DOCSEARCHbyAlgolia
Submit Docs

Gloo Gateway

repository·main·Indexed 41 days ago

https://github.com/solo-io/gloo

An Envoy-powered, Kubernetes-native API gateway and ingress controller designed for hybrid applications. It supports routing to microservices, serverless functions, and legacy applications using the Kubernetes Gateway API.

Tokens
501.6K
Snippets
1.4K
Records
2K
Agent score
50%

What's inside Gloo

  1. Overview of Gloo Gateway API

    main

    Gloo is a high-performance, plugin-extendable, platform-agnostic API Gateway built on top of Envoy. It is designed to support microservice, monolithic, and serverless applications.

    Key capabilities include:

    • Function-level routing: Decouples client APIs from upstream APIs at the routing level.
    • Abstraction layer: Acts as a buffer between clients and upstream services, allowing front-end and back-end teams to work independently.

    The current API version is gloo.solo.io.v1.

  2. Overview of Gloo, The Hybrid Application Gateway

    main

    Gloo is a high-performance, plugin-extendable, and platform-agnostic API Gateway built on top of Envoy. It is designed to support microservice, monolithic, and serverless applications.

    A key feature of Gloo is function-level routing, which allows for the complete decoupling of client APIs from upstream APIs at the routing level. This provides an abstraction layer between clients and upstream services, enabling front-end teams to work independently of the teams developing the underlying microservices.

  3. What is Gloo Gateway?

    main

    Gloo Gateway is a Kubernetes-native ingress controller and API gateway designed to support hybrid application architectures. It acts as a decoupled control plane for Envoy Proxy, allowing developers to manage Envoy dynamically using xDS gRPC APIs in a declarative format.

    Key capabilities include:

    • Kubernetes Ingress: Simplifies routing when deployed on Kubernetes (e.g., AWS EKS).
    • Hybrid App Support: Routes traffic to diverse backends including microservices, serverless functions (Lambda, Google Cloud Function, OpenFaaS), legacy applications (REST, SOAP), and message queues.
    • Service Mesh Ingress: Complements service meshes (Istio, Linkerd, Consul Connect, AWS App Mesh) by handling edge-specific concerns like OAuth, WAF, edge caching, and per-user rate limiting.
    • Automated Discovery: Continuously maintains a catalog of destinations across IaaS, PaaS, FaaS, Swagger, and gRPC.

  4. Overview of Gloo Gateway Traffic Management

    main

    Gloo Gateway provides a routing engine capable of handling diverse traffic patterns, ranging from simple API-to-API routing to complex protocol conversions (e.g., HTTP to gRPC) involving body and header transformations.

    A key capability is the ability to route requests directly to various function providers, supporting hybrid application architectures. This includes:

    • Serverless functions: AWS Lambda, Google Cloud Functions, and Azure Functions.
    • Microservices/Legacy services: REST API calls, OpenAPI operations, and gRPC operations.

  5. Overview of Gloo Gateway

    main

    Gloo Gateway is a Kubernetes-native ingress controller and next-generation API gateway built on top of Envoy Proxy and the Kubernetes Gateway API.

    Key capabilities include:

    • Function-level routing: Routes requests to microservices, serverless functions (e.g., Lambda, Google Cloud Function, OpenFaaS), legacy services (REST, OpenAPI, XML/SOAP), or message queues (NATS, AMQP).
    • API Gateway Features: Supports rate limiting, circuit breaking, retries, caching, transformation, service-mesh integration, security, and external authentication/authorization.
    • Automated Discovery: Automatically creates and maintains a catalog of available destinations across IaaS, PaaS, FaaS, Swagger, and gRPC providers.
    • Open Source Integration: Integrates with projects like gRPC, OpenTelemetry, and NATS.

  6. Overview of Gloo API (gloo.solo.io.v1)

    main

    Gloo is a high-performance, plugin-extendable, platform-agnostic API Gateway built on top of Envoy. It is designed to support microservice, monolithic, and serverless applications.

