License Service: Manually enabling the use of Gateway API as a substitute of the Ingress NGINX

Steps

1. Deploy Gateway API with Envoy Gateway.
   1. Install Gateway API CRDs. For more information, see: Getting started with Gateway API.
   2. Install Envoy Gateway from OCI registry, for example by using Helm. See the gateway repository on the Envoy Proxy github project. 
      
      Note: If you use the Helm installation, you can skip the CRDs installation during the Envoy deployment because you already deployed CRDs in step 1. You can use the --skip-crds parameter, for example in the Helm execution command. 
      
      For information about other installation options, see: Installation.

2. Create the default GatewayClass on the cluster. Use 'ibm-licensing' as the Envoy name.

   cat <<EOF | kubectl apply -f -
   apiVersion: gateway.networking.k8s.io/v1
   kind: GatewayClass
   metadata:
     name: ibm-licensing
   spec:
     controllerName: gateway.envoyproxy.io/gatewayclass-controller
   EOF

3. Create a ConfigMap for BackendTLSPolicy. 

   By default, BackendTLSPolicy expects the certificate to be present under the ca.crt key. However, in the existing ConfigMap, the certificate is stored under the crt.pem key.

   Create a copy of the new 'ibm-licensing-upload-config' ConfigMap and call it 'ibm-licensing-gateway-api-config'. The new map should contain the certificate under the required ca.crt key.

   LIC_NS="ibm-licensing"
   
   kubectl get configmap ibm-licensing-upload-config -n "$LIC_NS" -o yaml 2>/dev/null | \
     awk '/crt.pem:/{flag=1; next} /^[^ ]/{flag=0} flag{print}' | \
     sed 's/^[[:space:]]*//' | \
     kubectl create configmap ibm-licensing-gateway-api-config -n "$LIC_NS" \
       --from-file=ca.crt=/dev/stdin \
       --dry-run=client -o yaml | kubectl apply -f -
   
   echo "Verifying CA certificate ConfigMap..."
   kubectl get configmap ibm-licensing-gateway-api-config -n ibm-licensing -o jsonpath='{.data.ca\.crt}' 

4. Deploy Gateway, HTTPRoute, and BackendTLSPolicy for License Service. Use the following YAMLs to deploy the new resources. 
   Note: The examples use the default namespace ('ibm-licensing'). If License Service is in a different namespace, adjust namespace definition in the YAML examples.

   1. Deploy Gateway deployment. 
      Note: Adapt the port numbers in the YAML example to the values that you prefer using for external communication.

      cat <<EOF | kubectl apply -f -
      apiVersion: gateway.networking.k8s.io/v1
      kind: Gateway
      metadata:
        name: ibm-licensing-service-gateway
        namespace: ibm-licensing
      spec:
        gatewayClassName: ibm-licensing # must be the same as the one in the GatewayClass
        listeners:
          - name: http
            protocol: HTTP
            port: 80
            allowedRoutes:
              namespaces:
                from: All
          - name: https
            protocol: HTTPS
            port: 8080
            tls:
              mode: Terminate
              certificateRefs:
              - kind: Secret
                name: ibm-license-service-cert-internal
      EOF

   2. Deploy HTTPRoute.

      cat <<EOF | kubectl apply -f -
      apiVersion: gateway.networking.k8s.io/v1
      kind: HTTPRoute
      metadata:
        name: ibm-licensing-route
        namespace: ibm-licensing
      spec:
        # Attach to your existing Gateway (fill in the actual names)
        parentRefs:
          - name: ibm-licensing-service-gateway
            namespace: ibm-licensing
            # Optionally pin to HTTPS listener:
            # sectionName: https
        rules:
          - matches:
              - path:
                  type: PathPrefix
                  value: /ibm-licensing-service-instance
            filters:
              - type: URLRewrite
                urlRewrite:
                  path:
                    type: ReplacePrefixMatch
                    replacePrefixMatch: /
            backendRefs:
              - kind: Service
                name: ibm-licensing-service-instance
                port: 8080
      EOF

   3. Deploy BackendTLSPolicy.

      cat <<EOF | kubectl apply -f -
      apiVersion: gateway.networking.k8s.io/v1
      kind: BackendTLSPolicy
      metadata:
        name: licensing-backend-tls
        namespace: ibm-licensing
      spec:
        targetRefs:
        - group: ""
          kind: Service
          name: ibm-licensing-service-instance
        validation:
          hostname: ibm-licensing-service-instance.ibm-licensing.svc.cluster.local
          caCertificateRefs:
          - group: ""
            kind: ConfigMap
            name: ibm-licensing-gateway-api-config
      EOF

5. Validate the installation. Check whether:

   - A new namespace for Envoy (for example, 'envoy-gateway-system') with GatewayClass is created. For other validation points, see: Testing the configuration.

   - Gateway, HTTPRoute, and BackendTLSPolicy exist. 

6. Retrieve the new host name. To retrieve the new host name from the Gateway created in the 'ibm-licensing' namespace, run the following command.

   LIC_NS="ibm-licensing"
   kubectl get gateway ibm-licensing-service-gateway -n "$LIC_NS" -o jsonpath='{.status.addresses[?(@.type=="Hostname")].value}{"\n"}'

7. Optional: Delete the old ingress-nginx controller. Perform this step only if the controller is not used by other applications.

   1. If Helm was used to install the ingress-nginx controller, use the following command:

      helm uninstall ingress-nginx --namespace ingress-nginx
      kubectl delete namespace ingress-nginx

      Alternatively, delete the existing resources from the ingress-nginx namespace. Then, delete the namespace.

   2. Test again whether the route from step 6 is working.