---
layout: docs
page_title: API gateways overview
description: API gateways provide an ingress point for service mesh traffic. Learn how API gateways add listeners for external traffic and route HTTP requests to services in the mesh.
---

# API gateways overview

This topic provides overview information about API gateways in Consul. 

## Introduction

API gateways enable external network clients to access applications and services running in a Consul datacenter. Consul API gateways can also forward requests from clients to specific destinations based on path or request protocol. Systems that access services in the mesh may be internal or external to your organizational network. _North-south traffic_ is a common term to describe this type of network traffic.

## API gateway use cases

API gateways solve the following primary use cases:

- **Control access at the point of entry**: Set the protocols of external connection requests and secure inbound connections with TLS certificates from trusted providers, such as Verisign and Let's Encrypt.
- **Simplify traffic management**: Load balance requests across services and route traffic to the appropriate service by matching one or more criteria, such as hostname, path, header presence or value, and HTTP method.

## Workflows

You can deploy API gateways to networks that implement a variety of computing environments:

- Services hosted on VMs
- Kubernetes-orchestrated service containers
- Kubernetes-orchestrated service containers in OpenShift

The following steps describe the general workflow for deploying a Consul API gateways:

1. For Kubernetes-orchestrated services, install Consul on your cluster. For Kubernetes-orchestrated services on OpenShift, you must also enable the `openShift.enabled` parameter. Refer to [Install Consul on Kubernetes](/consul/docs/deploy/server/k8s/consul-k8s) for additional information.
1. Define and deploy the API gateway configurations to create the API gateway artifacts. For VM-hosted services, create configuration entries for the gateway service, listeners configurations, and references to TLS certificates. For Kubernetes-orchestrated, configurations also include `GatewayClassConfig`s and `parametersRef`s.
1. Define and deploy routes between the gateway listeners and services in the mesh.

Gateway configurations are modular, so you can define and attach routes and inline certificates to multiple gateways.

### Configurations for virtual machines

Apply the following configuration items if your network runs on virtual machines nodes:

| Configuration | Description | Usage |
| ---  | ---         | ---   |
| [`api-gateway`](/consul/docs/reference/config-entry/api-gateway) | Defines the main infrastructure resource for declaring an API gateway and listeners on the gateway. | [Deploy API gateway listeners on virtual machines](/consul/docs/north-south/api-gateway/vm/listener) |
| [`http-route`](/consul/docs/reference/config-entry/http-route) | Enables HTTP traffic to reach services in the mesh from a listener on the gateway.| <nobr>[Define routes on virtual machines](/consul/docs/north-south/api-gateway/vm/route)</nobr> |
| [`tcp-route`](/consul/docs/reference/config-entry/tcp-route) | Enables TCP traffic to reach services in the mesh from a listener on the gateway.| [Define routes on virtual machines](/consul/docs/north-south/api-gateway/vm/route) |
| <nobr>[`file-system-certificate`](/consul/docs/reference/config-entry/file-system-certificate)</nobr> | Provides gateway with a CA certificate so that requests between the user and the gateway endpoint are encrypted. | [Encrypt API gateway traffic on virtual machines](/consul/docs/north-south/api-gateway/secure-traffic/encrypt) |
| <nobr>[`inline-certificate`](/consul/docs/reference/config-entry/inline-certificate)</nobr> | Provides gateway with a CA certificate so that requests between the user and the gateway endpoint are encrypted. | [Encrypt API gateway traffic on virtual machines](/consul/docs/north-south/api-gateway/secure-traffic/encrypt) |
| [`service-intentions`](/consul/docs/reference/config-entry/service-intentions) | Specifies traffic communication rules between services in the mesh. Intentions also enforce rules for service-to-service traffic routed through a Consul API gateway. | General configuration for securing a service mesh |

### Configurations for Kubernetes

Apply the following configuration items if your network runs on Kubernetes:

| Configuration | Description | Usage |
| ---  | ---         | ---   |
| [`Gateway`](/consul/docs/reference/k8s/api-gateway/gateway) | Defines the main infrastructure resource for declaring an API gateway and listeners on the gateway. It also specifies the name of the `GatewayClass`. | [Deploy listeners on Kubernetes](/consul/docs/north-south/api-gateway/k8s/listener) |
| [`GatewayClass`](/consul/docs/reference/k8s/api-gateway/gatewayclass) | Defines a class of gateway resources used as a template for creating gateways. The default gateway class is `consul` and is suitable for most API gateway implementations.  | [Deploy listeners on Kubernetes](/consul/docs/north-south/api-gateway/k8s/listener) |
| [`GatewayClassConfig`](/consul/docs/reference/k8s/api-gateway/gatewayclassconfig) | Describes additional gateway-related configuration parameters for the `GatewayClass` resource. | [Deploy listeners on Kubernetes](/consul/docs/north-south/api-gateway/k8s/listener) |
| [`Routes`](/consul/docs/reference/k8s/api-gateway/routes) | Specifies paths from the gateway listener to backend services. | <nobr>[Define routes on Kubernetes](/consul/docs/north-south/api-gateway/k8s/route)</nobr><p>[Reroute traffic in Kubernetes](/consul/docs/north-south/api-gateway/k8s/reroute)</p><p>[Route traffic to peered services in Kubernetes](/consul/docs/north-south/api-gateway/k8s/peer)</p> |
| [`MeshServices`](/consul/docs/north-south/api-gateway/k8s/peer) | Enables routes to reference services in Consul. | [Route traffic to peered services in Kubernetes](/consul/docs/north-south/api-gateway/k8s/peer) |
| [`ServiceIntentions`](/consul/docs/reference/config-entry/service-intentions) | Specifies traffic communication rules between services in the mesh. Intentions also enforce rules for service-to-service traffic routed through a Consul API gateway. | General configuration for securing a service mesh |

## Technical specifications

Refer to [Technical specifications for API gateways on Kubernetes](/consul/docs/north-south/api-gateway/k8s/tech-specs) for additional details and considerations about using API gateways in Kubernetes-orchestrated networks.

## Guidance

Refer to the following resources for help setting up and using API gateways:

### Tutorials

- [Control access into the service mesh with Consul API gateway](/consul/tutorials/developer-mesh/kubernetes-api-gateway)

### Usage documentation

- [Deploy API gateway listeners to VMs](/consul/docs/north-south/api-gateway/vm/listener)
- [Deploy API gateway listeners to Kubernetes](/consul/docs/north-south/api-gateway/k8s/listener)
- [Deploy API gateway routes to VMs](/consul/docs/north-south/api-gateway/vm/route)
- [Deploy API gateway routes to Kubernetes](/consul/docs/north-south/api-gateway/k8s/route)
- [Reroute HTTP requests in Kubernetes](/consul/docs/north-south/api-gateway/k8s/reroute)
- [Route traffic to peered services in Kubernetes](/consul/docs/north-south/api-gateway/k8s/peer)
- [Encrypt API gateway traffic on VMs](/consul/docs/north-south/api-gateway/secure-traffic/encrypt)
- [Use JWTs to verify requests to API gateways on VMs](/consul/docs/north-south/api-gateway/secure-traffic/jwt/vm)
- [Use JWTs to verify requests to API gateways on Kubernetes](/consul/docs/north-south/api-gateway/secure-traffic/jwt/k8s)

### Reference

- [API gateway configuration entry reference](/consul/docs/reference/config-entry/api-gateway)
- [HTTP route configuration entry reference](/consul/docs/reference/config-entry/http-route)
- [TCP route configuration entry reference](/consul/docs/reference/config-entry/tcp-route)
- [Error messages](/consul/docs/error-messages/api-gateway)
