APIGateway v1alpha1 proposal

[strekm]

Description

Create document (docs/contributor) that will describe proposed API to configure api-gateway manager. Responsibility of api-gateway manager will be:

• installation of api-gateway controller that manages APIRule CRD
• managing of gateway(s) - default kyma-gateway and in the future other gateways too
• managing certificates for above gateways
• managing domains for istio ingress gateway IP (including default kyma domain)
• installation of ORY oathkeeper (this component will not be a part of api-gateway in the future)
  Since ORY Hydra is deprecated and will be removed from Kyma in version 2.19, Hydra should not be a part of API proposal nor implementation.

Take into consideration api-gateway profile settings and overrides created for managed Kyma.

At this moment default Kyma domain is set up by Istio operator by annotating Istio ingress gateway service with gardener specific annotations. This responsibility will be passed to api-gateway module. instead of annotating ingress gateway service DNSEntry should be created. Users should be able to specify their domains for DNSEntry.

api-gateway module has strong dependency to Istio, Gardener DNS management and Gardener Certificates management.

ACs:

• APIGateway v1alpha1 proposal documented: spec and status
• proposal approved by @kyma-project/goat
• proposal approved by @pbochynski

Decision needed:

• should we expose ORY oathkeeper configuration -> any related configuration will not be exposed in api-gateway module API

Reasons

DoD:

• provide documentation
  - [ ] release notes and What's New updates for Kyma customers
  - [ ] provide unit tests
  - [ ] provide integration tests
  - [ ] test on production-like environment
  - [ ] verify resource limits
  - [ ] followup issue
  - [ ] create release and bump in kyma
  - [ ] PR reviewer will verify code coverage and evaluate if it is acceptable

Attachments

Proposal PR

• Create API-Gateway-CRD-proposal.md #481

[pbochynski]

Oathkeeper will be removed soon and can be already replaced by istio/envoy so I would not expose it to the user.