►
From YouTube: Hoot [Episode #12] API Gateways Architecture and Gloo
Description
Hoot Series: Networking at the Edge - Proxies, Ingress and API Gateways
How we need to handle application networking for Kubernetes and cloud-native platforms and how we solve them have evolved. In the “Get to Know Service Mesh” series, we looked at how service mesh technology solves some of these problems. In this series, we explore proxies, ingress, API gateways, and how they solve challenges at the edge and how they complement a service mesh to provide a holistic solution.
Join us online to learn more about the terminology and technologies used to facilitate and manage incoming traffic from external clients and end users into your backend application services. We will look at ingress solutions like NGINX, HA Proxy, and Envoy Proxy as well as API Gateways such as Kong, Ambassador, Gloo and more.
Episodes in this series:
* All About Proxies: Get the facts - Comparing Proxies, Ingress vs. API Gateway vs. Service Mesh
* Datawire Ambassador
* Kong
* Containous Traefik
* VMware Contour
* Solo.io Gloo
Interested in having our crew unbox another API gateway or Ingress Controller or have a question? DM us at https://slack.solo.io or https://twitter.com/soloio_inc.
Learn more about API gateways here https://www.solo.io/solutions/api-gateway/
A
We
started
with
looking
at
service
mesh
sort
of
an
introduction
to
some
different
service
mesh
implementations,
and
then
we
actually
did
a
wrap-up
of
the
of
the
various
different
service
questions
that
exist
and
kind
of
compared
and
contrast
and
gave
you
pointers
for
how
to
evaluate
them
and
so
forth.
So
go
back
and
check
some
of
those
previous
episodes.
A
A
So
we
did
a
general
kind
of
what
are
proxies.
What
are
what
is
in
grass
and
and
what
is
api
gateway
and
that
kind
of
thing,
and
then
we
looked
at
technologies
like
ambassador,
like
kong,
trafic
contour,
and
today
we're
going
to
look
at
glue,
and
we
know
that
there's
been
some
there's
a
lot
of
demos
about
about
glue
and
the
documentation.
Does
a
really
good
job
of
walking
you
through,
let's
say
getting
started
so
forth?
You
click
on
getting
started
and
there's
it's
fairly
fairly
straightforward.
A
A
So
no
additional
databases
setting
up
expensive
cassandra
farms
and
all
this
other
stuff
it
integrates
directly
with
kubernetes
and
uses
the
kubernetes
custom
resource
definition.
Extension
points.
So
you
you
write
all
of
your
in
yaml
and
config.
That
looks
like
kubernetes
config
and
it's
built
on
envoy
proxy.
So
there's
a
important
thing
to
note
and
the
architecture
and
the
way
that
it
looks
and
what
it
is.
More
specifically
is
its
envoy.
A
A
Microservice
architecture
that
allows
traffic
to
come
in
and-
and
you
can,
you
can
direct
the
traffic
to
backend
services
and
api
gateway,
does
a
little
bit
more
api
gateway,
abstracts
away
the
details
of
what
the
implementation
services
actually
look
like
from
the
clients
that
call
it
ingress,
doesn't
really
do
this,
it's
sort
of
a
pass-through
now
to
be
able
to
do
that.
You
need
things
like
transformation.
A
A
So
we
have
added
things
like
caching,
like
transformation,
so
to
be
able
to
transform
messages
as
they
go
through
the
gateway
we've
added
security
features
like
data
loss
prevention,
web
application,
firewalling
and
so
forth,
but
so
we
built
that
into
the
proxy
itself
and
then
glue
the
control
plane.
So
envoy
needs
a
control
plane
to
be
able
to
drive
its
configuration.
A
The
control
plane,
then,
is
what
the
user
interacts
with
the
user
gives
it
configurations
the
user
sets.
It
up,
sets
up
the
control
plane
to
know
how
to
talk
to
different
backend
service
registries,
so
that
the
the
glue
control
point
can
be
smart
enough
to
know
how
to
how
to
tell
the
proxy
how
to
do
service
discovery
and
and
so
forth.
So
it
plays
the
intermediary
between
you,
the
user
and
an
api,
that's
comfortable
for
you
and
the
the
lower
level
proxy
and
configuration
of
that
proxy.
A
So
we're
going
to
take
a
look
at
you
know:
come
over
here,
go
to
glue.solo.io
or
docs
solo
blue,
slash
latest.
You
can
see
all
the
different
versions,
previous
versions
of
glue.
Now
this
is
open
source
that
we're
looking
at
at
solo.
We
do
sell
the
enterprise
version
too,
and
that
includes
some
more
of
the
security
components,
but
just
getting
started
with
open
source
is
fairly
simple.
This
will
install
a
the
glue
ctl
binary.
Now
the
glue
see
tail
binary
is
sort
of
a
convenience
tool
for
installing
it
managing
debugging
it.
A
A
A
A
A
A
If
you
find
that
the
ingress
resource
is
too
limiting
like
a
lot
of
people,
do
then
I
would
suggest
just
just
use
the
gateway
and
then,
lastly,
you
can
install
it
with
you,
can
install
k
native
actually
with
glue
as
the
as
the
edge
gateway
swapped
in
for
istio.
So
you
don't
need
istio
to
run
all
of
the
k-native
serving
components
as
an
example.
So
let's
do
glue
and
install
we're
gonna
do
the
gateway,
so
we're
gonna
install
the
gateway
here
across
our
fingers.
A
This
is
live
demo
over
the
internet,
using
gke
as
our
as
a
back-end
cluster
here,
and
what
this
is
going
to
do
is
install
the
the
proxy,
the
envoy
proxy,
as
well
as
the
components
needed
to
run
the
control
plane.
So
if
we
come
back
to
here,
we
see
that
everything
was
installed
nicely
and
neatly,
and
if
we
do
get
our
namespace
see
everything
was
put
into
the
blue
namespace.
A
Video
do
names,
glue
system,
name
space.
Here
we
see
that
we
have
our
some
of
these
components.
Let's
switch
over
to
using
canines
canine
is
one
of
my
favorite
tools
here,
let's
just
look
into
the
cluster
a
little
bit
easier
and
so
a
couple
things
that
we
see.
First,
we
have
our
our
gateway
proxy.
This
is
envoy
if
we
actually,
shell
into
the
the
that
particular
pod
and
look
at
what's
running,
we
see
indeed
envoy
is,
is
running
and
an
envoy
has
a
bootstrap
config
that
basically
points
it
to
the
control.
A
Plane
says:
hey,
go
look
at
this,
this
control
plane
here.
So
that's
all!
That's
all
good!
The
second
thing
we
have
is
a
couple
different
components
that
make
up
the
control
plane.
So
if
we
come
over
here
and
take
a
look
at
a
different
diagram,
we
should
see
that
the
architecture
here
is.
We
need
a
xds
server.
So
this
is
the
config
api.
A
That
angle
uses
a
xds
server
that
sends
configuration
to
onpoint
configures
it
that's
what
this
glue
component
is
here,
but
then
we
also
have
some
other
components
that
kind
of
cooperate
with
the
with
with
glue
so
glue
serves
the
final
envoy
config.
But
we
also
do
things
like
discovery,
so
we
can
go
out
and
do
proactive
service
discovery.
We
can
find
services
that
live
in
our
environment,
services
that
might
be
running
on
kubernetes
or
console
or
ec2
or
lambda
or
whatever.
A
So
the
discovery
component
takes
care
of
that,
and
then
the
gateway
component
takes
care
of
giving
us
a
a
little
higher
level.
More
ergonomic
api
for
driving
the
glue
api
gateway,
so
xds
serves
a
very
low
level
config
to
envoy,
but
the
gateway
component
gives
us
an
api
that
we'll
look
at
as
we
as
we
walk
through
this
demo.
Here
we
can
do
very
powerful
things
like
actually,
let's
just
let's
just
do
a
quick,
very
simple
demo
here.
A
A
But
you
can
also
point
it
to
console,
like
I
said,
to
lambdas
and
ec2
and
and
it's
pluggable,
so
if
you
don't
have
an
existing
plug-in
for
the
discovery
service,
you
can
write
your
own
and
discover
from
your
own
custom,
catalogs
and
so
forth.
