Mulesoft Runtime Fabric: How to setup Envoy Gateway

1. Overview

This document outlines the steps to configure Envoy Gateway (using the Kubernetes Gateway API) as the ingress controller for a MuleSoft Runtime Fabric (RTF) cluster.

The configuration fulfills the following requirements:

• Supports both HTTPS (Port 443) and HTTP (Port 80) traffic as explicitly separate endpoints.
• Listens on the apex domain (envoygateway.techworld360.io) and wildcard subdomain (*.envoygateway.techworld360.io).
• Terminates TLS at the Gateway.
• Automatically strips the application base path (configured in Anypoint Platform) and routes the remainder of the URL to the root (/) of the Mule app pod, strictly for the apex domain (envoygateway.techworld360.io).

2. Prerequisites

• A running Kubernetes cluster with MuleSoft RTF installed.
• kubectl CLI configured with cluster admin access.
• helm CLI installed.
• Your TLS certificate (fullchain.crt) and private key (private.key) for your domains

3. Installation & Setup

Step 3.1: Install Envoy Gateway

Install the Envoy Gateway controller using Helm. This provisions the necessary Gateway API Custom Resource Definitions (CRDs) and the Envoy control plane.

helm install eg oci://docker.io/envoyproxy/gateway-helm \
  --version v1.7.0 \
  -n envoy-gateway-system \
  --create-namespace

Wait for the deployment to become available:

kubectl wait --timeout=5m -n envoy-gateway-system deployment/envoy-gateway --for=condition=Available

Step 3.2: Create the GatewayClass

Link your Gateway resources to the Envoy controller.

# gateway-class.yaml
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
name: envoy-gateway
spec:
controllerName: gateway.envoyproxy.io/gatewayclass-controller

Apply it:

kubectl apply -f gateway-class.yaml

Step 3.3: Configure TLS Certificate Secret

Store your TLS certificates in the same namespace where the Gateway will reside (envoy-gateway-system).

kubectl create secret tls envoy-tls-secret \
  --namespace envoy-gateway-system \
  --cert=path/to/fullchain.crt \
  --key=path/to/private.key

Step 3.4: Deploy the Gateway

Create the Gateway resource to listen on ports 80 and 443. Setting allowedRoutes.namespaces.from: All allows the Mule apps in the rtf namespace to attach HTTPRoute configurations to this Gateway.

# gateway.yaml
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: rtf-envoy-gateway
  namespace: envoy-gateway-system
spec:
  gatewayClassName: envoy-gateway
  listeners:
    # --- HTTPS Listeners (Port 443) ---
    - name: https-wildcard
      protocol: HTTPS
      port: 443
      hostname: "*.envoygateway.techworld360.io"
      allowedRoutes:
        namespaces:
          from: All
      tls:
        mode: Terminate
        certificateRefs:
          - name: envoy-tls-secret
            kind: Secret

    - name: https-root
      protocol: HTTPS
      port: 443
      hostname: "envoygateway.techworld360.io"
      allowedRoutes:
        namespaces:
          from: All
      tls:
        mode: Terminate
        certificateRefs:
          - name: envoy-tls-secret
            kind: Secret

    # --- HTTP Listeners (Port 80) ---
    - name: http-wildcard
      protocol: HTTP
      port: 80
      hostname: "*.envoygateway.techworld360.io"
      allowedRoutes:
        namespaces:
          from: All
    - name: http-root
      protocol: HTTP
      port: 80
      hostname: "envoygateway.techworld360.io"
      allowedRoutes:
        namespaces:
          from: All

Apply it:

kubectl apply -f gateway.yaml

4. MuleSoft RTF Configuration (HTTPRouteTemplates)

MuleSoft RTF uses HTTPRouteTemplate CRDs to dynamically generate HTTPRoute manifests when developers deploy applications from Anypoint Runtime Manager.

Get techworld360’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

To ensure Anypoint Platform handles HTTP and HTTPS separately for both the apex and wildcard domains, we deploy four distinct templates.

Template 1: HTTPS Apex Domain WITH Path Rewrite

Triggered when https://envoygateway.techworld360.io is selected. Uses ReplacePrefixMatch to strip the Anypoint base path ({{ .Path }}) from the request, forwarding the remainder to the root of the pod.

