diff --git a/AGENTS.md b/AGENTS.md index a3d81dc1..c56b6d0d 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -110,7 +110,8 @@ Use MkDocs Material admonitions: - Use `shell` as the language for terminal commands and output. - Use `hl_lines` to highlight important output lines, e.g. add `hl_lines="3 4"` after the language tag. -- Include `$` prompt prefix only when mixing commands with output. +- Code blocks with more than 4 lines must have a `title=""` attribute. +- Include `%` prompt prefix only when mixing commands with output. ### Child-page listing (index pages) diff --git a/content/README.md b/content/README.md index fb7c0ed8..44b62fd7 100644 --- a/content/README.md +++ b/content/README.md @@ -24,6 +24,7 @@ and benefit from the expertise shared in this repository. |Date|Headline| |---|---| +|2026-07-18|[Gateway API examples and ingress sharding](networking/gateway-api/)| |2026-07-17|[Gatekeeper — Automatic SCC Assignment](cluster-configuration/gatekeeper-opa/automatic-scc-assignment/)| |2026-07-10|[Updated SCC anyuid page with selection process and modern examples](deploy/scc-anyuid.md)| |2026-07-03|[Updated KubeVirt networking: OVN-Bridge, Linux-Bridge, ClusterUserDefinedNetwork](kubevirt/networking/)| diff --git a/content/networking/gateway-api/backendtlspolicy.yaml b/content/networking/gateway-api/backendtlspolicy.yaml new file mode 100644 index 00000000..72355f21 --- /dev/null +++ b/content/networking/gateway-api/backendtlspolicy.yaml @@ -0,0 +1,17 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: BackendTLSPolicy +metadata: + name: simple-https +spec: + targetRefs: + - group: "" + kind: Service + name: simple-https + validation: + # System do not include openshift service serving root ca. + # wellKnownCACertificates: "System" + caCertificateRefs: + - group: "" + kind: ConfigMap + name: my-openshift-service-ca.crt + hostname: simple-https.test-app.svc diff --git a/content/networking/gateway-api/gateway.yaml b/content/networking/gateway-api/gateway.yaml new file mode 100644 index 00000000..2e9f4378 --- /dev/null +++ b/content/networking/gateway-api/gateway.yaml @@ -0,0 +1,29 @@ +kind: Gateway +apiVersion: gateway.networking.k8s.io/v1 +metadata: + name: default + namespace: openshift-ingress +spec: + gatewayClassName: openshift-default + infrastructure: + annotations: + external-dns.alpha.kubernetes.io/hostname: '*.gwapi-default.ocp7.stormshift.coe.muc.redhat.com' + listeners: + - protocol: HTTP + port: 80 + name: http + allowedRoutes: + namespaces: + from: All + - protocol: HTTPS + port: 443 + name: https + hostname: "*.gwapi-default.ocp7.stormshift.coe.muc.redhat.com" + tls: + mode: Terminate + certificateRefs: + - name: gwapidefault-cert + kind: Secret + allowedRoutes: + namespaces: + from: All diff --git a/content/networking/gateway-api/httproute.yaml