Kubernetes Helm Chart - Gateway API is now available

[iainsproat]

For anyone who is self-hosting Speckle server on a Kubernetes cluster, we have recently added support for Gateway API to our Helm Chart. This is now available in our 2.29.0 release of Speckle server.

We welcome feedback - please do reply to this thread with any comments and bug reports.

Background

Speckle provide a Helm Chart to simplify the deployment of Speckle server to Kubernetes. This Helm Chart currently includes an Nginx Ingress definition to allow external traffic to be correctly routed to the various components of Speckle server running inside the Kubernetes cluster.

However, Nginx Ingress for Kubernetes will be deprecated as of March 2026. The recommended equivalent is the Gateway API to define routing in Kubernetes.

Speckle now includes Gateway API resources in the Helm Chart for Speckle server. The Gateway API resources from Speckle’s Helm Chart are disabled by default, but can be enabled by amending the Helm configuration.

Deploying the Gateway API resources

For clusters with existing shared Gateways

If you have an existing Gateway within your cluster and it is intended to be shared amongst applications, configuration of the Speckle server Helm chart is as follows:

    ingress:
      enabled: false # Gateway API replaces the ingress
    gatewayAPI:
      enabled: true
      gateway:
        enabled: false # We have an existing gateway so do not need to deploy another from the Speckle server helm chart
        name: my-existing-gateway # provide a reference to the existing Gateway
        namespace: my-existing-gateway-namespace # provide a reference to the existing Gateway's namespace

For clusters without existing Gateways

If you do not already have an existing Gateway in your server, we provide a simple template which can be deployed via Speckle’s Helm Chart. Below we provide an example Helm configuration for deployment of Gateway API on a GKE cluster on GCP. The Gateway API is applicable to other cloud providers - please refer to their documentation for specific examples of configuring it.

    ingress:
      enabled: false
    gatewayAPI:
      enabled: true
      gateway:
        enabled: true
        gatewayClassName: "gke-l7-rilb" # See options in https://docs.cloud.google.com/load-balancing/docs/l7-internal
        defaultListenerName: speckle-server-gateway-https
        name: speckle-server-gateway
        tls:
          enabled: true # TLS can be disabled by setting to 'false'
          certificateRefs: [] # if creating a Kubernetes Secret https://docs.cloud.google.com/kubernetes-engine/docs/how-to/secure-gateway#secure-using-secret
          options:
            networking.gke.io/pre-shared-certs: my-ilb-cert # if creating an SSL certificate https://docs.cloud.google.com/kubernetes-engine/docs/how-to/secure-gateway#secure-using-ssl-certificate

If you need additional configuration options for the Gateway than is currently provided, please do let us know in the comments below. We will try to accommodate your requirements, but may not be able to offer complete flexibility - in those cases deploying your own custom Gateway may be a better way of achieving customisation of the Gateway.

Health Checks on GKE

There are some additional requirements to supporting some implementations of Gateway API, for example GKE requires Health Check Policies to be explicitly defined as follows. Similar may be required for other cloud providers, please refer to their documentation.

    apiVersion: networking.gke.io/v1
    kind: HealthCheckPolicy
    metadata:
      name: speckle-frontend-2
    spec:
      default:
        config:
          type: HTTP
          httpHealthCheck:
            portSpecification: USE_SERVING_PORT
            requestPath: /api/status
      # Attach to a Service in the cluster.
      targetRef:
        group: ""
        kind: Service
        name: speckle-frontend-2

    apiVersion: networking.gke.io/v1
    kind: HealthCheckPolicy
    metadata:
      name: speckle-objects
    spec:
      default:
        config:
          type: HTTP
          httpHealthCheck:
            portSpecification: USE_SERVING_PORT
            requestPath: /readiness
      # Attach to a Service in the cluster.
      targetRef:
        group: ""
        kind: Service
        name: speckle-objects

    apiVersion: networking.gke.io/v1
    kind: HealthCheckPolicy
    metadata:
      name: speckle-server
    spec:
      default:
        config:
          type: HTTP
          httpHealthCheck:
            portSpecification: USE_SERVING_PORT
            requestPath: /readiness
      # Attach to a Service in the cluster.
      targetRef:
        group: ""
        kind: Service
        name: speckle-server

Further reading

Further information can be found in the GitHub Pull Request which introduced this feature:

feat(helm): gateway API support