# rtf-template-https-root.yaml
apiVersion: rtf.mulesoft.com/v1
kind: HTTPRouteTemplate
metadata:
  name: envoy-template-https-root-rewrite
  namespace: rtf
spec:
  baseEndpoints:
    - https://envoygateway.techworld360.io
  resources:
    - |
      apiVersion: gateway.networking.k8s.io/v1
      kind: HTTPRoute
      metadata:
        name: {{ .ResourceName }}
        namespace: {{ .Namespace }}
      spec:
        parentRefs:
          - kind: Gateway
            name: rtf-envoy-gateway
            namespace: envoy-gateway-system
        hostnames:
          - {{ .Host }}
        rules:
          - matches:
              - path:
                  type: PathPrefix
                  value: {{ .Path }}
            filters:
              - type: URLRewrite
                urlRewrite:
                  path:
                    type: ReplacePrefixMatch
                    replacePrefixMatch: /
            backendRefs:
              - name: {{ .Service.Name }}
                port: {{ .Service.Port }}

Template 2: HTTP Apex Domain WITH Path Rewrite

Triggered when http://envoygateway.techworld360.io is selected. Same rewrite logic as HTTPS, but maps explicitly to the unencrypted endpoint in Anypoint.

# rtf-template-http-root.yaml
apiVersion: rtf.mulesoft.com/v1
kind: HTTPRouteTemplate
metadata:
  name: envoy-template-http-root-rewrite
  namespace: rtf
spec:
  baseEndpoints:
    - http://envoygateway.techworld360.io
  resources:
    - |
      apiVersion: gateway.networking.k8s.io/v1
      kind: HTTPRoute
      metadata:
        name: {{ .ResourceName }}
        namespace: {{ .Namespace }}
      spec:
        parentRefs:
          - kind: Gateway
            name: rtf-envoy-gateway
            namespace: envoy-gateway-system
        hostnames:
          - {{ .Host }}
        rules:
          - matches:
              - path:
                  type: PathPrefix
                  value: {{ .Path }}
            filters:
              - type: URLRewrite
                urlRewrite:
                  path:
                    type: ReplacePrefixMatch
                    replacePrefixMatch: /
            backendRefs:
              - name: {{ .Service.Name }}
                port: {{ .Service.Port }}

Template 3: HTTPS Wildcard Domain WITHOUT Rewrite

Triggered when https://*.envoygateway.techworld360.io is selected. Passes the path exactly as-is to the Mule application.

# rtf-template-https-wildcard.yaml
apiVersion: rtf.mulesoft.com/v1
kind: HTTPRouteTemplate
metadata:
  name: envoy-template-https-wildcard-norewrite
  namespace: rtf
spec:
  baseEndpoints:
    - https://*.envoygateway.techworld360.io
  resources:
    - |
      apiVersion: gateway.networking.k8s.io/v1
      kind: HTTPRoute
      metadata:
        name: {{ .ResourceName }}
        namespace: {{ .Namespace }}
      spec:
        parentRefs:
          - kind: Gateway
            name: rtf-envoy-gateway
            namespace: envoy-gateway-system
        hostnames:
          - {{ .Host }}
        rules:
          - matches:
              - path:
                  type: PathPrefix
                  value: {{ .Path }}
            backendRefs:
              - name: {{ .Service.Name }}
                port: {{ .Service.Port }}

Template 4: HTTP Wildcard Domain WITHOUT Rewrite

Triggered when http://*.envoygateway.techworld360.io is selected. Passes the unencrypted path exactly as-is to the Mule application.

# rtf-template-http-wildcard.yaml
apiVersion: rtf.mulesoft.com/v1
kind: HTTPRouteTemplate
metadata:
  name: envoy-template-http-wildcard-norewrite
  namespace: rtf
spec:
  baseEndpoints:
    - http://*.envoygateway.techworld360.io
  resources:
    - |
      apiVersion: gateway.networking.k8s.io/v1
      kind: HTTPRoute
      metadata:
        name: {{ .ResourceName }}
        namespace: {{ .Namespace }}
      spec:
        parentRefs:
          - kind: Gateway
            name: rtf-envoy-gateway
            namespace: envoy-gateway-system
        hostnames:
          - {{ .Host }}
        rules:
          - matches:
              - path:
                  type: PathPrefix
                  value: {{ .Path }}
            backendRefs:
              - name: {{ .Service.Name }}
                port: {{ .Service.Port }}

5. Grant RTF Permissions

# rtf-rbac.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: rtf-manage-gateway-httproutes
rules:
  - apiGroups:
      - gateway.networking.k8s.io
    resources:
      - httproutes
    verbs:
      - '*'
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: rtf-manage-gateway-httproutes-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: rtf-manage-gateway-httproutes
subjects:
  - kind: ServiceAccount
    name: rtf-agent
    namespace: rtf

6. Conclusion

Once this above setup is done you can deploy your application from the Anypoint Control Plane Page under Runtime Manager.

For any Clarifications Please reach out via below medium, but expect delay in response

Discord Server: https://discord.gg/9Z8KfyqX

Email: techworld360@hotmail.com