Routing Develocity With the Gateway API

Gateway API routing is available in Develocity 2026.2 for early access. Its configuration may change in future releases.

Feedback on this setup is welcome. Please contact Develocity support to share your experience.

Develocity can route external traffic using the Kubernetes Gateway API. In this mode, the Helm chart generates HTTPRoute and GRPCRoute resources that attach to an existing Gateway in your cluster.

This guide assumes you are comfortable with Kubernetes and with running a Gateway API implementation in your cluster.

What the Chart Creates

When you enable Gateway API routing, the chart renders only the route resources:

  • HTTPRoute resources for the web UI, the REST and GraphQL API, Keycloak, the test distribution broker, and, when enabled, the edge node cache endpoints.

  • GRPCRoute resources for gRPC traffic (see HTTP and gRPC Traffic).

The chart does not create the Gateway, the GatewayClass, the TLS configuration, or the Gateway API implementation itself. Providing and managing those is your responsibility.

Prerequisites

Before enabling Gateway API routing, make sure that:

  • You are performing a cluster installation. Gateway API routing is not available for standalone installations.

  • Your cluster has the Gateway API custom resource definitions installed, at version v1.3 or later.

  • A Gateway API implementation (controller) is running in your cluster. See the list of Gateway API implementations to choose one that supports both HTTPRoute and GRPCRoute.

  • An existing Gateway in your cluster has a listener bound to your Develocity hostname. That listener terminates TLS, supports HTTP/2 for gRPC, and allows the Develocity namespace to attach routes. See Attach to an Existing Gateway.

HTTP and gRPC Traffic

Develocity serves both HTTP and gRPC traffic on the same hostname:

  • HTTP carries the web UI, the REST and GraphQL API, and the Build Cache endpoints.

  • gRPC carries communication between edge nodes and Develocity, Bazel traffic (the Build Event Service and the remote execution API), and the Bazel remote cache.

Bazel clients connect over grpcs://, so your Gateway must terminate TLS and support HTTP/2. Ensure the listener your routes attach to accepts both HTTPRoute and GRPCRoute on the Develocity hostname.

Attach to an Existing Gateway

The generated routes attach to a Gateway that already exists in your cluster. That Gateway is typically shared infrastructure managed by your platform team, running in its own namespace. There is no need to create a dedicated Gateway for Develocity.

The routes attach to a listener that is bound to the Develocity hostname, terminates TLS, and supports HTTP/2 for gRPC. The Gateway below illustrates such a listener. Your own Gateway will have its own gatewayClassName, TLS, and namespace.

An existing Gateway, shown for reference
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: shared-gateway
  namespace: gateway-system (1)
spec:
  gatewayClassName: «your-gateway-class»
  listeners:
    - name: https
      protocol: HTTPS
      port: 443
      hostname: develocity.example.com (2)
      tls:
        mode: Terminate
        certificateRefs:
          - kind: Secret
            name: develocity-tls
      allowedRoutes:
        namespaces:
          from: All (3)
1 The Gateway typically runs in its own infrastructure namespace, separate from Develocity.
2 A listener bound to the Develocity hostname. It must match global.hostname.
3 The listener must allow the Develocity namespace to attach routes. allowedRoutes governs this, so no ReferenceGrant is required.
A single HTTPS listener can serve both HTTP and gRPC traffic when the implementation supports gRPC over HTTP/2. Some implementations require a dedicated listener for gRPC. Consult your implementation’s documentation.

Configure the Helm Values

Enable Gateway API routing and point it at your Gateway by adding the following to your values.yaml:

Develocity Helm values
global:
  hostname: develocity.example.com (1)
  internal:
    gatewayApi:
      enabled: true
      parentRef:
        name: shared-gateway (2)
        namespace: gateway-system (3)
enterprise:
  routedBy: ingress (4)
1 The hostname clients use to reach Develocity. All generated routes use this hostname.
2 The name of your existing Gateway.
3 The namespace where your Gateway runs. Omit it only when the Gateway shares the Develocity namespace. To target a specific listener, add sectionName (for example, https).
4 Routes traffic directly to the application, rather than through the gradle-proxy component. Gateway API routing requires this setting.

Install Develocity

Install Develocity as described in the Self-Hosted Kubernetes Installation Guide, using the values file above. No other change to the installation procedure is required.

Verify the Routing

After installation, confirm that the chart created the route resources and bound them to your hostname:

kubectl --namespace develocity get httproute,grpcroute
Output
NAME                                                          HOSTNAMES                    AGE
httproute.gateway.networking.k8s.io/enterprise-app            ["develocity.example.com"]   5m
httproute.gateway.networking.k8s.io/keycloak                  ["develocity.example.com"]   5m
httproute.gateway.networking.k8s.io/test-distribution-broker  ["develocity.example.com"]   5m
httproute.gateway.networking.k8s.io/edge-node                 ["develocity.example.com"]   5m

NAME                                                          HOSTNAMES                    AGE
grpcroute.gateway.networking.k8s.io/enterprise-app            ["develocity.example.com"]   5m
grpcroute.gateway.networking.k8s.io/edge-node                 ["develocity.example.com"]   5m

Then verify connectivity through the hostname:

curl -sw '\n' --fail-with-body --show-error https://«develocity-host»/ping
Output
{"status":"UP"}

Notes and Known Limitations

  • Implementation compatibility. Gateway API implementations differ in how they handle gRPC and TLS. Because Develocity serves HTTP and gRPC on a single hostname, verify that your chosen implementation supports attaching both HTTPRoute and GRPCRoute to it.

  • Configuration stability. The values under global.internal.gatewayApi may change between releases. Review the changes when upgrading.