> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ahmadraza.in/llms.txt
> Use this file to discover all available pages before exploring further.

# NLB GatewayAPI

# Gateway API with **Envoy Gateway**

In this setup, we will use the **AWS Load Balancer Controller** to provision a high-performance **NLB** that terminates TLS via **ACM**, and then passes the traffic to **Envoy** pods which handle the smart routing to your apps.

***

### High-Level Architecture

***

### Step 1: Prerequisites

Before we start, ensure your EKS cluster has the following:

1. **AWS Load Balancer Controller (LBC) installed.** This is mandatory as it’s the component that actually talks to AWS to create the NLB.
2. **VPC CNI** (standard on EKS) for "IP" target mode (faster performance).
3. **An ACM Certificate ARN** (e.g., `arn:aws:acm:region:account:certificate/ID`) for your domain.

***

### Step 2: Install Gateway API CRDs & Envoy Gateway

Gateway API is not installed by default in K8s clusters. You must install the definitions first.

```bash theme={null}
# 1. Install Standard Gateway API CRDs
kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.1.0/standard-install.yaml

# 2. Install Envoy Gateway via Helm
helm install eg oci://docker.io/envoyproxy/gateway-helm \
  --version v1.6.3 \
  -n envoy-gateway-system \
  --create-namespace

```

***

### Step 3: Configure the NLB (EnvoyProxy & GatewayClass)

We need to tell Envoy Gateway *how* to provision the AWS infrastructure. We do this using a provider-specific configuration.

#### 1. Define the EnvoyProxy (The AWS Settings)

This is where we put our NLB annotations.

```yaml theme={null}
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyProxy
metadata:
  name: aws-nlb-config
  namespace: envoy-gateway-system
spec:
  provider:
    type: Kubernetes
    kubernetes:
      envoyService:
        annotations:
          service.beta.kubernetes.io/aws-load-balancer-type: "external"
          service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: "ip"
          service.beta.kubernetes.io/aws-load-balancer-scheme: "internet-facing"
          # TLS Termination at NLB level
          service.beta.kubernetes.io/aws-load-balancer-ssl-cert: <YOUR_ACM_ARN>
          service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "443"

```

#### 2. Define the GatewayClass

This links the Envoy controller to your specific AWS config.

```yaml theme={null}
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: envoy-gateway-class
spec:
  controllerName: gateway.envoyproxy.io/gatewayclass-controller
  parametersRef:
    group: gateway.envoyproxy.io
    kind: EnvoyProxy
    name: aws-nlb-config
    namespace: envoy-gateway-system

```

***

### Step 4: Provision the Gateway (The NLB)

Creating this resource triggers the AWS Load Balancer Controller to spin up your NLB.

```yaml theme={null}
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: my-gateway
  namespace: default
spec:
  gatewayClassName: envoy-gateway-class
  listeners:
  - name: https
    protocol: HTTP # We use HTTP here because NLB terminates TLS and sends plain HTTP to Envoy
    port: 443
    allowedRoutes:
      namespaces:
        from: All

```

*Note: Check the status with `kubectl get gateway`. Once the `PROGRAMMED` status is `True`, you will see an `ADDRESS` which is your NLB DNS.*

***

### Step 5: Route-Based Routing (HTTPRoute)

Now, let's point `example.com/app1` to Service A and `example.com/app2` to Service B.

```yaml theme={null}
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: app-routes
  namespace: default
spec:
  parentRefs:
  - name: my-gateway
  hostnames:
  - "example.com"
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /app1
    backendRefs:
    - name: app1-service
      port: 80
  - matches:
    - path:
        type: PathPrefix
        value: /app2
    backendRefs:
    - name: app2-service
      port: 80

```

***

### Step 6: Finalize Route 53

1. Go to the **Route 53 Console**.
2. Create an **A Record** for `example.com`.
3. Select **Alias to Network Load Balancer**.
4. Choose your region and select the NLB created by the Gateway.

***

### Why this approach in 2026?

* **Role Separation:** Your infrastructure team manages the `Gateway`, while app teams just manage their own `HTTPRoute` without breaking each other's configurations.
* **Performance:** Envoy is C++ based and extremely lightweight compared to the Lua-heavy NGINX Ingress.
* **Future Proof:** Most cloud providers are moving away from Ingress annotations in favor of this standardized API.

**Now add advanced filters, like "URL Rewriting" (so `/app1` becomes `/` when it hits the pod), or "Rate Limiting" to this setup?**