diff --git a/ansible/group_vars/all/vault b/ansible/group_vars/all/vault
index ce11c56..1d88287 100644
--- a/ansible/group_vars/all/vault
+++ b/ansible/group_vars/all/vault
@@ -1,306 +1,306 @@
$ANSIBLE_VAULT;1.1;AES256
-33636563666434346633346237653863333636613037643330326538346433386534376566626239
-3935376664643730336533343031613262336632303836350a633165356661666465373334653166
-61633332666430643236363333326361373136353964356538343063633366323433316430646437
-6261303837306339340a393861653064393930373766303333333639306338356230613339393565
-34633833613065626566316331303336363863396662303830633637633037303464343966333865
-32636363366433666364393831366462663062353934616237356361363436393535636361633430
-39376137353635636436633436646230336265663637396162323262306331613330306237303238
-32396265643166303538333965373838323631333263663365343137336263336135313862356432
-66383263643064646464643131646231386334633761663761376438346664396263636533386631
-35653864613234393838663430336663346235623330336239383330613033656665613938313039
-35333463343739363836366364643264626238363639333230646162316538343038656237646464
-32323333613135663330323330623939383165396362396530643866656661356164646237613365
-61613635656633636339363236643637633633616330336338336634373337663233373738373663
-34666130623939653439333363323836346436656431356166623534626133616532303761306562
-39356139323666326663396661663539336163303062646362663432366136353561323739663235
-32383836346439363037353933346136643937393830343337396231386661626337313937393931
-32633063623637353665373838666563336263346432343938336462303833313862313233343766
-64626663653339663366333634303033323863346235313330303137326139633436373732656238
-61346432666564666439623937313830653632623333353566326264343831633063626335336538
-63363139663238366666373033646439626166333031303764373765373861653933376530623361
-66336534643231376230663638636335323237376133376438316262666438353232396637393863
-63346133326439626235303232656164393633303766343236643861313062383435663737343761
-63333466653636626163633264393233326663336462376130386461663231616533303832623632
-37333861313631306636373538643534613337626662663131613038366365386464383336303730
-39396464383266316464613430633734656564393135383030393364323835393238353862366438
-33313664376336636237363964393130326237353430613663356239393136356638303566303564
-63346332363062656162396561343864323435643931373936303637323063303433643133663730
-62316434306634373336643037326564613365633630626464313135386634326332333931643466
-31626365326337363934353961343237313363316431356361373563623035613931326361343164
-33323362373637373735663432313762356361336563396635623665373861323639303063353434
-62366134326238656636613861386665373933393461313564396538616464643262666438323466
-35623361633433356166303237636266303961636164663936343930663739626432636134373161
-31613163653566663739303664343736656664633535663130373065333761373565643838636464
-30323436366662633832356535336137383431313331353535626462353936333637393034656162
-62353166346433313139623231613834636537316236386330323662396266356237663932303138
-64316665663465376539343630633834366430386333333263623435626336323561643839373333
-31626261643332336362363662613630626538663361623739303830643936376463386464653063
-66643739616366616232323930666337623164323764303038653165643238663266373133356531
-31353837626536383636633063636336636637623839666636343033383436616534383538613434
-63636139323531656136393665353266303261633366663563366535336635333037323937333930
-63643436643361653464373737653266323933633239663165346234393062623736663262366664
-63646534663135376335313331353639316162393163643162373163643132376261313463376633
-30646138613761656661653739316535326630613164356635396138653564396238333661613937
-62386265313666353664626636616333376431346334626538363738616261326264303533633633
-65623164363866303235313935386533386630393733336435323530326461303435363838613136
-37616535653539393434313535656337336130643962316364616366633438376465343937323431
-34383834386537333163306166373761366166643235393466383933633264623166393432333731
-38386230663138396530356162336636646663636536376164346637626363333133346336346138
-39363835386631306333643830356130636339336439623463393632633961343439366332653135
-62343465643231353333396130663563343039346630376634306137616163616135356466396333
-62643661333664363437613564353635383365633562636565323062383738313631373763656633
-61393362393063666537653765313164646535393738343164613162396663313133383166396462
-61356562343433373036396633373135346338326164336666373933353238386263396134626166
-63373562626631336436616264333936623463343662306633313238613532613764346337343439
-33663238313665303061663532653163383535356230623535643564303232336262376134363139
-34306130313935383039373964633233656337376533623835346332306161396239383939383034
-35393433363961633262663130643763383336316235343261356562643339613831393831663033
-65326562623239616366383331393336636333323331653230653266666165353033373965613037
-61333939613634363336306463303136303730653434376630393066653539626430623436333536
-61396135396165643934623162386434663863336533306332376266613766356535336164616431
-34646438396261383030656133313935343365306365323762306534633237366338326632616234
-37313435653166333835643066396162376230306534303964646534616166383932616339353236
-61643136343230633934646162356363633737313731326639613538383134306165393436653361
-37643536613738373536323061643038376566313836393736636362303637353339366433653963
-63393830653332656163373231323432396361353064313033656234383431316232343037626138
-38663739636637666563323439643835393365653137303362343537346535613765663661393430
-33636334656530373133303831646464363133323064333865376637366338656236316464373162
-35656531653831323932353637633064386466353539373132656133356233366463626266366237
-61373461306361353738623135613033316537623533306264343838613730653534386333306633
-66326536393034623462653065613239656235396431643735353061616134386362353234363736
-31376338323630373663346633386561343932316339626264663462326161343331373163303735
-34643566386562393933303632383230363936373263333632326233643663386631316235383736
-37666664396233613261663335346464346630356535646262346563323937366665346533356361
-61616664326635663833396565643437313236346136623962626433373866616234613131393265
-35383439303233623062616637343235306531333666386132656634383338346262363764356632
-31633233363838316665323062333935336466373565313936613461313739316161353639363831
-31663063353532626164326562363832393166623835663061386236616365613935653462386237
-61646638333165656230363864393138363332343132656333303238643432316136336463636662
-35646438303461366433393934663537656333373462663339303962333838643261313962646163
-31353132656334323663373335616366636636343133636134303936313264313437643038663966
-35663335386466333064623737393933383936356162626364396339373466653836323265396435
-38346436366432316530346665623939313633643963333130326335613736386463613739326265
-66613739366161346533346530303936613234613262633234646166323862633163653930666431
-65333165313430316634303034336361393564623963613165386337356266326665323135653564
-30653438636365353061303666653862306335373039623435343933393166653062336263646332
-64666634613535343733656261656165396462643533346461333237343739636534393038323038
-61383537626134636535646539343238376566376361386236383936303535383738616563303165
-33323139393731323738393139623833613864353761353437363730303336303564346634666332
-31616532636332613566393532383438306466303038636264306165396339396432393039393133
-32303135396230393030333633383830323539633235346666333661653361346664363966393338
-31653865663933643536663163373433663263643136386365366238336239353235333833613939
-65383538336563346432316231613363613530393761653530333732323964346232333464623734
-63303236626161663436373265643733313964663237373838393136356439313036613062616361
-38366665396134366335626335353835663132623864613034656534366265623736666236663532
-36393465643734313036396139663766656132323837313637313136383538336263666539313033
-37393630336661333036326132356130646263636337336265636539643965613966396265383866
-66343739333834666663383263303261333530616563303530353738386263333235626231346237
-31366631666230383966643733323764626430666430346238393661373163373439393530663739
-37376538306232346161326363313734643733636362643235363633613465623462623335303130
-30336166643635323633396362323365326539653865613339386533626537356332643231363731
-37626366323466613830633930366138313764666333313866633638316339623764643431343837
-32616435383966626138353366323234393635653461346331336339373137383066663261666637
-65643930386332653731313932306264393035623438373461323230383666343565623531656530
-32366636646661363133646331636634333364353133316463316264623462643837386664643031
-34313863636163396661353439306261663864333836633737306363613666633561323565396666
-62303739343731623666303265383236656666323363386563626330356366643336666262653133
-32653266626339326566386135376566636664303164336266396631353337306165303236316634
-61323734643833393732613539326439633533666437303862326566343462343266646634333633
-32346563636133313730303635633132663838626431656137623732373139323532383239613562
-34616566643465346566656661303034313161363862376530663465646437363033323136626530
-33663935613436303239643639316537323432336165356435376330303336396432623332623365
-39383135653163356434303765616335633835313061353336383737356166633166363765643166
-32623338306336663533346537356138343035633766656532613738376333653938336432376365
-31373238613237346265316132343261356534313765323337666563363663633032303334386531
-36353135623334343962646638333863326533393437666532633264643133666235336163313366
-32303036343032383635386430356135386462646562383963383635646535303365626434623630
-61373362333432343438623734623434636366643537653666373166306137633364623963356438
-39363933646562663562386365363832633135393766313031643535306137326363353364373361
-39396666366134373565336134376637393132333766653634646661623832363230303937353163
-37313864353231616661363763373263376139393364663739356262356332323165326538663465
-61613334653465646563623531383836653565343863656261623532396661333836363564393362
-32336363326165323563356137626633376666373639616666633935346264386565346661313135
-62623933376237303136376661636335376564323164626265303939393562313265363333343537
-35363664393563343662616264323637383964313438383766303366333934336461306664646164
-61656638396365626135333230383830303831346662306630356366303630303832323561336262
-35323834383265623536393863643366316230656262343630373639353762613230343565323330
-37303431363966353061663932333262336239656164383832333338633730353961666335376661
-32663432663862346533386638353366633338666538313065626630653535633939313332313435
-34303638306664636531336461363431333132313535343133373931663231653733653536326466
-65386564643633356539343131383461666364356234316365373637316361383339323235326132
-36353964633034333135383364636530346163333865636233303437656231646333333466366332
-34323362336332656463626532663063393938393566643864323036636161356531353861376338
-38653037656339383636366635636534663334396132323462313862613833396166393263646532
-61623966333431366565316633366166346334656232616238306461643132656131383834343132
-39396132666231656235643163636331383761633466613035323864356365363761383732326139
-61343963626639343730383665346534303939326364353038616263616633616238613634393933
-31613630626339626162656536336535303334666263353935633734643162313134333338663833
-63643363353334343935373461656130353438656435613734613963656361386136316634313933
-38323938373732633938366261653833633134623238313639313761393061663261636161656134
-33346237323566336437356430656137666565363735656636333338303366333132643661373032
-62393464316137666530346666623232643233323237393762626164666130366339393565373730
-31306634636530613537353265356662366432633034353431633837343962663662366133323836
-61343361353963323737316536346565616331343961313262313336653232613832346663333337
-66626561306539653665323233656332366166646163613764306533643465663430616530363631
-39373761333434346231353533353463333739386538373631666437316333343531306531386533
-38363232613032663737333034633830393239393635616137636661303334303639386666383835
-62336562663063653462333137646162616166306564313932373232376633313363643562393365
-34366566623164373831393237353830316164396636623830373632316432306435383731383966
-31643763323665623964626338366564613431353565643935613634343735323162303538623066
-64323235306238343234613133616336306331623563343739633965356438613738613735363437
-66653262663332333830623531343430366237363932616631326230326164316239613565623632
-37313961306430663936323737653835373361613766343234313964316436643562626636613835
-61356230616665353833336239623930666132323962363063366661386133343935613837363866
-61613337626161353938363662643161643135333063393936653566656461303561346132616666
-64383965303339613333376438363261343761633835386463636661666631613363323962633432
-31333136393735393735616162373863343236633161373866666237636333646131386661373635
-32353230343637396236316634336133376363666366313763616531666632613363316533663166
-33623533346434666336333132383939363931323038396239626333373163366463663262656561
-61323463653830386330363634623534383133306264363937306436303133326565346161313166
-62383738393466353832623436336236323233303737663730633231656338643836333064336234
-64373762303965643135346630313332643761396135333235346533623535353734303562303132
-63623161353662333232646538643037663535363932666538353932313031313662656466393466
-63366536333762316661623564636335386337393436393533623938636363663239336662663130
-63323762383263356632663466633739303766626661373164386138363930373266303532613531
-33353064636531363131363261633633616235306166616238326166383630373730636332313134
-33636234613833643734343235376163346561393433356334663530316635663738663562343035
-38393930303038303263323837306365323062353561653033656231393930626231343563656663
-61376439363662343366396530363562656232343431343637643264363463393632646435633962
-32646664306237376135383930353666643635356565623664393362633564363466386535303430
-38316632303233626166633131386539643535653361303632333566303165356162356439313164
-64356133366236623835363862653563383031373037366332363663653439346330333734656265
-37363030393763613562363430646134666238626635363862373930646631653431643337653930
-62336537376137396137356330326462306238633837316463656564333865396230303161626138
-64353961666230306638343331636536643639633265396563346339613530393632613864303864
-32623630333439646664346165346136646565303131343061366236336238623565363239366239
-36663034353965336334333139666462623634383863383862643863383063353465353330376665
-37353163616136323732643236343030343538363961653763623736316433373137363232393034
-34393865356566303064306564313031633134353334623437386337356263636236373936376636
-30376537326264323636626339666236343935353133626330386561343963323361373638303662
-63323065386362643163376630636463613566623465373462353937633765306632383437633561
-63366237616362393731343536343164633161373132626561353632313961303564306632326564
-35613461383963323136643363666333653738613636376435303065653533303932333933663934
-64633938613263623566336365363236663039643035626138666666623961366634393438323934
-31303637666166316664646130636332633531643266616630333638623936393631313232393737
-36383137616261613230306339336637633763313939333136636231396661666330656636373139
-33613331356362663631333635316132653637613034326234373137306531316338373566343730
-31333966366564383761636663356638316161653038313263636438323239643532636131383130
-66386566323835343039303133663731346536396134343834376431663935346238383836626133
-38656134666335656661356530663234363463353763373938393164333664313366633739386436
-38313734376130383439363238356161333262303738626533333061346435393261313534363632
-39343965633735383834653162353233343563386266303936616163323033626664653032646337
-63393064626633303665343432373666663331633065373166336436663838353663383530353062
-66666334363562396139333439393439393030616331303636346136666432343365333031333762
-34343566643434363536616330633234363330653335323965396337663061643832336261363732
-36373434323739343535316362383239343836663736616162353133313637383038646432323338
-37316631623862316466653833343066313435356264393232666364313839623135666262343930
-32616639343238343164343566333732386432643330333331323162356364636638316165353431
-38653261313839343264633434316163333035353865396261633662666239616130353364366234
-34656132356665343733643738623237353535316236646135613234306262633564656361306366
-35616232636438663961333439306538303133613566306464636430363536316361653731616339
-38623536343032346537336234613562323232353966623738316264313135666133313034316263
-62366238643262366536636663366438313262313965313137663036623832616232376366653630
-38393762663961396130633364663234386266663634353563303738653238656561343531343937
-62366236636662363262613137363436323266336136306361666561323866373465636531333264
-66313461383437303230366636663066336638363032346661626432356434616331623130653237
-62633062316136326366613331386237333135633064313839316265393865333138326166386339
-38353036393530386566663264646433346539306534616539363264343566636263343138656137
-34633837626439613230633134343132306334383233666431313064643561373739313738623937
-65373162333862306334643236643137633262376364653036303033666461303066383338373136
-63636162373462646436363836356331323837623465636365646536646337363265643861353238
-61353766343731363165303263633764666663643264343562383065343439626532656138643766
-37613430356138386664373963306663366561326661363035353133653761646161353037666531
-37626638323537616363353763333661373631333166376564336238396339653565333736376336
-63663737303936663562626563623933656565346331623738653762303832636365356661363462
-66373335343237623535376362346362323332363365363863336434636564656338333036616433
-30356133616533346539656161616237393766346361323737646537666638663934616437663338
-34383335306430646234373331316261303037656138366437656637323635373734313633323736
-62653631393365356461643630663431353938316665663865613633373834303838373834303164
-35376637643863336233656564653535653136333766353935393765303137623461663331366361
-64613737613230626238313163386364663332663838313634303737333666363730343464363466
-39333137626436303563316361376363663531666632653137383538653165656233363739636236
-65303664663165333434313135663861313231303462353465313965306364666438373563613763
-34643933306230396537363831323637393061633763613566356166323862636137383035663532
-39666631333738633766643239633065616534383539663036343665386230356430656564653366
-37633937303963383834323461653435363234376164383736653933623835636134623937656638
-34383862383630356233633066376264303234306431663636333965653663623931393236336332
-31316662653537356633646633663563653032303439653235623262303135353238306631333466
-63343638326562646339663238336562616332666534306631323865373531373738653138346564
-62316332366566353536303036663134343165656637333432333039646134623937326638646230
-66303435636535356465316635363338663266626339383163356133313461616137643131346530
-37376366363530346639356239656362626566333261663439323539613034373439643737303836
-33363939303037353763343932323864613133393063363861306536356536616233343235626533
-35396335353835643038386138623335656534643161386439383239633636313135633039363266
-61373362376334653636303864353437633064383162306263373030386637646632633062633938
-64666265653635393039326465646331663238643838626238656631303939613066643961656364
-30373131343661343731376262386564343464306537363530376262636665643936313366333336
-65393364316566306539386361313534363835636363653063386139623032653939613632306130
-62306531336234613033663233343332393064646265666261636265633434646130306139316436
-65663863666136313932396366303637326464646665633261636538306466366662396466373832
-31613136343735656162323762343837393333373832663139356531663965363666313763393638
-39656430356666386565653030363163613530626235313963656666613737653036366133383730
-64363062336562633739666366343930653635353331353636326333393538326362323665633364
-35656239373031653938663161363736323731633865333163616466366164306336633764636565
-65363262323361353139623661663161356232656461336464306636633736666535343833393437
-63306137626235306336663336343065393931613739633031326432366662653330616263653837
-36343637373636383130346334343562333861643834623332353833653666363839613334353237
-36303335346565326331356463303737393762616337376263356338653731393164386234326366
-63343435653137366630383761666236336135303739323839383238376237663836383138616133
-35616362353038653865643834663837643533323566383737303566386431396437323739376165
-37653861643836636563343562303738363738326437356433383562323939383438393964663263
-36306433663531373133343232306631313431656361363565643164346465396132366433323633
-63333933363633366435633731313738333865373330663361376637333564643163616632626636
-30386161356637643862366433366435616534656663313663643566386334346665346438326335
-30633235323365303935326235366363383833343066636335363162373863623632646566646436
-63616433336461306634396464393133333637383031643662313434656539303361653939323134
-33376434323636393636663937393363663638383364613637346365363932366632346666346235
-65316665623265646666366238386431613466636663343633366362366666663837356364323161
-39373534323536656235386430303134626633336633353761653063303638313338303433616333
-66393562653230636334613063663763323764306231303337323163613039323335643134633537
-38326233366463306535353961636430383439346637643036343165383462353161323234333330
-36363264346266643835376634373062396338316334646439343462616262316363616632613734
-32353839666462656633396637663562653839303763313637393432353465666133656561643164
-65363933643132333364633036633534303061616630636133383965346165643032356137323831
-62393438353937343838623434303935306666623330323635653963313238366335613434646561
-61333334393061663338656337633561396532363763396663336537316339636437653065346362
-31613539616539656233376162333033373736646365646137313033633464383530663161653662
-35393561373131376366353039343266303336383234653862303436633365333563653732643635
-65313936303039393063613462653333333265653161303837306534303032306631343137633837
-30346266363335656238653862396365323434386137303631626162613437363236353036353563
-31303838336331623738373961353166316531353038336662383436623539646464656135633934
-30386530636664653430306265393065353962653961623862336563353861643863346130376161
-35663865323732396230663435326636306135623734623063396162623536346239393732663963
-65393463363934333331343761663439633039336230386562663630333366343633326632643839
-65633864353138306263663561633530633963613630643737623237353062636561623039356333
-31343938303939306263393430346664376636333737633230363734363863373330333661353562
-35623531366530653435653234323839643231336663373430653866313764313139373234323637
-61663535383464616134623333653435356633653661323232333933376566623361353330343964
-30666233626563366334366131653365626363366134363432366233393264633738333063333563
-33623362383338323763373463646633313630346139623864366333643932356336366364383835
-39303964666239363164383931313336373831333964623165363430393639636136373334623566
-35353936396163383032636265383764373764313334323434343662643064356665616563363861
-35303934373064316461666232666566656435646636633238336266366261373763336235643130
-31626363373137633037666464623261353831646433396639613030643266333961613636313432
-35383036353534346532313131313736663966306232383231353564653532303565663736303438
-66323466396463313939396132383061616635393733636361383339653037396162623965616163
-33663034653538353661356136343733353232313637613231316536336262323433393266396337
-34353264396365336338313632333334646536646461336561323837356631386161313962303134
-32336163313330333164373232373335346237656434656330356461353163346538666534663965
-35653937363339323561383330353133646664646563346333313863643162353031653635633536
-31383637663366313265666638623965633734613832396531303530346130313761633765613935
-34333336306631613339386539393330316165663766353938313432623937363062323064333934
-39626161323637666630663462646439356438393237363330303031643433653337663864356433
-33353363386566353064356166666564326432346437356636626535653930366236333733383066
-62393763346438346364363466343162303131623031383835633065613966336633313362656235
-61623735663737333935636532333262633432646138313030623964373335343238393334353035
-61656132373133353533623965366539326362316537323262396564353161616563306330626637
-37353566313664656566303937623733323833333532393637623438383637383035313232666461
-37653766386235666439653962626465333563646261396337363538323836616665363232643932
-61663535303463373436373262623062633562623436616539306562623136376361343035396466
-64343963633762663239616333376661346230646265326565633361366132333165393438643038
-38366163336366396437666234653262393536646662666439613532666463373230386131363734
-32666233656432393466323437623638626136356366633330356164346330383934333736393662
-31613564626236333933353837336634613863613066396535343337323066386335616565376634
-63383161623637633736313532376632366539653833356539303238663830326635666564613632
-3333
+33333438373661633337383161343862383963623736636136653339363064386538386437323135
+6436666330363032616365656434356161396530363363610a333864313064633232366133366232
+37316636366334346536663337663065303635626638666264666435393933343832653061323237
+6663333736386636350a653931626665346234323832393334373563303130626262646565653231
+30326263623965356639386438636531306430343239313162383065386135653534636134376333
+64616432303732646535643530353963363734663538393539633034326535643539356561656632
+36363330346131393262326561356631343631356434666264616134643136646238376336373665
+65346361636435316437353235393263313766623438336662353532306463353134366435326364
+36613865343264616364333631353238663238313338333232626262313637633662633163366638
+61323166393739656536656435336538303439636561363961353832313431666432393463636537
+62323939376265353330356334303334303532643136376531343765613738656562386665336132
+36346232313432396431666535663362333332613037623531636135376439393936353261653863
+65373061316461303866363338376131343736323933383636626338616431656533363833663266
+62363935313262393733333566386337633630666332353263666462373164346362313034636239
+33656462396238343065613965613232623132343562323364653366313231323531326364376631
+65643961303862653030343364326533356336393031636437393465636263626236303633326139
+65643432663037333332346261323663613031386563383533336538383133373332343363326530
+66643231666636366435623639643166333863376533633537363364396663363732333932663333
+62333239613264353233303064333931326236396538323130353061366139623362393734323434
+36343537393363343861633131346561353637646336313233376162656561623362653565623339
+63386337613461343534643964323932356661383436303966346339386131336133643132376330
+38656535353335303966636235643666306336396435636434363733313665366234393032333065
+37633231376134636435343233363032666231666134623365653238373836326237373831326262
+66303234303164303961316166623062616139353264343864363938313733653563663661633535
+37326636346435626362336437666364623264363565653935336438386262376663303230313265
+62663665666132313436663330616230383235346333623563313262376530356535613263316436
+35313766363763386234333733636464326134633136346532346632623534646365623136343363
+30316435613031333036383835656230353430636135343961356363613139353763343233633834
+38656431363139396535653565633631393462316334666464333839343035616531643466643531
+35613733373331643961353830376266376433363938373563653833343464633465663766333066
+34633364313762633034633461623232656537653762623532613332386132333365383062653136
+63323234626266336462333534636236653230343530336532653831313339613531343731313237
+39653737663665373361326433643364656434393838326339636238303964366336363961653366
+36643938633635313432663765316130326238306163346566313062626439626263633033623731
+63323532346366653238663931653334613734633963363632643462316130393138363436666532
+32373833323330356164626332646232623031326365653765336261323661616137373732356164
+63383633353764643233323430333233306337623834353934643864636339646239636430316166
+33643030333261323461643031613730343131343830353463313766353035326436306566343161
+35643534323763316165343832346433356364343061383036306434386631356537363331303035
+34303430393034393763343964613935383739656662643066363633333839396465386231383837
+30336331393365346636363732616661633635326364366435366466383639353839343731616365
+65326633636263653438343561633632646234316461616666363630333966326230356331373335
+31353665626233663433633563623765343431376639316232346666663065656462616438663333
+62663662336662346563333935333261626635343764356631356363356362346231306535376466
+36393932666662653934626134613065623461303834393231616332363461306534303666353632
+35646363333065356631393863396536633838343365343238636332303862306631346639656166
+30373735336361653863326331373834663164393863666631623866353338366561326635323132
+35306535626564376666623837666435663337613164623966306138353161313239373436346239
+36656266323233636233326139326266346464353665323465663666646264613466636132626464
+37353762306538643233663338613062353134323832653139663036666337643131613062643936
+37633363376365356333353433613839653130323036643737633163336531323032393937333432
+39343238396534353330346664346135326333333638666261396463656663323935643337313462
+32396137613432623664323134356361323861306230353165663162663732326563626162346630
+34626536393962393764393764393234373138656432346332633963393135386238313563353761
+34366438353337396264373032336166663937343931633635666166343638386237396333626133
+38383766616566336163363931393438366566386565663938356630366430393830653037363738
+30666465326266363834653934643434666466326632366463303965303366326364316430366561
+32636631663232373163636535366333623261366466623262393631626334626263656534386536
+66323833353264623538663232376138346361646362313565333534363535663031643833373064
+38313062346339636335633962323933383230623634303431383236626166636535326465316439
+38646636336130373763646635386265373065326263616438646565313439613830316135616435
+62326430336337643265306261343036653938633634626561333664313035393933646533326661
+62626437306432353938356338616462663130646530623636393233373837336138383963323165
+35643231613565313434386163643637633130626435376561376235346438303234386637383835
+37356238616263646665336435306233396436666664396532373063626162346237376662393639
+35373665373638396434353062666430633362653163633639623836346438323632643164653638
+62623463343465303236346562386338646536656438633966643430343266313935323630616633
+62313531343764343966333439343866613965303036616634363162303434643533366465313562
+62393666313838313938356265633531326431333730626632343139666338656465306431636162
+66343532346238393464366134656334363964626264623263353537633638346239396539653538
+37303339613036306533353132326534306433353364613536316263326363323134333639346236
+39376263313431666462383863336638306631663563313364333235333338323364613361633532
+38313263353539633662353533646333353262356436353938303036663130306362303935356136
+63313234363138383864613664666635613464653765636461383738356135623662313866383036
+64626437343465333563346434323762313232643230323336366539326631396463303961666461
+61656338643532616337653362636362373837373836666535633762343335623033316264366261
+62633137356132306430623537616135613965393737323263343463633839393165646630383331
+36616339346534346636396532333836633436323232323364303963313030656330386336633538
+34383534313236396461653462306130376462396138303561636331663062303864326238303335
+65663832333631613963326639386665643135366632393438666361376334636233336239633837
+36383761616364363262306535653065303536363066316431303464373230326436336661396231
+66333438376664333731333630383031366237396638326534636532343535303964653436633438
+64616263366561653334346138393866353437393037343930623237326231303261383733336232
+37646533393439653965386563333232656565663531396663303334313839323361363864396332
+61656638303130303433666561646663323139643337326561333832373538306236326538363637
+38666534633330653564653066643335623938373331376339393338343533366436333330313165
+65366562386366666632653064663637343536313462326562626436356363306134306237613265
+32366338643237333739626331393763323934396265383138633035646533353536633866313432
+38336137383036373434363530353833653938663035306337643638316463373762613931373038
+32373361326136616331663733616133623936663530356566383461336334663937383230386462
+38656332613763653339363565613762383735333163633831356364333563363630623666616430
+30353237653730613361643233386139303639666137653733353334326530306431376666663664
+34633531393261343165663330373961646665396139323762313663376639366464306533623333
+62326432623334336166656565656230313063656163636561326632666438633966323930316264
+66373866663461616336336264356561373232313737353836646632383438333162383832616662
+30636437613163613631623165366631306438643765383263626133653231333361383633363136
+36653831623562653838633133646633393038666164346461333531373034356435363336636338
+62623464376264363537306166613461396630303039373239656664396564333435303164613235
+61346238386233653462616632303337663036626465663361636130333566303337313237626237
+65636633316366343064663636383362316665633263633136323563363935346138356635653036
+36383835323838366363363335323731333066393334373265653563336533616362633163343661
+66326630353537653633316631343332303231373630363635623136386537666434383032323165
+33333633643064376239346139633664633330323966366430353135616633633465363030386665
+36353164623564343934323063313763316566373830643163616633643937323732333561353832
+66623364666335316230346665353631663465633034323265666663653866623037353935393262
+61623065656637636666383239343661616233396663333038393963366537326136653863333235
+65633137626134383763663366396438366634313465363965343830333966373930333134353339
+35396538303537316636333339613731623636646230323662613663306537326566656666323434
+65346531623533336535393530373963343864313963666335636334396663393837396665373565
+39646138356134313732666633663061646330643438393736653433313238373135656636643337
+39396362383363333434376336613933613438653636663334336337653633613433623336623461
+32373565306435646438306365343465653863656434663937653938393839333739363639326536
+64303534383961333333386237366239386330386533343939613664363439373135333731393739
+39363166306636333766333332393265613133356262356666343039666237663664636266626664
+65316339323638353333653631363365356562623535666235313234613236326130616261663830
+34663063626539363734313562656233656131326265626637353239636638396564313561383761
+62663638623135343333316464346236353364616239633566393039633339306334623234616331
+34366435663938346335323932633330366639653636336636373562306561656536653363366233
+39383064623435356338636335343662343435336564363965646439393964323162363736346637
+65323765333364353831396433666561376437333834313334316165386631616332633533666336
+37313533623535313934393230353439363231623063663961376537393638636237623134323337
+30393032333530316330333736616463633262616631353238323933303766646137386465643366
+33356665396437623732373437373537303034353431353031313162323730316566396238653038
+30366234663037653736353137376264363934646366353761323364663538346662323934343266
+30373662613461663561623466633939396439653663353365346133623933613462623231616562
+66643738643661643766323266626266313330633936313964366536323263373666303130623738
+32323230356665323439646532343930333936373536626466656566363161646663616266326133
+32393137663562613531323832313565346632303131646432363961613331346636653830323136
+36323436373964313737313131346131353630636561636639316464323666636336656265343565
+65303936353165326137613638366532303265356537343337656165366663383961643134656435
+61383565306265333939613561613035616663336361396536343939343761663833346134646365
+34323233666439623436323261616432363838616437386138393735383364393164646638373630
+33386632346239383037633132636431366264383633333365306338333661303662363533376339
+62633663366362303038616666336335346332316366353136323666346531393938666236343163
+31663665643839313439663839353431343061386465366331663637373532613266383065393639
+62613565626135363133623261333061373738633333623337396631356332643039306638303434
+65663762373630323263333239613939346133626534613632396433376234663636363062656537
+62386664343462346334663662663865653766373738306438316533643962356136653565373761
+62393437326138323065396630653838326138653865643937353431656137393732346361353734
+31326634653331353232633061303230393462363065613832303630383237366463363666613864
+37643135303034326335326563353064343835323863313134616262386564313235653762376332
+36636533646235343138396537623266333566633466393764353731393935306432313266636133
+63326362653033613264333139633638643638326532313239646239386332323330306538366362
+37646432363535396161336465376363343430333261396536346464356135343462663462613136
+36666238633663326230373834303431336566366666666534343537313635366537396262656236
+36646639643730393134613662383238623835626230313833653932303832323366343765343434
+34363033323836663035363166313630313062663162313165636138373261386636623831666632
+33373962626237666130373031633437653966386561363232363332333633303961323864333263
+39666230383332376537313137643635623336316336646537333137633564376432356432326639
+61383565313233376435636366366531363462306535636131636163636130663732383161616364
+37343064333264663533343739356139353365386565383833363165326536306431393764303632
+30653865623566363965306636366530303261616663306433393135656366383138356337383365
+36323736643035383231663034626564643235646237623632383164633062326132363331353634
+61653761346439326665366565383534393635616365353361353863363763383664303166383434
+33393732313837373336616564343864633330663566653933356237613538653366663838383132
+33303437323438313837616134616466626562313262653866313034383764656566373331343738
+30613062303630663365636230396231313065356662376163353632613564363066316239636434
+66356535386263353737383838653538316366343935323337386561353533353161636538646363
+63643739376366326536333261306263653563353331393133323964653764373932663136316335
+36333535626231373864316634613366353535393932373039646161646466363663626561373033
+64333133353931303361363466346666376431363336323166356162363537633536336638653838
+35323562653138393833383130353232616564393738326638366565616233633634336438303632
+30353765623565336330386335306162336662643466663335623836383238316161633339373137
+32393165323735643034633464313337386362363331353432363233396538393835383933313637
+65656330383732633537646361666439303266653165313233636464313964383639346635376538
+64633861623439626331643431326336646135656539313836323135373862316438393237663564
+31373135356135356662336265633862343435356530393835376430666566653036373338636332
+64663230323361356262356537656262396665663538386664363735646234306231613339636338
+34366433326535353965376236643661646339366566663531653864316533356466653864373633
+33363330333765373662646634326236313434383433653563383436316635353461386662646165
+31626566616163373137326165323066646535663766636265386435633965326165303831323633
+39613139623835316165326138386431383530383035653931616334353235636138303761383037
+39336163373332346365333935656563343939623335313461363138656239666263366236663464
+32303732663937363964346639323236623166373334386239613564643834316536363634326461
+64623939363635613863613065656363303734643766306564326437663037623839303734393036
+64326363626562363934313930383766383462663766336666663338653765656137393362643366
+36326336323638393161353464396637633566383262333234656233653334623131323532376637
+62613064626532616631646232386631623839326665346431333232333463373031316237363462
+30643731653666643331643839343865646437613135346363646131383262396134376363303335
+34303164303236383139326264623462363062313139653465346435336163653863633764613631
+33623666316530353163396539323238663935643764643939333966336137353034663164643733
+34393132323339626331626532643266336435653636353930393738363134353661653636643263
+30313138393263383837333438356463636162383938396137363035646433663932613066386138
+37316535373939326131643930353435383232623366393630663463633233393232373730333631
+37623837373533383462323431323335316231356436303239313535633837353931613730303363
+31613765626466636636613366346166393766373834643337353764666532376335376139316138
+38646133643736636363363434306334373933633264366530373534666637393835366266306633
+66653966613136653936313732396366323830376236626530306139333030323966383035643733
+36353833323539393136303035393866366563323430636336356639623734656135356566373062
+34666433316139316664643234623530363732373338623162363636303463346463323131333065
+64656566353837336266386233323439623237366364343635306137663038326434366531623062
+64613365323339613465326464653965613439653766623762363139366264663765363862323839
+63346539323961343532626465363266626234363964313531353662636635623165376130616536
+64363361383766636333626366616531343833633033643965626435313130653938316430313532
+64363731633139383236326231653434663132313463326563393739393132663765396337643035
+32373963393830356362366130376135353935396631393533333430363531636234333832373939
+36656233343663623262346337323034653036373432303266353333626434353137353939346665
+37633432303162323538343339643635636464353333313063363662663033396630303162333639
+31633537373364666234653938633461343738333464653736316331343038393333643936646462
+36373232373962653031333730363166393463313232616631383233386533373464366465623335
+65393462353638633931353331313233356230303565313030663739626230323766666466326339
+35303361383065353333666161306433383139366439633730666364383130316637633464646336
+66643065303934663765623233333261313939373236396136366566306438626439393163636430
+30656334663361396230303239663338373664346362623934313130343064353435626439356562
+35653638613037656133313765313165333066353732363361386234353635626563323932356237
+31363333326536353536323931643739333764323637356164663566343563633761333462383735
+66383134646139373130386366316532656139336231303931656265636130643130616531366530
+62383132643236623835323362383866613765343762333536333365336338373264633130656438
+36343331666431326530626137333665623836636136303031333965356366396239396534663263
+35343730303534313830623430666566386564653036356635623038303133623231616635396463
+65626137633033663631373366373238353766323533643462396562633164633730633135396266
+36316362353964306463336237383232306530613539653462326137383938333638353038396132
+66343265643162363735663235353161393732326530373735363662633165316265323065396163
+31663761303637616566396262346238366631663562323566323364663464373930373831323630
+39333165336264336539353634633936396561626363353466303931343436306636356663346438
+64373561666638656439353964626436613164643663336336333337393332346132313830316430
+37336139333539316639646337383737373530643533336133633135333936343165303764623366
+35346432656263396439663635653066303861643938633033393334336336396133626237336432
+31393061653839653964613239353336653666366163616163616230396661313233613934326339
+36333733663032613633613037343337646237666565316239303231313163383264376636336338
+37656532373634383132346163316337336534316465383531316465353861633062336235376631
+33333963313730653164313866323461353334653231333762336232366434333631396135333466
+36643362653137323934323966303734316334306133656139613763336431323236643264663530
+38633730346531396435666530316563386566323737343766653135386537393165356264356534
+62323962306332393063313062313230333334353833393362656166353638323366353934656263
+38633531306438663134616262323332323338653361356336353962376331323537623734316532
+35306434383336633436656437663765626530626535383464356532613536356533646332646135
+39613030323432643161366363313262633261366566613931303663636262353466313933303162
+66373535353934626135326439653630303437666535396266303532626636613563616633623237
+38623938323137393065616136376663363234633735363264356438353534616338393832386337
+66663339313062613766666435626364353935643932633233643630323464336135336339376437
+30323536373639343738613463613466396335626339343135306666663931656564393664643761
+65396336613465313035396134636438636134316236636566333031646666383939383264303437
+38656337326233363866336363363161333236326137393465633935626165663136316661316131
+66393764313130373766386235663134376239323037373365333730643336656532316434663265
+35646664383338326366386536616339393938336539373762643839613763323434363037326330
+66353738643735656165396138343262653563353934376237366564636638623630393238373530
+39336335303564616232393165653639326166333536343966353933633365326539383632646639
+37636238376137646239353731343933346562613630656130653865633834626363656231373162
+65333662653962373139633466383834626566336234316161633038653137393266393564376439
+62343365666637396639326438326631613664666662653935346230316632396361663038663239
+63336335643665353162393330623635663839666162333561376265363330383530653733333239
+37373665646562343562313764386534663239636130646564333433313661363338326439363865
+63353064613161366461383862623363333637633430376361366566383332636634646630363139
+65303139396539323336313666336362626339326666343061303431356361343438313365353431
+30303266363664373233303231346166643839343564306363613236316665306437333636343131
+61303234666664323138376335623639393939633836353664343232316630393263323233343366
+32393736336166323166616139323066613062646139656236343233623630616262343034383631
+61653662383537646364363764353335333630353431633534313731633265626263303863326565
+37616534303164316162353165396236656565303532326235393237366434323739633662663261
+33383635653734303233356438636132343731383439623463633732373833303339353662386435
+63316138353766303962616435383138373739383835353662613666356565366237353932393263
+34326561613234356537343234303166613534356134643766383332646263623430653632386365
+61376165656366366532346465343932313032643163313362373633373066653036346238343938
+66626133306163353966386662363039323166353330633239386264306337386361653430633838
+66366636616661313939316562373330313564383033643035393738353939613066316138643238
+35376336633238636463376234376364386464396461636336313562616361396435323639666433
+34653139613962623235613035363634383735326564333332333632656237333238356566646536
+62346435303932363231306634643037623935653235613330666666656433396463656231643364
+34313235613064646432633935656231643162363530313761303339323830653564303963643532
+39326163396461613161363031616336666564326630323465663831653431353566643661656435
+35636238633663346139343732353233663930353664623636303134303633356232313063346566
+30633762653239356131613539396435396235326431633062616436613266353266636133656531
+63346533383764393733396436306136383830313265656539376136343536353737313365333865
+61653665393037346231656663363432666332383837393264656231386435323333376633333265
+39633563653161663531303330393237316132653339653531316538316534353334383161623833
+63656534643833656366623031326132343732663536393636393537383338613462336638626334
+39326264623032393661303335356235343736613964636261633038333236623232613633343263
+34363865306233346433393664363038303464363834313463636363366333313433333930336634
+65396232663031323965343336366339623239386566323362396564333932336134336231646430
+34376236636536626264663532323530656634333137363431313339643164333236303337373639
+31326131636161386665623838303939616337636666346363616465323263373061633832363839
+39343131386333666231643931353330343136363732396465383336303866623733316235646234
+65613531613333653231666234353532313738363266353336303564613061393639323933646339
+64396334396431313563326136656539613535663334323330326566613264393965623065616634
+32313333663535313531343363656230656334346430643365363838656430616366653766333136
+32346137656136666432383934313865613535303962333464316465313464333233646162376165
+37363265316139643332393761663164346537663064346133323661393030393533396633646134
+39383539333364626263323364353764316539323162346434656234393562326133613632633137
+34323537393838393534643861356365376461636235386638376661623439303832643231616431
+32663264306166366336396130326435346432343732323764346232356439633361663937313233
+62636130663238333433396335356331653166366130626632663162653736656238343134353134
+39373663633437626661393734363264313137663138643665353633366663366562386337396561
+38383464333531306138316266626461326531616364303732343337386464366464633834383439
+66303334333234306166396235666164313833333164356561663063326563303934373933313334
+32326466343761333666373936373332663939643662363665323534333638316637666665326564
+63616134623530333739633265343637626561383831663836626538313539653536373165636133
+62396432376332356133336461633664336264616566376664643861363838313766393833343366
+31386636343835663062396232646663363935396366343361633462643734373437666331383035
+30373963323834343138653063313635643062396130373861643134363062363135623730663335
+34373935623239363866393932363966366233643732646461343964383563393064396331353331
+31646662323364376639316562666465356438386637393130616330663563633839326661643239
+62346633353963336239633738336431326638626232313965336361636430323739653734636436
+39316363316137366233616431346639663335393737653562356532363634346237336266333132
+31343836326538653164653163653738656238326366313532613433333337383263646439326661
+65306135363138646665363463636436303864316432663734393130313932643833356161373139
+65376334376136313237393336636630643933373165336432643233306366633663333930396364
+31393739333730326434313639376365356432376338386430363133666436643837633533616333
+36363464633233343130656163353137663165343064373039363439346631393436393430383361
+61353563346531353561303935363531333235313731303237326334363763646131653961613334
+33306534663238343433363237393234643236393931343230656438353866313638636633396464
+61636561333562383964663261316135373235313234613564333333336438646636303561616634
+63363033613238323463646165373361613834353230653138623132303731393436386139663533
+38393263306139303231626363353931646163323364666161653861643739353262313561393165
+6262
diff --git a/archive/argocd/application.yaml b/archive/argocd/application.yaml
deleted file mode 100644
index 0db0922..0000000
--- a/archive/argocd/application.yaml
+++ /dev/null
@@ -1,46 +0,0 @@
-# ------------------------------------------------------------------------------
-# Platform: ArgoCD Configuration (post-bootstrap)
-# Wave 2 — after ESO (wave 1), needs 1Password for Authentik client secret
-#
-# This is NOT the ArgoCD install (that's a manual bootstrap step).
-# This Application manages ArgoCD's own configuration declaratively:
-# - argocd-cm (URL, Dex/OIDC config, repo credentials)
-# - argocd-rbac-cm (RBAC policies mapped from Authentik groups)
-# - argocd-secret (Authentik client secret via ESO)
-#
-# ArgoCD managing its own config is intentional and works cleanly —
-# it's the "self-managed ArgoCD" pattern.
-# ------------------------------------------------------------------------------
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
- name: argocd-config
- namespace: argocd
- annotations:
- argocd.argoproj.io/sync-wave: "2"
-spec:
- project: default
- source:
- repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
- targetRevision: main
- path: cluster/platform/argocd
- directory:
- exclude: "application.yaml"
- destination:
- server: https://kubernetes.default.svc
- namespace: argocd
- syncPolicy:
- automated:
- prune: false
- selfHeal: true
- syncOptions:
- - ServerSideApply=true
- ignoreDifferences:
- # ArgoCD mutates its own secret — ignore those fields
- - group: ""
- kind: Secret
- name: argocd-secret
- jsonPointers:
- - /data/admin.password
- - /data/admin.passwordMtime
- - /data/server.secretkey
diff --git a/archive/argocd/argocd-cm.yaml b/archive/argocd/argocd-cm.yaml
deleted file mode 100644
index 6de5827..0000000
--- a/archive/argocd/argocd-cm.yaml
+++ /dev/null
@@ -1,69 +0,0 @@
-# ------------------------------------------------------------------------------
-# argocd-cm — ArgoCD Core Configuration
-#
-# Configures:
-# - ArgoCD public URL (used in Dex redirect URIs)
-# - Dex connector to Authentik OIDC
-# - Gitea repo credentials reference
-#
-# Authentik side setup (manual — do this in guest-relations before bootstrapping):
-# 1. Admin UI → Applications → Create New Application
-# 2. Provider type: OAuth2/OpenID Connect
-# 3. Name: argocd
-# 4. Authorization flow: default-provider-authorization-explicit-consent
-# 5. Client type: Confidential
-# 6. Strict redirect URIs:
-# https://argocd.local.mk-labs.cloud/api/dex/callback
-# http://localhost:8085/auth/callback (ArgoCD CLI)
-# 7. Scopes: openid, profile, email, groups
-# 8. Note the Client ID and Client Secret → store in 1Password as:
-# Item: "argocd-oidc"
-# Fields: client-id, client-secret
-# 9. Create two groups in Authentik:
-# - argocd-admins (add your user)
-# - argocd-viewers (read-only users)
-# ------------------------------------------------------------------------------
-apiVersion: v1
-kind: ConfigMap
-metadata:
- name: argocd-cm
- namespace: argocd
-data:
- # Public URL — must match the HTTPRoute hostname
- url: https://argocd.local.mk-labs.cloud
-
- # Dex connector to Authentik
- # Using Dex (not native OIDC) to preserve ArgoCD CLI functionality
- dex.config: |
- connectors:
- - type: oidc
- id: authentik
- name: Authentik
- config:
- # Authentik OIDC issuer — slug must match the Application slug in Authentik
- # Slug is auto-generated from the app name, usually lowercase with hyphens
- issuer: https://authentik.local.mk-labs.cloud/application/o/argocd/
- clientID: $dex.authentik.clientID
- clientSecret: $dex.authentik.clientSecret
- redirectURI: https://argocd.local.mk-labs.cloud/api/dex/callback
- scopes:
- - openid
- - profile
- - email
- - groups
- insecureEnableGroups: true
- groupsKey: groups
- userIDKey: sub
- userNameKey: preferred_username
- emailKey: email
-
- # Gitea repo — ArgoCD needs credentials to pull from your private repo
- # Credentials are stored as a Repository secret (see repository-secret.yaml)
- # This tells ArgoCD to use SSH for the repo
- repositories: |
- - url: git@gitea.mk-labs.cloud:rblundon/homelab.git
- type: git
- name: homelab
-
- # Resource tracking via annotation (recommended over label tracking)
- application.resourceTrackingMethod: annotation
diff --git a/archive/argocd/argocd-params.yaml b/archive/argocd/argocd-params.yaml
deleted file mode 100644
index ede1927..0000000
--- a/archive/argocd/argocd-params.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-# ------------------------------------------------------------------------------
-# ArgoCD Server Parameters
-# Sets server.insecure=true so TLS is terminated at ingress, not argocd-server
-# ------------------------------------------------------------------------------
-apiVersion: v1
-kind: ConfigMap
-metadata:
- name: argocd-cmd-params-cm
- namespace: argocd
-data:
- server.insecure: "true"
\ No newline at end of file
diff --git a/archive/argocd/argocd-rbac-cm.yaml b/archive/argocd/argocd-rbac-cm.yaml
deleted file mode 100644
index bf1ceaf..0000000
--- a/archive/argocd/argocd-rbac-cm.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-# ------------------------------------------------------------------------------
-# argocd-rbac-cm — RBAC Policy
-#
-# Maps Authentik groups to ArgoCD roles.
-# Groups must exist in Authentik and be assigned to users there.
-#
-# Roles:
-# role:admin — full access, all operations
-# role:readonly — read-only, can view but not sync/modify
-#
-# Single-user homelab: your user should be in argocd-admins in Authentik.
-# Add argocd-viewers later when you have guests/collaborators.
-# ------------------------------------------------------------------------------
-apiVersion: v1
-kind: ConfigMap
-metadata:
- name: argocd-rbac-cm
- namespace: argocd
-data:
- # Default policy for any authenticated user not in a mapped group
- # readonly is safe — they can see but not touch
- policy.default: role:readonly
-
- policy.csv: |
- # Authentik group → ArgoCD role mappings
- g, argocd-admins, role:admin
- g, argocd-viewers, role:readonly
-
- # Tell ArgoCD which OIDC claims to use for group mapping
- scopes: '[groups, email]'
diff --git a/archive/argocd/certificate.yaml b/archive/argocd/certificate.yaml
deleted file mode 100644
index 4c75e04..0000000
--- a/archive/argocd/certificate.yaml
+++ /dev/null
@@ -1,41 +0,0 @@
-# ------------------------------------------------------------------------------
-# Certificate — ArgoCD TLS
-# Issued by cert-manager via letsencrypt-prod + Cloudflare DNS-01
-#
-# The secret produced (argocd-tls) is referenced by the Gateway listener
-# in cluster/platform/gateway-api/gateway.yaml via ReferenceGrant.
-#
-# Per the thematic naming convention: argocd.local.mk-labs.cloud is the
-# service DNS name. No VM hostname alias needed here.
-# ------------------------------------------------------------------------------
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
- name: argocd-tls
- namespace: argocd
-spec:
- secretName: argocd-tls
- issuerRef:
- name: letsencrypt-prod
- kind: ClusterIssuer
- dnsNames:
- - argocd.local.mk-labs.cloud
-
----
-# ReferenceGrant — allows the Gateway in gateway-system to reference
-# the TLS secret in the argocd namespace
-# Without this, cross-namespace secret references are denied
-apiVersion: gateway.networking.k8s.io/v1beta1
-kind: ReferenceGrant
-metadata:
- name: argocd-tls-grant
- namespace: argocd
-spec:
- from:
- - group: gateway.networking.k8s.io
- kind: Gateway
- namespace: gateway-system
- to:
- - group: ""
- kind: Secret
- name: argocd-tls
diff --git a/archive/argocd/externalsecret.yaml b/archive/argocd/externalsecret.yaml
deleted file mode 100644
index b581f95..0000000
--- a/archive/argocd/externalsecret.yaml
+++ /dev/null
@@ -1,49 +0,0 @@
-# ------------------------------------------------------------------------------
-# ExternalSecret — ArgoCD Secrets
-#
-# Pulls two secrets from 1Password:
-# 1. Authentik OIDC client ID + secret (for Dex connector)
-# 2. Gitea personal access token (for repo access)
-#
-# In 1Password (mk-labs vault), create:
-# Item: "argocd-oidc"
-# Field: client-id → Authentik OAuth2 client ID
-# Field: client-secret → Authentik OAuth2 client secret
-#
-# Item: "gitea-argocd-token"
-# Field: token → Gitea personal access token with repo read permissions
-# (Create in Gitea: Settings → Applications → Generate Token)
-#
-# These materialize into argocd-secret, which ArgoCD reads natively.
-# The $dex.authentik.clientID / $dex.authentik.clientSecret references
-# in argocd-cm.yaml are resolved by ArgoCD from this secret automatically.
-# ------------------------------------------------------------------------------
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
- name: argocd-secrets
- namespace: argocd
-spec:
- secretStoreRef:
- kind: ClusterSecretStore
- name: onepassword-connect
- refreshInterval: "1h"
- target:
- # Must be named argocd-secret — ArgoCD reads this specific secret name
- name: argocd-secret
- creationPolicy: Merge # Merge into existing argocd-secret, don't replace it
- data:
- # Authentik OIDC credentials — referenced as $dex.authentik.* in argocd-cm
- - secretKey: dex.authentik.clientID
- remoteRef:
- key: argocd-oidc
- property: client-id
- - secretKey: dex.authentik.clientSecret
- remoteRef:
- key: argocd-oidc
- property: client-secret
- # Gitea token — used by the Repository credential below
- - secretKey: sshPrivateKey
- remoteRef:
- key: gitea-argocd-ssh
- property: private-key
diff --git a/archive/argocd/ingress.yaml b/archive/argocd/ingress.yaml
deleted file mode 100644
index f517f67..0000000
--- a/archive/argocd/ingress.yaml
+++ /dev/null
@@ -1,31 +0,0 @@
-# ------------------------------------------------------------------------------
-# Ingress — ArgoCD via ingress-nginx
-# Temporary until Cilium Gateway API is stable
-# TLS terminated at ingress, argocd-server runs in insecure mode
-# ------------------------------------------------------------------------------
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
- name: argocd
- namespace: argocd
- annotations:
- nginx.ingress.kubernetes.io/ssl-passthrough: "false"
- nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
- nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-spec:
- ingressClassName: nginx
- tls:
- - hosts:
- - argocd.local.mk-labs.cloud
- secretName: argocd-tls
- rules:
- - host: argocd.local.mk-labs.cloud
- http:
- paths:
- - path: /
- pathType: Prefix
- backend:
- service:
- name: argocd-server
- port:
- number: 80
diff --git a/archive/argocd/repository-secret.yaml b/archive/argocd/repository-secret.yaml
deleted file mode 100644
index 0c3acee..0000000
--- a/archive/argocd/repository-secret.yaml
+++ /dev/null
@@ -1,27 +0,0 @@
-# ------------------------------------------------------------------------------
-# Repository Credential Secret — Gitea homelab repo
-#
-# ArgoCD discovers repository credentials via secrets with the label
-# argocd.argoproj.io/secret-type: repository
-#
-# The actual token value is injected by the ExternalSecret (externalsecret.yaml)
-# which merges into argocd-secret. This secret references that value.
-#
-# NOTE: The token field here uses a placeholder. The ExternalSecret populates
-# argocd-secret with gitea.token, and ArgoCD resolves it via the
-# stringData reference below.
-# ------------------------------------------------------------------------------
-apiVersion: v1
-kind: Secret
-metadata:
- name: repo-homelab-gitea
- namespace: argocd
- labels:
- argocd.argoproj.io/secret-type: repository
-stringData:
- type: git
- url: git@gitea.mk-labs.cloud:rblundon/homelab.git
- sshPrivateKey: |
- -----BEGIN OPENSSH PRIVATE KEY-----
- # populated by ESO
- -----END OPENSSH PRIVATE KEY-----
diff --git a/archive/cilium-config/application.yaml b/archive/cilium-config/application.yaml
deleted file mode 100644
index 04345b6..0000000
--- a/archive/cilium-config/application.yaml
+++ /dev/null
@@ -1,43 +0,0 @@
-# ------------------------------------------------------------------------------
-# Platform: Cilium — Helm upgrade + LB IPAM + Gateway API
-# Wave 4 — no dependencies, Cilium is pre-installed via Talos bootstrap
-#
-# This Application does two things:
-# 1. Manages Cilium itself via Helm (enables Gateway API, keeps config in git)
-# 2. Applies LB pool and L2 announcement manifests from repo
-#
-# IP Allocation:
-# 10.1.71.80-.89 — ingress-nginx LB pool
-# 10.1.71.90-.99 — Cilium Gateway LB pool
-# ------------------------------------------------------------------------------
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
- name: cilium-config
- namespace: argocd
- annotations:
- argocd.argoproj.io/sync-wave: "4"
-spec:
- project: default
- sources:
- # Source 1: Cilium Helm chart — manages Cilium itself
- - repoURL: https://helm.cilium.io
- chart: cilium
- targetRevision: 1.17.4
- helm:
- valueFiles:
- - $values/cluster/platform/cilium-config/values.yaml
- # Source 2: Repo — values ref + lb-pool.yaml + GatewayClass manifests
- - repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
- targetRevision: main
- path: cluster/platform/cilium-config/manifests
- ref: values
- destination:
- server: https://kubernetes.default.svc
- namespace: kube-system
- syncPolicy:
- automated:
- prune: true
- selfHeal: true
- syncOptions:
- - ServerSideApply=true
diff --git a/archive/cilium-config/manifests/lb-pool.yaml b/archive/cilium-config/manifests/lb-pool.yaml
deleted file mode 100644
index b577332..0000000
--- a/archive/cilium-config/manifests/lb-pool.yaml
+++ /dev/null
@@ -1,41 +0,0 @@
-# Pool for ingress-nginx
-apiVersion: cilium.io/v2
-kind: CiliumLoadBalancerIPPool
-metadata:
- name: ingress-nginx-pool
- namespace: kube-system
-spec:
- blocks:
- - start: 10.1.71.80
- stop: 10.1.71.89
- serviceSelector:
- matchLabels:
- app.kubernetes.io/name: ingress-nginx
-
----
-# Pool for Cilium Gateway API
-apiVersion: cilium.io/v2
-kind: CiliumLoadBalancerIPPool
-metadata:
- name: cilium-gateway-pool
- namespace: kube-system
-spec:
- blocks:
- - start: 10.1.71.90
- stop: 10.1.71.99
- serviceSelector:
- matchExpressions:
- - key: io.cilium.gateway/owning-gateway
- operator: Exists
-
----
-# L2 Announcement Policy
-apiVersion: cilium.io/v2alpha1
-kind: CiliumL2AnnouncementPolicy
-metadata:
- name: fastpass-l2-policy
- namespace: kube-system
-spec:
- loadBalancerIPs: true
- interfaces:
- - ^eth[0-9]+
diff --git a/archive/cilium-config/values.yaml b/archive/cilium-config/values.yaml
deleted file mode 100644
index 09aa765..0000000
--- a/archive/cilium-config/values.yaml
+++ /dev/null
@@ -1,41 +0,0 @@
-# ------------------------------------------------------------------------------
-# Cilium Helm Values — fastpass cluster
-# Chart: https://helm.cilium.io
-# Version: 1.17.4
-# ------------------------------------------------------------------------------
-
-# Bootstrap values
-kubeProxyReplacement: true
-k8sServiceHost: 10.1.71.65
-k8sServicePort: 6443
-ipam:
- mode: kubernetes
-
-# Routing mode — replaces deprecated tunnel value
-routingMode: tunnel
-tunnelProtocol: vxlan
-
-# L2 announcements
-l2announcements:
- enabled: true
-
-k8sClientRateLimit:
- qps: 20
- burst: 40
-
-externalIPs:
- enabled: true
-
-# Hubble observability
-hubble:
- enabled: true
- relay:
- enabled: true
- ui:
- enabled: true
-
-# Prometheus metrics
-prometheus:
- enabled: true
- serviceMonitor:
- enabled: false
diff --git a/archive/gateway-api/application.yaml b/archive/gateway-api/application.yaml
deleted file mode 100644
index ef2442b..0000000
--- a/archive/gateway-api/application.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
-# ------------------------------------------------------------------------------
-# Platform: Gateway API CRDs
-# Wave 3.5 — must exist before cilium-config (wave 4) enables gatewayAPI
-#
-# The Gateway API CRDs are maintained separately from any implementation.
-# We install the standard channel CRDs from the upstream sig-network repo.
-# Cilium requires these CRDs to exist before gatewayAPI.enabled=true works.
-#
-# Standard channel includes: GatewayClass, Gateway, HTTPRoute, GRPCRoute,
-# ReferenceGrant
-# Experimental channel adds: TCPRoute, TLSRoute, UDPRoute (added below)
-# ------------------------------------------------------------------------------
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
- name: gateway-api-crds
- namespace: argocd
- annotations:
- # Wave 3.5 — after cert-manager (3), before cilium-config (4)
- # ArgoCD sync waves are integers, so we use 3 here and rely on
- # sync ordering within the wave. Add a sync-wave of 3 to cert-manager
- # and this will naturally sequence correctly.
- argocd.argoproj.io/sync-wave: "3"
-spec:
- project: default
- source:
- repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
- targetRevision: main
- path: cluster/platform/gateway-api/manifests
- destination:
- server: https://kubernetes.default.svc
- namespace: gateway-api
- syncPolicy:
- automated:
- prune: false # Never prune CRDs — too dangerous
- selfHeal: true
- syncOptions:
- - CreateNamespace=true
- - ServerSideApply=true
- - Replace=true # CRDs require Replace not Patch for updates
diff --git a/archive/gateway-api/manifests/README.md b/archive/gateway-api/manifests/README.md
deleted file mode 100644
index 6246941..0000000
--- a/archive/gateway-api/manifests/README.md
+++ /dev/null
@@ -1,40 +0,0 @@
-# ------------------------------------------------------------------------------
-# Gateway API CRDs — Standard + Experimental Channel
-# Version: v1.2.1 (latest stable as of May 2026)
-#
-# We reference upstream CRD manifests directly. ArgoCD will apply them
-# from the upstream GitHub URL via the source config in application.yaml.