    Key capabilities include:

    • Function-level routing: Decouples client APIs from upstream APIs at the routing level.
    • Abstraction layer: Acts as an intermediary between clients and upstream services, enabling front-end teams to work independently of microservice development teams.

    The current API version is gloo.solo.io.v1.

  7. Authentication and Authorization options in Gloo Gateway

    main

    Gloo Gateway provides multiple mechanisms to establish and validate client identity and enforce access control policies at the API Gateway level. Depending on your requirements for performance, complexity, and integration, you can choose from the following methods:

    1. External Authentication (Ext Auth)

    Available in Gloo Gateway Enterprise, the Ext Auth service allows for complex, multi-step authentication and authorization processes.

    • Built-in Support: Authenticate with Identity Providers using LDAP or OIDC.
    • Standard Methods: Supports Basic Auth and API Keys.
    • Custom Logic: Includes a plugin framework to load and configure custom business logic for bespoke authentication protocols.
    • Fine-grained Authorization: Supports Rego (via Open Policy Agent) for applying granular access policies.
    • Chaining: Ext Auth configurations can be chained to perform sequential authentication and authorization steps.

    2. JSON Web Tokens (JWT)

    Use JWTs for high-performance authentication where Gloo Gateway validates a token from a trusted source.

    • Performance: Verification is performed directly in Envoy, making it faster and more resource-efficient than remote calls to an external auth service.
    • Mechanism: Gloo Gateway verifies the token signature and claims without necessarily performing an authentication handoff to an external provider.

    3. Custom Authentication Services

    For specialized requirements, you can develop and integrate your own custom authentication service directly with Gloo Gateway.

  9. Use cases for Route Table Delegation

    main

    Delegation is useful for several organizational and technical patterns:

    • Multi-tenancy: Allow different teams to manage their own routes (add, remove, update) without granting them access to the root-level Virtual Service.
    • Configuration Sharing: Reuse the same Route Table configuration across multiple Virtual Services.
    • Blue-Green Deployments: Simplify traffic shifting by swapping a target Route Table for a delegated route.
    • Complexity Management: Break down massive, single-object routing configurations into manageable, modular pieces.
    • Granular Ownership: Restrict a tenant's control to only a specific subset of the overall Virtual Service routing logic.

  10. Observability in Gloo Gateway

    main

    Gloo Gateway provides observability by exposing metrics from both the data plane (Envoy) and the control plane components. These metrics can be scraped into standard metrics backends like Prometheus.

    Open Source vs. Enterprise

    • Open Source Gloo Gateway: Metrics are available and can be scraped into your own Prometheus instance.
    • Enterprise Gloo Gateway:
      • Installs a Prometheus server and Grafana instance by default.
      • Includes built-in Grafana dashboards for Envoy proxy health.
      • Includes an observability component that dynamically creates a new Grafana dashboard for every Gloo Gateway Upstream.

  11. Gloo Edge API Overview

    main

    Gloo Edge is a high-performance, plugin-extendable, platform-agnostic API Gateway built on top of Envoy. It is designed to support microservice, monolithic, and serverless applications.

    Key capability:

    • Function-level routing: Decouples client APIs from upstream APIs at the routing level, acting as an abstraction layer between clients and upstream services.

  12. Use glooctl command groups

    main

    The glooctl CLI provides a wide range of subcommands for managing Gloo resources, clusters, and proxies. Common task groups include:

    • Resource Management: create, get, edit, delete, add, and remove for managing Gloo resources.
    • System Operations: install, uninstall, upgrade, check, and check-crds for managing the Gloo installation and CRD consistency.
    • Observability & Debugging: dashboard to open the UI, debug for troubleshooting, and usage to scan for feature usage.
    • Specialized Management: gateway-api for Kubernetes Gateway API interactions, istio for Istio integration, and proxy for managing proxy instances.
    • Plugin Management: plugin for interacting with CLI plugins and init-plugin-manager for the Enterprise CLI plugin manager.