So
we
found
these
different
upstreams
these
services
that
we
can
route
to,
that
that
we've
discovered
automatically
the
one
thing
to
point
out
is
that
glue
does
more
than
just
discover
the
host
and
import
endpoints.
A
A
A
A
A
A
We
can
see
that
the
pet
store
virtual
service,
which
is
backed
by
cr,
is
is
here,
and
if
we
look
at
the
yaml,
we
can
see
that
it
is
so
far
fairly
simple.
We've
just
displayed
or
just
defined
the
the
host
domains
that
we
should
watch
out
for
and
match
on
to
be
able
to
route
to
this
service
and
now,
let's
add
a
route
to
this
service
as
well,
and
we're
doing
this
by
using
the
glue,
ctl
command,
add
route.
A
A
So
what
if
we
want
to
change
how
we
expose
this
api
on
the
gateway
from
how
it's
actually
implemented
in
the
back
end?
So,
in
the
back
end,
we
saw
previously
that
if
we,
if
we
do
get
past-
and
we
want
to
get
one
by
id-
we
have
to
pass
it
in
as
a
context
path
parameter
right.
So
that's
how
we
call
it
on
the
back
end
on
on
the
on
the
edge.
A
Now
you
can
be
very
fine-grained
about
what
those
transformations
look
like,
and
so
you
can
edit
that
all
yourself
to
make
make
it
look
differently,
but
you
can
see
here's
an
example
of
using
the
glue
gateway
for
for
this
purpose.
Now
one
of
the
one
of
the
key
differentiators
of
of
glue
from
probably
some
of
the
other
other
gateways
that
we
saw
is
that
glute
was
built
very
cloud
native
right
and
in
this
idea
that
there's
it's
a
distributed
system
that
some
components
are
responsible
for
certain
things
like
maybe
handling
the
traffic.
A
Some
components
are
responsible
for
serving
configuration.
Some
components
are
responsible
for
interacting
with
the
rest
of
your
your
data
center,
all
right,
so
keeping
them
at
separate
components,
separately,
deployable
components
has
this
advantage
of
scale
of
security,
posture
of
performance
and
and
many
many
other
things
all
right.
One
of
the
things
that
which
isn't
the
same
for
some
of
the
other
proxies
we
looked
at
so,
for
example,
in
ambassador.
A
You
have
all
of
that
all
of
those
concerns
combined
and
down
into
a
single
container
and
that's
what
you
deploy
at
your
edge
right.
So
there's
drawbacks
to
that
in
terms
of
well.
If
you
try
to
scale
it
out,
you're
scaling
out
replicas,
so
you're
scaling
out
the
data
plane
and
the
control
plane
exactly
the
same
right
one
to
one.
So
you
don't
have
that
delineation
between
responsibilities.
A
So
one
thing
I
do
want
to
point
out
is
that
we
can
deploy
glue
the
data
plane
and
the
control
plane
separately
and
highly
locked
down.
So
let's
take
a
look
at
if
we
come
over
here
to
the
glue
documentation
and
look
in
operations,
I'm
gonna
look
at
production
deployments.
This
is
how
you
would.
This
is
how
you
would
deploy
an
edge
gateway
in
in
kubernetes,
highly
locked
down
separated
from
the
control
plane.
So
the
first
thing
is
you
don't
want
the
edge
talking
to
kubernetes
at
all?
A
Fine,
so
don't
implement
it
like
that.
Don't
bundle
your
control
plane
as
a
monolith
inside
your
data
plane
right.
But
what,
if
you
so
glue,
doesn't
do
that
we
can
completely
remove
the
surface
account
token
or
any
tokens
mounted
in
into
the
pod,
so
that
not
only
does
it
not
talk,
but
it
doesn't
have
permissions
to
do
anything
like
that
right.
So
if
we
come
back
here
and
take
a
look
at
our
our
configs
themselves,
we
can
see
things
like.
A
A
We
have
kubernetes
mounting
the
default
service
account
token
here
that
allows
it
to
communicate
with
the
kubernetes
api,
depending
on
the
cluster
role
bindings
and
so
forth
that
you
that
you
implement.
We
don't
want
that
right.
Another
thing
that
we
don't
want
is
additional
security
context
privileges.
A
So
if
we
look
at
the
yaml
here
and
look
at
the
capabilities
we
have
net
bind
now
we
add
this
as
sort
of
a
default,
because
some
people
do
want
to
bind
their
glue
proxy
service
to
host
hosts
networking
on
their
on
their
nodes
and
so
just
for
user
experience.
Reason
we
have
that
in,
but
we
can
lock
all
that
stuff
down
and
glue
will
behave
perfectly
fine.
A
A
A
A
What
we're
going
to
do
is
disable
mounting
the
the
token
we're
also
going
to
disable
netbind.
We
don't
need
those
things
in
a
in
a
secure,
lockdown
deployment
of
glue,
so
we'll
do
install
gateway
values.
This
values
file
that
I
have
here
so
let's
install
it
and
then
we'll
take
a
quick
look
at
the
details
of
it.
A
There
we
have
it,
we
have
it
up,
let's
get
k9
is
going
back
again.
We
see
we
have
some
of
the
control
plane
components
coming
up
now,
the
gateway
proxy.
Let's
shell,
back
into
that,
let's
look
at
var,
slash,
run
secrets,
there's
no
secrets,
it
has
not
been
mounted.
Not
only
do
we
not
have
cluster
role
by
endings
to
be
able
to
talk
to
the
kubernetes,
we
don't
even
we
don't
even
deploy
the
or
mount
the
default
secrets
when
it
comes
to.
Let's
look
at
the
yaml,
the
security
context.
A
A
This
is
a
read-only
file
system,
there's
no
reading
and
writing
to
the
file
system.
Everything
is
is
completely
locked
down
and
the
control
plane
in
this
case
is
separately
deployed
from
the
data
plan.
We
can
scale
it
separately.
We
can
add
different
security
kind.
We
can
even
move
it
to
a
totally
different
name
space
if
we,
if
we
want
and
the
last
the
last
point
I
was
going
to
make-
is
that
that
glue
does
have.
Let's
go
back
to
this
thing.
A
A
A
A
All
right,
so
the
first
thing
we
see
is
that
our
the
overview
in
a
dashboard
that
we
have
here
shows
that
the
that
envoy
is
not
in
a
healthy
running
state,
and
that
is
that
is
fine,
because
we
don't
have
a.
We
don't
have
any
virtual
services.
So
basically,
if
we
don't
define
virtual
services,
another
security
minded
way
of
thinking
right.
A
So
if
you
don't
have
any
rules
defined
for
routing
in
your
api
gateway
that
don't
even
open
up
any
ports
and
alert
that
hey
we're
not
in
a
not
in
a
good
state,
but
this
is
something
you
should
look
at
for
a
reason:
we
don't
want
to
just
open
up
arbitrary
ports
and
have
them
vulnerable
without
having
having
any
any
routing
rules
there.
So,
let's
do
do
we
have
hey
yeah.
Let's
just
do
this:
let's
do.
A
A
A
A
A
You
can
do
basically,
you
know
there's
some
areas
where
we've
implemented
things
like
security
like
web
application,
firewalling
that
kind
of
stuff,
but
you
can
still
you
there's
nothing
locked
down
or
you
know,
limiting
of
the
open
source
project
in
in
any
way,
so
go
go!
Try
that
out
and
go
check
out
the
previous
previous
hoots
that
we've
done
on
the
different
api
gateways
and
and
service
mesh
and
there's
going
to
be
a
lot
more
to
come.
A
Like
I
said,
some
of
these
were
very
intro
level
talks
and
we're
just
going
to
continue
to
build
on
this
going
deeper
into
the,
but
the
networking
challenges,
especially
at
the
application
layer
for
for
modernizing
your
your
application
architecture
going
to
microservices
these
types
of
things
at
solo.
We
believe
envoy
is
a
very
powerful
foundation
to
those
frameworks,
but
envoy's
not
the
only
thing
out
there.
So
we're
going
to
we're
going
to
take
a
look
at
continuing
to
take
a
look
at
the
ecosystem
here.