kubectl get gatewayclass cbyDESKTOP-IKRNJQE:~$ kubectl get gatewayclass gatewayclass.gateway.networking.k8s.io/nginx-gateway-class created NAME CONTROLLER ACCEPTED AGE eg gateway.envoyproxy.io/gatewayclass-controller True 19m nginx-gateway-class gateway.envoyproxy.io/gatewayclass-controller True 18s cbyDESKTOP-IKRNJQE:~$步骤 4: 部署示例应用创建两个简单的后端服务用于测试:cat demo-app.yaml EOF apiVersion: apps/v1 kind: Deployment metadata: name: web-app-v1 spec: replicas: 1 selector: matchLabels: app: web-app-v1 template: metadata: labels: app: web-app-v1 spec: containers: - name: web-app-v1 image: registry.cn-hangzhou.aliyuncs.com/chenby/cby:nginx-v1 ports: - containerPort: 80 --- apiVersion: apps/v1 kind: Deployment metadata: name: web-app-v2 spec: replicas: 1 selector: matchLabels: app: web-app-v2 template: metadata: labels: app: web-app-v2 spec: containers: - name: web-app-v2 image: registry.cn-hangzhou.aliyuncs.com/chenby/cby:nginx-v2 ports: - containerPort: 80 --- apiVersion: v1 kind: Service metadata: labels: app: web-app-v2 name: web-app-v2 spec: selector: app: web-app-v2 ports: - port: 80 protocol: TCP targetPort: 80 --- apiVersion: v1 kind: Service metadata: labels: app: web-app-v1 name: web-app-v1 spec: selector: app: web-app-v1 ports: - port: 80 protocol: TCP targetPort: 80 EOF同样创建 v2 版本,然后应用:kubectl apply -f demo-app.yaml测试查看cbyDESKTOP-IKRNJQE:~$ kubectl get pod NAME READY STATUS RESTARTS AGE backend-869c8646c5-s4426 1/1 Running 0 20m web-app-v1-844db9d88f-tjwzz 1/1 Running 0 22s web-app-v2-dd8d978b8-9stzg 1/1 Running 0 22s cbyDESKTOP-IKRNJQE:~$ cbyDESKTOP-IKRNJQE:~$ cbyDESKTOP-IKRNJQE:~$ cbyDESKTOP-IKRNJQE:~$ kubectl get svc NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE backend ClusterIP 10.68.86.118 none 3000/TCP 21m kubernetes ClusterIP 10.68.0.1 none 443/TCP 60d web-app-v1 ClusterIP 10.68.255.182 none 80/TCP 27s web-app-v2 ClusterIP 10.68.113.128 none 80/TCP 27s cbyDESKTOP-IKRNJQE:~$ cbyDESKTOP-IKRNJQE:~$ curl ^[[200~10.68.255.182~^C cbyDESKTOP-IKRNJQE:~$ cbyDESKTOP-IKRNJQE:~$ cbyDESKTOP-IKRNJQE:~$ curl 10.68.255.182 h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$ cbyDESKTOP-IKRNJQE:~$ curl 10.68.113.128 h1 stylecolor: #2196F3;Hello V2/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$步骤 5: 配置基本 HTTP 路由首先创建 Gateway:cat gateway.yaml EOF apiVersion: gateway.networking.k8s.io/v1 kind: Gateway metadata: name: production-gateway namespace: web-app spec: gatewayClassName: nginx-gateway-class listeners: - name: http port: 80 protocol: HTTP allowedRoutes: namespaces: from: All EOF创建 HTTPRoute:cat httproute-basic.yaml EOF apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: web-app-route namespace: default spec: parentRefs: - name: production-gateway namespace: web-app hostnames: - app.example.com rules: - matches: - path: type: PathPrefix value: / backendRefs: - name: web-app-v1 port: 80 - name: web-app-v2 port: 80 EOF应用配置:kubectl create namespace web-app kubectl apply -f gateway.yaml kubectl apply -f httproute-basic.yaml # 验证 kubectl get gateway -n web-app kubectl get httproute -n default cbyDESKTOP-IKRNJQE:~$ kubectl get gateway -n web-app NAME CLASS ADDRESS PROGRAMMED AGE production-gateway nginx-gateway-class 192.168.1.16 True 