Skip to content

Updates to traffic management#120

Open
oquinena wants to merge 4 commits into
masterfrom
update/update-httprouting
Open

Updates to traffic management#120
oquinena wants to merge 4 commits into
masterfrom
update/update-httprouting

Conversation

@oquinena

@oquinena oquinena commented Jul 7, 2026

Copy link
Copy Markdown
Contributor

No description provided.

# Kubernetes Cluster Traffic Management

We are making use of Cilium [Gateway API](https://gateway-api.sigs.k8s.io/) as default means of managing traffic towards Routes defined in a Kubernetes Service, which offers full API lifecycle management, security, and governance.
Safespring uses the Cilium [Gateway API](https://gateway-api.sigs.k8s.io/) as the default means of routing traffic to services running in your cluster. It offers full API lifecycle management, security, and governance.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should "Safespring" be "Safespring Kubernetes Engine", or is this sentence referring to the company?

Safespring uses the Cilium [Gateway API](https://gateway-api.sigs.k8s.io/) as the default means of routing traffic to services running in your cluster. It offers full API lifecycle management, security, and governance.

If you are migrating your service from an Ingress Controller (Nginx, Traefik or any other) a quick comparison of main advantages of using Gateway API:
If you are migrating your service from an Ingress controller (Nginx, Traefik, or any other), here is a quick comparison of the main advantages of using the Gateway API:

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My impression is that I'm reading the documentation for the Safespring Kubernetes Engine.

I'm not sure why I need the comparison to some other Ingress controller that the Safespring Kubernetes Engine doesn't use, it gives the impression that the choice of using the Cilium Gateway API needs to be defended. And even if that choice would need to be defended, it's a moot point by the time someone is reading the product documentation since they have most likely already bought the product by that time.

This isn't an objection against the content itself, it just feels like this salespitch belongs in some other place than half-way through the product documentation.

- The traffic is picked up by services exposed via Cilium Gateway API at ports `80` and `443`.
- **OpenStack Security Groups**: provide a stateful virtual firewall applied to cluster nodes, plus granular filtering for API access and service ports, with explicit allowlists for Kubernetes control plane and worker node communication.
- The Safespring load balancer forwards traffic to the cluster nodes on L4 TCP ports `80, 443, 6443 and 30000-32767`.
- Ports `80`, `443` and the range `30000-32767` (all TCP) are available for exposing your own services. `80`/`443` are served by the Cilium Gateway API and `30000-32767` is the Kubernetes [NodePort](https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport) range - and as covered below, the Gateway can listen on any of these ports.

@pjonsson pjonsson Jul 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What does "(all TCP)" refer to, 30000-32767, or all ports mentioned? If the intention is all ports mentioned, I think it's less ambiguous to start the sentence with "TCP ports" and remove the comment in the parenthesis.

Edit: and prepending "ports" before the numbers in the second sentence makes it easier to read.

- The Safespring load balancer forwards traffic to the cluster nodes on L4 TCP ports `80, 443, 6443 and 30000-32767`.
- Ports `80`, `443` and the range `30000-32767` (all TCP) are available for exposing your own services. `80`/`443` are served by the Cilium Gateway API and `30000-32767` is the Kubernetes [NodePort](https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport) range - and as covered below, the Gateway can listen on any of these ports.

## How incoming traffic reaches your app

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think most other sections in this documentation use title-case capitalization for headings.

In the following example we create a Gateway and its HTTP routes (with HTTP redirecting to HTTPS), using the [`GatewayClass`](https://gateway-api.sigs.k8s.io/docs/concepts/api-overview/) `cilium`. Everything - the app and its Service, the Certificate, and the Gateway with its routes - lives in one namespace, so it all appears together below.

In the following example we illustrate how to create a Gateway and corresponding HTTP routes, with HTTP redirecting to HTTPS. We create the Gateway `cilium-gateway` which makes use of the [`GatewayClass`](https://gateway-api.sigs.k8s.io/api-types/gatewayclass/) `cilium`.
First, the application itself - a namespace, an nginx `Deployment` serving a demo page, and a `Service` in front of it:

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's probably not something to be done for this PR, but I think it would reduce the risk of confusion if the application deployed in the example was something that doesn't have a name that happens to be very close to the name of an ingress controller.


```

### Shared Gateway for multiple services

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would guess that this scenario applies to the vast majority of uses of Safespring Kubernetes Engine, is it worth the real-estate in the documentation to explain the non-common case at all?

Even if you decide it is worth the real-estate, I would suggest to put the thing most of your users need first (i.e. this one), so they don't have to read through the details of the thing they don't need.

from: All
```

Because the TLS Secret lives in the service's namespace but the Gateway reads it from `gateway-system`, each service needs a [`ReferenceGrant`](https://gateway-api.sigs.k8s.io/guides/tls/) allowing that cross-namespace read. Per service you then apply a `Certificate`, the `ReferenceGrant`, and the `HTTPRoute`s (reusing the `letsencrypt-prod` ClusterIssuer from the previous example):

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lead sentences with the important stuff first, "Each service needs .. to allow ".

| **Certificate** + **ClusterIssuer** | cert-manager obtains and renews the TLS certificate (via Let's Encrypt) that the Gateway serves. | [cert-manager + Gateway API](https://cert-manager.io/docs/usage/gateway/) |
| **Service** | Your application - the destination the HTTPRoute forwards to. | [Kubernetes Services](https://kubernetes.io/docs/concepts/services-networking/service/) |

!!! note "One Gateway per app vs. a shared Gateway"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm guessing this is the thing that gives a red box with a warning in the rendered documentation on the deployed page.

I believe I tried to address the same issue as this warning with my comment in https://github.com/safespring/docs/pull/120/files#r3543593280, but in a much less jarring way.

(There's also a numbing aspect if warnings are frequent, so people stop paying attention and will miss the times the warnings are important.)

- We make use of [Load Balancing - Elastic IP](../compute/loadbalancing.md) to forward traffic to respective Cluster Nodes based on L4 TCP ports: `80/443/6443/50000`. Additional ports can be provided on request.
- The traffic is picked up by services exposed via Cilium Gateway API at ports `80` and `443`.
- **OpenStack Security Groups**: provide a stateful virtual firewall applied to cluster nodes, plus granular filtering for API access and service ports, with explicit allowlists for Kubernetes control plane and worker node communication.
- The Safespring load balancer forwards traffic to the cluster nodes on L4 TCP ports `80, 443, 6443 and 30000-32767`.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you want the "and" and commas rendered as "and" and ",", or should each number have a closing backtick?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants