# IMESH API Gateway


# Overview

The IMESH API gateway offers a Kubernetes-native ingress controller for DevOps and developers to overcome application networking's limitations. It is based on Envoy Proxy, which makes it faster and lighter. It conforms to Kubernetes Gateway API specifications. Unlike legacy gateway solutions, the IMESH API gateway is meant to handle traffic at scale for microservices-based applications.

{% embed url="<https://www.youtube.com/watch?v=VCEnDNG1uPY>" %}

\
Features of IMESH API Gateway are:

1. Unified API interface for DevOps, developers, DevSecOPs, and platform engineers
2. Federated RBAC for developers to create APIs independently&#x20;
3. Conformance with [Kubernetes Gateway API](https://gateway-api.sigs.k8s.io/) standards
4. Native support for Envoy Gateway and Istio Ingress controller
5. The built-in network features such as failover, retries, timeouts, canary, and rate-limiting
6. YAML templates for AuthN/Z policies such as JWT, OIDC, Basic Auth, etc.&#x20;
7. Support GitOps-style delivery
8. Scale to millions of transactions per day without fail
9. Real-time dashboard for traffic and API performance

###

####


# Concepts

The Kubernetes community has started [Kubernetes Gateway API](https://gateway-api.sigs.k8s.io/), standardizing how north-south traffic is handled in Kubernetes clusters. The three primary goals of this standardization are:&#x20;

* Generalization of configuration to avoid vendor-locking,&#x20;
* Expressiveness for core traffic functionality (header-based routing, traffic weighting, etc.)
* Role-oriented design to improve self-service of API creation.

The idea is that in emerging startups or enterprises, DevOps or the platform team would own the creation of a Gateway to listen to external traffic, and developers would create Routes (like APIs) to map the traffic from the Gateway to their backend services in Kubernetes.&#x20;

<br>

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXclGHcqz-AnX3Cn4iiUBoYhqGYb6cUf-J6M50LZYw-JDI1vwm3qGO0oLYBrgbGSiyoWLdJ2EMzTDhebVPs77CrcIUtx8127epMPlelQrEHr2v87nG3tjyhYi_QJ1ZsDCJXycRCVEjidzJbz1TC1Cwb8KvYL?key=TmnoeuMYwYPADPNdd3FkNg" alt=""><figcaption></figcaption></figure>

#### Key benefits of IMESH API Gateway

1. Fast, secure, and scalable traffic&#x20;
2. Rise in developer’s productivity with low-code API management solution
3. Implementation of multi-tenancy with RBAC of API management
4. Faster troubleshooting of production issues with real-time traffic insights.
5. Less hassle with integrations with built-in integration with Kubernetes-native platforms such as Prometheus, Grafana, Argo CD, and Istio service mesh
6. High flexibility to rip-and-replace ingress controllers as per convenience, as IMESH provides support for Istio and Envoy Gateway controllers.

<br>


# Architecture

IMESH API Gateway uses Envoy Gateway as a controller to create gateways and routes for online traffic. It supports protocols like HTTP, HTTPS, TCP, TLS, UDP, and gRPC.

The IMESH API Gateway has four main components: Envoy Gateway, Envoy Gateway controller, IMESH Agent, and IMESH Platform. <br>

1. **Envoy Gateway:** It is an open-source API gateway based on an Envoy proxy. It is fast, secure, and highly scalable. It follows Gateway API standards.&#x20;
2. **Gateway Controller:** Gateway Controller is responsible for provisioning and configuring Envoy proxies, including the gateway, based on the configuration defined by the user. Although there are many open source Gateway controllers, we are supporting two popular controllers- Envoy Gateway and Istio Ingress.
3. **IMESH Agent:** It is a cluster agent installed on the gateway to implement enterprise features such as RBAC, visibility, and network policies.&#x20;
4. **IMESH Platform:** It is the backend core application that interfaces with the user to configure various gateways and provides insights into the performance of network and gateway resources.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXdZORQlqwxPz2lpRr3uOkrhzef8IQRINHh0YrUIlYP-c4A-9pvSlcpvExidge84ou-ELIS72PcNx7Qr18x_hQEQ4rB11pXPfZM8M3htahW07aRDZpCM5anglHVKZXefbHNpGE2OLCvK--FPYgOQy1Dp5FH5?key=TmnoeuMYwYPADPNdd3FkNg" alt=""><figcaption></figcaption></figure>