b/content/networking/gateway-api/httproute.yaml new file mode 100644 index 00000000..76246ed5 --- /dev/null +++ b/content/networking/gateway-api/httproute.yaml @@ -0,0 +1,15 @@ +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: simple-https +spec: + parentRefs: + - kind: Gateway + name: default + namespace: openshift-ingress + hostnames: + - "simple-https.gwapi-default.ocp7.stormshift.coe.muc.redhat.com" + rules: + - backendRefs: + - name: simple-https + port: 8080 diff --git a/content/networking/gateway-api/index.md b/content/networking/gateway-api/index.md new file mode 100644 index 00000000..4197396c --- /dev/null +++ b/content/networking/gateway-api/index.md @@ -0,0 +1,318 @@ +--- +title: Gateway API +linktitle: Gateway API +description: Gateway API examples on OpenShift — GatewayClass, Gateway with External DNS, HTTPRoute, and re-encrypt termination with BackendTLSPolicy. +tags: ['Gateway API','v4.22','networking'] +--- +# Gateway API + +The Kubernetes [Gateway API](https://gateway-api.sigs.k8s.io/) is the [next generation](https://gateway-api.sigs.k8s.io/docs/) of Kubernetes Ingress, Load Balancing, and Service Mesh APIs — intended as a more expressive, role-oriented successor to `Ingress` and OpenShift `Route` objects. +It separates concerns across three roles: + +| Role | Resource | Who manages it | +|---|---|---| +| Infrastructure Provider | `GatewayClass` | Cluster admin / cloud provider | +| Cluster Operator | `Gateway` | Platform team | +| Application Developer | `HTTPRoute` / `GRPCRoute` / … | App team | + +![Gateway API resource model](resource-model.png) + +Official documentation: + +* [OpenShift — Gateway API](https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/networking/gateway-api) — including how to enable Gateway API on your cluster +* [Kubernetes Gateway API](https://gateway-api.sigs.k8s.io/) + +!!! tip "Red Hat Connectivity Link Tutorial" + + For a full end-to-end walkthrough covering TLS automation, OIDC auth, rate limiting, and observability on top of Gateway API, check out Nikolaus Lemberski's + [Connectivity Link 1.3 Tutorial](https://github.com/nikolaus-lemberski/connectivity-link-tutorial). + It uses [Red Hat Connectivity Link](https://docs.redhat.com/en/documentation/red_hat_connectivity_link/1.3/) (based on [Kuadrant](https://kuadrant.io/)) to add `TLSPolicy`, `AuthPolicy`, and `RateLimitPolicy` on top of the Gateway API resources shown on this page. + +Tested with: + +| Component | Version | +|---|---| +| OpenShift | v4.22.5 | + +## Create `GatewayClass` + +```yaml title="GatewayClass" +apiVersion: gateway.networking.k8s.io/v1 +kind: GatewayClass +metadata: + name: openshift-default +spec: + controllerName: openshift.io/gateway-controller/v1 +``` + +## Create `Gateway` + +!!! warning "Requires `LoadBalancer` service