Kubernetes Gateway API入门指南：下一代Ingress替代方案与NGINX部署实操

随着Ingress NGINX即将退出历史舞台，你是否正在为Kubernetes集群的网关选型而思考？实际上，Kubernetes Gateway API 早已为我们提供了更现代、更强大的替代方案。本文将带你快速入门，理解其核心概念并通过实战部署掌握其用法。

官方文档：https://gateway-api.sigs.k8s.io/

基本原理

网关（Gateway）API 是一组提供动态基础设施配置和高级流量路由能力的API资源集合。

它通过可扩展的、面向角色的、协议感知的配置机制来提供网络服务，旨在为云原生环境下的网络流量管理提供更优解。Gateway API 定义了三种稳定的核心资源：

• GatewayClass： 定义一组具有相同配置的网关，由特定的控制器进行管理。

---
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  labels:
    app.kubernetes.io/instance: nginx-gateway
    app.kubernetes.io/name: nginx-gateway
    app.kubernetes.io/version: 1.6.2
  name: nginx
spec:
  controllerName: gateway.nginx.org/nginx-gateway-controller
---
apiVersion: gateway.nginx.org/v1alpha1
kind: NginxGateway
metadata:
  labels:
    app.kubernetes.io/instance: nginx-gateway
    app.kubernetes.io/name: nginx-gateway
    app.kubernetes.io/version: 1.6.2
  name: nginx-gateway-config
  namespace: nginx-gateway
spec:
  logging:
    level: info

• Gateway： 定义流量处理基础设施（例如云负载均衡器或反向代理）的一个具体实例。

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: cafe
spec:
  gatewayClassName: nginx
  listeners:
  - name: http
    port: 80
    protocol: HTTP

• HTTPRoute： 定义HTTP协议特定的规则，用于将来自网关监听器的流量映射到后端服务（Service）。

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: coffee
spec:
  parentRefs:
  - name: cafe
  hostnames:
  - “cafe.example.com”
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: coffee
      port: 80

上述HTTPRoute引用的后端服务定义如下：

---
apiVersion: v1
kind: Service
metadata:
  name: coffee
spec:
  ports:
  - port: 80
    targetPort: 8080
    protocol: TCP
    name: http
  selector:
    app: coffee
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: coffee
spec:
  replicas: 4
  selector:
    matchLabels:
      app: coffee
  template:
    metadata:
      labels:
        app: coffee
    spec:
      containers:
      - name: coffee
        image: dockerhub.kubekey.local/nginx/nginxdemos/nginx-hello:plain-text
        ports:
      - containerPort: 8080

Gateway API 的资源间存在清晰的依赖关系，以支持面向角色的设计。一个 Gateway 对象关联一个 GatewayClass；而多个路由资源（如 HTTPRoute）可以关联到同一个 Gateway。Gateway 可以通过监听器（listeners）过滤可绑定的路由，形成了双向的信任模型。

下图清晰地展示了这三种稳定API资源之间的关系：

请求数据流

以下是一个使用 Gateway 和 HTTPRoute 将HTTP流量路由到服务的简单数据流示例：

在此示例中，作为反向代理的 Gateway 处理请求的流程如下：

1. 客户端发起一个指向 http://www.example.com 的HTTP请求。
2. 客户端的DNS解析器查询该域名，并获得关联到Gateway的一个或多个IP地址。
3. 客户端向Gateway的IP地址发送请求；反向代理接收请求，并根据 Host 头部匹配基于Gateway及其关联的HTTPRoute所生成的配置。
4. （可选）反向代理可根据HTTPRoute中定义的匹配规则，进一步匹配请求头或路径。
5. （可选）反向代理可以修改请求，例如根据HTTPRoute的过滤规则添加或删除请求头。
6. 最后，反向代理将请求转发到一个或多个后端服务。