13s cbyDESKTOP-IKRNJQE:~$ cbyDESKTOP-IKRNJQE:~$ kubectl get httproute -n default NAME HOSTNAMES AGE backend [www.example.com] 26m web-app-route [app.example.com] 56s cbyDESKTOP-IKRNJQE:~$获取 LoadBalancer IP 并测试:curl -H Host: app.example.com http://192.168.1.16 cbyDESKTOP-IKRNJQE:~$ curl -H Host: app.example.com http://192.168.1.16 h1 stylecolor: #2196F3;Hello V2/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$ curl -H Host: app.example.com http://192.168.1.16 h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$ curl -H Host: app.example.com http://192.168.1.16 h1 stylecolor: #2196F3;Hello V2/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$ curl -H Host: app.example.com http://192.168.1.16 h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$ curl -H Host: app.example.com http://192.168.1.16 h1 stylecolor: #2196F3;Hello V2/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$ curl -H Host: app.example.com http://192.168.1.16 h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$步骤 6: 配置 TLS 终止6.1 创建自签名证书(测试用)openssl genrsa -out tls.key 2048 openssl req -new -key tls.key -out tls.csr -subj /CNapp.example.com openssl x509 -req -in tls.csr -signkey tls.key -out tls.crt -days 365 kubectl create secret tls app-tls-secret \ --certtls.crt \ --keytls.key \ -n web-app rm tls.key tls.csr tls.crt6.2 更新 Gateway 配置启用 HTTPScat gateway-with-tls.yaml EOF apiVersion: gateway.networking.k8s.io/v1 kind: Gateway metadata: name: production-gateway namespace: web-app spec: gatewayClassName: nginx-gateway-class listeners: - name: http port: 80 protocol: HTTP allowedRoutes: namespaces: from: All - name: https port: 443 protocol: HTTPS tls: mode: Terminate certificateRefs: - name: app-tls-secret kind: Secret group: allowedRoutes: namespaces: from: All EOF应用更新:kubectl apply -f gateway-with-tls.yaml测试 HTTPS 访问:curl -k -H Host: app.example.com https://192.168.1.16 cbyDESKTOP-IKRNJQE:~$ curl -k -H Host: app.example.com https://192.168.1.16 h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$ curl -k -H Host: app.example.com https://192.168.1.16 h1 stylecolor: #2196F3;Hello V2/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$ curl -k -H Host: app.example.com https://192.168.1.16 h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$ curl -k -H Host: app.example.com https://192.168.1.16 h1 stylecolor: #2196F3;Hello V2/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$ curl -k -H Host: app.example.com https://192.168.1.16 h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$步骤 7: 配置流量分割(金丝雀发布)创建将 90% 流量发送到 v1,10% 流量发送到 v2 的路由:cat httproute-canary.yaml EOF apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: web-app-canary-route namespace: default spec: parentRefs: - name: production-gateway namespace: web-app hostnames: - app.example.com rules: - matches: - path: type: PathPrefix value: / backendRefs: - name: web-app-v1 port: 80 weight: 90 - name: web-app-v2 port: 80 weight: 10 EOF应用配置:kubectl delete -f httproute-basic.yaml kubectl apply -f httproute-canary.yaml cbyDESKTOP-IKRNJQE:~$ kubectl get HTTPRoute NAMESPACE NAME HOSTNAMES AGE default backend [www.example.com] 45m default web-app-canary-route [app.example.com] 104s