<br>

<br>

###


# Getting started

Watch the video to get started with IMESH API Gateway

{% embed url="<https://www.youtube.com/watch?v=L8Eo_ZgeFjg>" %}


# Pre-requisite

You need to ensure the following before installation:

1. Kubernetes cluster (EKS/GKE/AKS/On-prem)
2. Helm. ( Refer to this [documentation](https://helm.sh/docs/) to get started)
3. [Kubernetes Gateway API](https://gateway-api.sigs.k8s.io/) CRD
4. Controller of Istio or Envoy Gateway (you can refer to the video to install Istio/Envoy Gateway controllers)

You need to install IMESH Agent to your cluster. The minimum resources you require for installing IMESH Agent are provided below:

| Items       | CPU | Memory |
| ----------- | --- | ------ |
| IMESH Agent | 50m | 128MB  |

Note: These minimum resources are as per this release only and may vary in future releases.

#### Install Gateway API CRD

Use the following command to install the Kubernetes Gateway API CRD standard channel.&#x20;

```yaml
kubectl apply -f
https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.1.0/standard-install.yaml
```

\
(refer to the Kubernetes gateway API [guide](https://gateway-api.sigs.k8s.io/guides/) to know more)

**Installing Istio as a controller for Gateway API**

You can install the Istio or Envoy Gateway controller. Here are the commands to install Istiod, which will act as the controller for managing the Kubernetes gateway. (We have used istioctl, but you can use HELM alternatively).

```yaml
istioctl install -set profile=minimal
```

(Note: we have kept the profile minimal because we need only Istio core or Istiod)

**Installing Envoy Gateway as a controller for Gateway API**

You can install Envoy Gateway as a controller by executing the following command:

```yaml
kubectl apply --server-side -f https://github.com/envoyproxy/gateway/releases/download/v1.1.0/install.yaml
```

**Create GatewayClass resource**

To create gateways, we have to make a **GatewayClass** CRD. The **GatewayClass** resource represents a class of controllers that can be instantiated. Istio automatically installs GatewayClass CRD; however, with Envoy Gateway, one must manually create and deploy GatewayClass CRD.&#x20;

To create a GatewayClass resource, you can use the following code to create a YAML file.

```yaml
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: eg
spec:
  controllerName: gateway.envoyproxy.io/gatewayclass-controller
```

You can deploy the yaml to create a GatewayClass resource.\ <br>


# Installation

**Install IMESH Agent with HELM**

IMESH offers both on-prem and SaaS solutions for enterprises. To get started with the SaaS version, follow the following steps.

1. Register your organization and work email address by clicking on this [link](https://app.imesh.ai/registration).&#x20;
2. Once you register your organization and email, you will receive an email from us to activate your account.&#x20;
3. After activating your account, you can log in to the IMESH platform at <https://app.imesh.ai/>. Use your registered email ID and password to log in.
4. Now, you can go to Admin -> Clusters and add a new cluster. It will ask for your cluster name and prompt you to install the IMESH Agent with commands.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfZgFlagphgtk6B3W-xV-hUOUKqy2Kzei6mu1abdWOv5s03Jzs6JxoPcl1LLs8IMHGU7S8mr8TeA7ul2UP1XlpMY7QzJKWSmwshoURUGzi8JGeEAO0wXn4GqXDXTwpOIXyq5ajH3rky3S_OuAvWY3PSpgaO?key=TmnoeuMYwYPADPNdd3FkNg" alt="" width="375"><figcaption></figcaption></figure>

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfic801FyQkmUVTTRogv-eH3A4XbxLt9pVhdLAY-9f8FpTgYxWIamq1GIJHh_rmLjPmVAH-hPcxDA5vVgaLmsoWmDfCFpOu4FQZanolC1FEPToRTsApQqdOJZpXR-m24vqL27GAv5fhGKGfC8AHQ4o0Be6v?key=TmnoeuMYwYPADPNdd3FkNg" alt=""><figcaption></figcaption></figure>

Note: Please let us know on our [Slack channel ](https://imesh.ai/register-slack.html)if you have any questions.