support" + + Creating a Gateway provisions a Kubernetes service of type `LoadBalancer`. + On-premise clusters need MetalLB installed and configured — see + [On-premise gateway routing requirements](https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/ingress_and_load_balancing/configuring-gateway-api#on-premise-gateway-routing-requirements_assigning-network-addresses-gateways). + + [RFE-8640 — "Support self-provisioned load balancers for Gateway API"](https://redhat.atlassian.net/browse/RFE-8640) + +Create a TLS secret for the Gateway: + +```shell title="Create TLS secret" +oc create secret tls gwapidefault-cert \ + -n openshift-ingress \ + --cert=cert_and_intermediate.pem \ + --key=cert-key.pem +``` + +=== "gateway.yaml" + + ```yaml hl_lines="18" + --8<-- "content/networking/gateway-api/gateway.yaml" + ``` + +=== "Download/Apply: gateway.yaml" + + ```shell + curl -L -O {{ page.canonical_url }}gateway.yaml + ``` + + ```shell + oc apply -f {{ page.canonical_url }}gateway.yaml + ``` + +### DNS setup + +The wildcard hostname defined in the Gateway must have a DNS A record pointing to the external IP of the LoadBalancer service: + +```shell title="Verify Gateway and services" +% oc get gateway,svc -n openshift-ingress +NAME CLASS ADDRESS PROGRAMMED AGE +gateway.gateway.networking.k8s.io/default openshift-default 10.32.105.107 True 4d6h + +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +service/default-openshift-default LoadBalancer 172.30.169.90 10.32.105.107 15021:30288/TCP,80:31988/TCP,443:32360/TCP 3d23h +service/istiod-openshift-gateway ClusterIP 172.30.3.90 15010/TCP,15012/TCP,443/TCP,15014/TCP 4d18h +service/router-internal-default ClusterIP 172.30.22.81 80/TCP,443/TCP,1936/TCP 12d +``` + +If you use the [External DNS Operator](https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/networking_operators/external-dns-operator-1), the LoadBalancer service already carries the annotation for automatic DNS provisioning: + +```shell title="External DNS annotation" hl_lines="4" +% oc get svc/default-openshift-default -n openshift-ingress -o yaml +metadata: + annotations: + external-dns.alpha.kubernetes.io/hostname: '*.gwapi-default.ocp7.stormshift.coe.muc.redhat.com' +``` + +Otherwise, create the DNS record manually: + +```txt +*.gwapi-default.ocp7 IN A 10.32.105.107 +``` + +See also: [Configuring DNS for on-premise gateways](https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/ingress_and_load_balancing/configuring-gateway-api#configuring-dns-on-premise-gateways_assigning-network-addresses-gateways) + +## Basic HTTPRoute example + +Exposes a simple workload through the `Gateway` via an `HTTPRoute`. + +### Deploy the workload + +```shell +oc apply -k 'https://github.com/openshift-examples/kustomize.git/components/simple-https?ref=2026-07-20' +``` + +### Attach an