new: Added Gateway API lab (#1852)

Author: desaiajayhnr

.gitignore

@@ -53,3 +53,4 @@ devenv.local.nix
 
 # direnv
 .direnv
+.kiro/

Makefile

@@ -56,10 +56,12 @@ pre-provision:
 
 .PHONY: create-infrastructure
 create-infrastructure:
+	aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws
 	bash hack/create-infrastructure.sh $(environment) $(cluster)
 
 .PHONY: destroy-infrastructure
 destroy-infrastructure:
+	aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws
 	bash hack/destroy-infrastructure.sh $(environment) $(cluster)
 
 .PHONY: deploy-ide

hack/create-infrastructure.sh

@@ -40,6 +40,8 @@ else
   echo "Auto mode cluster ${EKS_CLUSTER_AUTO_NAME} already exists"
 fi
 
-for pid in "${pids[@]}"; do
-  wait "$pid" || exit 1
-done
+if [ ${#pids[@]} -gt 0 ]; then
+  for pid in "${pids[@]}"; do
+    wait "$pid" || exit 1
+  done
+fi

manifests/modules/exposing/gateway-api/.workshop/cleanup.sh

@@ -0,0 +1,38 @@
+#!/bin/bash
+
+set -e
+
+# Delete Gateway API resources BEFORE uninstalling the controller
+# so the LBC can clean up the ALB and target groups
+if kubectl api-resources --api-group=gateway.networking.k8s.io -o name 2>/dev/null | grep -q httproute; then
+  kubectl delete httproute --all -A --ignore-not-found
+  kubectl delete gateway --all -A --ignore-not-found --wait=false
+  kubectl delete gatewayclass --all --ignore-not-found --wait=false
+fi
+
+# Delete AWS LBC Gateway CRDs resources
+if kubectl api-resources --api-group=gateway.k8s.aws -o name 2>/dev/null | grep -q targetgroupconfiguration; then
+  kubectl delete targetgroupconfiguration --all -A --ignore-not-found
+  kubectl delete loadbalancerconfiguration --all -A --ignore-not-found
+  kubectl delete listenerruleconfiguration --all -A --ignore-not-found
+fi
+
+# Wait for Gateways to be fully removed (finalizers cleared by LBC)
+echo "Waiting for Gateway resources to be cleaned up..."
+timeout 120 bash -c 'while kubectl get gateway -A 2>/dev/null | grep -q .; do sleep 5; done' || true
+
+# Force-remove finalizers if still stuck
+for gw in $(kubectl get gateway -A -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}{"\n"}{end}' 2>/dev/null); do
+  ns=$(echo $gw | cut -d/ -f1)
+  name=$(echo $gw | cut -d/ -f2)
+  kubectl patch gateway $name -n $ns --type=merge -p '{"metadata":{"finalizers":[]}}' 2>/dev/null || true
+done
+kubectl delete gateway --all -A --ignore-not-found 2>/dev/null || true
+kubectl delete gatewayclass --all --ignore-not-found 2>/dev/null || true
+
+# Now uninstall the controllers
+uninstall-helm-chart aws-load-balancer-controller kube-system
+
+# Clean up CRDs
+kubectl delete -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/refs/heads/main/config/crd/gateway/gateway-crds.yaml --ignore-not-found 2>/dev/null || true
+kubectl delete -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.0/standard-install.yaml --ignore-not-found 2>/dev/null || true

manifests/modules/exposing/gateway-api/.workshop/terraform/main.tf

@@ -0,0 +1,33 @@
+resource "terraform_data" "gateway_api_crds" {
+  provisioner "local-exec" {
+    command = "kubectl apply --server-side=true -f https://github.com/kubernetes-sigs/gateway-api/releases/download/${var.gateway_api_version}/standard-install.yaml"
+  }
+}
+
+resource "terraform_data" "lbc_gateway_crds" {
+  provisioner "local-exec" {
+    command = "kubectl apply -f https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/refs/heads/main/config/crd/gateway/gateway-crds.yaml"
+  }
+
+  depends_on = [terraform_data.gateway_api_crds]
+}
+
+module "eks_blueprints_addons" {
+  source  = "aws-ia/eks-blueprints-addons/aws"
+  version = "1.23.0"
+
+  cluster_name      = var.addon_context.eks_cluster_id
+  cluster_endpoint  = var.addon_context.aws_eks_cluster_endpoint
+  cluster_version   = var.eks_cluster_version
+  oidc_provider_arn = var.addon_context.eks_oidc_provider_arn
+
+  enable_aws_load_balancer_controller = true
+  aws_load_balancer_controller = {
+    role_name   = "${var.addon_context.eks_cluster_id}-alb-controller"
+    policy_name = "${var.addon_context.eks_cluster_id}-alb-controller"
+  }
+
+  create_kubernetes_resources = false
+
+  observability_tag = null
+}