-#
-# To upgrade Gateway API CRDs:
-# 1. Update the version tag in the URLs below
-# 2. Commit and push — ArgoCD applies automatically
-#
-# Standard channel CRDs (stable, production-ready):
-# - GatewayClass
-# - Gateway
-# - HTTPRoute
-# - GRPCRoute
-# - ReferenceGrant
-#
-# Experimental channel additions (used for TCPRoute for non-HTTP services):
-# - TLSRoute
-# - TCPRoute
-#
-# Source: https://github.com/kubernetes-sigs/gateway-api/releases/tag/v1.2.1
-# ------------------------------------------------------------------------------
-
-# NOTE: ArgoCD applies these from the upstream URL. This file documents
-# the versions in use. The actual application.yaml points ArgoCD at this
-# directory, so place the CRD manifests here by running:
-#
-# curl -L https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.1/standard-install.yaml \
-# -o cluster/platform/gateway-api/manifests/standard-install.yaml
-#
-# curl -L https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.1/experimental-install.yaml \
-# -o cluster/platform/gateway-api/manifests/experimental-install.yaml
-#
-# Commit both files. ArgoCD will apply them on next sync.
-#
-# The commands above should be run from city-hall or your workstation
-# and the resulting files committed to git. We vendor them rather than
-# fetching at runtime so the exact CRD versions are pinned in git.
diff --git a/archive/gateway-api/manifests/experimental-install.yaml b/archive/gateway-api/manifests/experimental-install.yaml
deleted file mode 100644
index f311060..0000000
--- a/archive/gateway-api/manifests/experimental-install.yaml
+++ /dev/null
@@ -1,14974 +0,0 @@
-# Copyright 2024 The Kubernetes Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-#
-# Gateway API Experimental channel install
-#
----
-#
-# config/crd/experimental/gateway.networking.k8s.io_backendlbpolicies.yaml
-#
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
- gateway.networking.k8s.io/bundle-version: v1.2.1
- gateway.networking.k8s.io/channel: experimental
- creationTimestamp: null
- labels:
- gateway.networking.k8s.io/policy: Direct
- name: backendlbpolicies.gateway.networking.k8s.io
-spec:
- group: gateway.networking.k8s.io
- names:
- categories:
- - gateway-api
- kind: BackendLBPolicy
- listKind: BackendLBPolicyList
- plural: backendlbpolicies
- shortNames:
- - blbpolicy
- singular: backendlbpolicy
- scope: Namespaced
- versions:
- - additionalPrinterColumns:
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- name: v1alpha2
- schema:
- openAPIV3Schema:
- description: |-
- BackendLBPolicy provides a way to define load balancing rules
- for a backend.
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: Spec defines the desired state of BackendLBPolicy.
- properties:
- sessionPersistence:
- description: |-
- SessionPersistence defines and configures session persistence
- for the backend.
-
- Support: Extended
- properties:
- absoluteTimeout:
- description: |-
- AbsoluteTimeout defines the absolute timeout of the persistent
- session. Once the AbsoluteTimeout duration has elapsed, the
- session becomes invalid.
-
- Support: Extended
- pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
- type: string
- cookieConfig:
- description: |-
- CookieConfig provides configuration settings that are specific
- to cookie-based session persistence.
-
- Support: Core
- properties:
- lifetimeType:
- default: Session
- description: |-
- LifetimeType specifies whether the cookie has a permanent or
- session-based lifetime. A permanent cookie persists until its
- specified expiry time, defined by the Expires or Max-Age cookie
- attributes, while a session cookie is deleted when the current
- session ends.
-
- When set to "Permanent", AbsoluteTimeout indicates the
- cookie's lifetime via the Expires or Max-Age cookie attributes
- and is required.
-
- When set to "Session", AbsoluteTimeout indicates the
- absolute lifetime of the cookie tracked by the gateway and
- is optional.
-
- Support: Core for "Session" type
-
- Support: Extended for "Permanent" type
- enum:
- - Permanent
- - Session
- type: string
- type: object
- idleTimeout:
- description: |-
- IdleTimeout defines the idle timeout of the persistent session.
- Once the session has been idle for more than the specified
- IdleTimeout duration, the session becomes invalid.
-
- Support: Extended
- pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
- type: string
- sessionName:
- description: |-
- SessionName defines the name of the persistent session token
- which may be reflected in the cookie or the header. Users
- should avoid reusing session names to prevent unintended
- consequences, such as rejection or unpredictable behavior.
-
- Support: Implementation-specific
- maxLength: 128
- type: string
- type:
- default: Cookie
- description: |-
- Type defines the type of session persistence such as through
- the use a header or cookie. Defaults to cookie based session
- persistence.
-
- Support: Core for "Cookie" type
-
- Support: Extended for "Header" type
- enum:
- - Cookie
- - Header
- type: string
- type: object
- x-kubernetes-validations:
- - message: AbsoluteTimeout must be specified when cookie lifetimeType
- is Permanent
- rule: '!has(self.cookieConfig) || !has(self.cookieConfig.lifetimeType)
- || self.cookieConfig.lifetimeType != ''Permanent'' || has(self.absoluteTimeout)'
- targetRefs:
- description: |-
- TargetRef identifies an API object to apply policy to.
- Currently, Backends (i.e. Service, ServiceImport, or any
- implementation-specific backendRef) are the only valid API
- target references.
- items:
- description: |-
- LocalPolicyTargetReference identifies an API object to apply a direct or
- inherited policy to. This should be used as part of Policy resources
- that can target Gateway API resources. For more information on how this
- policy attachment model works, and a sample Policy resource, refer to
- the policy attachment documentation for Gateway API.
- properties:
- group:
- description: Group is the group of the target resource.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is kind of the target resource.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the target resource.
- maxLength: 253
- minLength: 1
- type: string
- required:
- - group
- - kind
- - name
- type: object
- maxItems: 16
- minItems: 1
- type: array
- x-kubernetes-list-map-keys:
- - group
- - kind
- - name
- x-kubernetes-list-type: map
- required:
- - targetRefs
- type: object
- status:
- description: Status defines the current state of BackendLBPolicy.
- properties:
- ancestors:
- description: |-
- Ancestors is a list of ancestor resources (usually Gateways) that are
- associated with the policy, and the status of the policy with respect to
- each ancestor. When this policy attaches to a parent, the controller that
- manages the parent and the ancestors MUST add an entry to this list when
- the controller first sees the policy and SHOULD update the entry as
- appropriate when the relevant ancestor is modified.
-
- Note that choosing the relevant ancestor is left to the Policy designers;
- an important part of Policy design is designing the right object level at
- which to namespace this status.
-
- Note also that implementations MUST ONLY populate ancestor status for
- the Ancestor resources they are responsible for. Implementations MUST
- use the ControllerName field to uniquely identify the entries in this list
- that they are responsible for.
-
- Note that to achieve this, the list of PolicyAncestorStatus structs
- MUST be treated as a map with a composite key, made up of the AncestorRef
- and ControllerName fields combined.
-
- A maximum of 16 ancestors will be represented in this list. An empty list
- means the Policy is not relevant for any ancestors.
-
- If this slice is full, implementations MUST NOT add further entries.
- Instead they MUST consider the policy unimplementable and signal that
- on any related resources such as the ancestor that would be referenced
- here. For example, if this list was full on BackendTLSPolicy, no
- additional Gateways would be able to reference the Service targeted by
- the BackendTLSPolicy.
- items:
- description: |-
- PolicyAncestorStatus describes the status of a route with respect to an
- associated Ancestor.
-
- Ancestors refer to objects that are either the Target of a policy or above it
- in terms of object hierarchy. For example, if a policy targets a Service, the
- Policy's Ancestors are, in order, the Service, the HTTPRoute, the Gateway, and
- the GatewayClass. Almost always, in this hierarchy, the Gateway will be the most
- useful object to place Policy status on, so we recommend that implementations
- SHOULD use Gateway as the PolicyAncestorStatus object unless the designers
- have a _very_ good reason otherwise.
-
- In the context of policy attachment, the Ancestor is used to distinguish which
- resource results in a distinct application of this policy. For example, if a policy
- targets a Service, it may have a distinct result per attached Gateway.
-
- Policies targeting the same resource may have different effects depending on the
- ancestors of those resources. For example, different Gateways targeting the same
- Service may have different capabilities, especially if they have different underlying
- implementations.
-
- For example, in BackendTLSPolicy, the Policy attaches to a Service that is
- used as a backend in a HTTPRoute that is itself attached to a Gateway.
- In this case, the relevant object for status is the Gateway, and that is the
- ancestor object referred to in this status.
-
- Note that a parent is also an ancestor, so for objects where the parent is the
- relevant object for status, this struct SHOULD still be used.
-
- This struct is intended to be used in a slice that's effectively a map,
- with a composite key made up of the AncestorRef and the ControllerName.
- properties:
- ancestorRef:
- description: |-
- AncestorRef corresponds with a ParentRef in the spec that this
- PolicyAncestorStatus struct describes the status of.
- properties:
- group:
- default: gateway.networking.k8s.io
- description: |-
- Group is the group of the referent.
- When unspecified, "gateway.networking.k8s.io" is inferred.
- To set the core API group (such as for a "Service" kind referent),
- Group must be explicitly set to "" (empty string).
-
- Support: Core
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Gateway
- description: |-
- Kind is kind of the referent.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- Support for other resources is Implementation-Specific.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: |-
- Name is the name of the referent.
-
- Support: Core
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referent. When unspecified, this refers
- to the local namespace of the Route.
-
- Note that there are specific rules for ParentRefs which cross namespace
- boundaries. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example:
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable any other kind of cross-namespace reference.
-
-
- ParentRefs from a Route to a Service in the same namespace are "producer"
- routes, which apply default routing rules to inbound connections from
- any namespace to the Service.
-
- ParentRefs from a Route to a Service in a different namespace are
- "consumer" routes, and these routing rules are only applied to outbound
- connections originating from the same namespace as the Route, for which
- the intended destination of the connections are a Service targeted as a
- ParentRef of the Route.
-
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port is the network port this Route targets. It can be interpreted
- differently based on the type of parent resource.
-
- When the parent resource is a Gateway, this targets all listeners
- listening on the specified port that also support this kind of Route(and
- select this Route). It's not recommended to set `Port` unless the
- networking behaviors specified in a Route must apply to a specific port
- as opposed to a listener(s) whose port(s) may be changed. When both Port
- and SectionName are specified, the name and port of the selected listener
- must match both specified values.
-
-
- When the parent resource is a Service, this targets a specific port in the
- Service spec. When both Port (experimental) and SectionName are specified,
- the name and port of the selected port must match both specified values.
-
-
- Implementations MAY choose to support other parent resources.
- Implementations supporting other types of parent resources MUST clearly
- document how/if Port is interpreted.
-
- For the purpose of status, an attachment is considered successful as
- long as the parent resource accepts it partially. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
- from the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route,
- the Route MUST be considered detached from the Gateway.
-
- Support: Extended
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- sectionName:
- description: |-
- SectionName is the name of a section within the target resource. In the
- following resources, SectionName is interpreted as the following:
-
- * Gateway: Listener name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
- * Service: Port name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
-
- Implementations MAY choose to support attaching Routes to other resources.
- If that is the case, they MUST clearly document how SectionName is
- interpreted.
-
- When unspecified (empty string), this will reference the entire resource.
- For the purpose of status, an attachment is considered successful if at
- least one section in the parent resource accepts it. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
- the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route, the
- Route MUST be considered detached from the Gateway.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- required:
- - name
- type: object
- conditions:
- description: Conditions describes the status of the Policy with
- respect to the given Ancestor.
- items:
- description: Condition contains details for one aspect of
- the current state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False,
- Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- maxItems: 8
- minItems: 1
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- controllerName:
- description: |-
- ControllerName is a domain/path string that indicates the name of the
- controller that wrote this status. This corresponds with the
- controllerName field on GatewayClass.
-
- Example: "example.net/gateway-controller".
-
- The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
- valid Kubernetes names
- (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
-
- Controllers MUST populate this field when writing status. Controllers should ensure that
- entries to status populated with their ControllerName are cleaned up when they are no
- longer necessary.
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
- type: string
- required:
- - ancestorRef
- - controllerName
- type: object
- maxItems: 16
- type: array
- required:
- - ancestors
- type: object
- required:
- - spec
- type: object
- served: true
- storage: true
- subresources:
- status: {}
-status:
- acceptedNames:
- kind: ""
- plural: ""
- conditions: null
- storedVersions: null
----
-#
-# config/crd/experimental/gateway.networking.k8s.io_backendtlspolicies.yaml
-#
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
- gateway.networking.k8s.io/bundle-version: v1.2.1
- gateway.networking.k8s.io/channel: experimental
- creationTimestamp: null
- labels:
- gateway.networking.k8s.io/policy: Direct
- name: backendtlspolicies.gateway.networking.k8s.io
-spec:
- group: gateway.networking.k8s.io
- names:
- categories:
- - gateway-api
- kind: BackendTLSPolicy
- listKind: BackendTLSPolicyList
- plural: backendtlspolicies
- shortNames:
- - btlspolicy
- singular: backendtlspolicy
- scope: Namespaced
- versions:
- - additionalPrinterColumns:
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- name: v1alpha3
- schema:
- openAPIV3Schema:
- description: |-
- BackendTLSPolicy provides a way to configure how a Gateway
- connects to a Backend via TLS.
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: Spec defines the desired state of BackendTLSPolicy.
- properties:
- options:
- additionalProperties:
- description: |-
- AnnotationValue is the value of an annotation in Gateway API. This is used
- for validation of maps such as TLS options. This roughly matches Kubernetes
- annotation validation, although the length validation in that case is based
- on the entire size of the annotations struct.
- maxLength: 4096
- minLength: 0
- type: string
- description: |-
- Options are a list of key/value pairs to enable extended TLS
- configuration for each implementation. For example, configuring the
- minimum TLS version or supported cipher suites.
-
- A set of common keys MAY be defined by the API in the future. To avoid
- any ambiguity, implementation-specific definitions MUST use
- domain-prefixed names, such as `example.com/my-custom-option`.
- Un-prefixed names are reserved for key names defined by Gateway API.
-
- Support: Implementation-specific
- maxProperties: 16
- type: object
- targetRefs:
- description: |-
- TargetRefs identifies an API object to apply the policy to.
- Only Services have Extended support. Implementations MAY support
- additional objects, with Implementation Specific support.
- Note that this config applies to the entire referenced resource
- by default, but this default may change in the future to provide
- a more granular application of the policy.
-
- Support: Extended for Kubernetes Service
-
- Support: Implementation-specific for any other resource
- items:
- description: |-
- LocalPolicyTargetReferenceWithSectionName identifies an API object to apply a
- direct policy to. This should be used as part of Policy resources that can
- target single resources. For more information on how this policy attachment
- mode works, and a sample Policy resource, refer to the policy attachment
- documentation for Gateway API.
-
- Note: This should only be used for direct policy attachment when references
- to SectionName are actually needed. In all other cases,
- LocalPolicyTargetReference should be used.
- properties:
- group:
- description: Group is the group of the target resource.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is kind of the target resource.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the target resource.
- maxLength: 253
- minLength: 1
- type: string
- sectionName:
- description: |-
- SectionName is the name of a section within the target resource. When
- unspecified, this targetRef targets the entire resource. In the following
- resources, SectionName is interpreted as the following:
-
- * Gateway: Listener name
- * HTTPRoute: HTTPRouteRule name
- * Service: Port name
-
- If a SectionName is specified, but does not exist on the targeted object,
- the Policy must fail to attach, and the policy implementation should record
- a `ResolvedRefs` or similar Condition in the Policy's status.
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- required:
- - group
- - kind
- - name
- type: object
- maxItems: 16
- minItems: 1
- type: array
- validation:
- description: Validation contains backend TLS validation configuration.
- properties:
- caCertificateRefs:
- description: |-
- CACertificateRefs contains one or more references to Kubernetes objects that
- contain a PEM-encoded TLS CA certificate bundle, which is used to
- validate a TLS handshake between the Gateway and backend Pod.
-
- If CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be
- specified. Only one of CACertificateRefs or WellKnownCACertificates may be specified,
- not both. If CACertifcateRefs is empty or unspecified, the configuration for
- WellKnownCACertificates MUST be honored instead if supported by the implementation.
-
- References to a resource in a different namespace are invalid for the
- moment, although we will revisit this in the future.
-
- A single CACertificateRef to a Kubernetes ConfigMap kind has "Core" support.
- Implementations MAY choose to support attaching multiple certificates to
- a backend, but this behavior is implementation-specific.
-
- Support: Core - An optional single reference to a Kubernetes ConfigMap,
- with the CA certificate in a key named `ca.crt`.
-
- Support: Implementation-specific (More than one reference, or other kinds
- of resources).
- items:
- description: |-
- LocalObjectReference identifies an API object within the namespace of the
- referrer.
- The API object must be valid in the cluster; the Group and Kind must
- be registered in the cluster for this reference to be valid.
-
- References to objects with invalid Group and Kind are not valid, and must
- be rejected by the implementation, with appropriate Conditions set
- on the containing object.
- properties:
- group:
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is kind of the referent. For example "HTTPRoute"
- or "Service".
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- required:
- - group
- - kind
- - name
- type: object
- maxItems: 8
- type: array
- hostname:
- description: |-
- Hostname is used for two purposes in the connection between Gateways and
- backends:
-
- 1. Hostname MUST be used as the SNI to connect to the backend (RFC 6066).
- 2. If SubjectAltNames is not specified, Hostname MUST be used for
- authentication and MUST match the certificate served by the matching
- backend.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- subjectAltNames:
- description: |-
- SubjectAltNames contains one or more Subject Alternative Names.
- When specified, the certificate served from the backend MUST have at least one
- Subject Alternate Name matching one of the specified SubjectAltNames.
-
- Support: Core
- items:
- description: SubjectAltName represents Subject Alternative Name.
- properties:
- hostname:
- description: |-
- Hostname contains Subject Alternative Name specified in DNS name format.
- Required when Type is set to Hostname, ignored otherwise.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- type:
- description: |-
- Type determines the format of the Subject Alternative Name. Always required.
-
- Support: Core
- enum:
- - Hostname
- - URI
- type: string
- uri:
- description: |-
- URI contains Subject Alternative Name specified in a full URI format.
- It MUST include both a scheme (e.g., "http" or "ftp") and a scheme-specific-part.
- Common values include SPIFFE IDs like "spiffe://mycluster.example.com/ns/myns/sa/svc1sa".
- Required when Type is set to URI, ignored otherwise.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^(([^:/?#]+):)(//([^/?#]*))([^?#]*)(\?([^#]*))?(#(.*))?
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: SubjectAltName element must contain Hostname, if
- Type is set to Hostname
- rule: '!(self.type == "Hostname" && (!has(self.hostname) ||
- self.hostname == ""))'
- - message: SubjectAltName element must not contain Hostname,
- if Type is not set to Hostname
- rule: '!(self.type != "Hostname" && has(self.hostname) &&
- self.hostname != "")'
- - message: SubjectAltName element must contain URI, if Type
- is set to URI
- rule: '!(self.type == "URI" && (!has(self.uri) || self.uri
- == ""))'
- - message: SubjectAltName element must not contain URI, if Type
- is not set to URI
- rule: '!(self.type != "URI" && has(self.uri) && self.uri !=
- "")'
- maxItems: 5
- type: array
- wellKnownCACertificates:
- description: |-
- WellKnownCACertificates specifies whether system CA certificates may be used in
- the TLS handshake between the gateway and backend pod.
-
- If WellKnownCACertificates is unspecified or empty (""), then CACertificateRefs
- must be specified with at least one entry for a valid configuration. Only one of
- CACertificateRefs or WellKnownCACertificates may be specified, not both. If an
- implementation does not support the WellKnownCACertificates field or the value
- supplied is not supported, the Status Conditions on the Policy MUST be
- updated to include an Accepted: False Condition with Reason: Invalid.
-
- Support: Implementation-specific
- enum:
- - System
- type: string
- required:
- - hostname
- type: object
- x-kubernetes-validations:
- - message: must not contain both CACertificateRefs and WellKnownCACertificates
- rule: '!(has(self.caCertificateRefs) && size(self.caCertificateRefs)
- > 0 && has(self.wellKnownCACertificates) && self.wellKnownCACertificates
- != "")'
- - message: must specify either CACertificateRefs or WellKnownCACertificates
- rule: (has(self.caCertificateRefs) && size(self.caCertificateRefs)
- > 0 || has(self.wellKnownCACertificates) && self.wellKnownCACertificates
- != "")
- required:
- - targetRefs
- - validation
- type: object
- status:
- description: Status defines the current state of BackendTLSPolicy.
- properties:
- ancestors:
- description: |-
- Ancestors is a list of ancestor resources (usually Gateways) that are
- associated with the policy, and the status of the policy with respect to
- each ancestor. When this policy attaches to a parent, the controller that
- manages the parent and the ancestors MUST add an entry to this list when
- the controller first sees the policy and SHOULD update the entry as
- appropriate when the relevant ancestor is modified.
-
- Note that choosing the relevant ancestor is left to the Policy designers;
- an important part of Policy design is designing the right object level at
- which to namespace this status.
-
- Note also that implementations MUST ONLY populate ancestor status for
- the Ancestor resources they are responsible for. Implementations MUST
- use the ControllerName field to uniquely identify the entries in this list
- that they are responsible for.
-
- Note that to achieve this, the list of PolicyAncestorStatus structs
- MUST be treated as a map with a composite key, made up of the AncestorRef
- and ControllerName fields combined.
-
- A maximum of 16 ancestors will be represented in this list. An empty list
- means the Policy is not relevant for any ancestors.
-
- If this slice is full, implementations MUST NOT add further entries.
- Instead they MUST consider the policy unimplementable and signal that
- on any related resources such as the ancestor that would be referenced
- here. For example, if this list was full on BackendTLSPolicy, no
- additional Gateways would be able to reference the Service targeted by
- the BackendTLSPolicy.
- items:
- description: |-
- PolicyAncestorStatus describes the status of a route with respect to an
- associated Ancestor.
-
- Ancestors refer to objects that are either the Target of a policy or above it
- in terms of object hierarchy. For example, if a policy targets a Service, the
- Policy's Ancestors are, in order, the Service, the HTTPRoute, the Gateway, and
- the GatewayClass. Almost always, in this hierarchy, the Gateway will be the most
- useful object to place Policy status on, so we recommend that implementations
- SHOULD use Gateway as the PolicyAncestorStatus object unless the designers
- have a _very_ good reason otherwise.
-
- In the context of policy attachment, the Ancestor is used to distinguish which
- resource results in a distinct application of this policy. For example, if a policy
- targets a Service, it may have a distinct result per attached Gateway.
-
- Policies targeting the same resource may have different effects depending on the
- ancestors of those resources. For example, different Gateways targeting the same
- Service may have different capabilities, especially if they have different underlying
- implementations.
-
- For example, in BackendTLSPolicy, the Policy attaches to a Service that is
- used as a backend in a HTTPRoute that is itself attached to a Gateway.
- In this case, the relevant object for status is the Gateway, and that is the
- ancestor object referred to in this status.
-
- Note that a parent is also an ancestor, so for objects where the parent is the
- relevant object for status, this struct SHOULD still be used.
-
- This struct is intended to be used in a slice that's effectively a map,
- with a composite key made up of the AncestorRef and the ControllerName.
- properties:
- ancestorRef:
- description: |-
- AncestorRef corresponds with a ParentRef in the spec that this
- PolicyAncestorStatus struct describes the status of.
- properties:
- group:
- default: gateway.networking.k8s.io
- description: |-
- Group is the group of the referent.
- When unspecified, "gateway.networking.k8s.io" is inferred.
- To set the core API group (such as for a "Service" kind referent),
- Group must be explicitly set to "" (empty string).
-
- Support: Core
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Gateway
- description: |-
- Kind is kind of the referent.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- Support for other resources is Implementation-Specific.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: |-
- Name is the name of the referent.
-
- Support: Core
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referent. When unspecified, this refers
- to the local namespace of the Route.
-
- Note that there are specific rules for ParentRefs which cross namespace
- boundaries. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example:
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable any other kind of cross-namespace reference.
-
-
- ParentRefs from a Route to a Service in the same namespace are "producer"
- routes, which apply default routing rules to inbound connections from
- any namespace to the Service.
-
- ParentRefs from a Route to a Service in a different namespace are
- "consumer" routes, and these routing rules are only applied to outbound
- connections originating from the same namespace as the Route, for which
- the intended destination of the connections are a Service targeted as a
- ParentRef of the Route.
-
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port is the network port this Route targets. It can be interpreted
- differently based on the type of parent resource.
-
- When the parent resource is a Gateway, this targets all listeners
- listening on the specified port that also support this kind of Route(and
- select this Route). It's not recommended to set `Port` unless the
- networking behaviors specified in a Route must apply to a specific port
- as opposed to a listener(s) whose port(s) may be changed. When both Port
- and SectionName are specified, the name and port of the selected listener
- must match both specified values.
-
-
- When the parent resource is a Service, this targets a specific port in the
- Service spec. When both Port (experimental) and SectionName are specified,
- the name and port of the selected port must match both specified values.
-
-
- Implementations MAY choose to support other parent resources.
- Implementations supporting other types of parent resources MUST clearly
- document how/if Port is interpreted.
-
- For the purpose of status, an attachment is considered successful as
- long as the parent resource accepts it partially. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
- from the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route,
- the Route MUST be considered detached from the Gateway.
-
- Support: Extended
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- sectionName:
- description: |-
- SectionName is the name of a section within the target resource. In the
- following resources, SectionName is interpreted as the following:
-
- * Gateway: Listener name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
- * Service: Port name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
-
- Implementations MAY choose to support attaching Routes to other resources.
- If that is the case, they MUST clearly document how SectionName is
- interpreted.
-
- When unspecified (empty string), this will reference the entire resource.
- For the purpose of status, an attachment is considered successful if at
- least one section in the parent resource accepts it. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
- the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route, the
- Route MUST be considered detached from the Gateway.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- required:
- - name
- type: object
- conditions:
- description: Conditions describes the status of the Policy with
- respect to the given Ancestor.
- items:
- description: Condition contains details for one aspect of
- the current state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False,
- Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- maxItems: 8
- minItems: 1
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- controllerName:
- description: |-
- ControllerName is a domain/path string that indicates the name of the
- controller that wrote this status. This corresponds with the
- controllerName field on GatewayClass.
-
- Example: "example.net/gateway-controller".
-
- The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
- valid Kubernetes names
- (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
-
- Controllers MUST populate this field when writing status. Controllers should ensure that
- entries to status populated with their ControllerName are cleaned up when they are no
- longer necessary.
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
- type: string
- required:
- - ancestorRef
- - controllerName
- type: object
- maxItems: 16
- type: array
- required:
- - ancestors
- type: object
- required:
- - spec
- type: object
- served: true
- storage: true
- subresources:
- status: {}
-status:
- acceptedNames:
- kind: ""
- plural: ""
- conditions: null
- storedVersions: null
----
-#
-# config/crd/experimental/gateway.networking.k8s.io_gatewayclasses.yaml
-#
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
- gateway.networking.k8s.io/bundle-version: v1.2.1
- gateway.networking.k8s.io/channel: experimental
- creationTimestamp: null
- name: gatewayclasses.gateway.networking.k8s.io
-spec:
- group: gateway.networking.k8s.io
- names:
- categories:
- - gateway-api
- kind: GatewayClass
- listKind: GatewayClassList
- plural: gatewayclasses
- shortNames:
- - gc
- singular: gatewayclass
- scope: Cluster
- versions:
- - additionalPrinterColumns:
- - jsonPath: .spec.controllerName
- name: Controller
- type: string
- - jsonPath: .status.conditions[?(@.type=="Accepted")].status
- name: Accepted
- type: string
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- - jsonPath: .spec.description
- name: Description
- priority: 1
- type: string
- name: v1
- schema:
- openAPIV3Schema:
- description: |-
- GatewayClass describes a class of Gateways available to the user for creating
- Gateway resources.
-
- It is recommended that this resource be used as a template for Gateways. This
- means that a Gateway is based on the state of the GatewayClass at the time it
- was created and changes to the GatewayClass or associated parameters are not
- propagated down to existing Gateways. This recommendation is intended to
- limit the blast radius of changes to GatewayClass or associated parameters.
- If implementations choose to propagate GatewayClass changes to existing
- Gateways, that MUST be clearly documented by the implementation.
-
- Whenever one or more Gateways are using a GatewayClass, implementations SHOULD
- add the `gateway-exists-finalizer.gateway.networking.k8s.io` finalizer on the
- associated GatewayClass. This ensures that a GatewayClass associated with a
- Gateway is not deleted while in use.
-
- GatewayClass is a Cluster level resource.
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: Spec defines the desired state of GatewayClass.
- properties:
- controllerName:
- description: |-
- ControllerName is the name of the controller that is managing Gateways of
- this class. The value of this field MUST be a domain prefixed path.
-
- Example: "example.net/gateway-controller".
-
- This field is not mutable and cannot be empty.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
- type: string
- x-kubernetes-validations:
- - message: Value is immutable
- rule: self == oldSelf
- description:
- description: Description helps describe a GatewayClass with more details.
- maxLength: 64
- type: string
- parametersRef:
- description: |-
- ParametersRef is a reference to a resource that contains the configuration
- parameters corresponding to the GatewayClass. This is optional if the
- controller does not require any additional configuration.
-
- ParametersRef can reference a standard Kubernetes resource, i.e. ConfigMap,
- or an implementation-specific custom resource. The resource can be
- cluster-scoped or namespace-scoped.
-
- If the referent cannot be found, refers to an unsupported kind, or when
- the data within that resource is malformed, the GatewayClass SHOULD be
- rejected with the "Accepted" status condition set to "False" and an
- "InvalidParameters" reason.
-
- A Gateway for this GatewayClass may provide its own `parametersRef`. When both are specified,
- the merging behavior is implementation specific.
- It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway.
-
- Support: Implementation-specific
- properties:
- group:
- description: Group is the group of the referent.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is kind of the referent.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referent.
- This field is required when referring to a Namespace-scoped resource and
- MUST be unset when referring to a Cluster-scoped resource.
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- required:
- - group
- - kind
- - name
- type: object
- required:
- - controllerName
- type: object
- status:
- default:
- conditions:
- - lastTransitionTime: "1970-01-01T00:00:00Z"
- message: Waiting for controller
- reason: Pending
- status: Unknown
- type: Accepted
- description: |-
- Status defines the current state of GatewayClass.
-
- Implementations MUST populate status on all GatewayClass resources which
- specify their controller name.
- properties:
- conditions:
- default:
- - lastTransitionTime: "1970-01-01T00:00:00Z"
- message: Waiting for controller
- reason: Pending
- status: Unknown
- type: Accepted
- description: |-
- Conditions is the current status from the controller for
- this GatewayClass.
-
- Controllers should prefer to publish conditions using values
- of GatewayClassConditionType for the type of each Condition.
- items:
- description: Condition contains details for one aspect of the current
- state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False, Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- maxItems: 8
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- supportedFeatures:
- description: |
- SupportedFeatures is the set of features the GatewayClass support.
- It MUST be sorted in ascending alphabetical order by the Name key.
- items:
- properties:
- name:
- description: |-
- FeatureName is used to describe distinct features that are covered by
- conformance tests.
- type: string
- required:
- - name
- type: object
- maxItems: 64
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- required:
- - spec
- type: object
- served: true
- storage: true
- subresources:
- status: {}
- - additionalPrinterColumns:
- - jsonPath: .spec.controllerName
- name: Controller
- type: string
- - jsonPath: .status.conditions[?(@.type=="Accepted")].status
- name: Accepted
- type: string
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- - jsonPath: .spec.description
- name: Description
- priority: 1
- type: string
- name: v1beta1
- schema:
- openAPIV3Schema:
- description: |-
- GatewayClass describes a class of Gateways available to the user for creating
- Gateway resources.
-
- It is recommended that this resource be used as a template for Gateways. This
- means that a Gateway is based on the state of the GatewayClass at the time it
- was created and changes to the GatewayClass or associated parameters are not
- propagated down to existing Gateways. This recommendation is intended to
- limit the blast radius of changes to GatewayClass or associated parameters.
- If implementations choose to propagate GatewayClass changes to existing
- Gateways, that MUST be clearly documented by the implementation.
-
- Whenever one or more Gateways are using a GatewayClass, implementations SHOULD
- add the `gateway-exists-finalizer.gateway.networking.k8s.io` finalizer on the
- associated GatewayClass. This ensures that a GatewayClass associated with a
- Gateway is not deleted while in use.
-
- GatewayClass is a Cluster level resource.
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: Spec defines the desired state of GatewayClass.
- properties:
- controllerName:
- description: |-
- ControllerName is the name of the controller that is managing Gateways of
- this class. The value of this field MUST be a domain prefixed path.
-
- Example: "example.net/gateway-controller".
-
- This field is not mutable and cannot be empty.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
- type: string
- x-kubernetes-validations:
- - message: Value is immutable
- rule: self == oldSelf
- description:
- description: Description helps describe a GatewayClass with more details.
- maxLength: 64
- type: string
- parametersRef:
- description: |-
- ParametersRef is a reference to a resource that contains the configuration
- parameters corresponding to the GatewayClass. This is optional if the
- controller does not require any additional configuration.
-
- ParametersRef can reference a standard Kubernetes resource, i.e. ConfigMap,
- or an implementation-specific custom resource. The resource can be
- cluster-scoped or namespace-scoped.
-
- If the referent cannot be found, refers to an unsupported kind, or when
- the data within that resource is malformed, the GatewayClass SHOULD be
- rejected with the "Accepted" status condition set to "False" and an
- "InvalidParameters" reason.
-
- A Gateway for this GatewayClass may provide its own `parametersRef`. When both are specified,
- the merging behavior is implementation specific.
- It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway.
-
- Support: Implementation-specific
- properties:
- group:
- description: Group is the group of the referent.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is kind of the referent.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referent.
- This field is required when referring to a Namespace-scoped resource and
- MUST be unset when referring to a Cluster-scoped resource.
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- required:
- - group
- - kind
- - name
- type: object
- required:
- - controllerName
- type: object
- status:
- default:
- conditions:
- - lastTransitionTime: "1970-01-01T00:00:00Z"
- message: Waiting for controller
- reason: Pending
- status: Unknown
- type: Accepted
- description: |-
- Status defines the current state of GatewayClass.
-
- Implementations MUST populate status on all GatewayClass resources which
- specify their controller name.
- properties:
- conditions:
- default:
- - lastTransitionTime: "1970-01-01T00:00:00Z"
- message: Waiting for controller
- reason: Pending
- status: Unknown
- type: Accepted
- description: |-
- Conditions is the current status from the controller for
- this GatewayClass.
-
- Controllers should prefer to publish conditions using values
- of GatewayClassConditionType for the type of each Condition.
- items:
- description: Condition contains details for one aspect of the current
- state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False, Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- maxItems: 8
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- supportedFeatures:
- description: |
- SupportedFeatures is the set of features the GatewayClass support.
- It MUST be sorted in ascending alphabetical order by the Name key.
- items:
- properties:
- name:
- description: |-
- FeatureName is used to describe distinct features that are covered by
- conformance tests.
- type: string
- required:
- - name
- type: object
- maxItems: 64
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- required:
- - spec
- type: object
- served: true
- storage: false
- subresources:
- status: {}
-status:
- acceptedNames:
- kind: ""
- plural: ""
- conditions: null
- storedVersions: null
----
-#
-# config/crd/experimental/gateway.networking.k8s.io_gateways.yaml
-#
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
- gateway.networking.k8s.io/bundle-version: v1.2.1
- gateway.networking.k8s.io/channel: experimental
- creationTimestamp: null
- name: gateways.gateway.networking.k8s.io
-spec:
- group: gateway.networking.k8s.io
- names:
- categories:
- - gateway-api
- kind: Gateway
- listKind: GatewayList
- plural: gateways
- shortNames:
- - gtw
- singular: gateway
- scope: Namespaced
- versions:
- - additionalPrinterColumns:
- - jsonPath: .spec.gatewayClassName
- name: Class
- type: string
- - jsonPath: .status.addresses[*].value
- name: Address
- type: string
- - jsonPath: .status.conditions[?(@.type=="Programmed")].status
- name: Programmed
- type: string
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- name: v1
- schema:
- openAPIV3Schema:
- description: |-
- Gateway represents an instance of a service-traffic handling infrastructure
- by binding Listeners to a set of IP addresses.
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: Spec defines the desired state of Gateway.
- properties:
- addresses:
- description: |+
- Addresses requested for this Gateway. This is optional and behavior can
- depend on the implementation. If a value is set in the spec and the
- requested address is invalid or unavailable, the implementation MUST
- indicate this in the associated entry in GatewayStatus.Addresses.
-
- The Addresses field represents a request for the address(es) on the
- "outside of the Gateway", that traffic bound for this Gateway will use.
- This could be the IP address or hostname of an external load balancer or
- other networking infrastructure, or some other address that traffic will
- be sent to.
-
- If no Addresses are specified, the implementation MAY schedule the
- Gateway in an implementation-specific manner, assigning an appropriate
- set of Addresses.
-
- The implementation MUST bind all Listeners to every GatewayAddress that
- it assigns to the Gateway and add a corresponding entry in
- GatewayStatus.Addresses.
-
- Support: Extended
-
- items:
- description: GatewayAddress describes an address that can be bound
- to a Gateway.
- oneOf:
- - properties:
- type:
- enum:
- - IPAddress
- value:
- anyOf:
- - format: ipv4
- - format: ipv6
- - properties:
- type:
- not:
- enum:
- - IPAddress
- properties:
- type:
- default: IPAddress
- description: Type of the address.
- maxLength: 253
- minLength: 1
- pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
- type: string
- value:
- description: |-
- Value of the address. The validity of the values will depend
- on the type and support by the controller.
-
- Examples: `1.2.3.4`, `128::1`, `my-ip-address`.
- maxLength: 253
- minLength: 1
- type: string
- required:
- - value
- type: object
- x-kubernetes-validations:
- - message: Hostname value must only contain valid characters (matching
- ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)
- rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""):
- true'
- maxItems: 16
- type: array
- x-kubernetes-validations:
- - message: IPAddress values must be unique
- rule: 'self.all(a1, a1.type == ''IPAddress'' ? self.exists_one(a2,
- a2.type == a1.type && a2.value == a1.value) : true )'
- - message: Hostname values must be unique
- rule: 'self.all(a1, a1.type == ''Hostname'' ? self.exists_one(a2,
- a2.type == a1.type && a2.value == a1.value) : true )'
- backendTLS:
- description: |+
- BackendTLS configures TLS settings for when this Gateway is connecting to
- backends with TLS.
-
- Support: Core
-
- properties:
- clientCertificateRef:
- description: |+
- ClientCertificateRef is a reference to an object that contains a Client
- Certificate and the associated private key.
-
- References to a resource in different namespace are invalid UNLESS there
- is a ReferenceGrant in the target namespace that allows the certificate
- to be attached. If a ReferenceGrant does not allow this reference, the
- "ResolvedRefs" condition MUST be set to False for this listener with the
- "RefNotPermitted" reason.
-
- ClientCertificateRef can reference to standard Kubernetes resources, i.e.
- Secret, or implementation-specific custom resources.
-
- This setting can be overridden on the service level by use of BackendTLSPolicy.
-
- Support: Core
-
- properties:
- group:
- default: ""
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Secret
- description: Kind is kind of the referent. For example "Secret".
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referenced object. When unspecified, the local
- namespace is inferred.
-
- Note that when a namespace different than the local namespace is specified,
- a ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- required:
- - name
- type: object
- type: object
- gatewayClassName:
- description: |-
- GatewayClassName used for this Gateway. This is the name of a
- GatewayClass resource.
- maxLength: 253
- minLength: 1
- type: string
- infrastructure:
- description: |-
- Infrastructure defines infrastructure level attributes about this Gateway instance.
-
- Support: Extended
- properties:
- annotations:
- additionalProperties:
- description: |-
- AnnotationValue is the value of an annotation in Gateway API. This is used
- for validation of maps such as TLS options. This roughly matches Kubernetes
- annotation validation, although the length validation in that case is based
- on the entire size of the annotations struct.
- maxLength: 4096
- minLength: 0
- type: string
- description: |-
- Annotations that SHOULD be applied to any resources created in response to this Gateway.
-
- For implementations creating other Kubernetes objects, this should be the `metadata.annotations` field on resources.
- For other implementations, this refers to any relevant (implementation specific) "annotations" concepts.
-
- An implementation may chose to add additional implementation-specific annotations as they see fit.
-
- Support: Extended
- maxProperties: 8
- type: object
- x-kubernetes-validations:
- - message: Annotation keys must be in the form of an optional
- DNS subdomain prefix followed by a required name segment of
- up to 63 characters.
- rule: self.all(key, key.matches(r"""^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9]$"""))
- - message: If specified, the annotation key's prefix must be a
- DNS subdomain not longer than 253 characters in total.
- rule: self.all(key, key.split("/")[0].size() < 253)
- labels:
- additionalProperties:
- description: |-
- LabelValue is the value of a label in the Gateway API. This is used for validation
- of maps such as Gateway infrastructure labels. This matches the Kubernetes
- label validation rules:
- * must be 63 characters or less (can be empty),
- * unless empty, must begin and end with an alphanumeric character ([a-z0-9A-Z]),
- * could contain dashes (-), underscores (_), dots (.), and alphanumerics between.
-
- Valid values include:
-
- * MyValue
- * my.name
- * 123-my-value
- maxLength: 63
- minLength: 0
- pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
- type: string
- description: |-
- Labels that SHOULD be applied to any resources created in response to this Gateway.
-
- For implementations creating other Kubernetes objects, this should be the `metadata.labels` field on resources.
- For other implementations, this refers to any relevant (implementation specific) "labels" concepts.
-
- An implementation may chose to add additional implementation-specific labels as they see fit.
-
- If an implementation maps these labels to Pods, or any other resource that would need to be recreated when labels
- change, it SHOULD clearly warn about this behavior in documentation.
-
- Support: Extended
- maxProperties: 8
- type: object
- x-kubernetes-validations:
- - message: Label keys must be in the form of an optional DNS subdomain
- prefix followed by a required name segment of up to 63 characters.
- rule: self.all(key, key.matches(r"""^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9]$"""))
- - message: If specified, the label key's prefix must be a DNS
- subdomain not longer than 253 characters in total.
- rule: self.all(key, key.split("/")[0].size() < 253)
- parametersRef:
- description: |-
- ParametersRef is a reference to a resource that contains the configuration
- parameters corresponding to the Gateway. This is optional if the
- controller does not require any additional configuration.
-
- This follows the same semantics as GatewayClass's `parametersRef`, but on a per-Gateway basis
-
- The Gateway's GatewayClass may provide its own `parametersRef`. When both are specified,
- the merging behavior is implementation specific.
- It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway.
-
- Support: Implementation-specific
- properties:
- group:
- description: Group is the group of the referent.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is kind of the referent.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- required:
- - group
- - kind
- - name
- type: object
- type: object
- listeners:
- description: |-
- Listeners associated with this Gateway. Listeners define
- logical endpoints that are bound on this Gateway's addresses.
- At least one Listener MUST be specified.
-
- Each Listener in a set of Listeners (for example, in a single Gateway)
- MUST be _distinct_, in that a traffic flow MUST be able to be assigned to
- exactly one listener. (This section uses "set of Listeners" rather than
- "Listeners in a single Gateway" because implementations MAY merge configuration
- from multiple Gateways onto a single data plane, and these rules _also_
- apply in that case).
-
- Practically, this means that each listener in a set MUST have a unique
- combination of Port, Protocol, and, if supported by the protocol, Hostname.
-
- Some combinations of port, protocol, and TLS settings are considered
- Core support and MUST be supported by implementations based on their
- targeted conformance profile:
-
- HTTP Profile
-
- 1. HTTPRoute, Port: 80, Protocol: HTTP
- 2. HTTPRoute, Port: 443, Protocol: HTTPS, TLS Mode: Terminate, TLS keypair provided
-
- TLS Profile
-
- 1. TLSRoute, Port: 443, Protocol: TLS, TLS Mode: Passthrough
-
- "Distinct" Listeners have the following property:
-
- The implementation can match inbound requests to a single distinct
- Listener. When multiple Listeners share values for fields (for
- example, two Listeners with the same Port value), the implementation
- can match requests to only one of the Listeners using other
- Listener fields.
-
- For example, the following Listener scenarios are distinct:
-
- 1. Multiple Listeners with the same Port that all use the "HTTP"
- Protocol that all have unique Hostname values.
- 2. Multiple Listeners with the same Port that use either the "HTTPS" or
- "TLS" Protocol that all have unique Hostname values.
- 3. A mixture of "TCP" and "UDP" Protocol Listeners, where no Listener
- with the same Protocol has the same Port value.
-
- Some fields in the Listener struct have possible values that affect
- whether the Listener is distinct. Hostname is particularly relevant
- for HTTP or HTTPS protocols.
-
- When using the Hostname value to select between same-Port, same-Protocol
- Listeners, the Hostname value must be different on each Listener for the
- Listener to be distinct.
-
- When the Listeners are distinct based on Hostname, inbound request
- hostnames MUST match from the most specific to least specific Hostname
- values to choose the correct Listener and its associated set of Routes.
-
- Exact matches must be processed before wildcard matches, and wildcard
- matches must be processed before fallback (empty Hostname value)
- matches. For example, `"foo.example.com"` takes precedence over
- `"*.example.com"`, and `"*.example.com"` takes precedence over `""`.
-
- Additionally, if there are multiple wildcard entries, more specific
- wildcard entries must be processed before less specific wildcard entries.
- For example, `"*.foo.example.com"` takes precedence over `"*.example.com"`.
- The precise definition here is that the higher the number of dots in the
- hostname to the right of the wildcard character, the higher the precedence.
-
- The wildcard character will match any number of characters _and dots_ to
- the left, however, so `"*.example.com"` will match both
- `"foo.bar.example.com"` _and_ `"bar.example.com"`.
-
- If a set of Listeners contains Listeners that are not distinct, then those
- Listeners are Conflicted, and the implementation MUST set the "Conflicted"
- condition in the Listener Status to "True".
-
- Implementations MAY choose to accept a Gateway with some Conflicted
- Listeners only if they only accept the partial Listener set that contains
- no Conflicted Listeners. To put this another way, implementations may
- accept a partial Listener set only if they throw out *all* the conflicting
- Listeners. No picking one of the conflicting listeners as the winner.
- This also means that the Gateway must have at least one non-conflicting
- Listener in this case, otherwise it violates the requirement that at
- least one Listener must be present.
-
- The implementation MUST set a "ListenersNotValid" condition on the
- Gateway Status when the Gateway contains Conflicted Listeners whether or
- not they accept the Gateway. That Condition SHOULD clearly
- indicate in the Message which Listeners are conflicted, and which are
- Accepted. Additionally, the Listener status for those listeners SHOULD
- indicate which Listeners are conflicted and not Accepted.
-
- A Gateway's Listeners are considered "compatible" if:
-
- 1. They are distinct.
- 2. The implementation can serve them in compliance with the Addresses
- requirement that all Listeners are available on all assigned
- addresses.
-
- Compatible combinations in Extended support are expected to vary across
- implementations. A combination that is compatible for one implementation
- may not be compatible for another.
-
- For example, an implementation that cannot serve both TCP and UDP listeners
- on the same address, or cannot mix HTTPS and generic TLS listens on the same port
- would not consider those cases compatible, even though they are distinct.
-
- Note that requests SHOULD match at most one Listener. For example, if
- Listeners are defined for "foo.example.com" and "*.example.com", a
- request to "foo.example.com" SHOULD only be routed using routes attached
- to the "foo.example.com" Listener (and not the "*.example.com" Listener).
- This concept is known as "Listener Isolation". Implementations that do
- not support Listener Isolation MUST clearly document this.
-
- Implementations MAY merge separate Gateways onto a single set of
- Addresses if all Listeners across all Gateways are compatible.
-
- Support: Core
- items:
- description: |-
- Listener embodies the concept of a logical endpoint where a Gateway accepts
- network connections.
- properties:
- allowedRoutes:
- default:
- namespaces:
- from: Same
- description: |-
- AllowedRoutes defines the types of routes that MAY be attached to a
- Listener and the trusted namespaces where those Route resources MAY be
- present.
-
- Although a client request may match multiple route rules, only one rule
- may ultimately receive the request. Matching precedence MUST be
- determined in order of the following criteria:
-
- * The most specific match as defined by the Route type.
- * The oldest Route based on creation timestamp. For example, a Route with
- a creation timestamp of "2020-09-08 01:02:03" is given precedence over
- a Route with a creation timestamp of "2020-09-08 01:02:04".
- * If everything else is equivalent, the Route appearing first in
- alphabetical order (namespace/name) should be given precedence. For
- example, foo/bar is given precedence over foo/baz.
-
- All valid rules within a Route attached to this Listener should be
- implemented. Invalid Route rules can be ignored (sometimes that will mean
- the full Route). If a Route rule transitions from valid to invalid,
- support for that Route rule should be dropped to ensure consistency. For
- example, even if a filter specified by a Route rule is invalid, the rest
- of the rules within that Route should still be supported.
-
- Support: Core
- properties:
- kinds:
- description: |-
- Kinds specifies the groups and kinds of Routes that are allowed to bind
- to this Gateway Listener. When unspecified or empty, the kinds of Routes
- selected are determined using the Listener protocol.
-
- A RouteGroupKind MUST correspond to kinds of Routes that are compatible
- with the application protocol specified in the Listener's Protocol field.
- If an implementation does not support or recognize this resource type, it
- MUST set the "ResolvedRefs" condition to False for this Listener with the
- "InvalidRouteKinds" reason.
-
- Support: Core
- items:
- description: RouteGroupKind indicates the group and kind
- of a Route resource.
- properties:
- group:
- default: gateway.networking.k8s.io
- description: Group is the group of the Route.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is the kind of the Route.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- required:
- - kind
- type: object
- maxItems: 8
- type: array
- namespaces:
- default:
- from: Same
- description: |-
- Namespaces indicates namespaces from which Routes may be attached to this
- Listener. This is restricted to the namespace of this Gateway by default.
-
- Support: Core
- properties:
- from:
- default: Same
- description: |-
- From indicates where Routes will be selected for this Gateway. Possible
- values are:
-
- * All: Routes in all namespaces may be used by this Gateway.
- * Selector: Routes in namespaces selected by the selector may be used by
- this Gateway.
- * Same: Only Routes in the same namespace may be used by this Gateway.
-
- Support: Core
- enum:
- - All
- - Selector
- - Same
- type: string
- selector:
- description: |-
- Selector must be specified when From is set to "Selector". In that case,
- only Routes in Namespaces matching this Selector will be selected by this
- Gateway. This field is ignored for other values of "From".
-
- Support: Core
- properties:
- matchExpressions:
- description: matchExpressions is a list of label
- selector requirements. The requirements are ANDed.
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- properties:
- key:
- description: key is the label key that the
- selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- items:
- type: string
- type: array
- x-kubernetes-list-type: atomic
- required:
- - key
- - operator
- type: object
- type: array
- x-kubernetes-list-type: atomic
- matchLabels:
- additionalProperties:
- type: string
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- type: object
- x-kubernetes-map-type: atomic
- type: object
- type: object
- hostname:
- description: |-
- Hostname specifies the virtual hostname to match for protocol types that
- define this concept. When unspecified, all hostnames are matched. This
- field is ignored for protocols that don't require hostname based
- matching.
-
- Implementations MUST apply Hostname matching appropriately for each of
- the following protocols:
-
- * TLS: The Listener Hostname MUST match the SNI.
- * HTTP: The Listener Hostname MUST match the Host header of the request.
- * HTTPS: The Listener Hostname SHOULD match at both the TLS and HTTP
- protocol layers as described above. If an implementation does not
- ensure that both the SNI and Host header match the Listener hostname,
- it MUST clearly document that.
-
- For HTTPRoute and TLSRoute resources, there is an interaction with the
- `spec.hostnames` array. When both listener and route specify hostnames,
- there MUST be an intersection between the values for a Route to be
- accepted. For more information, refer to the Route specific Hostnames
- documentation.
-
- Hostnames that are prefixed with a wildcard label (`*.`) are interpreted
- as a suffix match. That means that a match for `*.example.com` would match
- both `test.example.com`, and `foo.test.example.com`, but not `example.com`.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- name:
- description: |-
- Name is the name of the Listener. This name MUST be unique within a
- Gateway.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- port:
- description: |-
- Port is the network port. Multiple listeners may use the
- same port, subject to the Listener compatibility rules.
-
- Support: Core
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- protocol:
- description: |-
- Protocol specifies the network protocol this listener expects to receive.
-
- Support: Core
- maxLength: 255
- minLength: 1
- pattern: ^[a-zA-Z0-9]([-a-zA-Z0-9]*[a-zA-Z0-9])?$|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9]+$
- type: string
- tls:
- description: |-
- TLS is the TLS configuration for the Listener. This field is required if
- the Protocol field is "HTTPS" or "TLS". It is invalid to set this field
- if the Protocol field is "HTTP", "TCP", or "UDP".
-
- The association of SNIs to Certificate defined in GatewayTLSConfig is
- defined based on the Hostname field for this listener.
-
- The GatewayClass MUST use the longest matching SNI out of all
- available certificates for any TLS handshake.
-
- Support: Core
- properties:
- certificateRefs:
- description: |-
- CertificateRefs contains a series of references to Kubernetes objects that
- contains TLS certificates and private keys. These certificates are used to
- establish a TLS handshake for requests that match the hostname of the
- associated listener.
-
- A single CertificateRef to a Kubernetes Secret has "Core" support.
- Implementations MAY choose to support attaching multiple certificates to
- a Listener, but this behavior is implementation-specific.
-
- References to a resource in different namespace are invalid UNLESS there
- is a ReferenceGrant in the target namespace that allows the certificate
- to be attached. If a ReferenceGrant does not allow this reference, the
- "ResolvedRefs" condition MUST be set to False for this listener with the
- "RefNotPermitted" reason.
-
- This field is required to have at least one element when the mode is set
- to "Terminate" (default) and is optional otherwise.
-
- CertificateRefs can reference to standard Kubernetes resources, i.e.
- Secret, or implementation-specific custom resources.
-
- Support: Core - A single reference to a Kubernetes Secret of type kubernetes.io/tls
-
- Support: Implementation-specific (More than one reference or other resource types)
- items:
- description: |-
- SecretObjectReference identifies an API object including its namespace,
- defaulting to Secret.
-
- The API object must be valid in the cluster; the Group and Kind must
- be registered in the cluster for this reference to be valid.
-
- References to objects with invalid Group and Kind are not valid, and must
- be rejected by the implementation, with appropriate Conditions set
- on the containing object.
- properties:
- group:
- default: ""
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Secret
- description: Kind is kind of the referent. For example
- "Secret".
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referenced object. When unspecified, the local
- namespace is inferred.
-
- Note that when a namespace different than the local namespace is specified,
- a ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- required:
- - name
- type: object
- maxItems: 64
- type: array
- frontendValidation:
- description: |+
- FrontendValidation holds configuration information for validating the frontend (client).
- Setting this field will require clients to send a client certificate
- required for validation during the TLS handshake. In browsers this may result in a dialog appearing
- that requests a user to specify the client certificate.
- The maximum depth of a certificate chain accepted in verification is Implementation specific.
-
- Support: Extended
-
- properties:
- caCertificateRefs:
- description: |-
- CACertificateRefs contains one or more references to
- Kubernetes objects that contain TLS certificates of
- the Certificate Authorities that can be used
- as a trust anchor to validate the certificates presented by the client.
-
- A single CA certificate reference to a Kubernetes ConfigMap
- has "Core" support.
- Implementations MAY choose to support attaching multiple CA certificates to
- a Listener, but this behavior is implementation-specific.
-
- Support: Core - A single reference to a Kubernetes ConfigMap
- with the CA certificate in a key named `ca.crt`.
-
- Support: Implementation-specific (More than one reference, or other kinds
- of resources).
-
- References to a resource in a different namespace are invalid UNLESS there
- is a ReferenceGrant in the target namespace that allows the certificate
- to be attached. If a ReferenceGrant does not allow this reference, the
- "ResolvedRefs" condition MUST be set to False for this listener with the
- "RefNotPermitted" reason.
- items:
- description: |-
- ObjectReference identifies an API object including its namespace.
-
- The API object must be valid in the cluster; the Group and Kind must
- be registered in the cluster for this reference to be valid.
-
- References to objects with invalid Group and Kind are not valid, and must
- be rejected by the implementation, with appropriate Conditions set
- on the containing object.
- properties:
- group:
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is kind of the referent. For
- example "ConfigMap" or "Service".
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referenced object. When unspecified, the local
- namespace is inferred.
-
- Note that when a namespace different than the local namespace is specified,
- a ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- required:
- - group
- - kind
- - name
- type: object
- maxItems: 8
- minItems: 1
- type: array
- type: object
- mode:
- default: Terminate
- description: |-
- Mode defines the TLS behavior for the TLS session initiated by the client.
- There are two possible modes:
-
- - Terminate: The TLS session between the downstream client and the
- Gateway is terminated at the Gateway. This mode requires certificates
- to be specified in some way, such as populating the certificateRefs
- field.
- - Passthrough: The TLS session is NOT terminated by the Gateway. This
- implies that the Gateway can't decipher the TLS stream except for
- the ClientHello message of the TLS protocol. The certificateRefs field
- is ignored in this mode.
-
- Support: Core
- enum:
- - Terminate
- - Passthrough
- type: string
- options:
- additionalProperties:
- description: |-
- AnnotationValue is the value of an annotation in Gateway API. This is used
- for validation of maps such as TLS options. This roughly matches Kubernetes
- annotation validation, although the length validation in that case is based
- on the entire size of the annotations struct.
- maxLength: 4096
- minLength: 0
- type: string
- description: |-
- Options are a list of key/value pairs to enable extended TLS
- configuration for each implementation. For example, configuring the
- minimum TLS version or supported cipher suites.
-
- A set of common keys MAY be defined by the API in the future. To avoid
- any ambiguity, implementation-specific definitions MUST use
- domain-prefixed names, such as `example.com/my-custom-option`.
- Un-prefixed names are reserved for key names defined by Gateway API.
-
- Support: Implementation-specific
- maxProperties: 16
- type: object
- type: object
- x-kubernetes-validations:
- - message: certificateRefs or options must be specified when
- mode is Terminate
- rule: 'self.mode == ''Terminate'' ? size(self.certificateRefs)
- > 0 || size(self.options) > 0 : true'
- required:
- - name
- - port
- - protocol
- type: object
- maxItems: 64
- minItems: 1
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- x-kubernetes-validations:
- - message: tls must not be specified for protocols ['HTTP', 'TCP',
- 'UDP']
- rule: 'self.all(l, l.protocol in [''HTTP'', ''TCP'', ''UDP''] ?
- !has(l.tls) : true)'
- - message: tls mode must be Terminate for protocol HTTPS
- rule: 'self.all(l, (l.protocol == ''HTTPS'' && has(l.tls)) ? (l.tls.mode
- == '''' || l.tls.mode == ''Terminate'') : true)'
- - message: hostname must not be specified for protocols ['TCP', 'UDP']
- rule: 'self.all(l, l.protocol in [''TCP'', ''UDP''] ? (!has(l.hostname)
- || l.hostname == '''') : true)'
- - message: Listener name must be unique within the Gateway
- rule: self.all(l1, self.exists_one(l2, l1.name == l2.name))
- - message: Combination of port, protocol and hostname must be unique
- for each listener
- rule: 'self.all(l1, self.exists_one(l2, l1.port == l2.port && l1.protocol
- == l2.protocol && (has(l1.hostname) && has(l2.hostname) ? l1.hostname
- == l2.hostname : !has(l1.hostname) && !has(l2.hostname))))'
- required:
- - gatewayClassName
- - listeners
- type: object
- status:
- default:
- conditions:
- - lastTransitionTime: "1970-01-01T00:00:00Z"
- message: Waiting for controller
- reason: Pending
- status: Unknown
- type: Accepted
- - lastTransitionTime: "1970-01-01T00:00:00Z"
- message: Waiting for controller
- reason: Pending
- status: Unknown
- type: Programmed
- description: Status defines the current state of Gateway.
- properties:
- addresses:
- description: |+
- Addresses lists the network addresses that have been bound to the
- Gateway.
-
- This list may differ from the addresses provided in the spec under some
- conditions:
-
- * no addresses are specified, all addresses are dynamically assigned
- * a combination of specified and dynamic addresses are assigned
- * a specified address was unusable (e.g. already in use)
-
- items:
- description: GatewayStatusAddress describes a network address that
- is bound to a Gateway.
- oneOf:
- - properties:
- type:
- enum:
- - IPAddress
- value:
- anyOf:
- - format: ipv4
- - format: ipv6
- - properties:
- type:
- not:
- enum:
- - IPAddress
- properties:
- type:
- default: IPAddress
- description: Type of the address.
- maxLength: 253
- minLength: 1
- pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
- type: string
- value:
- description: |-
- Value of the address. The validity of the values will depend
- on the type and support by the controller.
-
- Examples: `1.2.3.4`, `128::1`, `my-ip-address`.
- maxLength: 253
- minLength: 1
- type: string
- required:
- - value
- type: object
- x-kubernetes-validations:
- - message: Hostname value must only contain valid characters (matching
- ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)
- rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""):
- true'
- maxItems: 16
- type: array
- conditions:
- default:
- - lastTransitionTime: "1970-01-01T00:00:00Z"
- message: Waiting for controller
- reason: Pending
- status: Unknown
- type: Accepted
- - lastTransitionTime: "1970-01-01T00:00:00Z"
- message: Waiting for controller
- reason: Pending
- status: Unknown
- type: Programmed
- description: |-
- Conditions describe the current conditions of the Gateway.
-
- Implementations should prefer to express Gateway conditions
- using the `GatewayConditionType` and `GatewayConditionReason`
- constants so that operators and tools can converge on a common
- vocabulary to describe Gateway state.