# Gateway

This section showcases how to create and manage a Gateway for your Kubernetes apps from the IMESH API Gateway's UI.


# Create Gateway

IMESH API Gateway offers **API Configuration** to create and manage APIs for your Kubernetes applications. You can create Gateways to receive incoming traffic at a specific port and Routes to redirect the traffic to a back-end application.&#x20;

The video below provides an overview.

{% embed url="<https://www.youtube.com/watch?v=GO4tTDCw65o>" %}

1. IMESH API Gateway allows DevOps to create, edit, and delete Gateway resources from the application itself. To create a Gateway, you only need to click **Add New Gateway** and complete the form.&#x20;

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXcFGRxTlxaOhZCavKHqO1jrpPZO8V1A-MyGpgxieyxrdszyBisB5rlLpL0hYTpDVp6uwln-uZUV30TtMbBrq6YR9qAI77enHFX37o0oGdJA31uL4N_b9pt6lQafmV_b8nCJeT1BhgoJzRQtxWiblxBHfF8?key=TmnoeuMYwYPADPNdd3FkNg" alt=""><figcaption></figcaption></figure>

2. Gateway creation has two parts: **General Info** and **Listener**. At first, a DevOps engineer must fill in the general info about creating a Gateway resource, such as the namespace, selecting a Gateway class, etc.&#x20;

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfgUCbKGqSwjnZIIx0HZfR51UQKfI2u-KLIm1T3GdildSkHFs-Pv1g8D8yz6TC7FLTrcjbi849C9ywa2mxkXYdrqh_5jh6XxZTngzDYCyYOWjzJd2OaDRxMWz870ohBMryCVn29EwqeoloJcGQ5qEXpEJyH?key=TmnoeuMYwYPADPNdd3FkNg" alt=""><figcaption></figcaption></figure>

3. The Listener section will seek information about the traffic, such as the IP protocol (HTTP, HTTPS, TCP, UDP, etc.), Port, and TLS mode.&#x20;

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfLV-JdZwJe2GjomIFxLfCanNJEod2YcsownUigYWaQQV3KB5yw-s5HVsuaVV2zJtqNTQtzhq_2ZH0OGnbGq8n1u5XdSeiKKBmIRjXBUGieKqJQYQh-nZlJfjUE5f69exKo1A8bN0GBss5fwGwaxCE4HLI?key=TmnoeuMYwYPADPNdd3FkNg" alt=""><figcaption></figcaption></figure>

4. Once you create a listener, you can deploy the Gateway resource.&#x20;

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfzG9otDFJkJABp8rXMd2gA61TEGkwjSvIfT5BkvG1WqsXisSQ8xCYpNlXpoDis26Hk96uG4A08-3oljP0HmIHArrVD11aoxVHNhI6pdU00lsBCP43mcgUr3O_NEJXD1tJUKhr2eSq3YAJsjDCBq1ON6udG?key=TmnoeuMYwYPADPNdd3FkNg" alt=""><figcaption></figcaption></figure>

5. Your Gateway has already been created and is visible in the Gateway portal. And it will provide a public address to receive the traffic. Now, developers can use this Gateway and listener to create Routes for their applications.&#x20;

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXd6Xb38NRIatzHbP7Cft8uYD8DXXLUb4dYUPkvqdKGk_mMVDkMHFkw_1y0vvBIiDY9iGj2EdE5WGektU_n33RhhG3IT0cUQhxg649IxHmvySkYIAuZqLpD1EEZVrRxGq6C9IQfDQM6C2oI3OR6Y5AyhWchi?key=TmnoeuMYwYPADPNdd3FkNg" alt=""><figcaption></figcaption></figure>

\
Note: Please let us know on our [Slack channel ](https://imesh.ai/register-slack.html)if you have any questions.&#x20;

<br>


# View and Manage Gateway

The landing page will provide all the consolidated API gateways created in your enterprise multicluster environment. DevOps and cloud teams can be scattered across geography or projects; the Gateway dashboard provides a consolidated view of all the Gateways and their respective IP address, the namespace they are created in, the Gateway class, and more info at the fingertips.&#x20;

