Version:

Expose workloads in multiple Namespaces with a single APIRule definition

This tutorial shows how to expose service endpoints in multiple Namespaces using API Gateway Controller.

CAUTION: Exposing a workload to the outside world causes a potential security vulnerability, so tread carefully. In a production environment, secure the workload you expose with OAuth2 or JWT.

Prerequisites

Create a sample HttpBin service deployment and a sample Function in the separate Namespaces:

Create a Namespace for the HttpBin service and export its value as an environment variable. Run:

Click to copy

export NAMESPACE_HTTPBIN={NAMESPACE_HTTPBIN}
kubectl create ns $NAMESPACE_HTTPBIN
kubectl label namespace $NAMESPACE_HTTPBIN istio-injection=enabled --overwrite

Create a different Namespace for the Function service and export its value as an environment variable. Run:

Click to copy

export NAMESPACE_FUNCTION={NAMESPACE_FUNCTION}
kubectl create ns $NAMESPACE_FUNCTION
kubectl label namespace $NAMESPACE_FUNCTION istio-injection=enabled --overwrite

Deploy an instance of the HttpBin service in its Namespace using the sample code:

Click to copy

kubectl -n $NAMESPACE_HTTPBIN create -f https://raw.githubusercontent.com/istio/istio/master/samples/httpbin/httpbin.yaml

Create a Function in its Namespace using the sample code:

Click to copy

kubectl -n $NAMESPACE_FUNCTION apply -f https://raw.githubusercontent.com/kyma-project/kyma/main/docs/03-tutorials/assets/function.yaml

Create a Namespace for the Gateway and APIRule CRs and export its value as the environment variable. Run:

Click to copy

export NAMESPACE={NAMESPACE}
kubectl create ns $NAMESPACE
kubectl label namespace $NAMESPACE istio-injection=enabled --overwrite

Depending on whether you use your custom domain or a Kyma domain, export the necessary values as environment variables:

Custom domain
Kyma domain

Click to copy

export DOMAIN_TO_EXPOSE_WORKLOADS={DOMAIN_NAME}
export GATEWAY=$NAMESPACE/httpbin-gateway

Expose and access your workloads in multiple Namespaces

Expose the HttpBin and Function services in their respective Namespaces by creating an APIRule CR in its own Namespace. Run:

Click to copy

cat <<EOF | kubectl apply -f -
apiVersion: gateway.kyma-project.io/v1beta1
kind: APIRule
metadata:
  name: httpbin-and-function
  namespace: $NAMESPACE
spec:
  host: httpbin-and-function.$DOMAIN_TO_EXPOSE_WORKLOADS
  gateway: $GATEWAY
  rules:
    - path: /headers
      methods: ["GET"]
      service:
        name: httpbin
        namespace: $NAMESPACE_HTTPBIN
        port: 8000
      accessStrategies:
        - handler: noop
      mutators:
        - handler: noop
    - path: /function
      methods: ["GET"]
      service:
        name: function
        namespace: $NAMESPACE_FUNCTION
        port: 80
      accessStrategies:
        - handler: noop
      mutators:
        - handler: noop
EOF

NOTE: If you are running Kyma on k3d, add httpbin.kyma.local to the entry with k3d IP in your system's /etc/hosts file.

Call the HttpBin endpoint by sending a GET request to the HttpBin service:
Click to copy
```
curl -ik -X GET https://httpbin-and-function.$DOMAIN_TO_EXPOSE_WORKLOADS/headers
```
If successful, the call returns the code 200 OK response.
Call the Function endpoint by sending a GET request to the Function service:
Click to copy
```
curl -ik -X GET https://httpbin-and-function.$DOMAIN_TO_EXPOSE_WORKLOADS/function
```
If successful, the call returns the code 200 OK response.