-
- Known condition types are:
-
- * "Accepted"
- * "Programmed"
- * "Ready"
- items:
- description: Condition contains details for one aspect of the current
- state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False, Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- maxItems: 8
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- listeners:
- description: Listeners provide status for each unique listener port
- defined in the Spec.
- items:
- description: ListenerStatus is the status associated with a Listener.
- properties:
- attachedRoutes:
- description: |-
- AttachedRoutes represents the total number of Routes that have been
- successfully attached to this Listener.
-
- Successful attachment of a Route to a Listener is based solely on the
- combination of the AllowedRoutes field on the corresponding Listener
- and the Route's ParentRefs field. A Route is successfully attached to
- a Listener when it is selected by the Listener's AllowedRoutes field
- AND the Route has a valid ParentRef selecting the whole Gateway
- resource or a specific Listener as a parent resource (more detail on
- attachment semantics can be found in the documentation on the various
- Route kinds ParentRefs fields). Listener or Route status does not impact
- successful attachment, i.e. the AttachedRoutes field count MUST be set
- for Listeners with condition Accepted: false and MUST count successfully
- attached Routes that may themselves have Accepted: false conditions.
-
- Uses for this field include troubleshooting Route attachment and
- measuring blast radius/impact of changes to a Listener.
- format: int32
- type: integer
- conditions:
- description: Conditions describe the current condition of this
- listener.
- items:
- description: Condition contains details for one aspect of
- the current state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False,
- Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- maxItems: 8
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- name:
- description: Name is the name of the Listener that this status
- corresponds to.
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- supportedKinds:
- description: |-
- SupportedKinds is the list indicating the Kinds supported by this
- listener. This MUST represent the kinds an implementation supports for
- that Listener configuration.
-
- If kinds are specified in Spec that are not supported, they MUST NOT
- appear in this list and an implementation MUST set the "ResolvedRefs"
- condition to "False" with the "InvalidRouteKinds" reason. If both valid
- and invalid Route kinds are specified, the implementation MUST
- reference the valid Route kinds that have been specified.
- items:
- description: RouteGroupKind indicates the group and kind of
- a Route resource.
- properties:
- group:
- default: gateway.networking.k8s.io
- description: Group is the group of the Route.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is the kind of the Route.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- required:
- - kind
- type: object
- maxItems: 8
- type: array
- required:
- - attachedRoutes
- - conditions
- - name
- - supportedKinds
- type: object
- maxItems: 64
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- required:
- - spec
- type: object
- served: true
- storage: true
- subresources:
- status: {}
- - additionalPrinterColumns:
- - jsonPath: .spec.gatewayClassName
- name: Class
- type: string
- - jsonPath: .status.addresses[*].value
- name: Address
- type: string
- - jsonPath: .status.conditions[?(@.type=="Programmed")].status
- name: Programmed
- type: string
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- name: v1beta1
- schema:
- openAPIV3Schema:
- description: |-
- Gateway represents an instance of a service-traffic handling infrastructure
- by binding Listeners to a set of IP addresses.
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: Spec defines the desired state of Gateway.
- properties:
- addresses:
- description: |+
- Addresses requested for this Gateway. This is optional and behavior can
- depend on the implementation. If a value is set in the spec and the
- requested address is invalid or unavailable, the implementation MUST
- indicate this in the associated entry in GatewayStatus.Addresses.
-
- The Addresses field represents a request for the address(es) on the
- "outside of the Gateway", that traffic bound for this Gateway will use.
- This could be the IP address or hostname of an external load balancer or
- other networking infrastructure, or some other address that traffic will
- be sent to.
-
- If no Addresses are specified, the implementation MAY schedule the
- Gateway in an implementation-specific manner, assigning an appropriate
- set of Addresses.
-
- The implementation MUST bind all Listeners to every GatewayAddress that
- it assigns to the Gateway and add a corresponding entry in
- GatewayStatus.Addresses.
-
- Support: Extended
-
- items:
- description: GatewayAddress describes an address that can be bound
- to a Gateway.
- oneOf:
- - properties:
- type:
- enum:
- - IPAddress
- value:
- anyOf:
- - format: ipv4
- - format: ipv6
- - properties:
- type:
- not:
- enum:
- - IPAddress
- properties:
- type:
- default: IPAddress
- description: Type of the address.
- maxLength: 253
- minLength: 1
- pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
- type: string
- value:
- description: |-
- Value of the address. The validity of the values will depend
- on the type and support by the controller.
-
- Examples: `1.2.3.4`, `128::1`, `my-ip-address`.
- maxLength: 253
- minLength: 1
- type: string
- required:
- - value
- type: object
- x-kubernetes-validations:
- - message: Hostname value must only contain valid characters (matching
- ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)
- rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""):
- true'
- maxItems: 16
- type: array
- x-kubernetes-validations:
- - message: IPAddress values must be unique
- rule: 'self.all(a1, a1.type == ''IPAddress'' ? self.exists_one(a2,
- a2.type == a1.type && a2.value == a1.value) : true )'
- - message: Hostname values must be unique
- rule: 'self.all(a1, a1.type == ''Hostname'' ? self.exists_one(a2,
- a2.type == a1.type && a2.value == a1.value) : true )'
- backendTLS:
- description: |+
- BackendTLS configures TLS settings for when this Gateway is connecting to
- backends with TLS.
-
- Support: Core
-
- properties:
- clientCertificateRef:
- description: |+
- ClientCertificateRef is a reference to an object that contains a Client
- Certificate and the associated private key.
-
- References to a resource in different namespace are invalid UNLESS there
- is a ReferenceGrant in the target namespace that allows the certificate
- to be attached. If a ReferenceGrant does not allow this reference, the
- "ResolvedRefs" condition MUST be set to False for this listener with the
- "RefNotPermitted" reason.
-
- ClientCertificateRef can reference to standard Kubernetes resources, i.e.
- Secret, or implementation-specific custom resources.
-
- This setting can be overridden on the service level by use of BackendTLSPolicy.
-
- Support: Core
-
- properties:
- group:
- default: ""
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Secret
- description: Kind is kind of the referent. For example "Secret".
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referenced object. When unspecified, the local
- namespace is inferred.
-
- Note that when a namespace different than the local namespace is specified,
- a ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- required:
- - name
- type: object
- type: object
- gatewayClassName:
- description: |-
- GatewayClassName used for this Gateway. This is the name of a
- GatewayClass resource.
- maxLength: 253
- minLength: 1
- type: string
- infrastructure:
- description: |-
- Infrastructure defines infrastructure level attributes about this Gateway instance.
-
- Support: Extended
- properties:
- annotations:
- additionalProperties:
- description: |-
- AnnotationValue is the value of an annotation in Gateway API. This is used
- for validation of maps such as TLS options. This roughly matches Kubernetes
- annotation validation, although the length validation in that case is based
- on the entire size of the annotations struct.
- maxLength: 4096
- minLength: 0
- type: string
- description: |-
- Annotations that SHOULD be applied to any resources created in response to this Gateway.
-
- For implementations creating other Kubernetes objects, this should be the `metadata.annotations` field on resources.
- For other implementations, this refers to any relevant (implementation specific) "annotations" concepts.
-
- An implementation may chose to add additional implementation-specific annotations as they see fit.
-
- Support: Extended
- maxProperties: 8
- type: object
- x-kubernetes-validations:
- - message: Annotation keys must be in the form of an optional
- DNS subdomain prefix followed by a required name segment of
- up to 63 characters.
- rule: self.all(key, key.matches(r"""^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9]$"""))
- - message: If specified, the annotation key's prefix must be a
- DNS subdomain not longer than 253 characters in total.
- rule: self.all(key, key.split("/")[0].size() < 253)
- labels:
- additionalProperties:
- description: |-
- LabelValue is the value of a label in the Gateway API. This is used for validation
- of maps such as Gateway infrastructure labels. This matches the Kubernetes
- label validation rules:
- * must be 63 characters or less (can be empty),
- * unless empty, must begin and end with an alphanumeric character ([a-z0-9A-Z]),
- * could contain dashes (-), underscores (_), dots (.), and alphanumerics between.
-
- Valid values include:
-
- * MyValue
- * my.name
- * 123-my-value
- maxLength: 63
- minLength: 0
- pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
- type: string
- description: |-
- Labels that SHOULD be applied to any resources created in response to this Gateway.
-
- For implementations creating other Kubernetes objects, this should be the `metadata.labels` field on resources.
- For other implementations, this refers to any relevant (implementation specific) "labels" concepts.
-
- An implementation may chose to add additional implementation-specific labels as they see fit.
-
- If an implementation maps these labels to Pods, or any other resource that would need to be recreated when labels
- change, it SHOULD clearly warn about this behavior in documentation.
-
- Support: Extended
- maxProperties: 8
- type: object
- x-kubernetes-validations:
- - message: Label keys must be in the form of an optional DNS subdomain
- prefix followed by a required name segment of up to 63 characters.
- rule: self.all(key, key.matches(r"""^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9]$"""))
- - message: If specified, the label key's prefix must be a DNS
- subdomain not longer than 253 characters in total.
- rule: self.all(key, key.split("/")[0].size() < 253)
- parametersRef:
- description: |-
- ParametersRef is a reference to a resource that contains the configuration
- parameters corresponding to the Gateway. This is optional if the
- controller does not require any additional configuration.
-
- This follows the same semantics as GatewayClass's `parametersRef`, but on a per-Gateway basis
-
- The Gateway's GatewayClass may provide its own `parametersRef`. When both are specified,
- the merging behavior is implementation specific.
- It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway.
-
- Support: Implementation-specific
- properties:
- group:
- description: Group is the group of the referent.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is kind of the referent.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- required:
- - group
- - kind
- - name
- type: object
- type: object
- listeners:
- description: |-
- Listeners associated with this Gateway. Listeners define
- logical endpoints that are bound on this Gateway's addresses.
- At least one Listener MUST be specified.
-
- Each Listener in a set of Listeners (for example, in a single Gateway)
- MUST be _distinct_, in that a traffic flow MUST be able to be assigned to
- exactly one listener. (This section uses "set of Listeners" rather than
- "Listeners in a single Gateway" because implementations MAY merge configuration
- from multiple Gateways onto a single data plane, and these rules _also_
- apply in that case).
-
- Practically, this means that each listener in a set MUST have a unique
- combination of Port, Protocol, and, if supported by the protocol, Hostname.
-
- Some combinations of port, protocol, and TLS settings are considered
- Core support and MUST be supported by implementations based on their
- targeted conformance profile:
-
- HTTP Profile
-
- 1. HTTPRoute, Port: 80, Protocol: HTTP
- 2. HTTPRoute, Port: 443, Protocol: HTTPS, TLS Mode: Terminate, TLS keypair provided
-
- TLS Profile
-
- 1. TLSRoute, Port: 443, Protocol: TLS, TLS Mode: Passthrough
-
- "Distinct" Listeners have the following property:
-
- The implementation can match inbound requests to a single distinct
- Listener. When multiple Listeners share values for fields (for
- example, two Listeners with the same Port value), the implementation
- can match requests to only one of the Listeners using other
- Listener fields.
-
- For example, the following Listener scenarios are distinct:
-
- 1. Multiple Listeners with the same Port that all use the "HTTP"
- Protocol that all have unique Hostname values.
- 2. Multiple Listeners with the same Port that use either the "HTTPS" or
- "TLS" Protocol that all have unique Hostname values.
- 3. A mixture of "TCP" and "UDP" Protocol Listeners, where no Listener
- with the same Protocol has the same Port value.
-
- Some fields in the Listener struct have possible values that affect
- whether the Listener is distinct. Hostname is particularly relevant
- for HTTP or HTTPS protocols.
-
- When using the Hostname value to select between same-Port, same-Protocol
- Listeners, the Hostname value must be different on each Listener for the
- Listener to be distinct.
-
- When the Listeners are distinct based on Hostname, inbound request
- hostnames MUST match from the most specific to least specific Hostname
- values to choose the correct Listener and its associated set of Routes.
-
- Exact matches must be processed before wildcard matches, and wildcard
- matches must be processed before fallback (empty Hostname value)
- matches. For example, `"foo.example.com"` takes precedence over
- `"*.example.com"`, and `"*.example.com"` takes precedence over `""`.
-
- Additionally, if there are multiple wildcard entries, more specific
- wildcard entries must be processed before less specific wildcard entries.
- For example, `"*.foo.example.com"` takes precedence over `"*.example.com"`.
- The precise definition here is that the higher the number of dots in the
- hostname to the right of the wildcard character, the higher the precedence.
-
- The wildcard character will match any number of characters _and dots_ to
- the left, however, so `"*.example.com"` will match both
- `"foo.bar.example.com"` _and_ `"bar.example.com"`.
-
- If a set of Listeners contains Listeners that are not distinct, then those
- Listeners are Conflicted, and the implementation MUST set the "Conflicted"
- condition in the Listener Status to "True".
-
- Implementations MAY choose to accept a Gateway with some Conflicted
- Listeners only if they only accept the partial Listener set that contains
- no Conflicted Listeners. To put this another way, implementations may
- accept a partial Listener set only if they throw out *all* the conflicting
- Listeners. No picking one of the conflicting listeners as the winner.
- This also means that the Gateway must have at least one non-conflicting
- Listener in this case, otherwise it violates the requirement that at
- least one Listener must be present.
-
- The implementation MUST set a "ListenersNotValid" condition on the
- Gateway Status when the Gateway contains Conflicted Listeners whether or
- not they accept the Gateway. That Condition SHOULD clearly
- indicate in the Message which Listeners are conflicted, and which are
- Accepted. Additionally, the Listener status for those listeners SHOULD
- indicate which Listeners are conflicted and not Accepted.
-
- A Gateway's Listeners are considered "compatible" if:
-
- 1. They are distinct.
- 2. The implementation can serve them in compliance with the Addresses
- requirement that all Listeners are available on all assigned
- addresses.
-
- Compatible combinations in Extended support are expected to vary across
- implementations. A combination that is compatible for one implementation
- may not be compatible for another.
-
- For example, an implementation that cannot serve both TCP and UDP listeners
- on the same address, or cannot mix HTTPS and generic TLS listens on the same port
- would not consider those cases compatible, even though they are distinct.
-
- Note that requests SHOULD match at most one Listener. For example, if
- Listeners are defined for "foo.example.com" and "*.example.com", a
- request to "foo.example.com" SHOULD only be routed using routes attached
- to the "foo.example.com" Listener (and not the "*.example.com" Listener).
- This concept is known as "Listener Isolation". Implementations that do
- not support Listener Isolation MUST clearly document this.
-
- Implementations MAY merge separate Gateways onto a single set of
- Addresses if all Listeners across all Gateways are compatible.
-
- Support: Core
- items:
- description: |-
- Listener embodies the concept of a logical endpoint where a Gateway accepts
- network connections.
- properties:
- allowedRoutes:
- default:
- namespaces:
- from: Same
- description: |-
- AllowedRoutes defines the types of routes that MAY be attached to a
- Listener and the trusted namespaces where those Route resources MAY be
- present.
-
- Although a client request may match multiple route rules, only one rule
- may ultimately receive the request. Matching precedence MUST be
- determined in order of the following criteria:
-
- * The most specific match as defined by the Route type.
- * The oldest Route based on creation timestamp. For example, a Route with
- a creation timestamp of "2020-09-08 01:02:03" is given precedence over
- a Route with a creation timestamp of "2020-09-08 01:02:04".
- * If everything else is equivalent, the Route appearing first in
- alphabetical order (namespace/name) should be given precedence. For
- example, foo/bar is given precedence over foo/baz.
-
- All valid rules within a Route attached to this Listener should be
- implemented. Invalid Route rules can be ignored (sometimes that will mean
- the full Route). If a Route rule transitions from valid to invalid,
- support for that Route rule should be dropped to ensure consistency. For
- example, even if a filter specified by a Route rule is invalid, the rest
- of the rules within that Route should still be supported.
-
- Support: Core
- properties:
- kinds:
- description: |-
- Kinds specifies the groups and kinds of Routes that are allowed to bind
- to this Gateway Listener. When unspecified or empty, the kinds of Routes
- selected are determined using the Listener protocol.
-
- A RouteGroupKind MUST correspond to kinds of Routes that are compatible
- with the application protocol specified in the Listener's Protocol field.
- If an implementation does not support or recognize this resource type, it
- MUST set the "ResolvedRefs" condition to False for this Listener with the
- "InvalidRouteKinds" reason.
-
- Support: Core
- items:
- description: RouteGroupKind indicates the group and kind
- of a Route resource.
- properties:
- group:
- default: gateway.networking.k8s.io
- description: Group is the group of the Route.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is the kind of the Route.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- required:
- - kind
- type: object
- maxItems: 8
- type: array
- namespaces:
- default:
- from: Same
- description: |-
- Namespaces indicates namespaces from which Routes may be attached to this
- Listener. This is restricted to the namespace of this Gateway by default.
-
- Support: Core
- properties:
- from:
- default: Same
- description: |-
- From indicates where Routes will be selected for this Gateway. Possible
- values are:
-
- * All: Routes in all namespaces may be used by this Gateway.
- * Selector: Routes in namespaces selected by the selector may be used by
- this Gateway.
- * Same: Only Routes in the same namespace may be used by this Gateway.
-
- Support: Core
- enum:
- - All
- - Selector
- - Same
- type: string
- selector:
- description: |-
- Selector must be specified when From is set to "Selector". In that case,
- only Routes in Namespaces matching this Selector will be selected by this
- Gateway. This field is ignored for other values of "From".
-
- Support: Core
- properties:
- matchExpressions:
- description: matchExpressions is a list of label
- selector requirements. The requirements are ANDed.
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- properties:
- key:
- description: key is the label key that the
- selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- items:
- type: string
- type: array
- x-kubernetes-list-type: atomic
- required:
- - key
- - operator
- type: object
- type: array
- x-kubernetes-list-type: atomic
- matchLabels:
- additionalProperties:
- type: string
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- type: object
- x-kubernetes-map-type: atomic
- type: object
- type: object
- hostname:
- description: |-
- Hostname specifies the virtual hostname to match for protocol types that
- define this concept. When unspecified, all hostnames are matched. This
- field is ignored for protocols that don't require hostname based
- matching.
-
- Implementations MUST apply Hostname matching appropriately for each of
- the following protocols:
-
- * TLS: The Listener Hostname MUST match the SNI.
- * HTTP: The Listener Hostname MUST match the Host header of the request.
- * HTTPS: The Listener Hostname SHOULD match at both the TLS and HTTP
- protocol layers as described above. If an implementation does not
- ensure that both the SNI and Host header match the Listener hostname,
- it MUST clearly document that.
-
- For HTTPRoute and TLSRoute resources, there is an interaction with the
- `spec.hostnames` array. When both listener and route specify hostnames,
- there MUST be an intersection between the values for a Route to be
- accepted. For more information, refer to the Route specific Hostnames
- documentation.
-
- Hostnames that are prefixed with a wildcard label (`*.`) are interpreted
- as a suffix match. That means that a match for `*.example.com` would match
- both `test.example.com`, and `foo.test.example.com`, but not `example.com`.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- name:
- description: |-
- Name is the name of the Listener. This name MUST be unique within a
- Gateway.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- port:
- description: |-
- Port is the network port. Multiple listeners may use the
- same port, subject to the Listener compatibility rules.
-
- Support: Core
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- protocol:
- description: |-
- Protocol specifies the network protocol this listener expects to receive.
-
- Support: Core
- maxLength: 255
- minLength: 1
- pattern: ^[a-zA-Z0-9]([-a-zA-Z0-9]*[a-zA-Z0-9])?$|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9]+$
- type: string
- tls:
- description: |-
- TLS is the TLS configuration for the Listener. This field is required if
- the Protocol field is "HTTPS" or "TLS". It is invalid to set this field
- if the Protocol field is "HTTP", "TCP", or "UDP".
-
- The association of SNIs to Certificate defined in GatewayTLSConfig is
- defined based on the Hostname field for this listener.
-
- The GatewayClass MUST use the longest matching SNI out of all
- available certificates for any TLS handshake.
-
- Support: Core
- properties:
- certificateRefs:
- description: |-
- CertificateRefs contains a series of references to Kubernetes objects that
- contains TLS certificates and private keys. These certificates are used to
- establish a TLS handshake for requests that match the hostname of the
- associated listener.
-
- A single CertificateRef to a Kubernetes Secret has "Core" support.
- Implementations MAY choose to support attaching multiple certificates to
- a Listener, but this behavior is implementation-specific.
-
- References to a resource in different namespace are invalid UNLESS there
- is a ReferenceGrant in the target namespace that allows the certificate
- to be attached. If a ReferenceGrant does not allow this reference, the
- "ResolvedRefs" condition MUST be set to False for this listener with the
- "RefNotPermitted" reason.
-
- This field is required to have at least one element when the mode is set
- to "Terminate" (default) and is optional otherwise.
-
- CertificateRefs can reference to standard Kubernetes resources, i.e.
- Secret, or implementation-specific custom resources.
-
- Support: Core - A single reference to a Kubernetes Secret of type kubernetes.io/tls
-
- Support: Implementation-specific (More than one reference or other resource types)
- items:
- description: |-
- SecretObjectReference identifies an API object including its namespace,
- defaulting to Secret.
-
- The API object must be valid in the cluster; the Group and Kind must
- be registered in the cluster for this reference to be valid.
-
- References to objects with invalid Group and Kind are not valid, and must
- be rejected by the implementation, with appropriate Conditions set
- on the containing object.
- properties:
- group:
- default: ""
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Secret
- description: Kind is kind of the referent. For example
- "Secret".
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referenced object. When unspecified, the local
- namespace is inferred.
-
- Note that when a namespace different than the local namespace is specified,
- a ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- required:
- - name
- type: object
- maxItems: 64
- type: array
- frontendValidation:
- description: |+
- FrontendValidation holds configuration information for validating the frontend (client).
- Setting this field will require clients to send a client certificate
- required for validation during the TLS handshake. In browsers this may result in a dialog appearing
- that requests a user to specify the client certificate.
- The maximum depth of a certificate chain accepted in verification is Implementation specific.
-
- Support: Extended
-
- properties:
- caCertificateRefs:
- description: |-
- CACertificateRefs contains one or more references to
- Kubernetes objects that contain TLS certificates of
- the Certificate Authorities that can be used
- as a trust anchor to validate the certificates presented by the client.
-
- A single CA certificate reference to a Kubernetes ConfigMap
- has "Core" support.
- Implementations MAY choose to support attaching multiple CA certificates to
- a Listener, but this behavior is implementation-specific.
-
- Support: Core - A single reference to a Kubernetes ConfigMap
- with the CA certificate in a key named `ca.crt`.
-
- Support: Implementation-specific (More than one reference, or other kinds
- of resources).
-
- References to a resource in a different namespace are invalid UNLESS there
- is a ReferenceGrant in the target namespace that allows the certificate
- to be attached. If a ReferenceGrant does not allow this reference, the
- "ResolvedRefs" condition MUST be set to False for this listener with the
- "RefNotPermitted" reason.
- items:
- description: |-
- ObjectReference identifies an API object including its namespace.
-
- The API object must be valid in the cluster; the Group and Kind must
- be registered in the cluster for this reference to be valid.
-
- References to objects with invalid Group and Kind are not valid, and must
- be rejected by the implementation, with appropriate Conditions set
- on the containing object.
- properties:
- group:
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is kind of the referent. For
- example "ConfigMap" or "Service".
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referenced object. When unspecified, the local
- namespace is inferred.
-
- Note that when a namespace different than the local namespace is specified,
- a ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- required:
- - group
- - kind
- - name
- type: object
- maxItems: 8
- minItems: 1
- type: array
- type: object
- mode:
- default: Terminate
- description: |-
- Mode defines the TLS behavior for the TLS session initiated by the client.
- There are two possible modes:
-
- - Terminate: The TLS session between the downstream client and the
- Gateway is terminated at the Gateway. This mode requires certificates
- to be specified in some way, such as populating the certificateRefs
- field.
- - Passthrough: The TLS session is NOT terminated by the Gateway. This
- implies that the Gateway can't decipher the TLS stream except for
- the ClientHello message of the TLS protocol. The certificateRefs field
- is ignored in this mode.
-
- Support: Core
- enum:
- - Terminate
- - Passthrough
- type: string
- options:
- additionalProperties:
- description: |-
- AnnotationValue is the value of an annotation in Gateway API. This is used
- for validation of maps such as TLS options. This roughly matches Kubernetes
- annotation validation, although the length validation in that case is based
- on the entire size of the annotations struct.
- maxLength: 4096
- minLength: 0
- type: string
- description: |-
- Options are a list of key/value pairs to enable extended TLS
- configuration for each implementation. For example, configuring the
- minimum TLS version or supported cipher suites.
-
- A set of common keys MAY be defined by the API in the future. To avoid
- any ambiguity, implementation-specific definitions MUST use
- domain-prefixed names, such as `example.com/my-custom-option`.
- Un-prefixed names are reserved for key names defined by Gateway API.
-
- Support: Implementation-specific
- maxProperties: 16
- type: object
- type: object
- x-kubernetes-validations:
- - message: certificateRefs or options must be specified when
- mode is Terminate
- rule: 'self.mode == ''Terminate'' ? size(self.certificateRefs)
- > 0 || size(self.options) > 0 : true'
- required:
- - name
- - port
- - protocol
- type: object
- maxItems: 64
- minItems: 1
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- x-kubernetes-validations:
- - message: tls must not be specified for protocols ['HTTP', 'TCP',
- 'UDP']
- rule: 'self.all(l, l.protocol in [''HTTP'', ''TCP'', ''UDP''] ?
- !has(l.tls) : true)'
- - message: tls mode must be Terminate for protocol HTTPS
- rule: 'self.all(l, (l.protocol == ''HTTPS'' && has(l.tls)) ? (l.tls.mode
- == '''' || l.tls.mode == ''Terminate'') : true)'
- - message: hostname must not be specified for protocols ['TCP', 'UDP']
- rule: 'self.all(l, l.protocol in [''TCP'', ''UDP''] ? (!has(l.hostname)
- || l.hostname == '''') : true)'
- - message: Listener name must be unique within the Gateway
- rule: self.all(l1, self.exists_one(l2, l1.name == l2.name))
- - message: Combination of port, protocol and hostname must be unique
- for each listener
- rule: 'self.all(l1, self.exists_one(l2, l1.port == l2.port && l1.protocol
- == l2.protocol && (has(l1.hostname) && has(l2.hostname) ? l1.hostname
- == l2.hostname : !has(l1.hostname) && !has(l2.hostname))))'
- required:
- - gatewayClassName
- - listeners
- type: object
- status:
- default:
- conditions:
- - lastTransitionTime: "1970-01-01T00:00:00Z"
- message: Waiting for controller
- reason: Pending
- status: Unknown
- type: Accepted
- - lastTransitionTime: "1970-01-01T00:00:00Z"
- message: Waiting for controller
- reason: Pending
- status: Unknown
- type: Programmed
- description: Status defines the current state of Gateway.
- properties:
- addresses:
- description: |+
- Addresses lists the network addresses that have been bound to the
- Gateway.
-
- This list may differ from the addresses provided in the spec under some
- conditions:
-
- * no addresses are specified, all addresses are dynamically assigned
- * a combination of specified and dynamic addresses are assigned
- * a specified address was unusable (e.g. already in use)
-
- items:
- description: GatewayStatusAddress describes a network address that
- is bound to a Gateway.
- oneOf:
- - properties:
- type:
- enum:
- - IPAddress
- value:
- anyOf:
- - format: ipv4
- - format: ipv6
- - properties:
- type:
- not:
- enum:
- - IPAddress
- properties:
- type:
- default: IPAddress
- description: Type of the address.
- maxLength: 253
- minLength: 1
- pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
- type: string
- value:
- description: |-
- Value of the address. The validity of the values will depend
- on the type and support by the controller.
-
- Examples: `1.2.3.4`, `128::1`, `my-ip-address`.
- maxLength: 253
- minLength: 1
- type: string
- required:
- - value
- type: object
- x-kubernetes-validations:
- - message: Hostname value must only contain valid characters (matching
- ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)
- rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""):
- true'
- maxItems: 16
- type: array
- conditions:
- default:
- - lastTransitionTime: "1970-01-01T00:00:00Z"
- message: Waiting for controller
- reason: Pending
- status: Unknown
- type: Accepted
- - lastTransitionTime: "1970-01-01T00:00:00Z"
- message: Waiting for controller
- reason: Pending
- status: Unknown
- type: Programmed
- description: |-
- Conditions describe the current conditions of the Gateway.
-
- Implementations should prefer to express Gateway conditions
- using the `GatewayConditionType` and `GatewayConditionReason`
- constants so that operators and tools can converge on a common
- vocabulary to describe Gateway state.
-
- Known condition types are:
-
- * "Accepted"
- * "Programmed"
- * "Ready"
- items:
- description: Condition contains details for one aspect of the current
- state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False, Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- maxItems: 8
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- listeners:
- description: Listeners provide status for each unique listener port
- defined in the Spec.
- items:
- description: ListenerStatus is the status associated with a Listener.
- properties:
- attachedRoutes:
- description: |-
- AttachedRoutes represents the total number of Routes that have been
- successfully attached to this Listener.
-
- Successful attachment of a Route to a Listener is based solely on the
- combination of the AllowedRoutes field on the corresponding Listener
- and the Route's ParentRefs field. A Route is successfully attached to
- a Listener when it is selected by the Listener's AllowedRoutes field
- AND the Route has a valid ParentRef selecting the whole Gateway
- resource or a specific Listener as a parent resource (more detail on
- attachment semantics can be found in the documentation on the various
- Route kinds ParentRefs fields). Listener or Route status does not impact
- successful attachment, i.e. the AttachedRoutes field count MUST be set
- for Listeners with condition Accepted: false and MUST count successfully
- attached Routes that may themselves have Accepted: false conditions.
-
- Uses for this field include troubleshooting Route attachment and
- measuring blast radius/impact of changes to a Listener.
- format: int32
- type: integer
- conditions:
- description: Conditions describe the current condition of this
- listener.
- items:
- description: Condition contains details for one aspect of
- the current state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False,
- Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- maxItems: 8
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- name:
- description: Name is the name of the Listener that this status
- corresponds to.
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- supportedKinds:
- description: |-
- SupportedKinds is the list indicating the Kinds supported by this
- listener. This MUST represent the kinds an implementation supports for
- that Listener configuration.
-
- If kinds are specified in Spec that are not supported, they MUST NOT
- appear in this list and an implementation MUST set the "ResolvedRefs"
- condition to "False" with the "InvalidRouteKinds" reason. If both valid
- and invalid Route kinds are specified, the implementation MUST
- reference the valid Route kinds that have been specified.
- items:
- description: RouteGroupKind indicates the group and kind of
- a Route resource.
- properties:
- group:
- default: gateway.networking.k8s.io
- description: Group is the group of the Route.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is the kind of the Route.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- required:
- - kind
- type: object
- maxItems: 8
- type: array
- required:
- - attachedRoutes
- - conditions
- - name
- - supportedKinds
- type: object
- maxItems: 64
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- required:
- - spec
- type: object
- served: true
- storage: false
- subresources:
- status: {}
-status:
- acceptedNames:
- kind: ""
- plural: ""
- conditions: null
- storedVersions: null
----
-#
-# config/crd/experimental/gateway.networking.k8s.io_grpcroutes.yaml
-#
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
- gateway.networking.k8s.io/bundle-version: v1.2.1
- gateway.networking.k8s.io/channel: experimental
- creationTimestamp: null
- name: grpcroutes.gateway.networking.k8s.io
-spec:
- group: gateway.networking.k8s.io
- names:
- categories:
- - gateway-api
- kind: GRPCRoute
- listKind: GRPCRouteList
- plural: grpcroutes
- singular: grpcroute
- scope: Namespaced
- versions:
- - additionalPrinterColumns:
- - jsonPath: .spec.hostnames
- name: Hostnames
- type: string
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- name: v1
- schema:
- openAPIV3Schema:
- description: |-
- GRPCRoute provides a way to route gRPC requests. This includes the capability
- to match requests by hostname, gRPC service, gRPC method, or HTTP/2 header.
- Filters can be used to specify additional processing steps. Backends specify
- where matching requests will be routed.
-
- GRPCRoute falls under extended support within the Gateway API. Within the
- following specification, the word "MUST" indicates that an implementation
- supporting GRPCRoute must conform to the indicated requirement, but an
- implementation not supporting this route type need not follow the requirement
- unless explicitly indicated.
-
- Implementations supporting `GRPCRoute` with the `HTTPS` `ProtocolType` MUST
- accept HTTP/2 connections without an initial upgrade from HTTP/1.1, i.e. via
- ALPN. If the implementation does not support this, then it MUST set the
- "Accepted" condition to "False" for the affected listener with a reason of
- "UnsupportedProtocol". Implementations MAY also accept HTTP/2 connections
- with an upgrade from HTTP/1.
-
- Implementations supporting `GRPCRoute` with the `HTTP` `ProtocolType` MUST
- support HTTP/2 over cleartext TCP (h2c,
- https://www.rfc-editor.org/rfc/rfc7540#section-3.1) without an initial
- upgrade from HTTP/1.1, i.e. with prior knowledge
- (https://www.rfc-editor.org/rfc/rfc7540#section-3.4). If the implementation
- does not support this, then it MUST set the "Accepted" condition to "False"
- for the affected listener with a reason of "UnsupportedProtocol".
- Implementations MAY also accept HTTP/2 connections with an upgrade from
- HTTP/1, i.e. without prior knowledge.
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: Spec defines the desired state of GRPCRoute.
- properties:
- hostnames:
- description: |-
- Hostnames defines a set of hostnames to match against the GRPC
- Host header to select a GRPCRoute to process the request. This matches
- the RFC 1123 definition of a hostname with 2 notable exceptions:
-
- 1. IPs are not allowed.
- 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard
- label MUST appear by itself as the first label.
-
- If a hostname is specified by both the Listener and GRPCRoute, there
- MUST be at least one intersecting hostname for the GRPCRoute to be
- attached to the Listener. For example:
-
- * A Listener with `test.example.com` as the hostname matches GRPCRoutes
- that have either not specified any hostnames, or have specified at
- least one of `test.example.com` or `*.example.com`.
- * A Listener with `*.example.com` as the hostname matches GRPCRoutes
- that have either not specified any hostnames or have specified at least
- one hostname that matches the Listener hostname. For example,
- `test.example.com` and `*.example.com` would both match. On the other
- hand, `example.com` and `test.example.net` would not match.
-
- Hostnames that are prefixed with a wildcard label (`*.`) are interpreted
- as a suffix match. That means that a match for `*.example.com` would match
- both `test.example.com`, and `foo.test.example.com`, but not `example.com`.
-
- If both the Listener and GRPCRoute have specified hostnames, any
- GRPCRoute hostnames that do not match the Listener hostname MUST be
- ignored. For example, if a Listener specified `*.example.com`, and the
- GRPCRoute specified `test.example.com` and `test.example.net`,
- `test.example.net` MUST NOT be considered for a match.
-
- If both the Listener and GRPCRoute have specified hostnames, and none
- match with the criteria above, then the GRPCRoute MUST NOT be accepted by
- the implementation. The implementation MUST raise an 'Accepted' Condition
- with a status of `False` in the corresponding RouteParentStatus.
-
- If a Route (A) of type HTTPRoute or GRPCRoute is attached to a
- Listener and that listener already has another Route (B) of the other
- type attached and the intersection of the hostnames of A and B is
- non-empty, then the implementation MUST accept exactly one of these two
- routes, determined by the following criteria, in order:
-
- * The oldest Route based on creation timestamp.
- * The Route appearing first in alphabetical order by
- "{namespace}/{name}".
-
- The rejected Route MUST raise an 'Accepted' condition with a status of
- 'False' in the corresponding RouteParentStatus.
-
- Support: Core
- items:
- description: |-
- Hostname is the fully qualified domain name of a network host. This matches
- the RFC 1123 definition of a hostname with 2 notable exceptions:
-
- 1. IPs are not allowed.
- 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard
- label must appear by itself as the first label.
-
- Hostname can be "precise" which is a domain name without the terminating
- dot of a network host (e.g. "foo.example.com") or "wildcard", which is a
- domain name prefixed with a single wildcard label (e.g. `*.example.com`).
-
- Note that as per RFC1035 and RFC1123, a *label* must consist of lower case
- alphanumeric characters or '-', and must start and end with an alphanumeric
- character. No other punctuation is allowed.
- maxLength: 253
- minLength: 1
- pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- maxItems: 16
- type: array
- parentRefs:
- description: |+
- ParentRefs references the resources (usually Gateways) that a Route wants
- to be attached to. Note that the referenced parent resource needs to
- allow this for the attachment to be complete. For Gateways, that means
- the Gateway needs to allow attachment from Routes of this kind and
- namespace. For Services, that means the Service must either be in the same
- namespace for a "producer" route, or the mesh implementation must support
- and allow "consumer" routes for the referenced Service. ReferenceGrant is
- not applicable for governing ParentRefs to Services - it is not possible to
- create a "producer" route for a Service in a different namespace from the
- Route.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- This API may be extended in the future to support additional kinds of parent
- resources.
-
- ParentRefs must be _distinct_. This means either that:
-
- * They select different objects. If this is the case, then parentRef
- entries are distinct. In terms of fields, this means that the
- multi-part key defined by `group`, `kind`, `namespace`, and `name` must
- be unique across all parentRef entries in the Route.
- * They do not select different objects, but for each optional field used,
- each ParentRef that selects the same object must set the same set of
- optional fields to different values. If one ParentRef sets a
- combination of optional fields, all must set the same combination.
-
- Some examples:
-
- * If one ParentRef sets `sectionName`, all ParentRefs referencing the
- same object must also set `sectionName`.
- * If one ParentRef sets `port`, all ParentRefs referencing the same
- object must also set `port`.
- * If one ParentRef sets `sectionName` and `port`, all ParentRefs
- referencing the same object must also set `sectionName` and `port`.
-
- It is possible to separately reference multiple distinct objects that may
- be collapsed by an implementation. For example, some implementations may
- choose to merge compatible Gateway Listeners together. If that is the
- case, the list of routes attached to those resources should also be
- merged.
-
- Note that for ParentRefs that cross namespace boundaries, there are specific
- rules. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example,
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable other kinds of cross-namespace reference.
-
-
- ParentRefs from a Route to a Service in the same namespace are "producer"
- routes, which apply default routing rules to inbound connections from
- any namespace to the Service.
-
- ParentRefs from a Route to a Service in a different namespace are
- "consumer" routes, and these routing rules are only applied to outbound
- connections originating from the same namespace as the Route, for which
- the intended destination of the connections are a Service targeted as a
- ParentRef of the Route.
-
-
-
-
-
- items:
- description: |-
- ParentReference identifies an API object (usually a Gateway) that can be considered
- a parent of this resource (usually a route). There are two kinds of parent resources
- with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- This API may be extended in the future to support additional kinds of parent
- resources.
-
- The API object must be valid in the cluster; the Group and Kind must
- be registered in the cluster for this reference to be valid.
- properties:
- group:
- default: gateway.networking.k8s.io
- description: |-
- Group is the group of the referent.
- When unspecified, "gateway.networking.k8s.io" is inferred.
- To set the core API group (such as for a "Service" kind referent),
- Group must be explicitly set to "" (empty string).
-
- Support: Core
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Gateway
- description: |-
- Kind is kind of the referent.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- Support for other resources is Implementation-Specific.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: |-
- Name is the name of the referent.
-
- Support: Core
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referent. When unspecified, this refers
- to the local namespace of the Route.
-
- Note that there are specific rules for ParentRefs which cross namespace
- boundaries. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example:
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable any other kind of cross-namespace reference.
-
-
- ParentRefs from a Route to a Service in the same namespace are "producer"
- routes, which apply default routing rules to inbound connections from
- any namespace to the Service.
-
- ParentRefs from a Route to a Service in a different namespace are
- "consumer" routes, and these routing rules are only applied to outbound
- connections originating from the same namespace as the Route, for which
- the intended destination of the connections are a Service targeted as a
- ParentRef of the Route.
-
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port is the network port this Route targets. It can be interpreted
- differently based on the type of parent resource.
-
- When the parent resource is a Gateway, this targets all listeners
- listening on the specified port that also support this kind of Route(and
- select this Route). It's not recommended to set `Port` unless the
- networking behaviors specified in a Route must apply to a specific port
- as opposed to a listener(s) whose port(s) may be changed. When both Port
- and SectionName are specified, the name and port of the selected listener
- must match both specified values.
-
-
- When the parent resource is a Service, this targets a specific port in the
- Service spec. When both Port (experimental) and SectionName are specified,
- the name and port of the selected port must match both specified values.
-
-
- Implementations MAY choose to support other parent resources.
- Implementations supporting other types of parent resources MUST clearly
- document how/if Port is interpreted.
-
- For the purpose of status, an attachment is considered successful as
- long as the parent resource accepts it partially. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
- from the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route,
- the Route MUST be considered detached from the Gateway.
-
- Support: Extended
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- sectionName:
- description: |-
- SectionName is the name of a section within the target resource. In the
- following resources, SectionName is interpreted as the following:
-
- * Gateway: Listener name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
- * Service: Port name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
-
- Implementations MAY choose to support attaching Routes to other resources.
- If that is the case, they MUST clearly document how SectionName is
- interpreted.
-
- When unspecified (empty string), this will reference the entire resource.
- For the purpose of status, an attachment is considered successful if at
- least one section in the parent resource accepts it. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
- the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route, the
- Route MUST be considered detached from the Gateway.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- required:
- - name
- type: object
- maxItems: 32
- type: array
- x-kubernetes-validations:
- - message: sectionName or port must be specified when parentRefs includes
- 2 or more references to the same parent
- rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind
- == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__)
- || p1.__namespace__ == '''') && (!has(p2.__namespace__) || p2.__namespace__
- == '''')) || (has(p1.__namespace__) && has(p2.__namespace__) &&
- p1.__namespace__ == p2.__namespace__)) ? ((!has(p1.sectionName)
- || p1.sectionName == '''') == (!has(p2.sectionName) || p2.sectionName
- == '''') && (!has(p1.port) || p1.port == 0) == (!has(p2.port)
- || p2.port == 0)): true))'
- - message: sectionName or port must be unique when parentRefs includes
- 2 or more references to the same parent
- rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind
- == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__)
- || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__
- == '')) || (has(p1.__namespace__) && has(p2.__namespace__) &&
- p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName)
- || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName
- == '')) || ( has(p1.sectionName) && has(p2.sectionName) && p1.sectionName
- == p2.sectionName)) && (((!has(p1.port) || p1.port == 0) && (!has(p2.port)
- || p2.port == 0)) || (has(p1.port) && has(p2.port) && p1.port
- == p2.port))))
- rules:
- description: |+
- Rules are a list of GRPC matchers, filters and actions.
-
- items:
- description: |-
- GRPCRouteRule defines the semantics for matching a gRPC request based on
- conditions (matches), processing it (filters), and forwarding the request to
- an API object (backendRefs).
- properties:
- backendRefs:
- description: |-
- BackendRefs defines the backend(s) where matching requests should be
- sent.
-
- Failure behavior here depends on how many BackendRefs are specified and
- how many are invalid.
-
- If *all* entries in BackendRefs are invalid, and there are also no filters
- specified in this route rule, *all* traffic which matches this rule MUST
- receive an `UNAVAILABLE` status.
-
- See the GRPCBackendRef definition for the rules about what makes a single
- GRPCBackendRef invalid.
-
- When a GRPCBackendRef is invalid, `UNAVAILABLE` statuses MUST be returned for
- requests that would have otherwise been routed to an invalid backend. If
- multiple backends are specified, and some are invalid, the proportion of
- requests that would otherwise have been routed to an invalid backend
- MUST receive an `UNAVAILABLE` status.
-
- For example, if two backends are specified with equal weights, and one is
- invalid, 50 percent of traffic MUST receive an `UNAVAILABLE` status.
- Implementations may choose how that 50 percent is determined.
-
- Support: Core for Kubernetes Service
-
- Support: Implementation-specific for any other resource
-
- Support for weight: Core
- items:
- description: |-
- GRPCBackendRef defines how a GRPCRoute forwards a gRPC request.
-
- Note that when a namespace different than the local namespace is specified, a
- ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
-
-
- When the BackendRef points to a Kubernetes Service, implementations SHOULD
- honor the appProtocol field if it is set for the target Service Port.
-
- Implementations supporting appProtocol SHOULD recognize the Kubernetes
- Standard Application Protocols defined in KEP-3726.
-
- If a Service appProtocol isn't specified, an implementation MAY infer the
- backend protocol through its own means. Implementations MAY infer the
- protocol from the Route type referring to the backend Service.
-
- If a Route is not able to send traffic to the backend using the specified
- protocol then the backend is considered invalid. Implementations MUST set the
- "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason.
-
-
- properties:
- filters:
- description: |-
- Filters defined at this level MUST be executed if and only if the
- request is being forwarded to the backend defined here.
-
- Support: Implementation-specific (For broader support of filters, use the
- Filters field in GRPCRouteRule.)
- items:
- description: |-
- GRPCRouteFilter defines processing steps that must be completed during the
- request or response lifecycle. GRPCRouteFilters are meant as an extension
- point to express processing that may be done in Gateway implementations. Some
- examples include request or response modification, implementing
- authentication strategies, rate-limiting, and traffic shaping. API
- guarantee/conformance is defined based on the type of the filter.
- properties:
- extensionRef:
- description: |-
- ExtensionRef is an optional, implementation-specific extension to the
- "filter" behavior. For example, resource "myroutefilter" in group
- "networking.example.net"). ExtensionRef MUST NOT be used for core and
- extended filters.
-
- Support: Implementation-specific
-
- This filter can be used multiple times within the same rule.
- properties:
- group:
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is kind of the referent. For
- example "HTTPRoute" or "Service".
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- required:
- - group
- - kind
- - name
- type: object
- requestHeaderModifier:
- description: |-
- RequestHeaderModifier defines a schema for a filter that modifies request
- headers.
-
- Support: Core
- properties:
- add:
- description: |-
- Add adds the given header(s) (name, value) to the request
- before the action. It appends to any existing values associated
- with the header name.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- add:
- - name: "my-header"
- value: "bar,baz"
-
- Output:
- GET /foo HTTP/1.1
- my-header: foo,bar,baz
- items:
- description: HTTPHeader represents an HTTP
- Header name and value as defined by RFC
- 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP
- Header to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- remove:
- description: |-
- Remove the given header(s) from the HTTP request before the action. The
- value of Remove is a list of HTTP header names. Note that the header
- names are case-insensitive (see
- https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).
-
- Input:
- GET /foo HTTP/1.1
- my-header1: foo
- my-header2: bar
- my-header3: baz
-
- Config:
- remove: ["my-header1", "my-header3"]
-
- Output:
- GET /foo HTTP/1.1
- my-header2: bar
- items:
- type: string
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- set:
- description: |-
- Set overwrites the request with the given header (name, value)
- before the action.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- set:
- - name: "my-header"
- value: "bar"
-
- Output:
- GET /foo HTTP/1.1
- my-header: bar
- items:
- description: HTTPHeader represents an HTTP
- Header name and value as defined by RFC
- 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP
- Header to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- requestMirror:
- description: |+
- RequestMirror defines a schema for a filter that mirrors requests.
- Requests are sent to the specified destination, but responses from
- that destination are ignored.
-
- This filter can be used multiple times within the same rule. Note that
- not all implementations will be able to support mirroring to multiple
- backends.
-
- Support: Extended
-
- properties:
- backendRef:
- description: |-
- BackendRef references a resource where mirrored requests are sent.
-
- Mirrored requests must be sent only to a single destination endpoint
- within this BackendRef, irrespective of how many endpoints are present
- within this BackendRef.
-
- If the referent cannot be found, this BackendRef is invalid and must be
- dropped from the Gateway. The controller must ensure the "ResolvedRefs"
- condition on the Route status is set to `status: False` and not configure
- this backend in the underlying implementation.
-
- If there is a cross-namespace reference to an *existing* object
- that is not allowed by a ReferenceGrant, the controller must ensure the
- "ResolvedRefs" condition on the Route is set to `status: False`,
- with the "RefNotPermitted" reason and not configure this backend in the
- underlying implementation.
-
- In either error case, the Message of the `ResolvedRefs` Condition
- should be used to provide more detail about the problem.
-
- Support: Extended for Kubernetes Service
-
- Support: Implementation-specific for any other resource
- properties:
- group:
- default: ""
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Service
- description: |-
- Kind is the Kubernetes resource kind of the referent. For example
- "Service".
-
- Defaults to "Service" when not specified.
-
- ExternalName services can refer to CNAME DNS records that may live
- outside of the cluster and as such are difficult to reason about in
- terms of conformance. They also may not be safe to forward to (see
- CVE-2021-25740 for more information). Implementations SHOULD NOT
- support ExternalName Services.
-
- Support: Core (Services with a type other than ExternalName)
-
- Support: Implementation-specific (Services with type ExternalName)
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the backend. When unspecified, the local
- namespace is inferred.
-
- Note that when a namespace different than the local namespace is specified,
- a ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port specifies the destination port number to use for this resource.
- Port is required when the referent is a Kubernetes Service. In this
- case, the port number is the service port number, not the target port.
- For other resources, destination port might be derived from the referent
- resource or this field.
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- required:
- - name
- type: object
- x-kubernetes-validations:
- - message: Must have port for Service reference
- rule: '(size(self.group) == 0 && self.kind
- == ''Service'') ? has(self.port) : true'
- fraction:
- description: |+
- Fraction represents the fraction of requests that should be
- mirrored to BackendRef.
-
- Only one of Fraction or Percent may be specified. If neither field
- is specified, 100% of requests will be mirrored.
-
- properties:
- denominator:
- default: 100
- format: int32
- minimum: 1
- type: integer
- numerator:
- format: int32
- minimum: 0
- type: integer
- required:
- - numerator
- type: object
- x-kubernetes-validations:
- - message: numerator must be less than or equal
- to denominator
- rule: self.numerator <= self.denominator
- percent:
- description: |+
- Percent represents the percentage of requests that should be
- mirrored to BackendRef. Its minimum value is 0 (indicating 0% of
- requests) and its maximum value is 100 (indicating 100% of requests).
-
- Only one of Fraction or Percent may be specified. If neither field
- is specified, 100% of requests will be mirrored.
-
- format: int32
- maximum: 100
- minimum: 0
- type: integer
- required:
- - backendRef
- type: object
- x-kubernetes-validations:
- - message: Only one of percent or fraction may be
- specified in HTTPRequestMirrorFilter
- rule: '!(has(self.percent) && has(self.fraction))'
- responseHeaderModifier:
- description: |-
- ResponseHeaderModifier defines a schema for a filter that modifies response
- headers.
-
- Support: Extended
- properties:
- add:
- description: |-
- Add adds the given header(s) (name, value) to the request
- before the action. It appends to any existing values associated
- with the header name.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- add:
- - name: "my-header"
- value: "bar,baz"
-
- Output:
- GET /foo HTTP/1.1
- my-header: foo,bar,baz
- items:
- description: HTTPHeader represents an HTTP
- Header name and value as defined by RFC
- 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP
- Header to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- remove:
- description: |-
- Remove the given header(s) from the HTTP request before the action. The
- value of Remove is a list of HTTP header names. Note that the header
- names are case-insensitive (see
- https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).
-
- Input:
- GET /foo HTTP/1.1
- my-header1: foo
- my-header2: bar
- my-header3: baz
-
- Config:
- remove: ["my-header1", "my-header3"]
-
- Output:
- GET /foo HTTP/1.1
- my-header2: bar
- items:
- type: string
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- set:
- description: |-
- Set overwrites the request with the given header (name, value)
- before the action.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- set:
- - name: "my-header"
- value: "bar"
-
- Output:
- GET /foo HTTP/1.1
- my-header: bar
- items:
- description: HTTPHeader represents an HTTP
- Header name and value as defined by RFC
- 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP
- Header to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- type:
- description: |+
- Type identifies the type of filter to apply. As with other API fields,
- types are classified into three conformance levels:
-
- - Core: Filter types and their corresponding configuration defined by
- "Support: Core" in this package, e.g. "RequestHeaderModifier". All
- implementations supporting GRPCRoute MUST support core filters.
-
- - Extended: Filter types and their corresponding configuration defined by
- "Support: Extended" in this package, e.g. "RequestMirror". Implementers
- are encouraged to support extended filters.
-
- - Implementation-specific: Filters that are defined and supported by specific vendors.
- In the future, filters showing convergence in behavior across multiple
- implementations will be considered for inclusion in extended or core
- conformance levels. Filter-specific configuration for such filters
- is specified using the ExtensionRef field. `Type` MUST be set to
- "ExtensionRef" for custom filters.
-
- Implementers are encouraged to define custom implementation types to
- extend the core API with implementation-specific behavior.
-
- If a reference to a custom filter type cannot be resolved, the filter
- MUST NOT be skipped. Instead, requests that would have been processed by
- that filter MUST receive a HTTP error response.
-
- enum:
- - ResponseHeaderModifier
- - RequestHeaderModifier
- - RequestMirror
- - ExtensionRef
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: filter.requestHeaderModifier must be nil
- if the filter.type is not RequestHeaderModifier
- rule: '!(has(self.requestHeaderModifier) && self.type
- != ''RequestHeaderModifier'')'
- - message: filter.requestHeaderModifier must be specified
- for RequestHeaderModifier filter.type
- rule: '!(!has(self.requestHeaderModifier) && self.type
- == ''RequestHeaderModifier'')'
- - message: filter.responseHeaderModifier must be nil
- if the filter.type is not ResponseHeaderModifier
- rule: '!(has(self.responseHeaderModifier) && self.type
- != ''ResponseHeaderModifier'')'
- - message: filter.responseHeaderModifier must be specified
- for ResponseHeaderModifier filter.type
- rule: '!(!has(self.responseHeaderModifier) && self.type
- == ''ResponseHeaderModifier'')'
- - message: filter.requestMirror must be nil if the filter.type
- is not RequestMirror
- rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')'
- - message: filter.requestMirror must be specified for
- RequestMirror filter.type
- rule: '!(!has(self.requestMirror) && self.type ==
- ''RequestMirror'')'
- - message: filter.extensionRef must be nil if the filter.type
- is not ExtensionRef
- rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')'
- - message: filter.extensionRef must be specified for
- ExtensionRef filter.type
- rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')'
- maxItems: 16
- type: array
- x-kubernetes-validations:
- - message: RequestHeaderModifier filter cannot be repeated
- rule: self.filter(f, f.type == 'RequestHeaderModifier').size()
- <= 1
- - message: ResponseHeaderModifier filter cannot be repeated
- rule: self.filter(f, f.type == 'ResponseHeaderModifier').size()
- <= 1
- group:
- default: ""
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Service
- description: |-
- Kind is the Kubernetes resource kind of the referent. For example
- "Service".
-
- Defaults to "Service" when not specified.
-
- ExternalName services can refer to CNAME DNS records that may live
- outside of the cluster and as such are difficult to reason about in
- terms of conformance. They also may not be safe to forward to (see
- CVE-2021-25740 for more information). Implementations SHOULD NOT
- support ExternalName Services.
-
- Support: Core (Services with a type other than ExternalName)
-
- Support: Implementation-specific (Services with type ExternalName)
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the backend. When unspecified, the local
- namespace is inferred.
-
- Note that when a namespace different than the local namespace is specified,
- a ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port specifies the destination port number to use for this resource.
- Port is required when the referent is a Kubernetes Service. In this
- case, the port number is the service port number, not the target port.
- For other resources, destination port might be derived from the referent
- resource or this field.
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- weight:
- default: 1
- description: |-
- Weight specifies the proportion of requests forwarded to the referenced
- backend. This is computed as weight/(sum of all weights in this
- BackendRefs list). For non-zero values, there may be some epsilon from
- the exact proportion defined here depending on the precision an
- implementation supports. Weight is not a percentage and the sum of
- weights does not need to equal 100.
-
- If only one backend is specified and it has a weight greater than 0, 100%
- of the traffic is forwarded to that backend. If weight is set to 0, no
- traffic should be forwarded for this entry. If unspecified, weight
- defaults to 1.
-
- Support for this field varies based on the context where used.
- format: int32
- maximum: 1000000
- minimum: 0
- type: integer
- required:
- - name
- type: object
- x-kubernetes-validations:
- - message: Must have port for Service reference
- rule: '(size(self.group) == 0 && self.kind == ''Service'')
- ? has(self.port) : true'
- maxItems: 16
- type: array
- filters:
- description: |-
- Filters define the filters that are applied to requests that match
- this rule.
-
- The effects of ordering of multiple behaviors are currently unspecified.
- This can change in the future based on feedback during the alpha stage.
-
- Conformance-levels at this level are defined based on the type of filter:
-
- - ALL core filters MUST be supported by all implementations that support
- GRPCRoute.
- - Implementers are encouraged to support extended filters.
- - Implementation-specific custom filters have no API guarantees across
- implementations.
-
- Specifying the same filter multiple times is not supported unless explicitly
- indicated in the filter.
-
- If an implementation can not support a combination of filters, it must clearly
- document that limitation. In cases where incompatible or unsupported
- filters are specified and cause the `Accepted` condition to be set to status
- `False`, implementations may use the `IncompatibleFilters` reason to specify
- this configuration error.
-
- Support: Core
- items:
- description: |-
- GRPCRouteFilter defines processing steps that must be completed during the
- request or response lifecycle. GRPCRouteFilters are meant as an extension
- point to express processing that may be done in Gateway implementations. Some
- examples include request or response modification, implementing
- authentication strategies, rate-limiting, and traffic shaping. API
- guarantee/conformance is defined based on the type of the filter.
- properties:
- extensionRef:
- description: |-
- ExtensionRef is an optional, implementation-specific extension to the
- "filter" behavior. For example, resource "myroutefilter" in group
- "networking.example.net"). ExtensionRef MUST NOT be used for core and
- extended filters.
-
- Support: Implementation-specific
-
- This filter can be used multiple times within the same rule.
- properties:
- group:
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is kind of the referent. For example
- "HTTPRoute" or "Service".
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- required:
- - group
- - kind
- - name
- type: object
- requestHeaderModifier:
- description: |-
- RequestHeaderModifier defines a schema for a filter that modifies request
- headers.
-
- Support: Core
- properties:
- add:
- description: |-
- Add adds the given header(s) (name, value) to the request
- before the action. It appends to any existing values associated
- with the header name.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- add:
- - name: "my-header"
- value: "bar,baz"
-
- Output:
- GET /foo HTTP/1.1
- my-header: foo,bar,baz
- items:
- description: HTTPHeader represents an HTTP Header
- name and value as defined by RFC 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP Header
- to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- remove:
- description: |-
- Remove the given header(s) from the HTTP request before the action. The
- value of Remove is a list of HTTP header names. Note that the header
- names are case-insensitive (see
- https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).
-
- Input:
- GET /foo HTTP/1.1
- my-header1: foo
- my-header2: bar
- my-header3: baz
-
- Config:
- remove: ["my-header1", "my-header3"]
-
- Output:
- GET /foo HTTP/1.1
- my-header2: bar
- items:
- type: string
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- set:
- description: |-
- Set overwrites the request with the given header (name, value)
- before the action.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- set:
- - name: "my-header"
- value: "bar"
-
- Output:
- GET /foo HTTP/1.1
- my-header: bar
- items:
- description: HTTPHeader represents an HTTP Header
- name and value as defined by RFC 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP Header
- to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- requestMirror:
- description: |+
- RequestMirror defines a schema for a filter that mirrors requests.
- Requests are sent to the specified destination, but responses from
- that destination are ignored.
-
- This filter can be used multiple times within the same rule. Note that
- not all implementations will be able to support mirroring to multiple
- backends.
-
- Support: Extended
-
- properties:
- backendRef:
- description: |-
- BackendRef references a resource where mirrored requests are sent.
-
- Mirrored requests must be sent only to a single destination endpoint
- within this BackendRef, irrespective of how many endpoints are present
- within this BackendRef.
-
- If the referent cannot be found, this BackendRef is invalid and must be
- dropped from the Gateway. The controller must ensure the "ResolvedRefs"
- condition on the Route status is set to `status: False` and not configure
- this backend in the underlying implementation.
-
- If there is a cross-namespace reference to an *existing* object
- that is not allowed by a ReferenceGrant, the controller must ensure the
- "ResolvedRefs" condition on the Route is set to `status: False`,
- with the "RefNotPermitted" reason and not configure this backend in the
- underlying implementation.
-
- In either error case, the Message of the `ResolvedRefs` Condition
- should be used to provide more detail about the problem.
-
- Support: Extended for Kubernetes Service
-
- Support: Implementation-specific for any other resource
- properties:
- group:
- default: ""
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Service
- description: |-
- Kind is the Kubernetes resource kind of the referent. For example
- "Service".
-
- Defaults to "Service" when not specified.
-
- ExternalName services can refer to CNAME DNS records that may live
- outside of the cluster and as such are difficult to reason about in
- terms of conformance. They also may not be safe to forward to (see
- CVE-2021-25740 for more information). Implementations SHOULD NOT
- support ExternalName Services.
-
- Support: Core (Services with a type other than ExternalName)
-
- Support: Implementation-specific (Services with type ExternalName)
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the backend. When unspecified, the local
- namespace is inferred.
-
- Note that when a namespace different than the local namespace is specified,
- a ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port specifies the destination port number to use for this resource.
- Port is required when the referent is a Kubernetes Service. In this
- case, the port number is the service port number, not the target port.