HTTPRoute + +=== "httproute.yaml" + + ```yaml + --8<-- "content/networking/gateway-api/httproute.yaml" + ``` + +=== "Download: httproute.yaml" + + ```shell + curl -L -O {{ page.canonical_url }}httproute.yaml + ``` + +```shell +oc apply -f httproute.yaml +``` + +Verify the route is `Accepted`: + +```shell +% oc get httproute -n test-app +NAME HOSTNAMES AGE +simple-https ["simple-https.gwapi-default.ocp7.stormshift.coe.muc.redhat.com"] 3h27m +``` + +```shell +% curl https://simple-https.gwapi-default.ocp7.stormshift.coe.muc.redhat.com/ + + + +

Hi, 10.131.0.20

+I'm a simple httpd+CGI webserver running in +pod simple-https-79f5d5876b-w6vtf on node ocp7-worker-0 +responding at 2026-07-20 19:14:33 +0000 +via http + + +``` + +Both HTTP and HTTPS work, but the backend always responds via plain HTTP — the Gateway terminates TLS and forwards unencrypted traffic to the pod. + +![Connection flow — edge termination](overview.drawio){page=Page-1} + +## Re-encrypt termination with `BackendTLSPolicy` + +To encrypt traffic between the Gateway and the backend, use a `BackendTLSPolicy`. + +See: [Configuring re-encrypt termination with a BackendTLSPolicy](https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/ingress_and_load_balancing/configuring-gateway-api#configuring-backend-reencrypt-tls_securing-httproutes) + +### Known limitation: CA certificate key name mismatch + +The `BackendTLSPolicy` spec requires the CA certificate in a ConfigMap key named exactly **`ca.crt`**. OpenShift's service-ca operator injects certificates with key `service-ca.crt`, and the trusted CA bundle injector uses `ca-bundle.crt`. Neither matches what `BackendTLSPolicy` expects. + +??? quote "Tracking issues and proposed solutions" + + **Active RFEs / Tracking Issues** + + - [RFE-9174](https://redhat.atlassian.net/browse/RFE-9174) — "CA Bundle Key Name Flexibility" — Approved, Priority: Critical. Primary RFE requesting configurable CA bundle key names for interop between OpenShift CA injection and `BackendTLSPolicy`. + - [OCPSTRAT-3459](https://redhat.atlassian.net/browse/OCPSTRAT-3459) — "CA Bundle Key Name Flexibility" — New, Priority: Critical. Strategic tracking issue under Networking, created July 2026. + - [RFE-8361](https://redhat.atlassian.net/browse/RFE-8361) — "Setting the Gateway API controller to mount openshift-service-ca.crt" — Backlog. Original customer-filed RFE from October 2025. + - [gateway-api#4196](https://github.com/kubernetes-sigs/gateway-api/issues/4196) — Upstream feature request to support custom certificate key names. + + **Potential solutions being evaluated (from OCPSTRAT-3459)** + + 1. **Upstream Gateway API change** — Allow the gateway controller to accept a configurable key name + 2. **Add service CA to the default trust bundle** — No per-resource configuration needed + 3. **Use `ClusterTrustBundle`** — Newer Kubernetes API, requires k8s 1.37+ + 4. **Fallback-to-first-cert-in-configmap** — Gateway controller uses the first certificate found regardless of key name + 5. **OpenShift service-ca-operator change** — Allow configuring the injected key name so it can inject as `ca.crt` + +### Workaround: create a ConfigMap with the correct key + +Create a ConfigMap that copies the service CA content into a key named `ca.crt`: + +```shell +oc get configmap openshift-service-ca.crt -n -o jsonpath='{.data.service-ca\.crt}' \ + | oc create configmap my-openshift-service-ca.crt -n --from-file=ca.crt=/dev/stdin +``` + +!!! warning + + This ConfigMap will **not** auto-rotate when the service CA is renewed. + You need external tooling (custom controller, CronJob, or GitOps template) to keep it in sync. + Watch out for x509 formatting issues — trailing newlines or whitespace can cause certificate validation failures. + +### Apply the `BackendTLSPolicy` + +=== "backendtlspolicy.yaml" + + ```yaml + --8<-- "content/networking/gateway-api/backendtlspolicy.yaml" + ``` + +=== "Download: backendtlspolicy.yaml" + + ```shell + curl -L -O {{ page.canonical_url }}backendtlspolicy.yaml + ``` + +```shell +oc apply -f backendtlspolicy.yaml +``` + +### Update the HTTPRoute for HTTPS backend + +Change the backend port from `8080` to `8443`: + +```yaml title="HTTPRoute" hl_lines="17" +apiVersion: gateway.networking.k8s.io/v1 +kind: HTTPRoute +metadata: + name: simple-https +spec: + parentRefs: + - kind: Gateway + name: default + namespace: openshift-ingress + hostnames: + - "simple-https.gwapi-default.ocp7.stormshift.coe.muc.redhat.com" + rules: + - backendRefs: + - group: "" + kind: Service + name: simple-https + port: 8443 +``` + +```shell +% curl https://simple-https.gwapi-default.ocp7.stormshift.coe.muc.redhat.com/ + + + +

Hi, 10.128.2.98

+I'm a simple httpd+CGI webserver running in +pod simple-https-79f5d5876b-s276h on node ocp7-worker-1 +responding at 2026-07-21 14:14:18 +0000 +via https + + +``` + +HTTPS work, and the backend always responds via HTTPS — the Gateway terminates TLS and forwards encrypted traffic to the pod. + +![Connection flow — re-encrypt termination](overview.drawio){page=Page-2} + +## Troubleshooting + +### Dump Envoy config + +```shell +oc rsh deployment/default-openshift-default pilot-agent request GET /config_dump > default-openshift-default.json +``` + +### Dump all endpoints + +Forward the Envoy admin port: + +```shell +oc port-forward deployment/default-openshift-default 15000:15000 +``` + +List endpoints (filtered by namespace): + +```shell title="List endpoints" +% curl -s 'http://localhost:15000/config_dump?include_eds' | jq -r ' + .configs[] + | select(.