manifests/modules/exposing/gateway-api/.workshop/terraform/outputs.tf

@@ -0,0 +1,7 @@
+output "environment_variables" {
+  description = "Environment variables to be added to the IDE shell"
+  value = {
+    LBC_CHART_VERSION = var.load_balancer_controller_chart_version
+    LBC_ROLE_ARN      = module.eks_blueprints_addons.aws_load_balancer_controller.iam_role_arn
+  }
+}

manifests/modules/exposing/gateway-api/.workshop/terraform/vars.tf

@@ -0,0 +1,54 @@
+# tflint-ignore: terraform_unused_declarations
+variable "eks_cluster_id" {
+  description = "EKS cluster name"
+  type        = string
+}
+
+# tflint-ignore: terraform_unused_declarations
+variable "eks_cluster_version" {
+  description = "EKS cluster version"
+  type        = string
+}
+
+# tflint-ignore: terraform_unused_declarations
+variable "cluster_security_group_id" {
+  description = "EKS cluster security group ID"
+  type        = any
+}
+
+# tflint-ignore: terraform_unused_declarations
+variable "addon_context" {
+  description = "Addon context that can be passed directly to blueprints addon modules"
+  type        = any
+}
+
+# tflint-ignore: terraform_unused_declarations
+variable "tags" {
+  description = "Tags to apply to AWS resources"
+  type        = any
+}
+
+# tflint-ignore: terraform_unused_declarations
+variable "resources_precreated" {
+  description = "Have expensive resources been created already"
+  type        = bool
+}
+
+variable "load_balancer_controller_chart_version" {
+  description = "The chart version of aws-load-balancer-controller to use"
+  type        = string
+  # renovate-helm: depName=aws-load-balancer-controller
+  default = "3.3.0"
+}
+
+# tflint-ignore: terraform_unused_declarations
+variable "inbound_cidrs" {
+  description = "CIDR range to allowlist for inbound traffic"
+  type        = string
+}
+
+variable "gateway_api_version" {
+  description = "The version of gateway-api CRDs to install"
+  type        = string
+  default     = "v1.2.0"
+}

manifests/modules/exposing/gateway-api/canary/deployment-ui-v2.yaml

@@ -0,0 +1,31 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ui-v2
+  namespace: ui
+  labels:
+    app.kubernetes.io/name: ui
+    app.kubernetes.io/version: v2
+    app.kubernetes.io/component: service
+    app.kubernetes.io/created-by: eks-workshop
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: ui
+      app.kubernetes.io/version: v2
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: ui
+        app.kubernetes.io/version: v2
+    spec:
+      containers:
+        - name: ui
+          image: public.ecr.aws/aws-containers/retail-store-sample-ui:1.2.1
+          ports:
+            - containerPort: 8080
+              protocol: TCP
+          env:
+            - name: RETAIL_UI_THEME
+              value: "orange"

manifests/modules/exposing/gateway-api/canary/httproute-canary-0-100.yaml

@@ -0,0 +1,21 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: ui-route
+  namespace: ui
+spec:
+  parentRefs:
+    - name: retail-store-gateway
+      namespace: ui
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: ui
+          port: 80
+          weight: 0
+        - name: ui-v2
+          port: 8080
+          weight: 100

manifests/modules/exposing/gateway-api/canary/httproute-canary-50-50.yaml

@@ -0,0 +1,21 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: ui-route
+  namespace: ui
+spec:
+  parentRefs:
+    - name: retail-store-gateway
+      namespace: ui
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: ui
+          port: 80
+          weight: 50
+        - name: ui-v2
+          port: 8080
+          weight: 50