部署实战

我们以NGINX官方实现的NGINX Gateway Fabric为例进行部署。

参考文档：

• NGINX Gateway Fabric 安装指南
• Gateway API 官方指南

1. 安装 Gateway API CRDs

kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml

2. 部署 NGINX Gateway Fabric 的 CRDs

kubectl apply -f https://raw.githubusercontent.com/nginx/nginx-gateway-fabric/v1.6.2/deploy/crds.yaml

3. 以 NodePort 方式部署 NGINX Gateway Fabric

kubectl apply -f https://raw.githubusercontent.com/nginx/nginx-gateway-fabric/v1.6.2/deploy/nodeport/deploy.yaml

加速技巧： 在国内环境，可以预先在各个工作节点上从可访问的镜像站拉取所需镜像，加速部署。

# 在 node1 执行
ctr -n=k8s.io images pull ghcr.nju.edu.cn/nginx/nginx-gateway-fabric/nginx:1.6.2
ctr -n=k8s.io images pull ghcr.nju.edu.cn/nginx/nginx-gateway-fabric:1.6.2

# 在 node2 执行
ctr -n=k8s.io images pull ghcr.nju.edu.cn/nginx/nginx-gateway-fabric/nginx:1.6.2
ctr -n=k8s.io images pull ghcr.nju.edu.cn/nginx/nginx-gateway-fabric:1.6.2

性能优化建议： 官网默认以Deployment方式部署nginx-gateway-controller，但推荐使用DaemonSet，让其在每个节点上都运行一个实例，通常能获得更好的请求处理性能。可以通过配置Pod反亲和性来实现类似效果：

affinity:
  podAntiAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
    - weight: 100
      podAffinityTerm:
        labelSelector:
          matchLabels:
            app.kubernetes.io/name: nginx-gateway
        topologyKey: kubernetes.io/hostname

测试与演示

1. 基础流量路由

准备示例应用：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: coffee
spec:
  replicas: 4
  selector:
    matchLabels:
      app: coffee
  template:
    metadata:
      labels:
        app: coffee
    spec:
      containers:
      - name: coffee
        image: dockerhub.kubekey.local/nginx/nginxdemos/nginx-hello:plain-text
        ports:
        - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: coffee
spec:
  ports:
  - port: 80
    targetPort: 8080
    protocol: TCP
    name: http
  selector:
    app: coffee

创建Gateway：

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: cafe
spec:
  gatewayClassName: nginx
  listeners:
  - name: http
    port: 80
    protocol: HTTP

创建HTTPRoute：

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: coffee
spec:
  parentRefs:
  - name: cafe
  hostnames:
  - “cafe.example.com”
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: coffee
      port: 80

测试验证： 在客户端hosts文件中添加映射后（例如 172.20.100.247 cafe.example.com），通过curl访问：

$ curl cafe.example.com:31949
Server address: 10.233.69.47:8080
Server name: coffee-69fd995757-tpjrb
Date: 26/May/2025:08:55:34 +0000
URI: /
Request ID: 7b7551b044cab8b484d83cb751e0fbb0

2. 使用HTTP匹配条件进行路由

此示例演示如何根据请求头和查询参数将流量路由到不同版本的应用。

部署v1和v2版本的应用：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: coffee-v1
spec:
  replicas: 1
  selector:
    matchLabels:
      app: coffee-v1
  template:
    metadata:
      labels:
        app: coffee-v1
    spec:
      containers:
      - name: coffee-v1
        image: dockerhub.kubekey.local/nginx/nginxdemos/nginx-hello:plain-text
        ports:
        - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: coffee-v1-svc
spec:
  ports:
  - port: 80
    targetPort: 8080
    protocol: TCP
    name: http
  selector:
    app: coffee-v1
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: coffee-v2
spec:
  replicas: 1
  selector:
    matchLabels:
      app: coffee-v2
  template:
    metadata:
      labels:
        app: coffee-v2
    spec:
      containers:
      - name: coffee-v2
        image: dockerhub.kubekey.local/nginx/nginxdemos/nginx-hello:plain-text
        ports:
        - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: coffee-v2-svc
spec:
  ports:
  - port: 80
    targetPort: 8080
    protocol: TCP
    name: http
  selector:
    app: coffee-v2