- For other resources, destination port might be derived from the referent
- resource or this field.
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- required:
- - name
- type: object
- x-kubernetes-validations:
- - message: Must have port for Service reference
- rule: '(size(self.group) == 0 && self.kind == ''Service'')
- ? has(self.port) : true'
- fraction:
- description: |+
- Fraction represents the fraction of requests that should be
- mirrored to BackendRef.
-
- Only one of Fraction or Percent may be specified. If neither field
- is specified, 100% of requests will be mirrored.
-
- properties:
- denominator:
- default: 100
- format: int32
- minimum: 1
- type: integer
- numerator:
- format: int32
- minimum: 0
- type: integer
- required:
- - numerator
- type: object
- x-kubernetes-validations:
- - message: numerator must be less than or equal to
- denominator
- rule: self.numerator <= self.denominator
- percent:
- description: |+
- Percent represents the percentage of requests that should be
- mirrored to BackendRef. Its minimum value is 0 (indicating 0% of
- requests) and its maximum value is 100 (indicating 100% of requests).
-
- Only one of Fraction or Percent may be specified. If neither field
- is specified, 100% of requests will be mirrored.
-
- format: int32
- maximum: 100
- minimum: 0
- type: integer
- required:
- - backendRef
- type: object
- x-kubernetes-validations:
- - message: Only one of percent or fraction may be specified
- in HTTPRequestMirrorFilter
- rule: '!(has(self.percent) && has(self.fraction))'
- responseHeaderModifier:
- description: |-
- ResponseHeaderModifier defines a schema for a filter that modifies response
- headers.
-
- Support: Extended
- properties:
- add:
- description: |-
- Add adds the given header(s) (name, value) to the request
- before the action. It appends to any existing values associated
- with the header name.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- add:
- - name: "my-header"
- value: "bar,baz"
-
- Output:
- GET /foo HTTP/1.1
- my-header: foo,bar,baz
- items:
- description: HTTPHeader represents an HTTP Header
- name and value as defined by RFC 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP Header
- to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- remove:
- description: |-
- Remove the given header(s) from the HTTP request before the action. The
- value of Remove is a list of HTTP header names. Note that the header
- names are case-insensitive (see
- https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).
-
- Input:
- GET /foo HTTP/1.1
- my-header1: foo
- my-header2: bar
- my-header3: baz
-
- Config:
- remove: ["my-header1", "my-header3"]
-
- Output:
- GET /foo HTTP/1.1
- my-header2: bar
- items:
- type: string
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- set:
- description: |-
- Set overwrites the request with the given header (name, value)
- before the action.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- set:
- - name: "my-header"
- value: "bar"
-
- Output:
- GET /foo HTTP/1.1
- my-header: bar
- items:
- description: HTTPHeader represents an HTTP Header
- name and value as defined by RFC 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP Header
- to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- type:
- description: |+
- Type identifies the type of filter to apply. As with other API fields,
- types are classified into three conformance levels:
-
- - Core: Filter types and their corresponding configuration defined by
- "Support: Core" in this package, e.g. "RequestHeaderModifier". All
- implementations supporting GRPCRoute MUST support core filters.
-
- - Extended: Filter types and their corresponding configuration defined by
- "Support: Extended" in this package, e.g. "RequestMirror". Implementers
- are encouraged to support extended filters.
-
- - Implementation-specific: Filters that are defined and supported by specific vendors.
- In the future, filters showing convergence in behavior across multiple
- implementations will be considered for inclusion in extended or core
- conformance levels. Filter-specific configuration for such filters
- is specified using the ExtensionRef field. `Type` MUST be set to
- "ExtensionRef" for custom filters.
-
- Implementers are encouraged to define custom implementation types to
- extend the core API with implementation-specific behavior.
-
- If a reference to a custom filter type cannot be resolved, the filter
- MUST NOT be skipped. Instead, requests that would have been processed by
- that filter MUST receive a HTTP error response.
-
- enum:
- - ResponseHeaderModifier
- - RequestHeaderModifier
- - RequestMirror
- - ExtensionRef
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: filter.requestHeaderModifier must be nil if the
- filter.type is not RequestHeaderModifier
- rule: '!(has(self.requestHeaderModifier) && self.type !=
- ''RequestHeaderModifier'')'
- - message: filter.requestHeaderModifier must be specified
- for RequestHeaderModifier filter.type
- rule: '!(!has(self.requestHeaderModifier) && self.type ==
- ''RequestHeaderModifier'')'
- - message: filter.responseHeaderModifier must be nil if the
- filter.type is not ResponseHeaderModifier
- rule: '!(has(self.responseHeaderModifier) && self.type !=
- ''ResponseHeaderModifier'')'
- - message: filter.responseHeaderModifier must be specified
- for ResponseHeaderModifier filter.type
- rule: '!(!has(self.responseHeaderModifier) && self.type
- == ''ResponseHeaderModifier'')'
- - message: filter.requestMirror must be nil if the filter.type
- is not RequestMirror
- rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')'
- - message: filter.requestMirror must be specified for RequestMirror
- filter.type
- rule: '!(!has(self.requestMirror) && self.type == ''RequestMirror'')'
- - message: filter.extensionRef must be nil if the filter.type
- is not ExtensionRef
- rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')'
- - message: filter.extensionRef must be specified for ExtensionRef
- filter.type
- rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')'
- maxItems: 16
- type: array
- x-kubernetes-validations:
- - message: RequestHeaderModifier filter cannot be repeated
- rule: self.filter(f, f.type == 'RequestHeaderModifier').size()
- <= 1
- - message: ResponseHeaderModifier filter cannot be repeated
- rule: self.filter(f, f.type == 'ResponseHeaderModifier').size()
- <= 1
- matches:
- description: |-
- Matches define conditions used for matching the rule against incoming
- gRPC requests. Each match is independent, i.e. this rule will be matched
- if **any** one of the matches is satisfied.
-
- For example, take the following matches configuration:
-
- ```
- matches:
- - method:
- service: foo.bar
- headers:
- values:
- version: 2
- - method:
- service: foo.bar.v2
- ```
-
- For a request to match against this rule, it MUST satisfy
- EITHER of the two conditions:
-
- - service of foo.bar AND contains the header `version: 2`
- - service of foo.bar.v2
-
- See the documentation for GRPCRouteMatch on how to specify multiple
- match conditions to be ANDed together.
-
- If no matches are specified, the implementation MUST match every gRPC request.
-
- Proxy or Load Balancer routing configuration generated from GRPCRoutes
- MUST prioritize rules based on the following criteria, continuing on
- ties. Merging MUST not be done between GRPCRoutes and HTTPRoutes.
- Precedence MUST be given to the rule with the largest number of:
-
- * Characters in a matching non-wildcard hostname.
- * Characters in a matching hostname.
- * Characters in a matching service.
- * Characters in a matching method.
- * Header matches.
-
- If ties still exist across multiple Routes, matching precedence MUST be
- determined in order of the following criteria, continuing on ties:
-
- * The oldest Route based on creation timestamp.
- * The Route appearing first in alphabetical order by
- "{namespace}/{name}".
-
- If ties still exist within the Route that has been given precedence,
- matching precedence MUST be granted to the first matching rule meeting
- the above criteria.
- items:
- description: |-
- GRPCRouteMatch defines the predicate used to match requests to a given
- action. Multiple match types are ANDed together, i.e. the match will
- evaluate to true only if all conditions are satisfied.
-
- For example, the match below will match a gRPC request only if its service
- is `foo` AND it contains the `version: v1` header:
-
- ```
- matches:
- - method:
- type: Exact
- service: "foo"
- headers:
- - name: "version"
- value "v1"
-
- ```
- properties:
- headers:
- description: |-
- Headers specifies gRPC request header matchers. Multiple match values are
- ANDed together, meaning, a request MUST match all the specified headers
- to select the route.
- items:
- description: |-
- GRPCHeaderMatch describes how to select a gRPC route by matching gRPC request
- headers.
- properties:
- name:
- description: |-
- Name is the name of the gRPC Header to be matched.
-
- If multiple entries specify equivalent header names, only the first
- entry with an equivalent name MUST be considered for a match. Subsequent
- entries with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- type:
- default: Exact
- description: Type specifies how to match against
- the value of the header.
- enum:
- - Exact
- - RegularExpression
- type: string
- value:
- description: Value is the value of the gRPC Header
- to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- method:
- description: |-
- Method specifies a gRPC request service/method matcher. If this field is
- not specified, all services and methods will match.
- properties:
- method:
- description: |-
- Value of the method to match against. If left empty or omitted, will
- match all services.
-
- At least one of Service and Method MUST be a non-empty string.
- maxLength: 1024
- type: string
- service:
- description: |-
- Value of the service to match against. If left empty or omitted, will
- match any service.
-
- At least one of Service and Method MUST be a non-empty string.
- maxLength: 1024
- type: string
- type:
- default: Exact
- description: |-
- Type specifies how to match against the service and/or method.
- Support: Core (Exact with service and method specified)
-
- Support: Implementation-specific (Exact with method specified but no service specified)
-
- Support: Implementation-specific (RegularExpression)
- enum:
- - Exact
- - RegularExpression
- type: string
- type: object
- x-kubernetes-validations:
- - message: One or both of 'service' or 'method' must be
- specified
- rule: 'has(self.type) ? has(self.service) || has(self.method)
- : true'
- - message: service must only contain valid characters
- (matching ^(?i)\.?[a-z_][a-z_0-9]*(\.[a-z_][a-z_0-9]*)*$)
- rule: '(!has(self.type) || self.type == ''Exact'') &&
- has(self.service) ? self.service.matches(r"""^(?i)\.?[a-z_][a-z_0-9]*(\.[a-z_][a-z_0-9]*)*$"""):
- true'
- - message: method must only contain valid characters (matching
- ^[A-Za-z_][A-Za-z_0-9]*$)
- rule: '(!has(self.type) || self.type == ''Exact'') &&
- has(self.method) ? self.method.matches(r"""^[A-Za-z_][A-Za-z_0-9]*$"""):
- true'
- type: object
- maxItems: 8
- type: array
- name:
- description: |
- Name is the name of the route rule. This name MUST be unique within a Route if it is set.
-
- Support: Extended
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- sessionPersistence:
- description: |+
- SessionPersistence defines and configures session persistence
- for the route rule.
-
- Support: Extended
-
- properties:
- absoluteTimeout:
- description: |-
- AbsoluteTimeout defines the absolute timeout of the persistent
- session. Once the AbsoluteTimeout duration has elapsed, the
- session becomes invalid.
-
- Support: Extended
- pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
- type: string
- cookieConfig:
- description: |-
- CookieConfig provides configuration settings that are specific
- to cookie-based session persistence.
-
- Support: Core
- properties:
- lifetimeType:
- default: Session
- description: |-
- LifetimeType specifies whether the cookie has a permanent or
- session-based lifetime. A permanent cookie persists until its
- specified expiry time, defined by the Expires or Max-Age cookie
- attributes, while a session cookie is deleted when the current
- session ends.
-
- When set to "Permanent", AbsoluteTimeout indicates the
- cookie's lifetime via the Expires or Max-Age cookie attributes
- and is required.
-
- When set to "Session", AbsoluteTimeout indicates the
- absolute lifetime of the cookie tracked by the gateway and
- is optional.
-
- Support: Core for "Session" type
-
- Support: Extended for "Permanent" type
- enum:
- - Permanent
- - Session
- type: string
- type: object
- idleTimeout:
- description: |-
- IdleTimeout defines the idle timeout of the persistent session.
- Once the session has been idle for more than the specified
- IdleTimeout duration, the session becomes invalid.
-
- Support: Extended
- pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
- type: string
- sessionName:
- description: |-
- SessionName defines the name of the persistent session token
- which may be reflected in the cookie or the header. Users
- should avoid reusing session names to prevent unintended
- consequences, such as rejection or unpredictable behavior.
-
- Support: Implementation-specific
- maxLength: 128
- type: string
- type:
- default: Cookie
- description: |-
- Type defines the type of session persistence such as through
- the use a header or cookie. Defaults to cookie based session
- persistence.
-
- Support: Core for "Cookie" type
-
- Support: Extended for "Header" type
- enum:
- - Cookie
- - Header
- type: string
- type: object
- x-kubernetes-validations:
- - message: AbsoluteTimeout must be specified when cookie lifetimeType
- is Permanent
- rule: '!has(self.cookieConfig) || !has(self.cookieConfig.lifetimeType)
- || self.cookieConfig.lifetimeType != ''Permanent'' || has(self.absoluteTimeout)'
- type: object
- maxItems: 16
- type: array
- x-kubernetes-validations:
- - message: While 16 rules and 64 matches per rule are allowed, the
- total number of matches across all rules in a route must be less
- than 128
- rule: '(self.size() > 0 ? (has(self[0].matches) ? self[0].matches.size()
- : 0) : 0) + (self.size() > 1 ? (has(self[1].matches) ? self[1].matches.size()
- : 0) : 0) + (self.size() > 2 ? (has(self[2].matches) ? self[2].matches.size()
- : 0) : 0) + (self.size() > 3 ? (has(self[3].matches) ? self[3].matches.size()
- : 0) : 0) + (self.size() > 4 ? (has(self[4].matches) ? self[4].matches.size()
- : 0) : 0) + (self.size() > 5 ? (has(self[5].matches) ? self[5].matches.size()
- : 0) : 0) + (self.size() > 6 ? (has(self[6].matches) ? self[6].matches.size()
- : 0) : 0) + (self.size() > 7 ? (has(self[7].matches) ? self[7].matches.size()
- : 0) : 0) + (self.size() > 8 ? (has(self[8].matches) ? self[8].matches.size()
- : 0) : 0) + (self.size() > 9 ? (has(self[9].matches) ? self[9].matches.size()
- : 0) : 0) + (self.size() > 10 ? (has(self[10].matches) ? self[10].matches.size()
- : 0) : 0) + (self.size() > 11 ? (has(self[11].matches) ? self[11].matches.size()
- : 0) : 0) + (self.size() > 12 ? (has(self[12].matches) ? self[12].matches.size()
- : 0) : 0) + (self.size() > 13 ? (has(self[13].matches) ? self[13].matches.size()
- : 0) : 0) + (self.size() > 14 ? (has(self[14].matches) ? self[14].matches.size()
- : 0) : 0) + (self.size() > 15 ? (has(self[15].matches) ? self[15].matches.size()
- : 0) : 0) <= 128'
- - message: Rule name must be unique within the route
- rule: self.all(l1, !has(l1.name) || self.exists_one(l2, has(l2.name)
- && l1.name == l2.name))
- type: object
- status:
- description: Status defines the current state of GRPCRoute.
- properties:
- parents:
- description: |-
- Parents is a list of parent resources (usually Gateways) that are
- associated with the route, and the status of the route with respect to
- each parent. When this route attaches to a parent, the controller that
- manages the parent must add an entry to this list when the controller
- first sees the route and should update the entry as appropriate when the
- route or gateway is modified.
-
- Note that parent references that cannot be resolved by an implementation
- of this API will not be added to this list. Implementations of this API
- can only populate Route status for the Gateways/parent resources they are
- responsible for.
-
- A maximum of 32 Gateways will be represented in this list. An empty list
- means the route has not been attached to any Gateway.
- items:
- description: |-
- RouteParentStatus describes the status of a route with respect to an
- associated Parent.
- properties:
- conditions:
- description: |-
- Conditions describes the status of the route with respect to the Gateway.
- Note that the route's availability is also subject to the Gateway's own
- status conditions and listener status.
-
- If the Route's ParentRef specifies an existing Gateway that supports
- Routes of this kind AND that Gateway's controller has sufficient access,
- then that Gateway's controller MUST set the "Accepted" condition on the
- Route, to indicate whether the route has been accepted or rejected by the
- Gateway, and why.
-
- A Route MUST be considered "Accepted" if at least one of the Route's
- rules is implemented by the Gateway.
-
- There are a number of cases where the "Accepted" condition may not be set
- due to lack of controller visibility, that includes when:
-
- * The Route refers to a non-existent parent.
- * The Route is of a type that the controller does not support.
- * The Route is in a namespace the controller does not have access to.
- items:
- description: Condition contains details for one aspect of
- the current state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False,
- Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- maxItems: 8
- minItems: 1
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- controllerName:
- description: |-
- ControllerName is a domain/path string that indicates the name of the
- controller that wrote this status. This corresponds with the
- controllerName field on GatewayClass.
-
- Example: "example.net/gateway-controller".
-
- The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
- valid Kubernetes names
- (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
-
- Controllers MUST populate this field when writing status. Controllers should ensure that
- entries to status populated with their ControllerName are cleaned up when they are no
- longer necessary.
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
- type: string
- parentRef:
- description: |-
- ParentRef corresponds with a ParentRef in the spec that this
- RouteParentStatus struct describes the status of.
- properties:
- group:
- default: gateway.networking.k8s.io
- description: |-
- Group is the group of the referent.
- When unspecified, "gateway.networking.k8s.io" is inferred.
- To set the core API group (such as for a "Service" kind referent),
- Group must be explicitly set to "" (empty string).
-
- Support: Core
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Gateway
- description: |-
- Kind is kind of the referent.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- Support for other resources is Implementation-Specific.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: |-
- Name is the name of the referent.
-
- Support: Core
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referent. When unspecified, this refers
- to the local namespace of the Route.
-
- Note that there are specific rules for ParentRefs which cross namespace
- boundaries. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example:
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable any other kind of cross-namespace reference.
-
-
- ParentRefs from a Route to a Service in the same namespace are "producer"
- routes, which apply default routing rules to inbound connections from
- any namespace to the Service.
-
- ParentRefs from a Route to a Service in a different namespace are
- "consumer" routes, and these routing rules are only applied to outbound
- connections originating from the same namespace as the Route, for which
- the intended destination of the connections are a Service targeted as a
- ParentRef of the Route.
-
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port is the network port this Route targets. It can be interpreted
- differently based on the type of parent resource.
-
- When the parent resource is a Gateway, this targets all listeners
- listening on the specified port that also support this kind of Route(and
- select this Route). It's not recommended to set `Port` unless the
- networking behaviors specified in a Route must apply to a specific port
- as opposed to a listener(s) whose port(s) may be changed. When both Port
- and SectionName are specified, the name and port of the selected listener
- must match both specified values.
-
-
- When the parent resource is a Service, this targets a specific port in the
- Service spec. When both Port (experimental) and SectionName are specified,
- the name and port of the selected port must match both specified values.
-
-
- Implementations MAY choose to support other parent resources.
- Implementations supporting other types of parent resources MUST clearly
- document how/if Port is interpreted.
-
- For the purpose of status, an attachment is considered successful as
- long as the parent resource accepts it partially. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
- from the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route,
- the Route MUST be considered detached from the Gateway.
-
- Support: Extended
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- sectionName:
- description: |-
- SectionName is the name of a section within the target resource. In the
- following resources, SectionName is interpreted as the following:
-
- * Gateway: Listener name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
- * Service: Port name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
-
- Implementations MAY choose to support attaching Routes to other resources.
- If that is the case, they MUST clearly document how SectionName is
- interpreted.
-
- When unspecified (empty string), this will reference the entire resource.
- For the purpose of status, an attachment is considered successful if at
- least one section in the parent resource accepts it. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
- the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route, the
- Route MUST be considered detached from the Gateway.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- required:
- - name
- type: object
- required:
- - controllerName
- - parentRef
- type: object
- maxItems: 32
- type: array
- required:
- - parents
- type: object
- type: object
- served: true
- storage: true
- subresources:
- status: {}
-status:
- acceptedNames:
- kind: ""
- plural: ""
- conditions: null
- storedVersions: null
----
-#
-# config/crd/experimental/gateway.networking.k8s.io_httproutes.yaml
-#
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
- gateway.networking.k8s.io/bundle-version: v1.2.1
- gateway.networking.k8s.io/channel: experimental
- creationTimestamp: null
- name: httproutes.gateway.networking.k8s.io
-spec:
- group: gateway.networking.k8s.io
- names:
- categories:
- - gateway-api
- kind: HTTPRoute
- listKind: HTTPRouteList
- plural: httproutes
- singular: httproute
- scope: Namespaced
- versions:
- - additionalPrinterColumns:
- - jsonPath: .spec.hostnames
- name: Hostnames
- type: string
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- name: v1
- schema:
- openAPIV3Schema:
- description: |-
- HTTPRoute provides a way to route HTTP requests. This includes the capability
- to match requests by hostname, path, header, or query param. Filters can be
- used to specify additional processing steps. Backends specify where matching
- requests should be routed.
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: Spec defines the desired state of HTTPRoute.
- properties:
- hostnames:
- description: |-
- Hostnames defines a set of hostnames that should match against the HTTP Host
- header to select a HTTPRoute used to process the request. Implementations
- MUST ignore any port value specified in the HTTP Host header while
- performing a match and (absent of any applicable header modification
- configuration) MUST forward this header unmodified to the backend.
-
- Valid values for Hostnames are determined by RFC 1123 definition of a
- hostname with 2 notable exceptions:
-
- 1. IPs are not allowed.
- 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard
- label must appear by itself as the first label.
-
- If a hostname is specified by both the Listener and HTTPRoute, there
- must be at least one intersecting hostname for the HTTPRoute to be
- attached to the Listener. For example:
-
- * A Listener with `test.example.com` as the hostname matches HTTPRoutes
- that have either not specified any hostnames, or have specified at
- least one of `test.example.com` or `*.example.com`.
- * A Listener with `*.example.com` as the hostname matches HTTPRoutes
- that have either not specified any hostnames or have specified at least
- one hostname that matches the Listener hostname. For example,
- `*.example.com`, `test.example.com`, and `foo.test.example.com` would
- all match. On the other hand, `example.com` and `test.example.net` would
- not match.
-
- Hostnames that are prefixed with a wildcard label (`*.`) are interpreted
- as a suffix match. That means that a match for `*.example.com` would match
- both `test.example.com`, and `foo.test.example.com`, but not `example.com`.
-
- If both the Listener and HTTPRoute have specified hostnames, any
- HTTPRoute hostnames that do not match the Listener hostname MUST be
- ignored. For example, if a Listener specified `*.example.com`, and the
- HTTPRoute specified `test.example.com` and `test.example.net`,
- `test.example.net` must not be considered for a match.
-
- If both the Listener and HTTPRoute have specified hostnames, and none
- match with the criteria above, then the HTTPRoute is not accepted. The
- implementation must raise an 'Accepted' Condition with a status of
- `False` in the corresponding RouteParentStatus.
-
- In the event that multiple HTTPRoutes specify intersecting hostnames (e.g.
- overlapping wildcard matching and exact matching hostnames), precedence must
- be given to rules from the HTTPRoute with the largest number of:
-
- * Characters in a matching non-wildcard hostname.
- * Characters in a matching hostname.
-
- If ties exist across multiple Routes, the matching precedence rules for
- HTTPRouteMatches takes over.
-
- Support: Core
- items:
- description: |-
- Hostname is the fully qualified domain name of a network host. This matches
- the RFC 1123 definition of a hostname with 2 notable exceptions:
-
- 1. IPs are not allowed.
- 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard
- label must appear by itself as the first label.
-
- Hostname can be "precise" which is a domain name without the terminating
- dot of a network host (e.g. "foo.example.com") or "wildcard", which is a
- domain name prefixed with a single wildcard label (e.g. `*.example.com`).
-
- Note that as per RFC1035 and RFC1123, a *label* must consist of lower case
- alphanumeric characters or '-', and must start and end with an alphanumeric
- character. No other punctuation is allowed.
- maxLength: 253
- minLength: 1
- pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- maxItems: 16
- type: array
- parentRefs:
- description: |+
- ParentRefs references the resources (usually Gateways) that a Route wants
- to be attached to. Note that the referenced parent resource needs to
- allow this for the attachment to be complete. For Gateways, that means
- the Gateway needs to allow attachment from Routes of this kind and
- namespace. For Services, that means the Service must either be in the same
- namespace for a "producer" route, or the mesh implementation must support
- and allow "consumer" routes for the referenced Service. ReferenceGrant is
- not applicable for governing ParentRefs to Services - it is not possible to
- create a "producer" route for a Service in a different namespace from the
- Route.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- This API may be extended in the future to support additional kinds of parent
- resources.
-
- ParentRefs must be _distinct_. This means either that:
-
- * They select different objects. If this is the case, then parentRef
- entries are distinct. In terms of fields, this means that the
- multi-part key defined by `group`, `kind`, `namespace`, and `name` must
- be unique across all parentRef entries in the Route.
- * They do not select different objects, but for each optional field used,
- each ParentRef that selects the same object must set the same set of
- optional fields to different values. If one ParentRef sets a
- combination of optional fields, all must set the same combination.
-
- Some examples:
-
- * If one ParentRef sets `sectionName`, all ParentRefs referencing the
- same object must also set `sectionName`.
- * If one ParentRef sets `port`, all ParentRefs referencing the same
- object must also set `port`.
- * If one ParentRef sets `sectionName` and `port`, all ParentRefs
- referencing the same object must also set `sectionName` and `port`.
-
- It is possible to separately reference multiple distinct objects that may
- be collapsed by an implementation. For example, some implementations may
- choose to merge compatible Gateway Listeners together. If that is the
- case, the list of routes attached to those resources should also be
- merged.
-
- Note that for ParentRefs that cross namespace boundaries, there are specific
- rules. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example,
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable other kinds of cross-namespace reference.
-
-
- ParentRefs from a Route to a Service in the same namespace are "producer"
- routes, which apply default routing rules to inbound connections from
- any namespace to the Service.
-
- ParentRefs from a Route to a Service in a different namespace are
- "consumer" routes, and these routing rules are only applied to outbound
- connections originating from the same namespace as the Route, for which
- the intended destination of the connections are a Service targeted as a
- ParentRef of the Route.
-
-
-
-
-
- items:
- description: |-
- ParentReference identifies an API object (usually a Gateway) that can be considered
- a parent of this resource (usually a route). There are two kinds of parent resources
- with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- This API may be extended in the future to support additional kinds of parent
- resources.
-
- The API object must be valid in the cluster; the Group and Kind must
- be registered in the cluster for this reference to be valid.
- properties:
- group:
- default: gateway.networking.k8s.io
- description: |-
- Group is the group of the referent.
- When unspecified, "gateway.networking.k8s.io" is inferred.
- To set the core API group (such as for a "Service" kind referent),
- Group must be explicitly set to "" (empty string).
-
- Support: Core
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Gateway
- description: |-
- Kind is kind of the referent.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- Support for other resources is Implementation-Specific.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: |-
- Name is the name of the referent.
-
- Support: Core
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referent. When unspecified, this refers
- to the local namespace of the Route.
-
- Note that there are specific rules for ParentRefs which cross namespace
- boundaries. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example:
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable any other kind of cross-namespace reference.
-
-
- ParentRefs from a Route to a Service in the same namespace are "producer"
- routes, which apply default routing rules to inbound connections from
- any namespace to the Service.
-
- ParentRefs from a Route to a Service in a different namespace are
- "consumer" routes, and these routing rules are only applied to outbound
- connections originating from the same namespace as the Route, for which
- the intended destination of the connections are a Service targeted as a
- ParentRef of the Route.
-
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port is the network port this Route targets. It can be interpreted
- differently based on the type of parent resource.
-
- When the parent resource is a Gateway, this targets all listeners
- listening on the specified port that also support this kind of Route(and
- select this Route). It's not recommended to set `Port` unless the
- networking behaviors specified in a Route must apply to a specific port
- as opposed to a listener(s) whose port(s) may be changed. When both Port
- and SectionName are specified, the name and port of the selected listener
- must match both specified values.
-
-
- When the parent resource is a Service, this targets a specific port in the
- Service spec. When both Port (experimental) and SectionName are specified,
- the name and port of the selected port must match both specified values.
-
-
- Implementations MAY choose to support other parent resources.
- Implementations supporting other types of parent resources MUST clearly
- document how/if Port is interpreted.
-
- For the purpose of status, an attachment is considered successful as
- long as the parent resource accepts it partially. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
- from the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route,
- the Route MUST be considered detached from the Gateway.
-
- Support: Extended
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- sectionName:
- description: |-
- SectionName is the name of a section within the target resource. In the
- following resources, SectionName is interpreted as the following:
-
- * Gateway: Listener name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
- * Service: Port name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
-
- Implementations MAY choose to support attaching Routes to other resources.
- If that is the case, they MUST clearly document how SectionName is
- interpreted.
-
- When unspecified (empty string), this will reference the entire resource.
- For the purpose of status, an attachment is considered successful if at
- least one section in the parent resource accepts it. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
- the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route, the
- Route MUST be considered detached from the Gateway.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- required:
- - name
- type: object
- maxItems: 32
- type: array
- x-kubernetes-validations:
- - message: sectionName or port must be specified when parentRefs includes
- 2 or more references to the same parent
- rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind
- == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__)
- || p1.__namespace__ == '''') && (!has(p2.__namespace__) || p2.__namespace__
- == '''')) || (has(p1.__namespace__) && has(p2.__namespace__) &&
- p1.__namespace__ == p2.__namespace__)) ? ((!has(p1.sectionName)
- || p1.sectionName == '''') == (!has(p2.sectionName) || p2.sectionName
- == '''') && (!has(p1.port) || p1.port == 0) == (!has(p2.port)
- || p2.port == 0)): true))'
- - message: sectionName or port must be unique when parentRefs includes
- 2 or more references to the same parent
- rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind
- == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__)
- || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__
- == '')) || (has(p1.__namespace__) && has(p2.__namespace__) &&
- p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName)
- || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName
- == '')) || ( has(p1.sectionName) && has(p2.sectionName) && p1.sectionName
- == p2.sectionName)) && (((!has(p1.port) || p1.port == 0) && (!has(p2.port)
- || p2.port == 0)) || (has(p1.port) && has(p2.port) && p1.port
- == p2.port))))
- rules:
- default:
- - matches:
- - path:
- type: PathPrefix
- value: /
- description: |+
- Rules are a list of HTTP matchers, filters and actions.
-
- items:
- description: |-
- HTTPRouteRule defines semantics for matching an HTTP request based on
- conditions (matches), processing it (filters), and forwarding the request to
- an API object (backendRefs).
- properties:
- backendRefs:
- description: |-
- BackendRefs defines the backend(s) where matching requests should be
- sent.
-
- Failure behavior here depends on how many BackendRefs are specified and
- how many are invalid.
-
- If *all* entries in BackendRefs are invalid, and there are also no filters
- specified in this route rule, *all* traffic which matches this rule MUST
- receive a 500 status code.
-
- See the HTTPBackendRef definition for the rules about what makes a single
- HTTPBackendRef invalid.
-
- When a HTTPBackendRef is invalid, 500 status codes MUST be returned for
- requests that would have otherwise been routed to an invalid backend. If
- multiple backends are specified, and some are invalid, the proportion of
- requests that would otherwise have been routed to an invalid backend
- MUST receive a 500 status code.
-
- For example, if two backends are specified with equal weights, and one is
- invalid, 50 percent of traffic must receive a 500. Implementations may
- choose how that 50 percent is determined.
-
- When a HTTPBackendRef refers to a Service that has no ready endpoints,
- implementations SHOULD return a 503 for requests to that backend instead.
- If an implementation chooses to do this, all of the above rules for 500 responses
- MUST also apply for responses that return a 503.
-
- Support: Core for Kubernetes Service
-
- Support: Extended for Kubernetes ServiceImport
-
- Support: Implementation-specific for any other resource
-
- Support for weight: Core
- items:
- description: |-
- HTTPBackendRef defines how a HTTPRoute forwards a HTTP request.
-
- Note that when a namespace different than the local namespace is specified, a
- ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
-
-
- When the BackendRef points to a Kubernetes Service, implementations SHOULD
- honor the appProtocol field if it is set for the target Service Port.
-
- Implementations supporting appProtocol SHOULD recognize the Kubernetes
- Standard Application Protocols defined in KEP-3726.
-
- If a Service appProtocol isn't specified, an implementation MAY infer the
- backend protocol through its own means. Implementations MAY infer the
- protocol from the Route type referring to the backend Service.
-
- If a Route is not able to send traffic to the backend using the specified
- protocol then the backend is considered invalid. Implementations MUST set the
- "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason.
-
-
- properties:
- filters:
- description: |-
- Filters defined at this level should be executed if and only if the
- request is being forwarded to the backend defined here.
-
- Support: Implementation-specific (For broader support of filters, use the
- Filters field in HTTPRouteRule.)
- items:
- description: |-
- HTTPRouteFilter defines processing steps that must be completed during the
- request or response lifecycle. HTTPRouteFilters are meant as an extension
- point to express processing that may be done in Gateway implementations. Some
- examples include request or response modification, implementing
- authentication strategies, rate-limiting, and traffic shaping. API
- guarantee/conformance is defined based on the type of the filter.
- properties:
- extensionRef:
- description: |-
- ExtensionRef is an optional, implementation-specific extension to the
- "filter" behavior. For example, resource "myroutefilter" in group
- "networking.example.net"). ExtensionRef MUST NOT be used for core and
- extended filters.
-
- This filter can be used multiple times within the same rule.
-
- Support: Implementation-specific
- properties:
- group:
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is kind of the referent. For
- example "HTTPRoute" or "Service".
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- required:
- - group
- - kind
- - name
- type: object
- requestHeaderModifier:
- description: |-
- RequestHeaderModifier defines a schema for a filter that modifies request
- headers.
-
- Support: Core
- properties:
- add:
- description: |-
- Add adds the given header(s) (name, value) to the request
- before the action. It appends to any existing values associated
- with the header name.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- add:
- - name: "my-header"
- value: "bar,baz"
-
- Output:
- GET /foo HTTP/1.1
- my-header: foo,bar,baz
- items:
- description: HTTPHeader represents an HTTP
- Header name and value as defined by RFC
- 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP
- Header to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- remove:
- description: |-
- Remove the given header(s) from the HTTP request before the action. The
- value of Remove is a list of HTTP header names. Note that the header
- names are case-insensitive (see
- https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).
-
- Input:
- GET /foo HTTP/1.1
- my-header1: foo
- my-header2: bar
- my-header3: baz
-
- Config:
- remove: ["my-header1", "my-header3"]
-
- Output:
- GET /foo HTTP/1.1
- my-header2: bar
- items:
- type: string
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- set:
- description: |-
- Set overwrites the request with the given header (name, value)
- before the action.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- set:
- - name: "my-header"
- value: "bar"
-
- Output:
- GET /foo HTTP/1.1
- my-header: bar
- items:
- description: HTTPHeader represents an HTTP
- Header name and value as defined by RFC
- 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP
- Header to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- requestMirror:
- description: |+
- RequestMirror defines a schema for a filter that mirrors requests.
- Requests are sent to the specified destination, but responses from
- that destination are ignored.
-
- This filter can be used multiple times within the same rule. Note that
- not all implementations will be able to support mirroring to multiple
- backends.
-
- Support: Extended
-
- properties:
- backendRef:
- description: |-
- BackendRef references a resource where mirrored requests are sent.
-
- Mirrored requests must be sent only to a single destination endpoint
- within this BackendRef, irrespective of how many endpoints are present
- within this BackendRef.
-
- If the referent cannot be found, this BackendRef is invalid and must be
- dropped from the Gateway. The controller must ensure the "ResolvedRefs"
- condition on the Route status is set to `status: False` and not configure
- this backend in the underlying implementation.
-
- If there is a cross-namespace reference to an *existing* object
- that is not allowed by a ReferenceGrant, the controller must ensure the
- "ResolvedRefs" condition on the Route is set to `status: False`,
- with the "RefNotPermitted" reason and not configure this backend in the
- underlying implementation.
-
- In either error case, the Message of the `ResolvedRefs` Condition
- should be used to provide more detail about the problem.
-
- Support: Extended for Kubernetes Service
-
- Support: Implementation-specific for any other resource
- properties:
- group:
- default: ""
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Service
- description: |-
- Kind is the Kubernetes resource kind of the referent. For example
- "Service".
-
- Defaults to "Service" when not specified.
-
- ExternalName services can refer to CNAME DNS records that may live
- outside of the cluster and as such are difficult to reason about in
- terms of conformance. They also may not be safe to forward to (see
- CVE-2021-25740 for more information). Implementations SHOULD NOT
- support ExternalName Services.
-
- Support: Core (Services with a type other than ExternalName)
-
- Support: Implementation-specific (Services with type ExternalName)
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the backend. When unspecified, the local
- namespace is inferred.
-
- Note that when a namespace different than the local namespace is specified,
- a ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port specifies the destination port number to use for this resource.
- Port is required when the referent is a Kubernetes Service. In this
- case, the port number is the service port number, not the target port.
- For other resources, destination port might be derived from the referent
- resource or this field.
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- required:
- - name
- type: object
- x-kubernetes-validations:
- - message: Must have port for Service reference
- rule: '(size(self.group) == 0 && self.kind
- == ''Service'') ? has(self.port) : true'
- fraction:
- description: |+
- Fraction represents the fraction of requests that should be
- mirrored to BackendRef.
-
- Only one of Fraction or Percent may be specified. If neither field
- is specified, 100% of requests will be mirrored.
-
- properties:
- denominator:
- default: 100
- format: int32
- minimum: 1
- type: integer
- numerator:
- format: int32
- minimum: 0
- type: integer
- required:
- - numerator
- type: object
- x-kubernetes-validations:
- - message: numerator must be less than or equal
- to denominator
- rule: self.numerator <= self.denominator
- percent:
- description: |+
- Percent represents the percentage of requests that should be
- mirrored to BackendRef. Its minimum value is 0 (indicating 0% of
- requests) and its maximum value is 100 (indicating 100% of requests).
-
- Only one of Fraction or Percent may be specified. If neither field
- is specified, 100% of requests will be mirrored.
-
- format: int32
- maximum: 100
- minimum: 0
- type: integer
- required:
- - backendRef
- type: object
- x-kubernetes-validations:
- - message: Only one of percent or fraction may be
- specified in HTTPRequestMirrorFilter
- rule: '!(has(self.percent) && has(self.fraction))'
- requestRedirect:
- description: |-
- RequestRedirect defines a schema for a filter that responds to the
- request with an HTTP redirection.
-
- Support: Core
- properties:
- hostname:
- description: |-
- Hostname is the hostname to be used in the value of the `Location`
- header in the response.
- When empty, the hostname in the `Host` header of the request is used.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- path:
- description: |-
- Path defines parameters used to modify the path of the incoming request.
- The modified path is then used to construct the `Location` header. When
- empty, the request path is used as-is.
-
- Support: Extended
- properties:
- replaceFullPath:
- description: |-
- ReplaceFullPath specifies the value with which to replace the full path
- of a request during a rewrite or redirect.
- maxLength: 1024
- type: string
- replacePrefixMatch:
- description: |-
- ReplacePrefixMatch specifies the value with which to replace the prefix
- match of a request during a rewrite or redirect. For example, a request
- to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch
- of "/xyz" would be modified to "/xyz/bar".
-
- Note that this matches the behavior of the PathPrefix match type. This
- matches full path elements. A path element refers to the list of labels
- in the path split by the `/` separator. When specified, a trailing `/` is
- ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all
- match the prefix `/abc`, but the path `/abcd` would not.
-
- ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.
- Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in
- the implementation setting the Accepted Condition for the Route to `status: False`.
-
- Request Path | Prefix Match | Replace Prefix | Modified Path
- maxLength: 1024
- type: string
- type:
- description: |-
- Type defines the type of path modifier. Additional types may be
- added in a future release of the API.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
- enum:
- - ReplaceFullPath
- - ReplacePrefixMatch
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: replaceFullPath must be specified
- when type is set to 'ReplaceFullPath'
- rule: 'self.type == ''ReplaceFullPath'' ?
- has(self.replaceFullPath) : true'
- - message: type must be 'ReplaceFullPath' when
- replaceFullPath is set
- rule: 'has(self.replaceFullPath) ? self.type
- == ''ReplaceFullPath'' : true'
- - message: replacePrefixMatch must be specified
- when type is set to 'ReplacePrefixMatch'
- rule: 'self.type == ''ReplacePrefixMatch''
- ? has(self.replacePrefixMatch) : true'
- - message: type must be 'ReplacePrefixMatch'
- when replacePrefixMatch is set
- rule: 'has(self.replacePrefixMatch) ? self.type
- == ''ReplacePrefixMatch'' : true'
- port:
- description: |-
- Port is the port to be used in the value of the `Location`
- header in the response.
-
- If no port is specified, the redirect port MUST be derived using the
- following rules:
-
- * If redirect scheme is not-empty, the redirect port MUST be the well-known
- port associated with the redirect scheme. Specifically "http" to port 80
- and "https" to port 443. If the redirect scheme does not have a
- well-known port, the listener port of the Gateway SHOULD be used.
- * If redirect scheme is empty, the redirect port MUST be the Gateway
- Listener port.
-
- Implementations SHOULD NOT add the port number in the 'Location'
- header in the following cases:
-
- * A Location header that will use HTTP (whether that is determined via
- the Listener protocol or the Scheme field) _and_ use port 80.
- * A Location header that will use HTTPS (whether that is determined via
- the Listener protocol or the Scheme field) _and_ use port 443.
-
- Support: Extended
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- scheme:
- description: |-
- Scheme is the scheme to be used in the value of the `Location` header in
- the response. When empty, the scheme of the request is used.
-
- Scheme redirects can affect the port of the redirect, for more information,
- refer to the documentation for the port field of this filter.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
-
- Support: Extended
- enum:
- - http
- - https
- type: string
- statusCode:
- default: 302
- description: |-
- StatusCode is the HTTP status code to be used in response.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
-
- Support: Core
- enum:
- - 301
- - 302
- type: integer
- type: object
- responseHeaderModifier:
- description: |-
- ResponseHeaderModifier defines a schema for a filter that modifies response
- headers.
-
- Support: Extended
- properties:
- add:
- description: |-
- Add adds the given header(s) (name, value) to the request
- before the action. It appends to any existing values associated
- with the header name.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- add:
- - name: "my-header"
- value: "bar,baz"
-
- Output:
- GET /foo HTTP/1.1
- my-header: foo,bar,baz
- items:
- description: HTTPHeader represents an HTTP
- Header name and value as defined by RFC
- 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP
- Header to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- remove:
- description: |-
- Remove the given header(s) from the HTTP request before the action. The
- value of Remove is a list of HTTP header names. Note that the header
- names are case-insensitive (see
- https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).
-
- Input:
- GET /foo HTTP/1.1
- my-header1: foo
- my-header2: bar
- my-header3: baz
-
- Config:
- remove: ["my-header1", "my-header3"]
-
- Output:
- GET /foo HTTP/1.1
- my-header2: bar
- items:
- type: string
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- set:
- description: |-
- Set overwrites the request with the given header (name, value)
- before the action.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- set:
- - name: "my-header"
- value: "bar"
-
- Output:
- GET /foo HTTP/1.1
- my-header: bar
- items:
- description: HTTPHeader represents an HTTP
- Header name and value as defined by RFC
- 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP
- Header to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- type:
- description: |-
- Type identifies the type of filter to apply. As with other API fields,
- types are classified into three conformance levels:
-
- - Core: Filter types and their corresponding configuration defined by
- "Support: Core" in this package, e.g. "RequestHeaderModifier". All
- implementations must support core filters.
-
- - Extended: Filter types and their corresponding configuration defined by
- "Support: Extended" in this package, e.g. "RequestMirror". Implementers
- are encouraged to support extended filters.
-
- - Implementation-specific: Filters that are defined and supported by
- specific vendors.
- In the future, filters showing convergence in behavior across multiple
- implementations will be considered for inclusion in extended or core
- conformance levels. Filter-specific configuration for such filters
- is specified using the ExtensionRef field. `Type` should be set to
- "ExtensionRef" for custom filters.
-
- Implementers are encouraged to define custom implementation types to
- extend the core API with implementation-specific behavior.
-
- If a reference to a custom filter type cannot be resolved, the filter
- MUST NOT be skipped. Instead, requests that would have been processed by
- that filter MUST receive a HTTP error response.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
- enum:
- - RequestHeaderModifier
- - ResponseHeaderModifier
- - RequestMirror
- - RequestRedirect
- - URLRewrite
- - ExtensionRef
- type: string
- urlRewrite:
- description: |-
- URLRewrite defines a schema for a filter that modifies a request during forwarding.
-
- Support: Extended
- properties:
- hostname:
- description: |-
- Hostname is the value to be used to replace the Host header value during
- forwarding.
-
- Support: Extended
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- path:
- description: |-
- Path defines a path rewrite.
-
- Support: Extended
- properties:
- replaceFullPath:
- description: |-
- ReplaceFullPath specifies the value with which to replace the full path
- of a request during a rewrite or redirect.
- maxLength: 1024
- type: string
- replacePrefixMatch:
- description: |-
- ReplacePrefixMatch specifies the value with which to replace the prefix
- match of a request during a rewrite or redirect. For example, a request
- to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch
- of "/xyz" would be modified to "/xyz/bar".
-
- Note that this matches the behavior of the PathPrefix match type. This
- matches full path elements. A path element refers to the list of labels
- in the path split by the `/` separator. When specified, a trailing `/` is
- ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all
- match the prefix `/abc`, but the path `/abcd` would not.
-
- ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.
- Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in
- the implementation setting the Accepted Condition for the Route to `status: False`.
-
- Request Path | Prefix Match | Replace Prefix | Modified Path
- maxLength: 1024
- type: string
- type:
- description: |-
- Type defines the type of path modifier. Additional types may be
- added in a future release of the API.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
- enum:
- - ReplaceFullPath
- - ReplacePrefixMatch
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: replaceFullPath must be specified
- when type is set to 'ReplaceFullPath'
- rule: 'self.type == ''ReplaceFullPath'' ?
- has(self.replaceFullPath) : true'
- - message: type must be 'ReplaceFullPath' when
- replaceFullPath is set
- rule: 'has(self.replaceFullPath) ? self.type
- == ''ReplaceFullPath'' : true'
- - message: replacePrefixMatch must be specified
- when type is set to 'ReplacePrefixMatch'
- rule: 'self.type == ''ReplacePrefixMatch''
- ? has(self.replacePrefixMatch) : true'
- - message: type must be 'ReplacePrefixMatch'
- when replacePrefixMatch is set
- rule: 'has(self.replacePrefixMatch) ? self.type
- == ''ReplacePrefixMatch'' : true'
- type: object
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: filter.requestHeaderModifier must be nil
- if the filter.type is not RequestHeaderModifier
- rule: '!(has(self.requestHeaderModifier) && self.type
- != ''RequestHeaderModifier'')'
- - message: filter.requestHeaderModifier must be specified
- for RequestHeaderModifier filter.type
- rule: '!(!has(self.requestHeaderModifier) && self.type
- == ''RequestHeaderModifier'')'
- - message: filter.responseHeaderModifier must be nil
- if the filter.type is not ResponseHeaderModifier
- rule: '!(has(self.responseHeaderModifier) && self.type
- != ''ResponseHeaderModifier'')'
- - message: filter.responseHeaderModifier must be specified
- for ResponseHeaderModifier filter.type
- rule: '!(!has(self.responseHeaderModifier) && self.type
- == ''ResponseHeaderModifier'')'
- - message: filter.requestMirror must be nil if the filter.type
- is not RequestMirror
- rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')'
- - message: filter.requestMirror must be specified for
- RequestMirror filter.type
- rule: '!(!has(self.requestMirror) && self.type ==
- ''RequestMirror'')'
- - message: filter.requestRedirect must be nil if the
- filter.type is not RequestRedirect
- rule: '!(has(self.requestRedirect) && self.type !=
- ''RequestRedirect'')'
- - message: filter.requestRedirect must be specified
- for RequestRedirect filter.type
- rule: '!(!has(self.requestRedirect) && self.type ==
- ''RequestRedirect'')'
- - message: filter.urlRewrite must be nil if the filter.type
- is not URLRewrite
- rule: '!(has(self.urlRewrite) && self.type != ''URLRewrite'')'
- - message: filter.urlRewrite must be specified for URLRewrite
- filter.type
- rule: '!(!has(self.urlRewrite) && self.type == ''URLRewrite'')'
- - message: filter.extensionRef must be nil if the filter.type
- is not ExtensionRef
- rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')'
- - message: filter.extensionRef must be specified for
- ExtensionRef filter.type
- rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')'
- maxItems: 16
- type: array
- x-kubernetes-validations:
- - message: May specify either httpRouteFilterRequestRedirect
- or httpRouteFilterRequestRewrite, but not both
- rule: '!(self.exists(f, f.type == ''RequestRedirect'')
- && self.exists(f, f.type == ''URLRewrite''))'
- - message: May specify either httpRouteFilterRequestRedirect
- or httpRouteFilterRequestRewrite, but not both
- rule: '!(self.exists(f, f.type == ''RequestRedirect'')
- && self.exists(f, f.type == ''URLRewrite''))'
- - message: RequestHeaderModifier filter cannot be repeated
- rule: self.filter(f, f.type == 'RequestHeaderModifier').size()
- <= 1
- - message: ResponseHeaderModifier filter cannot be repeated
- rule: self.filter(f, f.type == 'ResponseHeaderModifier').size()
- <= 1
- - message: RequestRedirect filter cannot be repeated
- rule: self.filter(f, f.type == 'RequestRedirect').size()
- <= 1
- - message: URLRewrite filter cannot be repeated
- rule: self.filter(f, f.type == 'URLRewrite').size()
- <= 1
- group:
- default: ""
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Service
- description: |-
- Kind is the Kubernetes resource kind of the referent. For example
- "Service".
-
- Defaults to "Service" when not specified.
-
- ExternalName services can refer to CNAME DNS records that may live
- outside of the cluster and as such are difficult to reason about in
- terms of conformance. They also may not be safe to forward to (see
- CVE-2021-25740 for more information). Implementations SHOULD NOT
- support ExternalName Services.
-
- Support: Core (Services with a type other than ExternalName)
-
- Support: Implementation-specific (Services with type ExternalName)
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the backend. When unspecified, the local
- namespace is inferred.
-
- Note that when a namespace different than the local namespace is specified,
- a ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port specifies the destination port number to use for this resource.
- Port is required when the referent is a Kubernetes Service. In this
- case, the port number is the service port number, not the target port.
- For other resources, destination port might be derived from the referent
- resource or this field.
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- weight:
- default: 1
- description: |-
- Weight specifies the proportion of requests forwarded to the referenced
- backend. This is computed as weight/(sum of all weights in this
- BackendRefs list). For non-zero values, there may be some epsilon from
- the exact proportion defined here depending on the precision an
- implementation supports. Weight is not a percentage and the sum of
- weights does not need to equal 100.
-
- If only one backend is specified and it has a weight greater than 0, 100%
- of the traffic is forwarded to that backend. If weight is set to 0, no
- traffic should be forwarded for this entry. If unspecified, weight
- defaults to 1.
-
- Support for this field varies based on the context where used.
- format: int32
- maximum: 1000000
- minimum: 0
- type: integer
- required:
- - name
- type: object
- x-kubernetes-validations:
- - message: Must have port for Service reference
- rule: '(size(self.group) == 0 && self.kind == ''Service'')
- ? has(self.port) : true'
- maxItems: 16
- type: array
- filters:
- description: |-
- Filters define the filters that are applied to requests that match
- this rule.
-
- Wherever possible, implementations SHOULD implement filters in the order
- they are specified.
-
- Implementations MAY choose to implement this ordering strictly, rejecting
- any combination or order of filters that can not be supported. If implementations
- choose a strict interpretation of filter ordering, they MUST clearly document
- that behavior.
-
- To reject an invalid combination or order of filters, implementations SHOULD
- consider the Route Rules with this configuration invalid. If all Route Rules
- in a Route are invalid, the entire Route would be considered invalid. If only
- a portion of Route Rules are invalid, implementations MUST set the
- "PartiallyInvalid" condition for the Route.
-
- Conformance-levels at this level are defined based on the type of filter:
-
- - ALL core filters MUST be supported by all implementations.
- - Implementers are encouraged to support extended filters.
- - Implementation-specific custom filters have no API guarantees across
- implementations.
-
- Specifying the same filter multiple times is not supported unless explicitly
- indicated in the filter.
-
- All filters are expected to be compatible with each other except for the
- URLRewrite and RequestRedirect filters, which may not be combined. If an
- implementation can not support other combinations of filters, they must clearly
- document that limitation. In cases where incompatible or unsupported
- filters are specified and cause the `Accepted` condition to be set to status
- `False`, implementations may use the `IncompatibleFilters` reason to specify
- this configuration error.
-
- Support: Core
- items:
- description: |-
- HTTPRouteFilter defines processing steps that must be completed during the
- request or response lifecycle. HTTPRouteFilters are meant as an extension
- point to express processing that may be done in Gateway implementations. Some
- examples include request or response modification, implementing
- authentication strategies, rate-limiting, and traffic shaping. API
- guarantee/conformance is defined based on the type of the filter.
- properties:
- extensionRef:
- description: |-
- ExtensionRef is an optional, implementation-specific extension to the
- "filter" behavior. For example, resource "myroutefilter" in group
- "networking.example.net"). ExtensionRef MUST NOT be used for core and
- extended filters.
-
- This filter can be used multiple times within the same rule.
-
- Support: Implementation-specific
- properties:
- group:
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is kind of the referent. For example
- "HTTPRoute" or "Service".
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- required:
- - group
- - kind
- - name
- type: object
- requestHeaderModifier:
- description: |-
- RequestHeaderModifier defines a schema for a filter that modifies request
- headers.
-
- Support: Core
- properties:
- add:
- description: |-
- Add adds the given header(s) (name, value) to the request
- before the action. It appends to any existing values associated
- with the header name.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- add:
- - name: "my-header"
- value: "bar,baz"
-
- Output:
- GET /foo HTTP/1.1
- my-header: foo,bar,baz
- items:
- description: HTTPHeader represents an HTTP Header
- name and value as defined by RFC 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP Header
- to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- remove:
- description: |-
- Remove the given header(s) from the HTTP request before the action. The
- value of Remove is a list of HTTP header names. Note that the header
- names are case-insensitive (see
- https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).
-
- Input:
- GET /foo HTTP/1.1
- my-header1: foo
- my-header2: bar
- my-header3: baz
-
- Config:
- remove: ["my-header1", "my-header3"]
-
- Output:
- GET /foo HTTP/1.1
- my-header2: bar
- items:
- type: string
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- set:
- description: |-
- Set overwrites the request with the given header (name, value)
- before the action.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- set:
- - name: "my-header"
- value: "bar"
-
- Output:
- GET /foo HTTP/1.1
- my-header: bar
- items:
- description: HTTPHeader represents an HTTP Header
- name and value as defined by RFC 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP Header
- to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- requestMirror:
- description: |+
- RequestMirror defines a schema for a filter that mirrors requests.
- Requests are sent to the specified destination, but responses from
- that destination are ignored.
-
- This filter can be used multiple times within the same rule. Note that
- not all implementations will be able to support mirroring to multiple
- backends.
-
- Support: Extended
-
- properties:
- backendRef:
- description: |-
- BackendRef references a resource where mirrored requests are sent.
-
- Mirrored requests must be sent only to a single destination endpoint
- within this BackendRef, irrespective of how many endpoints are present
- within this BackendRef.
-
- If the referent cannot be found, this BackendRef is invalid and must be
- dropped from the Gateway. The controller must ensure the "ResolvedRefs"
- condition on the Route status is set to `status: False` and not configure
- this backend in the underlying implementation.
-
- If there is a cross-namespace reference to an *existing* object
- that is not allowed by a ReferenceGrant, the controller must ensure the
- "ResolvedRefs" condition on the Route is set to `status: False`,
- with the "RefNotPermitted" reason and not configure this backend in the
- underlying implementation.
-
- In either error case, the Message of the `ResolvedRefs` Condition
- should be used to provide more detail about the problem.
-
- Support: Extended for Kubernetes Service
-
- Support: Implementation-specific for any other resource
- properties:
- group:
- default: ""
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Service
- description: |-
- Kind is the Kubernetes resource kind of the referent. For example
- "Service".
-
- Defaults to "Service" when not specified.
-
- ExternalName services can refer to CNAME DNS records that may live
- outside of the cluster and as such are difficult to reason about in
- terms of conformance. They also may not be safe to forward to (see
- CVE-2021-25740 for more information). Implementations SHOULD NOT
- support ExternalName Services.
-
- Support: Core (Services with a type other than ExternalName)
-
- Support: Implementation-specific (Services with type ExternalName)
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the backend. When unspecified, the local
- namespace is inferred.
-
- Note that when a namespace different than the local namespace is specified,
- a ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port specifies the destination port number to use for this resource.
- Port is required when the referent is a Kubernetes Service. In this
- case, the port number is the service port number, not the target port.
- For other resources, destination port might be derived from the referent
- resource or this field.
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- required:
- - name
- type: object
- x-kubernetes-validations:
- - message: Must have port for Service reference
- rule: '(size(self.group) == 0 && self.kind == ''Service'')
- ? has(self.port) : true'
- fraction:
- description: |+
- Fraction represents the fraction of requests that should be
- mirrored to BackendRef.
-
- Only one of Fraction or Percent may be specified. If neither field
- is specified, 100% of requests will be mirrored.
-
- properties:
- denominator:
- default: 100
- format: int32
- minimum: 1
- type: integer
- numerator:
- format: int32
- minimum: 0
- type: integer
- required:
- - numerator
- type: object
- x-kubernetes-validations:
- - message: numerator must be less than or equal to
- denominator
- rule: self.numerator <= self.denominator
- percent:
- description: |+
- Percent represents the percentage of requests that should be
- mirrored to BackendRef. Its minimum value is 0 (indicating 0% of
- requests) and its maximum value is 100 (indicating 100% of requests).
-
- Only one of Fraction or Percent may be specified. If neither field
- is specified, 100% of requests will be mirrored.
-
- format: int32
- maximum: 100
- minimum: 0
- type: integer
- required:
- - backendRef
- type: object
- x-kubernetes-validations:
- - message: Only one of percent or fraction may be specified
- in HTTPRequestMirrorFilter
- rule: '!(has(self.percent) && has(self.fraction))'
- requestRedirect:
- description: |-
- RequestRedirect defines a schema for a filter that responds to the
- request with an HTTP redirection.
-
- Support: Core
- properties:
- hostname:
- description: |-
- Hostname is the hostname to be used in the value of the `Location`
- header in the response.
- When empty, the hostname in the `Host` header of the request is used.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- path:
- description: |-
- Path defines parameters used to modify the path of the incoming request.
- The modified path is then used to construct the `Location` header. When
- empty, the request path is used as-is.
-
- Support: Extended
- properties:
- replaceFullPath:
- description: |-
- ReplaceFullPath specifies the value with which to replace the full path
- of a request during a rewrite or redirect.
- maxLength: 1024
- type: string
- replacePrefixMatch:
- description: |-
- ReplacePrefixMatch specifies the value with which to replace the prefix
- match of a request during a rewrite or redirect. For example, a request
- to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch
- of "/xyz" would be modified to "/xyz/bar".
-
- Note that this matches the behavior of the PathPrefix match type. This
- matches full path elements. A path element refers to the list of labels
- in the path split by the `/` separator. When specified, a trailing `/` is
- ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all
- match the prefix `/abc`, but the path `/abcd` would not.
-
- ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.
- Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in
- the implementation setting the Accepted Condition for the Route to `status: False`.
-
- Request Path | Prefix Match | Replace Prefix | Modified Path
- maxLength: 1024
- type: string
- type:
- description: |-
- Type defines the type of path modifier. Additional types may be
- added in a future release of the API.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
- enum:
- - ReplaceFullPath
- - ReplacePrefixMatch
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: replaceFullPath must be specified when
- type is set to 'ReplaceFullPath'
- rule: 'self.type == ''ReplaceFullPath'' ? has(self.replaceFullPath)
- : true'
- - message: type must be 'ReplaceFullPath' when replaceFullPath
- is set
- rule: 'has(self.replaceFullPath) ? self.type ==
- ''ReplaceFullPath'' : true'
- - message: replacePrefixMatch must be specified when
- type is set to 'ReplacePrefixMatch'
- rule: 'self.type == ''ReplacePrefixMatch'' ? has(self.replacePrefixMatch)
- : true'
- - message: type must be 'ReplacePrefixMatch' when
- replacePrefixMatch is set
- rule: 'has(self.replacePrefixMatch) ? self.type
- == ''ReplacePrefixMatch'' : true'
- port:
- description: |-
- Port is the port to be used in the value of the `Location`
- header in the response.
-
- If no port is specified, the redirect port MUST be derived using the
- following rules:
-
- * If redirect scheme is not-empty, the redirect port MUST be the well-known
- port associated with the redirect scheme. Specifically "http" to port 80
- and "https" to port 443. If the redirect scheme does not have a
- well-known port, the listener port of the Gateway SHOULD be used.
- * If redirect scheme is empty, the redirect port MUST be the Gateway
- Listener port.
-
- Implementations SHOULD NOT add the port number in the 'Location'
- header in the following cases:
-
- * A Location header that will use HTTP (whether that is determined via
- the Listener protocol or the Scheme field) _and_ use port 80.
- * A Location header that will use HTTPS (whether that is determined via
- the Listener protocol or the Scheme field) _and_ use port 443.
-
- Support: Extended
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- scheme:
- description: |-
- Scheme is the scheme to be used in the value of the `Location` header in
- the response. When empty, the scheme of the request is used.
-
- Scheme redirects can affect the port of the redirect, for more information,
- refer to the documentation for the port field of this filter.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
-
- Support: Extended
- enum:
- - http
- - https
- type: string
- statusCode:
- default: 302
- description: |-
- StatusCode is the HTTP status code to be used in response.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
-
- Support: Core
- enum:
- - 301
- - 302
- type: integer
- type: object
- responseHeaderModifier:
- description: |-
- ResponseHeaderModifier defines a schema for a filter that modifies response
- headers.
