Deploy a production API and gateway with APIOps using Argo CD and ngrok

• ngrok’s out-of-the-box API Gateway
• The ngrok Kubernetes Operator, which adds secure public ingress and middleware execution with declarative CRDs
• The Kubernetes Gateway API, for role-oriented load balancing and routing with developer-defined paths to production APIs
• Argo CD, a declarative GitOps tool for Kubernetes that version-controls definitions, configurations, and environments, including an API gateway

​

What you’ll need

• An ngrok account.
• A Kubernetes cluster. For a local cluster, use minikube; this guide refers to your cluster as <YOUR-CLUSTER>.
• Argo CD installed on your cluster, with the argocd CLI installed and logged in on your local workstation.
• kubectl and Helm 3.0.0+ installed on your local workstation.
• The ngrok Kubernetes Operator installed on your cluster.
• A reserved domain from the ngrok dashboard or API. You can use an ngrok subdomain or a custom branded domain like https://api.example.com; this guide refers to it as <NGROK_DOMAIN>.

​

Deploy Argo CD

kubectl get pods --namespace argocd

​

Set up the demo API

1. Reserve a static domain from the ngrok dashboard or API. This static domain (for example, example.ngrok.app) is your NGROK_DOMAIN for the remainder of this guide.
2. Fork the repository for the demo API at ngrok-samples/apiops-demo.
3. In your fork, open gateway.yaml and replace the values of lines 18 and 37 with the ngrok domain you just created (for example, one-two-three.ngrok.app).
4. Add, commit, and push these changes to your fork.

​

Deploy your demo API with Argo CD

1. Register the demo app with Argo CD, replacing <YOUR-GITHUB-USERNAME> with your fork of the demo API repository.
   argocd app create apiops-demo \
     --repo https://github.com/<YOUR-GITHUB-USERNAME>/apiops-demo.git \
     --path . \
     --dest-server https://kubernetes.default.svc \
     --dest-namespace apiops-demo
   
   Refresh the Argo CD UI to see your app. The Missing and OutOfSync status report are not errors; they reflect that Argo CD doesn’t automatically sync and deploy a newly registered app. You can click the app to view additional details about the deployment and the Git repository on which it is based.
2. Use the Argo CD CLI to perform a manual first sync of your registered app against your Git repository.
   argocd app sync apiops-demo
   
   Refresh the UI to see that your demo API is properly synced and deployed. You can also navigate to the Endpoints section of the ngrok dashboard to see the endpoint the ngrok Kubernetes Operator created via secure tunnel. You can curl your deployed API; ngrok’s API gateway handles ingress and TLS automatically. You’ll only see null in response, but that confirms your demo API is working.
   curl \
     -X GET \
     -H "Content-Type: application/json" \
     https://<NGROK-DOMAIN>/legend
   

​

Enable APIOps in Argo CD

1. Enable auto sync of your app to the Git repository that stores your desired state.
   argocd app set apiops-demo --sync-policy automated
   
   You can confirm this change in the Argo CD UI.
   The default interval at which Argo CD looks for changes to the desired state in your Git repo is 3 minutes. You can alter this in Argo CD’s configuration.
2. Optionally, test auto sync by editing the number of replicas of the demo API in your cluster. In your Git repository, open the deployment.yaml file and edit the replicas value:
   spec:
     replicas: 5
   
   To push these changes to your production cluster, add, commit, and push them to your Git repository.
   git add .
   git commit -m "Increase replicas to 5"
   git push origin main
   
   Argo CD will soon poll your repository, identify changes, and reconcile the deployed state to increase the number of replicas.

​

Configure your API gateway with Traffic Policies

1. In your fork of the demo API project, create a new file called rate-limiting.yaml. Open the file and add the following YAML:
   kind: NgrokTrafficPolicy
   apiVersion: ngrok.k8s.ngrok.com/v1alpha1
   metadata:
     name: traffic-policy-rate-limiting
   spec:
     policy:
       on_http_request:
         - actions:
             - type: "rate-limit"
               config:
                 name: "Only allow 10 requests per minute"
                 algorithm: "sliding_window"
                 capacity: 10
                 rate: "60s"
                 bucket_key:
                   - "req.headers['host']"
   
   This example policy includes a low limit for demonstration purposes, but you can change the capacity value to your needs in production.
2. Insert the YAML below into the HTTPRoute in your deployment.yaml. This defines a filter that runs during the request or response lifecycle, letting you inject policy into all traffic arriving at your API through your ngrok API gateway.
    apiVersion: gateway.networking.k8s.io/v1
    kind: HTTPRoute
    metadata:
      name: apiops-demo-route
      namespace: apiops-demo
    spec:
      parentRefs:
        - kind: Gateway
          name: apiops-demo-gateway
          namespace: apiops-demo
      hostnames:
        - "apiops-demo.ngrok.app"
      rules:
        - matches:
            - path:
                type: PathPrefix
                value: /
          filters:
            - type: ExtensionRef
              extensionRef:
                group: ngrok.k8s.ngrok.com
                kind: NgrokTrafficPolicy
                name: traffic-policy-rate-limiting
          backendRefs:
            - name: apiops-demo-service
              port: 80
              kind: Service
   
3. Add, commit, and push this change to your Git repository. Argo CD will auto sync and reconcile the deployed state with the changes to the NgrokTrafficPolicy CRD and HTTPRoute. Once the ngrok Kubernetes Operator picks up those changes, it will push them, and you can verify them directly in your ngrok dashboard.
4. Optionally, test your new rate limiting policy by curl-ing your API in a quick loop.
   for i in `seq 1 50`; do \
     curl -s -o /dev/null \
       -w "\n%{http_code}" \
       -X GET https://apiops-demo.ngrok.app/legend ; \
   done
   
   You should see 429 response codes as your ngrok API gateway rate-limits your IP address.

​

What’s next?