EKS Auto Mode now runs Kubernetes Gateway API routing with no controller to install

Amazon EKS Auto Mode now supports the Kubernetes Gateway API. AWS’s 28 October announcement says you can define routing with Gateway and route resources and Auto Mode “provisions and manages the underlying AWS infrastructure automatically,” with no separate controller to install or configure.

How it works

Per the setup guide, you pick an AWS controller in your GatewayClass:

• eks.amazonaws.com/gateway-alb gives you an Application Load Balancer for L7 routes.
• eks.amazonaws.com/gateway-nlb gives you a Network Load Balancer for L4 routes.

Creating a Gateway with one of those classes provisions the load balancer and keeps it in sync with your routes. Supported route types are HTTPRoute, GRPCRoute, TCPRoute and UDPRoute. AWS lists cross-namespace routing, weighted traffic splitting, header-based routing and automatic TLS certificate discovery through AWS Certificate Manager.

Because the AWS controllers use their own names, they can coexist with Envoy Gateway or Istio in the same cluster. AWS-specific tuning uses TargetGroupConfiguration, LoadBalancerConfiguration and ListenerRuleConfiguration, the same resources the AWS Load Balancer Controller uses, according to the release notes.

Turning it on: the CRD choice

The Gateway API is enabled through the gatewayApi.crds.managed field in the cluster’s load balancing configuration, via the CLI, API or console. The value decides who owns the Gateway API CRDs:

• Managed (true). AWS installs and updates the CRDs at Gateway API v1. If your cluster already has older CRDs, the change is rejected and nothing is altered, so upgrade them to v1 first.
• Unmanaged (false). You keep installing and upgrading them yourself. AWS suggests this if you already run the Gateway API or another controller manages the CRDs.

Limits to check

The guide says “not every field in the Gateway API specification maps to an AWS load balancer capability” and points to a feature comparison for ALB gateways. Existing Ingress and Service type LoadBalancer resources keep working, so you can move one app at a time. AWS says Gateway API support is included as part of EKS Auto Mode, and standard charges apply for the load balancers it creates. It’s available in every Region where EKS Auto Mode is.

If you’ve written Gateway API routes before, the model will look familiar: our Istio traffic mirroring walkthrough shows an HTTPRoute RequestMirror filter, and agentgateway’s Kubernetes controller translates the same Gateway and HTTPRoute resources into its own config. Whether a given filter works on ALB is exactly what the feature comparison is for.

Why this matters

If you’re on EKS Auto Mode and have avoided the Gateway API because it meant running another controller, that cost is gone. Before moving an app, check its routes against the ALB feature comparison, decide who owns the CRDs, and remember each Gateway is a load balancer you pay for. Teams that already run Istio or Envoy Gateway can add the AWS classes beside them rather than replacing anything.