We use analytics and cookies to understand site traffic. Information about your use of our site is shared with Google for that purpose. Learn more.
Setting up custom ingress gateway
Knative uses a shared ingress Gateway to serve all incoming traffic within
Knative service mesh, which is the knative-ingress-gateway
Gateway under
knative-serving
namespace. By default, we use Istio gateway service
istio-ingressgateway
under istio-system
namespace as its underlying service.
You can replace the service with that of your own as follows.
Step 1: Create Gateway Service and Deployment Instance
You'll need to create the gateway service and deployment instance to handle traffic first. The simplest way should be making a copy of the Gateway service template in Istio release.
Here is an example:
apiVersion: v1
kind: Service
metadata:
name: custom-ingressgateway
namespace: istio-system
annotations:
labels:
chart: gateways-1.0.1
release: RELEASE-NAME
heritage: Tiller
app: custom-ingressgateway
custom: ingressgateway
spec:
type: LoadBalancer
selector:
app: custom-ingressgateway
custom: ingressgateway
ports:
- name: http2
nodePort: 32380
port: 80
targetPort: 80
- name: https
nodePort: 32390
port: 443
- name: tcp
nodePort: 32400
port: 31400
- name: tcp-pilot-grpc-tls
port: 15011
targetPort: 15011
- name: tcp-citadel-grpc-tls
port: 8060
targetPort: 8060
- name: tcp-dns-tls
port: 853
targetPort: 853
- name: http2-prometheus
port: 15030
targetPort: 15030
- name: http2-grafana
port: 15031
targetPort: 15031
---
# This is the corresponding deployment to back the gateway service
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
name: custom-ingressgateway
namespace: istio-system
labels:
chart: gateways-1.0.1
release: RELEASE-NAME
heritage: Tiller
app: custom-ingressgateway
custom: ingressgateway
spec:
replicas: 1
selector:
matchLabels:
app: custom-ingressgateway
custom: ingressgateway
template:
metadata:
labels:
app: custom-ingressgateway
custom: ingressgateway
annotations:
sidecar.istio.io/inject: "false"
scheduler.alpha.kubernetes.io/critical-pod: ""
spec:
serviceAccountName: istio-ingressgateway-service-account
containers:
- name: istio-proxy
image: "docker.io/istio/proxyv2:1.0.2"
imagePullPolicy: IfNotPresent
ports:
- containerPort: 80
- containerPort: 443
- containerPort: 31400
- containerPort: 15011
- containerPort: 8060
- containerPort: 853
- containerPort: 15030
- containerPort: 15031
args:
- proxy
- router
- -v
- "2"
- --discoveryRefreshDelay
- "1s" #discoveryRefreshDelay
- --drainDuration
- "45s" #drainDuration
- --parentShutdownDuration
- "1m0s" #parentShutdownDuration
- --connectTimeout
- "10s" #connectTimeout
- --serviceCluster
- custom-ingressgateway
- --zipkinAddress
- zipkin:9411
- --statsdUdpAddress
- istio-statsd-prom-bridge:9125
- --proxyAdminPort
- "15000"
- --controlPlaneAuthPolicy
- NONE
- --discoveryAddress
- istio-pilot:8080
resources:
requests:
cpu: 10m
env:
- name: POD_NAME
valueFrom:
fieldRef:
apiVersion: v1
fieldPath: metadata.name
- name: POD_NAMESPACE
valueFrom:
fieldRef:
apiVersion: v1
fieldPath: metadata.namespace
- name: INSTANCE_IP
valueFrom:
fieldRef:
apiVersion: v1
fieldPath: status.podIP
- name: ISTIO_META_POD_NAME
valueFrom:
fieldRef:
fieldPath: metadata.name
volumeMounts:
- name: istio-certs
mountPath: /etc/certs
readOnly: true
- name: ingressgateway-certs
mountPath: "/etc/istio/ingressgateway-certs"
readOnly: true
- name: ingressgateway-ca-certs
mountPath: "/etc/istio/ingressgateway-ca-certs"
readOnly: true
volumes:
- name: istio-certs
secret:
secretName: istio.istio-ingressgateway-service-account
optional: true
- name: ingressgateway-certs
secret:
secretName: "istio-ingressgateway-certs"
optional: true
- name: ingressgateway-ca-certs
secret:
secretName: "istio-ingressgateway-ca-certs"
optional: true
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
nodeSelectorTerms:
- matchExpressions:
- key: beta.kubernetes.io/arch
operator: In
values:
- amd64
- ppc64le
- s390x
preferredDuringSchedulingIgnoredDuringExecution:
- weight: 2
preference:
matchExpressions:
- key: beta.kubernetes.io/arch
operator: In
values:
- amd64
- weight: 2
preference:
matchExpressions:
- key: beta.kubernetes.io/arch
operator: In
values:
- ppc64le
- weight: 2
preference:
matchExpressions:
- key: beta.kubernetes.io/arch
operator: In
values:
- s390x
Step 2: Update Knative Gateway
Update gateway instance knative-ingress-gateway
under knative-serving
namespace:
kubectl edit gateway knative-ingress-gateway -n knative-serving
Replace the label selector with the label of your service:
istio: ingressgateway
For the service above, it should be updated to:
custom: ingressgateway
If there is a change in service ports (compared with that of
istio-ingressgateway
), update the port info in the gateway accordingly.
Step 3: Update Gateway Configmap
Update gateway configmap config-istio
under knative-serving
namespace:
kubectl edit configmap config-istio -n knative-serving
Replace the ingress-gateway
field with the fully qualified url of your
service. For the service above, it should be updated to:
custom-ingressgateway.istio-system.svc.cluster.local
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.