---
component: ROOT
version: "2026.2"
slug: ROOT/installation/gateway-api
canonical_url: "https://docs.develocity.ai/2026.2/installation/gateway-api/"
title: "Routing Develocity With the Gateway API"
description: "Routing external traffic to Develocity 2026.2 with the Kubernetes Gateway API, covering the chart resources and prerequisites."
keywords:
  - "cluster"
  - "installation"
status: current
---

<!-- llms-index: https://docs.develocity.ai/llms.txt -->

# Routing Develocity With the Gateway API

<a id="preamble"></a>

> [!IMPORTANT]
> Gateway API routing is available in Develocity 2026.2 for early access. Its configuration may change in future releases. Feedback on this setup is welcome. Please contact Develocity support to share your experience.

Develocity can route external traffic using the [Kubernetes Gateway API](https://gateway-api.sigs.k8s.io/). In this mode, the Helm chart generates `HTTPRoute` and `GRPCRoute` resources that attach to an existing `Gateway` in your cluster.

This guide assumes you are comfortable with Kubernetes and with running a Gateway API implementation in your cluster.

<a id="what-the-chart-creates"></a>

## What the Chart Creates

When you enable Gateway API routing, the chart renders only the route resources:

*   `HTTPRoute` resources for the web UI, the REST and GraphQL API, Keycloak, the test distribution broker, and, when enabled, the edge node cache endpoints.
    
*   `GRPCRoute` resources for gRPC traffic (see [HTTP and gRPC Traffic](#grpc_traffic)).
    

The chart does not create the `Gateway`, the `GatewayClass`, the TLS configuration, or the Gateway API implementation itself. Providing and managing those is your responsibility.

<a id="prerequisites"></a>

## Prerequisites

Before enabling Gateway API routing, make sure that:

*   You are performing a **cluster installation**. Gateway API routing is not available for standalone installations.
    
*   Your cluster has the **Gateway API custom resource definitions** installed, at version **v1.3 or later**.
    
*   A **Gateway API implementation** (controller) is running in your cluster. See the [list of Gateway API implementations](https://gateway-api.sigs.k8s.io/implementations/) to choose one that supports both `HTTPRoute` and `GRPCRoute`.
    
*   An existing **`Gateway`** in your cluster has a listener bound to your Develocity hostname. That listener terminates TLS, supports HTTP/2 for gRPC, and allows the Develocity namespace to attach routes. See [Attach to an Existing Gateway](#gateway).
    

<a id="grpc_traffic"></a>

## HTTP and gRPC Traffic

Develocity serves both HTTP and gRPC traffic on the same hostname:

*   **HTTP** carries the web UI, the REST and GraphQL API, and the Build Cache endpoints.
    
*   **gRPC** carries communication between edge nodes and Develocity, Bazel traffic (the Build Event Service and the remote execution API), and the Bazel remote cache.
    

Bazel clients connect over `grpcs://`, so your `Gateway` must terminate TLS and support HTTP/2. Ensure the listener your routes attach to accepts both `HTTPRoute` and `GRPCRoute` on the Develocity hostname.

<a id="gateway"></a>

## Attach to an Existing Gateway

The generated routes attach to a `Gateway` that already exists in your cluster. That `Gateway` is typically shared infrastructure managed by your platform team, running in its own namespace. There is no need to create a dedicated `Gateway` for Develocity.

The routes attach to a listener that is bound to the Develocity hostname, terminates TLS, and supports HTTP/2 for gRPC. The `Gateway` below illustrates such a listener. Your own `Gateway` will have its own `gatewayClassName`, TLS, and namespace.

**An existing Gateway, shown for reference:**

```
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: shared-gateway
  namespace: gateway-system (1)
spec:
  gatewayClassName: «your-gateway-class»
  listeners:
    - name: https
      protocol: HTTPS
      port: 443
      hostname: develocity.example.com (2)
      tls:
        mode: Terminate
        certificateRefs:
          - kind: Secret
            name: develocity-tls
      allowedRoutes:
        namespaces:
          from: All (3)
```

1. The Gateway typically runs in its own infrastructure namespace, separate from Develocity.
2. A listener bound to the Develocity hostname. It must match global.hostname.
3. The listener must allow the Develocity namespace to attach routes. allowedRoutes governs this, so no ReferenceGrant is required.

> [!NOTE]
> A single HTTPS listener can serve both HTTP and gRPC traffic when the implementation supports gRPC over HTTP/2. Some implementations require a dedicated listener for gRPC. Consult your implementation’s documentation.

<a id="configure-the-helm-values"></a>

## Configure the Helm Values

Enable Gateway API routing and point it at your `Gateway` by adding the following to your `values.yaml`:

**Develocity Helm values:**

```
global:
  hostname: develocity.example.com (1)
  internal:
    gatewayApi:
      enabled: true
      parentRef:
        name: shared-gateway (2)
        namespace: gateway-system (3)
enterprise:
  routedBy: ingress (4)
```

1. The hostname clients use to reach Develocity. All generated routes use this hostname.
2. The name of your existing Gateway.
3. The namespace where your Gateway runs. Omit it only when the Gateway shares the Develocity namespace. To target a specific listener, add sectionName (for example, https).
4. Routes traffic directly to the application, rather than through the gradle-proxy component. Gateway API routing requires this setting.

<a id="install-develocity"></a>

## Install Develocity

Install Develocity as described in the [Self-Hosted Kubernetes Installation Guide](https://docs.develocity.ai/2026.2/installation/kubernetes-installation/), using the values file above. No other change to the installation procedure is required.

<a id="verify-the-routing"></a>

## Verify the Routing

After installation, confirm that the chart created the route resources and bound them to your hostname:

```shell
kubectl --namespace develocity get httproute,grpcroute
```

**Output:**

```
NAME                                                          HOSTNAMES                    AGE
httproute.gateway.networking.k8s.io/enterprise-app            ["develocity.example.com"]   5m
httproute.gateway.networking.k8s.io/keycloak                  ["develocity.example.com"]   5m
httproute.gateway.networking.k8s.io/test-distribution-broker  ["develocity.example.com"]   5m
httproute.gateway.networking.k8s.io/edge-node                 ["develocity.example.com"]   5m

NAME                                                          HOSTNAMES                    AGE
grpcroute.gateway.networking.k8s.io/enterprise-app            ["develocity.example.com"]   5m
grpcroute.gateway.networking.k8s.io/edge-node                 ["develocity.example.com"]   5m
```

Then verify connectivity through the hostname:

```shell
curl -sw '\n' --fail-with-body --show-error https://«develocity-host»/ping
```

**Output:**

```
{"status":"UP"}
```

<a id="notes"></a>

## Notes and Known Limitations

*   **Implementation compatibility.** Gateway API implementations differ in how they handle gRPC and TLS. Because Develocity serves HTTP and gRPC on a single hostname, verify that your chosen implementation supports attaching both `HTTPRoute` and `GRPCRoute` to it.
    
*   **Configuration stability.** The values under `global.internal.gatewayApi` may change between releases. Review the changes when upgrading.