推荐理由:
  - CNCF官方项目，无厂商绑定，配置可跨云迁移
  - 原生支持所有Standard通道资源（HTTPRoute/GRPCRoute/TLSRoute等）
  - SecurityPolicy内置OIDC认证，BackendTrafficPolicy支持限流/熔断
  - 支持EnvoyPatchPolicy扩展，保留底层能力逃逸通道

部署示例:
  helm install envoy-gateway oci://docker.io/envoyproxy/gateway-helm \
    --namespace envoy-gateway-system --create-namespace

推荐理由:
  - Gateway API + Service Mesh 统一控制面，避免两套配置
  - Ambient模式移除Sidecar，延迟降低40%，内存占用减少90%
  - 原生支持mTLS、JWT验证、细粒度授权策略
  - 控制平面更新延迟<100ms，适合高频变更场景

注意: 学习曲线较陡，建议从Gateway API ingress场景逐步切入

推荐理由:
  - L4流量eBPF直通，吞吐量达硬件极限，延迟<50μs
  - 网络策略 + Gateway + Service Mesh 三合一，减少组件栈
  - 支持共享Agent模式，资源复用效率高

限制:
  - L7功能仍依赖Envoy代理，混合架构调试复杂度较高
  - 大规模路由变更时控制平面可能出现短暂CPU尖峰 [[5]]

推荐理由:
  - NGINX数据平面成熟稳定，内存占用低（~50MB/实例）
  - 配置语法与经典Ingress-NGINX相似，迁移成本低
  - 静态内容服务性能优异，适合内容分发场景

注意: 控制平面更新速度较慢（秒级），不适合高频路由变更

GKE用户 → GKE Gateway
  - 自动集成Cloud CDN、Cloud Armor、Managed Certificates
  - 全球负载均衡开箱即用，多区域部署极简

AWS用户 → AWS Gateway API Controller
  - 直接映射ALB/NLB，享受AWS安全组、WAF、Shield集成
  - 注意：当前仅支持HTTPRoute/GRPCRoute，TCP/UDP需回退到Service

Azure用户 → Application Gateway for Containers
  - 与Azure AD、Key Vault深度集成，合规场景友好

apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: envoy-external
spec:
  controllerName: gateway.envoyproxy.io/gatewayclass-controller
  parametersRef:
    group: gateway.envoyproxy.io
    kind: EnvoyProxy
    name: envoy-external-proxy
    namespace: gw-external
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyProxy
metadata:
  name: envoy-external-proxy
  namespace: gw-external
spec:
  provider:
    type: Kubernetes
    kubernetes:
      envoyDeployment:
        replicas: 3
        pod:
          annotations:
            prometheus.io/scrape: "true"
          tolerations:
            - key: "dedicated"
              operator: "Equal"
              value: "external-gw"
              effect: "NoSchedule"
        container:
          resources:
            requests:
              cpu: "1"
              memory: "512Mi"
            limits:
              cpu: "2"
              memory: "1Gi"
          securityContext:
            runAsNonRoot: true
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
      service:
        type: LoadBalancer
        annotations:
          service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
          service.beta.kubernetes.io/aws-load-balancer-type: nlb

apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: envoy-internal
spec:
  controllerName: gateway.envoyproxy.io/gatewayclass-controller
  parametersRef:
    group: gateway.envoyproxy.io
    kind: EnvoyProxy
    name: envoy-internal-proxy
    namespace: gw-internal
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyProxy
metadata:
  name: envoy-internal-proxy
  namespace: gw-internal
spec:
  provider:
    type: Kubernetes
    kubernetes:
      envoyDeployment:
        replicas: 2
        pod:
          tolerations:
            - key: "dedicated"
              operator: "Equal"
              value: "internal-gw"
              effect: "NoSchedule"
        container:
          resources:
            requests:
              cpu: "500m"
              memory: "256Mi"
            limits:
              cpu: "1"
              memory: "512Mi"
      service:
        type: LoadBalancer
        annotations:
          service.beta.kubernetes.io/aws-load-balancer-scheme: internal
          service.beta.kubernetes.io/aws-load-balancer-type: nlb

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: external-gateway
  namespace: gw-external
spec:
  gatewayClassName: envoy-external
  listeners:
    - name: https-public
      protocol: HTTPS
      port: 443
      hostname: "*.example.com"
      tls:
        mode: Terminate
        certificateRefs:
          - name: public-wildcard-cert
            namespace: gw-external
      allowedRoutes:
        namespaces:
          from: Selector
          selector:
            matchLabels:
              gw-access: external
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: internal-gateway
  namespace: gw-internal
spec:
  gatewayClassName: envoy-internal
  listeners:
    - name: https-internal
      protocol: HTTPS
      port: 443
      hostname: "*.internal.example.com"
      tls:
        mode: Terminate
        certificateRefs:
          - name: internal-wildcard-cert
            namespace: gw-internal
      allowedRoutes:
        namespaces:
          from: Selector
          selector:
            matchLabels:
              gw-access: internal

