xin

Kubernetes Gateway

xin-gateway is a combined Gateway API controller and data plane. It watches Gateway API resources and Kubernetes EndpointSlices, then serves accepted listeners in the same process.

Install and start

Install the upstream Gateway API standard-channel CRDs first. The xin chart does not install shared CRDs. Deploy the chart with one replica and give each accepted Gateway a routable address from the configured address pool.

helm upgrade --install xin-gateway deploy/helm/xin-gateway \
  --namespace xin-gateway --create-namespace

The beta supports Gateway API v1.2.1 standard resources: GatewayClass, Gateway, HTTPRoute, ReferenceGrant, Services, EndpointSlices, and TLS Secrets. Check the beta support matrix before relying on an extended feature.

Minimal route

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: edge
spec:
  gatewayClassName: xin
  listeners:
  - name: http
    protocol: HTTP
    port: 80
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: app
spec:
  parentRefs:
  - name: edge
  rules:
  - matches:
    - path: { type: PathPrefix, value: / }
    backendRefs:
    - name: app
      port: 8080

Operational behavior

  • Status is the readiness contract. Inspect Gateway and HTTPRoute conditions; unaccepted or unprogrammed listeners are not silently served.
  • EndpointSlice updates are in-place. A membership-only update refreshes the affected pools without rebuilding route matching or listener state.
  • Cross-namespace backends require ReferenceGrant. Without it, the route reports the rejected reference and is not programmed.
  • One replica is the beta topology. Lease election protects status writes, not listener high availability. Multiple data-plane replicas need distinct routable addresses and a deliberate traffic topology.

Troubleshooting

kubectl describe gateway edge
kubectl describe httproute app
kubectl get endpointslice -l kubernetes.io/service-name=app

Use the resource conditions first. They name invalid references, unsupported fields, unavailable addresses, and data-plane programming failures. The controller never treats a successful parse as proof that a listener was bound.