<commit_before># GKE Gateway in Single Cluster

[GKE Gateway](https://cloud.google.com/kubernetes-engine/docs/concepts/gateway-api) is the GKE implementation of the Kubernetes Gateway API. The Gateway API is an open source standard for service networking and is currently in the v1Alpha1 stage. At this time it is recommended for testing and evaluation only.

This recipe provides a walkthrough of GKE Gateway using **gke-l7-gxlb** (Global external HTTP(S) load balancers built on External HTTP(S) Load Balancing) GKE [GatewayClass](https://cloud.google.com/kubernetes-engine/docs/concepts/gateway-api#gatewayclass).


## Use-cases

- Routing traffic to services deployed in multiple Kubernetes namespaces
- Encrypted traffic between the clients and HTTPS Load Balancer

## Relevant documentation

- [GKE Gateway Concepts](https://cloud.google.com/kubernetes-engine/docs/concepts/gateway-api)
- [Deploying Gateway in Single cluster](https://cloud.google.com/kubernetes-engine/docs/how-to/deploying-gateways)
- [Kubernetes Gateway API Concepts](https://gateway-api.sigs.k8s.io/#gateway-api-concepts)

## Versions

- GKE clusters on GCP
- GKE version 1.20 or later
- Tested and validated with 1.21.5-gke.1302 on Dec 4th 2021

### Networking Manifests

This recipe demonstrates deploying [Gateway](https://cloud.google.com/kubernetes-engine/docs/concepts/gateway-api#gateway) and [HTTPRoute](https://cloud.google.com/kubernetes-engine/docs/concepts/gateway-api#httproute) in a single GKE cluster. One Gateway resource to expose two different services hosted in two different namespaces.

The cluster `gke-1` is a regional cluster. The Gateway is hosted in default namespace. Two services in two different namespaces (other than default namespace). The Gateway (GKE load balancer) will match the traffic and send it to the right service depending on the request.

This Recipe also demonstrates how to enable HTTPS on Gateway Load Balancer using Google-managed certificate.

This example is using two applications; foo and bar. The *foo* applicaion is deployed in `NAMESPACE#1` and *bar* application is deployed in `NAMESPACE#2`. The External HTTPS Load Balancer is designed to route traffic to the services based on the request host name header. 

The Gateway below also uses:

- A [Google-Managed Certificate](https://cloud.google.com/kubernetes-engine/docs/how-to/deploying-gateways#tls_between_client_and_gateway)
- A public [Static IP](https://cloud.google.com/compute/docs/ip-addresses/reserve-static-external-ip-address) used as Gateway address

```yaml
kind: Gateway
apiVersion: networking.x-k8s.io/v1alpha1
metadata:
  name: external-http
spec:
  gatewayClassName: gke-l7-gxlb
  listeners:
  - protocol: HTTPS
    port: 443
    routes:
      kind: HTTPRoute
      namespaces:
        from: "All"
    tls:
      mode: Terminate
      options:
        networking.gke.io/pre-shared-certs: gxlb-cert
  addresses:
  - type: NamedAddress
    value: gke-gxlb-ip
```

The *spec.listeners.routes* in Gateway defines which routes can bind to the Gateway. In this example, routes from all namespaces are allowed. We can also use `selector` to restrict the routes binding to specific namespaces or services.

The HTTPRoute resource defines how HTTP and HTTPS requests received by a Gateway are directed to Services. Application developers create HTTPRoutes to expose their applications through Gateways.


```yaml
kind: HTTPRoute
apiVersion: networking.x-k8s.io/v1alpha1
metadata:
  name: foo
  namespace: gxlb-demo-ns1
spec:
  gateways:
    allow: FromList
    gatewayRefs:
    - name: external-http
      namespace: default
  hostnames:
  - "foo.$DOMAIN"
  rules:
  - forwardTo:
    - serviceName: foo
      port: 8080
```

The HTTPRoutes resources for two services (foo and bar) define which Gateway it can route traffic from (external-http in default namespace), which Services to route to (foo/bar), and rules that define what traffic the HTTPRoute matches (request host name is foo/bar.$DOMAIN). 

Now that you have the background knowledge and understanding of GKE Gateway, you can try it out yourself.

## Try it out

1. Download this repo and navigate to this folder

    ```bash
    git clone https://github.com/GoogleCloudPlatform/gke-networking-recipes.git
    Cloning into 'gke-networking-recipes'...

    cd gke-networking-recipes/gateway/single-cluster/global-lb-basic
    ```

2. Set up Environment variables

    ```bash
    export PROJECT_ID=$(gcloud config get-value project) # or your preferred project
    export GKE_REGION=GCP_CLOUD_REGION # Pick a supported Zone for cluster
    ```

    NB: This tutorial uses Regional Clusters, you can also use Zonal Clusters. Replace a region with a zone and use the ```--zone``` flag instead of ```--region``` in the next steps.

3. Deploy the cluster as mentioned in [cluster setup](../../../cluster-setup.md#single-cluster-environment). Once done, come back to the next step.

4. Get the clusters credentials

    ```bash
    gcloud container clusters get-credentials gke-1 --region=us-central1
    ```

5. Create a Static IP for the LoadBalancer and register it to DNS.

    In order to use Google-Managed Certificated, a static IP needs to be reserved and registered with your DNS Server.

    Start by creating a public Static IP.

    ```bash
    gcloud compute addresses create gke-gxlb-ip --global
    ```
<commit_msg>corrected folder name<commit_after># GKE Gateway in Single Cluster

[GKE Gateway](https://cloud.google.com/kubernetes-engine/docs/concepts/gateway-api) is the GKE implementation of the Kubernetes Gateway API. The Gateway API is an open source standard for service networking and is currently in the v1Alpha1 stage. At this time it is recommended for testing and evaluation only.