-
- Support: Extended
- properties:
- add:
- description: |-
- Add adds the given header(s) (name, value) to the request
- before the action. It appends to any existing values associated
- with the header name.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- add:
- - name: "my-header"
- value: "bar,baz"
-
- Output:
- GET /foo HTTP/1.1
- my-header: foo,bar,baz
- items:
- description: HTTPHeader represents an HTTP Header
- name and value as defined by RFC 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP Header
- to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- remove:
- description: |-
- Remove the given header(s) from the HTTP request before the action. The
- value of Remove is a list of HTTP header names. Note that the header
- names are case-insensitive (see
- https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).
-
- Input:
- GET /foo HTTP/1.1
- my-header1: foo
- my-header2: bar
- my-header3: baz
-
- Config:
- remove: ["my-header1", "my-header3"]
-
- Output:
- GET /foo HTTP/1.1
- my-header2: bar
- items:
- type: string
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- set:
- description: |-
- Set overwrites the request with the given header (name, value)
- before the action.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- set:
- - name: "my-header"
- value: "bar"
-
- Output:
- GET /foo HTTP/1.1
- my-header: bar
- items:
- description: HTTPHeader represents an HTTP Header
- name and value as defined by RFC 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP Header
- to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- type:
- description: |-
- Type identifies the type of filter to apply. As with other API fields,
- types are classified into three conformance levels:
-
- - Core: Filter types and their corresponding configuration defined by
- "Support: Core" in this package, e.g. "RequestHeaderModifier". All
- implementations must support core filters.
-
- - Extended: Filter types and their corresponding configuration defined by
- "Support: Extended" in this package, e.g. "RequestMirror". Implementers
- are encouraged to support extended filters.
-
- - Implementation-specific: Filters that are defined and supported by
- specific vendors.
- In the future, filters showing convergence in behavior across multiple
- implementations will be considered for inclusion in extended or core
- conformance levels. Filter-specific configuration for such filters
- is specified using the ExtensionRef field. `Type` should be set to
- "ExtensionRef" for custom filters.
-
- Implementers are encouraged to define custom implementation types to
- extend the core API with implementation-specific behavior.
-
- If a reference to a custom filter type cannot be resolved, the filter
- MUST NOT be skipped. Instead, requests that would have been processed by
- that filter MUST receive a HTTP error response.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
- enum:
- - RequestHeaderModifier
- - ResponseHeaderModifier
- - RequestMirror
- - RequestRedirect
- - URLRewrite
- - ExtensionRef
- type: string
- urlRewrite:
- description: |-
- URLRewrite defines a schema for a filter that modifies a request during forwarding.
-
- Support: Extended
- properties:
- hostname:
- description: |-
- Hostname is the value to be used to replace the Host header value during
- forwarding.
-
- Support: Extended
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- path:
- description: |-
- Path defines a path rewrite.
-
- Support: Extended
- properties:
- replaceFullPath:
- description: |-
- ReplaceFullPath specifies the value with which to replace the full path
- of a request during a rewrite or redirect.
- maxLength: 1024
- type: string
- replacePrefixMatch:
- description: |-
- ReplacePrefixMatch specifies the value with which to replace the prefix
- match of a request during a rewrite or redirect. For example, a request
- to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch
- of "/xyz" would be modified to "/xyz/bar".
-
- Note that this matches the behavior of the PathPrefix match type. This
- matches full path elements. A path element refers to the list of labels
- in the path split by the `/` separator. When specified, a trailing `/` is
- ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all
- match the prefix `/abc`, but the path `/abcd` would not.
-
- ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.
- Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in
- the implementation setting the Accepted Condition for the Route to `status: False`.
-
- Request Path | Prefix Match | Replace Prefix | Modified Path
- maxLength: 1024
- type: string
- type:
- description: |-
- Type defines the type of path modifier. Additional types may be
- added in a future release of the API.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
- enum:
- - ReplaceFullPath
- - ReplacePrefixMatch
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: replaceFullPath must be specified when
- type is set to 'ReplaceFullPath'
- rule: 'self.type == ''ReplaceFullPath'' ? has(self.replaceFullPath)
- : true'
- - message: type must be 'ReplaceFullPath' when replaceFullPath
- is set
- rule: 'has(self.replaceFullPath) ? self.type ==
- ''ReplaceFullPath'' : true'
- - message: replacePrefixMatch must be specified when
- type is set to 'ReplacePrefixMatch'
- rule: 'self.type == ''ReplacePrefixMatch'' ? has(self.replacePrefixMatch)
- : true'
- - message: type must be 'ReplacePrefixMatch' when
- replacePrefixMatch is set
- rule: 'has(self.replacePrefixMatch) ? self.type
- == ''ReplacePrefixMatch'' : true'
- type: object
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: filter.requestHeaderModifier must be nil if the
- filter.type is not RequestHeaderModifier
- rule: '!(has(self.requestHeaderModifier) && self.type !=
- ''RequestHeaderModifier'')'
- - message: filter.requestHeaderModifier must be specified
- for RequestHeaderModifier filter.type
- rule: '!(!has(self.requestHeaderModifier) && self.type ==
- ''RequestHeaderModifier'')'
- - message: filter.responseHeaderModifier must be nil if the
- filter.type is not ResponseHeaderModifier
- rule: '!(has(self.responseHeaderModifier) && self.type !=
- ''ResponseHeaderModifier'')'
- - message: filter.responseHeaderModifier must be specified
- for ResponseHeaderModifier filter.type
- rule: '!(!has(self.responseHeaderModifier) && self.type
- == ''ResponseHeaderModifier'')'
- - message: filter.requestMirror must be nil if the filter.type
- is not RequestMirror
- rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')'
- - message: filter.requestMirror must be specified for RequestMirror
- filter.type
- rule: '!(!has(self.requestMirror) && self.type == ''RequestMirror'')'
- - message: filter.requestRedirect must be nil if the filter.type
- is not RequestRedirect
- rule: '!(has(self.requestRedirect) && self.type != ''RequestRedirect'')'
- - message: filter.requestRedirect must be specified for RequestRedirect
- filter.type
- rule: '!(!has(self.requestRedirect) && self.type == ''RequestRedirect'')'
- - message: filter.urlRewrite must be nil if the filter.type
- is not URLRewrite
- rule: '!(has(self.urlRewrite) && self.type != ''URLRewrite'')'
- - message: filter.urlRewrite must be specified for URLRewrite
- filter.type
- rule: '!(!has(self.urlRewrite) && self.type == ''URLRewrite'')'
- - message: filter.extensionRef must be nil if the filter.type
- is not ExtensionRef
- rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')'
- - message: filter.extensionRef must be specified for ExtensionRef
- filter.type
- rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')'
- maxItems: 16
- type: array
- x-kubernetes-validations:
- - message: May specify either httpRouteFilterRequestRedirect
- or httpRouteFilterRequestRewrite, but not both
- rule: '!(self.exists(f, f.type == ''RequestRedirect'') &&
- self.exists(f, f.type == ''URLRewrite''))'
- - message: RequestHeaderModifier filter cannot be repeated
- rule: self.filter(f, f.type == 'RequestHeaderModifier').size()
- <= 1
- - message: ResponseHeaderModifier filter cannot be repeated
- rule: self.filter(f, f.type == 'ResponseHeaderModifier').size()
- <= 1
- - message: RequestRedirect filter cannot be repeated
- rule: self.filter(f, f.type == 'RequestRedirect').size() <=
- 1
- - message: URLRewrite filter cannot be repeated
- rule: self.filter(f, f.type == 'URLRewrite').size() <= 1
- matches:
- default:
- - path:
- type: PathPrefix
- value: /
- description: |-
- Matches define conditions used for matching the rule against incoming
- HTTP requests. Each match is independent, i.e. this rule will be matched
- if **any** one of the matches is satisfied.
-
- For example, take the following matches configuration:
-
- ```
- matches:
- - path:
- value: "/foo"
- headers:
- - name: "version"
- value: "v2"
- - path:
- value: "/v2/foo"
- ```
-
- For a request to match against this rule, a request must satisfy
- EITHER of the two conditions:
-
- - path prefixed with `/foo` AND contains the header `version: v2`
- - path prefix of `/v2/foo`
-
- See the documentation for HTTPRouteMatch on how to specify multiple
- match conditions that should be ANDed together.
-
- If no matches are specified, the default is a prefix
- path match on "/", which has the effect of matching every
- HTTP request.
-
- Proxy or Load Balancer routing configuration generated from HTTPRoutes
- MUST prioritize matches based on the following criteria, continuing on
- ties. Across all rules specified on applicable Routes, precedence must be
- given to the match having:
-
- * "Exact" path match.
- * "Prefix" path match with largest number of characters.
- * Method match.
- * Largest number of header matches.
- * Largest number of query param matches.
-
- Note: The precedence of RegularExpression path matches are implementation-specific.
-
- If ties still exist across multiple Routes, matching precedence MUST be
- determined in order of the following criteria, continuing on ties:
-
- * The oldest Route based on creation timestamp.
- * The Route appearing first in alphabetical order by
- "{namespace}/{name}".
-
- If ties still exist within an HTTPRoute, matching precedence MUST be granted
- to the FIRST matching rule (in list order) with a match meeting the above
- criteria.
-
- When no rules matching a request have been successfully attached to the
- parent a request is coming from, a HTTP 404 status code MUST be returned.
- items:
- description: "HTTPRouteMatch defines the predicate used to
- match requests to a given\naction. Multiple match types
- are ANDed together, i.e. the match will\nevaluate to true
- only if all conditions are satisfied.\n\nFor example, the
- match below will match a HTTP request only if its path\nstarts
- with `/foo` AND it contains the `version: v1` header:\n\n```\nmatch:\n\n\tpath:\n\t
- \ value: \"/foo\"\n\theaders:\n\t- name: \"version\"\n\t
- \ value \"v1\"\n\n```"
- properties:
- headers:
- description: |-
- Headers specifies HTTP request header matchers. Multiple match values are
- ANDed together, meaning, a request must match all the specified headers
- to select the route.
- items:
- description: |-
- HTTPHeaderMatch describes how to select a HTTP route by matching HTTP request
- headers.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, only the first
- entry with an equivalent name MUST be considered for a match. Subsequent
- entries with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
-
- When a header is repeated in an HTTP request, it is
- implementation-specific behavior as to how this is represented.
- Generally, proxies should follow the guidance from the RFC:
- https://www.rfc-editor.org/rfc/rfc7230.html#section-3.2.2 regarding
- processing a repeated header, with special handling for "Set-Cookie".
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- type:
- default: Exact
- description: |-
- Type specifies how to match against the value of the header.
-
- Support: Core (Exact)
-
- Support: Implementation-specific (RegularExpression)
-
- Since RegularExpression HeaderMatchType has implementation-specific
- conformance, implementations can support POSIX, PCRE or any other dialects
- of regular expressions. Please read the implementation's documentation to
- determine the supported dialect.
- enum:
- - Exact
- - RegularExpression
- type: string
- value:
- description: Value is the value of HTTP Header to
- be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- method:
- description: |-
- Method specifies HTTP method matcher.
- When specified, this route will be matched only if the request has the
- specified method.
-
- Support: Extended
- enum:
- - GET
- - HEAD
- - POST
- - PUT
- - DELETE
- - CONNECT
- - OPTIONS
- - TRACE
- - PATCH
- type: string
- path:
- default:
- type: PathPrefix
- value: /
- description: |-
- Path specifies a HTTP request path matcher. If this field is not
- specified, a default prefix match on the "/" path is provided.
- properties:
- type:
- default: PathPrefix
- description: |-
- Type specifies how to match against the path Value.
-
- Support: Core (Exact, PathPrefix)
-
- Support: Implementation-specific (RegularExpression)
- enum:
- - Exact
- - PathPrefix
- - RegularExpression
- type: string
- value:
- default: /
- description: Value of the HTTP path to match against.
- maxLength: 1024
- type: string
- type: object
- x-kubernetes-validations:
- - message: value must be an absolute path and start with
- '/' when type one of ['Exact', 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? self.value.startsWith(''/'')
- : true'
- - message: must not contain '//' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''//'')
- : true'
- - message: must not contain '/./' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''/./'')
- : true'
- - message: must not contain '/../' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''/../'')
- : true'
- - message: must not contain '%2f' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''%2f'')
- : true'
- - message: must not contain '%2F' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''%2F'')
- : true'
- - message: must not contain '#' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''#'')
- : true'
- - message: must not end with '/..' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.endsWith(''/..'')
- : true'
- - message: must not end with '/.' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.endsWith(''/.'')
- : true'
- - message: type must be one of ['Exact', 'PathPrefix',
- 'RegularExpression']
- rule: self.type in ['Exact','PathPrefix'] || self.type
- == 'RegularExpression'
- - message: must only contain valid characters (matching
- ^(?:[-A-Za-z0-9/._~!$&'()*+,;=:@]|[%][0-9a-fA-F]{2})+$)
- for types ['Exact', 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? self.value.matches(r"""^(?:[-A-Za-z0-9/._~!$&''()*+,;=:@]|[%][0-9a-fA-F]{2})+$""")
- : true'
- queryParams:
- description: |-
- QueryParams specifies HTTP query parameter matchers. Multiple match
- values are ANDed together, meaning, a request must match all the
- specified query parameters to select the route.
-
- Support: Extended
- items:
- description: |-
- HTTPQueryParamMatch describes how to select a HTTP route by matching HTTP
- query parameters.
- properties:
- name:
- description: |-
- Name is the name of the HTTP query param to be matched. This must be an
- exact string match. (See
- https://tools.ietf.org/html/rfc7230#section-2.7.3).
-
- If multiple entries specify equivalent query param names, only the first
- entry with an equivalent name MUST be considered for a match. Subsequent
- entries with an equivalent query param name MUST be ignored.
-
- If a query param is repeated in an HTTP request, the behavior is
- purposely left undefined, since different data planes have different
- capabilities. However, it is *recommended* that implementations should
- match against the first value of the param if the data plane supports it,
- as this behavior is expected in other load balancing contexts outside of
- the Gateway API.
-
- Users SHOULD NOT route traffic based on repeated query params to guard
- themselves against potential differences in the implementations.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- type:
- default: Exact
- description: |-
- Type specifies how to match against the value of the query parameter.
-
- Support: Extended (Exact)
-
- Support: Implementation-specific (RegularExpression)
-
- Since RegularExpression QueryParamMatchType has Implementation-specific
- conformance, implementations can support POSIX, PCRE or any other
- dialects of regular expressions. Please read the implementation's
- documentation to determine the supported dialect.
- enum:
- - Exact
- - RegularExpression
- type: string
- value:
- description: Value is the value of HTTP query param
- to be matched.
- maxLength: 1024
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- maxItems: 64
- type: array
- name:
- description: |
- Name is the name of the route rule. This name MUST be unique within a Route if it is set.
-
- Support: Extended
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- retry:
- description: |+
- Retry defines the configuration for when to retry an HTTP request.
-
- Support: Extended
-
- properties:
- attempts:
- description: |-
- Attempts specifies the maxmimum number of times an individual request
- from the gateway to a backend should be retried.
-
- If the maximum number of retries has been attempted without a successful
- response from the backend, the Gateway MUST return an error.
-
- When this field is unspecified, the number of times to attempt to retry
- a backend request is implementation-specific.
-
- Support: Extended
- type: integer
- backoff:
- description: |-
- Backoff specifies the minimum duration a Gateway should wait between
- retry attempts and is represented in Gateway API Duration formatting.
-
- For example, setting the `rules[].retry.backoff` field to the value
- `100ms` will cause a backend request to first be retried approximately
- 100 milliseconds after timing out or receiving a response code configured
- to be retryable.
-
- An implementation MAY use an exponential or alternative backoff strategy
- for subsequent retry attempts, MAY cap the maximum backoff duration to
- some amount greater than the specified minimum, and MAY add arbitrary
- jitter to stagger requests, as long as unsuccessful backend requests are
- not retried before the configured minimum duration.
-
- If a Request timeout (`rules[].timeouts.request`) is configured on the
- route, the entire duration of the initial request and any retry attempts
- MUST not exceed the Request timeout duration. If any retry attempts are
- still in progress when the Request timeout duration has been reached,
- these SHOULD be canceled if possible and the Gateway MUST immediately
- return a timeout error.
-
- If a BackendRequest timeout (`rules[].timeouts.backendRequest`) is
- configured on the route, any retry attempts which reach the configured
- BackendRequest timeout duration without a response SHOULD be canceled if
- possible and the Gateway should wait for at least the specified backoff
- duration before attempting to retry the backend request again.
-
- If a BackendRequest timeout is _not_ configured on the route, retry
- attempts MAY time out after an implementation default duration, or MAY
- remain pending until a configured Request timeout or implementation
- default duration for total request time is reached.
-
- When this field is unspecified, the time to wait between retry attempts
- is implementation-specific.
-
- Support: Extended
- pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
- type: string
- codes:
- description: |-
- Codes defines the HTTP response status codes for which a backend request
- should be retried.
-
- Support: Extended
- items:
- description: |-
- HTTPRouteRetryStatusCode defines an HTTP response status code for
- which a backend request should be retried.
-
- Implementations MUST support the following status codes as retryable:
-
- * 500
- * 502
- * 503
- * 504
-
- Implementations MAY support specifying additional discrete values in the
- 500-599 range.
-
- Implementations MAY support specifying discrete values in the 400-499 range,
- which are often inadvisable to retry.
-
-
- maximum: 599
- minimum: 400
- type: integer
- type: array
- type: object
- sessionPersistence:
- description: |+
- SessionPersistence defines and configures session persistence
- for the route rule.
-
- Support: Extended
-
- properties:
- absoluteTimeout:
- description: |-
- AbsoluteTimeout defines the absolute timeout of the persistent
- session. Once the AbsoluteTimeout duration has elapsed, the
- session becomes invalid.
-
- Support: Extended
- pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
- type: string
- cookieConfig:
- description: |-
- CookieConfig provides configuration settings that are specific
- to cookie-based session persistence.
-
- Support: Core
- properties:
- lifetimeType:
- default: Session
- description: |-
- LifetimeType specifies whether the cookie has a permanent or
- session-based lifetime. A permanent cookie persists until its
- specified expiry time, defined by the Expires or Max-Age cookie
- attributes, while a session cookie is deleted when the current
- session ends.
-
- When set to "Permanent", AbsoluteTimeout indicates the
- cookie's lifetime via the Expires or Max-Age cookie attributes
- and is required.
-
- When set to "Session", AbsoluteTimeout indicates the
- absolute lifetime of the cookie tracked by the gateway and
- is optional.
-
- Support: Core for "Session" type
-
- Support: Extended for "Permanent" type
- enum:
- - Permanent
- - Session
- type: string
- type: object
- idleTimeout:
- description: |-
- IdleTimeout defines the idle timeout of the persistent session.
- Once the session has been idle for more than the specified
- IdleTimeout duration, the session becomes invalid.
-
- Support: Extended
- pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
- type: string
- sessionName:
- description: |-
- SessionName defines the name of the persistent session token
- which may be reflected in the cookie or the header. Users
- should avoid reusing session names to prevent unintended
- consequences, such as rejection or unpredictable behavior.
-
- Support: Implementation-specific
- maxLength: 128
- type: string
- type:
- default: Cookie
- description: |-
- Type defines the type of session persistence such as through
- the use a header or cookie. Defaults to cookie based session
- persistence.
-
- Support: Core for "Cookie" type
-
- Support: Extended for "Header" type
- enum:
- - Cookie
- - Header
- type: string
- type: object
- x-kubernetes-validations:
- - message: AbsoluteTimeout must be specified when cookie lifetimeType
- is Permanent
- rule: '!has(self.cookieConfig) || !has(self.cookieConfig.lifetimeType)
- || self.cookieConfig.lifetimeType != ''Permanent'' || has(self.absoluteTimeout)'
- timeouts:
- description: |-
- Timeouts defines the timeouts that can be configured for an HTTP request.
-
- Support: Extended
- properties:
- backendRequest:
- description: |-
- BackendRequest specifies a timeout for an individual request from the gateway
- to a backend. This covers the time from when the request first starts being
- sent from the gateway to when the full response has been received from the backend.
-
- Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout
- completely. Implementations that cannot completely disable the timeout MUST
- instead interpret the zero duration as the longest possible value to which
- the timeout can be set.
-
- An entire client HTTP transaction with a gateway, covered by the Request timeout,
- may result in more than one call from the gateway to the destination backend,
- for example, if automatic retries are supported.
-
- The value of BackendRequest must be a Gateway API Duration string as defined by
- GEP-2257. When this field is unspecified, its behavior is implementation-specific;
- when specified, the value of BackendRequest must be no more than the value of the
- Request timeout (since the Request timeout encompasses the BackendRequest timeout).
-
- Support: Extended
- pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
- type: string
- request:
- description: |-
- Request specifies the maximum duration for a gateway to respond to an HTTP request.
- If the gateway has not been able to respond before this deadline is met, the gateway
- MUST return a timeout error.
-
- For example, setting the `rules.timeouts.request` field to the value `10s` in an
- `HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds
- to complete.
-
- Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout
- completely. Implementations that cannot completely disable the timeout MUST
- instead interpret the zero duration as the longest possible value to which
- the timeout can be set.
-
- This timeout is intended to cover as close to the whole request-response transaction
- as possible although an implementation MAY choose to start the timeout after the entire
- request stream has been received instead of immediately after the transaction is
- initiated by the client.
-
- The value of Request is a Gateway API Duration string as defined by GEP-2257. When this
- field is unspecified, request timeout behavior is implementation-specific.
-
- Support: Extended
- pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
- type: string
- type: object
- x-kubernetes-validations:
- - message: backendRequest timeout cannot be longer than request
- timeout
- rule: '!(has(self.request) && has(self.backendRequest) &&
- duration(self.request) != duration(''0s'') && duration(self.backendRequest)
- > duration(self.request))'
- type: object
- x-kubernetes-validations:
- - message: RequestRedirect filter must not be used together with
- backendRefs
- rule: '(has(self.backendRefs) && size(self.backendRefs) > 0) ?
- (!has(self.filters) || self.filters.all(f, !has(f.requestRedirect))):
- true'
- - message: When using RequestRedirect filter with path.replacePrefixMatch,
- exactly one PathPrefix match must be specified
- rule: '(has(self.filters) && self.filters.exists_one(f, has(f.requestRedirect)
- && has(f.requestRedirect.path) && f.requestRedirect.path.type
- == ''ReplacePrefixMatch'' && has(f.requestRedirect.path.replacePrefixMatch)))
- ? ((size(self.matches) != 1 || !has(self.matches[0].path) ||
- self.matches[0].path.type != ''PathPrefix'') ? false : true)
- : true'
- - message: When using URLRewrite filter with path.replacePrefixMatch,
- exactly one PathPrefix match must be specified
- rule: '(has(self.filters) && self.filters.exists_one(f, has(f.urlRewrite)
- && has(f.urlRewrite.path) && f.urlRewrite.path.type == ''ReplacePrefixMatch''
- && has(f.urlRewrite.path.replacePrefixMatch))) ? ((size(self.matches)
- != 1 || !has(self.matches[0].path) || self.matches[0].path.type
- != ''PathPrefix'') ? false : true) : true'
- - message: Within backendRefs, when using RequestRedirect filter
- with path.replacePrefixMatch, exactly one PathPrefix match must
- be specified
- rule: '(has(self.backendRefs) && self.backendRefs.exists_one(b,
- (has(b.filters) && b.filters.exists_one(f, has(f.requestRedirect)
- && has(f.requestRedirect.path) && f.requestRedirect.path.type
- == ''ReplacePrefixMatch'' && has(f.requestRedirect.path.replacePrefixMatch)))
- )) ? ((size(self.matches) != 1 || !has(self.matches[0].path)
- || self.matches[0].path.type != ''PathPrefix'') ? false : true)
- : true'
- - message: Within backendRefs, When using URLRewrite filter with
- path.replacePrefixMatch, exactly one PathPrefix match must be
- specified
- rule: '(has(self.backendRefs) && self.backendRefs.exists_one(b,
- (has(b.filters) && b.filters.exists_one(f, has(f.urlRewrite)
- && has(f.urlRewrite.path) && f.urlRewrite.path.type == ''ReplacePrefixMatch''
- && has(f.urlRewrite.path.replacePrefixMatch))) )) ? ((size(self.matches)
- != 1 || !has(self.matches[0].path) || self.matches[0].path.type
- != ''PathPrefix'') ? false : true) : true'
- maxItems: 16
- type: array
- x-kubernetes-validations:
- - message: While 16 rules and 64 matches per rule are allowed, the
- total number of matches across all rules in a route must be less
- than 128
- rule: '(self.size() > 0 ? self[0].matches.size() : 0) + (self.size()
- > 1 ? self[1].matches.size() : 0) + (self.size() > 2 ? self[2].matches.size()
- : 0) + (self.size() > 3 ? self[3].matches.size() : 0) + (self.size()
- > 4 ? self[4].matches.size() : 0) + (self.size() > 5 ? self[5].matches.size()
- : 0) + (self.size() > 6 ? self[6].matches.size() : 0) + (self.size()
- > 7 ? self[7].matches.size() : 0) + (self.size() > 8 ? self[8].matches.size()
- : 0) + (self.size() > 9 ? self[9].matches.size() : 0) + (self.size()
- > 10 ? self[10].matches.size() : 0) + (self.size() > 11 ? self[11].matches.size()
- : 0) + (self.size() > 12 ? self[12].matches.size() : 0) + (self.size()
- > 13 ? self[13].matches.size() : 0) + (self.size() > 14 ? self[14].matches.size()
- : 0) + (self.size() > 15 ? self[15].matches.size() : 0) <= 128'
- - message: Rule name must be unique within the route
- rule: self.all(l1, !has(l1.name) || self.exists_one(l2, has(l2.name)
- && l1.name == l2.name))
- type: object
- status:
- description: Status defines the current state of HTTPRoute.
- properties:
- parents:
- description: |-
- Parents is a list of parent resources (usually Gateways) that are
- associated with the route, and the status of the route with respect to
- each parent. When this route attaches to a parent, the controller that
- manages the parent must add an entry to this list when the controller
- first sees the route and should update the entry as appropriate when the
- route or gateway is modified.
-
- Note that parent references that cannot be resolved by an implementation
- of this API will not be added to this list. Implementations of this API
- can only populate Route status for the Gateways/parent resources they are
- responsible for.
-
- A maximum of 32 Gateways will be represented in this list. An empty list
- means the route has not been attached to any Gateway.
- items:
- description: |-
- RouteParentStatus describes the status of a route with respect to an
- associated Parent.
- properties:
- conditions:
- description: |-
- Conditions describes the status of the route with respect to the Gateway.
- Note that the route's availability is also subject to the Gateway's own
- status conditions and listener status.
-
- If the Route's ParentRef specifies an existing Gateway that supports
- Routes of this kind AND that Gateway's controller has sufficient access,
- then that Gateway's controller MUST set the "Accepted" condition on the
- Route, to indicate whether the route has been accepted or rejected by the
- Gateway, and why.
-
- A Route MUST be considered "Accepted" if at least one of the Route's
- rules is implemented by the Gateway.
-
- There are a number of cases where the "Accepted" condition may not be set
- due to lack of controller visibility, that includes when:
-
- * The Route refers to a non-existent parent.
- * The Route is of a type that the controller does not support.
- * The Route is in a namespace the controller does not have access to.
- items:
- description: Condition contains details for one aspect of
- the current state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False,
- Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- maxItems: 8
- minItems: 1
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- controllerName:
- description: |-
- ControllerName is a domain/path string that indicates the name of the
- controller that wrote this status. This corresponds with the
- controllerName field on GatewayClass.
-
- Example: "example.net/gateway-controller".
-
- The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
- valid Kubernetes names
- (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
-
- Controllers MUST populate this field when writing status. Controllers should ensure that
- entries to status populated with their ControllerName are cleaned up when they are no
- longer necessary.
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
- type: string
- parentRef:
- description: |-
- ParentRef corresponds with a ParentRef in the spec that this
- RouteParentStatus struct describes the status of.
- properties:
- group:
- default: gateway.networking.k8s.io
- description: |-
- Group is the group of the referent.
- When unspecified, "gateway.networking.k8s.io" is inferred.
- To set the core API group (such as for a "Service" kind referent),
- Group must be explicitly set to "" (empty string).
-
- Support: Core
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Gateway
- description: |-
- Kind is kind of the referent.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- Support for other resources is Implementation-Specific.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: |-
- Name is the name of the referent.
-
- Support: Core
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referent. When unspecified, this refers
- to the local namespace of the Route.
-
- Note that there are specific rules for ParentRefs which cross namespace
- boundaries. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example:
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable any other kind of cross-namespace reference.
-
-
- ParentRefs from a Route to a Service in the same namespace are "producer"
- routes, which apply default routing rules to inbound connections from
- any namespace to the Service.
-
- ParentRefs from a Route to a Service in a different namespace are
- "consumer" routes, and these routing rules are only applied to outbound
- connections originating from the same namespace as the Route, for which
- the intended destination of the connections are a Service targeted as a
- ParentRef of the Route.
-
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port is the network port this Route targets. It can be interpreted
- differently based on the type of parent resource.
-
- When the parent resource is a Gateway, this targets all listeners
- listening on the specified port that also support this kind of Route(and
- select this Route). It's not recommended to set `Port` unless the
- networking behaviors specified in a Route must apply to a specific port
- as opposed to a listener(s) whose port(s) may be changed. When both Port
- and SectionName are specified, the name and port of the selected listener
- must match both specified values.
-
-
- When the parent resource is a Service, this targets a specific port in the
- Service spec. When both Port (experimental) and SectionName are specified,
- the name and port of the selected port must match both specified values.
-
-
- Implementations MAY choose to support other parent resources.
- Implementations supporting other types of parent resources MUST clearly
- document how/if Port is interpreted.
-
- For the purpose of status, an attachment is considered successful as
- long as the parent resource accepts it partially. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
- from the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route,
- the Route MUST be considered detached from the Gateway.
-
- Support: Extended
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- sectionName:
- description: |-
- SectionName is the name of a section within the target resource. In the
- following resources, SectionName is interpreted as the following:
-
- * Gateway: Listener name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
- * Service: Port name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
-
- Implementations MAY choose to support attaching Routes to other resources.
- If that is the case, they MUST clearly document how SectionName is
- interpreted.
-
- When unspecified (empty string), this will reference the entire resource.
- For the purpose of status, an attachment is considered successful if at
- least one section in the parent resource accepts it. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
- the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route, the
- Route MUST be considered detached from the Gateway.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- required:
- - name
- type: object
- required:
- - controllerName
- - parentRef
- type: object
- maxItems: 32
- type: array
- required:
- - parents
- type: object
- required:
- - spec
- type: object
- served: true
- storage: true
- subresources:
- status: {}
- - additionalPrinterColumns:
- - jsonPath: .spec.hostnames
- name: Hostnames
- type: string
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- name: v1beta1
- schema:
- openAPIV3Schema:
- description: |-
- HTTPRoute provides a way to route HTTP requests. This includes the capability
- to match requests by hostname, path, header, or query param. Filters can be
- used to specify additional processing steps. Backends specify where matching
- requests should be routed.
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: Spec defines the desired state of HTTPRoute.
- properties:
- hostnames:
- description: |-
- Hostnames defines a set of hostnames that should match against the HTTP Host
- header to select a HTTPRoute used to process the request. Implementations
- MUST ignore any port value specified in the HTTP Host header while
- performing a match and (absent of any applicable header modification
- configuration) MUST forward this header unmodified to the backend.
-
- Valid values for Hostnames are determined by RFC 1123 definition of a
- hostname with 2 notable exceptions:
-
- 1. IPs are not allowed.
- 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard
- label must appear by itself as the first label.
-
- If a hostname is specified by both the Listener and HTTPRoute, there
- must be at least one intersecting hostname for the HTTPRoute to be
- attached to the Listener. For example:
-
- * A Listener with `test.example.com` as the hostname matches HTTPRoutes
- that have either not specified any hostnames, or have specified at
- least one of `test.example.com` or `*.example.com`.
- * A Listener with `*.example.com` as the hostname matches HTTPRoutes
- that have either not specified any hostnames or have specified at least
- one hostname that matches the Listener hostname. For example,
- `*.example.com`, `test.example.com`, and `foo.test.example.com` would
- all match. On the other hand, `example.com` and `test.example.net` would
- not match.
-
- Hostnames that are prefixed with a wildcard label (`*.`) are interpreted
- as a suffix match. That means that a match for `*.example.com` would match
- both `test.example.com`, and `foo.test.example.com`, but not `example.com`.
-
- If both the Listener and HTTPRoute have specified hostnames, any
- HTTPRoute hostnames that do not match the Listener hostname MUST be
- ignored. For example, if a Listener specified `*.example.com`, and the
- HTTPRoute specified `test.example.com` and `test.example.net`,
- `test.example.net` must not be considered for a match.
-
- If both the Listener and HTTPRoute have specified hostnames, and none
- match with the criteria above, then the HTTPRoute is not accepted. The
- implementation must raise an 'Accepted' Condition with a status of
- `False` in the corresponding RouteParentStatus.
-
- In the event that multiple HTTPRoutes specify intersecting hostnames (e.g.
- overlapping wildcard matching and exact matching hostnames), precedence must
- be given to rules from the HTTPRoute with the largest number of:
-
- * Characters in a matching non-wildcard hostname.
- * Characters in a matching hostname.
-
- If ties exist across multiple Routes, the matching precedence rules for
- HTTPRouteMatches takes over.
-
- Support: Core
- items:
- description: |-
- Hostname is the fully qualified domain name of a network host. This matches
- the RFC 1123 definition of a hostname with 2 notable exceptions:
-
- 1. IPs are not allowed.
- 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard
- label must appear by itself as the first label.
-
- Hostname can be "precise" which is a domain name without the terminating
- dot of a network host (e.g. "foo.example.com") or "wildcard", which is a
- domain name prefixed with a single wildcard label (e.g. `*.example.com`).
-
- Note that as per RFC1035 and RFC1123, a *label* must consist of lower case
- alphanumeric characters or '-', and must start and end with an alphanumeric
- character. No other punctuation is allowed.
- maxLength: 253
- minLength: 1
- pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- maxItems: 16
- type: array
- parentRefs:
- description: |+
- ParentRefs references the resources (usually Gateways) that a Route wants
- to be attached to. Note that the referenced parent resource needs to
- allow this for the attachment to be complete. For Gateways, that means
- the Gateway needs to allow attachment from Routes of this kind and
- namespace. For Services, that means the Service must either be in the same
- namespace for a "producer" route, or the mesh implementation must support
- and allow "consumer" routes for the referenced Service. ReferenceGrant is
- not applicable for governing ParentRefs to Services - it is not possible to
- create a "producer" route for a Service in a different namespace from the
- Route.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- This API may be extended in the future to support additional kinds of parent
- resources.
-
- ParentRefs must be _distinct_. This means either that:
-
- * They select different objects. If this is the case, then parentRef
- entries are distinct. In terms of fields, this means that the
- multi-part key defined by `group`, `kind`, `namespace`, and `name` must
- be unique across all parentRef entries in the Route.
- * They do not select different objects, but for each optional field used,
- each ParentRef that selects the same object must set the same set of
- optional fields to different values. If one ParentRef sets a
- combination of optional fields, all must set the same combination.
-
- Some examples:
-
- * If one ParentRef sets `sectionName`, all ParentRefs referencing the
- same object must also set `sectionName`.
- * If one ParentRef sets `port`, all ParentRefs referencing the same
- object must also set `port`.
- * If one ParentRef sets `sectionName` and `port`, all ParentRefs
- referencing the same object must also set `sectionName` and `port`.
-
- It is possible to separately reference multiple distinct objects that may
- be collapsed by an implementation. For example, some implementations may
- choose to merge compatible Gateway Listeners together. If that is the
- case, the list of routes attached to those resources should also be
- merged.
-
- Note that for ParentRefs that cross namespace boundaries, there are specific
- rules. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example,
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable other kinds of cross-namespace reference.
-
-
- ParentRefs from a Route to a Service in the same namespace are "producer"
- routes, which apply default routing rules to inbound connections from
- any namespace to the Service.
-
- ParentRefs from a Route to a Service in a different namespace are
- "consumer" routes, and these routing rules are only applied to outbound
- connections originating from the same namespace as the Route, for which
- the intended destination of the connections are a Service targeted as a
- ParentRef of the Route.
-
-
-
-
-
- items:
- description: |-
- ParentReference identifies an API object (usually a Gateway) that can be considered
- a parent of this resource (usually a route). There are two kinds of parent resources
- with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- This API may be extended in the future to support additional kinds of parent
- resources.
-
- The API object must be valid in the cluster; the Group and Kind must
- be registered in the cluster for this reference to be valid.
- properties:
- group:
- default: gateway.networking.k8s.io
- description: |-
- Group is the group of the referent.
- When unspecified, "gateway.networking.k8s.io" is inferred.
- To set the core API group (such as for a "Service" kind referent),
- Group must be explicitly set to "" (empty string).
-
- Support: Core
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Gateway
- description: |-
- Kind is kind of the referent.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- Support for other resources is Implementation-Specific.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: |-
- Name is the name of the referent.
-
- Support: Core
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referent. When unspecified, this refers
- to the local namespace of the Route.
-
- Note that there are specific rules for ParentRefs which cross namespace
- boundaries. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example:
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable any other kind of cross-namespace reference.
-
-
- ParentRefs from a Route to a Service in the same namespace are "producer"
- routes, which apply default routing rules to inbound connections from
- any namespace to the Service.
-
- ParentRefs from a Route to a Service in a different namespace are
- "consumer" routes, and these routing rules are only applied to outbound
- connections originating from the same namespace as the Route, for which
- the intended destination of the connections are a Service targeted as a
- ParentRef of the Route.
-
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port is the network port this Route targets. It can be interpreted
- differently based on the type of parent resource.
-
- When the parent resource is a Gateway, this targets all listeners
- listening on the specified port that also support this kind of Route(and
- select this Route). It's not recommended to set `Port` unless the
- networking behaviors specified in a Route must apply to a specific port
- as opposed to a listener(s) whose port(s) may be changed. When both Port
- and SectionName are specified, the name and port of the selected listener
- must match both specified values.
-
-
- When the parent resource is a Service, this targets a specific port in the
- Service spec. When both Port (experimental) and SectionName are specified,
- the name and port of the selected port must match both specified values.
-
-
- Implementations MAY choose to support other parent resources.
- Implementations supporting other types of parent resources MUST clearly
- document how/if Port is interpreted.
-
- For the purpose of status, an attachment is considered successful as
- long as the parent resource accepts it partially. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
- from the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route,
- the Route MUST be considered detached from the Gateway.
-
- Support: Extended
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- sectionName:
- description: |-
- SectionName is the name of a section within the target resource. In the
- following resources, SectionName is interpreted as the following:
-
- * Gateway: Listener name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
- * Service: Port name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
-
- Implementations MAY choose to support attaching Routes to other resources.
- If that is the case, they MUST clearly document how SectionName is
- interpreted.
-
- When unspecified (empty string), this will reference the entire resource.
- For the purpose of status, an attachment is considered successful if at
- least one section in the parent resource accepts it. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
- the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route, the
- Route MUST be considered detached from the Gateway.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- required:
- - name
- type: object
- maxItems: 32
- type: array
- x-kubernetes-validations:
- - message: sectionName or port must be specified when parentRefs includes
- 2 or more references to the same parent
- rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind
- == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__)
- || p1.__namespace__ == '''') && (!has(p2.__namespace__) || p2.__namespace__
- == '''')) || (has(p1.__namespace__) && has(p2.__namespace__) &&
- p1.__namespace__ == p2.__namespace__)) ? ((!has(p1.sectionName)
- || p1.sectionName == '''') == (!has(p2.sectionName) || p2.sectionName
- == '''') && (!has(p1.port) || p1.port == 0) == (!has(p2.port)
- || p2.port == 0)): true))'
- - message: sectionName or port must be unique when parentRefs includes
- 2 or more references to the same parent
- rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind
- == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__)
- || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__
- == '')) || (has(p1.__namespace__) && has(p2.__namespace__) &&
- p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName)
- || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName
- == '')) || ( has(p1.sectionName) && has(p2.sectionName) && p1.sectionName
- == p2.sectionName)) && (((!has(p1.port) || p1.port == 0) && (!has(p2.port)
- || p2.port == 0)) || (has(p1.port) && has(p2.port) && p1.port
- == p2.port))))
- rules:
- default:
- - matches:
- - path:
- type: PathPrefix
- value: /
- description: |+
- Rules are a list of HTTP matchers, filters and actions.
-
- items:
- description: |-
- HTTPRouteRule defines semantics for matching an HTTP request based on
- conditions (matches), processing it (filters), and forwarding the request to
- an API object (backendRefs).
- properties:
- backendRefs:
- description: |-
- BackendRefs defines the backend(s) where matching requests should be
- sent.
-
- Failure behavior here depends on how many BackendRefs are specified and
- how many are invalid.
-
- If *all* entries in BackendRefs are invalid, and there are also no filters
- specified in this route rule, *all* traffic which matches this rule MUST
- receive a 500 status code.
-
- See the HTTPBackendRef definition for the rules about what makes a single
- HTTPBackendRef invalid.
-
- When a HTTPBackendRef is invalid, 500 status codes MUST be returned for
- requests that would have otherwise been routed to an invalid backend. If
- multiple backends are specified, and some are invalid, the proportion of
- requests that would otherwise have been routed to an invalid backend
- MUST receive a 500 status code.
-
- For example, if two backends are specified with equal weights, and one is
- invalid, 50 percent of traffic must receive a 500. Implementations may
- choose how that 50 percent is determined.
-
- When a HTTPBackendRef refers to a Service that has no ready endpoints,
- implementations SHOULD return a 503 for requests to that backend instead.
- If an implementation chooses to do this, all of the above rules for 500 responses
- MUST also apply for responses that return a 503.
-
- Support: Core for Kubernetes Service
-
- Support: Extended for Kubernetes ServiceImport
-
- Support: Implementation-specific for any other resource
-
- Support for weight: Core
- items:
- description: |-
- HTTPBackendRef defines how a HTTPRoute forwards a HTTP request.
-
- Note that when a namespace different than the local namespace is specified, a
- ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
-
-
- When the BackendRef points to a Kubernetes Service, implementations SHOULD
- honor the appProtocol field if it is set for the target Service Port.
-
- Implementations supporting appProtocol SHOULD recognize the Kubernetes
- Standard Application Protocols defined in KEP-3726.
-
- If a Service appProtocol isn't specified, an implementation MAY infer the
- backend protocol through its own means. Implementations MAY infer the
- protocol from the Route type referring to the backend Service.
-
- If a Route is not able to send traffic to the backend using the specified
- protocol then the backend is considered invalid. Implementations MUST set the
- "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason.
-
-
- properties:
- filters:
- description: |-
- Filters defined at this level should be executed if and only if the
- request is being forwarded to the backend defined here.
-
- Support: Implementation-specific (For broader support of filters, use the
- Filters field in HTTPRouteRule.)
- items:
- description: |-
- HTTPRouteFilter defines processing steps that must be completed during the
- request or response lifecycle. HTTPRouteFilters are meant as an extension
- point to express processing that may be done in Gateway implementations. Some
- examples include request or response modification, implementing
- authentication strategies, rate-limiting, and traffic shaping. API
- guarantee/conformance is defined based on the type of the filter.
- properties:
- extensionRef:
- description: |-
- ExtensionRef is an optional, implementation-specific extension to the
- "filter" behavior. For example, resource "myroutefilter" in group
- "networking.example.net"). ExtensionRef MUST NOT be used for core and
- extended filters.
-
- This filter can be used multiple times within the same rule.
-
- Support: Implementation-specific
- properties:
- group:
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is kind of the referent. For
- example "HTTPRoute" or "Service".
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- required:
- - group
- - kind
- - name
- type: object
- requestHeaderModifier:
- description: |-
- RequestHeaderModifier defines a schema for a filter that modifies request
- headers.
-
- Support: Core
- properties:
- add:
- description: |-
- Add adds the given header(s) (name, value) to the request
- before the action. It appends to any existing values associated
- with the header name.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- add:
- - name: "my-header"
- value: "bar,baz"
-
- Output:
- GET /foo HTTP/1.1
- my-header: foo,bar,baz
- items:
- description: HTTPHeader represents an HTTP
- Header name and value as defined by RFC
- 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP
- Header to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- remove:
- description: |-
- Remove the given header(s) from the HTTP request before the action. The
- value of Remove is a list of HTTP header names. Note that the header
- names are case-insensitive (see
- https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).
-
- Input:
- GET /foo HTTP/1.1
- my-header1: foo
- my-header2: bar
- my-header3: baz
-
- Config:
- remove: ["my-header1", "my-header3"]
-
- Output:
- GET /foo HTTP/1.1
- my-header2: bar
- items:
- type: string
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- set:
- description: |-
- Set overwrites the request with the given header (name, value)
- before the action.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- set:
- - name: "my-header"
- value: "bar"
-
- Output:
- GET /foo HTTP/1.1
- my-header: bar
- items:
- description: HTTPHeader represents an HTTP
- Header name and value as defined by RFC
- 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP
- Header to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- requestMirror:
- description: |+
- RequestMirror defines a schema for a filter that mirrors requests.
- Requests are sent to the specified destination, but responses from
- that destination are ignored.
-
- This filter can be used multiple times within the same rule. Note that
- not all implementations will be able to support mirroring to multiple
- backends.
-
- Support: Extended
-
- properties:
- backendRef:
- description: |-
- BackendRef references a resource where mirrored requests are sent.
-
- Mirrored requests must be sent only to a single destination endpoint
- within this BackendRef, irrespective of how many endpoints are present
- within this BackendRef.
-
- If the referent cannot be found, this BackendRef is invalid and must be
- dropped from the Gateway. The controller must ensure the "ResolvedRefs"
- condition on the Route status is set to `status: False` and not configure
- this backend in the underlying implementation.
-
- If there is a cross-namespace reference to an *existing* object
- that is not allowed by a ReferenceGrant, the controller must ensure the
- "ResolvedRefs" condition on the Route is set to `status: False`,
- with the "RefNotPermitted" reason and not configure this backend in the
- underlying implementation.
-
- In either error case, the Message of the `ResolvedRefs` Condition
- should be used to provide more detail about the problem.
-
- Support: Extended for Kubernetes Service
-
- Support: Implementation-specific for any other resource
- properties:
- group:
- default: ""
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Service
- description: |-
- Kind is the Kubernetes resource kind of the referent. For example
- "Service".
-
- Defaults to "Service" when not specified.
-
- ExternalName services can refer to CNAME DNS records that may live
- outside of the cluster and as such are difficult to reason about in
- terms of conformance. They also may not be safe to forward to (see
- CVE-2021-25740 for more information). Implementations SHOULD NOT
- support ExternalName Services.
-
- Support: Core (Services with a type other than ExternalName)
-
- Support: Implementation-specific (Services with type ExternalName)
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the backend. When unspecified, the local
- namespace is inferred.
-
- Note that when a namespace different than the local namespace is specified,
- a ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port specifies the destination port number to use for this resource.
- Port is required when the referent is a Kubernetes Service. In this
- case, the port number is the service port number, not the target port.
- For other resources, destination port might be derived from the referent
- resource or this field.
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- required:
- - name
- type: object
- x-kubernetes-validations:
- - message: Must have port for Service reference
- rule: '(size(self.group) == 0 && self.kind
- == ''Service'') ? has(self.port) : true'
- fraction:
- description: |+
- Fraction represents the fraction of requests that should be
- mirrored to BackendRef.
-
- Only one of Fraction or Percent may be specified. If neither field
- is specified, 100% of requests will be mirrored.
-
- properties:
- denominator:
- default: 100
- format: int32
- minimum: 1
- type: integer
- numerator:
- format: int32
- minimum: 0
- type: integer
- required:
- - numerator
- type: object
- x-kubernetes-validations:
- - message: numerator must be less than or equal
- to denominator
- rule: self.numerator <= self.denominator
- percent:
- description: |+
- Percent represents the percentage of requests that should be
- mirrored to BackendRef. Its minimum value is 0 (indicating 0% of
- requests) and its maximum value is 100 (indicating 100% of requests).
-
- Only one of Fraction or Percent may be specified. If neither field
- is specified, 100% of requests will be mirrored.
-
- format: int32
- maximum: 100
- minimum: 0
- type: integer
- required:
- - backendRef
- type: object
- x-kubernetes-validations:
- - message: Only one of percent or fraction may be
- specified in HTTPRequestMirrorFilter
- rule: '!(has(self.percent) && has(self.fraction))'
- requestRedirect:
- description: |-
- RequestRedirect defines a schema for a filter that responds to the
- request with an HTTP redirection.
-
- Support: Core
- properties:
- hostname:
- description: |-
- Hostname is the hostname to be used in the value of the `Location`
- header in the response.
- When empty, the hostname in the `Host` header of the request is used.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- path:
- description: |-
- Path defines parameters used to modify the path of the incoming request.
- The modified path is then used to construct the `Location` header. When
- empty, the request path is used as-is.
-
- Support: Extended
- properties:
- replaceFullPath:
- description: |-
- ReplaceFullPath specifies the value with which to replace the full path
- of a request during a rewrite or redirect.
- maxLength: 1024
- type: string
- replacePrefixMatch:
- description: |-
- ReplacePrefixMatch specifies the value with which to replace the prefix
- match of a request during a rewrite or redirect. For example, a request
- to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch
- of "/xyz" would be modified to "/xyz/bar".
-
- Note that this matches the behavior of the PathPrefix match type. This
- matches full path elements. A path element refers to the list of labels
- in the path split by the `/` separator. When specified, a trailing `/` is
- ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all
- match the prefix `/abc`, but the path `/abcd` would not.
-
- ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.
- Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in
- the implementation setting the Accepted Condition for the Route to `status: False`.
-
- Request Path | Prefix Match | Replace Prefix | Modified Path
- maxLength: 1024
- type: string
- type:
- description: |-
- Type defines the type of path modifier. Additional types may be
- added in a future release of the API.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
- enum:
- - ReplaceFullPath
- - ReplacePrefixMatch
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: replaceFullPath must be specified
- when type is set to 'ReplaceFullPath'
- rule: 'self.type == ''ReplaceFullPath'' ?
- has(self.replaceFullPath) : true'
- - message: type must be 'ReplaceFullPath' when
- replaceFullPath is set
- rule: 'has(self.replaceFullPath) ? self.type
- == ''ReplaceFullPath'' : true'
- - message: replacePrefixMatch must be specified
- when type is set to 'ReplacePrefixMatch'
- rule: 'self.type == ''ReplacePrefixMatch''
- ? has(self.replacePrefixMatch) : true'
- - message: type must be 'ReplacePrefixMatch'
- when replacePrefixMatch is set
- rule: 'has(self.replacePrefixMatch) ? self.type
- == ''ReplacePrefixMatch'' : true'
- port:
- description: |-
- Port is the port to be used in the value of the `Location`
- header in the response.
-
- If no port is specified, the redirect port MUST be derived using the
- following rules:
-
- * If redirect scheme is not-empty, the redirect port MUST be the well-known
- port associated with the redirect scheme. Specifically "http" to port 80
- and "https" to port 443. If the redirect scheme does not have a
- well-known port, the listener port of the Gateway SHOULD be used.
- * If redirect scheme is empty, the redirect port MUST be the Gateway
- Listener port.
-
- Implementations SHOULD NOT add the port number in the 'Location'
- header in the following cases:
-
- * A Location header that will use HTTP (whether that is determined via
- the Listener protocol or the Scheme field) _and_ use port 80.
- * A Location header that will use HTTPS (whether that is determined via
- the Listener protocol or the Scheme field) _and_ use port 443.
-
- Support: Extended
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- scheme:
- description: |-
- Scheme is the scheme to be used in the value of the `Location` header in
- the response. When empty, the scheme of the request is used.
-
- Scheme redirects can affect the port of the redirect, for more information,
- refer to the documentation for the port field of this filter.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
-
- Support: Extended
- enum:
- - http
- - https
- type: string
- statusCode:
- default: 302
- description: |-
- StatusCode is the HTTP status code to be used in response.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
-
- Support: Core
- enum:
- - 301
- - 302
- type: integer
- type: object
- responseHeaderModifier:
- description: |-
- ResponseHeaderModifier defines a schema for a filter that modifies response
- headers.
-
- Support: Extended
- properties:
- add:
- description: |-
- Add adds the given header(s) (name, value) to the request
- before the action. It appends to any existing values associated
- with the header name.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- add:
- - name: "my-header"
- value: "bar,baz"
-
- Output:
- GET /foo HTTP/1.1
- my-header: foo,bar,baz
- items:
- description: HTTPHeader represents an HTTP
- Header name and value as defined by RFC
- 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP
- Header to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- remove:
- description: |-
- Remove the given header(s) from the HTTP request before the action. The
- value of Remove is a list of HTTP header names. Note that the header
- names are case-insensitive (see
- https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).
-
- Input:
- GET /foo HTTP/1.1
- my-header1: foo
- my-header2: bar
- my-header3: baz
-
- Config:
- remove: ["my-header1", "my-header3"]
-
- Output:
- GET /foo HTTP/1.1
- my-header2: bar
- items:
- type: string
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- set:
- description: |-
- Set overwrites the request with the given header (name, value)
- before the action.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- set:
- - name: "my-header"
- value: "bar"
-
- Output:
- GET /foo HTTP/1.1
- my-header: bar
- items:
- description: HTTPHeader represents an HTTP
- Header name and value as defined by RFC
- 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP
- Header to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- type:
- description: |-
- Type identifies the type of filter to apply. As with other API fields,
- types are classified into three conformance levels:
-
- - Core: Filter types and their corresponding configuration defined by
- "Support: Core" in this package, e.g. "RequestHeaderModifier". All
- implementations must support core filters.
-
- - Extended: Filter types and their corresponding configuration defined by
- "Support: Extended" in this package, e.g. "RequestMirror". Implementers
- are encouraged to support extended filters.
-
- - Implementation-specific: Filters that are defined and supported by
- specific vendors.
- In the future, filters showing convergence in behavior across multiple
- implementations will be considered for inclusion in extended or core
- conformance levels. Filter-specific configuration for such filters
- is specified using the ExtensionRef field. `Type` should be set to
- "ExtensionRef" for custom filters.
-
- Implementers are encouraged to define custom implementation types to
- extend the core API with implementation-specific behavior.
-
- If a reference to a custom filter type cannot be resolved, the filter
- MUST NOT be skipped. Instead, requests that would have been processed by
- that filter MUST receive a HTTP error response.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
- enum:
- - RequestHeaderModifier
- - ResponseHeaderModifier
- - RequestMirror
- - RequestRedirect
- - URLRewrite
- - ExtensionRef
- type: string
- urlRewrite:
- description: |-
- URLRewrite defines a schema for a filter that modifies a request during forwarding.
-
- Support: Extended
- properties:
- hostname:
- description: |-
- Hostname is the value to be used to replace the Host header value during
- forwarding.
-
- Support: Extended
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- path:
- description: |-
- Path defines a path rewrite.
-
- Support: Extended
- properties:
- replaceFullPath:
- description: |-
- ReplaceFullPath specifies the value with which to replace the full path
- of a request during a rewrite or redirect.
- maxLength: 1024
- type: string
- replacePrefixMatch:
- description: |-
- ReplacePrefixMatch specifies the value with which to replace the prefix
- match of a request during a rewrite or redirect. For example, a request
- to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch
- of "/xyz" would be modified to "/xyz/bar".
-
- Note that this matches the behavior of the PathPrefix match type. This
- matches full path elements. A path element refers to the list of labels
- in the path split by the `/` separator. When specified, a trailing `/` is
- ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all
- match the prefix `/abc`, but the path `/abcd` would not.
-
- ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.
- Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in
- the implementation setting the Accepted Condition for the Route to `status: False`.
-
- Request Path | Prefix Match | Replace Prefix | Modified Path
- maxLength: 1024
- type: string
- type:
- description: |-
- Type defines the type of path modifier. Additional types may be
- added in a future release of the API.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
- enum:
- - ReplaceFullPath
- - ReplacePrefixMatch
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: replaceFullPath must be specified
- when type is set to 'ReplaceFullPath'
- rule: 'self.type == ''ReplaceFullPath'' ?
- has(self.replaceFullPath) : true'
- - message: type must be 'ReplaceFullPath' when
- replaceFullPath is set
- rule: 'has(self.replaceFullPath) ? self.type
- == ''ReplaceFullPath'' : true'
- - message: replacePrefixMatch must be specified
- when type is set to 'ReplacePrefixMatch'
- rule: 'self.type == ''ReplacePrefixMatch''
- ? has(self.replacePrefixMatch) : true'
- - message: type must be 'ReplacePrefixMatch'
- when replacePrefixMatch is set
- rule: 'has(self.replacePrefixMatch) ? self.type
- == ''ReplacePrefixMatch'' : true'
- type: object
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: filter.requestHeaderModifier must be nil
- if the filter.type is not RequestHeaderModifier
- rule: '!(has(self.requestHeaderModifier) && self.type
- != ''RequestHeaderModifier'')'
- - message: filter.requestHeaderModifier must be specified
- for RequestHeaderModifier filter.type
- rule: '!(!has(self.requestHeaderModifier) && self.type
- == ''RequestHeaderModifier'')'
- - message: filter.responseHeaderModifier must be nil
- if the filter.type is not ResponseHeaderModifier
- rule: '!(has(self.responseHeaderModifier) && self.type
- != ''ResponseHeaderModifier'')'
- - message: filter.responseHeaderModifier must be specified
- for ResponseHeaderModifier filter.type
- rule: '!(!has(self.responseHeaderModifier) && self.type
- == ''ResponseHeaderModifier'')'
- - message: filter.requestMirror must be nil if the filter.type
- is not RequestMirror
- rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')'
- - message: filter.requestMirror must be specified for
- RequestMirror filter.type
- rule: '!(!has(self.requestMirror) && self.type ==
- ''RequestMirror'')'
- - message: filter.requestRedirect must be nil if the
- filter.type is not RequestRedirect
- rule: '!(has(self.requestRedirect) && self.type !=
- ''RequestRedirect'')'
- - message: filter.requestRedirect must be specified
- for RequestRedirect filter.type
- rule: '!(!has(self.requestRedirect) && self.type ==
- ''RequestRedirect'')'
- - message: filter.urlRewrite must be nil if the filter.type
- is not URLRewrite
- rule: '!(has(self.urlRewrite) && self.type != ''URLRewrite'')'
- - message: filter.urlRewrite must be specified for URLRewrite
- filter.type
- rule: '!(!has(self.urlRewrite) && self.type == ''URLRewrite'')'
- - message: filter.extensionRef must be nil if the filter.type
- is not ExtensionRef
- rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')'
- - message: filter.extensionRef must be specified for
- ExtensionRef filter.type
- rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')'
- maxItems: 16
- type: array
- x-kubernetes-validations:
- - message: May specify either httpRouteFilterRequestRedirect
- or httpRouteFilterRequestRewrite, but not both
- rule: '!(self.exists(f, f.type == ''RequestRedirect'')
- && self.exists(f, f.type == ''URLRewrite''))'
- - message: May specify either httpRouteFilterRequestRedirect
- or httpRouteFilterRequestRewrite, but not both
- rule: '!(self.exists(f, f.type == ''RequestRedirect'')
- && self.exists(f, f.type == ''URLRewrite''))'
- - message: RequestHeaderModifier filter cannot be repeated
- rule: self.filter(f, f.type == 'RequestHeaderModifier').size()
- <= 1
- - message: ResponseHeaderModifier filter cannot be repeated
- rule: self.filter(f, f.type == 'ResponseHeaderModifier').size()
- <= 1
- - message: RequestRedirect filter cannot be repeated
- rule: self.filter(f, f.type == 'RequestRedirect').size()
- <= 1
- - message: URLRewrite filter cannot be repeated
- rule: self.filter(f, f.type == 'URLRewrite').size()
- <= 1
- group:
- default: ""
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Service
- description: |-
- Kind is the Kubernetes resource kind of the referent. For example
- "Service".
-
- Defaults to "Service" when not specified.
-
- ExternalName services can refer to CNAME DNS records that may live
- outside of the cluster and as such are difficult to reason about in
- terms of conformance. They also may not be safe to forward to (see
- CVE-2021-25740 for more information). Implementations SHOULD NOT
- support ExternalName Services.
-
- Support: Core (Services with a type other than ExternalName)
-
- Support: Implementation-specific (Services with type ExternalName)
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the backend. When unspecified, the local
- namespace is inferred.
-
- Note that when a namespace different than the local namespace is specified,
- a ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port specifies the destination port number to use for this resource.
- Port is required when the referent is a Kubernetes Service. In this
- case, the port number is the service port number, not the target port.
- For other resources, destination port might be derived from the referent
- resource or this field.
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- weight:
- default: 1
- description: |-
- Weight specifies the proportion of requests forwarded to the referenced
- backend. This is computed as weight/(sum of all weights in this
- BackendRefs list). For non-zero values, there may be some epsilon from
- the exact proportion defined here depending on the precision an
- implementation supports. Weight is not a percentage and the sum of
- weights does not need to equal 100.
-
- If only one backend is specified and it has a weight greater than 0, 100%
- of the traffic is forwarded to that backend. If weight is set to 0, no
- traffic should be forwarded for this entry. If unspecified, weight
- defaults to 1.