cbyDESKTOP-IKRNJQE:~$测试流量分割:for i in {1..20}; do curl -s -H Host: app.example.com http://192.168.1.16 done cbyDESKTOP-IKRNJQE:~$ for i in {1..20}; do curl -s -H Host: app.example.com http://192.168.1.16 done h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #2196F3;Hello V2/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #2196F3;Hello V2/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$步骤 8: 高级路由配置8.1 基于 Header 的路由cat httproute-header.yaml EOF apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: header-based-route namespace: default spec: parentRefs: - name: production-gateway namespace: web-app hostnames: - app.example.com rules: - matches: - headers: - name: x-version value: v2 backendRefs: - name: web-app-v2 port: 80 - matches: - path: type: PathPrefix value: / backendRefs: - name: web-app-v1 port: 80 EOF测试:kubectl delete -f httproute-canary.yaml kubectl apply -f httproute-header.yaml # 不带 Header,访问 v1 curl -H Host: app.example.com http://192.168.1.16 # 带 Header,访问 v2 curl -H Host: app.example.com -H x-version: v2 http://192.168.1.16 cbyDESKTOP-IKRNJQE:~$ curl -H Host: app.example.com http://192.168.1.16 h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$ cbyDESKTOP-IKRNJQE:~$ curl -H Host: app.example.com -H x-version: v2 http://192.168.1.16 h1 stylecolor: #2196F3;Hello V2/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$8.2 URL 重写cat httproute-rewrite.yaml EOF apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: rewrite-route namespace: default spec: parentRefs: - name: production-gateway namespace: web-app hostnames: - app.example.com rules: - matches: - path: type: PathPrefix value: /api/v1 filters: - type: URLRewrite urlRewrite: path: type: ReplacePrefixMatch replacePrefixMatch: / backendRefs: - name: web-app-v1 port: 80 - matches: - path: type: PathPrefix value: /api/v2 filters: - type: URLRewrite urlRewrite: path: type: ReplacePrefixMatch replacePrefixMatch: / backendRefs: - name: web-app-v2 port: 80 EOF测试使用kubectl delete -f httproute-header.yaml kubectl apply -f httproute-rewrite.yaml curl -H Host: app.example.com http://192.168.1.16/api/v1 curl -H Host: app.example.com http://192.168.1.16/api/v2 cbyDESKTOP-IKRNJQE:~$ curl -H Host: app.example.com http://192.168.1.16/api/v1 h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$ curl -H Host: app.example.com http://192.168.1.16/api/v2 h1 stylecolor: #2196F3;Hello V2/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p cbyDESKTOP-IKRNJQE:~$8.3 请求/响应头修改cat httproute-modify.yaml EOF apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: header-modify-route namespace: default spec: parentRefs: - name: production-gateway namespace: web-app hostnames: - app.example.com rules: - matches: - path: type: PathPrefix value: / filters: - type: RequestHeaderModifier requestHeaderModifier: add: - name: X-Forwarded-Gateway value: nginx-gateway set: - name: X-Custom-Header value: custom-value - type: ResponseHeaderModifier responseHeaderModifier: add: - name: X-Powered-By value: Gateway-API backendRefs: - name: web-app-v1 port: 80 EOFkubectl delete -f httproute-rewrite.yaml kubectl apply -f httproute-modify.yaml curl -v -H Host: app.example.com http://192.168.1.16/ cbyDESKTOP-IKRNJQE:~$ curl -v -H Host: app.example.com http://192.168.1.16/ * Trying 192.168.1.16:80... * Established connection to 192.168.1.16 (192.168.1.16 port 80) from 172.30.72.41 port 46798 * using HTTP/1.x GET / HTTP/1.1 Host: app.example.com User-Agent: curl/8.18.0 Accept: */* * Request completely sent off HTTP/1.1 200 OK server: nginx/1.29.8 date: Mon, 11 May 2026 14:54:24 GMT content-type: text/html content-length: 128 last-modified: Mon, 11 May 2026 14:02:13 GMT etag: 6a01e165-80 accept-ranges: bytes x-powered-by: Gateway-API h1 stylecolor: #4CAF50;Hello V1/h1p时间2026-05-11 星期一/pp地点内蒙古自治区 呼和浩特市/p * Connection #0 to host 192.168.1.16:80 left intact cbyDESKTOP-IKRNJQE:~$最佳实践1. 安全管理1.1 使用 RBAC 限制权限为应用团队创建受限角色,只允许管理 Route 资源:apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: gateway-route-manager namespace: default rules: - apiGroups: [gateway.networking.k8s.io] resources: [httproutes, grpcroutes] verbs: [get, list, watch, create, update, patch]1.2 使用 ReferenceGrant 控制跨命名空间访问apiVersion: gateway.networking.k8s.io/v1beta1 kind: ReferenceGrant metadata: name: allow-tls-ref namespace: cert-manager spec: from: - group: gateway.networking.k8s.io kind: Gateway namespace: web-app to: - group: kind: Secret name: wildcard-tls-cert1.3 TLS 最佳实践使用通配符证书减少证书管理复杂度定期轮换证书,建议使用 cert-manager 自动化优先使用 TLS Terminate 模式强制 HTTPS,配置 HTTP 到 HTTPS 重定向2. 性能优化2.1 合理配置监听器限制允许的路由来源,减少配置复杂度:spec: listeners: - name: http port: 80 protocol: HTTP allowedRoutes: namespaces: from: Selector selector: matchLabels: allow-gateway-access: true2.2 避免过度复杂的路由规则合并相似的路由规则,减少配置数量使用最具体的匹配条件优先,提高匹配效率避免过多的 Header/Query 匹配,影响性能3. 可靠性保障3.1 渐进式发布策略金丝雀发布流程:部署新版本服务(v2)配置 5% 流量到 v2监控错误率和延迟逐步增加流量比例(10% → 25% → 50% → 100%)确认稳定后,移除旧版本# 阶段 1: 5% 流量 backendRefs: - name: web-app-v1 weight: 95 - name: web-app-v2 weight: 5 # 阶段 2: 25% 流量 backendRefs: - name: web-app-v1 weight: 75 - name: web-app-v2 weight: 25 # 阶段 3: 100% 流量 backendRefs: - name: web-app-v2 weight: 1003.2 蓝绿部署通过快速切换权重实现蓝绿部署:# 初始状态: 100% 蓝色环境 backendRefs: - name: blue-service weight: 100 - name: green-service weight: 0 # 切换时: 快速切换到绿色环境 backendRefs: - name: blue-service weight: 0 - name: green-service weight: 1004. 多租户隔离4.1 命名空间隔离策略spec: listeners: - name: http port: 80 protocol: HTTP allowedRoutes: namespaces: from: Selector selector: matchLabels: environment: production5. 调试和故障排查5.1 常见问题诊断清单问题 1: Gateway 状态为 Not Accepted检查步骤:# 1. 检查 GatewayClass 是否存在且有效 kubectl get gatewayclass # 2. 检查 Controller 是否运行 kubectl get pods -n controller-namespace # 3. 查看 Gateway 事件 kubectl describe gateway name -n namespace # 4. 检查控制器日志 kubectl logs -n controller-namespace -l appcontroller-name问题 2: HTTPRoute 未被接受检查步骤:# 1. 验证 parentRefs 是否正确 kubectl get httproute name -o yaml # 2. 检查 Gateway 是否允许该命名空间的路由 kubectl describe gateway gateway-name -n namespace # 3. 验证后端服务是否存在 kubectl get svc backend-service-name # 4. 检查 ReferenceGrant (如果跨命名空间) kubectl get referencegrant -A问题 3: 流量未正确路由检查步骤:# 1. 验证路由规则匹配条件 kubectl describe httproute name # 2. 测试后端服务直接访问 kubectl run test --rm -i --tty --imagecurlimages/curl -- \ curl http://service-name.namespace.svc.cluster.local # 3. 检查 Gateway 外部 IP kubectl get gateway name -o jsonpath{.status.addresses} # 4. 