[kaitlynmichael]

Summary

Documents Gateway API support in the Redis Software for Kubernetes operator (RED-112546). The operator attaches TLSRoute resources to a platform-owned Gateway to expose the cluster API, Cluster Manager UI, metrics, and Active-Active databases.

Hold: do not merge until the operator release that ships this feature is generally available. Jira: DOC-7109.

Changes

• New page: networking/gateway-api.md
• Cross-links and short additions on 11 existing pages in networking/, architecture/, active-active/, and re-clusters/
• Link-text fix (ingressOrRoutes to ingressOrRouteSpec) on prepare-clusters.md and create-reaadb.md

The API reference pages are not edited here. The k8s_apis_sync workflow regenerates them from the release bundle.

Sources

Field names, defaults, status conditions, event reasons, and error messages come from the operator source and CRDs on the main branch. Example manifests and command output come from the feature's demo recordings. Migration steps follow the Phase 1 design doc's runbook.

For SME review

Please confirm these. Each one is inferred from the source rather than stated in it:

1. Prerequisites: DNS records must resolve each exposed FQDN to the Gateway's address.
2. Troubleshooting, RoutePending row: the remedy "check that gatewayRef names an existing Gateway and that your Gateway controller is running."
3. Troubleshooting, "refusing to tear down the gateway route" row: the remedy "select the database for Gateway exposure again, or configure another exposure method on that cluster first."
4. Expose Active-Active databases: "Each participating cluster needs its own fqdnSuffix." This comes from the design doc; no validation enforces it.
5. Client test: the redis-cli example includes a client certificate and key, as in the demo. Is client authentication required, or only used in that environment?

Not covered, and open for input: TLS certificates. Clients that verify certificates will see the REC's certificate under the Gateway hostname. Both examples use an option that skips verification.

Generated with Claude Code

---

Note

Low Risk
Documentation-only changes with no runtime or security impact; content should stay aligned with the operator release that ships Gateway API (per PR hold note).

Overview
Adds documentation for Gateway API routing in Redis Software for Kubernetes: configuring spec.gateway on the REC so the operator attaches TLSRoute resources to a customer-owned Gateway (TLS passthrough) for the cluster API, Cluster Manager UI, metrics, and Active-Active (REAADB) databases.

The new networking/gateway-api.md page covers prerequisites (Gateway API CRDs ≥1.5, listener setup, DNS), REC patching, Active-Active exposure with replicationPort on every RERC copy, status/troubleshooting, and migration from ingressOrRouteSpec without downtime.

Active-Active guides (prepare-clusters, create-reaadb, edit-clusters, edit-rerc) now point to Gateway API as an alternative to ingressOrRouteSpec and document replicationPort behavior. Networking, architecture, ingress/routes, database connectivity, and admin console pages add cross-links; ingressOrRoutes link text is corrected to ingressOrRouteSpec in two prerequisites sections.

^{Reviewed by Cursor Bugbot for commit 974d25d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Staging links:
https://redis.io/docs/staging/DOC-7109/operate/kubernetes/active-active/create-reaadb/
https://redis.io/docs/staging/DOC-7109/operate/kubernetes/active-active/edit-clusters/
https://redis.io/docs/staging/DOC-7109/operate/kubernetes/active-active/edit-rerc/
https://redis.io/docs/staging/DOC-7109/operate/kubernetes/active-active/prepare-clusters/
https://redis.io/docs/staging/DOC-7109/operate/kubernetes/architecture/
https://redis.io/docs/staging/DOC-7109/operate/kubernetes/networking/
https://redis.io/docs/staging/DOC-7109/operate/kubernetes/networking/database-connectivity/
https://redis.io/docs/staging/DOC-7109/operate/kubernetes/networking/gateway-api/
https://redis.io/docs/staging/DOC-7109/operate/kubernetes/networking/ingress/
https://redis.io/docs/staging/DOC-7109/operate/kubernetes/networking/ingressorroutespec/
https://redis.io/docs/staging/DOC-7109/operate/kubernetes/networking/routes/
https://redis.io/docs/staging/DOC-7109/operate/kubernetes/re-clusters/connect-to-admin-console/

[github-actions]

DOC-7109

[github-actions]

🧠 Redis Memory

Found 6 related items from repository history (1 new this commit):

• PR — K8s: fix ingress doc bugs

• PR — K8s: Document disconnectClientsOnPasswordRemoval (RED-197499)

  Summary

• PR — k8s api docs 8.2.0-10

  k8s api docs 8.2.0-10

• PR — k8s api docs 8.0.18-8

  k8s api docs 8.0.18-8

• PR — DOC-6816 Document smart client handoffs (SCH) for Redis Enterprise on Kubernetes

  Summary

• Commit — K8s: Gateway API routing (eden release) 🆕

  K8s: Gateway API routing (eden release)

Memory updated at 974d25d

[dwdougherty]

Language LGTM.

[randv1r]

1. Prerequisites: DNS records must resolve each exposed FQDN to the Gateway's address.
2. Troubleshooting, RoutePending row: the remedy "check that gatewayRef names an existing Gateway and that your Gateway controller is running."
3. Troubleshooting, "refusing to tear down the gateway route" row: the remedy "select the database for Gateway exposure again, or configure another exposure method on that cluster first."
4. Expose Active-Active databases: "Each participating cluster needs its own fqdnSuffix." This comes from the design doc; no validation enforces it.
5. Client test: the redis-cli example includes a client certificate and key, as in the demo. Is client authentication required, or only used in that environment?

1. Correct. Also for active active, peer clusters must be able to resolve these names too for replication.
2. Correct.
3. Correct.
4. Right, and database hostnames need to be unique per participating cluster.
5. Client certificate is not required unless the database requires one.

One thing I suggest adding to the gateway-api.md example:
Prerequisites in the Gateway prerequisites/example need allowedRoutes. With a platform Gateway in another namespace (as the patch’s gatewayRef.namespace implies), listeners only accept same-namespace routes by default, so every TLSRoute is rejected (NotAllowedByListeners). Please add a prerequisite that listeners allow routes from the REC namespace (allowedRoutes.namespaces.from: All or Selector) and include it in the example Gateway.

[kaitlynmichael]

Added the allowedRoutes prerequisite and example listeners, and folded in your notes on peer DNS resolution, unique hostnames, and client certificates.