-
- Support for this field varies based on the context where used.
- format: int32
- maximum: 1000000
- minimum: 0
- type: integer
- required:
- - name
- type: object
- x-kubernetes-validations:
- - message: Must have port for Service reference
- rule: '(size(self.group) == 0 && self.kind == ''Service'')
- ? has(self.port) : true'
- maxItems: 16
- type: array
- filters:
- description: |-
- Filters define the filters that are applied to requests that match
- this rule.
-
- Wherever possible, implementations SHOULD implement filters in the order
- they are specified.
-
- Implementations MAY choose to implement this ordering strictly, rejecting
- any combination or order of filters that can not be supported. If implementations
- choose a strict interpretation of filter ordering, they MUST clearly document
- that behavior.
-
- To reject an invalid combination or order of filters, implementations SHOULD
- consider the Route Rules with this configuration invalid. If all Route Rules
- in a Route are invalid, the entire Route would be considered invalid. If only
- a portion of Route Rules are invalid, implementations MUST set the
- "PartiallyInvalid" condition for the Route.
-
- Conformance-levels at this level are defined based on the type of filter:
-
- - ALL core filters MUST be supported by all implementations.
- - Implementers are encouraged to support extended filters.
- - Implementation-specific custom filters have no API guarantees across
- implementations.
-
- Specifying the same filter multiple times is not supported unless explicitly
- indicated in the filter.
-
- All filters are expected to be compatible with each other except for the
- URLRewrite and RequestRedirect filters, which may not be combined. If an
- implementation can not support other combinations of filters, they must clearly
- document that limitation. In cases where incompatible or unsupported
- filters are specified and cause the `Accepted` condition to be set to status
- `False`, implementations may use the `IncompatibleFilters` reason to specify
- this configuration error.
-
- Support: Core
- items:
- description: |-
- HTTPRouteFilter defines processing steps that must be completed during the
- request or response lifecycle. HTTPRouteFilters are meant as an extension
- point to express processing that may be done in Gateway implementations. Some
- examples include request or response modification, implementing
- authentication strategies, rate-limiting, and traffic shaping. API
- guarantee/conformance is defined based on the type of the filter.
- properties:
- extensionRef:
- description: |-
- ExtensionRef is an optional, implementation-specific extension to the
- "filter" behavior. For example, resource "myroutefilter" in group
- "networking.example.net"). ExtensionRef MUST NOT be used for core and
- extended filters.
-
- This filter can be used multiple times within the same rule.
-
- Support: Implementation-specific
- properties:
- group:
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is kind of the referent. For example
- "HTTPRoute" or "Service".
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- required:
- - group
- - kind
- - name
- type: object
- requestHeaderModifier:
- description: |-
- RequestHeaderModifier defines a schema for a filter that modifies request
- headers.
-
- Support: Core
- properties:
- add:
- description: |-
- Add adds the given header(s) (name, value) to the request
- before the action. It appends to any existing values associated
- with the header name.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- add:
- - name: "my-header"
- value: "bar,baz"
-
- Output:
- GET /foo HTTP/1.1
- my-header: foo,bar,baz
- items:
- description: HTTPHeader represents an HTTP Header
- name and value as defined by RFC 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP Header
- to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- remove:
- description: |-
- Remove the given header(s) from the HTTP request before the action. The
- value of Remove is a list of HTTP header names. Note that the header
- names are case-insensitive (see
- https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).
-
- Input:
- GET /foo HTTP/1.1
- my-header1: foo
- my-header2: bar
- my-header3: baz
-
- Config:
- remove: ["my-header1", "my-header3"]
-
- Output:
- GET /foo HTTP/1.1
- my-header2: bar
- items:
- type: string
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- set:
- description: |-
- Set overwrites the request with the given header (name, value)
- before the action.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- set:
- - name: "my-header"
- value: "bar"
-
- Output:
- GET /foo HTTP/1.1
- my-header: bar
- items:
- description: HTTPHeader represents an HTTP Header
- name and value as defined by RFC 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP Header
- to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- requestMirror:
- description: |+
- RequestMirror defines a schema for a filter that mirrors requests.
- Requests are sent to the specified destination, but responses from
- that destination are ignored.
-
- This filter can be used multiple times within the same rule. Note that
- not all implementations will be able to support mirroring to multiple
- backends.
-
- Support: Extended
-
- properties:
- backendRef:
- description: |-
- BackendRef references a resource where mirrored requests are sent.
-
- Mirrored requests must be sent only to a single destination endpoint
- within this BackendRef, irrespective of how many endpoints are present
- within this BackendRef.
-
- If the referent cannot be found, this BackendRef is invalid and must be
- dropped from the Gateway. The controller must ensure the "ResolvedRefs"
- condition on the Route status is set to `status: False` and not configure
- this backend in the underlying implementation.
-
- If there is a cross-namespace reference to an *existing* object
- that is not allowed by a ReferenceGrant, the controller must ensure the
- "ResolvedRefs" condition on the Route is set to `status: False`,
- with the "RefNotPermitted" reason and not configure this backend in the
- underlying implementation.
-
- In either error case, the Message of the `ResolvedRefs` Condition
- should be used to provide more detail about the problem.
-
- Support: Extended for Kubernetes Service
-
- Support: Implementation-specific for any other resource
- properties:
- group:
- default: ""
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Service
- description: |-
- Kind is the Kubernetes resource kind of the referent. For example
- "Service".
-
- Defaults to "Service" when not specified.
-
- ExternalName services can refer to CNAME DNS records that may live
- outside of the cluster and as such are difficult to reason about in
- terms of conformance. They also may not be safe to forward to (see
- CVE-2021-25740 for more information). Implementations SHOULD NOT
- support ExternalName Services.
-
- Support: Core (Services with a type other than ExternalName)
-
- Support: Implementation-specific (Services with type ExternalName)
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the backend. When unspecified, the local
- namespace is inferred.
-
- Note that when a namespace different than the local namespace is specified,
- a ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port specifies the destination port number to use for this resource.
- Port is required when the referent is a Kubernetes Service. In this
- case, the port number is the service port number, not the target port.
- For other resources, destination port might be derived from the referent
- resource or this field.
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- required:
- - name
- type: object
- x-kubernetes-validations:
- - message: Must have port for Service reference
- rule: '(size(self.group) == 0 && self.kind == ''Service'')
- ? has(self.port) : true'
- fraction:
- description: |+
- Fraction represents the fraction of requests that should be
- mirrored to BackendRef.
-
- Only one of Fraction or Percent may be specified. If neither field
- is specified, 100% of requests will be mirrored.
-
- properties:
- denominator:
- default: 100
- format: int32
- minimum: 1
- type: integer
- numerator:
- format: int32
- minimum: 0
- type: integer
- required:
- - numerator
- type: object
- x-kubernetes-validations:
- - message: numerator must be less than or equal to
- denominator
- rule: self.numerator <= self.denominator
- percent:
- description: |+
- Percent represents the percentage of requests that should be
- mirrored to BackendRef. Its minimum value is 0 (indicating 0% of
- requests) and its maximum value is 100 (indicating 100% of requests).
-
- Only one of Fraction or Percent may be specified. If neither field
- is specified, 100% of requests will be mirrored.
-
- format: int32
- maximum: 100
- minimum: 0
- type: integer
- required:
- - backendRef
- type: object
- x-kubernetes-validations:
- - message: Only one of percent or fraction may be specified
- in HTTPRequestMirrorFilter
- rule: '!(has(self.percent) && has(self.fraction))'
- requestRedirect:
- description: |-
- RequestRedirect defines a schema for a filter that responds to the
- request with an HTTP redirection.
-
- Support: Core
- properties:
- hostname:
- description: |-
- Hostname is the hostname to be used in the value of the `Location`
- header in the response.
- When empty, the hostname in the `Host` header of the request is used.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- path:
- description: |-
- Path defines parameters used to modify the path of the incoming request.
- The modified path is then used to construct the `Location` header. When
- empty, the request path is used as-is.
-
- Support: Extended
- properties:
- replaceFullPath:
- description: |-
- ReplaceFullPath specifies the value with which to replace the full path
- of a request during a rewrite or redirect.
- maxLength: 1024
- type: string
- replacePrefixMatch:
- description: |-
- ReplacePrefixMatch specifies the value with which to replace the prefix
- match of a request during a rewrite or redirect. For example, a request
- to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch
- of "/xyz" would be modified to "/xyz/bar".
-
- Note that this matches the behavior of the PathPrefix match type. This
- matches full path elements. A path element refers to the list of labels
- in the path split by the `/` separator. When specified, a trailing `/` is
- ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all
- match the prefix `/abc`, but the path `/abcd` would not.
-
- ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.
- Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in
- the implementation setting the Accepted Condition for the Route to `status: False`.
-
- Request Path | Prefix Match | Replace Prefix | Modified Path
- maxLength: 1024
- type: string
- type:
- description: |-
- Type defines the type of path modifier. Additional types may be
- added in a future release of the API.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
- enum:
- - ReplaceFullPath
- - ReplacePrefixMatch
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: replaceFullPath must be specified when
- type is set to 'ReplaceFullPath'
- rule: 'self.type == ''ReplaceFullPath'' ? has(self.replaceFullPath)
- : true'
- - message: type must be 'ReplaceFullPath' when replaceFullPath
- is set
- rule: 'has(self.replaceFullPath) ? self.type ==
- ''ReplaceFullPath'' : true'
- - message: replacePrefixMatch must be specified when
- type is set to 'ReplacePrefixMatch'
- rule: 'self.type == ''ReplacePrefixMatch'' ? has(self.replacePrefixMatch)
- : true'
- - message: type must be 'ReplacePrefixMatch' when
- replacePrefixMatch is set
- rule: 'has(self.replacePrefixMatch) ? self.type
- == ''ReplacePrefixMatch'' : true'
- port:
- description: |-
- Port is the port to be used in the value of the `Location`
- header in the response.
-
- If no port is specified, the redirect port MUST be derived using the
- following rules:
-
- * If redirect scheme is not-empty, the redirect port MUST be the well-known
- port associated with the redirect scheme. Specifically "http" to port 80
- and "https" to port 443. If the redirect scheme does not have a
- well-known port, the listener port of the Gateway SHOULD be used.
- * If redirect scheme is empty, the redirect port MUST be the Gateway
- Listener port.
-
- Implementations SHOULD NOT add the port number in the 'Location'
- header in the following cases:
-
- * A Location header that will use HTTP (whether that is determined via
- the Listener protocol or the Scheme field) _and_ use port 80.
- * A Location header that will use HTTPS (whether that is determined via
- the Listener protocol or the Scheme field) _and_ use port 443.
-
- Support: Extended
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- scheme:
- description: |-
- Scheme is the scheme to be used in the value of the `Location` header in
- the response. When empty, the scheme of the request is used.
-
- Scheme redirects can affect the port of the redirect, for more information,
- refer to the documentation for the port field of this filter.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
-
- Support: Extended
- enum:
- - http
- - https
- type: string
- statusCode:
- default: 302
- description: |-
- StatusCode is the HTTP status code to be used in response.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
-
- Support: Core
- enum:
- - 301
- - 302
- type: integer
- type: object
- responseHeaderModifier:
- description: |-
- ResponseHeaderModifier defines a schema for a filter that modifies response
- headers.
-
- Support: Extended
- properties:
- add:
- description: |-
- Add adds the given header(s) (name, value) to the request
- before the action. It appends to any existing values associated
- with the header name.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- add:
- - name: "my-header"
- value: "bar,baz"
-
- Output:
- GET /foo HTTP/1.1
- my-header: foo,bar,baz
- items:
- description: HTTPHeader represents an HTTP Header
- name and value as defined by RFC 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP Header
- to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- remove:
- description: |-
- Remove the given header(s) from the HTTP request before the action. The
- value of Remove is a list of HTTP header names. Note that the header
- names are case-insensitive (see
- https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).
-
- Input:
- GET /foo HTTP/1.1
- my-header1: foo
- my-header2: bar
- my-header3: baz
-
- Config:
- remove: ["my-header1", "my-header3"]
-
- Output:
- GET /foo HTTP/1.1
- my-header2: bar
- items:
- type: string
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- set:
- description: |-
- Set overwrites the request with the given header (name, value)
- before the action.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- set:
- - name: "my-header"
- value: "bar"
-
- Output:
- GET /foo HTTP/1.1
- my-header: bar
- items:
- description: HTTPHeader represents an HTTP Header
- name and value as defined by RFC 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP Header
- to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- type:
- description: |-
- Type identifies the type of filter to apply. As with other API fields,
- types are classified into three conformance levels:
-
- - Core: Filter types and their corresponding configuration defined by
- "Support: Core" in this package, e.g. "RequestHeaderModifier". All
- implementations must support core filters.
-
- - Extended: Filter types and their corresponding configuration defined by
- "Support: Extended" in this package, e.g. "RequestMirror". Implementers
- are encouraged to support extended filters.
-
- - Implementation-specific: Filters that are defined and supported by
- specific vendors.
- In the future, filters showing convergence in behavior across multiple
- implementations will be considered for inclusion in extended or core
- conformance levels. Filter-specific configuration for such filters
- is specified using the ExtensionRef field. `Type` should be set to
- "ExtensionRef" for custom filters.
-
- Implementers are encouraged to define custom implementation types to
- extend the core API with implementation-specific behavior.
-
- If a reference to a custom filter type cannot be resolved, the filter
- MUST NOT be skipped. Instead, requests that would have been processed by
- that filter MUST receive a HTTP error response.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
- enum:
- - RequestHeaderModifier
- - ResponseHeaderModifier
- - RequestMirror
- - RequestRedirect
- - URLRewrite
- - ExtensionRef
- type: string
- urlRewrite:
- description: |-
- URLRewrite defines a schema for a filter that modifies a request during forwarding.
-
- Support: Extended
- properties:
- hostname:
- description: |-
- Hostname is the value to be used to replace the Host header value during
- forwarding.
-
- Support: Extended
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- path:
- description: |-
- Path defines a path rewrite.
-
- Support: Extended
- properties:
- replaceFullPath:
- description: |-
- ReplaceFullPath specifies the value with which to replace the full path
- of a request during a rewrite or redirect.
- maxLength: 1024
- type: string
- replacePrefixMatch:
- description: |-
- ReplacePrefixMatch specifies the value with which to replace the prefix
- match of a request during a rewrite or redirect. For example, a request
- to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch
- of "/xyz" would be modified to "/xyz/bar".
-
- Note that this matches the behavior of the PathPrefix match type. This
- matches full path elements. A path element refers to the list of labels
- in the path split by the `/` separator. When specified, a trailing `/` is
- ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all
- match the prefix `/abc`, but the path `/abcd` would not.
-
- ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.
- Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in
- the implementation setting the Accepted Condition for the Route to `status: False`.
-
- Request Path | Prefix Match | Replace Prefix | Modified Path
- maxLength: 1024
- type: string
- type:
- description: |-
- Type defines the type of path modifier. Additional types may be
- added in a future release of the API.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
- enum:
- - ReplaceFullPath
- - ReplacePrefixMatch
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: replaceFullPath must be specified when
- type is set to 'ReplaceFullPath'
- rule: 'self.type == ''ReplaceFullPath'' ? has(self.replaceFullPath)
- : true'
- - message: type must be 'ReplaceFullPath' when replaceFullPath
- is set
- rule: 'has(self.replaceFullPath) ? self.type ==
- ''ReplaceFullPath'' : true'
- - message: replacePrefixMatch must be specified when
- type is set to 'ReplacePrefixMatch'
- rule: 'self.type == ''ReplacePrefixMatch'' ? has(self.replacePrefixMatch)
- : true'
- - message: type must be 'ReplacePrefixMatch' when
- replacePrefixMatch is set
- rule: 'has(self.replacePrefixMatch) ? self.type
- == ''ReplacePrefixMatch'' : true'
- type: object
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: filter.requestHeaderModifier must be nil if the
- filter.type is not RequestHeaderModifier
- rule: '!(has(self.requestHeaderModifier) && self.type !=
- ''RequestHeaderModifier'')'
- - message: filter.requestHeaderModifier must be specified
- for RequestHeaderModifier filter.type
- rule: '!(!has(self.requestHeaderModifier) && self.type ==
- ''RequestHeaderModifier'')'
- - message: filter.responseHeaderModifier must be nil if the
- filter.type is not ResponseHeaderModifier
- rule: '!(has(self.responseHeaderModifier) && self.type !=
- ''ResponseHeaderModifier'')'
- - message: filter.responseHeaderModifier must be specified
- for ResponseHeaderModifier filter.type
- rule: '!(!has(self.responseHeaderModifier) && self.type
- == ''ResponseHeaderModifier'')'
- - message: filter.requestMirror must be nil if the filter.type
- is not RequestMirror
- rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')'
- - message: filter.requestMirror must be specified for RequestMirror
- filter.type
- rule: '!(!has(self.requestMirror) && self.type == ''RequestMirror'')'
- - message: filter.requestRedirect must be nil if the filter.type
- is not RequestRedirect
- rule: '!(has(self.requestRedirect) && self.type != ''RequestRedirect'')'
- - message: filter.requestRedirect must be specified for RequestRedirect
- filter.type
- rule: '!(!has(self.requestRedirect) && self.type == ''RequestRedirect'')'
- - message: filter.urlRewrite must be nil if the filter.type
- is not URLRewrite
- rule: '!(has(self.urlRewrite) && self.type != ''URLRewrite'')'
- - message: filter.urlRewrite must be specified for URLRewrite
- filter.type
- rule: '!(!has(self.urlRewrite) && self.type == ''URLRewrite'')'
- - message: filter.extensionRef must be nil if the filter.type
- is not ExtensionRef
- rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')'
- - message: filter.extensionRef must be specified for ExtensionRef
- filter.type
- rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')'
- maxItems: 16
- type: array
- x-kubernetes-validations:
- - message: May specify either httpRouteFilterRequestRedirect
- or httpRouteFilterRequestRewrite, but not both
- rule: '!(self.exists(f, f.type == ''RequestRedirect'') &&
- self.exists(f, f.type == ''URLRewrite''))'
- - message: RequestHeaderModifier filter cannot be repeated
- rule: self.filter(f, f.type == 'RequestHeaderModifier').size()
- <= 1
- - message: ResponseHeaderModifier filter cannot be repeated
- rule: self.filter(f, f.type == 'ResponseHeaderModifier').size()
- <= 1
- - message: RequestRedirect filter cannot be repeated
- rule: self.filter(f, f.type == 'RequestRedirect').size() <=
- 1
- - message: URLRewrite filter cannot be repeated
- rule: self.filter(f, f.type == 'URLRewrite').size() <= 1
- matches:
- default:
- - path:
- type: PathPrefix
- value: /
- description: |-
- Matches define conditions used for matching the rule against incoming
- HTTP requests. Each match is independent, i.e. this rule will be matched
- if **any** one of the matches is satisfied.
-
- For example, take the following matches configuration:
-
- ```
- matches:
- - path:
- value: "/foo"
- headers:
- - name: "version"
- value: "v2"
- - path:
- value: "/v2/foo"
- ```
-
- For a request to match against this rule, a request must satisfy
- EITHER of the two conditions:
-
- - path prefixed with `/foo` AND contains the header `version: v2`
- - path prefix of `/v2/foo`
-
- See the documentation for HTTPRouteMatch on how to specify multiple
- match conditions that should be ANDed together.
-
- If no matches are specified, the default is a prefix
- path match on "/", which has the effect of matching every
- HTTP request.
-
- Proxy or Load Balancer routing configuration generated from HTTPRoutes
- MUST prioritize matches based on the following criteria, continuing on
- ties. Across all rules specified on applicable Routes, precedence must be
- given to the match having:
-
- * "Exact" path match.
- * "Prefix" path match with largest number of characters.
- * Method match.
- * Largest number of header matches.
- * Largest number of query param matches.
-
- Note: The precedence of RegularExpression path matches are implementation-specific.
-
- If ties still exist across multiple Routes, matching precedence MUST be
- determined in order of the following criteria, continuing on ties:
-
- * The oldest Route based on creation timestamp.
- * The Route appearing first in alphabetical order by
- "{namespace}/{name}".
-
- If ties still exist within an HTTPRoute, matching precedence MUST be granted
- to the FIRST matching rule (in list order) with a match meeting the above
- criteria.
-
- When no rules matching a request have been successfully attached to the
- parent a request is coming from, a HTTP 404 status code MUST be returned.
- items:
- description: "HTTPRouteMatch defines the predicate used to
- match requests to a given\naction. Multiple match types
- are ANDed together, i.e. the match will\nevaluate to true
- only if all conditions are satisfied.\n\nFor example, the
- match below will match a HTTP request only if its path\nstarts
- with `/foo` AND it contains the `version: v1` header:\n\n```\nmatch:\n\n\tpath:\n\t
- \ value: \"/foo\"\n\theaders:\n\t- name: \"version\"\n\t
- \ value \"v1\"\n\n```"
- properties:
- headers:
- description: |-
- Headers specifies HTTP request header matchers. Multiple match values are
- ANDed together, meaning, a request must match all the specified headers
- to select the route.
- items:
- description: |-
- HTTPHeaderMatch describes how to select a HTTP route by matching HTTP request
- headers.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, only the first
- entry with an equivalent name MUST be considered for a match. Subsequent
- entries with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
-
- When a header is repeated in an HTTP request, it is
- implementation-specific behavior as to how this is represented.
- Generally, proxies should follow the guidance from the RFC:
- https://www.rfc-editor.org/rfc/rfc7230.html#section-3.2.2 regarding
- processing a repeated header, with special handling for "Set-Cookie".
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- type:
- default: Exact
- description: |-
- Type specifies how to match against the value of the header.
-
- Support: Core (Exact)
-
- Support: Implementation-specific (RegularExpression)
-
- Since RegularExpression HeaderMatchType has implementation-specific
- conformance, implementations can support POSIX, PCRE or any other dialects
- of regular expressions. Please read the implementation's documentation to
- determine the supported dialect.
- enum:
- - Exact
- - RegularExpression
- type: string
- value:
- description: Value is the value of HTTP Header to
- be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- method:
- description: |-
- Method specifies HTTP method matcher.
- When specified, this route will be matched only if the request has the
- specified method.
-
- Support: Extended
- enum:
- - GET
- - HEAD
- - POST
- - PUT
- - DELETE
- - CONNECT
- - OPTIONS
- - TRACE
- - PATCH
- type: string
- path:
- default:
- type: PathPrefix
- value: /
- description: |-
- Path specifies a HTTP request path matcher. If this field is not
- specified, a default prefix match on the "/" path is provided.
- properties:
- type:
- default: PathPrefix
- description: |-
- Type specifies how to match against the path Value.
-
- Support: Core (Exact, PathPrefix)
-
- Support: Implementation-specific (RegularExpression)
- enum:
- - Exact
- - PathPrefix
- - RegularExpression
- type: string
- value:
- default: /
- description: Value of the HTTP path to match against.
- maxLength: 1024
- type: string
- type: object
- x-kubernetes-validations:
- - message: value must be an absolute path and start with
- '/' when type one of ['Exact', 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? self.value.startsWith(''/'')
- : true'
- - message: must not contain '//' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''//'')
- : true'
- - message: must not contain '/./' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''/./'')
- : true'
- - message: must not contain '/../' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''/../'')
- : true'
- - message: must not contain '%2f' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''%2f'')
- : true'
- - message: must not contain '%2F' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''%2F'')
- : true'
- - message: must not contain '#' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''#'')
- : true'
- - message: must not end with '/..' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.endsWith(''/..'')
- : true'
- - message: must not end with '/.' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.endsWith(''/.'')
- : true'
- - message: type must be one of ['Exact', 'PathPrefix',
- 'RegularExpression']
- rule: self.type in ['Exact','PathPrefix'] || self.type
- == 'RegularExpression'
- - message: must only contain valid characters (matching
- ^(?:[-A-Za-z0-9/._~!$&'()*+,;=:@]|[%][0-9a-fA-F]{2})+$)
- for types ['Exact', 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? self.value.matches(r"""^(?:[-A-Za-z0-9/._~!$&''()*+,;=:@]|[%][0-9a-fA-F]{2})+$""")
- : true'
- queryParams:
- description: |-
- QueryParams specifies HTTP query parameter matchers. Multiple match
- values are ANDed together, meaning, a request must match all the
- specified query parameters to select the route.
-
- Support: Extended
- items:
- description: |-
- HTTPQueryParamMatch describes how to select a HTTP route by matching HTTP
- query parameters.
- properties:
- name:
- description: |-
- Name is the name of the HTTP query param to be matched. This must be an
- exact string match. (See
- https://tools.ietf.org/html/rfc7230#section-2.7.3).
-
- If multiple entries specify equivalent query param names, only the first
- entry with an equivalent name MUST be considered for a match. Subsequent
- entries with an equivalent query param name MUST be ignored.
-
- If a query param is repeated in an HTTP request, the behavior is
- purposely left undefined, since different data planes have different
- capabilities. However, it is *recommended* that implementations should
- match against the first value of the param if the data plane supports it,
- as this behavior is expected in other load balancing contexts outside of
- the Gateway API.
-
- Users SHOULD NOT route traffic based on repeated query params to guard
- themselves against potential differences in the implementations.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- type:
- default: Exact
- description: |-
- Type specifies how to match against the value of the query parameter.
-
- Support: Extended (Exact)
-
- Support: Implementation-specific (RegularExpression)
-
- Since RegularExpression QueryParamMatchType has Implementation-specific
- conformance, implementations can support POSIX, PCRE or any other
- dialects of regular expressions. Please read the implementation's
- documentation to determine the supported dialect.
- enum:
- - Exact
- - RegularExpression
- type: string
- value:
- description: Value is the value of HTTP query param
- to be matched.
- maxLength: 1024
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- maxItems: 64
- type: array
- name:
- description: |
- Name is the name of the route rule. This name MUST be unique within a Route if it is set.
-
- Support: Extended
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- retry:
- description: |+
- Retry defines the configuration for when to retry an HTTP request.
-
- Support: Extended
-
- properties:
- attempts:
- description: |-
- Attempts specifies the maxmimum number of times an individual request
- from the gateway to a backend should be retried.
-
- If the maximum number of retries has been attempted without a successful
- response from the backend, the Gateway MUST return an error.
-
- When this field is unspecified, the number of times to attempt to retry
- a backend request is implementation-specific.
-
- Support: Extended
- type: integer
- backoff:
- description: |-
- Backoff specifies the minimum duration a Gateway should wait between
- retry attempts and is represented in Gateway API Duration formatting.
-
- For example, setting the `rules[].retry.backoff` field to the value
- `100ms` will cause a backend request to first be retried approximately
- 100 milliseconds after timing out or receiving a response code configured
- to be retryable.
-
- An implementation MAY use an exponential or alternative backoff strategy
- for subsequent retry attempts, MAY cap the maximum backoff duration to
- some amount greater than the specified minimum, and MAY add arbitrary
- jitter to stagger requests, as long as unsuccessful backend requests are
- not retried before the configured minimum duration.
-
- If a Request timeout (`rules[].timeouts.request`) is configured on the
- route, the entire duration of the initial request and any retry attempts
- MUST not exceed the Request timeout duration. If any retry attempts are
- still in progress when the Request timeout duration has been reached,
- these SHOULD be canceled if possible and the Gateway MUST immediately
- return a timeout error.
-
- If a BackendRequest timeout (`rules[].timeouts.backendRequest`) is
- configured on the route, any retry attempts which reach the configured
- BackendRequest timeout duration without a response SHOULD be canceled if
- possible and the Gateway should wait for at least the specified backoff
- duration before attempting to retry the backend request again.
-
- If a BackendRequest timeout is _not_ configured on the route, retry
- attempts MAY time out after an implementation default duration, or MAY
- remain pending until a configured Request timeout or implementation
- default duration for total request time is reached.
-
- When this field is unspecified, the time to wait between retry attempts
- is implementation-specific.
-
- Support: Extended
- pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
- type: string
- codes:
- description: |-
- Codes defines the HTTP response status codes for which a backend request
- should be retried.
-
- Support: Extended
- items:
- description: |-
- HTTPRouteRetryStatusCode defines an HTTP response status code for
- which a backend request should be retried.
-
- Implementations MUST support the following status codes as retryable:
-
- * 500
- * 502
- * 503
- * 504
-
- Implementations MAY support specifying additional discrete values in the
- 500-599 range.
-
- Implementations MAY support specifying discrete values in the 400-499 range,
- which are often inadvisable to retry.
-
-
- maximum: 599
- minimum: 400
- type: integer
- type: array
- type: object
- sessionPersistence:
- description: |+
- SessionPersistence defines and configures session persistence
- for the route rule.
-
- Support: Extended
-
- properties:
- absoluteTimeout:
- description: |-
- AbsoluteTimeout defines the absolute timeout of the persistent
- session. Once the AbsoluteTimeout duration has elapsed, the
- session becomes invalid.
-
- Support: Extended
- pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
- type: string
- cookieConfig:
- description: |-
- CookieConfig provides configuration settings that are specific
- to cookie-based session persistence.
-
- Support: Core
- properties:
- lifetimeType:
- default: Session
- description: |-
- LifetimeType specifies whether the cookie has a permanent or
- session-based lifetime. A permanent cookie persists until its
- specified expiry time, defined by the Expires or Max-Age cookie
- attributes, while a session cookie is deleted when the current
- session ends.
-
- When set to "Permanent", AbsoluteTimeout indicates the
- cookie's lifetime via the Expires or Max-Age cookie attributes
- and is required.
-
- When set to "Session", AbsoluteTimeout indicates the
- absolute lifetime of the cookie tracked by the gateway and
- is optional.
-
- Support: Core for "Session" type
-
- Support: Extended for "Permanent" type
- enum:
- - Permanent
- - Session
- type: string
- type: object
- idleTimeout:
- description: |-
- IdleTimeout defines the idle timeout of the persistent session.
- Once the session has been idle for more than the specified
- IdleTimeout duration, the session becomes invalid.
-
- Support: Extended
- pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
- type: string
- sessionName:
- description: |-
- SessionName defines the name of the persistent session token
- which may be reflected in the cookie or the header. Users
- should avoid reusing session names to prevent unintended
- consequences, such as rejection or unpredictable behavior.
-
- Support: Implementation-specific
- maxLength: 128
- type: string
- type:
- default: Cookie
- description: |-
- Type defines the type of session persistence such as through
- the use a header or cookie. Defaults to cookie based session
- persistence.
-
- Support: Core for "Cookie" type
-
- Support: Extended for "Header" type
- enum:
- - Cookie
- - Header
- type: string
- type: object
- x-kubernetes-validations:
- - message: AbsoluteTimeout must be specified when cookie lifetimeType
- is Permanent
- rule: '!has(self.cookieConfig) || !has(self.cookieConfig.lifetimeType)
- || self.cookieConfig.lifetimeType != ''Permanent'' || has(self.absoluteTimeout)'
- timeouts:
- description: |-
- Timeouts defines the timeouts that can be configured for an HTTP request.
-
- Support: Extended
- properties:
- backendRequest:
- description: |-
- BackendRequest specifies a timeout for an individual request from the gateway
- to a backend. This covers the time from when the request first starts being
- sent from the gateway to when the full response has been received from the backend.
-
- Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout
- completely. Implementations that cannot completely disable the timeout MUST
- instead interpret the zero duration as the longest possible value to which
- the timeout can be set.
-
- An entire client HTTP transaction with a gateway, covered by the Request timeout,
- may result in more than one call from the gateway to the destination backend,
- for example, if automatic retries are supported.
-
- The value of BackendRequest must be a Gateway API Duration string as defined by
- GEP-2257. When this field is unspecified, its behavior is implementation-specific;
- when specified, the value of BackendRequest must be no more than the value of the
- Request timeout (since the Request timeout encompasses the BackendRequest timeout).
-
- Support: Extended
- pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
- type: string
- request:
- description: |-
- Request specifies the maximum duration for a gateway to respond to an HTTP request.
- If the gateway has not been able to respond before this deadline is met, the gateway
- MUST return a timeout error.
-
- For example, setting the `rules.timeouts.request` field to the value `10s` in an
- `HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds
- to complete.
-
- Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout
- completely. Implementations that cannot completely disable the timeout MUST
- instead interpret the zero duration as the longest possible value to which
- the timeout can be set.
-
- This timeout is intended to cover as close to the whole request-response transaction
- as possible although an implementation MAY choose to start the timeout after the entire
- request stream has been received instead of immediately after the transaction is
- initiated by the client.
-
- The value of Request is a Gateway API Duration string as defined by GEP-2257. When this
- field is unspecified, request timeout behavior is implementation-specific.
-
- Support: Extended
- pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
- type: string
- type: object
- x-kubernetes-validations:
- - message: backendRequest timeout cannot be longer than request
- timeout
- rule: '!(has(self.request) && has(self.backendRequest) &&
- duration(self.request) != duration(''0s'') && duration(self.backendRequest)
- > duration(self.request))'
- type: object
- x-kubernetes-validations:
- - message: RequestRedirect filter must not be used together with
- backendRefs
- rule: '(has(self.backendRefs) && size(self.backendRefs) > 0) ?
- (!has(self.filters) || self.filters.all(f, !has(f.requestRedirect))):
- true'
- - message: When using RequestRedirect filter with path.replacePrefixMatch,
- exactly one PathPrefix match must be specified
- rule: '(has(self.filters) && self.filters.exists_one(f, has(f.requestRedirect)
- && has(f.requestRedirect.path) && f.requestRedirect.path.type
- == ''ReplacePrefixMatch'' && has(f.requestRedirect.path.replacePrefixMatch)))
- ? ((size(self.matches) != 1 || !has(self.matches[0].path) ||
- self.matches[0].path.type != ''PathPrefix'') ? false : true)
- : true'
- - message: When using URLRewrite filter with path.replacePrefixMatch,
- exactly one PathPrefix match must be specified
- rule: '(has(self.filters) && self.filters.exists_one(f, has(f.urlRewrite)
- && has(f.urlRewrite.path) && f.urlRewrite.path.type == ''ReplacePrefixMatch''
- && has(f.urlRewrite.path.replacePrefixMatch))) ? ((size(self.matches)
- != 1 || !has(self.matches[0].path) || self.matches[0].path.type
- != ''PathPrefix'') ? false : true) : true'
- - message: Within backendRefs, when using RequestRedirect filter
- with path.replacePrefixMatch, exactly one PathPrefix match must
- be specified
- rule: '(has(self.backendRefs) && self.backendRefs.exists_one(b,
- (has(b.filters) && b.filters.exists_one(f, has(f.requestRedirect)
- && has(f.requestRedirect.path) && f.requestRedirect.path.type
- == ''ReplacePrefixMatch'' && has(f.requestRedirect.path.replacePrefixMatch)))
- )) ? ((size(self.matches) != 1 || !has(self.matches[0].path)
- || self.matches[0].path.type != ''PathPrefix'') ? false : true)
- : true'
- - message: Within backendRefs, When using URLRewrite filter with
- path.replacePrefixMatch, exactly one PathPrefix match must be
- specified
- rule: '(has(self.backendRefs) && self.backendRefs.exists_one(b,
- (has(b.filters) && b.filters.exists_one(f, has(f.urlRewrite)
- && has(f.urlRewrite.path) && f.urlRewrite.path.type == ''ReplacePrefixMatch''
- && has(f.urlRewrite.path.replacePrefixMatch))) )) ? ((size(self.matches)
- != 1 || !has(self.matches[0].path) || self.matches[0].path.type
- != ''PathPrefix'') ? false : true) : true'
- maxItems: 16
- type: array
- x-kubernetes-validations:
- - message: While 16 rules and 64 matches per rule are allowed, the
- total number of matches across all rules in a route must be less
- than 128
- rule: '(self.size() > 0 ? self[0].matches.size() : 0) + (self.size()
- > 1 ? self[1].matches.size() : 0) + (self.size() > 2 ? self[2].matches.size()
- : 0) + (self.size() > 3 ? self[3].matches.size() : 0) + (self.size()
- > 4 ? self[4].matches.size() : 0) + (self.size() > 5 ? self[5].matches.size()
- : 0) + (self.size() > 6 ? self[6].matches.size() : 0) + (self.size()
- > 7 ? self[7].matches.size() : 0) + (self.size() > 8 ? self[8].matches.size()
- : 0) + (self.size() > 9 ? self[9].matches.size() : 0) + (self.size()
- > 10 ? self[10].matches.size() : 0) + (self.size() > 11 ? self[11].matches.size()
- : 0) + (self.size() > 12 ? self[12].matches.size() : 0) + (self.size()
- > 13 ? self[13].matches.size() : 0) + (self.size() > 14 ? self[14].matches.size()
- : 0) + (self.size() > 15 ? self[15].matches.size() : 0) <= 128'
- - message: Rule name must be unique within the route
- rule: self.all(l1, !has(l1.name) || self.exists_one(l2, has(l2.name)
- && l1.name == l2.name))
- type: object
- status:
- description: Status defines the current state of HTTPRoute.
- properties:
- parents:
- description: |-
- Parents is a list of parent resources (usually Gateways) that are
- associated with the route, and the status of the route with respect to
- each parent. When this route attaches to a parent, the controller that
- manages the parent must add an entry to this list when the controller
- first sees the route and should update the entry as appropriate when the
- route or gateway is modified.
-
- Note that parent references that cannot be resolved by an implementation
- of this API will not be added to this list. Implementations of this API
- can only populate Route status for the Gateways/parent resources they are
- responsible for.
-
- A maximum of 32 Gateways will be represented in this list. An empty list
- means the route has not been attached to any Gateway.
- items:
- description: |-
- RouteParentStatus describes the status of a route with respect to an
- associated Parent.
- properties:
- conditions:
- description: |-
- Conditions describes the status of the route with respect to the Gateway.
- Note that the route's availability is also subject to the Gateway's own
- status conditions and listener status.
-
- If the Route's ParentRef specifies an existing Gateway that supports
- Routes of this kind AND that Gateway's controller has sufficient access,
- then that Gateway's controller MUST set the "Accepted" condition on the
- Route, to indicate whether the route has been accepted or rejected by the
- Gateway, and why.
-
- A Route MUST be considered "Accepted" if at least one of the Route's
- rules is implemented by the Gateway.
-
- There are a number of cases where the "Accepted" condition may not be set
- due to lack of controller visibility, that includes when:
-
- * The Route refers to a non-existent parent.
- * The Route is of a type that the controller does not support.
- * The Route is in a namespace the controller does not have access to.
- items:
- description: Condition contains details for one aspect of
- the current state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False,
- Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- maxItems: 8
- minItems: 1
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- controllerName:
- description: |-
- ControllerName is a domain/path string that indicates the name of the
- controller that wrote this status. This corresponds with the
- controllerName field on GatewayClass.
-
- Example: "example.net/gateway-controller".
-
- The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
- valid Kubernetes names
- (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
-
- Controllers MUST populate this field when writing status. Controllers should ensure that
- entries to status populated with their ControllerName are cleaned up when they are no
- longer necessary.
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
- type: string
- parentRef:
- description: |-
- ParentRef corresponds with a ParentRef in the spec that this
- RouteParentStatus struct describes the status of.
- properties:
- group:
- default: gateway.networking.k8s.io
- description: |-
- Group is the group of the referent.
- When unspecified, "gateway.networking.k8s.io" is inferred.
- To set the core API group (such as for a "Service" kind referent),
- Group must be explicitly set to "" (empty string).
-
- Support: Core
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Gateway
- description: |-
- Kind is kind of the referent.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- Support for other resources is Implementation-Specific.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: |-
- Name is the name of the referent.
-
- Support: Core
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referent. When unspecified, this refers
- to the local namespace of the Route.
-
- Note that there are specific rules for ParentRefs which cross namespace
- boundaries. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example:
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable any other kind of cross-namespace reference.
-
-
- ParentRefs from a Route to a Service in the same namespace are "producer"
- routes, which apply default routing rules to inbound connections from
- any namespace to the Service.
-
- ParentRefs from a Route to a Service in a different namespace are
- "consumer" routes, and these routing rules are only applied to outbound
- connections originating from the same namespace as the Route, for which
- the intended destination of the connections are a Service targeted as a
- ParentRef of the Route.
-
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port is the network port this Route targets. It can be interpreted
- differently based on the type of parent resource.
-
- When the parent resource is a Gateway, this targets all listeners
- listening on the specified port that also support this kind of Route(and
- select this Route). It's not recommended to set `Port` unless the
- networking behaviors specified in a Route must apply to a specific port
- as opposed to a listener(s) whose port(s) may be changed. When both Port
- and SectionName are specified, the name and port of the selected listener
- must match both specified values.
-
-
- When the parent resource is a Service, this targets a specific port in the
- Service spec. When both Port (experimental) and SectionName are specified,
- the name and port of the selected port must match both specified values.
-
-
- Implementations MAY choose to support other parent resources.
- Implementations supporting other types of parent resources MUST clearly
- document how/if Port is interpreted.
-
- For the purpose of status, an attachment is considered successful as
- long as the parent resource accepts it partially. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
- from the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route,
- the Route MUST be considered detached from the Gateway.
-
- Support: Extended
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- sectionName:
- description: |-
- SectionName is the name of a section within the target resource. In the
- following resources, SectionName is interpreted as the following:
-
- * Gateway: Listener name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
- * Service: Port name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
-
- Implementations MAY choose to support attaching Routes to other resources.
- If that is the case, they MUST clearly document how SectionName is
- interpreted.
-
- When unspecified (empty string), this will reference the entire resource.
- For the purpose of status, an attachment is considered successful if at
- least one section in the parent resource accepts it. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
- the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route, the
- Route MUST be considered detached from the Gateway.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- required:
- - name
- type: object
- required:
- - controllerName
- - parentRef
- type: object
- maxItems: 32
- type: array
- required:
- - parents
- type: object
- required:
- - spec
- type: object
- served: true
- storage: false
- subresources:
- status: {}
-status:
- acceptedNames:
- kind: ""
- plural: ""
- conditions: null
- storedVersions: null
----
-#
-# config/crd/experimental/gateway.networking.k8s.io_referencegrants.yaml
-#
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
- gateway.networking.k8s.io/bundle-version: v1.2.1
- gateway.networking.k8s.io/channel: experimental
- creationTimestamp: null
- name: referencegrants.gateway.networking.k8s.io
-spec:
- group: gateway.networking.k8s.io
- names:
- categories:
- - gateway-api
- kind: ReferenceGrant
- listKind: ReferenceGrantList
- plural: referencegrants
- shortNames:
- - refgrant
- singular: referencegrant
- scope: Namespaced
- versions:
- - additionalPrinterColumns:
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- name: v1beta1
- schema:
- openAPIV3Schema:
- description: |-
- ReferenceGrant identifies kinds of resources in other namespaces that are
- trusted to reference the specified kinds of resources in the same namespace
- as the policy.
-
- Each ReferenceGrant can be used to represent a unique trust relationship.
- Additional Reference Grants can be used to add to the set of trusted
- sources of inbound references for the namespace they are defined within.
-
- All cross-namespace references in Gateway API (with the exception of cross-namespace
- Gateway-route attachment) require a ReferenceGrant.
-
- ReferenceGrant is a form of runtime verification allowing users to assert
- which cross-namespace object references are permitted. Implementations that
- support ReferenceGrant MUST NOT permit cross-namespace references which have
- no grant, and MUST respond to the removal of a grant by revoking the access
- that the grant allowed.
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: Spec defines the desired state of ReferenceGrant.
- properties:
- from:
- description: |-
- From describes the trusted namespaces and kinds that can reference the
- resources described in "To". Each entry in this list MUST be considered
- to be an additional place that references can be valid from, or to put
- this another way, entries MUST be combined using OR.
-
- Support: Core
- items:
- description: ReferenceGrantFrom describes trusted namespaces and
- kinds.
- properties:
- group:
- description: |-
- Group is the group of the referent.
- When empty, the Kubernetes core API group is inferred.
-
- Support: Core
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: |-
- Kind is the kind of the referent. Although implementations may support
- additional resources, the following types are part of the "Core"
- support level for this field.
-
- When used to permit a SecretObjectReference:
-
- * Gateway
-
- When used to permit a BackendObjectReference:
-
- * GRPCRoute
- * HTTPRoute
- * TCPRoute
- * TLSRoute
- * UDPRoute
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referent.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- required:
- - group
- - kind
- - namespace
- type: object
- maxItems: 16
- minItems: 1
- type: array
- to:
- description: |-
- To describes the resources that may be referenced by the resources
- described in "From". Each entry in this list MUST be considered to be an
- additional place that references can be valid to, or to put this another
- way, entries MUST be combined using OR.
-
- Support: Core
- items:
- description: |-
- ReferenceGrantTo describes what Kinds are allowed as targets of the
- references.
- properties:
- group:
- description: |-
- Group is the group of the referent.
- When empty, the Kubernetes core API group is inferred.
-
- Support: Core
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: |-
- Kind is the kind of the referent. Although implementations may support
- additional resources, the following types are part of the "Core"
- support level for this field:
-
- * Secret when used to permit a SecretObjectReference
- * Service when used to permit a BackendObjectReference
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: |-
- Name is the name of the referent. When unspecified, this policy
- refers to all resources of the specified Group and Kind in the local
- namespace.
- maxLength: 253
- minLength: 1
- type: string
- required:
- - group
- - kind
- type: object
- maxItems: 16
- minItems: 1
- type: array
- required:
- - from
- - to
- type: object
- type: object
- served: true
- storage: true
- subresources: {}
-status:
- acceptedNames:
- kind: ""
- plural: ""
- conditions: null
- storedVersions: null
----
-#
-# config/crd/experimental/gateway.networking.k8s.io_tcproutes.yaml
-#
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
- gateway.networking.k8s.io/bundle-version: v1.2.1
- gateway.networking.k8s.io/channel: experimental
- creationTimestamp: null
- name: tcproutes.gateway.networking.k8s.io
-spec:
- group: gateway.networking.k8s.io
- names:
- categories:
- - gateway-api
- kind: TCPRoute
- listKind: TCPRouteList
- plural: tcproutes
- singular: tcproute
- scope: Namespaced
- versions:
- - additionalPrinterColumns:
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- name: v1alpha2
- schema:
- openAPIV3Schema:
- description: |-
- TCPRoute provides a way to route TCP requests. When combined with a Gateway
- listener, it can be used to forward connections on the port specified by the
- listener to a set of backends specified by the TCPRoute.
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: Spec defines the desired state of TCPRoute.
- properties:
- parentRefs:
- description: |+
- ParentRefs references the resources (usually Gateways) that a Route wants
- to be attached to. Note that the referenced parent resource needs to
- allow this for the attachment to be complete. For Gateways, that means
- the Gateway needs to allow attachment from Routes of this kind and
- namespace. For Services, that means the Service must either be in the same
- namespace for a "producer" route, or the mesh implementation must support
- and allow "consumer" routes for the referenced Service. ReferenceGrant is
- not applicable for governing ParentRefs to Services - it is not possible to
- create a "producer" route for a Service in a different namespace from the
- Route.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- This API may be extended in the future to support additional kinds of parent
- resources.
-
- ParentRefs must be _distinct_. This means either that:
-
- * They select different objects. If this is the case, then parentRef
- entries are distinct. In terms of fields, this means that the
- multi-part key defined by `group`, `kind`, `namespace`, and `name` must
- be unique across all parentRef entries in the Route.
- * They do not select different objects, but for each optional field used,
- each ParentRef that selects the same object must set the same set of
- optional fields to different values. If one ParentRef sets a
- combination of optional fields, all must set the same combination.
-
- Some examples:
-
- * If one ParentRef sets `sectionName`, all ParentRefs referencing the
- same object must also set `sectionName`.
- * If one ParentRef sets `port`, all ParentRefs referencing the same
- object must also set `port`.
- * If one ParentRef sets `sectionName` and `port`, all ParentRefs
- referencing the same object must also set `sectionName` and `port`.
-
- It is possible to separately reference multiple distinct objects that may
- be collapsed by an implementation. For example, some implementations may
- choose to merge compatible Gateway Listeners together. If that is the
- case, the list of routes attached to those resources should also be
- merged.
-
- Note that for ParentRefs that cross namespace boundaries, there are specific
- rules. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example,
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable other kinds of cross-namespace reference.
-
-
- ParentRefs from a Route to a Service in the same namespace are "producer"
- routes, which apply default routing rules to inbound connections from
- any namespace to the Service.
-
- ParentRefs from a Route to a Service in a different namespace are
- "consumer" routes, and these routing rules are only applied to outbound
- connections originating from the same namespace as the Route, for which
- the intended destination of the connections are a Service targeted as a
- ParentRef of the Route.
-
-
-
-
-
- items:
- description: |-
- ParentReference identifies an API object (usually a Gateway) that can be considered
- a parent of this resource (usually a route). There are two kinds of parent resources
- with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- This API may be extended in the future to support additional kinds of parent
- resources.
-
- The API object must be valid in the cluster; the Group and Kind must
- be registered in the cluster for this reference to be valid.
- properties:
- group:
- default: gateway.networking.k8s.io
- description: |-
- Group is the group of the referent.
- When unspecified, "gateway.networking.k8s.io" is inferred.
- To set the core API group (such as for a "Service" kind referent),
- Group must be explicitly set to "" (empty string).
-
- Support: Core
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Gateway
- description: |-
- Kind is kind of the referent.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- Support for other resources is Implementation-Specific.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: |-
- Name is the name of the referent.
-
- Support: Core
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referent. When unspecified, this refers
- to the local namespace of the Route.
-
- Note that there are specific rules for ParentRefs which cross namespace
- boundaries. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example:
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable any other kind of cross-namespace reference.
-
-
- ParentRefs from a Route to a Service in the same namespace are "producer"
- routes, which apply default routing rules to inbound connections from
- any namespace to the Service.
-
- ParentRefs from a Route to a Service in a different namespace are
- "consumer" routes, and these routing rules are only applied to outbound
- connections originating from the same namespace as the Route, for which
- the intended destination of the connections are a Service targeted as a
- ParentRef of the Route.
-
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port is the network port this Route targets. It can be interpreted
- differently based on the type of parent resource.
-
- When the parent resource is a Gateway, this targets all listeners
- listening on the specified port that also support this kind of Route(and
- select this Route). It's not recommended to set `Port` unless the
- networking behaviors specified in a Route must apply to a specific port
- as opposed to a listener(s) whose port(s) may be changed. When both Port
- and SectionName are specified, the name and port of the selected listener
- must match both specified values.
-
-
- When the parent resource is a Service, this targets a specific port in the
- Service spec. When both Port (experimental) and SectionName are specified,
- the name and port of the selected port must match both specified values.
-
-
- Implementations MAY choose to support other parent resources.
- Implementations supporting other types of parent resources MUST clearly
- document how/if Port is interpreted.
-
- For the purpose of status, an attachment is considered successful as
- long as the parent resource accepts it partially. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
- from the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route,
- the Route MUST be considered detached from the Gateway.
-
- Support: Extended
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- sectionName:
- description: |-
- SectionName is the name of a section within the target resource. In the
- following resources, SectionName is interpreted as the following:
-
- * Gateway: Listener name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
- * Service: Port name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
-
- Implementations MAY choose to support attaching Routes to other resources.
- If that is the case, they MUST clearly document how SectionName is
- interpreted.
-
- When unspecified (empty string), this will reference the entire resource.
- For the purpose of status, an attachment is considered successful if at
- least one section in the parent resource accepts it. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
- the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route, the
- Route MUST be considered detached from the Gateway.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- required:
- - name
- type: object
- maxItems: 32
- type: array
- x-kubernetes-validations:
- - message: sectionName or port must be specified when parentRefs includes
- 2 or more references to the same parent
- rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind
- == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__)
- || p1.__namespace__ == '''') && (!has(p2.__namespace__) || p2.__namespace__
- == '''')) || (has(p1.__namespace__) && has(p2.__namespace__) &&
- p1.__namespace__ == p2.__namespace__)) ? ((!has(p1.sectionName)
- || p1.sectionName == '''') == (!has(p2.sectionName) || p2.sectionName
- == '''') && (!has(p1.port) || p1.port == 0) == (!has(p2.port)
- || p2.port == 0)): true))'
- - message: sectionName or port must be unique when parentRefs includes
- 2 or more references to the same parent
- rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind
- == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__)
- || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__
- == '')) || (has(p1.__namespace__) && has(p2.__namespace__) &&
- p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName)
- || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName
- == '')) || ( has(p1.sectionName) && has(p2.sectionName) && p1.sectionName
- == p2.sectionName)) && (((!has(p1.port) || p1.port == 0) && (!has(p2.port)
- || p2.port == 0)) || (has(p1.port) && has(p2.port) && p1.port
- == p2.port))))
- rules:
- description: |+
- Rules are a list of TCP matchers and actions.
-
- items:
- description: TCPRouteRule is the configuration for a given rule.
- properties:
- backendRefs:
- description: |-
- BackendRefs defines the backend(s) where matching requests should be
- sent. If unspecified or invalid (refers to a non-existent resource or a
- Service with no endpoints), the underlying implementation MUST actively
- reject connection attempts to this backend. Connection rejections must
- respect weight; if an invalid backend is requested to have 80% of
- connections, then 80% of connections must be rejected instead.
-
- Support: Core for Kubernetes Service
-
- Support: Extended for Kubernetes ServiceImport
-
- Support: Implementation-specific for any other resource
-
- Support for weight: Extended
- items:
- description: |-
- BackendRef defines how a Route should forward a request to a Kubernetes
- resource.
-
- Note that when a namespace different than the local namespace is specified, a
- ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
-
-
- When the BackendRef points to a Kubernetes Service, implementations SHOULD
- honor the appProtocol field if it is set for the target Service Port.
-
- Implementations supporting appProtocol SHOULD recognize the Kubernetes
- Standard Application Protocols defined in KEP-3726.
-
- If a Service appProtocol isn't specified, an implementation MAY infer the
- backend protocol through its own means. Implementations MAY infer the
- protocol from the Route type referring to the backend Service.
-
- If a Route is not able to send traffic to the backend using the specified
- protocol then the backend is considered invalid. Implementations MUST set the
- "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason.
-
-
-
- Note that when the BackendTLSPolicy object is enabled by the implementation,
- there are some extra rules about validity to consider here. See the fields
- where this struct is used for more information about the exact behavior.
- properties:
- group:
- default: ""
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Service
- description: |-
- Kind is the Kubernetes resource kind of the referent. For example
- "Service".
-
- Defaults to "Service" when not specified.
-
- ExternalName services can refer to CNAME DNS records that may live
- outside of the cluster and as such are difficult to reason about in
- terms of conformance. They also may not be safe to forward to (see
- CVE-2021-25740 for more information). Implementations SHOULD NOT
- support ExternalName Services.
-
- Support: Core (Services with a type other than ExternalName)
-
- Support: Implementation-specific (Services with type ExternalName)
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the backend. When unspecified, the local
- namespace is inferred.
-
- Note that when a namespace different than the local namespace is specified,
- a ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port specifies the destination port number to use for this resource.
- Port is required when the referent is a Kubernetes Service. In this
- case, the port number is the service port number, not the target port.
- For other resources, destination port might be derived from the referent
- resource or this field.
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- weight:
- default: 1
- description: |-
- Weight specifies the proportion of requests forwarded to the referenced
- backend. This is computed as weight/(sum of all weights in this
- BackendRefs list). For non-zero values, there may be some epsilon from
- the exact proportion defined here depending on the precision an
- implementation supports. Weight is not a percentage and the sum of
- weights does not need to equal 100.
-
- If only one backend is specified and it has a weight greater than 0, 100%
- of the traffic is forwarded to that backend. If weight is set to 0, no
- traffic should be forwarded for this entry. If unspecified, weight
- defaults to 1.
-
- Support for this field varies based on the context where used.
- format: int32
- maximum: 1000000
- minimum: 0
- type: integer
- required:
- - name
- type: object
- x-kubernetes-validations:
- - message: Must have port for Service reference
- rule: '(size(self.group) == 0 && self.kind == ''Service'')
- ? has(self.port) : true'
- maxItems: 16
- minItems: 1
- type: array
- name:
- description: |-
- Name is the name of the route rule. This name MUST be unique within a Route if it is set.
-
- Support: Extended
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- type: object
- maxItems: 16
- minItems: 1
- type: array
- x-kubernetes-validations:
- - message: Rule name must be unique within the route
- rule: self.all(l1, !has(l1.name) || self.exists_one(l2, has(l2.name)
- && l1.name == l2.name))
- required:
- - rules
- type: object
- status:
- description: Status defines the current state of TCPRoute.
- properties:
- parents:
- description: |-
- Parents is a list of parent resources (usually Gateways) that are
- associated with the route, and the status of the route with respect to
- each parent. When this route attaches to a parent, the controller that
- manages the parent must add an entry to this list when the controller
- first sees the route and should update the entry as appropriate when the
- route or gateway is modified.
-
- Note that parent references that cannot be resolved by an implementation
- of this API will not be added to this list. Implementations of this API
- can only populate Route status for the Gateways/parent resources they are
- responsible for.
-
- A maximum of 32 Gateways will be represented in this list. An empty list
- means the route has not been attached to any Gateway.
- items:
- description: |-
- RouteParentStatus describes the status of a route with respect to an
- associated Parent.
- properties:
- conditions:
- description: |-
- Conditions describes the status of the route with respect to the Gateway.
- Note that the route's availability is also subject to the Gateway's own
- status conditions and listener status.
-
- If the Route's ParentRef specifies an existing Gateway that supports
- Routes of this kind AND that Gateway's controller has sufficient access,
- then that Gateway's controller MUST set the "Accepted" condition on the
- Route, to indicate whether the route has been accepted or rejected by the
- Gateway, and why.
-
- A Route MUST be considered "Accepted" if at least one of the Route's
- rules is implemented by the Gateway.
-
- There are a number of cases where the "Accepted" condition may not be set
- due to lack of controller visibility, that includes when:
-
- * The Route refers to a non-existent parent.
- * The Route is of a type that the controller does not support.
- * The Route is in a namespace the controller does not have access to.
- items:
- description: Condition contains details for one aspect of
- the current state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False,
- Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- maxItems: 8
- minItems: 1
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- controllerName:
- description: |-
- ControllerName is a domain/path string that indicates the name of the
- controller that wrote this status. This corresponds with the
- controllerName field on GatewayClass.
-
- Example: "example.net/gateway-controller".
-
- The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
- valid Kubernetes names
- (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
-
- Controllers MUST populate this field when writing status. Controllers should ensure that
- entries to status populated with their ControllerName are cleaned up when they are no
- longer necessary.
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
- type: string
- parentRef:
- description: |-
- ParentRef corresponds with a ParentRef in the spec that this
- RouteParentStatus struct describes the status of.
- properties:
- group:
- default: gateway.networking.k8s.io
- description: |-
- Group is the group of the referent.
- When unspecified, "gateway.networking.k8s.io" is inferred.
- To set the core API group (such as for a "Service" kind referent),
- Group must be explicitly set to "" (empty string).
-
- Support: Core
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Gateway
- description: |-
- Kind is kind of the referent.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- Support for other resources is Implementation-Specific.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: |-
- Name is the name of the referent.
-
- Support: Core
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referent. When unspecified, this refers
- to the local namespace of the Route.
-
- Note that there are specific rules for ParentRefs which cross namespace
- boundaries. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example:
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable any other kind of cross-namespace reference.
-
-
- ParentRefs from a Route to a Service in the same namespace are "producer"
- routes, which apply default routing rules to inbound connections from
- any namespace to the Service.
-
- ParentRefs from a Route to a Service in a different namespace are
- "consumer" routes, and these routing rules are only applied to outbound
- connections originating from the same namespace as the Route, for which
- the intended destination of the connections are a Service targeted as a
- ParentRef of the Route.
-
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port is the network port this Route targets. It can be interpreted
- differently based on the type of parent resource.
-
- When the parent resource is a Gateway, this targets all listeners
- listening on the specified port that also support this kind of Route(and
- select this Route). It's not recommended to set `Port` unless the
- networking behaviors specified in a Route must apply to a specific port
- as opposed to a listener(s) whose port(s) may be changed. When both Port
- and SectionName are specified, the name and port of the selected listener
- must match both specified values.
-
-
- When the parent resource is a Service, this targets a specific port in the
- Service spec. When both Port (experimental) and SectionName are specified,
- the name and port of the selected port must match both specified values.
-
-
- Implementations MAY choose to support other parent resources.
- Implementations supporting other types of parent resources MUST clearly
- document how/if Port is interpreted.
-
- For the purpose of status, an attachment is considered successful as
- long as the parent resource accepts it partially. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
- from the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route,
- the Route MUST be considered detached from the Gateway.
-
- Support: Extended
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- sectionName:
- description: |-
- SectionName is the name of a section within the target resource. In the
- following resources, SectionName is interpreted as the following:
-
- * Gateway: Listener name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
- * Service: Port name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
-
- Implementations MAY choose to support attaching Routes to other resources.
- If that is the case, they MUST clearly document how SectionName is
- interpreted.
-
- When unspecified (empty string), this will reference the entire resource.