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
  name: external-oidc
  namespace: gw-external
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: external-gateway
  oidc:
    provider:
      issuer: "https://auth.example.com/realms/production"
      authorizationURL: "https://auth.example.com/realms/production/protocol/openid-connect/auth"
      tokenURL: "https://auth.example.com/realms/production/protocol/openid-connect/token"
    clientID: "external-gateway-client"
    clientSecret:
      name: oidc-client-secret
      namespace: gw-external
    redirectURL: "https://app.example.com/oauth2/callback"
    logoutPath: "/logout"
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: BackendTrafficPolicy
metadata:
  name: external-rate-limit
  namespace: gw-external
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: external-gateway
  rateLimit:
    type: Global
    global:
      rules:
        - clientSelectors:
            - sourceIP: "*"
          limit:
            requests: 1000
            unit: Minute

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: SecurityPolicy
metadata:
  name: internal-mtls
  namespace: gw-internal
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: internal-gateway
  mtls:
    clientValidation:
      caCertificateRefs:
        - name: internal-ca-cert
          namespace: gw-internal
---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: BackendTrafficPolicy
metadata:
  name: internal-ip-allowlist
  namespace: gw-internal
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: internal-gateway
  clientIPDetection:
    xForwardedFor:
      numTrustedHops: 1

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-external-to-internal
  namespace: app-internal
spec:
  podSelector: {}
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              gw-access: internal
      ports:
        - protocol: TCP
          port: 8080
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-internal-to-external
  namespace: app-external
spec:
  podSelector: {}
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              gw-access: external
      ports:
        - protocol: TCP
          port: 8080

apiVersion: v1
kind: ConfigMap
metadata:
  name: envoy-external-observability
  namespace: gw-external
data:
  observability.yaml: |
    accessLog:
      type: OpenTelemetry
      openTelemetry:
        endpoint: "otel-collector.observability:4317"
        resources:
          k8s.gateway.class: "envoy-external"
          traffic.domain: "public"
    metrics:
      type: OpenTelemetry
      openTelemetry:
        endpoint: "otel-collector.observability:4317"
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: envoy-internal-observability
  namespace: gw-internal
data:
  observability.yaml: |
    accessLog:
      type: OpenTelemetry
      openTelemetry:
        endpoint: "otel-collector.observability:4317"
        resources:
          k8s.gateway.class: "envoy-internal"
          traffic.domain: "private"
    metrics:
      type: OpenTelemetry
      openTelemetry:
        endpoint: "otel-collector.observability:4317"

apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: envoy-ecom
spec:
  controllerName: gateway.envoyproxy.io/gatewayclass-controller
  parametersRef:
    group: gateway.envoyproxy.io
    kind: EnvoyProxy
    name: envoy-ecom-proxy
    namespace: gw-ecom
---
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: envoy-pay
spec:
  controllerName: gateway.envoyproxy.io/gatewayclass-controller
  parametersRef:
    group: gateway.envoyproxy.io
    kind: EnvoyProxy
    name: envoy-pay-proxy
    namespace: gw-pay
---
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: envoy-ops
spec:
  controllerName: gateway.envoyproxy.io/gatewayclass-controller
  parametersRef:
    group: gateway.envoyproxy.io
    kind: EnvoyProxy
    name: envoy-ops-proxy
    namespace: gw-ops

apiVersion: v1
kind: Namespace
metadata:
  name: gw-ecom
  labels:
    gw-access: ecom
    istio-injection: disabled
---
apiVersion: v1
kind: ResourceQuota
metadata:
  name: gw-ecom-quota
  namespace: gw-ecom
spec:
  hard:
    requests.cpu: "4"
    requests.memory: "8Gi"
    limits.cpu: "8"
    limits.memory: "16Gi"
    pods: "10"

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: ecom-gateway
  namespace: gw-ecom
spec:
  gatewayClassName: envoy-ecom
  listeners:
    - name: https-ecom
      protocol: HTTPS
      port: 443
      hostname: "ecom.example.com"
      tls:
        mode: Terminate
        certificateRefs:
          - name: ecom-tls-cert
      allowedRoutes:
        namespaces:
          from: Selector
          selector:
            matchLabels:
              gw-access: ecom
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: ecom-api-route
  namespace: app-ecom
spec:
  parentRefs:
    - name: ecom-gateway
      namespace: gw-ecom
  hostnames:
    - "ecom.example.com"
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /api/v1/products
      backendRefs:
        - name: product-service
          port: 8080
          weight: 100
    - matches:
        - path:
            type: PathPrefix
            value: /api/v1/orders
      backendRefs:
        - name: order-service
          port: 8080
          weight: 100

