## 4.3.1.2 API Gateway Module
Use the API Gateway module to expose and secure APIs.
##  Caution
The APIRule CustomResourceDefinition (CRD) in version v1beta1 has been deprecated and scheduled for deletion. If you use APIRule custom resources (CRs) v1beta1 , you must migrate to version v2 . See APIRule Migration [page 1850].
## What Is API Gateway?
API Gateway is a Kyma module with which you can expose and secure APIs.
To use the API Gateway module, you must also add the Istio module. Moreover, to expose a workload using the APIRule custom resource, the workload must be part of the Istio service mesh.
By default, both the API Gateway and Istio modules are added when you create a Kyma runtime instance.
## Features
The API Gateway module offers the following features:
- Ory Oathkeeper installation: The module simplifies and manages the installation of Ory Oathkeeper.
- API Exposure: The module combines Ory Oathkeeper and Istio capabilities to offer the APIRule CustomResourceDefinition (CRD). By creating APIRule custom resources (CRs), you can easily and securely expose your workloads.
- Kyma Gateway installation: The module installs the default simple TLS Kyma Gateway.
## Architecture
<!-- image -->
## API Gateway Operator
Within the API Gateway module, API Gateway Operator manages the application of API Gateway's configuration and handles resource reconciliation. It contains two controllers: APIGateway Controller and APIRule Controller.
## APIGateway Controller
APIGateway Controller manages the installation of Ory Oathkeeper and handles the configuration of Kyma Gateway and the resources defined in the APIGateway CR. The controller is responsible for:
- Installing, upgrading, and uninstalling Ory Oathkeeper
- Configuring Kyma Gateway
- Managing Certificate and DNSEntry resources
## APIRule Controller
APIRule Controller uses Ory Oathkeeper and Istio resources to expose and secure APIs.
## Certificate Controller
Certificate Controller is responsible for handling the Secret api-gateway-webhook-certificate in the kyma-system namespace. This Secret contains the Certificate data required for the APIRule conversion webhook.
## RateLimit Controller
RateLimit Controller manages the configuration of local rate limiting on the Istio service mesh layer. By creating a RateLimit custom resource (CR), you can limit the number of requests targeting an exposed application in a unit of time, based on specific paths and headers.
## API/Custom Resource Definitions
The apigateways.operator.kyma-project.io CRD describes the APIGateway CR that APIGateway Controller uses to manage the module and its resources. See APIGateway Custom Resource .
The apirules.operator.kyma-project.io CRD describes the APIRule CR that APIRule Controller uses to expose and secure APIs. See APIRule Custom Resource .
The ratelimits.gateway.kyma-project.io CRD describes the kind and the format of data that RateLimit Controller uses to configure the request rate limits for applications. See RateLimit Custom Resource .
## Resource Consumption
To learn more about the resources used by the API Gateway module, see Kyma Modules' Sizing.
## Related Information
```
kyma-project.io: API Gateway troubleshooting guides kyma-project.io: API Gateway tutorials Ory Oathkeeper Introduction Istio
```