envoyproxy / envoyproxy/gateway
Support for multiple LoadBalancer Services for a single Gateway instance
- Dominant language
- Go
- Stars
- 3k
- Forks
- 864
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 140
Description
*Description*:
Currently, Envoy Gateway follows a 1-to-1 mapping between a `Gateway` resource and a Kubernetes `Service` of type `LoadBalancer`. While the Gateway API spec allows multiple addresses in `spec.addresses`, most Cloud Providers (specifically GKE, which I am using) do not support mapping multiple IPv4 addresses to a single `Service` object. Each `Service` is bound to a single Forwarding Rule / Load Balancer IP.
To achieve multiple external IP addresses for what is logically the same entry point, users currently have to either:
1. Create multiple `Gateway` resources (which results in redundant Envoy Deployments, wasted CPU/RAM and complicated management of shared filters and state).
2. Manually create and manage secondary `Service` objects that point to the Envoy pods via selectors (which breaks the "GitOps" flow and makes the controller unaware of these entry points).
*Use Case:*
**Isolation for External Partners:** We need to provide different IP addresses for different partners/clients. For business or security reasons, these partners use different domains that must resolve to unique IP addresses, rather than sharing a single global IP. However, we want these IPs to be handled by the same Envoy proxy fleet to maintain centralized routing logic, shared cache, and efficient resource utilization.
*Proposed Solution:*
The controller should be able to provision several Services for a single Gateway. This could be achieved in two ways:
1. **Automatic:** If multiple IP addresses are defined in `spec.addresses` of the `Gateway` resource, the controller could automatically provision multiple `v1/Service` objects if the underlying cloud provider doesn't support multiple IPs per Service.
2. **Explicit via EnvoyProxy:** Introduce a way to define several Services within the `EnvoyProxy` configuration by adding an `envoyServices` field to the `KubernetesProxyProvider` (following the analogy of the existing `envoyService` field).
*Example hypothetical config in `EnvoyProxy`:*
```yaml
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyProxy
metadata:
name: multi-ip-proxy-config
spec:
provider:
type: Kubernetes
kubernetes:
# Following the analogy of envoyService:
# https://gateway.envoyproxy.io/docs/api/extension_types/#envoyproxykubernetesprovider
envoyServices:
- type: LoadBalancer
loadBalancerIP: "34.x.x.1"
- type: LoadBalancer
loadBalancerIP: "34.x.x.2"
```
*Affected Components:*
* Envoy Gateway Controller (Infrastructure Provisioning logic)
* `EnvoyProxy` CRD API (`KubernetesProxyProvider` type)
*Relevant Links*:
- [EnvoyProxy.spec.provider.kubernetes](https://gateway.envoyproxy.io/docs/api/extension_types/#envoyproxykubernetesprovider)
- [Gatewat.spec.addresses](https://gateway-api.sigs.k8s.io/reference/spec/#gatewayspecaddress)
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.