Envoy Gateway with external load balancer

[lyngekpdxc]

Hi. I am currently working on a project that utilizes some of the functionality in Envoy Proxy especially. This is neatly packaged in Envoy Gateway and have been working well with Gateway API ingress definition.

However I have just gotten a requirement that we are to use an external load balancer and to define NodePort service for ingress in k8s...

I have read the documentation and gotten Envoy Gateway configured with NodePort definitions, however these are assigned random nodeport values, not using the assigned port values.

My current configuration looks like below.

---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyProxy
metadata:
  name: test-nodeport-config
  namespace: nodeport-envoy-gateway
spec:
  provider:
    type: Kubernetes
    kubernetes:
      envoyService:
        type: NodePort
---
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: test-nodeport-eg
  namespace: nodeport-envoy-gateway
spec:
  controllerName: gateway.envoyproxy.io/gatewayclass-controller
  parametersRef:
    name: test-nodeport-config
    namespace: nodeport-envoy-gateway
    group: gateway.envoyproxy.io
    kind: EnvoyProxy
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: test-nodeport-ingress-gateway
  namespace: nodeport-envoy-gateway
spec:
  gatewayClassName: test-nodeport-eg
  listeners:
    - hostname: test-nodeport.example.com
      name: services-one-http
      port: 30011
      protocol: HTTP
    - hostname: test-nodeport-ba.example.com
      name: services-other-http
      port: 30021
      protocol: HTTP
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: test-nodeport-httproute
  namespace: nodeport-envoy-gateway
spec:
  parentRefs:
    - name: test-nodeport-ingress-gateway
      namespace: nodeport-envoy-gateway
  hostnames:
    - test-nodeport.example.com
  rules:
    - backendRefs:
        - name: csb-proxy-infrastructure-nginx
          namespace: nodeport-envoy-gateway
          port: 80
      matches:
        - path:
            type: Exact
            value: /ServicePath

But results in NodePort services being defined as below.

apiVersion: v1
kind: Service
metadata:
  creationTimestamp: "2026-01-20T07:39:53Z"
  labels:
    app.kubernetes.io/component: proxy
    app.kubernetes.io/managed-by: envoy-gateway
    app.kubernetes.io/name: envoy
    gateway.envoyproxy.io/owning-gateway-name: test-nodeport-ingress-gateway
    gateway.envoyproxy.io/owning-gateway-namespace: nodeport-envoy-gateway
  name: envoy-nodeport-envoy-gateway-test-nodeport-ingress-gateway-44e80c1c
  namespace: envoy-gateway-system
  ownerReferences:
  - apiVersion: gateway.networking.k8s.io/v1
    kind: GatewayClass
    name: test-nodeport-eg
    uid: 61a4833e-f1ce-43ed-9ed3-8a9c74dc15a4
  resourceVersion: "331608936"
  uid: b244b883-2d39-4522-bf92-120157eabcb1
spec:
  clusterIP: 10.108.74.29
  clusterIPs:
  - 10.108.74.29
  externalTrafficPolicy: Cluster
  internalTrafficPolicy: Cluster
  ipFamilies:
  - IPv4
  ipFamilyPolicy: SingleStack
  ports:
  - name: http-30011
    nodePort: 30404
    port: 30011
    protocol: TCP
    targetPort: 30011
  - name: http-30021
    nodePort: 32329
    port: 30021
    protocol: TCP
    targetPort: 30021
  selector:
    app.kubernetes.io/component: proxy
    app.kubernetes.io/managed-by: envoy-gateway
    app.kubernetes.io/name: envoy
    gateway.envoyproxy.io/owning-gateway-name: test-nodeport-ingress-gateway
    gateway.envoyproxy.io/owning-gateway-namespace: nodeport-envoy-gateway
  sessionAffinity: None
  type: NodePort
status:
  loadBalancer: {}

I would have expected some configuration property somewhere to be able to let me control nodeport value directly. As I cannot currently control where my services is exposed making this unusable for static configurations.

[zirain]

From what arko said in #2220 (comment), you should be able to patch the service as you wanted.

[lyngekpdxc]

Thank you for the link. This is definitely my problem as well.
I fail to see however how I would do this in a proper way. I see that arkodg states that EnvoyProxy can be defined directly under Gateway.Infrastructure.ParametersRef, which might simplify things. But do I need to overwrite NodePort definition entitely for this to function making my listeners section superfluous?

[lyngekpdxc]

Is it possible to specify this in a more general way, like with JsonPatch or similar? I could not figure out how to include the EnvoyProxy spec directly in my Gateway resource as arkodg suggested. Do you have any examples of how to do this? I can only find references being used in the documentation.

I did get it working with static configuration like below. But it seems off that we have to do this. But I also recognize that utilizing an external load balancer with Gateway API is not exactly most common use case...

---
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyProxy
metadata:
  name: test-nodeport-config
  namespace: nodeport-envoy-gateway
spec:
  provider:
    type: Kubernetes
    kubernetes:
      envoyService:
        type: NodePort
        patch:
          type: JSONMerge
          value:
            spec:
              ports:
                - name: http-30011
                  nodePort: 30011
                  port: 30011
                  protocol: TCP
                  targetPort: 30011
                - name: http-30021
                  nodePort: 30021
                  port: 30021
                  protocol: TCP
                  targetPort: 30021
---
apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: test-nodeport-eg
  namespace: nodeport-envoy-gateway
spec:
  controllerName: gateway.envoyproxy.io/gatewayclass-controller
  parametersRef:
    name: test-nodeport-config
    namespace: nodeport-envoy-gateway
    group: gateway.envoyproxy.io
    kind: EnvoyProxy
---
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: test-nodeport-ingress-gateway
  namespace: nodeport-envoy-gateway
spec:
  gatewayClassName: test-nodeport-eg
  listeners:
    - hostname: test-nodeport.example.com
      name: services-one-http
      port: 30011
      protocol: HTTP
    - hostname: test-nodeport-ba.example.com
      name: services-other-http
      port: 30021
      protocol: HTTP
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: test-nodeport-httproute
  namespace: nodeport-envoy-gateway
spec:
  parentRefs:
    - name: test-nodeport-ingress-gateway
      namespace: nodeport-envoy-gateway
  hostnames:
    - test-nodeport.example.com
  rules:
    - backendRefs:
        - name: csb-proxy-infrastructure-nginx
          namespace: nodeport-envoy-gateway
          port: 80
      matches:
        - path:
            type: Exact
            value: /ServicePath