["@type"] + | contains("EndpointsConfigDump")) + | .dynamic_endpoint_configs[] + | .endpoint_config + | .cluster_name as $cn + | .endpoints[]?.lb_endpoints[]?.endpoint.address.socket_address + | "\($cn) \(.address):\(.port_value)" + ' | grep test-app +outbound|8080||simple-https.test-app.svc.cluster.local 10.128.2.99:8080 +outbound|8080||simple-https.test-app.svc.cluster.local 10.131.0.24:8080 +outbound|8443||simple-https.test-app.svc.cluster.local 10.128.2.99:8443 +outbound|8443||simple-https.test-app.svc.cluster.local 10.131.0.24:8443 +``` + +Filter by a specific cluster name: + +```shell title="Filter by cluster name" +% curl -s 'http://localhost:15000/config_dump?include_eds' | jq -r ' + .configs[] + | select(.["@type"] | contains("EndpointsConfigDump")) + | .dynamic_endpoint_configs[] + | .endpoint_config + | select(.cluster_name | contains("demo-backend")) + | .cluster_name as $cn + | .endpoints[]?.lb_endpoints[]?.endpoint.address.socket_address + | "\($cn) \(.address):\(.port_value)"' +``` diff --git a/content/networking/gateway-api/openshift-service-ca.crt.yaml b/content/networking/gateway-api/openshift-service-ca.crt.yaml new file mode 100644 index 00000000..91c31371 --- /dev/null +++ b/content/networking/gateway-api/openshift-service-ca.crt.yaml @@ -0,0 +1,27 @@ +apiVersion: v1 +data: + ca.crt: | + -----BEGIN CERTIFICATE----- + MIIDUTCCAjmgAwIBAgIIafT3q2F+xiMwDQYJKoZIhvcNAQELBQAwNjE0MDIGA1UE + Awwrb3BlbnNoaWZ0LXNlcnZpY2Utc2VydmluZy1zaWduZXJAMTc4MzU4MTQ0MzAe + Fw0yNjA3MDkwNzE3MjJaFw0yODA5MDYwNzE3MjNaMDYxNDAyBgNVBAMMK29wZW5z + aGlmdC1zZXJ2aWNlLXNlcnZpbmctc2lnbmVyQDE3ODM1ODE0NDMwggEiMA0GCSqG + SIb3DQEBAQUAA4IBDwAwggEKAoIBAQCkZOgL7903MoJrMt+Mo1n9Un1bLjeV5ZBm + 12/ZNx96E76PjuZvZz+9cgEwg/KlnozKC6BCH528uQ15NIYRpLqMz2IvNR+lmtDF + Cytp7YbI+A0lICARhJpEwgCKm5sqfclUiNYDqDafIMsVnIer3uiD3TOkZxgvKbdR + d8VY4BJfqED7CgMPqOhNYowRDmQY4x3Mac8BMEvusPECK6jNdQrIfq48WfBbWt45 + PinxTjdTnpxbV2P/g0tjTQkIWkPajXQn5DPfWRSUQWMnwZY52eL95QHkWKA4oNXl + B3GqSO73+GzOcv8/w4OAezVi6IO/KFRy4T1/x5ZzYJpN508/bUD1AgMBAAGjYzBh + MA4GA1UdDwEB/wQEAwICpDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQh1/9h + cKhnjvkqV4Ozt2/kz1GHSTAfBgNVHSMEGDAWgBQh1/9hcKhnjvkqV4Ozt2/kz1GH + STANBgkqhkiG9w0BAQsFAAOCAQEAABzPb0uIecdEjpuqgfuFtH5VwN3JFjftbdYj + c5iDRUBRIFoCzi72lSctVl9RbOfsTwieA+LFs8TswqH3pafOkpPzLIYQJPmhgquU + 0TQ6pvCZDNi7NW8O7J3fXuoaQaBjfmuPKJy7oV3He8J1JeIEioW96OQZoCcQ1BUg + sfEES+4LxDr7MNJntAn+P1aWNYva5SgBTNKfC0cPSR2BSa8OJY0bwPB7acdB1dA6 + k9ccOWbt7zSLYjZYWFcZHjKnIwJ+NyHBk7E47wNnVTKb0IYIiTgtXTddsDqULX+h + 6TeC51z7SNbB6GQGtypoBj2ua6AeHOzP+yoLjryp/feAwHfHfw== + -----END CERTIFICATE----- +kind: ConfigMap +metadata: + name: my-openshift-service-ca.crt + namespace: test-app diff --git a/content/networking/gateway-api/overview.drawio b/content/networking/gateway-api/overview.drawio new file mode 100644 index 00000000..0060a678 --- /dev/null +++ b/content/networking/gateway-api/overview.drawio @@ -0,0 +1,128 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/content/networking/gateway-api/resource-model.png b/content/networking/gateway-api/resource-model.png new file mode 100644 index 00000000..0397ad26 Binary files /dev/null and b/content/networking/gateway-api/resource-model.png differ diff --git a/content/networking/gateway-api/tls.crt b/content/networking/gateway-api/tls.crt new file mode 100644 index 00000000..f85479dd --- /dev/null +++ b/content/networking/gateway-api/tls.crt @@ -0,0 +1,43 @@ +-----BEGIN CERTIFICATE----- +MIID2TCCAsGgAwIBAgIIewBbIBju98AwDQYJKoZIhvcNAQELBQAwNjE0MDIGA1UE +Awwrb3BlbnNoaWZ0LXNlcnZpY2Utc2VydmluZy1zaWduZXJAMTc4MzU4MTQ0MzAe +Fw0yNjA3MjAxNTQ1MTRaFw0yODA3MTkxNTQ1MTVaMCQxIjAgBgNVBAMTGXNpbXBs +ZS1odHRwcy50ZXN0LWFwcC5zdmMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK +AoIBAQC3rMuXsvobKXbIwcdC+Wd96Rb3HIQtMYtfKPKiTfTaqiKRNA/OCIo9fdLw +RzFfsoRAKk2w64NDc/epdpBBl8B2YU0IaRCz0MHwAVxvKcmgMsZ7aD2hH43EQzXu +bcqFydWHM26KUiBJJFncXBFvGgw14hJ9GOhZQmM8kIonH4RjqaeP+YbqP3VzQGJx +LN7ypAd84LdJ9LcdewAbc7RDyfnVyFyLfxLglwjFvXatVOZ0CTCJzc5+wjt5yv9D +MqnkvjjuQYZbiyt992qrMLJONpeJ8pHczYbdmT4qrdb89qLW8OoXEyU5LVpXHM88 +xzzWxrREy57l0FNFuot2D7FVqnVzAgMBAAGjgfwwgfkwDgYDVR0PAQH/BAQDAgWg +MBMGA1UdJQQMMAoGCCsGAQUFBwMBMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFIdq +4hJktdvf1+YYOdM110/nTkejMB8GA1UdIwQYMBaAFCHX/2FwqGeO+SpXg7O3b+TP +UYdJME0GA1UdEQRGMESCGXNpbXBsZS1odHRwcy50ZXN0LWFwcC5zdmOCJ3NpbXBs +ZS1odHRwcy50ZXN0LWFwcC5zdmMuY2x1c3Rlci5sb2NhbDA1BgsrBgEEAZIIEWQC +AQQmEyQ5YTdjMTQyNC0yNzFiLTRlZWMtYWJlOC0zMTFiNWE2NDhhODEwDQYJKoZI +hvcNAQELBQADggEBAA5Jp8XKBbErBH++PaMEBsc/cH1BbRgNgSm/dEt7lIV/LLa5 +OZivaQkhrADx0KYoFvOIlRUnOlZiSNEFWOZf/7Du3XLP+r83exfpamLyoaf9Qtk4 +0Fc6tSZILA+qE/fSxdlqyJ63JAHdZecWsDgdoNrQr52eMDvQ54lMqMkNUeJP1Fho +sl6wZisIkxABYAUQtHr0aHi/bWiq+p4DjPPwvbl7plejSsOcn4IFyq1A/+hTPzEW +E0wa/9q6NaGmgd95vrEyI5GgzVlkIlQNHqN+d4KVCwv2dQN67NcyoESMj8wLFGLB +VpQhm/tsfEy/w/YBtSaoTEoaacOHX3B/t2DwSAE= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIDUTCCAjmgAwIBAgIIafT3q2F+xiMwDQYJKoZIhvcNAQELBQAwNjE0MDIGA1UE +Awwrb3BlbnNoaWZ0LXNlcnZpY2Utc2VydmluZy1zaWduZXJAMTc4MzU4MTQ0MzAe +Fw0yNjA3MDkwNzE3MjJaFw0yODA5MDYwNzE3MjNaMDYxNDAyBgNVBAMMK29wZW5z +aGlmdC1zZXJ2aWNlLXNlcnZpbmctc2lnbmVyQDE3ODM1ODE0NDMwggEiMA0GCSqG +SIb3DQEBAQUAA4IBDwAwggEKAoIBAQCkZOgL7903MoJrMt+Mo1n9Un1bLjeV5ZBm +12/ZNx96E76PjuZvZz+9cgEwg/KlnozKC6BCH528uQ15NIYRpLqMz2IvNR+lmtDF +Cytp7YbI+A0lICARhJpEwgCKm5sqfclUiNYDqDafIMsVnIer3uiD3TOkZxgvKbdR +d8VY4BJfqED7CgMPqOhNYowRDmQY4x3Mac8BMEvusPECK6jNdQrIfq48WfBbWt45 +PinxTjdTnpxbV2P/g0tjTQkIWkPajXQn5DPfWRSUQWMnwZY52eL95QHkWKA4oNXl +B3GqSO73+GzOcv8/w4OAezVi6IO/KFRy4T1/x5ZzYJpN508/bUD1AgMBAAGjYzBh +MA4GA1UdDwEB/wQEAwICpDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQh1/9h +cKhnjvkqV4Ozt2/kz1GHSTAfBgNVHSMEGDAWgBQh1/9hcKhnjvkqV4Ozt2/kz1GH +STANBgkqhkiG9w0BAQsFAAOCAQEAABzPb0uIecdEjpuqgfuFtH5VwN3JFjftbdYj +c5iDRUBRIFoCzi72lSctVl9RbOfsTwieA+LFs8TswqH3pafOkpPzLIYQJPmhgquU +0TQ6pvCZDNi7NW8O7J3fXuoaQaBjfmuPKJy7oV3He8J1JeIEioW96OQZoCcQ1BUg +sfEES+4LxDr7MNJntAn+P1aWNYva5SgBTNKfC0cPSR2BSa8OJY0bwPB7acdB1dA6 +k9ccOWbt7zSLYjZYWFcZHjKnIwJ+NyHBk7E47wNnVTKb0IYIiTgtXTddsDqULX+h +6TeC51z7SNbB6GQGtypoBj2ua6AeHOzP+yoLjryp/feAwHfHfw== +-----END CERTIFICATE----- diff --git a/content/networking/gateway-api/tls.key b/content/networking/gateway-api/tls.key new file mode 100644 index 00000000..c934c49b --- /dev/null +++ b/content/networking/gateway-api/tls.key @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEowIBAAKCAQEAt6zLl7L6Gyl2yMHHQvlnfekW9xyELTGLXyjyok302qoikTQP +zgiKPX3S8EcxX7KEQCpNsOuDQ3P3qXaQQZfAdmFNCGkQs9DB8AFcbynJoDLGe2g9 +oR+NxEM17m3KhcnVhzNuilIgSSRZ3FwRbxoMNeISfRjoWUJjPJCKJx+EY6mnj/mG +6j91c0BicSze8qQHfOC3SfS3HXsAG3O0Q8n51chci38S4JcIxb12rVTmdAkwic3O +fsI7ecr/QzKp5L447kGGW4srffdqqzCyTjaXifKR3M2G3Zk+Kq3W/Pai1vDqFxMl +OS1aVxzPPMc81sa0RMue5dBTRbqLdg+xVap1cwIDAQABAoIBAASWpBdlrAQ8F72R +w03HBHDYZW+shLJkVHXLt62aT1porNuXw1u2sICZjhV2kdZkLUc1FCL66/9ZYrLj +3vXkhpuIEfAt2ViRbhoPm3GJ4U5hNlgke7Wn7IpRa4PjT9xIjuie8YBlgNNfvYCM +KqghEtqdvslLpmV+C3o0QJJ6bq8J2RAI2QI0Mb8kDmZDLMIP5iOuvkXGkSHxf031 +5XSkKR4VLtKpHFyvWAu7cS05d494qw3MVta1xzGFaTa5jaDqK6lQK1TZBivjEH8h +ubgjt0EbKzK1XPnqsh7FnAyd119LkoHo5bVNrzIWy2tWTXoFTfrS9M/Sf9R06wJa +DgWWW2ECgYEAw3LguZEHmhiBeWWoLvoAHtTopH0KgBiPTr31Q2tGug+Lg+2+dF2E +McDh4fJclbB8B4N9rO4XxC3uiprq3bDsCVU7gboL46VRJ+ypvIvifd2eGdRQEXl+ +GbdA61aiG76ef0JKMgyg+l9dWqCE46EGNfZuL8kzHN74BSedv0RGx7kCgYEA8JQi +tXquA3zdMRxI2+9n5VgVyiqKMK9ScrdvRVrbCeJmHCCr0bTX7r5C07weyJR7MKUW +LTjhVXGLWA18F99KXxaUVYf8RoP08ieRxb66BQeUp+ZgnJhCCkPOzSeRIugTlvHG +MfBJX3C2hppdHa2nuaRYHK4EB5e9ysh+RW9WJIsCgYBE1i8D7GqLAVqIkR88/FwS +f9Y4KLoMB5phl1HMnvnYCiWPH6rWfSFUDKUB2UR2jCQC2XLn9ytzsuGy+4EA95EK +cHR26jnJwa3lq9rUR0hMIEPQwRA6N1oMYJiCyo5pyyczlvteyUfhJrlQc/yZ11rC +orqIJgrUfktINX2/oaJ0MQKBgG4varYzuf9e8O/NRJF21N71uQUe9qvVoK1p1kyt +kCS2zI2VaRxi94MhIPpY7sBvQPzGn6GWq522o1tw0aUdX7KtZMLHxYOGbGl8Ngeb +kxc6oZtEqHsQQS7yX4UW2iJiqJY5pcy5gOF1fiOoD33IS0l7O9/m03GmzgZSTYL/ +uzSBAoGBAKZlH4xvehNFRSzJsvy1J5gOIcnYRqW3mTKOfaqLkhOA4q+L7mQUBxp9 +waCI84fTkmYCuUgvU2UKz+FjxMBH9Rao/fEAGSAeZEYX5xfjwlml7FD1R2k8sMAk +3Rqmj6dHWN90ePGcS0t8PBPxDinNkqpVzq0W6DSDpmbdO6o0KYQA +-----END RSA PRIVATE KEY----- diff --git a/mkdocs.yml b/mkdocs.yml index 125c0498..4bca8853 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -276,6 +276,7 @@ nav: - OVNKubernetes: networking/network-policy/OVNKubernetes.md - OpenShiftSDN: networking/network-policy/OpenShiftSDN.md - Router sharding: networking/services-routes/router-sharding.md + - Gateway API: networking/gateway-api/index.md - Egress IP: networking/egress-ip/index.md - Kubernetes iptables chains: networking/k8s-iptables-chains.md - LLDPd: networking/lldpd/index.md