Connectivity Link-CY24Q4-Setting up Ingress for your Clusters - Platform Engineer Workflow

Configure ingress and associated policies for Kubernetes clusters with Kubernetes Gateway API and Red Hat Connectivity Link

Connectivity and Ingress policies for Kubernetes Clusters: A Platform Engineering Approach

The primary goal of a Platform Engineer in this exercise is to deploy a Gateway that  is ready for use by application development teams to enable access to their service endpoints or APIs. This gateway should be protected and secured with global rate limiting and auth policies.

Platform Engineering Workflow

TLS
:
Define
a
TLS
issuer
for
TLS
certificates
for
secure
communication
to
the
Gateways.
DNS
Configuration
:
Setup
a
hosted
zone
using
a
DNS
provider.
Gateway
:
Create
a
Gateway
(based
on
Istio
gateway)
with
a
wildcard
hostname
based
on
the
root
domain.
Policies:
Setup
Connectivity
Link
Custom
Resources
(CRs)
for
DNS,
TLS,
Auth,
Rate
Limiting
Platform
Engineering
Task
List

RHCL - Arcade Slides - Google Slides

Route 53 Console hosted zones

To secure communication to the Gateways, you will define a TLS issuer for TLS certificates. Let's create the ClusterIssuer custom resource.

Setting up TLS using cert manager

Import YAML · Red Hat OpenShift

To allow traffic using DNS you must define a Gateway using the Kubernetes Gateway API.  It is the new standard for Ingress from the Kubernetes. Let's setup the gateway

Gateway

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: prod-web
  labels:
    kuadrant.io/lb-attribute-geo-code: US
spec:
  gatewayClassName: istio
  listeners:
    - allowedRoutes:
        namespaces:
          from: All
      hostname: '*.globex.sandbox127.opentlc.com'
      name: api
      port: 443
      protocol: HTTPS
      tls:
        certificateRefs:
          - group: ''
            kind: Secret
            name: api-tls
        mode: Terminate

Provide TLS for gateway listeners by managing the lifecycle of tls certificates using CertManager

Apply an authorisation policy across all services attached to the gateway. 

Gateway Authentication using Red Hat Connectivity Link

On incoming request, the gateway checks the matching rules for enforcing rate limits, as stated in the RateLimitPolicy custom resources and targeted Gateway API networking objects

Gateway Rate Limits using Red Hat Connectivity Link

The DNSPolicy acts against a target Gateway by processing its listeners for hostnames and then create dns records for those hostnames.

DNS Policy using Red Hat Connectivity Link

globex.sandbox127.opentlc.com - details

Now that the Platform Engineer has configured the Gateway with all the policies. Developers/App owners can now onboard their application/service endpoints to be available for secure access. Application developers can self service and refine policies to their specific needs in order to protect their exposed service endpoints.

Platform Configuration Complete

Red Hat