Features
Nantian Gateway combines standard Kubernetes Gateway API routing with experimental extension APIs for AI traffic, token-aware policy, Wasm plugins, and backend load-balancing policy. This section gives each major capability a direct entry point.
What Can Nantian Gateway Do?
Section titled “What Can Nantian Gateway Do?”| You want to… | Use this |
|---|---|
| Route HTTP traffic by host, path, headers, or query | HTTPRoute |
| Route gRPC traffic by service and method | GRPCRoute |
| Handle raw TCP or UDP connections | TCPRoute, UDPRoute |
| Pass through TLS without termination | TLSRoute |
| Encrypt backend connections with custom CAs | BackendTLSPolicy |
| Distribute traffic across multiple backends | Traffic Splitting |
| Protect backends from overload | Circuit Breaker |
| Control request rates | Token Policy |
| Proxy requests to AI model providers | AI Gateway |
| Redact PII in AI requests | PII Masking |
| Cache AI responses for repeat prompts | Semantic Cache |
| Extend the proxy with custom logic | Wasm Plugins |
| Monitor traffic and gateway health | Metrics & Grafana |
| Reference backends across namespaces | ReferenceGrant |
Feature Map
Section titled “Feature Map”| Area | Primary APIs | Stability | Start here |
|---|---|---|---|
| Traffic routing | Gateway, HTTPRoute, GRPCRoute, TCPRoute, UDPRoute, TLSRoute | Gateway API standard or alpha, depending on resource | Traffic Management |
| AI traffic | AIService, TokenPolicy | Experimental Nantian API | AI Gateway |
| Custom proxy logic | WasmPlugin | Experimental Nantian API | Wasm Plugins |
| Backend policy | BackendLBPolicy | Experimental Gateway API policy | Traffic Management |
| Security and operations | BackendTLSPolicy, ReferenceGrant, Admin API, metrics | Mixed stable and extended APIs | Security And Observability |
Stable Gateway API Capabilities
Section titled “Stable Gateway API Capabilities”These resources are the default way to configure Nantian Gateway. They follow the upstream Gateway API specification and are portable across compliant implementations.
| Resource | Purpose | Example |
|---|---|---|
GatewayClass | Identifies the controller | spec.controllerName: nantian-gw |
Gateway | Entry point with listeners | Port 80 HTTP, port 443 HTTPS with TLS |
HTTPRoute | HTTP routing rules | Path /api → backend api-svc:8080 |
GRPCRoute | gRPC routing rules | Service echo.Echo → backend grpc-svc:9090 |
TCPRoute | Raw TCP forwarding | Port 3306 → MySQL backend |
UDPRoute | UDP packet forwarding | Port 53 → DNS backend |
TLSRoute | TLS passthrough | SNI *.example.com → backend |
BackendTLSPolicy | Backend TLS validation | Verify backend cert against custom CA |
ReferenceGrant | Cross-namespace access | Allow route in team-a to use service in team-b |
For field-level details, see Gateway API Resources. For a comparison of which features are supported versus other implementations, see the Gateway API Support Matrix.
Experimental Extension Capabilities
Section titled “Experimental Extension Capabilities”Nantian Gateway also ships experimental extension APIs. These are namespaced under gateway.nantian.dev and require explicit opt-in.
| Resource | Purpose | Example |
|---|---|---|
AIService | AI provider/model target | Route to OpenAI GPT-4o with API key from Secret |
TokenPolicy | Token/request quotas | Limit route to 1000 requests per minute |
WasmPlugin | Sandboxed Wasm module | Add custom auth header to all requests on a Gateway |
BackendLBPolicy | Backend load balancing | Round-robin with session cookie persistence |
Read Experimental Features before using these APIs, then use Custom And Experimental Resources for current field references.
Feature Maturity
Section titled “Feature Maturity”Features move from experimental to stable on independent timelines. Use this table to gauge readiness for production:
| Feature | Status | API Version | Production Ready? |
|---|---|---|---|
| HTTP/HTTPS Routing | Stable | gateway.networking.k8s.io/v1 | ✅ Yes |
| GRPCRoute | Stable | gateway.networking.k8s.io/v1 | ✅ Yes |
| TLS Passthrough | Stable | gateway.networking.k8s.io/v1 | ✅ Yes |
| TCP/UDP Routing | Alpha | gateway.networking.k8s.io/v1alpha2 | ⚠️ With testing |
| BackendTLSPolicy | Stable | gateway.networking.k8s.io/v1 | ✅ Yes |
| AI Gateway | Experimental | gateway.nantian.dev/v1alpha1 | ⚠️ Production evaluation |
| TokenPolicy | Experimental | gateway.nantian.dev/v1alpha1 | ⚠️ Production evaluation |
| WasmPlugin | Experimental | gateway.nantian.dev/v1alpha1 | ⚠️ Development/Staging |
| BackendLBPolicy | Experimental | gateway.networking.k8s.io/v1alpha2 | ⚠️ Production evaluation |
| RoutePolicy | Experimental | gateway.nantian.dev/v1alpha1 | ⚠️ Production evaluation |
Features marked ⚠️ “Production evaluation” are under active development. Their APIs may change between releases. Test thoroughly in staging before production deployment.
Where To Go Next
Section titled “Where To Go Next”- AI Gateway — provider/model targets, token quotas, and AI observability
- Wasm Plugins — sandboxed request, response, and stream hooks
- Traffic Management — Gateway API routing, traffic splitting, and backend load-balancing
- Security And Observability — TLS, cross-namespace controls, Admin API, metrics, Grafana, and troubleshooting
- Gateway API Support Matrix — detailed feature-by-feature support comparison