Design a containerized API gateway layer for a platform with both public-facing and internal-only microservices.

Cover: a clear network segmentation strategy (separate networks/namespaces for public-facing vs. internal-only services, with the gateway as the only ingress point to public services); rate limiting and authentication/authorization enforced at the gateway layer rather than duplicated per-service; TLS termination strategy (at the gateway vs. end-to-end); and how internal service-to-service calls bypass the gateway entirely (using internal service discovery/DNS) for lower latency, while still being subject to network policies restricting which services may call which.