Amazon VPC Lattice Gateway API Controller

A ServiceExport resource enables a Kubernetes Service for multi-cluster traffic setup within the AWS Gateway API Controller. When you create a ServiceExport, the controller internally creates a standalone VPC Lattice target group.

Key behaviors:

• Multi-cluster connectivity: Other clusters can import this exported service using a ServiceImport resource.
• Standalone usage: You can use ServiceExport even without ServiceImport if you only need the VPC Lattice target groups created (e.g., for use in VPC Lattice setups outside of Kubernetes).
• Implementation note: This is a custom implementation for Gateway API integration and is not the standard Kubernetes Multicluster Service APIs.

Note: ServiceExport is not a direct implementation of the Kubernetes Multicluster Service APIs; instead, the AWS Gateway API Controller uses its own version of the resource for Gateway API integration.

A ServiceImport is a resource used to refer to a Service or VPC Lattice target group located outside the current cluster. It allows you to distribute traffic across multiple VPCs, multiple clusters, or between EKS-native backends and existing VPC Lattice target groups (such as those pointing to ECS, Lambda, EC2, or ALB).

ServiceImport is used as a backendRef within Gateway API routes (HTTPRoute, GRPCRoute, or TLSRoute). It is not an implementation of the Kubernetes Multicluster Service APIs, but a custom resource used by the AWS Gateway API Controller for VPC Lattice integration.

Key Constraints:

• You cannot send traffic directly to a ServiceImport; it must be used as a backendRef in a route.
• BackendRef ports are not respected; you must use the port annotation on the corresponding ServiceExport instead.
• In Mode 3 (Direct ARN), the controller treats the target group as a reference only: it will not tag it with ManagedBy, will not register targets on it, and will not delete it.

You can use a TargetGroupPolicy to configure protocol, protocol version, and health check settings for a ServiceExport. When a policy targets a ServiceExport, the configuration is automatically propagated to all target groups across all clusters participating in the multi-cluster service mesh.

Protocol Overriding: If you use exportedPorts, the TargetGroupPolicy settings for protocol and protocolVersion will override the default protocol inferred from the routeType. For example, you can set routeType: HTTP in the ServiceExport but use protocol: HTTPS in the TargetGroupPolicy to enable secure communication between VPC Lattice and your backend pods.

# ServiceExport with HTTP routeType
apiVersion: application-networking.k8s.aws/v1alpha1
kind: ServiceExport
metadata:
  name: secure-service
spec:
  exportedPorts:
  - port: 443
    routeType: HTTP  # Default would be HTTP/1
---
# TargetGroupPolicy overriding to HTTPS
apiVersion: application-networking.k8s.aws/v1alpha1
kind: TargetGroupPolicy
metadata:
  name: https-override
spec:
  targetRef:
    group: "application-networking.k8s.aws"
    kind: ServiceExport
    name: secure-service
  protocol: HTTPS        # Overrides HTTP from routeType
  protocolVersion: HTTP2 # Overrides HTTP1 default
  healthCheck:
    enabled: true
    path: "/health"
    protocol: HTTPS
    protocolVersion: HTTP2
    statusMatch: "200-299"

If multiple clusters have services with the same name, use annotations to differentiate them in the federation.

1. In Exporting Clusters: Use the application-networking.k8s.aws/service-name annotation on the ServiceExport to point to the actual Kubernetes Service name, while giving the ServiceExport a unique metadata.name.
2. In Importing Clusters: Use the application-networking.k8s.aws/export-name annotation on the ServiceImport to reference the specific ServiceExport name from the remote cluster.

# In cluster1 (Exporting)
apiVersion: application-networking.k8s.aws/v1alpha1
kind: ServiceExport
metadata:
  name: checkout-cluster1
  annotations:
    application-networking.k8s.aws/federation: "amazon-vpc-lattice"
    application-networking.k8s.aws/service-name: "checkout"
spec:
  exportedPorts:
  - port: 80
    routeType: HTTP
---
# In cluster2 (Importing)
apiVersion: application-networking.k8s.aws/v1alpha1
kind: ServiceImport
metadata:
  name: checkout-import-1
  annotations:
    application-networking.k8s.aws/export-name: "checkout-cluster1"
    application-networking.k8s.aws/aws-eks-cluster-name: "cluster1"
spec:
  type: ClusterSetIP
  ports:
  - port: 80
    protocol: TCP

The HTTPRoute resource allows you to define and manage the routing of HTTP and HTTPS traffic within your Kubernetes cluster using the AWS Gateway API Controller. It enables traffic to be directed to backends based on path matching, HTTP methods, and header matching.

Key Features

• Routing Traffic: Forwards HTTP traffic to servers within your cluster.
• Path Matching: Supports exact paths or paths with a specified prefix.
• Method Matching: Supports matching based on specific HTTP Methods.
• Header Matching: Enables matching based on specific headers in the HTTP request.

Limitations

• Listener Protocol: The sectionName in parentRefs must refer to an http or https listener in the parent Gateway.
• Method Matches: Only one method match is allowed per rule.
• QueryParam Matches: Query parameter matching is not supported.
• Header Matches Limit: A maximum of 5 header matches per rule is supported.
• Case Insensitivity: All path matches are case-insensitive.