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: ecom-product-canary
  namespace: app-ecom
  annotations:
    rollout.argoproj.io/revision: "2"
spec:
  parentRefs:
    - name: ecom-gateway
      namespace: gw-ecom
  hostnames:
    - "ecom.example.com"
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /api/v1/products
      backendRefs:
        - name: product-service-v1
          port: 8080
          weight: 90
        - name: product-service-v2
          port: 8080
          weight: 10
      filters:
        - type: RequestHeaderModifier
          requestHeaderModifier:
            add:
              - name: X-Canary-Weight
                value: "v1:90,v2:10"

apiVersion: apps/v1
kind: Deployment
metadata:
  name: product-service-v2
  namespace: app-ecom
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  template:
    spec:
      terminationGracePeriodSeconds: 60
      containers:
        - name: product-service
          image: registry.example.com/ecom/product-service:v2.1.0
          ports:
            - containerPort: 8080
          readinessProbe:
            httpGet:
              path: /healthz/ready
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 3
            failureThreshold: 3
          livenessProbe:
            httpGet:
              path: /healthz/live
              port: 8080
            initialDelaySeconds: 10
            periodSeconds: 10
          lifecycle:
            preStop:
              exec:
                command: ["/bin/sh", "-c", "sleep 10"]

apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: product-service
  namespace: app-ecom
spec:
  replicas: 5
  strategy:
    canary:
      canaryService: product-service-canary
      stableService: product-service-stable
      trafficRouting:
        managedRoutes:
          - name: canary-header-route
        plugins:
          argo-rollouts-gatewayapi:
            gatewayRef:
              name: ecom-gateway
              namespace: gw-ecom
            httpRouteRef:
              name: ecom-product-route
              namespace: app-ecom
      steps:
        - setWeight: 10
        - pause: { duration: 3m }
        - setHeaderRoute:
            name: canary-header-route
            match:
              - headerName: X-Canary
                headerValue: "true"
        - pause: { duration: 5m }
        - setWeight: 30
        - pause: { duration: 5m }
        - analysis:
            templates:
              - templateName: success-rate
            args:
              - name: service-name
                value: product-service-canary.app-ecom.svc.cluster.local
        - setWeight: 60
        - pause: { duration: 5m }
        - setWeight: 100
      analysisTemplates:
        - templateName: success-rate
---
apiVersion: argoproj.io/v1alpha1
kind: AnalysisTemplate
metadata:
  name: success-rate
  namespace: app-ecom
spec:
  args:
    - name: service-name
  metrics:
    - name: success-rate
      interval: 30s
      successLimit: 3
      failureLimit: 2
      provider:
        prometheus:
          address: "http://prometheus.observability:9090"
          query: |
            sum(rate(http_requests_total{service="",status!~"5.."}[1m]))
            /
            sum(rate(http_requests_total{service=""}[1m]))
          successCondition: "result[0] >= 0.99"

apiVersion: gateway.networking.k8s.io/v1beta1
kind: ReferenceGrant
metadata:
  name: ecom-to-pay-grant
  namespace: app-pay
spec:
  from:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      namespace: app-ecom
  to:
    - group: ""
      kind: Service
      name: payment-api

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyProxy
metadata:
  name: envoy-ecom-proxy
  namespace: gw-ecom
spec:
  telemetry:
    accessLog:
      type: OpenTelemetry
      openTelemetry:
        endpoint: "otel-collector.observability:4317"
        resources:
          k8s.business.line: "ecom"
          k8s.gateway.name: "ecom-gateway"
    metrics:
      type: OpenTelemetry
      openTelemetry:
        endpoint: "otel-collector.observability:4317"
    tracing:
      type: OpenTelemetry
      openTelemetry:
        endpoint: "otel-collector.observability:4317"
        serviceName: "ecom-gateway"

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: BackendTrafficPolicy
metadata:
  name: pay-circuit-breaker
  namespace: gw-pay
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: pay-gateway
  circuitBreaker:
    maxConnections: 1000
    maxPendingRequests: 100
    maxParallelRequests: 500
    maxParallelRetries: 10
    perEndpoint:
      maxConnections: 50
      maxPendingRequests: 10
      maxParallelRequests: 25
  retry:
    retryOn:
      - "5xx"
      - "connect-failure"
      - "refused-stream"
    numRetries: 3
    retryBackOff:
      baseInterval: "100ms"
      maxInterval: "5s"
  faultInjection:
    abort:
      percentage: 100
      httpStatus: 503