部署Gateway（同上，略）。

部署配置了复杂匹配规则的HTTPRoute：

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: coffee
spec:
  parentRefs:
  - name: cafe
    sectionName: http
  hostnames:
  - cafe.example.com
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /coffee
    backendRefs:
    - name: coffee-v1-svc
      port: 80
  - matches:
    - path: # 匹配路径前缀为 /coffee 且请求头 version=v2
        type: PathPrefix
        value: /coffee
      headers:
      - name: version
        value: v2
    - path: # 匹配路径前缀为 /coffee 且查询参数 TEST=v2
        type: PathPrefix
        value: /coffee
      queryParams:
      - name: TEST
        value: v2
    backendRefs:
    - name: coffee-v2-svc
      port: 80

验证部署：

# 默认路由到 v1 版本
$ curl cafe.example.com:31949/coffee
Server address: 10.233.82.54:8080
Server name: coffee-v1-74b84b598f-6sflr
...

# 通过请求头 version:v2 路由到 v2 版本
$ curl cafe.example.com:31949/coffee -H “version:v2”
Server address: 10.233.69.50:8080
Server name: coffee-v2-67947f4b9f-5blzs
...

# 通过查询参数 Test=v2 路由（注意示例中规则匹配的是大写的TEST参数）
$ curl cafe.example.com:31949/coffee?Test=v2
Server address: 10.233.82.54:8080
Server name: coffee-v1-74b84b598f-6sflr
...

补充演示：根据HTTP方法路由 部署Tea应用，并根据GET和POST方法路由到不同服务。

部署Tea应用（略，类似Coffee应用部署）。

部署根据HTTP方法匹配的HTTPRoute：

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: tea
spec:
  parentRefs:
  - name: cafe
  hostnames:
  - cafe.example.com
  rules:
  - matches:  # 第一条规则：将到 /tea 路径的 POST 请求路由到 tea-post Service
    - path:
        type: PathPrefix
        value: /tea
      method: POST
    backendRefs:
    - name: tea-post-svc
      port: 80
  - matches:  # 第二条规则：将到 /tea 路径的 GET 请求路由到 tea Service
    - path:
        type: PathPrefix
        value: /tea
      method: GET
    backendRefs:
    - name: tea-svc
      port: 80

验证：

$ curl cafe.example.com:31949/tea -X POST
Server address: 10.233.82.55:8080
Server name: tea-post-766fd7dddf-kcnst
...

$ curl cafe.example.com:31949/tea -X GET
Server address: 10.233.69.51:8080
Server name: tea-97c885457-gdnnl
...

3. HTTP请求重写与重定向

3.1 请求重写（URL Rewrite）

请求重写用于在将请求转发到后端之前修改请求的路径。

部署应用与Gateway（略）。

部署包含URL重写过滤器的HTTPRoute：

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: coffee
spec:
  parentRefs:
  - name: gateway
    sectionName: http
  hostnames:
  - “cafe.example.com”
  rules:
  - matches: # 将 /coffee 和 /coffee/flavors 的完整路径重写为 /beans
    - path:
        type: PathPrefix
        value: /coffee
    filters:
    - type: URLRewrite
      urlRewrite:
        path:
          type: ReplaceFullPath
          replaceFullPath: /beans
    backendRefs:
    - name: coffee
      port: 80
  - matches: # 将 /latte 路径前缀替换为 / (即去掉前缀)，/latte/prices 变为 /prices
    - path:
        type: PathPrefix
        value: /latte
    filters:
    - type: URLRewrite
      urlRewrite:
        path:
          type: ReplacePrefixMatch
          replacePrefixMatch: /
    backendRefs:
    - name: coffee
      port: 80

验证：

$ curl cafe.example.com:31949/coffee
URI: /beans # 路径已被重写
...
$ curl cafe.example.com:31949/coffee/flavors
URI: /beans # 路径已被重写
...
$ curl cafe.example.com:31949/latte/prices
URI: /prices # 前缀 /latte 被替换为 /
...

