10 expert Gateway API Role Separation answers researched from official documentation. Every answer cites authoritative sources you can verify.
Three roles with distinct responsibilities: (1) Infrastructure Provider (GatewayClass): defines infrastructure templates (Istio, Cilium, NGINX), (2) Cluster Operator (Gateway): provisions load balancer instances with listeners and TLS, (3) Application Developer (HTTPRoute/TCPRoute): defines routing rules and traffic policies. Enables secure multi-tenant delegation without over-permissioning.
Infrastructure Provider (platform team) manages: (1) GatewayClass resources defining implementation (Istio, Cilium, etc), (2) Underlying infrastructure (cloud load balancers, ingress controllers), (3) Controller deployment and configuration, (4) Platform-wide policies (rate limiting, security). Creates templates that cluster operators instantiate. Typically cloud provider or platform team.
Cluster Operator (infrastructure team) manages: (1) Gateway resources (load balancer instances), (2) Listeners (ports, protocols, hostnames), (3) TLS certificates and configuration, (4) Cross-namespace routing policies, (5) Gateway-level observability. Creates Gateways from GatewayClass templates. Typically SRE/DevOps team managing shared infrastructure.
Application Developer manages: (1) HTTPRoute/TCPRoute/GRPCRoute resources, (2) Routing rules (host/path matching, headers, query params), (3) Backend Service references, (4) Traffic splitting for canary/A/B testing, (5) Request/response filters. No access to Gateway or GatewayClass. Self-service routing without cluster-wide permissions.
RBAC separation: (1) Infrastructure Provider: create/update GatewayClass (cluster-scoped), (2) Cluster Operator: create/update Gateway (namespaced, with cross-namespace references), (3) Application Developer: create/update HTTPRoute in own namespace. ReferenceGrant enables secure cross-namespace routing. Example: dev team creates HTTPRoute, cannot modify Gateway listeners.
ReferenceGrant enables cross-namespace references with explicit permission. Example: HTTPRoute in 'app-team' namespace routes to Gateway in 'infra' namespace. Cluster Operator creates ReferenceGrant in 'infra' namespace allowing references from 'app-team'. Prevents unauthorized routing. Required for multi-tenant clusters with namespace isolation.
Ingress: no role separation, single IngressClass resource, application developers modify shared infrastructure (TLS, listeners). Gateway API: three-tier separation (GatewayClass/Gateway/Route), application developers cannot modify Gateway. Gateway API enables secure multi-tenancy; Ingress requires over-permissioning or external policy enforcement.
Delegation patterns: (1) Namespace delegation: HTTPRoute in namespace-A references Gateway in namespace-B (via ReferenceGrant), (2) Hostname delegation: Gateway allows specific namespaces to route specific hostnames, (3) Backend delegation: HTTPRoute routes to Service in different namespace, (4) Policy attachment: attach policies at Gateway or Route level with inheritance.
TLS separation: (1) Cluster Operator: provisions TLS certificates (Secret in Gateway namespace), configures listeners with certificate references, (2) Application Developer: specifies hostnames in HTTPRoute (no cert access), (3) Infrastructure Provider: may provide cert automation (cert-manager integration). ReferenceGrant required for cross-namespace certificate references.
Multi-tenant models: (1) Shared Gateway: one Gateway, multiple teams' HTTPRoutes (namespace-per-team, ReferenceGrant for access), (2) Gateway-per-team: each team has Gateway in own namespace (more isolation, higher cost), (3) Hybrid: shared Gateway for common services, dedicated Gateways for sensitive teams. Choose based on: isolation requirements, cost, team autonomy.