This recipe provides a walkthrough of GKE Gateway using **gke-l7-gxlb** (Global external HTTP(S) load balancers built on External HTTP(S) Load Balancing) GKE [GatewayClass](https://cloud.google.com/kubernetes-engine/docs/concepts/gateway-api#gatewayclass).


## Use-cases

- Routing traffic to services deployed in multiple Kubernetes namespaces
- Encrypted traffic between the clients and HTTPS Load Balancer

## Relevant documentation

- [GKE Gateway Concepts](https://cloud.google.com/kubernetes-engine/docs/concepts/gateway-api)
- [Deploying Gateway in Single cluster](https://cloud.google.com/kubernetes-engine/docs/how-to/deploying-gateways)
- [Kubernetes Gateway API Concepts](https://gateway-api.sigs.k8s.io/#gateway-api-concepts)

## Versions

- GKE clusters on GCP
- GKE version 1.20 or later
- Tested and validated with 1.21.5-gke.1302 on Dec 4th 2021

### Networking Manifests

This recipe demonstrates deploying [Gateway](https://cloud.google.com/kubernetes-engine/docs/concepts/gateway-api#gateway) and [HTTPRoute](https://cloud.google.com/kubernetes-engine/docs/concepts/gateway-api#httproute) in a single GKE cluster. One Gateway resource to expose two different services hosted in two different namespaces.

The cluster `gke-1` is a regional cluster. The Gateway is hosted in default namespace. Two services in two different namespaces (other than default namespace). The Gateway (GKE load balancer) will match the traffic and send it to the right service depending on the request.

This Recipe also demonstrates how to enable HTTPS on Gateway Load Balancer using Google-managed certificate.

This example is using two applications; foo and bar. The *foo* applicaion is deployed in `NAMESPACE#1` and *bar* application is deployed in `NAMESPACE#2`. The External HTTPS Load Balancer is designed to route traffic to the services based on the request host name header. 

The Gateway below also uses:

- A [Google-Managed Certificate](https://cloud.google.com/kubernetes-engine/docs/how-to/deploying-gateways#tls_between_client_and_gateway)
- A public [Static IP](https://cloud.google.com/compute/docs/ip-addresses/reserve-static-external-ip-address) used as Gateway address

```yaml
kind: Gateway
apiVersion: networking.x-k8s.io/v1alpha1
metadata:
  name: external-http
spec:
  gatewayClassName: gke-l7-gxlb
  listeners:
  - protocol: HTTPS
    port: 443
    routes:
      kind: HTTPRoute
      namespaces:
        from: "All"
    tls:
      mode: Terminate
      options:
        networking.gke.io/pre-shared-certs: gxlb-cert
  addresses:
  - type: NamedAddress
    value: gke-gxlb-ip
```

The *spec.listeners.routes* in Gateway defines which routes can bind to the Gateway. In this example, routes from all namespaces are allowed. We can also use `selector` to restrict the routes binding to specific namespaces or services.

The HTTPRoute resource defines how HTTP and HTTPS requests received by a Gateway are directed to Services. Application developers create HTTPRoutes to expose their applications through Gateways.


```yaml
kind: HTTPRoute
apiVersion: networking.x-k8s.io/v1alpha1
metadata:
  name: foo
  namespace: gxlb-demo-ns1
spec:
  gateways:
    allow: FromList
    gatewayRefs:
    - name: external-http
      namespace: default
  hostnames:
  - "foo.$DOMAIN"
  rules:
  - forwardTo:
    - serviceName: foo
      port: 8080
```

The HTTPRoutes resources for two services (foo and bar) define which Gateway it can route traffic from (external-http in default namespace), which Services to route to (foo/bar), and rules that define what traffic the HTTPRoute matches (request host name is foo/bar.$DOMAIN). 

Now that you have the background knowledge and understanding of GKE Gateway, you can try it out yourself.

## Try it out

1. Download this repo and navigate to this folder

    ```bash
    git clone https://github.com/GoogleCloudPlatform/gke-networking-recipes.git
    Cloning into 'gke-networking-recipes'...

    cd gke-networking-recipes/gateway/single-cluster/global-l7-xlb
    ```

2. Set up Environment variables

    ```bash
    export PROJECT_ID=$(gcloud config get-value project) # or your preferred project
    export GKE_REGION=GCP_CLOUD_REGION # Pick a supported Zone for cluster
    ```

    NB: This tutorial uses Regional Clusters, you can also use Zonal Clusters. Replace a region with a zone and use the ```--zone``` flag instead of ```--region``` in the next steps.

3. Deploy the cluster as mentioned in [cluster setup](../../../cluster-setup.md#single-cluster-environment). Once done, come back to the next step.

4. Get the clusters credentials

    ```bash
    gcloud container clusters get-credentials gke-1 --region=us-central1
    ```

5. Create a Static IP for the LoadBalancer and register it to DNS.

    In order to use Google-Managed Certificated, a static IP needs to be reserved and registered with your DNS Server.

    Start by creating a public Static IP.

    ```bash
    gcloud compute addresses create gke-gxlb-ip --global
    ```

{'fraction_non_alphanumeric': 0.08379784466740989, 'fraction_numerical': 0.008454106280193236, 'mean_word_length': 3.98149005090236, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 20, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5316859', 'n_tokens_mistral': 3195, 'n_tokens_neox': 3036, 'n_words': 1196}