3.2 请求重定向（Redirect）

请求重定向使网关直接向客户端返回重定向响应。

部署应用（略）。

部署包含重定向过滤器的HTTPRoute：

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: tea-redirect
spec:
  parentRefs:
  - name: gateway
    sectionName: http
  hostnames:
  - “cafe.example.com”
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /tea
    filters:
    - type: RequestRedirect
      requestRedirect:
        path:
          type: ReplacePrefixMatch
          replacePrefixMatch: /organic
        port: 8080 # 重定向到8080端口
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: soda-redirect
spec:
  parentRefs:
  - name: gateway
    sectionName: http
  hostnames:
  - “cafe.example.com”
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /soda
    filters:
    - type: RequestRedirect
      requestRedirect:
        path:
          type: ReplaceFullPath
          replaceFullPath: /flavors
        port: 8080

验证（查看返回的302响应及Location头）：

$ curl http://cafe.example.com:31949/tea --include
HTTP/1.1 302 Moved Temporarily
...
Location: http://cafe.example.com:8080/organic # 路径前缀被替换，端口改变
...

4. HTTPS 终止（TLS Termination）

此示例展示如何在网关上终止TLS，并将HTTP流量重定向到HTTPS。

1. 部署应用（略）。

2. 创建命名空间并存储TLS证书Secret：

apiVersion: v1
kind: Namespace
metadata:
  name: certificate
---
apiVersion: v1
kind: Secret
metadata:
  name: cafe-secret
  namespace: certificate
type: kubernetes.io/tls
data:
  tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNzakNDQVpvQ0NRQzdCdVdXdWRtRkNEQU5CZ2txaGtpRzl3MEJBUXNGQURBYk1Sa3dGd1lEVlFRRERCQmoKWVdabExtVjRZVzF3YkdVdVkyOXRNQjRYRFRJeU1EY3hOREl4TlRJek9Wb1hEVEl6TURjeE5ESXhOVEl6T1ZvdwpHekVaTUJjR0ExVUVBd3dRWTJGbVpTNWxlR0Z0Y0d4bExtTnZiVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFECmdnRVBBRENDQVFvQ2dnRUJBTHFZMnRHNFc5aStFYzJhdnV4Q2prb2tnUUx1ek10U1Rnc1RNaEhuK3ZRUmxIam8KVzFLRnMvQVdlS25UUStyTWVKVWNseis4M3QwRGtyRThwUisxR2NKSE50WlNMb0NEYUlRN0Nhck5nY1daS0o4Qgo1WDNnVS9YeVJHZjI2c1REd2xzU3NkSEQ1U2U3K2Vab3NPcTdHTVF3K25HR2NVZ0VtL1Q1UEMvY05PWE0zZWxGClRPL051MStoMzROVG9BbDNQdTF2QlpMcDNQVERtQ0thaEROV0NWbUJQUWpNNFI4VERsbFhhMHQ5Z1o1MTRSRzUKWHlZWTNtdzZpUzIrR1dYVXllMjFuWVV4UEhZbDV4RHY0c0FXaGRXbElweHlZQlNCRURjczN6QlI2bFF1OWkxZAp0R1k4dGJ3blVmcUVUR3NZdWxzc05qcU95V1VEcFdJelhibHhJZVVDQXdFQUFUQU5CZ2txaGtpRzl3MEJBUXNGCkFBT0NBUUVBcjkrZWJ0U1dzSnhLTGtLZlRkek1ISFhOd2Y5ZXFVbHNtTXZmMGdBdWVKTUpUR215dG1iWjlpbXQKL2RnWlpYVE9hTElHUG9oZ3BpS0l5eVVRZVdGQ2F0NHRxWkNPVWRhbUloOGk0Q1h6QVJYVHNvcUNOenNNLzZMRQphM25XbFZyS2lmZHYrWkxyRi8vblc0VVNvOEoxaCtQeDljY0tpRDZZU0RVUERDRGh1RUtFWXcvbHpoUDJVOXNmCnl6cEJKVGQ4enFyM3paTjNGWWlITmgzYlRhQS82di9jU2lyamNTK1EwQXg4RWpzQzYxRjRVMTc4QzdWNWRCKzQKcmtPTy9QNlA0UFlWNTRZZHMvRjE2WkZJTHFBNENCYnExRExuYWRxamxyN3NPbzl2ZzNnWFNMYXBVVkdtZ2todAp6VlZPWG1mU0Z4OS90MDBHUi95bUdPbERJbWlXMGc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
  tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQzZtTnJSdUZ2WXZoSE4KbXI3c1FvNUtKSUVDN3N6TFVrNExFeklSNS9yMEVaUjQ2RnRTaGJQd0ZuaXAwMFBxekhpVkhKYy92TjdkQTVLeApQS1VmdFJuQ1J6YldVaTZBZzJpRU93bXF6WUhGbVNpZkFlVjk0RlAxOGtSbjl1ckV3OEpiRXJIUncrVW51L25tCmFMRHF1eGpFTVBweGhuRklCSnYwK1R3djNEVGx6TjNwUlV6dnpidGZvZCtEVTZBSmR6N3Rid1dTNmR6MHc1Z2kKbW9RelZnbFpnVDBJek9FZkV3NVpWMnRMZllHZWRlRVJ1VjhtR041c09va3R2aGxsMU1udHRaMkZNVHgySmVjUQo3K0xBRm9YVnBTS2NjbUFVZ1JBM0xOOHdVZXBVTHZZdFhiUm1QTFc4SjFINmhFeHJHTHBiTERZNmpzbGxBNlZpCk0xMjVjU0hsQWdNQkFBRUNnZ0VBQnpaRE50bmVTdWxGdk9HZlFYaHRFWGFKdWZoSzJBenRVVVpEcUNlRUxvekQKWlV6dHdxbkNRNlJLczUyandWNTN4cU9kUU94bTNMbjNvSHdNa2NZcEliWW82MjJ2dUczYnkwaVEzaFlsVHVMVgpqQmZCcS9UUXFlL2NMdngvSkczQWhFNmJxdFRjZFlXeGFmTmY2eUtpR1dzZk11WVVXTWs4MGVJVUxuRmZaZ1pOCklYNTlSOHlqdE9CVm9Sa3hjYTVoMW1ZTDFsSlJNM3ZqVHNHTHFybmpOTjNBdWZ3ZGRpK1VDbGZVL2l0K1EvZkUKV216aFFoTlRpNVFkRWJLVStOTnYvNnYvb2JvandNb25HVVBCdEFTUE05cmxFemIralQ1WHdWQjgvLzRGY3VoSwoyVzNpcjhtNHVlQ1JHSVlrbGxlLzhuQmZ0eVhiVkNocVRyZFBlaGlPM1FLQmdRRGlrR3JTOTc3cjg3Y1JPOCtQClpoeXltNXo4NVIzTHVVbFNTazJiOTI1QlhvakpZL2RRZDVTdFVsSWE4OUZKZnNWc1JRcEhHaTFCYzBMaTY1YjIKazR0cE5xcVFoUmZ1UVh0UG9GYXRuQzlPRnJVTXJXbDVJN0ZFejZnNkNQMVBXMEg5d2hPemFKZUdpZVpNYjlYTQoybDdSSFZOcC9jTDlYbmhNMnN0Q1lua2Iwd0tCZ1FEUzF4K0crakEyUVNtRVFWNXA1RnRONGcyamsyZEFjMEhNClRIQ2tTazFDRjhkR0Z2UWtsWm5ZbUt0dXFYeXNtekJGcnZKdmt2eUhqbUNYYTducXlpajBEdDZtODViN3BGcVAKQWxtajdtbXI3Z1pUeG1ZMXBhRWFLMXY4SDNINGtRNVl3MWdrTWRybVJHcVAvaTBGaDVpaGtSZS9DOUtGTFVkSQpDcnJjTzhkUVp3S0JnSHA1MzRXVWNCMVZibzFlYStIMUxXWlFRUmxsTWlwRFM2TzBqeWZWSmtFb1BZSEJESnp2ClIrdzZLREJ4eFoyWmJsZ05LblV0YlhHSVFZd3lGelhNcFB5SGxNVHpiZkJhYmJLcDFyR2JVT2RCMXpXM09PRkgKcmppb21TUm1YNmxhaDk0SjRHU0lFZ0drNGw1SHhxZ3JGRDZ2UDd4NGRjUktJWFpLZ0w2dVJSSUpBb0dCQU1CVApaL2p5WStRNTBLdEtEZHUrYU9ORW4zaGxUN3hrNXRKN3NBek5rbWdGMU10RXlQUk9Xd1pQVGFJbWpRbk9qbHdpCldCZ2JGcXg0M2ZlQ1Z4ZXJ6V3ZEM0txaWJVbWpCTkNMTGtYeGh3ZEVteFQwVit2NzZGYzgwaTNNYVdSNnZZR08KditwVVovL0F6UXdJcWZ6dlVmV2ZxdStrMHlhVXhQOGNlcFBIRyt0bEFvR0FmQUtVVWhqeFU0Ym5vVzVwVUhKegpwWWZXZXZ5TW54NWZyT2VsSmRmNzlvNGMvMHhVSjh1eFBFWDFkRmNrZW96dHNpaVFTNkN6MENRY09XVWxtSkRwCnVrdERvVzM3VmNSQU1BVjY3NlgxQVZlM0UwNm5aL2g2Tkd4Z28rT042Q3pwL0lkMkJPUm9IMFAxa2RjY1NLT3kKMUtFZlNnb1B0c1N1eEpBZXdUZmxDMXc9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K

3. 创建ReferenceGrant，允许Gateway访问其他命名空间中的Secret：

apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: access-to-cafe-secret
  namespace: certificate
spec:
  to:
  - group: “”
    kind: Secret
    name: cafe-secret # 如果省略此名称，则default命名空间中的Gateway可以访问certificate命名空间中的所有Secret
  from:
  - group: gateway.networking.k8s.io
    kind: Gateway
    namespace: default

4. 创建配置了HTTPS监听器的Gateway：

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: cafe
spec:
  gatewayClassName: nginx
  listeners:
  - name: http
    port: 80
    protocol: HTTP
  - name: https
    port: 443
    protocol: HTTPS
    tls:
      mode: Terminate
      certificateRefs:
      - kind: Secret
        name: cafe-secret
        namespace: certificate

5. 创建HTTPRoute：一个用于HTTP到HTTPS的重定向，一个用于HTTPS流量路由：

# 此Route将HTTP请求重定向到HTTPS
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: cafe-tls-redirect
spec:
  parentRefs:
  - name: cafe
    sectionName: http
  hostnames:
  - “cafe.example.com”
  rules:
  - filters:
    - type: RequestRedirect
      requestRedirect:
        scheme: https
        port: 443
---
# 此Route处理HTTPS流量
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: coffee
spec:
  parentRefs:
  - name: cafe
    sectionName: https
  hostnames:
  - “cafe.example.com”
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /coffee
    backendRefs:
    - name: coffee
      port: 80

6. 验证部署： 获取Gateway的外部IP和端口，然后进行测试。

# 测试HTTP访问（应返回重定向响应）
curl --resolve cafe.example.com:$GW_HTTP_PORT:$GW_IP http://cafe.example.com:$GW_HTTP_PORT/coffee --include
# 测试HTTPS访问
curl --resolve cafe.example.com:$GW_HTTPS_PORT:$GW_IP https://cafe.example.com:$GW_HTTPS_PORT/coffee --insecure