Integrating with API Gateways

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-gateway-ingress
spec:
  rules:
  - host: api.example.com
    http:
      paths:
      - path: /users
        backend:
          service:
            name: user-service
            port:
              number: 8080

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: user-service-vs
spec:
  hosts:
  - user-service
  http:
  - route:
    - destination:
        host: user-service
        port:
          number: 8080

{
  "apiGateway": {
    "integration": {
      "enabled": true,
      "mesh": "istio",
      "gateway": "nginx"
    },
    "routes": [
      {
        "path": "/api/users",
        "service": "user-service"
      }
    ]
  }
}

apiVersion: apps/v1
kind: Deployment
metadata:
  name: kong-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: kong
  template:
    metadata:
      labels:
        app: kong
    spec:
      containers:
      - name: kong
        image: kong:latest
        ports:
        - containerPort: 8000
        env:
        - name: KONG_PROXY_ACCESS_LOG
          value: /dev/stdout

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: kong-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "*"
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: kong-virtualservice
spec:
  hosts:
  - "*"
  gateways:
  - kong-gateway
  http:
  - route:
    - destination:
        host: kong-service
        port:
          number: 8000

apiVersion: getambassador.io/v3alpha1
kind: Mapping
metadata:
  name: istio-service-mapping
spec:
  host: example.com
  path: /api/v1/
  service: istio-service.default.svc.cluster.local:80
  timeout: 30s

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: istio-service-vs
spec:
  hosts:
  - istio-service.default.svc.cluster.local
  http:
  - route:
    - destination:
        host: istio-service.default.svc.cluster.local
        port:
          number: 80

apiVersion: v1
kind: ConfigMap
metadata:
  name: gloo-integration-config
  namespace: gloo-system
data:
  gateway.config: |
    name: "gloo"
    port: 8080
    tls:
      enabled: true
      port: 8443

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: example-route
spec:
  hosts:
    - api.example.com
  http:
    - route:
        - destination:
            host: service-a.example.svc.cluster.local
            port:
              number: 80

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: version-route
spec:
  hosts:
    - api.example.com
  http:
    - route:
        - destination:
            host: service-v1.example.svc.cluster.local
            port:
              number: 80
          weight: 90
        - destination:
            host: service-v2.example.svc.cluster.local
            port:
              number: 80
          weight: 10

// API Gateway receives request with JWT
const token = req.headers.authorization?.replace('Bearer ', '');

// Validate token using service mesh identity
if (!validateToken(token)) {
  return res.status(401).json({ error: 'Invalid token' });
}

// Forward to service with token in header
const serviceResponse = await fetch('https://service.example.com/api', {
  headers: { Authorization: `Bearer ${token}` }
});

rateLimiting:
  enabled: true
  requestsPerSecond: 500
  burst: 50
  windowSize: 30

apiVersion: v1
kind: ConfigMap
metadata:
  name: prometheus-config
  namespace: istio-system
data:
  prometheus.yml: |
    global:
      scrape_interval: 15s
    scrape_configs:
    - job_name: 'istio-mesh'
      kubernetes_sd_configs:
      - role: pod
      relabel_configs:
      - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
        action: keep
        regex: true
      - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path]
        action: replace
        target_label: __metrics_path__
        regex: (.+)
      - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_port]
        action: replace
        target_label: __address__
        regex: (.+)

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: example-route
spec:
  rules:
  - backendRefs:
    - name: example-service
      port: 8080
    timeout:
      request: 30s

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: hybrid-gateway
spec:
  gatewayClassName: istio
  listeners:
  - name: http
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: Same
  - name: https
    port: 443
    protocol: HTTPS
    tls:
      mode: Terminate
      certificateRef:
        name: gateway-tls

apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: secure-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 8443
      name: https-mtls
      protocol: HTTPS
    tls:
      mode: MUTUAL
      credentialName: client-cert