Deploying a Production-Ready Gateway API with NGINX Gateway Fabric and Cert-Manager

Sharath Veerapaneni — Sun, 30 Nov 2025 14:00:12 GMT

The Kubernetes Gateway API is the modern evolution of Ingress—offering better security, extensibility, and multi-route support. In this guide, we deploy the Gateway API v1.3.0, set up the NGINX Gateway Fabric, expose an NGINX application, and secure it using cert-manager with Let’s Encrypt. This is a complete, production-grade setup.

🧱 Architecture Overview

We will deploy:

Gateway API CRDs (v1.3.0)
NGINX Gateway Fabric
Nginx application
Gateway + HTTPRoute
cert-manager
Let’s Encrypt ClusterIssuer
Certificate
ACME HTTP-01 challenge routing

1. Install Gateway API CRDs

kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/experimental-install.yaml

2. Install NGINX Gateway Fabric

kubectl apply -f https://github.com/nginx/nginx-gateway-fabric/blob/v2.2.1/deploy/default/deploy.yaml

3. Deploy a Sample NGINX App

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-app
  namespace: default
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx-app
  template:
    metadata:
      labels:
        app: nginx-app
    spec:
      containers:
      - name: nginx
        image: nginx:alpine
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-service
  namespace: default
spec:
  selector:
    app: nginx-app
  ports:
  - protocol: TCP
    port: 80
    targetPort: 80

4. Create a Gateway (HTTP + HTTPS)

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: dev-gateway
  namespace: nginx-gateway
spec:
  gatewayClassName: nginx
  listeners:
  - name: http
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: All
  - name: https
    port: 443
    protocol: HTTPS
    tls:
      mode: Terminate
      certificateRefs:
      - name: appcertificate
    allowedRoutes:
      namespaces:
        from: All

5. Create HTTPRoute

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: nginx-route
  namespace: default
spec:
  parentRefs:
  - name: dev-gateway
    namespace: nginx-gateway
  hostnames:
  - "nginx.com"
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /
    backendRefs:
    - name: nginx-service
      port: 80

6. Install cert-manager

kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.13.0/cert-manager.yaml

7. Create ClusterIssuer

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: your-email@example.com
    privateKeySecretRef:
      name: letsencrypt-prod
    solvers:
    - http01:
        ingress:
          class: nginx

8. Create Certificate

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: appcertificate
  namespace: nginx-gateway
spec:
  secretName: appcertificate
  dnsNames:
  - "nginx.com"
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer

9. ACME HTTP-01 Challenge Route

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: acme-challenge
  namespace: nginx-gateway
spec:
  parentRefs:
  - name: dev-gateway
    namespace: nginx-gateway
  hostnames:
  - "nginx.nginx.com"
  rules:
  - matches:
    - path:
        type: PathPrefix
        value: /.well-known/acme-challenge/
    backendRefs:
    - name: cm-acme-http-solver-xxxxx
      kind: Service
      port: 8089

10. Verification

kubectl get gateway -A
kubectl get httproute -A
kubectl get certificate -n nginx-gateway
kubectl get svc -n nginx-gateway my-gateway-nginx

Test:

curl -H "Host: nginx..com" http://EXTERNAL_IP
curl https://nginx.com

🎉 Conclusion

You now have:

Gateway API
NGINX Gateway Fabric
HTTPRoute + HTTPS
Cert-manager + Let’s Encrypt

Kubernetes Gateway API With NginxGateway