cilium-gateway
Installation
SKILL.md
Cilium Gateway
Cilium v1.19.4 — Gateway API implementation for ingress traffic via per-node Envoy.
Overview
Cilium implements Gateway API v1.4.1 using per-node Envoy proxies with eBPF TPROXY interception. Supports GatewayClass, Gateway, HTTPRoute, GRPCRoute, TLSRoute, and ReferenceGrant. Host network mode exposes listeners directly on node IPs without a LoadBalancer Service. TLS termination, traffic splitting, and header modification all handled in Envoy.
CRDs Used
Gateway API (standard)
| CRD | Version | Purpose |
|---|---|---|
GatewayClass |
gateway.networking.k8s.io/v1 |
Class reference (parametersRef → CiliumGatewayClassConfig) |
Gateway |
gateway.networking.k8s.io/v1 |
Shared LB listener — hostname, TLS, ports |
HTTPRoute |
gateway.networking.k8s.io/v1 |
HTTP route rules — matches, filters, backends |
GRPCRoute |
gateway.networking.k8s.io/v1 |
gRPC route rules |
TLSRoute |
gateway.networking.k8s.io/v1alpha2 |
TLS passthrough routing by SNI (experimental) |
ReferenceGrant |
gateway.networking.k8s.io/v1beta1 |
Allow cross-namespace references (Secret, Service) |