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXcimkn1lJvwXwLSS4L3Cr6TpB7vacWVzQOCNeGPuKe5KapMi0GKaeMynMFYYk1OoXbOGU-YLxvufTTqMhT3cIsnREzrRv08tpV3MA0jqRNkHjEW5Yuk-q-OgKT9KNMO1vOvQoMrP2ZbD2sWPAa1BXtT3CQ?key=TmnoeuMYwYPADPNdd3FkNg" alt=""><figcaption></figcaption></figure>

One can also quickly check the YAML configuration file of the Gateway resource without logging into multiple clusters. Depending on the requirements, they can delete the Gateway resources from the IMESH application.&#x20;

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXc9xHmKjmgNd1D9y9NeZbtNJdswW1hBAJsHZf-KtRTFTclIXaIY4uq7mcgFRam4pdDODuq3AJNf2PsUdrt6r7E31jVBNL04STTP-9daQv2JIgMo6VHS4LBsKAxz1W4K-z3Qy83zyTvzEgCFPCN-B6FRynnk?key=TmnoeuMYwYPADPNdd3FkNg" alt=""><figcaption></figcaption></figure>

You can view the Gateway resource specs from the IMESH platform using the YAML viewer without having to log in to the cluster.&#x20;

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXduuDfuPFse2RSzdyMBzUUC4D5PjO72zBTSIZFTA4jAaoccAFbolvlmn7i3OVdNq1ztyTR7EWyJ_-4eodTUbqqkx663a7j5TcgADOm6dyQrn2Pz3dKaCy0PahGcdqnGPGK5S8vfLYIrgzJfpg_xIjy7Qvg?key=TmnoeuMYwYPADPNdd3FkNg" alt=""><figcaption></figcaption></figure>

Note: Please let us know on our [Slack channel ](https://imesh.ai/register-slack.html)if you have any questions.&#x20;

<br>


# Routes

Once you receive traffic at a specific port, you need to create Route resources to handle the traffic and send a response to the requestor.&#x20;

The IMESH API Gateway’s API Configuration-> Routes allows Application developers to create Routes in seconds without writing a single line of code.

Like creating and managing Gateway resources from the UI, IMESH API Gateway provides the flexibility to develop Routes from the UI. This reduces the application developers’ load to learn YAML files; creating an advanced filtering option can be challenging and often derail them from the core work.&#x20;

DevOps and Cloud engineers can give application developers access only to Routes, not Gateways. This allows an enterprise to achieve segregation of ownership based on Role.&#x20;

Refer to the video.

{% embed url="<https://www.youtube.com/watch?v=fLLr4FfcZr8>" %}


# Create Routes

Application developers can easily create a Route for their application in a few minutes using the following steps.

1. Click Add New HTTPRoute to create a new Route. Our platform will ask you to complete a form.

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXcJZFuiPx1ifXyZ1tMnAUStwU9fO-SQvHEYctmZ3RgzfeQUs9-Az9cYdzDvDK-D1QmzggGE-p2zI3uo0EBMLKH3mt9yq0kPGst907EhAM-tIE3ShSxIYjT2aARl-oQNdBdOHPtZxxrKilWkLRibMlbiQdVw?key=TmnoeuMYwYPADPNdd3FkNg" alt=""><figcaption></figcaption></figure>

2. The form has three sections: **General Info** (about the namespace, labels, annotations, etc.), **Gateway linking** (linking to a Listener of a Gateway), and **HTTP Rules** (conditions to filter traffic and send it to the backend service).

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfH-i7Hm2J_msT7y8C6wDZ6bt7bxUtwPI1R_xguepXmhUsKDtXX_9yQLOtAZ9KRbynE22iQJj_B9RgsC9X2yfM8G4cRfG_Hgl1D1iUGqmBoRDZJzrUUrO40Dh0EJONadlFU94REL1t2-ivz-Jd74_oLkOo?key=TmnoeuMYwYPADPNdd3FkNg" alt=""><figcaption></figcaption></figure>

3. Under the HTTP Rules, engineers need to fill in the following information about Condition (to filter traffic), Action (such as modifying request header, redirect to, URL rewrite, Request mirror), and Destination (backend service name, port, and traffic percentage).&#x20;

