sugaf1204 opened a new issue, #2895: URL: https://github.com/apache/apisix-ingress-controller/issues/2895
### Description ### Description We run APISIX Ingress Controller on a multi-tenant cluster. With Ingress, each team could manage its own hostnames and TLS certificates in its own namespace. With Gateway API on APISIX, we can't find a good way to keep this. With a shared Gateway, the platform team has to add a listener every time a team adds a hostname or certificate. Other implementations let each team run its own Gateway in its own namespace, e.g. [Envoy Gateway](https://gateway.envoyproxy.io/docs/tasks/operations/deployment-mode/) and [Traefik](https://doc.traefik.io/traefik/reference/install-configuration/providers/kubernetes/kubernetes-gateway/). On APISIX, a Gateway needs a GatewayProxy in the same namespace. But the GatewayProxy holds settings for the whole APISIX instance, such as global plugins, plugin metadata, and the Admin API endpoint. If each team owns a Gateway, each team also owns these settings and can affect other teams' traffic. [ListenerSet](https://gateway-api.sigs.k8s.io/geps/gep-1713/) (Standard since Gateway API v1.5.0) would solve this. Teams attach listeners with their own hostnames and certificates to the shared Gateway from their own namespaces, and the GatewayProxy stays with the platform team. It would be great if APISIX Ingress Controller supported ListenerSet, including: - `allowedListeners` on Gateway - Routes attached to a ListenerSet via `parentRefs` - Applying ListenerSet config through the parent Gateway's GatewayProxy -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
