One Size Doesn’t Fit All: Adding Org-Specific Gateway API Extensions with Envoy Gateway
Talkat EnvoyCon North America 2025 · on Monday, 2025-11-10· at 09:10· Building B | Level 4 | B406b-407·
summary
Shows how to write an extension server (gRPC binary) in Go that watches a Kubernetes CRD (custom backend MTLS policy), performs two concrete XDS mutations—add a hard‑coded Spire agent cluster and inject SDS config into backend clusters—and deploys it to k8s. Envoy Gateway calls the configured hooks, the extension parses policy context, mutates clusters to fetch SVID via Spire over a UDS, and verification uses Envoy config‑dump and a curl test that shows the peer certificate.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:47Envoy Gateway extensibility
- 3:34Gateway API features
- 4:16Control plane extensibility
- 6:03Extension server use cases
- 7:25Extension server concepts
- 11:56Demo setup
- 15:32Custom policy implementation
- 17:18Configuring extension server
- 19:04Building extension server
- 22:14Deploying extension server
- 23:38End-to-end demo verification
- 24:21Resources and closing
- 24:44Q&A
related talks
32mOne Size Doesn’t Fit All: Adding Org-Specific Gateway API Extensions with Envoy Gateway
33mEnvoy Gateway Project Update
26mSecuring the Gateway: A Deep Dive Into Envoy Gateway's Advanced Security Pol...
06mGet To Where You're Going With Kgateway
03h 18mHands-On with an Envoy API Gateway, Now with GraphQL!
31mBehind the Scenes of Building a Gateway API Dataplane...
21mDeep Dive: Envoy
21mExposing gRPC With Confidence: A Kubernetes-First API Gateway Approach