Exposing Web Apps (Gateway API & HTTPRoute)

Berkelium uses the Kubernetes Gateway API (gateway.networking.k8s.io/v1) powered by Envoy Gateway to provide modern, high-performance routing and automated SSL/TLS termination for scientific workloads.

The legacy networking.k8s.io/v1 Ingress is not used in this cluster. Instead, all traffic routing is defined using HTTPRoute resources attached to the cluster-wide Gateway.

The Central Gateway

The cluster operates a shared Gateway in the gateway namespace:

Gateway Name: ingress
Namespace: gateway
Parent Ref Group: gateway.networking.k8s.io
Section Names:
- https (Port 443 — TLS Terminated)
- http (Port 80 — Plain HTTP)
- grpc (Port 50051 — gRPC over TLS)

Because the central Gateway allows routes from all namespaces (namespaces.from: All), any scientific project namespace can attach an HTTPRoute directly.

Exposing to the world

By default the new service will only be visible within LBL’s internal network. To open it up to the world, use the iprequest service to create the CNAME to <service_name>.bk.lbl.gov.cdn.cloudflare.net and let us know to complete the setup in CloudFlare.

Example: Basic HTTPRoute Manifest

To expose a Dash, Streamlit, JupyterHub, or web service under *.bk.lbl.gov:

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: my-service-route
  namespace: my-project
spec:
  hostnames:
    - test-service.bk.lbl.gov
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: ingress
      namespace: gateway
      sectionName: https
  rules:
    - backendRefs:
        - group: ""
          kind: Service
          name: nginx-service
          port: 80
          weight: 1
      matches:
        - path:
            type: PathPrefix
            value: /

Key Fields Explained

Field	Description
`spec.parentRefs`	References the central Envoy Gateway (`ingress` in `gateway` namespace). Use `sectionName: https` for TLS.
`spec.hostnames`	DNS name that routes to your application (typically under `*.bk.lbl.gov`).
`spec.rules.matches`	Routing rules (e.g., `PathPrefix`, exact path, headers, or query parameters).
`spec.rules.backendRefs`	The target Kubernetes `Service` and port in your namespace receiving traffic.

Verifying Route Status

Check if your route has been programmed and accepted by Envoy Gateway:

kubectl get httproute my-service-route -n my-project

Look for PROGRAMMED: True and inspect status conditions:

kubectl describe httproute my-service-route -n my-project