Skip to content

kgateway ingress gateway

Page as Markdown 

    

  
  


              
            

          

          
          
Use kgateway as an ingress gateway for your ambient mesh, adding API gateway features like rate limiting, external auth, and header manipulation.

          
Ambient mode is designed to support alternative Layer 7 implementations. You can use kgateway instead of the Istio-native ingress gateway to get richer API gateway capabilities.


What is kgateway?
    
kgateway is a Kubernetes-native ingress controller and API gateway built on Envoy and configured with the Kubernetes Gateway API. Originally launched as Gloo in 2018 and transferred to the CNCF in 2024, kgateway extends the Gateway API with first-class support for rate limiting, header manipulation, request transformations, and external auth, without requiring EnvoyFilters.


Use kgateway as an ingress gateway
    
    

  1. 

    Install kgateway in your cluster. For installation instructions, see the kgateway documentation.
    

    2. 

  2. 

    Add the kgateway-system namespace to the ambient mesh. This secures traffic between the gateway and backend services with mTLS.
    

    


    kubectl label ns kgateway-system istio.io/dataplane-mode=ambient
    
  

    

    

    3. 

  3. 

    Reference your kgateway instance in the parentRefs of any HTTPRoute served by the gateway.
    

    


    parentRefs:
  - name: https
    namespace: kgateway-system
    
  

    

    

    4. 



For full setup instructions, see the kgateway ambient ingress guide.


        

        

  

OverviewKubernetes Gateway API