- For the purpose of status, an attachment is considered successful if at
- least one section in the parent resource accepts it. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
- the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route, the
- Route MUST be considered detached from the Gateway.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- required:
- - name
- type: object
- required:
- - controllerName
- - parentRef
- type: object
- maxItems: 32
- type: array
- required:
- - parents
- type: object
- required:
- - spec
- type: object
- served: true
- storage: true
- subresources:
- status: {}
-status:
- acceptedNames:
- kind: ""
- plural: ""
- conditions: null
- storedVersions: null
----
-#
-# config/crd/experimental/gateway.networking.k8s.io_tlsroutes.yaml
-#
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
- gateway.networking.k8s.io/bundle-version: v1.2.1
- gateway.networking.k8s.io/channel: experimental
- creationTimestamp: null
- name: tlsroutes.gateway.networking.k8s.io
-spec:
- group: gateway.networking.k8s.io
- names:
- categories:
- - gateway-api
- kind: TLSRoute
- listKind: TLSRouteList
- plural: tlsroutes
- singular: tlsroute
- scope: Namespaced
- versions:
- - additionalPrinterColumns:
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- name: v1alpha2
- schema:
- openAPIV3Schema:
- description: |-
- The TLSRoute resource is similar to TCPRoute, but can be configured
- to match against TLS-specific metadata. This allows more flexibility
- in matching streams for a given TLS listener.
-
- If you need to forward traffic to a single target for a TLS listener, you
- could choose to use a TCPRoute with a TLS listener.
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: Spec defines the desired state of TLSRoute.
- properties:
- hostnames:
- description: |-
- Hostnames defines a set of SNI names that should match against the
- SNI attribute of TLS ClientHello message in TLS handshake. This matches
- the RFC 1123 definition of a hostname with 2 notable exceptions:
-
- 1. IPs are not allowed in SNI names per RFC 6066.
- 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard
- label must appear by itself as the first label.
-
- If a hostname is specified by both the Listener and TLSRoute, there
- must be at least one intersecting hostname for the TLSRoute to be
- attached to the Listener. For example:
-
- * A Listener with `test.example.com` as the hostname matches TLSRoutes
- that have either not specified any hostnames, or have specified at
- least one of `test.example.com` or `*.example.com`.
- * A Listener with `*.example.com` as the hostname matches TLSRoutes
- that have either not specified any hostnames or have specified at least
- one hostname that matches the Listener hostname. For example,
- `test.example.com` and `*.example.com` would both match. On the other
- hand, `example.com` and `test.example.net` would not match.
-
- If both the Listener and TLSRoute have specified hostnames, any
- TLSRoute hostnames that do not match the Listener hostname MUST be
- ignored. For example, if a Listener specified `*.example.com`, and the
- TLSRoute specified `test.example.com` and `test.example.net`,
- `test.example.net` must not be considered for a match.
-
- If both the Listener and TLSRoute have specified hostnames, and none
- match with the criteria above, then the TLSRoute is not accepted. The
- implementation must raise an 'Accepted' Condition with a status of
- `False` in the corresponding RouteParentStatus.
-
- Support: Core
- items:
- description: |-
- Hostname is the fully qualified domain name of a network host. This matches
- the RFC 1123 definition of a hostname with 2 notable exceptions:
-
- 1. IPs are not allowed.
- 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard
- label must appear by itself as the first label.
-
- Hostname can be "precise" which is a domain name without the terminating
- dot of a network host (e.g. "foo.example.com") or "wildcard", which is a
- domain name prefixed with a single wildcard label (e.g. `*.example.com`).
-
- Note that as per RFC1035 and RFC1123, a *label* must consist of lower case
- alphanumeric characters or '-', and must start and end with an alphanumeric
- character. No other punctuation is allowed.
- maxLength: 253
- minLength: 1
- pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- maxItems: 16
- type: array
- parentRefs:
- description: |+
- ParentRefs references the resources (usually Gateways) that a Route wants
- to be attached to. Note that the referenced parent resource needs to
- allow this for the attachment to be complete. For Gateways, that means
- the Gateway needs to allow attachment from Routes of this kind and
- namespace. For Services, that means the Service must either be in the same
- namespace for a "producer" route, or the mesh implementation must support
- and allow "consumer" routes for the referenced Service. ReferenceGrant is
- not applicable for governing ParentRefs to Services - it is not possible to
- create a "producer" route for a Service in a different namespace from the
- Route.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- This API may be extended in the future to support additional kinds of parent
- resources.
-
- ParentRefs must be _distinct_. This means either that:
-
- * They select different objects. If this is the case, then parentRef
- entries are distinct. In terms of fields, this means that the
- multi-part key defined by `group`, `kind`, `namespace`, and `name` must
- be unique across all parentRef entries in the Route.
- * They do not select different objects, but for each optional field used,
- each ParentRef that selects the same object must set the same set of
- optional fields to different values. If one ParentRef sets a
- combination of optional fields, all must set the same combination.
-
- Some examples:
-
- * If one ParentRef sets `sectionName`, all ParentRefs referencing the
- same object must also set `sectionName`.
- * If one ParentRef sets `port`, all ParentRefs referencing the same
- object must also set `port`.
- * If one ParentRef sets `sectionName` and `port`, all ParentRefs
- referencing the same object must also set `sectionName` and `port`.
-
- It is possible to separately reference multiple distinct objects that may
- be collapsed by an implementation. For example, some implementations may
- choose to merge compatible Gateway Listeners together. If that is the
- case, the list of routes attached to those resources should also be
- merged.
-
- Note that for ParentRefs that cross namespace boundaries, there are specific
- rules. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example,
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable other kinds of cross-namespace reference.
-
-
- ParentRefs from a Route to a Service in the same namespace are "producer"
- routes, which apply default routing rules to inbound connections from
- any namespace to the Service.
-
- ParentRefs from a Route to a Service in a different namespace are
- "consumer" routes, and these routing rules are only applied to outbound
- connections originating from the same namespace as the Route, for which
- the intended destination of the connections are a Service targeted as a
- ParentRef of the Route.
-
-
-
-
-
- items:
- description: |-
- ParentReference identifies an API object (usually a Gateway) that can be considered
- a parent of this resource (usually a route). There are two kinds of parent resources
- with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- This API may be extended in the future to support additional kinds of parent
- resources.
-
- The API object must be valid in the cluster; the Group and Kind must
- be registered in the cluster for this reference to be valid.
- properties:
- group:
- default: gateway.networking.k8s.io
- description: |-
- Group is the group of the referent.
- When unspecified, "gateway.networking.k8s.io" is inferred.
- To set the core API group (such as for a "Service" kind referent),
- Group must be explicitly set to "" (empty string).
-
- Support: Core
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Gateway
- description: |-
- Kind is kind of the referent.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- Support for other resources is Implementation-Specific.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: |-
- Name is the name of the referent.
-
- Support: Core
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referent. When unspecified, this refers
- to the local namespace of the Route.
-
- Note that there are specific rules for ParentRefs which cross namespace
- boundaries. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example:
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable any other kind of cross-namespace reference.
-
-
- ParentRefs from a Route to a Service in the same namespace are "producer"
- routes, which apply default routing rules to inbound connections from
- any namespace to the Service.
-
- ParentRefs from a Route to a Service in a different namespace are
- "consumer" routes, and these routing rules are only applied to outbound
- connections originating from the same namespace as the Route, for which
- the intended destination of the connections are a Service targeted as a
- ParentRef of the Route.
-
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port is the network port this Route targets. It can be interpreted
- differently based on the type of parent resource.
-
- When the parent resource is a Gateway, this targets all listeners
- listening on the specified port that also support this kind of Route(and
- select this Route). It's not recommended to set `Port` unless the
- networking behaviors specified in a Route must apply to a specific port
- as opposed to a listener(s) whose port(s) may be changed. When both Port
- and SectionName are specified, the name and port of the selected listener
- must match both specified values.
-
-
- When the parent resource is a Service, this targets a specific port in the
- Service spec. When both Port (experimental) and SectionName are specified,
- the name and port of the selected port must match both specified values.
-
-
- Implementations MAY choose to support other parent resources.
- Implementations supporting other types of parent resources MUST clearly
- document how/if Port is interpreted.
-
- For the purpose of status, an attachment is considered successful as
- long as the parent resource accepts it partially. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
- from the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route,
- the Route MUST be considered detached from the Gateway.
-
- Support: Extended
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- sectionName:
- description: |-
- SectionName is the name of a section within the target resource. In the
- following resources, SectionName is interpreted as the following:
-
- * Gateway: Listener name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
- * Service: Port name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
-
- Implementations MAY choose to support attaching Routes to other resources.
- If that is the case, they MUST clearly document how SectionName is
- interpreted.
-
- When unspecified (empty string), this will reference the entire resource.
- For the purpose of status, an attachment is considered successful if at
- least one section in the parent resource accepts it. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
- the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route, the
- Route MUST be considered detached from the Gateway.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- required:
- - name
- type: object
- maxItems: 32
- type: array
- x-kubernetes-validations:
- - message: sectionName or port must be specified when parentRefs includes
- 2 or more references to the same parent
- rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind
- == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__)
- || p1.__namespace__ == '''') && (!has(p2.__namespace__) || p2.__namespace__
- == '''')) || (has(p1.__namespace__) && has(p2.__namespace__) &&
- p1.__namespace__ == p2.__namespace__)) ? ((!has(p1.sectionName)
- || p1.sectionName == '''') == (!has(p2.sectionName) || p2.sectionName
- == '''') && (!has(p1.port) || p1.port == 0) == (!has(p2.port)
- || p2.port == 0)): true))'
- - message: sectionName or port must be unique when parentRefs includes
- 2 or more references to the same parent
- rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind
- == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__)
- || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__
- == '')) || (has(p1.__namespace__) && has(p2.__namespace__) &&
- p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName)
- || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName
- == '')) || ( has(p1.sectionName) && has(p2.sectionName) && p1.sectionName
- == p2.sectionName)) && (((!has(p1.port) || p1.port == 0) && (!has(p2.port)
- || p2.port == 0)) || (has(p1.port) && has(p2.port) && p1.port
- == p2.port))))
- rules:
- description: |+
- Rules are a list of TLS matchers and actions.
-
- items:
- description: TLSRouteRule is the configuration for a given rule.
- properties:
- backendRefs:
- description: |-
- BackendRefs defines the backend(s) where matching requests should be
- sent. If unspecified or invalid (refers to a non-existent resource or
- a Service with no endpoints), the rule performs no forwarding; if no
- filters are specified that would result in a response being sent, the
- underlying implementation must actively reject request attempts to this
- backend, by rejecting the connection or returning a 500 status code.
- Request rejections must respect weight; if an invalid backend is
- requested to have 80% of requests, then 80% of requests must be rejected
- instead.
-
- Support: Core for Kubernetes Service
-
- Support: Extended for Kubernetes ServiceImport
-
- Support: Implementation-specific for any other resource
-
- Support for weight: Extended
- items:
- description: |-
- BackendRef defines how a Route should forward a request to a Kubernetes
- resource.
-
- Note that when a namespace different than the local namespace is specified, a
- ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
-
-
- When the BackendRef points to a Kubernetes Service, implementations SHOULD
- honor the appProtocol field if it is set for the target Service Port.
-
- Implementations supporting appProtocol SHOULD recognize the Kubernetes
- Standard Application Protocols defined in KEP-3726.
-
- If a Service appProtocol isn't specified, an implementation MAY infer the
- backend protocol through its own means. Implementations MAY infer the
- protocol from the Route type referring to the backend Service.
-
- If a Route is not able to send traffic to the backend using the specified
- protocol then the backend is considered invalid. Implementations MUST set the
- "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason.
-
-
-
- Note that when the BackendTLSPolicy object is enabled by the implementation,
- there are some extra rules about validity to consider here. See the fields
- where this struct is used for more information about the exact behavior.
- properties:
- group:
- default: ""
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Service
- description: |-
- Kind is the Kubernetes resource kind of the referent. For example
- "Service".
-
- Defaults to "Service" when not specified.
-
- ExternalName services can refer to CNAME DNS records that may live
- outside of the cluster and as such are difficult to reason about in
- terms of conformance. They also may not be safe to forward to (see
- CVE-2021-25740 for more information). Implementations SHOULD NOT
- support ExternalName Services.
-
- Support: Core (Services with a type other than ExternalName)
-
- Support: Implementation-specific (Services with type ExternalName)
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the backend. When unspecified, the local
- namespace is inferred.
-
- Note that when a namespace different than the local namespace is specified,
- a ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port specifies the destination port number to use for this resource.
- Port is required when the referent is a Kubernetes Service. In this
- case, the port number is the service port number, not the target port.
- For other resources, destination port might be derived from the referent
- resource or this field.
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- weight:
- default: 1
- description: |-
- Weight specifies the proportion of requests forwarded to the referenced
- backend. This is computed as weight/(sum of all weights in this
- BackendRefs list). For non-zero values, there may be some epsilon from
- the exact proportion defined here depending on the precision an
- implementation supports. Weight is not a percentage and the sum of
- weights does not need to equal 100.
-
- If only one backend is specified and it has a weight greater than 0, 100%
- of the traffic is forwarded to that backend. If weight is set to 0, no
- traffic should be forwarded for this entry. If unspecified, weight
- defaults to 1.
-
- Support for this field varies based on the context where used.
- format: int32
- maximum: 1000000
- minimum: 0
- type: integer
- required:
- - name
- type: object
- x-kubernetes-validations:
- - message: Must have port for Service reference
- rule: '(size(self.group) == 0 && self.kind == ''Service'')
- ? has(self.port) : true'
- maxItems: 16
- minItems: 1
- type: array
- name:
- description: |-
- Name is the name of the route rule. This name MUST be unique within a Route if it is set.
-
- Support: Extended
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- type: object
- maxItems: 16
- minItems: 1
- type: array
- x-kubernetes-validations:
- - message: Rule name must be unique within the route
- rule: self.all(l1, !has(l1.name) || self.exists_one(l2, has(l2.name)
- && l1.name == l2.name))
- required:
- - rules
- type: object
- status:
- description: Status defines the current state of TLSRoute.
- properties:
- parents:
- description: |-
- Parents is a list of parent resources (usually Gateways) that are
- associated with the route, and the status of the route with respect to
- each parent. When this route attaches to a parent, the controller that
- manages the parent must add an entry to this list when the controller
- first sees the route and should update the entry as appropriate when the
- route or gateway is modified.
-
- Note that parent references that cannot be resolved by an implementation
- of this API will not be added to this list. Implementations of this API
- can only populate Route status for the Gateways/parent resources they are
- responsible for.
-
- A maximum of 32 Gateways will be represented in this list. An empty list
- means the route has not been attached to any Gateway.
- items:
- description: |-
- RouteParentStatus describes the status of a route with respect to an
- associated Parent.
- properties:
- conditions:
- description: |-
- Conditions describes the status of the route with respect to the Gateway.
- Note that the route's availability is also subject to the Gateway's own
- status conditions and listener status.
-
- If the Route's ParentRef specifies an existing Gateway that supports
- Routes of this kind AND that Gateway's controller has sufficient access,
- then that Gateway's controller MUST set the "Accepted" condition on the
- Route, to indicate whether the route has been accepted or rejected by the
- Gateway, and why.
-
- A Route MUST be considered "Accepted" if at least one of the Route's
- rules is implemented by the Gateway.
-
- There are a number of cases where the "Accepted" condition may not be set
- due to lack of controller visibility, that includes when:
-
- * The Route refers to a non-existent parent.
- * The Route is of a type that the controller does not support.
- * The Route is in a namespace the controller does not have access to.
- items:
- description: Condition contains details for one aspect of
- the current state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False,
- Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- maxItems: 8
- minItems: 1
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- controllerName:
- description: |-
- ControllerName is a domain/path string that indicates the name of the
- controller that wrote this status. This corresponds with the
- controllerName field on GatewayClass.
-
- Example: "example.net/gateway-controller".
-
- The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
- valid Kubernetes names
- (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
-
- Controllers MUST populate this field when writing status. Controllers should ensure that
- entries to status populated with their ControllerName are cleaned up when they are no
- longer necessary.
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
- type: string
- parentRef:
- description: |-
- ParentRef corresponds with a ParentRef in the spec that this
- RouteParentStatus struct describes the status of.
- properties:
- group:
- default: gateway.networking.k8s.io
- description: |-
- Group is the group of the referent.
- When unspecified, "gateway.networking.k8s.io" is inferred.
- To set the core API group (such as for a "Service" kind referent),
- Group must be explicitly set to "" (empty string).
-
- Support: Core
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Gateway
- description: |-
- Kind is kind of the referent.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- Support for other resources is Implementation-Specific.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: |-
- Name is the name of the referent.
-
- Support: Core
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referent. When unspecified, this refers
- to the local namespace of the Route.
-
- Note that there are specific rules for ParentRefs which cross namespace
- boundaries. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example:
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable any other kind of cross-namespace reference.
-
-
- ParentRefs from a Route to a Service in the same namespace are "producer"
- routes, which apply default routing rules to inbound connections from
- any namespace to the Service.
-
- ParentRefs from a Route to a Service in a different namespace are
- "consumer" routes, and these routing rules are only applied to outbound
- connections originating from the same namespace as the Route, for which
- the intended destination of the connections are a Service targeted as a
- ParentRef of the Route.
-
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port is the network port this Route targets. It can be interpreted
- differently based on the type of parent resource.
-
- When the parent resource is a Gateway, this targets all listeners
- listening on the specified port that also support this kind of Route(and
- select this Route). It's not recommended to set `Port` unless the
- networking behaviors specified in a Route must apply to a specific port
- as opposed to a listener(s) whose port(s) may be changed. When both Port
- and SectionName are specified, the name and port of the selected listener
- must match both specified values.
-
-
- When the parent resource is a Service, this targets a specific port in the
- Service spec. When both Port (experimental) and SectionName are specified,
- the name and port of the selected port must match both specified values.
-
-
- Implementations MAY choose to support other parent resources.
- Implementations supporting other types of parent resources MUST clearly
- document how/if Port is interpreted.
-
- For the purpose of status, an attachment is considered successful as
- long as the parent resource accepts it partially. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
- from the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route,
- the Route MUST be considered detached from the Gateway.
-
- Support: Extended
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- sectionName:
- description: |-
- SectionName is the name of a section within the target resource. In the
- following resources, SectionName is interpreted as the following:
-
- * Gateway: Listener name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
- * Service: Port name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
-
- Implementations MAY choose to support attaching Routes to other resources.
- If that is the case, they MUST clearly document how SectionName is
- interpreted.
-
- When unspecified (empty string), this will reference the entire resource.
- For the purpose of status, an attachment is considered successful if at
- least one section in the parent resource accepts it. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
- the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route, the
- Route MUST be considered detached from the Gateway.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- required:
- - name
- type: object
- required:
- - controllerName
- - parentRef
- type: object
- maxItems: 32
- type: array
- required:
- - parents
- type: object
- required:
- - spec
- type: object
- served: true
- storage: true
- subresources:
- status: {}
-status:
- acceptedNames:
- kind: ""
- plural: ""
- conditions: null
- storedVersions: null
----
-#
-# config/crd/experimental/gateway.networking.k8s.io_udproutes.yaml
-#
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
- gateway.networking.k8s.io/bundle-version: v1.2.1
- gateway.networking.k8s.io/channel: experimental
- creationTimestamp: null
- name: udproutes.gateway.networking.k8s.io
-spec:
- group: gateway.networking.k8s.io
- names:
- categories:
- - gateway-api
- kind: UDPRoute
- listKind: UDPRouteList
- plural: udproutes
- singular: udproute
- scope: Namespaced
- versions:
- - additionalPrinterColumns:
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- name: v1alpha2
- schema:
- openAPIV3Schema:
- description: |-
- UDPRoute provides a way to route UDP traffic. When combined with a Gateway
- listener, it can be used to forward traffic on the port specified by the
- listener to a set of backends specified by the UDPRoute.
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: Spec defines the desired state of UDPRoute.
- properties:
- parentRefs:
- description: |+
- ParentRefs references the resources (usually Gateways) that a Route wants
- to be attached to. Note that the referenced parent resource needs to
- allow this for the attachment to be complete. For Gateways, that means
- the Gateway needs to allow attachment from Routes of this kind and
- namespace. For Services, that means the Service must either be in the same
- namespace for a "producer" route, or the mesh implementation must support
- and allow "consumer" routes for the referenced Service. ReferenceGrant is
- not applicable for governing ParentRefs to Services - it is not possible to
- create a "producer" route for a Service in a different namespace from the
- Route.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- This API may be extended in the future to support additional kinds of parent
- resources.
-
- ParentRefs must be _distinct_. This means either that:
-
- * They select different objects. If this is the case, then parentRef
- entries are distinct. In terms of fields, this means that the
- multi-part key defined by `group`, `kind`, `namespace`, and `name` must
- be unique across all parentRef entries in the Route.
- * They do not select different objects, but for each optional field used,
- each ParentRef that selects the same object must set the same set of
- optional fields to different values. If one ParentRef sets a
- combination of optional fields, all must set the same combination.
-
- Some examples:
-
- * If one ParentRef sets `sectionName`, all ParentRefs referencing the
- same object must also set `sectionName`.
- * If one ParentRef sets `port`, all ParentRefs referencing the same
- object must also set `port`.
- * If one ParentRef sets `sectionName` and `port`, all ParentRefs
- referencing the same object must also set `sectionName` and `port`.
-
- It is possible to separately reference multiple distinct objects that may
- be collapsed by an implementation. For example, some implementations may
- choose to merge compatible Gateway Listeners together. If that is the
- case, the list of routes attached to those resources should also be
- merged.
-
- Note that for ParentRefs that cross namespace boundaries, there are specific
- rules. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example,
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable other kinds of cross-namespace reference.
-
-
- ParentRefs from a Route to a Service in the same namespace are "producer"
- routes, which apply default routing rules to inbound connections from
- any namespace to the Service.
-
- ParentRefs from a Route to a Service in a different namespace are
- "consumer" routes, and these routing rules are only applied to outbound
- connections originating from the same namespace as the Route, for which
- the intended destination of the connections are a Service targeted as a
- ParentRef of the Route.
-
-
-
-
-
- items:
- description: |-
- ParentReference identifies an API object (usually a Gateway) that can be considered
- a parent of this resource (usually a route). There are two kinds of parent resources
- with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- This API may be extended in the future to support additional kinds of parent
- resources.
-
- The API object must be valid in the cluster; the Group and Kind must
- be registered in the cluster for this reference to be valid.
- properties:
- group:
- default: gateway.networking.k8s.io
- description: |-
- Group is the group of the referent.
- When unspecified, "gateway.networking.k8s.io" is inferred.
- To set the core API group (such as for a "Service" kind referent),
- Group must be explicitly set to "" (empty string).
-
- Support: Core
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Gateway
- description: |-
- Kind is kind of the referent.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- Support for other resources is Implementation-Specific.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: |-
- Name is the name of the referent.
-
- Support: Core
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referent. When unspecified, this refers
- to the local namespace of the Route.
-
- Note that there are specific rules for ParentRefs which cross namespace
- boundaries. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example:
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable any other kind of cross-namespace reference.
-
-
- ParentRefs from a Route to a Service in the same namespace are "producer"
- routes, which apply default routing rules to inbound connections from
- any namespace to the Service.
-
- ParentRefs from a Route to a Service in a different namespace are
- "consumer" routes, and these routing rules are only applied to outbound
- connections originating from the same namespace as the Route, for which
- the intended destination of the connections are a Service targeted as a
- ParentRef of the Route.
-
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port is the network port this Route targets. It can be interpreted
- differently based on the type of parent resource.
-
- When the parent resource is a Gateway, this targets all listeners
- listening on the specified port that also support this kind of Route(and
- select this Route). It's not recommended to set `Port` unless the
- networking behaviors specified in a Route must apply to a specific port
- as opposed to a listener(s) whose port(s) may be changed. When both Port
- and SectionName are specified, the name and port of the selected listener
- must match both specified values.
-
-
- When the parent resource is a Service, this targets a specific port in the
- Service spec. When both Port (experimental) and SectionName are specified,
- the name and port of the selected port must match both specified values.
-
-
- Implementations MAY choose to support other parent resources.
- Implementations supporting other types of parent resources MUST clearly
- document how/if Port is interpreted.
-
- For the purpose of status, an attachment is considered successful as
- long as the parent resource accepts it partially. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
- from the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route,
- the Route MUST be considered detached from the Gateway.
-
- Support: Extended
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- sectionName:
- description: |-
- SectionName is the name of a section within the target resource. In the
- following resources, SectionName is interpreted as the following:
-
- * Gateway: Listener name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
- * Service: Port name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
-
- Implementations MAY choose to support attaching Routes to other resources.
- If that is the case, they MUST clearly document how SectionName is
- interpreted.
-
- When unspecified (empty string), this will reference the entire resource.
- For the purpose of status, an attachment is considered successful if at
- least one section in the parent resource accepts it. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
- the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route, the
- Route MUST be considered detached from the Gateway.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- required:
- - name
- type: object
- maxItems: 32
- type: array
- x-kubernetes-validations:
- - message: sectionName or port must be specified when parentRefs includes
- 2 or more references to the same parent
- rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind
- == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__)
- || p1.__namespace__ == '''') && (!has(p2.__namespace__) || p2.__namespace__
- == '''')) || (has(p1.__namespace__) && has(p2.__namespace__) &&
- p1.__namespace__ == p2.__namespace__)) ? ((!has(p1.sectionName)
- || p1.sectionName == '''') == (!has(p2.sectionName) || p2.sectionName
- == '''') && (!has(p1.port) || p1.port == 0) == (!has(p2.port)
- || p2.port == 0)): true))'
- - message: sectionName or port must be unique when parentRefs includes
- 2 or more references to the same parent
- rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind
- == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__)
- || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__
- == '')) || (has(p1.__namespace__) && has(p2.__namespace__) &&
- p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName)
- || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName
- == '')) || ( has(p1.sectionName) && has(p2.sectionName) && p1.sectionName
- == p2.sectionName)) && (((!has(p1.port) || p1.port == 0) && (!has(p2.port)
- || p2.port == 0)) || (has(p1.port) && has(p2.port) && p1.port
- == p2.port))))
- rules:
- description: |+
- Rules are a list of UDP matchers and actions.
-
- items:
- description: UDPRouteRule is the configuration for a given rule.
- properties:
- backendRefs:
- description: |-
- BackendRefs defines the backend(s) where matching requests should be
- sent. If unspecified or invalid (refers to a non-existent resource or a
- Service with no endpoints), the underlying implementation MUST actively
- reject connection attempts to this backend. Packet drops must
- respect weight; if an invalid backend is requested to have 80% of
- the packets, then 80% of packets must be dropped instead.
-
- Support: Core for Kubernetes Service
-
- Support: Extended for Kubernetes ServiceImport
-
- Support: Implementation-specific for any other resource
-
- Support for weight: Extended
- items:
- description: |-
- BackendRef defines how a Route should forward a request to a Kubernetes
- resource.
-
- Note that when a namespace different than the local namespace is specified, a
- ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
-
-
- When the BackendRef points to a Kubernetes Service, implementations SHOULD
- honor the appProtocol field if it is set for the target Service Port.
-
- Implementations supporting appProtocol SHOULD recognize the Kubernetes
- Standard Application Protocols defined in KEP-3726.
-
- If a Service appProtocol isn't specified, an implementation MAY infer the
- backend protocol through its own means. Implementations MAY infer the
- protocol from the Route type referring to the backend Service.
-
- If a Route is not able to send traffic to the backend using the specified
- protocol then the backend is considered invalid. Implementations MUST set the
- "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason.
-
-
-
- Note that when the BackendTLSPolicy object is enabled by the implementation,
- there are some extra rules about validity to consider here. See the fields
- where this struct is used for more information about the exact behavior.
- properties:
- group:
- default: ""
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Service
- description: |-
- Kind is the Kubernetes resource kind of the referent. For example
- "Service".
-
- Defaults to "Service" when not specified.
-
- ExternalName services can refer to CNAME DNS records that may live
- outside of the cluster and as such are difficult to reason about in
- terms of conformance. They also may not be safe to forward to (see
- CVE-2021-25740 for more information). Implementations SHOULD NOT
- support ExternalName Services.
-
- Support: Core (Services with a type other than ExternalName)
-
- Support: Implementation-specific (Services with type ExternalName)
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the backend. When unspecified, the local
- namespace is inferred.
-
- Note that when a namespace different than the local namespace is specified,
- a ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port specifies the destination port number to use for this resource.
- Port is required when the referent is a Kubernetes Service. In this
- case, the port number is the service port number, not the target port.
- For other resources, destination port might be derived from the referent
- resource or this field.
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- weight:
- default: 1
- description: |-
- Weight specifies the proportion of requests forwarded to the referenced
- backend. This is computed as weight/(sum of all weights in this
- BackendRefs list). For non-zero values, there may be some epsilon from
- the exact proportion defined here depending on the precision an
- implementation supports. Weight is not a percentage and the sum of
- weights does not need to equal 100.
-
- If only one backend is specified and it has a weight greater than 0, 100%
- of the traffic is forwarded to that backend. If weight is set to 0, no
- traffic should be forwarded for this entry. If unspecified, weight
- defaults to 1.
-
- Support for this field varies based on the context where used.
- format: int32
- maximum: 1000000
- minimum: 0
- type: integer
- required:
- - name
- type: object
- x-kubernetes-validations:
- - message: Must have port for Service reference
- rule: '(size(self.group) == 0 && self.kind == ''Service'')
- ? has(self.port) : true'
- maxItems: 16
- minItems: 1
- type: array
- name:
- description: |-
- Name is the name of the route rule. This name MUST be unique within a Route if it is set.
-
- Support: Extended
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- type: object
- maxItems: 16
- minItems: 1
- type: array
- x-kubernetes-validations:
- - message: Rule name must be unique within the route
- rule: self.all(l1, !has(l1.name) || self.exists_one(l2, has(l2.name)
- && l1.name == l2.name))
- required:
- - rules
- type: object
- status:
- description: Status defines the current state of UDPRoute.
- properties:
- parents:
- description: |-
- Parents is a list of parent resources (usually Gateways) that are
- associated with the route, and the status of the route with respect to
- each parent. When this route attaches to a parent, the controller that
- manages the parent must add an entry to this list when the controller
- first sees the route and should update the entry as appropriate when the
- route or gateway is modified.
-
- Note that parent references that cannot be resolved by an implementation
- of this API will not be added to this list. Implementations of this API
- can only populate Route status for the Gateways/parent resources they are
- responsible for.
-
- A maximum of 32 Gateways will be represented in this list. An empty list
- means the route has not been attached to any Gateway.
- items:
- description: |-
- RouteParentStatus describes the status of a route with respect to an
- associated Parent.
- properties:
- conditions:
- description: |-
- Conditions describes the status of the route with respect to the Gateway.
- Note that the route's availability is also subject to the Gateway's own
- status conditions and listener status.
-
- If the Route's ParentRef specifies an existing Gateway that supports
- Routes of this kind AND that Gateway's controller has sufficient access,
- then that Gateway's controller MUST set the "Accepted" condition on the
- Route, to indicate whether the route has been accepted or rejected by the
- Gateway, and why.
-
- A Route MUST be considered "Accepted" if at least one of the Route's
- rules is implemented by the Gateway.
-
- There are a number of cases where the "Accepted" condition may not be set
- due to lack of controller visibility, that includes when:
-
- * The Route refers to a non-existent parent.
- * The Route is of a type that the controller does not support.
- * The Route is in a namespace the controller does not have access to.
- items:
- description: Condition contains details for one aspect of
- the current state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False,
- Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- maxItems: 8
- minItems: 1
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- controllerName:
- description: |-
- ControllerName is a domain/path string that indicates the name of the
- controller that wrote this status. This corresponds with the
- controllerName field on GatewayClass.
-
- Example: "example.net/gateway-controller".
-
- The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
- valid Kubernetes names
- (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
-
- Controllers MUST populate this field when writing status. Controllers should ensure that
- entries to status populated with their ControllerName are cleaned up when they are no
- longer necessary.
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
- type: string
- parentRef:
- description: |-
- ParentRef corresponds with a ParentRef in the spec that this
- RouteParentStatus struct describes the status of.
- properties:
- group:
- default: gateway.networking.k8s.io
- description: |-
- Group is the group of the referent.
- When unspecified, "gateway.networking.k8s.io" is inferred.
- To set the core API group (such as for a "Service" kind referent),
- Group must be explicitly set to "" (empty string).
-
- Support: Core
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Gateway
- description: |-
- Kind is kind of the referent.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- Support for other resources is Implementation-Specific.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: |-
- Name is the name of the referent.
-
- Support: Core
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referent. When unspecified, this refers
- to the local namespace of the Route.
-
- Note that there are specific rules for ParentRefs which cross namespace
- boundaries. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example:
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable any other kind of cross-namespace reference.
-
-
- ParentRefs from a Route to a Service in the same namespace are "producer"
- routes, which apply default routing rules to inbound connections from
- any namespace to the Service.
-
- ParentRefs from a Route to a Service in a different namespace are
- "consumer" routes, and these routing rules are only applied to outbound
- connections originating from the same namespace as the Route, for which
- the intended destination of the connections are a Service targeted as a
- ParentRef of the Route.
-
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port is the network port this Route targets. It can be interpreted
- differently based on the type of parent resource.
-
- When the parent resource is a Gateway, this targets all listeners
- listening on the specified port that also support this kind of Route(and
- select this Route). It's not recommended to set `Port` unless the
- networking behaviors specified in a Route must apply to a specific port
- as opposed to a listener(s) whose port(s) may be changed. When both Port
- and SectionName are specified, the name and port of the selected listener
- must match both specified values.
-
-
- When the parent resource is a Service, this targets a specific port in the
- Service spec. When both Port (experimental) and SectionName are specified,
- the name and port of the selected port must match both specified values.
-
-
- Implementations MAY choose to support other parent resources.
- Implementations supporting other types of parent resources MUST clearly
- document how/if Port is interpreted.
-
- For the purpose of status, an attachment is considered successful as
- long as the parent resource accepts it partially. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
- from the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route,
- the Route MUST be considered detached from the Gateway.
-
- Support: Extended
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- sectionName:
- description: |-
- SectionName is the name of a section within the target resource. In the
- following resources, SectionName is interpreted as the following:
-
- * Gateway: Listener name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
- * Service: Port name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
-
- Implementations MAY choose to support attaching Routes to other resources.
- If that is the case, they MUST clearly document how SectionName is
- interpreted.
-
- When unspecified (empty string), this will reference the entire resource.
- For the purpose of status, an attachment is considered successful if at
- least one section in the parent resource accepts it. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
- the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route, the
- Route MUST be considered detached from the Gateway.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- required:
- - name
- type: object
- required:
- - controllerName
- - parentRef
- type: object
- maxItems: 32
- type: array
- required:
- - parents
- type: object
- required:
- - spec
- type: object
- served: true
- storage: true
- subresources:
- status: {}
-status:
- acceptedNames:
- kind: ""
- plural: ""
- conditions: null
- storedVersions: null
diff --git a/archive/gateway-api/manifests/gateway.yaml b/archive/gateway-api/manifests/gateway.yaml
deleted file mode 100644
index cc68fd7..0000000
--- a/archive/gateway-api/manifests/gateway.yaml
+++ /dev/null
@@ -1,54 +0,0 @@
-# ------------------------------------------------------------------------------
-# GatewayClass — tells Kubernetes that Cilium handles Gateway resources
-# Defined here alongside the Gateway it enables
-# ------------------------------------------------------------------------------
-apiVersion: gateway.networking.k8s.io/v1
-kind: GatewayClass
-metadata:
- name: cilium
-spec:
- controllerName: io.cilium/gateway-controller
- description: Cilium Gateway API implementation (eBPF-native)
-
----
-# ------------------------------------------------------------------------------
-# Gateway — fastpass-gateway
-#
-# This is the central Gateway that all HTTPRoute resources attach to.
-# Cilium operator creates a LoadBalancer service for this Gateway automatically,
-# which will receive an IP from the cilium-gateway-pool (10.1.71.90-.99).
-#
-# Usage: Applications create HTTPRoute resources that reference this Gateway:
-#
-# spec:
-# parentRefs:
-# - name: fastpass-gateway
-# namespace: gateway-system
-# ------------------------------------------------------------------------------
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
- name: fastpass-gateway
- namespace: gateway-system
- annotations:
- io.cilium/lb-ipam-ips: "10.1.71.90"
-spec:
- gatewayClassName: cilium
- listeners:
- - name: http
- protocol: HTTP
- port: 80
- allowedRoutes:
- namespaces:
- from: All
- - name: https
- protocol: HTTPS
- port: 443
- allowedRoutes:
- namespaces:
- from: All
- tls:
- mode: Terminate
- certificateRefs:
- - name: argocd-tls
- namespace: argocd
diff --git a/archive/gateway-api/manifests/namespace.yaml b/archive/gateway-api/manifests/namespace.yaml
deleted file mode 100644
index 938e1c9..0000000
--- a/archive/gateway-api/manifests/namespace.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
- name: gateway-system
- labels:
- kubernetes.io/metadata.name: gateway-system
\ No newline at end of file
diff --git a/archive/gateway-api/manifests/standard-install.yaml b/archive/gateway-api/manifests/standard-install.yaml
deleted file mode 100644
index 5bf4f30..0000000
--- a/archive/gateway-api/manifests/standard-install.yaml
+++ /dev/null
@@ -1,10345 +0,0 @@
-# Copyright 2024 The Kubernetes Authors.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-#
-# Gateway API Standard channel install
-#
----
-#
-# config/crd/standard/gateway.networking.k8s.io_gatewayclasses.yaml
-#
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
- gateway.networking.k8s.io/bundle-version: v1.2.1
- gateway.networking.k8s.io/channel: standard
- creationTimestamp: null
- name: gatewayclasses.gateway.networking.k8s.io
-spec:
- group: gateway.networking.k8s.io
- names:
- categories:
- - gateway-api
- kind: GatewayClass
- listKind: GatewayClassList
- plural: gatewayclasses
- shortNames:
- - gc
- singular: gatewayclass
- scope: Cluster
- versions:
- - additionalPrinterColumns:
- - jsonPath: .spec.controllerName
- name: Controller
- type: string
- - jsonPath: .status.conditions[?(@.type=="Accepted")].status
- name: Accepted
- type: string
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- - jsonPath: .spec.description
- name: Description
- priority: 1
- type: string
- name: v1
- schema:
- openAPIV3Schema:
- description: |-
- GatewayClass describes a class of Gateways available to the user for creating
- Gateway resources.
-
- It is recommended that this resource be used as a template for Gateways. This
- means that a Gateway is based on the state of the GatewayClass at the time it
- was created and changes to the GatewayClass or associated parameters are not
- propagated down to existing Gateways. This recommendation is intended to
- limit the blast radius of changes to GatewayClass or associated parameters.
- If implementations choose to propagate GatewayClass changes to existing
- Gateways, that MUST be clearly documented by the implementation.
-
- Whenever one or more Gateways are using a GatewayClass, implementations SHOULD
- add the `gateway-exists-finalizer.gateway.networking.k8s.io` finalizer on the
- associated GatewayClass. This ensures that a GatewayClass associated with a
- Gateway is not deleted while in use.
-
- GatewayClass is a Cluster level resource.
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: Spec defines the desired state of GatewayClass.
- properties:
- controllerName:
- description: |-
- ControllerName is the name of the controller that is managing Gateways of
- this class. The value of this field MUST be a domain prefixed path.
-
- Example: "example.net/gateway-controller".
-
- This field is not mutable and cannot be empty.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
- type: string
- x-kubernetes-validations:
- - message: Value is immutable
- rule: self == oldSelf
- description:
- description: Description helps describe a GatewayClass with more details.
- maxLength: 64
- type: string
- parametersRef:
- description: |-
- ParametersRef is a reference to a resource that contains the configuration
- parameters corresponding to the GatewayClass. This is optional if the
- controller does not require any additional configuration.
-
- ParametersRef can reference a standard Kubernetes resource, i.e. ConfigMap,
- or an implementation-specific custom resource. The resource can be
- cluster-scoped or namespace-scoped.
-
- If the referent cannot be found, refers to an unsupported kind, or when
- the data within that resource is malformed, the GatewayClass SHOULD be
- rejected with the "Accepted" status condition set to "False" and an
- "InvalidParameters" reason.
-
- A Gateway for this GatewayClass may provide its own `parametersRef`. When both are specified,
- the merging behavior is implementation specific.
- It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway.
-
- Support: Implementation-specific
- properties:
- group:
- description: Group is the group of the referent.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is kind of the referent.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referent.
- This field is required when referring to a Namespace-scoped resource and
- MUST be unset when referring to a Cluster-scoped resource.
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- required:
- - group
- - kind
- - name
- type: object
- required:
- - controllerName
- type: object
- status:
- default:
- conditions:
- - lastTransitionTime: "1970-01-01T00:00:00Z"
- message: Waiting for controller
- reason: Pending
- status: Unknown
- type: Accepted
- description: |-
- Status defines the current state of GatewayClass.
-
- Implementations MUST populate status on all GatewayClass resources which
- specify their controller name.
- properties:
- conditions:
- default:
- - lastTransitionTime: "1970-01-01T00:00:00Z"
- message: Waiting for controller
- reason: Pending
- status: Unknown
- type: Accepted
- description: |-
- Conditions is the current status from the controller for
- this GatewayClass.
-
- Controllers should prefer to publish conditions using values
- of GatewayClassConditionType for the type of each Condition.
- items:
- description: Condition contains details for one aspect of the current
- state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False, Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- maxItems: 8
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- type: object
- required:
- - spec
- type: object
- served: true
- storage: true
- subresources:
- status: {}
- - additionalPrinterColumns:
- - jsonPath: .spec.controllerName
- name: Controller
- type: string
- - jsonPath: .status.conditions[?(@.type=="Accepted")].status
- name: Accepted
- type: string
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- - jsonPath: .spec.description
- name: Description
- priority: 1
- type: string
- name: v1beta1
- schema:
- openAPIV3Schema:
- description: |-
- GatewayClass describes a class of Gateways available to the user for creating
- Gateway resources.
-
- It is recommended that this resource be used as a template for Gateways. This
- means that a Gateway is based on the state of the GatewayClass at the time it
- was created and changes to the GatewayClass or associated parameters are not
- propagated down to existing Gateways. This recommendation is intended to
- limit the blast radius of changes to GatewayClass or associated parameters.
- If implementations choose to propagate GatewayClass changes to existing
- Gateways, that MUST be clearly documented by the implementation.
-
- Whenever one or more Gateways are using a GatewayClass, implementations SHOULD
- add the `gateway-exists-finalizer.gateway.networking.k8s.io` finalizer on the
- associated GatewayClass. This ensures that a GatewayClass associated with a
- Gateway is not deleted while in use.
-
- GatewayClass is a Cluster level resource.
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: Spec defines the desired state of GatewayClass.
- properties:
- controllerName:
- description: |-
- ControllerName is the name of the controller that is managing Gateways of
- this class. The value of this field MUST be a domain prefixed path.
-
- Example: "example.net/gateway-controller".
-
- This field is not mutable and cannot be empty.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
- type: string
- x-kubernetes-validations:
- - message: Value is immutable
- rule: self == oldSelf
- description:
- description: Description helps describe a GatewayClass with more details.
- maxLength: 64
- type: string
- parametersRef:
- description: |-
- ParametersRef is a reference to a resource that contains the configuration
- parameters corresponding to the GatewayClass. This is optional if the
- controller does not require any additional configuration.
-
- ParametersRef can reference a standard Kubernetes resource, i.e. ConfigMap,
- or an implementation-specific custom resource. The resource can be
- cluster-scoped or namespace-scoped.
-
- If the referent cannot be found, refers to an unsupported kind, or when
- the data within that resource is malformed, the GatewayClass SHOULD be
- rejected with the "Accepted" status condition set to "False" and an
- "InvalidParameters" reason.
-
- A Gateway for this GatewayClass may provide its own `parametersRef`. When both are specified,
- the merging behavior is implementation specific.
- It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway.
-
- Support: Implementation-specific
- properties:
- group:
- description: Group is the group of the referent.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is kind of the referent.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referent.
- This field is required when referring to a Namespace-scoped resource and
- MUST be unset when referring to a Cluster-scoped resource.
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- required:
- - group
- - kind
- - name
- type: object
- required:
- - controllerName
- type: object
- status:
- default:
- conditions:
- - lastTransitionTime: "1970-01-01T00:00:00Z"
- message: Waiting for controller
- reason: Pending
- status: Unknown
- type: Accepted
- description: |-
- Status defines the current state of GatewayClass.
-
- Implementations MUST populate status on all GatewayClass resources which
- specify their controller name.
- properties:
- conditions:
- default:
- - lastTransitionTime: "1970-01-01T00:00:00Z"
- message: Waiting for controller
- reason: Pending
- status: Unknown
- type: Accepted
- description: |-
- Conditions is the current status from the controller for
- this GatewayClass.
-
- Controllers should prefer to publish conditions using values
- of GatewayClassConditionType for the type of each Condition.
- items:
- description: Condition contains details for one aspect of the current
- state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False, Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- maxItems: 8
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- type: object
- required:
- - spec
- type: object
- served: true
- storage: false
- subresources:
- status: {}
-status:
- acceptedNames:
- kind: ""
- plural: ""
- conditions: null
- storedVersions: null
----
-#
-# config/crd/standard/gateway.networking.k8s.io_gateways.yaml
-#
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
- gateway.networking.k8s.io/bundle-version: v1.2.1
- gateway.networking.k8s.io/channel: standard
- creationTimestamp: null
- name: gateways.gateway.networking.k8s.io
-spec:
- group: gateway.networking.k8s.io
- names:
- categories:
- - gateway-api
- kind: Gateway
- listKind: GatewayList
- plural: gateways
- shortNames:
- - gtw
- singular: gateway
- scope: Namespaced
- versions:
- - additionalPrinterColumns:
- - jsonPath: .spec.gatewayClassName
- name: Class
- type: string
- - jsonPath: .status.addresses[*].value
- name: Address
- type: string
- - jsonPath: .status.conditions[?(@.type=="Programmed")].status
- name: Programmed
- type: string
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- name: v1
- schema:
- openAPIV3Schema:
- description: |-
- Gateway represents an instance of a service-traffic handling infrastructure
- by binding Listeners to a set of IP addresses.
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: Spec defines the desired state of Gateway.
- properties:
- addresses:
- description: |+
- Addresses requested for this Gateway. This is optional and behavior can
- depend on the implementation. If a value is set in the spec and the
- requested address is invalid or unavailable, the implementation MUST
- indicate this in the associated entry in GatewayStatus.Addresses.
-
- The Addresses field represents a request for the address(es) on the
- "outside of the Gateway", that traffic bound for this Gateway will use.
- This could be the IP address or hostname of an external load balancer or
- other networking infrastructure, or some other address that traffic will
- be sent to.
-
- If no Addresses are specified, the implementation MAY schedule the
- Gateway in an implementation-specific manner, assigning an appropriate
- set of Addresses.
-
- The implementation MUST bind all Listeners to every GatewayAddress that
- it assigns to the Gateway and add a corresponding entry in
- GatewayStatus.Addresses.
-
- Support: Extended
-
- items:
- description: GatewayAddress describes an address that can be bound
- to a Gateway.
- oneOf:
- - properties:
- type:
- enum:
- - IPAddress
- value:
- anyOf:
- - format: ipv4
- - format: ipv6
- - properties:
- type:
- not:
- enum:
- - IPAddress
- properties:
- type:
- default: IPAddress
- description: Type of the address.
- maxLength: 253
- minLength: 1
- pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
- type: string
- value:
- description: |-
- Value of the address. The validity of the values will depend
- on the type and support by the controller.
-
- Examples: `1.2.3.4`, `128::1`, `my-ip-address`.
- maxLength: 253
- minLength: 1
- type: string
- required:
- - value
- type: object
- x-kubernetes-validations:
- - message: Hostname value must only contain valid characters (matching
- ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)
- rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""):
- true'
- maxItems: 16
- type: array
- x-kubernetes-validations:
- - message: IPAddress values must be unique
- rule: 'self.all(a1, a1.type == ''IPAddress'' ? self.exists_one(a2,
- a2.type == a1.type && a2.value == a1.value) : true )'
- - message: Hostname values must be unique
- rule: 'self.all(a1, a1.type == ''Hostname'' ? self.exists_one(a2,
- a2.type == a1.type && a2.value == a1.value) : true )'
- gatewayClassName:
- description: |-
- GatewayClassName used for this Gateway. This is the name of a
- GatewayClass resource.
- maxLength: 253
- minLength: 1
- type: string
- infrastructure:
- description: |-
- Infrastructure defines infrastructure level attributes about this Gateway instance.
-
- Support: Extended
- properties:
- annotations:
- additionalProperties:
- description: |-
- AnnotationValue is the value of an annotation in Gateway API. This is used
- for validation of maps such as TLS options. This roughly matches Kubernetes
- annotation validation, although the length validation in that case is based
- on the entire size of the annotations struct.
- maxLength: 4096
- minLength: 0
- type: string
- description: |-
- Annotations that SHOULD be applied to any resources created in response to this Gateway.
-
- For implementations creating other Kubernetes objects, this should be the `metadata.annotations` field on resources.
- For other implementations, this refers to any relevant (implementation specific) "annotations" concepts.
-
- An implementation may chose to add additional implementation-specific annotations as they see fit.
-
- Support: Extended
- maxProperties: 8
- type: object
- x-kubernetes-validations:
- - message: Annotation keys must be in the form of an optional
- DNS subdomain prefix followed by a required name segment of
- up to 63 characters.
- rule: self.all(key, key.matches(r"""^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9]$"""))
- - message: If specified, the annotation key's prefix must be a
- DNS subdomain not longer than 253 characters in total.
- rule: self.all(key, key.split("/")[0].size() < 253)
- labels:
- additionalProperties:
- description: |-
- LabelValue is the value of a label in the Gateway API. This is used for validation
- of maps such as Gateway infrastructure labels. This matches the Kubernetes
- label validation rules:
- * must be 63 characters or less (can be empty),
- * unless empty, must begin and end with an alphanumeric character ([a-z0-9A-Z]),
- * could contain dashes (-), underscores (_), dots (.), and alphanumerics between.
-
- Valid values include:
-
- * MyValue
- * my.name
- * 123-my-value
- maxLength: 63
- minLength: 0
- pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
- type: string
- description: |-
- Labels that SHOULD be applied to any resources created in response to this Gateway.
-
- For implementations creating other Kubernetes objects, this should be the `metadata.labels` field on resources.
- For other implementations, this refers to any relevant (implementation specific) "labels" concepts.
-
- An implementation may chose to add additional implementation-specific labels as they see fit.
-
- If an implementation maps these labels to Pods, or any other resource that would need to be recreated when labels
- change, it SHOULD clearly warn about this behavior in documentation.
-
- Support: Extended
- maxProperties: 8
- type: object
- x-kubernetes-validations:
- - message: Label keys must be in the form of an optional DNS subdomain
- prefix followed by a required name segment of up to 63 characters.
- rule: self.all(key, key.matches(r"""^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9]$"""))
- - message: If specified, the label key's prefix must be a DNS
- subdomain not longer than 253 characters in total.
- rule: self.all(key, key.split("/")[0].size() < 253)
- parametersRef:
- description: |-
- ParametersRef is a reference to a resource that contains the configuration
- parameters corresponding to the Gateway. This is optional if the
- controller does not require any additional configuration.
-
- This follows the same semantics as GatewayClass's `parametersRef`, but on a per-Gateway basis
-
- The Gateway's GatewayClass may provide its own `parametersRef`. When both are specified,
- the merging behavior is implementation specific.
- It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway.
-
- Support: Implementation-specific
- properties:
- group:
- description: Group is the group of the referent.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is kind of the referent.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- required:
- - group
- - kind
- - name
- type: object
- type: object
- listeners:
- description: |-
- Listeners associated with this Gateway. Listeners define
- logical endpoints that are bound on this Gateway's addresses.
- At least one Listener MUST be specified.
-
- Each Listener in a set of Listeners (for example, in a single Gateway)
- MUST be _distinct_, in that a traffic flow MUST be able to be assigned to
- exactly one listener. (This section uses "set of Listeners" rather than
- "Listeners in a single Gateway" because implementations MAY merge configuration
- from multiple Gateways onto a single data plane, and these rules _also_
- apply in that case).
-
- Practically, this means that each listener in a set MUST have a unique
- combination of Port, Protocol, and, if supported by the protocol, Hostname.
-
- Some combinations of port, protocol, and TLS settings are considered
- Core support and MUST be supported by implementations based on their
- targeted conformance profile:
-
- HTTP Profile
-
- 1. HTTPRoute, Port: 80, Protocol: HTTP
- 2. HTTPRoute, Port: 443, Protocol: HTTPS, TLS Mode: Terminate, TLS keypair provided
-
- TLS Profile
-
- 1. TLSRoute, Port: 443, Protocol: TLS, TLS Mode: Passthrough
-
- "Distinct" Listeners have the following property:
-
- The implementation can match inbound requests to a single distinct
- Listener. When multiple Listeners share values for fields (for
- example, two Listeners with the same Port value), the implementation
- can match requests to only one of the Listeners using other
- Listener fields.
-
- For example, the following Listener scenarios are distinct:
-
- 1. Multiple Listeners with the same Port that all use the "HTTP"
- Protocol that all have unique Hostname values.
- 2. Multiple Listeners with the same Port that use either the "HTTPS" or
- "TLS" Protocol that all have unique Hostname values.
- 3. A mixture of "TCP" and "UDP" Protocol Listeners, where no Listener
- with the same Protocol has the same Port value.
-
- Some fields in the Listener struct have possible values that affect
- whether the Listener is distinct. Hostname is particularly relevant
- for HTTP or HTTPS protocols.
-
- When using the Hostname value to select between same-Port, same-Protocol
- Listeners, the Hostname value must be different on each Listener for the
- Listener to be distinct.
-
- When the Listeners are distinct based on Hostname, inbound request
- hostnames MUST match from the most specific to least specific Hostname
- values to choose the correct Listener and its associated set of Routes.
-
- Exact matches must be processed before wildcard matches, and wildcard
- matches must be processed before fallback (empty Hostname value)
- matches. For example, `"foo.example.com"` takes precedence over
- `"*.example.com"`, and `"*.example.com"` takes precedence over `""`.
-
- Additionally, if there are multiple wildcard entries, more specific
- wildcard entries must be processed before less specific wildcard entries.
- For example, `"*.foo.example.com"` takes precedence over `"*.example.com"`.
- The precise definition here is that the higher the number of dots in the
- hostname to the right of the wildcard character, the higher the precedence.
-
- The wildcard character will match any number of characters _and dots_ to
- the left, however, so `"*.example.com"` will match both
- `"foo.bar.example.com"` _and_ `"bar.example.com"`.
-
- If a set of Listeners contains Listeners that are not distinct, then those
- Listeners are Conflicted, and the implementation MUST set the "Conflicted"
- condition in the Listener Status to "True".
-
- Implementations MAY choose to accept a Gateway with some Conflicted
- Listeners only if they only accept the partial Listener set that contains
- no Conflicted Listeners. To put this another way, implementations may
- accept a partial Listener set only if they throw out *all* the conflicting
- Listeners. No picking one of the conflicting listeners as the winner.
- This also means that the Gateway must have at least one non-conflicting
- Listener in this case, otherwise it violates the requirement that at
- least one Listener must be present.
-
- The implementation MUST set a "ListenersNotValid" condition on the
- Gateway Status when the Gateway contains Conflicted Listeners whether or
- not they accept the Gateway. That Condition SHOULD clearly
- indicate in the Message which Listeners are conflicted, and which are
- Accepted. Additionally, the Listener status for those listeners SHOULD
- indicate which Listeners are conflicted and not Accepted.
-
- A Gateway's Listeners are considered "compatible" if:
-
- 1. They are distinct.
- 2. The implementation can serve them in compliance with the Addresses
- requirement that all Listeners are available on all assigned
- addresses.
-
- Compatible combinations in Extended support are expected to vary across
- implementations. A combination that is compatible for one implementation
- may not be compatible for another.
-
- For example, an implementation that cannot serve both TCP and UDP listeners
- on the same address, or cannot mix HTTPS and generic TLS listens on the same port
- would not consider those cases compatible, even though they are distinct.
-
- Note that requests SHOULD match at most one Listener. For example, if
- Listeners are defined for "foo.example.com" and "*.example.com", a
- request to "foo.example.com" SHOULD only be routed using routes attached
- to the "foo.example.com" Listener (and not the "*.example.com" Listener).
- This concept is known as "Listener Isolation". Implementations that do
- not support Listener Isolation MUST clearly document this.
-
- Implementations MAY merge separate Gateways onto a single set of
- Addresses if all Listeners across all Gateways are compatible.
-
- Support: Core
- items:
- description: |-
- Listener embodies the concept of a logical endpoint where a Gateway accepts
- network connections.
- properties:
- allowedRoutes:
- default:
- namespaces:
- from: Same
- description: |-
- AllowedRoutes defines the types of routes that MAY be attached to a
- Listener and the trusted namespaces where those Route resources MAY be
- present.
-
- Although a client request may match multiple route rules, only one rule
- may ultimately receive the request. Matching precedence MUST be
- determined in order of the following criteria:
-
- * The most specific match as defined by the Route type.
- * The oldest Route based on creation timestamp. For example, a Route with
- a creation timestamp of "2020-09-08 01:02:03" is given precedence over
- a Route with a creation timestamp of "2020-09-08 01:02:04".
- * If everything else is equivalent, the Route appearing first in
- alphabetical order (namespace/name) should be given precedence. For
- example, foo/bar is given precedence over foo/baz.
-
- All valid rules within a Route attached to this Listener should be
- implemented. Invalid Route rules can be ignored (sometimes that will mean
- the full Route). If a Route rule transitions from valid to invalid,
- support for that Route rule should be dropped to ensure consistency. For
- example, even if a filter specified by a Route rule is invalid, the rest
- of the rules within that Route should still be supported.
-
- Support: Core
- properties:
- kinds:
- description: |-
- Kinds specifies the groups and kinds of Routes that are allowed to bind
- to this Gateway Listener. When unspecified or empty, the kinds of Routes
- selected are determined using the Listener protocol.
-
- A RouteGroupKind MUST correspond to kinds of Routes that are compatible
- with the application protocol specified in the Listener's Protocol field.
- If an implementation does not support or recognize this resource type, it
- MUST set the "ResolvedRefs" condition to False for this Listener with the
- "InvalidRouteKinds" reason.
-
- Support: Core
- items:
- description: RouteGroupKind indicates the group and kind
- of a Route resource.
- properties:
- group:
- default: gateway.networking.k8s.io
- description: Group is the group of the Route.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is the kind of the Route.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- required:
- - kind
- type: object
- maxItems: 8
- type: array
- namespaces:
- default:
- from: Same
- description: |-
- Namespaces indicates namespaces from which Routes may be attached to this
- Listener. This is restricted to the namespace of this Gateway by default.
-
- Support: Core
- properties:
- from:
- default: Same
- description: |-
- From indicates where Routes will be selected for this Gateway. Possible
- values are:
-
- * All: Routes in all namespaces may be used by this Gateway.
- * Selector: Routes in namespaces selected by the selector may be used by
- this Gateway.
- * Same: Only Routes in the same namespace may be used by this Gateway.
-
- Support: Core
- enum:
- - All
- - Selector
- - Same
- type: string
- selector:
- description: |-
- Selector must be specified when From is set to "Selector". In that case,
- only Routes in Namespaces matching this Selector will be selected by this
- Gateway. This field is ignored for other values of "From".
-
- Support: Core
- properties:
- matchExpressions:
- description: matchExpressions is a list of label
- selector requirements. The requirements are ANDed.
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- properties:
- key:
- description: key is the label key that the
- selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- items:
- type: string
- type: array
- x-kubernetes-list-type: atomic
- required:
- - key
- - operator
- type: object
- type: array
- x-kubernetes-list-type: atomic
- matchLabels:
- additionalProperties:
- type: string
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- type: object
- x-kubernetes-map-type: atomic
- type: object
- type: object
- hostname:
- description: |-
- Hostname specifies the virtual hostname to match for protocol types that
- define this concept. When unspecified, all hostnames are matched. This
- field is ignored for protocols that don't require hostname based
- matching.
-
- Implementations MUST apply Hostname matching appropriately for each of
- the following protocols:
-
- * TLS: The Listener Hostname MUST match the SNI.
- * HTTP: The Listener Hostname MUST match the Host header of the request.
- * HTTPS: The Listener Hostname SHOULD match at both the TLS and HTTP
- protocol layers as described above. If an implementation does not
- ensure that both the SNI and Host header match the Listener hostname,
- it MUST clearly document that.
-
- For HTTPRoute and TLSRoute resources, there is an interaction with the
- `spec.hostnames` array. When both listener and route specify hostnames,
- there MUST be an intersection between the values for a Route to be
- accepted. For more information, refer to the Route specific Hostnames
- documentation.
-
- Hostnames that are prefixed with a wildcard label (`*.`) are interpreted
- as a suffix match. That means that a match for `*.example.com` would match
- both `test.example.com`, and `foo.test.example.com`, but not `example.com`.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- name:
- description: |-
- Name is the name of the Listener. This name MUST be unique within a
- Gateway.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- port:
- description: |-
- Port is the network port. Multiple listeners may use the
- same port, subject to the Listener compatibility rules.
-
- Support: Core
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- protocol:
- description: |-
- Protocol specifies the network protocol this listener expects to receive.
-
- Support: Core
- maxLength: 255
- minLength: 1
- pattern: ^[a-zA-Z0-9]([-a-zA-Z0-9]*[a-zA-Z0-9])?$|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9]+$
- type: string
- tls:
- description: |-
- TLS is the TLS configuration for the Listener. This field is required if
- the Protocol field is "HTTPS" or "TLS". It is invalid to set this field
- if the Protocol field is "HTTP", "TCP", or "UDP".
-
- The association of SNIs to Certificate defined in GatewayTLSConfig is
- defined based on the Hostname field for this listener.