使用详细输出测试 curl -v -H Host: hostname http://gateway-ippath6. 生产环境建议6.1 高可用架构部署多个 Controller 副本实现控制器高可用使用多个 Gateway 实例分散负载配置跨区域部署提高灾难恢复能力spec: replicas: 3 strategy: type: RollingUpdate rollingUpdate: maxSurge: 1 maxUnavailable: 06.2 备份和恢复定期备份 Gateway API 资源配置使用 GitOps 工具(如 ArgoCD、Flux)管理配置建立配置变更审批流程# 备份所有 Gateway API 资源 kubectl get gatewayclass,gateway,httproute,tcproute,referencegrant -A -o yaml gateway-backup.yaml6.3 容量规划关键监控指标:每秒请求数 (RPS)平均/ P95/P99 延迟错误率 (4xx, 5xx)活跃连接数带宽使用率6.4 版本升级策略先在测试环境验证新版本阅读发行说明,了解破坏性变更灰度升级,先升级部分节点保留回滚方案7. 常见应用场景场景 1: 多域名托管apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: multi-domain-route spec: parentRefs: - name: production-gateway hostnames: - app1.example.com - app2.example.com - app3.example.com rules: - matches: - path: type: PathPrefix value: / backendRefs: - name: shared-backend port: 80场景 2: API 网关apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: api-gateway-route spec: parentRefs: - name: production-gateway hostnames: - api.example.com rules: - matches: - path: type: PathPrefix value: /users backendRefs: - name: user-service port: 8080 - matches: - path: type: PathPrefix value: /orders backendRefs: - name: order-service port: 8080 - matches: - path: type: PathPrefix value: /payments backendRefs: - name: payment-service port: 8080场景 3: A/B 测试apiVersion: gateway.networking.k8s.io/v1 kind: HTTPRoute metadata: name: ab-test-route spec: parentRefs: - name: production-gateway hostnames: - app.example.com rules: - matches: - path: type: PathPrefix value: / backendRefs: - name: variant-a port: 80 weight: 50 - name: variant-b port: 80 weight: 50常见问题与故障排查FAQQ1: Gateway API 和 Ingress 可以共存吗?A: 可以。它们使用不同的资源类型,可以同时在集群中运行。建议逐步迁移,先在新服务中使用 Gateway API。Q2: 如何选择 Gateway Controller 实现?A: 考虑因素:功能需求:是否需要 gRPC、TCP 等高级功能性能要求:吞吐量、延迟指标生态系统:与现有工具链的集成社区活跃度:维护频率、问题响应速度企业支持:是否需要商业支持推荐选择:通用场景: Envoy Gateway、NGINX Gateway Fabric服务网格: Istio高性能: Envoy Gateway简单易用: ContourQ3: Gateway API 的性能如何?A: Gateway API 本身是控制平面,性能取决于数据平面实现(Envoy/Nginx 等)、配置复杂度和硬件资源。现代实现(如 Envoy)可以达到数十万 QPS,延迟在毫秒级。Q4: 如何处理 WebSocket 连接?A: HTTPRoute 天然支持 WebSocket,无需特殊配置。确保后端服务正确处理 Upgrade 头即可。Q5: 可以实现速率限制吗?A: Gateway API v1 标准不直接支持速率限制,但可以通过以下方式实现:Controller 特定扩展(如 Envoy Gateway 的 RateLimitFilter)在服务网格层实现(Istio)使用外部速率限制服务Q6: 如何迁移现有的 Ingress 配置?A: 迁移步骤:分析现有 Ingress 资源映射 Ingress 规则到 HTTPRoute创建对应的 Gateway 资源测试新配置逐步切换流量删除旧 Ingress 资源可以使用官方工具ingress2gateway辅助转换:kubectl get ingress -A -o yaml | ingress2gateway -f -Q7: Gateway API 支持哪些 Kubernetes 版本?A: Gateway API v1 需要 Kubernetes 1.22,推荐使用最新的稳定版 Kubernetes 以获得最佳支持。Q8: 如何实现灰度发布的自动化?A: 结合以下工具:Argo Rollouts:渐进式交付Flagger:自动化的金丝雀分析自定义控制器:根据监控指标自动调整权重总结Kubernetes Gateway API 代表了 Kubernetes 流量管理的未来方向。通过本教程,您应该已经掌握了:核心概念:理解了 GatewayClass、Gateway、HTTPRoute 等资源的作用和关系架构原理:了解了控制平面和数据平面的交互机制实践能力:能够从零搭建 Gateway API 环境并配置各种路由场景最佳实践:学会了安全管理、性能优化、可靠性保障等生产环境技巧下一步学习建议:深入研究特定 Gateway Controller 的文档探索服务网格与 Gateway API 的集成学习 GitOps 工作流管理 Gateway 配置祝您在 Kubernetes Gateway API 的学习之路上取得成功!关于小陈运维关于 - 小陈运维CSDN、GitHub、知乎、开源中国、思否、掘金、简书、华为云、阿里云、腾讯云、哔哩哔哩、今日头条、新浪微博、个人博客全网可搜《小陈运维》文章主要发布于微信公众号分类: Kubernetes免责声明本内容来自平台创作者博客园系信息发布平台仅提供信息存储空间服务。好文要顶 关注我 收藏该文 微信分享小陈运维粉丝 - 15 关注 - 0加关注00升级成为会员« 上一篇 二进制安装Kubernetesk8sv1.36.0posted 2026-05-12 12:21 小陈运维 阅读(159) 评论(0) 收藏 举报