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXeAIIAdeiPEUOkPqUI-TsYYyNQ67nwJ_3YvmZ8FyBVnRUOODcrsFp5WKBsdSAo8OqpAZP0LwljMbNbx7cf0U2w1hFx4QanaRGCycWMoGa2naAZg3_3hFOWjS_u7kpU3qTgmy_UJt4bEoO85bD0s8OpGhMNY?key=TmnoeuMYwYPADPNdd3FkNg" alt=""><figcaption></figcaption></figure>

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfkNQuEP4Stc_Y3ba5tghQyYD_SigfGBr6TvL1bfh8Au611EMeLW5QMAO5uIhPkEXZC4ho0whrBRNGvag5D9LBqtBc9U6Do4LK_s6tY5ErWdPjYzatSvcFPaSgcJrhQRcrZEnU9Jx6oTDXphVgxJLod_-fD?key=TmnoeuMYwYPADPNdd3FkNg" alt=""><figcaption></figcaption></figure>

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfjENEh9AbPn4En7_vNBxmxKNBROI3-MWnPyAwmXgOVAjDpI6uot0NcLlBYhxsE8zjGjAoYkKC62LqZ9XpaRJhSVMJ9kuXrpnIRWbuHsl4tDVNF659Ve1aHRrR-rzfQTt0uvNiL2_XPJK900cbupkStuCAj?key=TmnoeuMYwYPADPNdd3FkNg" alt=""><figcaption></figcaption></figure>

4. Once the form is completed, saved, and deployed, a new Route resource is created. IMESH API Gateway creates a YAML file and stores it for further reference.&#x20;

<figure><img src="https://lh7-rt.googleusercontent.com/docsz/AD_4nXfcz98YjguxJOeMFWjzt8q6Iow4KHC85P5Eh4sM142RIB1lShDrKfAy0Ol18x7Cn2L_gLmC1MVfOo1mrk1mULm6B61NhoFPNT4lQpBbbbWDcspsqVUGDWA0JPDP2KKbuaOsWFGjB1wTj8yA-zDJjXTTANAb?key=TmnoeuMYwYPADPNdd3FkNg" alt=""><figcaption></figcaption></figure>

Note: Please let us know on our [Slack channel ](https://imesh.ai/register-slack.html)if you have any questions.&#x20;

The following sections will discuss various cases to manage HTTP traffic, such as modifying headers, URL rewrite/redirect, etc.

<br>


# Add or Modify Headers

HTTP(s) Headers are key-value pairs that the client or server can use to pass additional information along with an HTTP(s) request or response. Modifying the headers of the traffic that passes through your browser quickly can help during development.  By modifying headers, you can test websites by bypassing authorization, removing the content-security-policy header to open the website in an iframe, modifying custom headers for feature flagging, handling CORS issues, managing cookies, etc.

\
IMESH API Gateway can help with a simple UI configuration that allows you to modify request/response headers as you want. It generates (Route) YAML in the backend.

<br>

{% embed url="<https://youtu.be/nGTSidK21Qk>" %}


# URL Rewrites

URL rewrite or “remapping” means changing the URL used in the proxy request. This is initially the same as in the client request and remains so if no URL rewriting is done. You can rewrite the URL of your HTTP request using IMESH API Gateway.

{% embed url="<https://youtu.be/F_D_WUlSB2k>" %}


# URL Redirect

URL redirection, or URL forwarding, is a technique developers use to make a web page available under more than one URL address. When a web browser attempts to open a URL that has been redirected, a page with a different URL is opened. Developers or DevOps need to provide a new URL and a 3XX HTTP redirection code in the IMESH API Gateway.

{% embed url="<https://youtu.be/_1CJnbbZVRQ>" %}


# Header and Query-based matching

IMESH API Gateway allows users to create header-matching rules to match requests to destinations based on the contents of the headers. Note that while configuring the matcher on a route, you may want to specify one or more header matches to require headers with matching values to be present on the request.

{% embed url="<https://youtu.be/60TouxeESFg>" %}


# Canary Deployment

Canary deployment is a strategy for gradually releasing software into production. The process involves allowing only a fraction of users to test newly deployed software. From an implementation perspective, the developer and DevOps would like to limit a small portion of traffic to a newly deployed service.&#x20;

IMESH API Gateway helps to create a canary deployment with a few clicks by adding destination services and traffic weight.

<br>

{% embed url="<https://youtu.be/5rtuGCn-wR4>" %}