envoyproxy / envoyproxy/gateway

Support for multiple LoadBalancer Services for a single Gateway instance

Open
#7,892 2 comments 4 reactions 0 assignees View on GitHub
stale triage
Dominant language
Go
Stars
3k
Forks
864
Avg merge
2d 2h
Merged PRs (30d)
140

Description

*Description*:

Currently, Envoy Gateway follows a 1-to-1 mapping between a `Gateway` resource and a Kubernetes `Service` of type `LoadBalancer`. While the Gateway API spec allows multiple addresses in `spec.addresses`, most Cloud Providers (specifically GKE, which I am using) do not support mapping multiple IPv4 addresses to a single `Service` object. Each `Service` is bound to a single Forwarding Rule / Load Balancer IP.

To achieve multiple external IP addresses for what is logically the same entry point, users currently have to either:

1. Create multiple `Gateway` resources (which results in redundant Envoy Deployments, wasted CPU/RAM and complicated management of shared filters and state).
2. Manually create and manage secondary `Service` objects that point to the Envoy pods via selectors (which breaks the "GitOps" flow and makes the controller unaware of these entry points).

*Use Case:*

**Isolation for External Partners:** We need to provide different IP addresses for different partners/clients. For business or security reasons, these partners use different domains that must resolve to unique IP addresses, rather than sharing a single global IP. However, we want these IPs to be handled by the same Envoy proxy fleet to maintain centralized routing logic, shared cache, and efficient resource utilization.

*Proposed Solution:*

The controller should be able to provision several Services for a single Gateway. This could be achieved in two ways:

1. **Automatic:** If multiple IP addresses are defined in `spec.addresses` of the `Gateway` resource, the controller could automatically provision multiple `v1/Service` objects if the underlying cloud provider doesn't support multiple IPs per Service.
2. **Explicit via EnvoyProxy:** Introduce a way to define several Services within the `EnvoyProxy` configuration by adding an `envoyServices` field to the `KubernetesProxyProvider` (following the analogy of the existing `envoyService` field).

*Example hypothetical config in `EnvoyProxy`:*

```yaml
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyProxy
metadata:
name: multi-ip-proxy-config
spec:
provider:
type: Kubernetes
kubernetes:
# Following the analogy of envoyService:
# https://gateway.envoyproxy.io/docs/api/extension_types/#envoyproxykubernetesprovider
envoyServices:
- type: LoadBalancer
loadBalancerIP: "34.x.x.1"
- type: LoadBalancer
loadBalancerIP: "34.x.x.2"

```

*Affected Components:*

* Envoy Gateway Controller (Infrastructure Provisioning logic)
* `EnvoyProxy` CRD API (`KubernetesProxyProvider` type)

*Relevant Links*:
- [EnvoyProxy.spec.provider.kubernetes](https://gateway.envoyproxy.io/docs/api/extension_types/#envoyproxykubernetesprovider)
- [Gatewat.spec.addresses](https://gateway-api.sigs.k8s.io/reference/spec/#gatewayspecaddress)

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.