---
component: ROOT
version: "2026.3"
slug: ROOT/installation/gateway-api
canonical_url: "https://docs.develocity.ai/2026.3/installation/gateway-api/"
title: "Routing Develocity With the Gateway API"
description: "Routing external traffic to Develocity 2026.3 with the Kubernetes Gateway API, covering the chart resources and prerequisites."
keywords:
  - "cluster"
  - "installation"
status: current
---

<!-- llms-index: https://docs.develocity.ai/llms.txt -->

# Routing Develocity With the Gateway API

<a id="preamble"></a>

> [!IMPORTANT]
> Gateway API routing is available in Develocity 2026.3 for early access. Its configuration may change in future releases.
> 
> Feedback on this setup is welcome. Please contact [Develocity support](https://support.gradle.com/) to share your experience.

Develocity can route external traffic using the [Kubernetes Gateway API](https://gateway-api.sigs.k8s.io/). In this mode, the Helm chart generates `HTTPRoute` and `GRPCRoute` resources that attach to an existing `Gateway` in your cluster.

This guide assumes you are comfortable with Kubernetes and with running a Gateway API implementation in your cluster.

<a id="what-the-chart-creates"></a>

## What the Chart Creates

When you enable Gateway API routing, the chart renders only the route resources:

*   `HTTPRoute` resources for the web UI, the REST and GraphQL API, Keycloak, the test distribution broker, and, when enabled, the edge node cache endpoints.
    
*   `GRPCRoute` resources for gRPC traffic (see [HTTP and gRPC Traffic](#grpc_traffic)).
    

The chart does not create the `Gateway`, the `GatewayClass`, the TLS configuration, or the Gateway API implementation itself. Providing and managing those is your responsibility.

<a id="prerequisites"></a>

## Prerequisites

Before enabling Gateway API routing, make sure that:

*   You are performing a **cluster installation**. Gateway API routing is not available for standalone installations.
    
*   Your cluster has the **Gateway API custom resource definitions** installed, at version **v1.3 or later**.
    
*   A **Gateway API implementation** (controller) is running in your cluster. See the [list of Gateway API implementations](https://gateway-api.sigs.k8s.io/implementations/) to choose one that supports both `HTTPRoute` and `GRPCRoute`.
    
*   An existing **`Gateway`** in your cluster has a listener bound to your Develocity hostname. That listener terminates TLS, supports HTTP/2 for gRPC, and allows the Develocity namespace to attach routes. See [Attach to an Existing Gateway](#gateway).
    

<a id="grpc_traffic"></a>

## HTTP and gRPC Traffic

Develocity serves both HTTP and gRPC traffic on the same hostname:

*   **HTTP** carries the web UI, the REST and GraphQL API, and the Build Cache endpoints.
    
*   **gRPC** carries communication between edge nodes and Develocity, Bazel traffic (the Build Event Service and the remote execution API), and the Bazel remote cache.
    

Bazel clients connect over `grpcs://`, so your `Gateway` must terminate TLS and support HTTP/2. Ensure the listener your routes attach to accepts both `HTTPRoute` and `GRPCRoute` on the Develocity hostname.

<a id="gateway"></a>

## Attach to an Existing Gateway

The generated routes attach to a `Gateway` that already exists in your cluster. That `Gateway` is typically shared infrastructure managed by your platform team, running in its own namespace. There is no need to create a dedicated `Gateway` for Develocity.

The routes attach to a listener that is bound to the Develocity hostname, terminates TLS, and supports HTTP/2 for gRPC. The `Gateway` below illustrates such a listener. Your own `Gateway` will have its own `gatewayClassName`, TLS, and namespace.

**An existing Gateway, shown for reference:**

```yaml
apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: shared-gateway
  namespace: gateway-system (1)
spec:
  gatewayClassName: «your-gateway-class»
  listeners:
    - name: https
      protocol: HTTPS
      port: 443
      hostname: develocity.example.com (2)
      tls:
        mode: Terminate
        certificateRefs:
          - kind: Secret
            name: develocity-tls
      allowedRoutes:
        namespaces:
          from: All (3)
```

1. The Gateway typically runs in its own infrastructure namespace, separate from Develocity.
2. A listener bound to the Develocity hostname. It must match global.hostname.
3. The listener must allow the Develocity namespace to attach routes. allowedRoutes governs this, so no ReferenceGrant is required.

> [!NOTE]
> A single HTTPS listener can serve both HTTP and gRPC traffic when the implementation supports gRPC over HTTP/2. Some implementations require a dedicated listener for gRPC. Consult your implementation’s documentation.

<a id="configure-the-helm-values"></a>

## Configure the Helm Values

Enable Gateway API routing and point it at your `Gateway` by adding the following to your `values.yaml`:

**Develocity Helm values:**

```yaml
global:
  hostname: develocity.example.com (1)
  externalSSLTermination: true (2)
  internal:
    gatewayApi:
      enabled: true
      parentRef:
        name: shared-gateway (3)
        namespace: gateway-system (4)
enterprise:
  routedBy: ingress (5)
```

1. The hostname clients use to reach Develocity. All generated routes use this hostname.
2. TLS terminates at your Gateway, not in Develocity. This setting makes Develocity generate https:// URLs. Without it, Develocity generates http:// URLs.
3. The name of your existing Gateway.
4. The namespace where your Gateway runs. Omit it only when the Gateway shares the Develocity namespace. To target a specific listener, add sectionName (for example, https).
5. Routes traffic directly to the application, rather than through the gradle-proxy component. Gateway API routing requires this setting.

<a id="install-develocity"></a>

## Install Develocity

Install Develocity as described in the [Self-Hosted Kubernetes Installation Guide](https://docs.develocity.ai/2026.3/installation/kubernetes-installation/), using the values file above. No other change to the installation procedure is required.

<a id="verify-the-routing"></a>

## Verify the Routing

After installation, confirm that the chart created the route resources and bound them to your hostname:

```shell
kubectl --namespace develocity get httproute,grpcroute
```

**Output:**

```
NAME                                                          HOSTNAMES                    AGE
httproute.gateway.networking.k8s.io/enterprise-app            ["develocity.example.com"]   5m
httproute.gateway.networking.k8s.io/keycloak                  ["develocity.example.com"]   5m
httproute.gateway.networking.k8s.io/test-distribution-broker  ["develocity.example.com"]   5m
httproute.gateway.networking.k8s.io/edge-node                 ["develocity.example.com"]   5m

NAME                                                          HOSTNAMES                    AGE
grpcroute.gateway.networking.k8s.io/enterprise-app            ["develocity.example.com"]   5m
grpcroute.gateway.networking.k8s.io/edge-node                 ["develocity.example.com"]   5m
```

Then verify connectivity through the hostname:

```shell
curl -sw '\n' --fail-with-body --show-error https://«develocity-host»/ping
```

**Output:**

```
{"status":"UP"}
```

<a id="notes"></a>

## Notes and Known Limitations

*   **Implementation compatibility.** Gateway API implementations differ in how they handle gRPC and TLS. Because Develocity serves HTTP and gRPC on a single hostname, verify that your chosen implementation supports attaching both `HTTPRoute` and `GRPCRoute` to it.
    
*   **Configuration stability.** The values under `global.internal.gatewayApi` may change between releases. Review the changes when upgrading.