Manage Kubernetes Gateway API

Hi there,

You should be able to use something like Ambassador to implement the Gateway API in DigitalOcean Kubernetes Service.

There is a 1-Click App for Ambassador Ingress Controller in the DigitalOcean Marketplace:

https://marketplace.digitalocean.com/apps/ambassador-ingress-controller

There is a nice demo project here that uses traefik:

https://github.com/digitalocean/mastodon-on-kubernetes/blob/main/docs/assets/mok-overview.png

But probably best to reach out to support if you have any other specific questions:

https://do.co/support

- Bobby

New clusters created using Kubernetes 1.33 with VPC-native networking have the Gateway API enabled using Cilium and Envoy Gateway as a Public Preview (i.e. they’re not necessarily production-ready): https://docs.digitalocean.com/release-notes/#2025-06-16 I’ve not been able to find any other documentation from DigitalOcean, but DO support was very helpful.

Currently, you can create Gateway listeners with Protocol TCP or TLS, and you can create TLSRoutes, but I’ve not been able to find a configuration where they would attach to a listener; I always get “TLSRoute is not allowed to attach to this Gateway due to route kind restrictions”. TCPRoute resources are not defined at all.

HTTPRoutes are functional and work with Cert-manager, though you can’t enable the PROXY Protocol between your load balancer and the Gateway controller, so all traffic will appear to come from the load balancer. I could not determine a configuration where sticky sessions worked.

Setting the annotation service.beta.kubernetes.io/do-loadbalancer-enable-proxy-protocol: "true" on the Gateway and the flag --enable-gateway-api-proxy-protocol for the Cilium operator in the cilium-config ConfigMap would enable the PROXY Protocol, but that’s not the configuration currently enforced by DO.