For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.

Additional configuration options for using kgateway as the ingress gateway in an Istio ambient mesh.

Review additional configuration options for using kgateway as the ingress gateway in an Istio ambient mesh.

Cluster draining weights

kgateway honors the solo.io/draining-weight annotation on east-west and remote peering gateways when routing ingress traffic to a multicluster ambient mesh. Previously, the draining weight was respected by ztunnel and waypoints for east-west traffic, but kgateway continued to send ingress traffic to a draining cluster, resulting in connection errors.

When a remote cluster’s east-west gateway is annotated with solo.io/draining-weight, kgateway adjusts the Envoy load balancing weights for that cluster’s endpoints on the ingress path:

Exclude ServiceEntries from discovery

You can exclude specific Istio ServiceEntry resources from the gateway’s backend and endpoint discovery by using Kubernetes label selectors. To enable this feature, set the serviceEntriesExclusionLabelSelectors Helm value to a list of selectors. Any ServiceEntry that matches a selector is ignored during the backend and endpoint discovery phase.

A ServiceEntry is excluded if it matches any entry in the list (OR condition). Within each entry, all matchLabels and matchExpressions conditions must hold for the ServiceEntry to be excluded (AND condition). Empty entries are rejected to prevent excluding all ServiceEntries.

The following example shows multiple matchLabel entries. ServiceEntries are excluded if they have both example.io/source: generated and example.io/source-kind: ExternalService labels (AND condition), or the env: staging label (OR condition).

serviceEntriesExclusionLabelSelectors:
  # Exclude entries that have both labels (AND within an entry)
  - matchLabels:
      example.io/source: generated
      example.io/source-kind: ExternalService
  # Also exclude entries in staging (OR across entries)
  - matchLabels:
      env: staging

Exclude WorkloadEntries from discovery

When a ServiceEntry has a workloadSelector, kgateway adds every WorkloadEntry with matching labels as an endpoint of that ServiceEntry, so that the gateway can route traffic to it.

Sometimes a WorkloadEntry that matches the selector is not a real backend. For example, it might represent the address of another gateway or proxy. To stop the gateway from sending traffic to it, exclude the WorkloadEntry from endpoint discovery.

To exclude WorkloadEntries, set the KGW_WORKLOAD_ENTRIES_EXCLUSION_LABELS environment variable on the kgateway control plane to a comma-separated list of label keys. By default, no WorkloadEntries are excluded. This setting applies only if the Istio integration is enabled.

controller:
  extraEnv:
    KGW_WORKLOAD_ENTRIES_EXCLUSION_LABELS: "example.io/source-kind,example.io/infrastructure"

Note the following behavior:

• A WorkloadEntry is excluded if it has any of the label keys that you list, regardless of the value of the label. For example, if you list the example.io/infrastructure key, a WorkloadEntry with the label example.io/infrastructure: "false" is also excluded.
• The label keys are checked in both the metadata.labels and the spec.labels fields of the WorkloadEntry.
• An excluded WorkloadEntry is not used as an endpoint for any ServiceEntry that the gateway discovers. The WorkloadEntry itself is not changed or deleted, so other components, such as Istio, can still use it.

To exclude entire ServiceEntry resources, or to match label values, use the serviceEntriesExclusionLabelSelectors Helm value instead.