Gateway API on Maxime Moreillon

Exposing Envoy Gateway on ports 80 and 443 with hostPort

Sun, 20 Sep 2026 00:00:00 +0900

In my article on migrating to Envoy Gateway, I exposed Envoy through a NodePort service and pointed the router’s port-forwards at the assigned ports, as a NodePort cannot use the standard HTTP and HTTPS ports. Accessing apps directly on the local LAN, however, then requires specifying a non-standard port in the URL. On a single-node homelab cluster, hostPort avoids this: it binds a container port directly on the node’s network interface, so the node answers on ports 80 and 443 with nothing in between. Unlike hostNetwork, the pod keeps its own network namespace.

Retiring Oauth2-Proxy in favor of Envoy Gateway

Fri, 18 Sep 2026 00:00:00 +0900

Oauth2-Proxy is a convenient solution to add authentication with OIDC on applications that do not ship with it natively. It integrates well with the Ingress NGINX controller but the latter is now deprecated.

A replacement for Ingress NGINX is the Gateway API, a newer Kubernetes standard for traffic routing with several available implementations — Envoy Gateway, Istio, Cilium, and NGINX Gateway Fabric among them. This article uses Envoy Gateway. Since Envoy Gateway provides its own OIDC authentication, Oauth2-Proxy is no longer needed for this purpose.

Migrating from Ingress NGINX Controller to Envoy Gateway

Thu, 17 Sep 2026 00:00:00 +0900

As the Ingress NGINX controller is now deprecated, replacing it with the Gateway API is in order. The Gateway API is a newer Kubernetes standard for traffic routing with several available implementations — Envoy Gateway, Istio, Cilium, and NGINX Gateway Fabric among them. Here, I have chosen Envoy Gateway as it is backed by the CNCF and provides all needed features, including native OIDC authentication, which removes the need for Oauth2-Proxy (see this article).