-
- The GatewayClass MUST use the longest matching SNI out of all
- available certificates for any TLS handshake.
-
- Support: Core
- properties:
- certificateRefs:
- description: |-
- CertificateRefs contains a series of references to Kubernetes objects that
- contains TLS certificates and private keys. These certificates are used to
- establish a TLS handshake for requests that match the hostname of the
- associated listener.
-
- A single CertificateRef to a Kubernetes Secret has "Core" support.
- Implementations MAY choose to support attaching multiple certificates to
- a Listener, but this behavior is implementation-specific.
-
- References to a resource in different namespace are invalid UNLESS there
- is a ReferenceGrant in the target namespace that allows the certificate
- to be attached. If a ReferenceGrant does not allow this reference, the
- "ResolvedRefs" condition MUST be set to False for this listener with the
- "RefNotPermitted" reason.
-
- This field is required to have at least one element when the mode is set
- to "Terminate" (default) and is optional otherwise.
-
- CertificateRefs can reference to standard Kubernetes resources, i.e.
- Secret, or implementation-specific custom resources.
-
- Support: Core - A single reference to a Kubernetes Secret of type kubernetes.io/tls
-
- Support: Implementation-specific (More than one reference or other resource types)
- items:
- description: |-
- SecretObjectReference identifies an API object including its namespace,
- defaulting to Secret.
-
- The API object must be valid in the cluster; the Group and Kind must
- be registered in the cluster for this reference to be valid.
-
- References to objects with invalid Group and Kind are not valid, and must
- be rejected by the implementation, with appropriate Conditions set
- on the containing object.
- properties:
- group:
- default: ""
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Secret
- description: Kind is kind of the referent. For example
- "Secret".
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referenced object. When unspecified, the local
- namespace is inferred.
-
- Note that when a namespace different than the local namespace is specified,
- a ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- required:
- - name
- type: object
- maxItems: 64
- type: array
- mode:
- default: Terminate
- description: |-
- Mode defines the TLS behavior for the TLS session initiated by the client.
- There are two possible modes:
-
- - Terminate: The TLS session between the downstream client and the
- Gateway is terminated at the Gateway. This mode requires certificates
- to be specified in some way, such as populating the certificateRefs
- field.
- - Passthrough: The TLS session is NOT terminated by the Gateway. This
- implies that the Gateway can't decipher the TLS stream except for
- the ClientHello message of the TLS protocol. The certificateRefs field
- is ignored in this mode.
-
- Support: Core
- enum:
- - Terminate
- - Passthrough
- type: string
- options:
- additionalProperties:
- description: |-
- AnnotationValue is the value of an annotation in Gateway API. This is used
- for validation of maps such as TLS options. This roughly matches Kubernetes
- annotation validation, although the length validation in that case is based
- on the entire size of the annotations struct.
- maxLength: 4096
- minLength: 0
- type: string
- description: |-
- Options are a list of key/value pairs to enable extended TLS
- configuration for each implementation. For example, configuring the
- minimum TLS version or supported cipher suites.
-
- A set of common keys MAY be defined by the API in the future. To avoid
- any ambiguity, implementation-specific definitions MUST use
- domain-prefixed names, such as `example.com/my-custom-option`.
- Un-prefixed names are reserved for key names defined by Gateway API.
-
- Support: Implementation-specific
- maxProperties: 16
- type: object
- type: object
- x-kubernetes-validations:
- - message: certificateRefs or options must be specified when
- mode is Terminate
- rule: 'self.mode == ''Terminate'' ? size(self.certificateRefs)
- > 0 || size(self.options) > 0 : true'
- required:
- - name
- - port
- - protocol
- type: object
- maxItems: 64
- minItems: 1
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- x-kubernetes-validations:
- - message: tls must not be specified for protocols ['HTTP', 'TCP',
- 'UDP']
- rule: 'self.all(l, l.protocol in [''HTTP'', ''TCP'', ''UDP''] ?
- !has(l.tls) : true)'
- - message: tls mode must be Terminate for protocol HTTPS
- rule: 'self.all(l, (l.protocol == ''HTTPS'' && has(l.tls)) ? (l.tls.mode
- == '''' || l.tls.mode == ''Terminate'') : true)'
- - message: hostname must not be specified for protocols ['TCP', 'UDP']
- rule: 'self.all(l, l.protocol in [''TCP'', ''UDP''] ? (!has(l.hostname)
- || l.hostname == '''') : true)'
- - message: Listener name must be unique within the Gateway
- rule: self.all(l1, self.exists_one(l2, l1.name == l2.name))
- - message: Combination of port, protocol and hostname must be unique
- for each listener
- rule: 'self.all(l1, self.exists_one(l2, l1.port == l2.port && l1.protocol
- == l2.protocol && (has(l1.hostname) && has(l2.hostname) ? l1.hostname
- == l2.hostname : !has(l1.hostname) && !has(l2.hostname))))'
- required:
- - gatewayClassName
- - listeners
- type: object
- status:
- default:
- conditions:
- - lastTransitionTime: "1970-01-01T00:00:00Z"
- message: Waiting for controller
- reason: Pending
- status: Unknown
- type: Accepted
- - lastTransitionTime: "1970-01-01T00:00:00Z"
- message: Waiting for controller
- reason: Pending
- status: Unknown
- type: Programmed
- description: Status defines the current state of Gateway.
- properties:
- addresses:
- description: |+
- Addresses lists the network addresses that have been bound to the
- Gateway.
-
- This list may differ from the addresses provided in the spec under some
- conditions:
-
- * no addresses are specified, all addresses are dynamically assigned
- * a combination of specified and dynamic addresses are assigned
- * a specified address was unusable (e.g. already in use)
-
- items:
- description: GatewayStatusAddress describes a network address that
- is bound to a Gateway.
- oneOf:
- - properties:
- type:
- enum:
- - IPAddress
- value:
- anyOf:
- - format: ipv4
- - format: ipv6
- - properties:
- type:
- not:
- enum:
- - IPAddress
- properties:
- type:
- default: IPAddress
- description: Type of the address.
- maxLength: 253
- minLength: 1
- pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
- type: string
- value:
- description: |-
- Value of the address. The validity of the values will depend
- on the type and support by the controller.
-
- Examples: `1.2.3.4`, `128::1`, `my-ip-address`.
- maxLength: 253
- minLength: 1
- type: string
- required:
- - value
- type: object
- x-kubernetes-validations:
- - message: Hostname value must only contain valid characters (matching
- ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)
- rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""):
- true'
- maxItems: 16
- type: array
- conditions:
- default:
- - lastTransitionTime: "1970-01-01T00:00:00Z"
- message: Waiting for controller
- reason: Pending
- status: Unknown
- type: Accepted
- - lastTransitionTime: "1970-01-01T00:00:00Z"
- message: Waiting for controller
- reason: Pending
- status: Unknown
- type: Programmed
- description: |-
- Conditions describe the current conditions of the Gateway.
-
- Implementations should prefer to express Gateway conditions
- using the `GatewayConditionType` and `GatewayConditionReason`
- constants so that operators and tools can converge on a common
- vocabulary to describe Gateway state.
-
- Known condition types are:
-
- * "Accepted"
- * "Programmed"
- * "Ready"
- items:
- description: Condition contains details for one aspect of the current
- state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False, Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- maxItems: 8
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- listeners:
- description: Listeners provide status for each unique listener port
- defined in the Spec.
- items:
- description: ListenerStatus is the status associated with a Listener.
- properties:
- attachedRoutes:
- description: |-
- AttachedRoutes represents the total number of Routes that have been
- successfully attached to this Listener.
-
- Successful attachment of a Route to a Listener is based solely on the
- combination of the AllowedRoutes field on the corresponding Listener
- and the Route's ParentRefs field. A Route is successfully attached to
- a Listener when it is selected by the Listener's AllowedRoutes field
- AND the Route has a valid ParentRef selecting the whole Gateway
- resource or a specific Listener as a parent resource (more detail on
- attachment semantics can be found in the documentation on the various
- Route kinds ParentRefs fields). Listener or Route status does not impact
- successful attachment, i.e. the AttachedRoutes field count MUST be set
- for Listeners with condition Accepted: false and MUST count successfully
- attached Routes that may themselves have Accepted: false conditions.
-
- Uses for this field include troubleshooting Route attachment and
- measuring blast radius/impact of changes to a Listener.
- format: int32
- type: integer
- conditions:
- description: Conditions describe the current condition of this
- listener.
- items:
- description: Condition contains details for one aspect of
- the current state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False,
- Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- maxItems: 8
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- name:
- description: Name is the name of the Listener that this status
- corresponds to.
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- supportedKinds:
- description: |-
- SupportedKinds is the list indicating the Kinds supported by this
- listener. This MUST represent the kinds an implementation supports for
- that Listener configuration.
-
- If kinds are specified in Spec that are not supported, they MUST NOT
- appear in this list and an implementation MUST set the "ResolvedRefs"
- condition to "False" with the "InvalidRouteKinds" reason. If both valid
- and invalid Route kinds are specified, the implementation MUST
- reference the valid Route kinds that have been specified.
- items:
- description: RouteGroupKind indicates the group and kind of
- a Route resource.
- properties:
- group:
- default: gateway.networking.k8s.io
- description: Group is the group of the Route.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is the kind of the Route.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- required:
- - kind
- type: object
- maxItems: 8
- type: array
- required:
- - attachedRoutes
- - conditions
- - name
- - supportedKinds
- type: object
- maxItems: 64
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- required:
- - spec
- type: object
- served: true
- storage: true
- subresources:
- status: {}
- - additionalPrinterColumns:
- - jsonPath: .spec.gatewayClassName
- name: Class
- type: string
- - jsonPath: .status.addresses[*].value
- name: Address
- type: string
- - jsonPath: .status.conditions[?(@.type=="Programmed")].status
- name: Programmed
- type: string
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- name: v1beta1
- schema:
- openAPIV3Schema:
- description: |-
- Gateway represents an instance of a service-traffic handling infrastructure
- by binding Listeners to a set of IP addresses.
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: Spec defines the desired state of Gateway.
- properties:
- addresses:
- description: |+
- Addresses requested for this Gateway. This is optional and behavior can
- depend on the implementation. If a value is set in the spec and the
- requested address is invalid or unavailable, the implementation MUST
- indicate this in the associated entry in GatewayStatus.Addresses.
-
- The Addresses field represents a request for the address(es) on the
- "outside of the Gateway", that traffic bound for this Gateway will use.
- This could be the IP address or hostname of an external load balancer or
- other networking infrastructure, or some other address that traffic will
- be sent to.
-
- If no Addresses are specified, the implementation MAY schedule the
- Gateway in an implementation-specific manner, assigning an appropriate
- set of Addresses.
-
- The implementation MUST bind all Listeners to every GatewayAddress that
- it assigns to the Gateway and add a corresponding entry in
- GatewayStatus.Addresses.
-
- Support: Extended
-
- items:
- description: GatewayAddress describes an address that can be bound
- to a Gateway.
- oneOf:
- - properties:
- type:
- enum:
- - IPAddress
- value:
- anyOf:
- - format: ipv4
- - format: ipv6
- - properties:
- type:
- not:
- enum:
- - IPAddress
- properties:
- type:
- default: IPAddress
- description: Type of the address.
- maxLength: 253
- minLength: 1
- pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
- type: string
- value:
- description: |-
- Value of the address. The validity of the values will depend
- on the type and support by the controller.
-
- Examples: `1.2.3.4`, `128::1`, `my-ip-address`.
- maxLength: 253
- minLength: 1
- type: string
- required:
- - value
- type: object
- x-kubernetes-validations:
- - message: Hostname value must only contain valid characters (matching
- ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)
- rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""):
- true'
- maxItems: 16
- type: array
- x-kubernetes-validations:
- - message: IPAddress values must be unique
- rule: 'self.all(a1, a1.type == ''IPAddress'' ? self.exists_one(a2,
- a2.type == a1.type && a2.value == a1.value) : true )'
- - message: Hostname values must be unique
- rule: 'self.all(a1, a1.type == ''Hostname'' ? self.exists_one(a2,
- a2.type == a1.type && a2.value == a1.value) : true )'
- gatewayClassName:
- description: |-
- GatewayClassName used for this Gateway. This is the name of a
- GatewayClass resource.
- maxLength: 253
- minLength: 1
- type: string
- infrastructure:
- description: |-
- Infrastructure defines infrastructure level attributes about this Gateway instance.
-
- Support: Extended
- properties:
- annotations:
- additionalProperties:
- description: |-
- AnnotationValue is the value of an annotation in Gateway API. This is used
- for validation of maps such as TLS options. This roughly matches Kubernetes
- annotation validation, although the length validation in that case is based
- on the entire size of the annotations struct.
- maxLength: 4096
- minLength: 0
- type: string
- description: |-
- Annotations that SHOULD be applied to any resources created in response to this Gateway.
-
- For implementations creating other Kubernetes objects, this should be the `metadata.annotations` field on resources.
- For other implementations, this refers to any relevant (implementation specific) "annotations" concepts.
-
- An implementation may chose to add additional implementation-specific annotations as they see fit.
-
- Support: Extended
- maxProperties: 8
- type: object
- x-kubernetes-validations:
- - message: Annotation keys must be in the form of an optional
- DNS subdomain prefix followed by a required name segment of
- up to 63 characters.
- rule: self.all(key, key.matches(r"""^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9]$"""))
- - message: If specified, the annotation key's prefix must be a
- DNS subdomain not longer than 253 characters in total.
- rule: self.all(key, key.split("/")[0].size() < 253)
- labels:
- additionalProperties:
- description: |-
- LabelValue is the value of a label in the Gateway API. This is used for validation
- of maps such as Gateway infrastructure labels. This matches the Kubernetes
- label validation rules:
- * must be 63 characters or less (can be empty),
- * unless empty, must begin and end with an alphanumeric character ([a-z0-9A-Z]),
- * could contain dashes (-), underscores (_), dots (.), and alphanumerics between.
-
- Valid values include:
-
- * MyValue
- * my.name
- * 123-my-value
- maxLength: 63
- minLength: 0
- pattern: ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$
- type: string
- description: |-
- Labels that SHOULD be applied to any resources created in response to this Gateway.
-
- For implementations creating other Kubernetes objects, this should be the `metadata.labels` field on resources.
- For other implementations, this refers to any relevant (implementation specific) "labels" concepts.
-
- An implementation may chose to add additional implementation-specific labels as they see fit.
-
- If an implementation maps these labels to Pods, or any other resource that would need to be recreated when labels
- change, it SHOULD clearly warn about this behavior in documentation.
-
- Support: Extended
- maxProperties: 8
- type: object
- x-kubernetes-validations:
- - message: Label keys must be in the form of an optional DNS subdomain
- prefix followed by a required name segment of up to 63 characters.
- rule: self.all(key, key.matches(r"""^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?([A-Za-z0-9][-A-Za-z0-9_.]{0,61})?[A-Za-z0-9]$"""))
- - message: If specified, the label key's prefix must be a DNS
- subdomain not longer than 253 characters in total.
- rule: self.all(key, key.split("/")[0].size() < 253)
- parametersRef:
- description: |-
- ParametersRef is a reference to a resource that contains the configuration
- parameters corresponding to the Gateway. This is optional if the
- controller does not require any additional configuration.
-
- This follows the same semantics as GatewayClass's `parametersRef`, but on a per-Gateway basis
-
- The Gateway's GatewayClass may provide its own `parametersRef`. When both are specified,
- the merging behavior is implementation specific.
- It is generally recommended that GatewayClass provides defaults that can be overridden by a Gateway.
-
- Support: Implementation-specific
- properties:
- group:
- description: Group is the group of the referent.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is kind of the referent.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- required:
- - group
- - kind
- - name
- type: object
- type: object
- listeners:
- description: |-
- Listeners associated with this Gateway. Listeners define
- logical endpoints that are bound on this Gateway's addresses.
- At least one Listener MUST be specified.
-
- Each Listener in a set of Listeners (for example, in a single Gateway)
- MUST be _distinct_, in that a traffic flow MUST be able to be assigned to
- exactly one listener. (This section uses "set of Listeners" rather than
- "Listeners in a single Gateway" because implementations MAY merge configuration
- from multiple Gateways onto a single data plane, and these rules _also_
- apply in that case).
-
- Practically, this means that each listener in a set MUST have a unique
- combination of Port, Protocol, and, if supported by the protocol, Hostname.
-
- Some combinations of port, protocol, and TLS settings are considered
- Core support and MUST be supported by implementations based on their
- targeted conformance profile:
-
- HTTP Profile
-
- 1. HTTPRoute, Port: 80, Protocol: HTTP
- 2. HTTPRoute, Port: 443, Protocol: HTTPS, TLS Mode: Terminate, TLS keypair provided
-
- TLS Profile
-
- 1. TLSRoute, Port: 443, Protocol: TLS, TLS Mode: Passthrough
-
- "Distinct" Listeners have the following property:
-
- The implementation can match inbound requests to a single distinct
- Listener. When multiple Listeners share values for fields (for
- example, two Listeners with the same Port value), the implementation
- can match requests to only one of the Listeners using other
- Listener fields.
-
- For example, the following Listener scenarios are distinct:
-
- 1. Multiple Listeners with the same Port that all use the "HTTP"
- Protocol that all have unique Hostname values.
- 2. Multiple Listeners with the same Port that use either the "HTTPS" or
- "TLS" Protocol that all have unique Hostname values.
- 3. A mixture of "TCP" and "UDP" Protocol Listeners, where no Listener
- with the same Protocol has the same Port value.
-
- Some fields in the Listener struct have possible values that affect
- whether the Listener is distinct. Hostname is particularly relevant
- for HTTP or HTTPS protocols.
-
- When using the Hostname value to select between same-Port, same-Protocol
- Listeners, the Hostname value must be different on each Listener for the
- Listener to be distinct.
-
- When the Listeners are distinct based on Hostname, inbound request
- hostnames MUST match from the most specific to least specific Hostname
- values to choose the correct Listener and its associated set of Routes.
-
- Exact matches must be processed before wildcard matches, and wildcard
- matches must be processed before fallback (empty Hostname value)
- matches. For example, `"foo.example.com"` takes precedence over
- `"*.example.com"`, and `"*.example.com"` takes precedence over `""`.
-
- Additionally, if there are multiple wildcard entries, more specific
- wildcard entries must be processed before less specific wildcard entries.
- For example, `"*.foo.example.com"` takes precedence over `"*.example.com"`.
- The precise definition here is that the higher the number of dots in the
- hostname to the right of the wildcard character, the higher the precedence.
-
- The wildcard character will match any number of characters _and dots_ to
- the left, however, so `"*.example.com"` will match both
- `"foo.bar.example.com"` _and_ `"bar.example.com"`.
-
- If a set of Listeners contains Listeners that are not distinct, then those
- Listeners are Conflicted, and the implementation MUST set the "Conflicted"
- condition in the Listener Status to "True".
-
- Implementations MAY choose to accept a Gateway with some Conflicted
- Listeners only if they only accept the partial Listener set that contains
- no Conflicted Listeners. To put this another way, implementations may
- accept a partial Listener set only if they throw out *all* the conflicting
- Listeners. No picking one of the conflicting listeners as the winner.
- This also means that the Gateway must have at least one non-conflicting
- Listener in this case, otherwise it violates the requirement that at
- least one Listener must be present.
-
- The implementation MUST set a "ListenersNotValid" condition on the
- Gateway Status when the Gateway contains Conflicted Listeners whether or
- not they accept the Gateway. That Condition SHOULD clearly
- indicate in the Message which Listeners are conflicted, and which are
- Accepted. Additionally, the Listener status for those listeners SHOULD
- indicate which Listeners are conflicted and not Accepted.
-
- A Gateway's Listeners are considered "compatible" if:
-
- 1. They are distinct.
- 2. The implementation can serve them in compliance with the Addresses
- requirement that all Listeners are available on all assigned
- addresses.
-
- Compatible combinations in Extended support are expected to vary across
- implementations. A combination that is compatible for one implementation
- may not be compatible for another.
-
- For example, an implementation that cannot serve both TCP and UDP listeners
- on the same address, or cannot mix HTTPS and generic TLS listens on the same port
- would not consider those cases compatible, even though they are distinct.
-
- Note that requests SHOULD match at most one Listener. For example, if
- Listeners are defined for "foo.example.com" and "*.example.com", a
- request to "foo.example.com" SHOULD only be routed using routes attached
- to the "foo.example.com" Listener (and not the "*.example.com" Listener).
- This concept is known as "Listener Isolation". Implementations that do
- not support Listener Isolation MUST clearly document this.
-
- Implementations MAY merge separate Gateways onto a single set of
- Addresses if all Listeners across all Gateways are compatible.
-
- Support: Core
- items:
- description: |-
- Listener embodies the concept of a logical endpoint where a Gateway accepts
- network connections.
- properties:
- allowedRoutes:
- default:
- namespaces:
- from: Same
- description: |-
- AllowedRoutes defines the types of routes that MAY be attached to a
- Listener and the trusted namespaces where those Route resources MAY be
- present.
-
- Although a client request may match multiple route rules, only one rule
- may ultimately receive the request. Matching precedence MUST be
- determined in order of the following criteria:
-
- * The most specific match as defined by the Route type.
- * The oldest Route based on creation timestamp. For example, a Route with
- a creation timestamp of "2020-09-08 01:02:03" is given precedence over
- a Route with a creation timestamp of "2020-09-08 01:02:04".
- * If everything else is equivalent, the Route appearing first in
- alphabetical order (namespace/name) should be given precedence. For
- example, foo/bar is given precedence over foo/baz.
-
- All valid rules within a Route attached to this Listener should be
- implemented. Invalid Route rules can be ignored (sometimes that will mean
- the full Route). If a Route rule transitions from valid to invalid,
- support for that Route rule should be dropped to ensure consistency. For
- example, even if a filter specified by a Route rule is invalid, the rest
- of the rules within that Route should still be supported.
-
- Support: Core
- properties:
- kinds:
- description: |-
- Kinds specifies the groups and kinds of Routes that are allowed to bind
- to this Gateway Listener. When unspecified or empty, the kinds of Routes
- selected are determined using the Listener protocol.
-
- A RouteGroupKind MUST correspond to kinds of Routes that are compatible
- with the application protocol specified in the Listener's Protocol field.
- If an implementation does not support or recognize this resource type, it
- MUST set the "ResolvedRefs" condition to False for this Listener with the
- "InvalidRouteKinds" reason.
-
- Support: Core
- items:
- description: RouteGroupKind indicates the group and kind
- of a Route resource.
- properties:
- group:
- default: gateway.networking.k8s.io
- description: Group is the group of the Route.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is the kind of the Route.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- required:
- - kind
- type: object
- maxItems: 8
- type: array
- namespaces:
- default:
- from: Same
- description: |-
- Namespaces indicates namespaces from which Routes may be attached to this
- Listener. This is restricted to the namespace of this Gateway by default.
-
- Support: Core
- properties:
- from:
- default: Same
- description: |-
- From indicates where Routes will be selected for this Gateway. Possible
- values are:
-
- * All: Routes in all namespaces may be used by this Gateway.
- * Selector: Routes in namespaces selected by the selector may be used by
- this Gateway.
- * Same: Only Routes in the same namespace may be used by this Gateway.
-
- Support: Core
- enum:
- - All
- - Selector
- - Same
- type: string
- selector:
- description: |-
- Selector must be specified when From is set to "Selector". In that case,
- only Routes in Namespaces matching this Selector will be selected by this
- Gateway. This field is ignored for other values of "From".
-
- Support: Core
- properties:
- matchExpressions:
- description: matchExpressions is a list of label
- selector requirements. The requirements are ANDed.
- items:
- description: |-
- A label selector requirement is a selector that contains values, a key, and an operator that
- relates the key and values.
- properties:
- key:
- description: key is the label key that the
- selector applies to.
- type: string
- operator:
- description: |-
- operator represents a key's relationship to a set of values.
- Valid operators are In, NotIn, Exists and DoesNotExist.
- type: string
- values:
- description: |-
- values is an array of string values. If the operator is In or NotIn,
- the values array must be non-empty. If the operator is Exists or DoesNotExist,
- the values array must be empty. This array is replaced during a strategic
- merge patch.
- items:
- type: string
- type: array
- x-kubernetes-list-type: atomic
- required:
- - key
- - operator
- type: object
- type: array
- x-kubernetes-list-type: atomic
- matchLabels:
- additionalProperties:
- type: string
- description: |-
- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
- map is equivalent to an element of matchExpressions, whose key field is "key", the
- operator is "In", and the values array contains only "value". The requirements are ANDed.
- type: object
- type: object
- x-kubernetes-map-type: atomic
- type: object
- type: object
- hostname:
- description: |-
- Hostname specifies the virtual hostname to match for protocol types that
- define this concept. When unspecified, all hostnames are matched. This
- field is ignored for protocols that don't require hostname based
- matching.
-
- Implementations MUST apply Hostname matching appropriately for each of
- the following protocols:
-
- * TLS: The Listener Hostname MUST match the SNI.
- * HTTP: The Listener Hostname MUST match the Host header of the request.
- * HTTPS: The Listener Hostname SHOULD match at both the TLS and HTTP
- protocol layers as described above. If an implementation does not
- ensure that both the SNI and Host header match the Listener hostname,
- it MUST clearly document that.
-
- For HTTPRoute and TLSRoute resources, there is an interaction with the
- `spec.hostnames` array. When both listener and route specify hostnames,
- there MUST be an intersection between the values for a Route to be
- accepted. For more information, refer to the Route specific Hostnames
- documentation.
-
- Hostnames that are prefixed with a wildcard label (`*.`) are interpreted
- as a suffix match. That means that a match for `*.example.com` would match
- both `test.example.com`, and `foo.test.example.com`, but not `example.com`.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- name:
- description: |-
- Name is the name of the Listener. This name MUST be unique within a
- Gateway.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- port:
- description: |-
- Port is the network port. Multiple listeners may use the
- same port, subject to the Listener compatibility rules.
-
- Support: Core
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- protocol:
- description: |-
- Protocol specifies the network protocol this listener expects to receive.
-
- Support: Core
- maxLength: 255
- minLength: 1
- pattern: ^[a-zA-Z0-9]([-a-zA-Z0-9]*[a-zA-Z0-9])?$|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9]+$
- type: string
- tls:
- description: |-
- TLS is the TLS configuration for the Listener. This field is required if
- the Protocol field is "HTTPS" or "TLS". It is invalid to set this field
- if the Protocol field is "HTTP", "TCP", or "UDP".
-
- The association of SNIs to Certificate defined in GatewayTLSConfig is
- defined based on the Hostname field for this listener.
-
- The GatewayClass MUST use the longest matching SNI out of all
- available certificates for any TLS handshake.
-
- Support: Core
- properties:
- certificateRefs:
- description: |-
- CertificateRefs contains a series of references to Kubernetes objects that
- contains TLS certificates and private keys. These certificates are used to
- establish a TLS handshake for requests that match the hostname of the
- associated listener.
-
- A single CertificateRef to a Kubernetes Secret has "Core" support.
- Implementations MAY choose to support attaching multiple certificates to
- a Listener, but this behavior is implementation-specific.
-
- References to a resource in different namespace are invalid UNLESS there
- is a ReferenceGrant in the target namespace that allows the certificate
- to be attached. If a ReferenceGrant does not allow this reference, the
- "ResolvedRefs" condition MUST be set to False for this listener with the
- "RefNotPermitted" reason.
-
- This field is required to have at least one element when the mode is set
- to "Terminate" (default) and is optional otherwise.
-
- CertificateRefs can reference to standard Kubernetes resources, i.e.
- Secret, or implementation-specific custom resources.
-
- Support: Core - A single reference to a Kubernetes Secret of type kubernetes.io/tls
-
- Support: Implementation-specific (More than one reference or other resource types)
- items:
- description: |-
- SecretObjectReference identifies an API object including its namespace,
- defaulting to Secret.
-
- The API object must be valid in the cluster; the Group and Kind must
- be registered in the cluster for this reference to be valid.
-
- References to objects with invalid Group and Kind are not valid, and must
- be rejected by the implementation, with appropriate Conditions set
- on the containing object.
- properties:
- group:
- default: ""
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Secret
- description: Kind is kind of the referent. For example
- "Secret".
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referenced object. When unspecified, the local
- namespace is inferred.
-
- Note that when a namespace different than the local namespace is specified,
- a ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- required:
- - name
- type: object
- maxItems: 64
- type: array
- mode:
- default: Terminate
- description: |-
- Mode defines the TLS behavior for the TLS session initiated by the client.
- There are two possible modes:
-
- - Terminate: The TLS session between the downstream client and the
- Gateway is terminated at the Gateway. This mode requires certificates
- to be specified in some way, such as populating the certificateRefs
- field.
- - Passthrough: The TLS session is NOT terminated by the Gateway. This
- implies that the Gateway can't decipher the TLS stream except for
- the ClientHello message of the TLS protocol. The certificateRefs field
- is ignored in this mode.
-
- Support: Core
- enum:
- - Terminate
- - Passthrough
- type: string
- options:
- additionalProperties:
- description: |-
- AnnotationValue is the value of an annotation in Gateway API. This is used
- for validation of maps such as TLS options. This roughly matches Kubernetes
- annotation validation, although the length validation in that case is based
- on the entire size of the annotations struct.
- maxLength: 4096
- minLength: 0
- type: string
- description: |-
- Options are a list of key/value pairs to enable extended TLS
- configuration for each implementation. For example, configuring the
- minimum TLS version or supported cipher suites.
-
- A set of common keys MAY be defined by the API in the future. To avoid
- any ambiguity, implementation-specific definitions MUST use
- domain-prefixed names, such as `example.com/my-custom-option`.
- Un-prefixed names are reserved for key names defined by Gateway API.
-
- Support: Implementation-specific
- maxProperties: 16
- type: object
- type: object
- x-kubernetes-validations:
- - message: certificateRefs or options must be specified when
- mode is Terminate
- rule: 'self.mode == ''Terminate'' ? size(self.certificateRefs)
- > 0 || size(self.options) > 0 : true'
- required:
- - name
- - port
- - protocol
- type: object
- maxItems: 64
- minItems: 1
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- x-kubernetes-validations:
- - message: tls must not be specified for protocols ['HTTP', 'TCP',
- 'UDP']
- rule: 'self.all(l, l.protocol in [''HTTP'', ''TCP'', ''UDP''] ?
- !has(l.tls) : true)'
- - message: tls mode must be Terminate for protocol HTTPS
- rule: 'self.all(l, (l.protocol == ''HTTPS'' && has(l.tls)) ? (l.tls.mode
- == '''' || l.tls.mode == ''Terminate'') : true)'
- - message: hostname must not be specified for protocols ['TCP', 'UDP']
- rule: 'self.all(l, l.protocol in [''TCP'', ''UDP''] ? (!has(l.hostname)
- || l.hostname == '''') : true)'
- - message: Listener name must be unique within the Gateway
- rule: self.all(l1, self.exists_one(l2, l1.name == l2.name))
- - message: Combination of port, protocol and hostname must be unique
- for each listener
- rule: 'self.all(l1, self.exists_one(l2, l1.port == l2.port && l1.protocol
- == l2.protocol && (has(l1.hostname) && has(l2.hostname) ? l1.hostname
- == l2.hostname : !has(l1.hostname) && !has(l2.hostname))))'
- required:
- - gatewayClassName
- - listeners
- type: object
- status:
- default:
- conditions:
- - lastTransitionTime: "1970-01-01T00:00:00Z"
- message: Waiting for controller
- reason: Pending
- status: Unknown
- type: Accepted
- - lastTransitionTime: "1970-01-01T00:00:00Z"
- message: Waiting for controller
- reason: Pending
- status: Unknown
- type: Programmed
- description: Status defines the current state of Gateway.
- properties:
- addresses:
- description: |+
- Addresses lists the network addresses that have been bound to the
- Gateway.
-
- This list may differ from the addresses provided in the spec under some
- conditions:
-
- * no addresses are specified, all addresses are dynamically assigned
- * a combination of specified and dynamic addresses are assigned
- * a specified address was unusable (e.g. already in use)
-
- items:
- description: GatewayStatusAddress describes a network address that
- is bound to a Gateway.
- oneOf:
- - properties:
- type:
- enum:
- - IPAddress
- value:
- anyOf:
- - format: ipv4
- - format: ipv6
- - properties:
- type:
- not:
- enum:
- - IPAddress
- properties:
- type:
- default: IPAddress
- description: Type of the address.
- maxLength: 253
- minLength: 1
- pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
- type: string
- value:
- description: |-
- Value of the address. The validity of the values will depend
- on the type and support by the controller.
-
- Examples: `1.2.3.4`, `128::1`, `my-ip-address`.
- maxLength: 253
- minLength: 1
- type: string
- required:
- - value
- type: object
- x-kubernetes-validations:
- - message: Hostname value must only contain valid characters (matching
- ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$)
- rule: 'self.type == ''Hostname'' ? self.value.matches(r"""^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"""):
- true'
- maxItems: 16
- type: array
- conditions:
- default:
- - lastTransitionTime: "1970-01-01T00:00:00Z"
- message: Waiting for controller
- reason: Pending
- status: Unknown
- type: Accepted
- - lastTransitionTime: "1970-01-01T00:00:00Z"
- message: Waiting for controller
- reason: Pending
- status: Unknown
- type: Programmed
- description: |-
- Conditions describe the current conditions of the Gateway.
-
- Implementations should prefer to express Gateway conditions
- using the `GatewayConditionType` and `GatewayConditionReason`
- constants so that operators and tools can converge on a common
- vocabulary to describe Gateway state.
-
- Known condition types are:
-
- * "Accepted"
- * "Programmed"
- * "Ready"
- items:
- description: Condition contains details for one aspect of the current
- state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False, Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- maxItems: 8
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- listeners:
- description: Listeners provide status for each unique listener port
- defined in the Spec.
- items:
- description: ListenerStatus is the status associated with a Listener.
- properties:
- attachedRoutes:
- description: |-
- AttachedRoutes represents the total number of Routes that have been
- successfully attached to this Listener.
-
- Successful attachment of a Route to a Listener is based solely on the
- combination of the AllowedRoutes field on the corresponding Listener
- and the Route's ParentRefs field. A Route is successfully attached to
- a Listener when it is selected by the Listener's AllowedRoutes field
- AND the Route has a valid ParentRef selecting the whole Gateway
- resource or a specific Listener as a parent resource (more detail on
- attachment semantics can be found in the documentation on the various
- Route kinds ParentRefs fields). Listener or Route status does not impact
- successful attachment, i.e. the AttachedRoutes field count MUST be set
- for Listeners with condition Accepted: false and MUST count successfully
- attached Routes that may themselves have Accepted: false conditions.
-
- Uses for this field include troubleshooting Route attachment and
- measuring blast radius/impact of changes to a Listener.
- format: int32
- type: integer
- conditions:
- description: Conditions describe the current condition of this
- listener.
- items:
- description: Condition contains details for one aspect of
- the current state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False,
- Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- maxItems: 8
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- name:
- description: Name is the name of the Listener that this status
- corresponds to.
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- supportedKinds:
- description: |-
- SupportedKinds is the list indicating the Kinds supported by this
- listener. This MUST represent the kinds an implementation supports for
- that Listener configuration.
-
- If kinds are specified in Spec that are not supported, they MUST NOT
- appear in this list and an implementation MUST set the "ResolvedRefs"
- condition to "False" with the "InvalidRouteKinds" reason. If both valid
- and invalid Route kinds are specified, the implementation MUST
- reference the valid Route kinds that have been specified.
- items:
- description: RouteGroupKind indicates the group and kind of
- a Route resource.
- properties:
- group:
- default: gateway.networking.k8s.io
- description: Group is the group of the Route.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is the kind of the Route.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- required:
- - kind
- type: object
- maxItems: 8
- type: array
- required:
- - attachedRoutes
- - conditions
- - name
- - supportedKinds
- type: object
- maxItems: 64
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- required:
- - spec
- type: object
- served: true
- storage: false
- subresources:
- status: {}
-status:
- acceptedNames:
- kind: ""
- plural: ""
- conditions: null
- storedVersions: null
----
-#
-# config/crd/standard/gateway.networking.k8s.io_grpcroutes.yaml
-#
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
- gateway.networking.k8s.io/bundle-version: v1.2.1
- gateway.networking.k8s.io/channel: standard
- creationTimestamp: null
- name: grpcroutes.gateway.networking.k8s.io
-spec:
- group: gateway.networking.k8s.io
- names:
- categories:
- - gateway-api
- kind: GRPCRoute
- listKind: GRPCRouteList
- plural: grpcroutes
- singular: grpcroute
- scope: Namespaced
- versions:
- - additionalPrinterColumns:
- - jsonPath: .spec.hostnames
- name: Hostnames
- type: string
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- name: v1
- schema:
- openAPIV3Schema:
- description: |-
- GRPCRoute provides a way to route gRPC requests. This includes the capability
- to match requests by hostname, gRPC service, gRPC method, or HTTP/2 header.
- Filters can be used to specify additional processing steps. Backends specify
- where matching requests will be routed.
-
- GRPCRoute falls under extended support within the Gateway API. Within the
- following specification, the word "MUST" indicates that an implementation
- supporting GRPCRoute must conform to the indicated requirement, but an
- implementation not supporting this route type need not follow the requirement
- unless explicitly indicated.
-
- Implementations supporting `GRPCRoute` with the `HTTPS` `ProtocolType` MUST
- accept HTTP/2 connections without an initial upgrade from HTTP/1.1, i.e. via
- ALPN. If the implementation does not support this, then it MUST set the
- "Accepted" condition to "False" for the affected listener with a reason of
- "UnsupportedProtocol". Implementations MAY also accept HTTP/2 connections
- with an upgrade from HTTP/1.
-
- Implementations supporting `GRPCRoute` with the `HTTP` `ProtocolType` MUST
- support HTTP/2 over cleartext TCP (h2c,
- https://www.rfc-editor.org/rfc/rfc7540#section-3.1) without an initial
- upgrade from HTTP/1.1, i.e. with prior knowledge
- (https://www.rfc-editor.org/rfc/rfc7540#section-3.4). If the implementation
- does not support this, then it MUST set the "Accepted" condition to "False"
- for the affected listener with a reason of "UnsupportedProtocol".
- Implementations MAY also accept HTTP/2 connections with an upgrade from
- HTTP/1, i.e. without prior knowledge.
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: Spec defines the desired state of GRPCRoute.
- properties:
- hostnames:
- description: |-
- Hostnames defines a set of hostnames to match against the GRPC
- Host header to select a GRPCRoute to process the request. This matches
- the RFC 1123 definition of a hostname with 2 notable exceptions:
-
- 1. IPs are not allowed.
- 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard
- label MUST appear by itself as the first label.
-
- If a hostname is specified by both the Listener and GRPCRoute, there
- MUST be at least one intersecting hostname for the GRPCRoute to be
- attached to the Listener. For example:
-
- * A Listener with `test.example.com` as the hostname matches GRPCRoutes
- that have either not specified any hostnames, or have specified at
- least one of `test.example.com` or `*.example.com`.
- * A Listener with `*.example.com` as the hostname matches GRPCRoutes
- that have either not specified any hostnames or have specified at least
- one hostname that matches the Listener hostname. For example,
- `test.example.com` and `*.example.com` would both match. On the other
- hand, `example.com` and `test.example.net` would not match.
-
- Hostnames that are prefixed with a wildcard label (`*.`) are interpreted
- as a suffix match. That means that a match for `*.example.com` would match
- both `test.example.com`, and `foo.test.example.com`, but not `example.com`.
-
- If both the Listener and GRPCRoute have specified hostnames, any
- GRPCRoute hostnames that do not match the Listener hostname MUST be
- ignored. For example, if a Listener specified `*.example.com`, and the
- GRPCRoute specified `test.example.com` and `test.example.net`,
- `test.example.net` MUST NOT be considered for a match.
-
- If both the Listener and GRPCRoute have specified hostnames, and none
- match with the criteria above, then the GRPCRoute MUST NOT be accepted by
- the implementation. The implementation MUST raise an 'Accepted' Condition
- with a status of `False` in the corresponding RouteParentStatus.
-
- If a Route (A) of type HTTPRoute or GRPCRoute is attached to a
- Listener and that listener already has another Route (B) of the other
- type attached and the intersection of the hostnames of A and B is
- non-empty, then the implementation MUST accept exactly one of these two
- routes, determined by the following criteria, in order:
-
- * The oldest Route based on creation timestamp.
- * The Route appearing first in alphabetical order by
- "{namespace}/{name}".
-
- The rejected Route MUST raise an 'Accepted' condition with a status of
- 'False' in the corresponding RouteParentStatus.
-
- Support: Core
- items:
- description: |-
- Hostname is the fully qualified domain name of a network host. This matches
- the RFC 1123 definition of a hostname with 2 notable exceptions:
-
- 1. IPs are not allowed.
- 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard
- label must appear by itself as the first label.
-
- Hostname can be "precise" which is a domain name without the terminating
- dot of a network host (e.g. "foo.example.com") or "wildcard", which is a
- domain name prefixed with a single wildcard label (e.g. `*.example.com`).
-
- Note that as per RFC1035 and RFC1123, a *label* must consist of lower case
- alphanumeric characters or '-', and must start and end with an alphanumeric
- character. No other punctuation is allowed.
- maxLength: 253
- minLength: 1
- pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- maxItems: 16
- type: array
- parentRefs:
- description: |+
- ParentRefs references the resources (usually Gateways) that a Route wants
- to be attached to. Note that the referenced parent resource needs to
- allow this for the attachment to be complete. For Gateways, that means
- the Gateway needs to allow attachment from Routes of this kind and
- namespace. For Services, that means the Service must either be in the same
- namespace for a "producer" route, or the mesh implementation must support
- and allow "consumer" routes for the referenced Service. ReferenceGrant is
- not applicable for governing ParentRefs to Services - it is not possible to
- create a "producer" route for a Service in a different namespace from the
- Route.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- This API may be extended in the future to support additional kinds of parent
- resources.
-
- ParentRefs must be _distinct_. This means either that:
-
- * They select different objects. If this is the case, then parentRef
- entries are distinct. In terms of fields, this means that the
- multi-part key defined by `group`, `kind`, `namespace`, and `name` must
- be unique across all parentRef entries in the Route.
- * They do not select different objects, but for each optional field used,
- each ParentRef that selects the same object must set the same set of
- optional fields to different values. If one ParentRef sets a
- combination of optional fields, all must set the same combination.
-
- Some examples:
-
- * If one ParentRef sets `sectionName`, all ParentRefs referencing the
- same object must also set `sectionName`.
- * If one ParentRef sets `port`, all ParentRefs referencing the same
- object must also set `port`.
- * If one ParentRef sets `sectionName` and `port`, all ParentRefs
- referencing the same object must also set `sectionName` and `port`.
-
- It is possible to separately reference multiple distinct objects that may
- be collapsed by an implementation. For example, some implementations may
- choose to merge compatible Gateway Listeners together. If that is the
- case, the list of routes attached to those resources should also be
- merged.
-
- Note that for ParentRefs that cross namespace boundaries, there are specific
- rules. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example,
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable other kinds of cross-namespace reference.
-
-
-
-
-
-
- items:
- description: |-
- ParentReference identifies an API object (usually a Gateway) that can be considered
- a parent of this resource (usually a route). There are two kinds of parent resources
- with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- This API may be extended in the future to support additional kinds of parent
- resources.
-
- The API object must be valid in the cluster; the Group and Kind must
- be registered in the cluster for this reference to be valid.
- properties:
- group:
- default: gateway.networking.k8s.io
- description: |-
- Group is the group of the referent.
- When unspecified, "gateway.networking.k8s.io" is inferred.
- To set the core API group (such as for a "Service" kind referent),
- Group must be explicitly set to "" (empty string).
-
- Support: Core
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Gateway
- description: |-
- Kind is kind of the referent.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- Support for other resources is Implementation-Specific.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: |-
- Name is the name of the referent.
-
- Support: Core
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referent. When unspecified, this refers
- to the local namespace of the Route.
-
- Note that there are specific rules for ParentRefs which cross namespace
- boundaries. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example:
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable any other kind of cross-namespace reference.
-
-
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port is the network port this Route targets. It can be interpreted
- differently based on the type of parent resource.
-
- When the parent resource is a Gateway, this targets all listeners
- listening on the specified port that also support this kind of Route(and
- select this Route). It's not recommended to set `Port` unless the
- networking behaviors specified in a Route must apply to a specific port
- as opposed to a listener(s) whose port(s) may be changed. When both Port
- and SectionName are specified, the name and port of the selected listener
- must match both specified values.
-
-
-
- Implementations MAY choose to support other parent resources.
- Implementations supporting other types of parent resources MUST clearly
- document how/if Port is interpreted.
-
- For the purpose of status, an attachment is considered successful as
- long as the parent resource accepts it partially. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
- from the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route,
- the Route MUST be considered detached from the Gateway.
-
- Support: Extended
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- sectionName:
- description: |-
- SectionName is the name of a section within the target resource. In the
- following resources, SectionName is interpreted as the following:
-
- * Gateway: Listener name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
- * Service: Port name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
-
- Implementations MAY choose to support attaching Routes to other resources.
- If that is the case, they MUST clearly document how SectionName is
- interpreted.
-
- When unspecified (empty string), this will reference the entire resource.
- For the purpose of status, an attachment is considered successful if at
- least one section in the parent resource accepts it. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
- the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route, the
- Route MUST be considered detached from the Gateway.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- required:
- - name
- type: object
- maxItems: 32
- type: array
- x-kubernetes-validations:
- - message: sectionName must be specified when parentRefs includes
- 2 or more references to the same parent
- rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind
- == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__)
- || p1.__namespace__ == '''') && (!has(p2.__namespace__) || p2.__namespace__
- == '''')) || (has(p1.__namespace__) && has(p2.__namespace__) &&
- p1.__namespace__ == p2.__namespace__ )) ? ((!has(p1.sectionName)
- || p1.sectionName == '''') == (!has(p2.sectionName) || p2.sectionName
- == '''')) : true))'
- - message: sectionName must be unique when parentRefs includes 2 or
- more references to the same parent
- rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind
- == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__)
- || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__
- == '')) || (has(p1.__namespace__) && has(p2.__namespace__) &&
- p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName)
- || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName
- == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName
- == p2.sectionName))))
- rules:
- description: |+
- Rules are a list of GRPC matchers, filters and actions.
-
- items:
- description: |-
- GRPCRouteRule defines the semantics for matching a gRPC request based on
- conditions (matches), processing it (filters), and forwarding the request to
- an API object (backendRefs).
- properties:
- backendRefs:
- description: |-
- BackendRefs defines the backend(s) where matching requests should be
- sent.
-
- Failure behavior here depends on how many BackendRefs are specified and
- how many are invalid.
-
- If *all* entries in BackendRefs are invalid, and there are also no filters
- specified in this route rule, *all* traffic which matches this rule MUST
- receive an `UNAVAILABLE` status.
-
- See the GRPCBackendRef definition for the rules about what makes a single
- GRPCBackendRef invalid.
-
- When a GRPCBackendRef is invalid, `UNAVAILABLE` statuses MUST be returned for
- requests that would have otherwise been routed to an invalid backend. If
- multiple backends are specified, and some are invalid, the proportion of
- requests that would otherwise have been routed to an invalid backend
- MUST receive an `UNAVAILABLE` status.
-
- For example, if two backends are specified with equal weights, and one is
- invalid, 50 percent of traffic MUST receive an `UNAVAILABLE` status.
- Implementations may choose how that 50 percent is determined.
-
- Support: Core for Kubernetes Service
-
- Support: Implementation-specific for any other resource
-
- Support for weight: Core
- items:
- description: |-
- GRPCBackendRef defines how a GRPCRoute forwards a gRPC request.
-
- Note that when a namespace different than the local namespace is specified, a
- ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
-
-
- When the BackendRef points to a Kubernetes Service, implementations SHOULD
- honor the appProtocol field if it is set for the target Service Port.
-
- Implementations supporting appProtocol SHOULD recognize the Kubernetes
- Standard Application Protocols defined in KEP-3726.
-
- If a Service appProtocol isn't specified, an implementation MAY infer the
- backend protocol through its own means. Implementations MAY infer the
- protocol from the Route type referring to the backend Service.
-
- If a Route is not able to send traffic to the backend using the specified
- protocol then the backend is considered invalid. Implementations MUST set the
- "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason.
-
-
- properties:
- filters:
- description: |-
- Filters defined at this level MUST be executed if and only if the
- request is being forwarded to the backend defined here.
-
- Support: Implementation-specific (For broader support of filters, use the
- Filters field in GRPCRouteRule.)
- items:
- description: |-
- GRPCRouteFilter defines processing steps that must be completed during the
- request or response lifecycle. GRPCRouteFilters are meant as an extension
- point to express processing that may be done in Gateway implementations. Some
- examples include request or response modification, implementing
- authentication strategies, rate-limiting, and traffic shaping. API
- guarantee/conformance is defined based on the type of the filter.
- properties:
- extensionRef:
- description: |-
- ExtensionRef is an optional, implementation-specific extension to the
- "filter" behavior. For example, resource "myroutefilter" in group
- "networking.example.net"). ExtensionRef MUST NOT be used for core and
- extended filters.
-
- Support: Implementation-specific
-
- This filter can be used multiple times within the same rule.
- properties:
- group:
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is kind of the referent. For
- example "HTTPRoute" or "Service".
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- required:
- - group
- - kind
- - name
- type: object
- requestHeaderModifier:
- description: |-
- RequestHeaderModifier defines a schema for a filter that modifies request
- headers.
-
- Support: Core
- properties:
- add:
- description: |-
- Add adds the given header(s) (name, value) to the request
- before the action. It appends to any existing values associated
- with the header name.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- add:
- - name: "my-header"
- value: "bar,baz"
-
- Output:
- GET /foo HTTP/1.1
- my-header: foo,bar,baz
- items:
- description: HTTPHeader represents an HTTP
- Header name and value as defined by RFC
- 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP
- Header to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- remove:
- description: |-
- Remove the given header(s) from the HTTP request before the action. The
- value of Remove is a list of HTTP header names. Note that the header
- names are case-insensitive (see
- https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).
-
- Input:
- GET /foo HTTP/1.1
- my-header1: foo
- my-header2: bar
- my-header3: baz
-
- Config:
- remove: ["my-header1", "my-header3"]
-
- Output:
- GET /foo HTTP/1.1
- my-header2: bar
- items:
- type: string
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- set:
- description: |-
- Set overwrites the request with the given header (name, value)
- before the action.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- set:
- - name: "my-header"
- value: "bar"
-
- Output:
- GET /foo HTTP/1.1
- my-header: bar
- items:
- description: HTTPHeader represents an HTTP
- Header name and value as defined by RFC
- 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP
- Header to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- requestMirror:
- description: |+
- RequestMirror defines a schema for a filter that mirrors requests.
- Requests are sent to the specified destination, but responses from
- that destination are ignored.
-
- This filter can be used multiple times within the same rule. Note that
- not all implementations will be able to support mirroring to multiple
- backends.
-
- Support: Extended
-
- properties:
- backendRef:
- description: |-
- BackendRef references a resource where mirrored requests are sent.
-
- Mirrored requests must be sent only to a single destination endpoint
- within this BackendRef, irrespective of how many endpoints are present
- within this BackendRef.
-
- If the referent cannot be found, this BackendRef is invalid and must be
- dropped from the Gateway. The controller must ensure the "ResolvedRefs"
- condition on the Route status is set to `status: False` and not configure
- this backend in the underlying implementation.
-
- If there is a cross-namespace reference to an *existing* object
- that is not allowed by a ReferenceGrant, the controller must ensure the
- "ResolvedRefs" condition on the Route is set to `status: False`,
- with the "RefNotPermitted" reason and not configure this backend in the
- underlying implementation.
-
- In either error case, the Message of the `ResolvedRefs` Condition
- should be used to provide more detail about the problem.
-
- Support: Extended for Kubernetes Service
-
- Support: Implementation-specific for any other resource
- properties:
- group:
- default: ""
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Service
- description: |-
- Kind is the Kubernetes resource kind of the referent. For example
- "Service".
-
- Defaults to "Service" when not specified.
-
- ExternalName services can refer to CNAME DNS records that may live
- outside of the cluster and as such are difficult to reason about in
- terms of conformance. They also may not be safe to forward to (see
- CVE-2021-25740 for more information). Implementations SHOULD NOT
- support ExternalName Services.
-
- Support: Core (Services with a type other than ExternalName)
-
- Support: Implementation-specific (Services with type ExternalName)
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the backend. When unspecified, the local
- namespace is inferred.
-
- Note that when a namespace different than the local namespace is specified,
- a ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port specifies the destination port number to use for this resource.
- Port is required when the referent is a Kubernetes Service. In this
- case, the port number is the service port number, not the target port.
- For other resources, destination port might be derived from the referent
- resource or this field.
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- required:
- - name
- type: object
- x-kubernetes-validations:
- - message: Must have port for Service reference
- rule: '(size(self.group) == 0 && self.kind
- == ''Service'') ? has(self.port) : true'
- required:
- - backendRef
- type: object
- responseHeaderModifier:
- description: |-
- ResponseHeaderModifier defines a schema for a filter that modifies response
- headers.
-
- Support: Extended
- properties:
- add:
- description: |-
- Add adds the given header(s) (name, value) to the request
- before the action. It appends to any existing values associated
- with the header name.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- add:
- - name: "my-header"
- value: "bar,baz"
-
- Output:
- GET /foo HTTP/1.1
- my-header: foo,bar,baz
- items:
- description: HTTPHeader represents an HTTP
- Header name and value as defined by RFC
- 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP
- Header to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- remove:
- description: |-
- Remove the given header(s) from the HTTP request before the action. The
- value of Remove is a list of HTTP header names. Note that the header
- names are case-insensitive (see
- https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).
-
- Input:
- GET /foo HTTP/1.1
- my-header1: foo
- my-header2: bar
- my-header3: baz
-
- Config:
- remove: ["my-header1", "my-header3"]
-
- Output:
- GET /foo HTTP/1.1
- my-header2: bar
- items:
- type: string
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- set:
- description: |-
- Set overwrites the request with the given header (name, value)
- before the action.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- set:
- - name: "my-header"
- value: "bar"
-
- Output:
- GET /foo HTTP/1.1
- my-header: bar
- items:
- description: HTTPHeader represents an HTTP
- Header name and value as defined by RFC
- 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP
- Header to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- type:
- description: |+
- Type identifies the type of filter to apply. As with other API fields,
- types are classified into three conformance levels:
-
- - Core: Filter types and their corresponding configuration defined by
- "Support: Core" in this package, e.g. "RequestHeaderModifier". All
- implementations supporting GRPCRoute MUST support core filters.
-
- - Extended: Filter types and their corresponding configuration defined by
- "Support: Extended" in this package, e.g. "RequestMirror". Implementers
- are encouraged to support extended filters.
-
- - Implementation-specific: Filters that are defined and supported by specific vendors.
- In the future, filters showing convergence in behavior across multiple
- implementations will be considered for inclusion in extended or core
- conformance levels. Filter-specific configuration for such filters
- is specified using the ExtensionRef field. `Type` MUST be set to
- "ExtensionRef" for custom filters.
-
- Implementers are encouraged to define custom implementation types to
- extend the core API with implementation-specific behavior.
-
- If a reference to a custom filter type cannot be resolved, the filter
- MUST NOT be skipped. Instead, requests that would have been processed by
- that filter MUST receive a HTTP error response.
-
- enum:
- - ResponseHeaderModifier
- - RequestHeaderModifier
- - RequestMirror
- - ExtensionRef
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: filter.requestHeaderModifier must be nil
- if the filter.type is not RequestHeaderModifier
- rule: '!(has(self.requestHeaderModifier) && self.type
- != ''RequestHeaderModifier'')'
- - message: filter.requestHeaderModifier must be specified
- for RequestHeaderModifier filter.type
- rule: '!(!has(self.requestHeaderModifier) && self.type
- == ''RequestHeaderModifier'')'
- - message: filter.responseHeaderModifier must be nil
- if the filter.type is not ResponseHeaderModifier
- rule: '!(has(self.responseHeaderModifier) && self.type
- != ''ResponseHeaderModifier'')'
- - message: filter.responseHeaderModifier must be specified
- for ResponseHeaderModifier filter.type
- rule: '!(!has(self.responseHeaderModifier) && self.type
- == ''ResponseHeaderModifier'')'
- - message: filter.requestMirror must be nil if the filter.type
- is not RequestMirror
- rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')'
- - message: filter.requestMirror must be specified for
- RequestMirror filter.type
- rule: '!(!has(self.requestMirror) && self.type ==
- ''RequestMirror'')'
- - message: filter.extensionRef must be nil if the filter.type
- is not ExtensionRef
- rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')'
- - message: filter.extensionRef must be specified for
- ExtensionRef filter.type
- rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')'
- maxItems: 16
- type: array
- x-kubernetes-validations:
- - message: RequestHeaderModifier filter cannot be repeated
- rule: self.filter(f, f.type == 'RequestHeaderModifier').size()
- <= 1
- - message: ResponseHeaderModifier filter cannot be repeated
- rule: self.filter(f, f.type == 'ResponseHeaderModifier').size()
- <= 1
- group:
- default: ""
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Service
- description: |-
- Kind is the Kubernetes resource kind of the referent. For example
- "Service".
-
- Defaults to "Service" when not specified.
-
- ExternalName services can refer to CNAME DNS records that may live
- outside of the cluster and as such are difficult to reason about in
- terms of conformance. They also may not be safe to forward to (see
- CVE-2021-25740 for more information). Implementations SHOULD NOT
- support ExternalName Services.
-
- Support: Core (Services with a type other than ExternalName)
-
- Support: Implementation-specific (Services with type ExternalName)
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the backend. When unspecified, the local
- namespace is inferred.
-
- Note that when a namespace different than the local namespace is specified,
- a ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port specifies the destination port number to use for this resource.
- Port is required when the referent is a Kubernetes Service. In this
- case, the port number is the service port number, not the target port.
- For other resources, destination port might be derived from the referent
- resource or this field.
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- weight:
- default: 1
- description: |-
- Weight specifies the proportion of requests forwarded to the referenced
- backend. This is computed as weight/(sum of all weights in this
- BackendRefs list). For non-zero values, there may be some epsilon from
- the exact proportion defined here depending on the precision an
- implementation supports. Weight is not a percentage and the sum of
- weights does not need to equal 100.
-
- If only one backend is specified and it has a weight greater than 0, 100%
- of the traffic is forwarded to that backend. If weight is set to 0, no
- traffic should be forwarded for this entry. If unspecified, weight
- defaults to 1.
-
- Support for this field varies based on the context where used.
- format: int32
- maximum: 1000000
- minimum: 0
- type: integer
- required:
- - name
- type: object
- x-kubernetes-validations:
- - message: Must have port for Service reference
- rule: '(size(self.group) == 0 && self.kind == ''Service'')
- ? has(self.port) : true'
- maxItems: 16
- type: array
- filters:
- description: |-
- Filters define the filters that are applied to requests that match
- this rule.
-
- The effects of ordering of multiple behaviors are currently unspecified.
- This can change in the future based on feedback during the alpha stage.
-
- Conformance-levels at this level are defined based on the type of filter:
-
- - ALL core filters MUST be supported by all implementations that support
- GRPCRoute.
- - Implementers are encouraged to support extended filters.
- - Implementation-specific custom filters have no API guarantees across
- implementations.
-
- Specifying the same filter multiple times is not supported unless explicitly
- indicated in the filter.
-
- If an implementation can not support a combination of filters, it must clearly
- document that limitation. In cases where incompatible or unsupported
- filters are specified and cause the `Accepted` condition to be set to status
- `False`, implementations may use the `IncompatibleFilters` reason to specify
- this configuration error.
-
- Support: Core
- items:
- description: |-
- GRPCRouteFilter defines processing steps that must be completed during the
- request or response lifecycle. GRPCRouteFilters are meant as an extension
- point to express processing that may be done in Gateway implementations. Some
- examples include request or response modification, implementing
- authentication strategies, rate-limiting, and traffic shaping. API
- guarantee/conformance is defined based on the type of the filter.
- properties:
- extensionRef:
- description: |-
- ExtensionRef is an optional, implementation-specific extension to the
- "filter" behavior. For example, resource "myroutefilter" in group
- "networking.example.net"). ExtensionRef MUST NOT be used for core and
- extended filters.
-
- Support: Implementation-specific
-
- This filter can be used multiple times within the same rule.
- properties:
- group:
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is kind of the referent. For example
- "HTTPRoute" or "Service".
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- required:
- - group
- - kind
- - name
- type: object
- requestHeaderModifier:
- description: |-
- RequestHeaderModifier defines a schema for a filter that modifies request
- headers.
-
- Support: Core
- properties:
- add:
- description: |-
- Add adds the given header(s) (name, value) to the request
- before the action. It appends to any existing values associated
- with the header name.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- add:
- - name: "my-header"
- value: "bar,baz"
-
- Output:
- GET /foo HTTP/1.1
- my-header: foo,bar,baz
- items:
- description: HTTPHeader represents an HTTP Header
- name and value as defined by RFC 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP Header
- to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- remove:
- description: |-
- Remove the given header(s) from the HTTP request before the action. The
- value of Remove is a list of HTTP header names. Note that the header
- names are case-insensitive (see
- https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).
-
- Input:
- GET /foo HTTP/1.1
- my-header1: foo
- my-header2: bar
- my-header3: baz
-
- Config:
- remove: ["my-header1", "my-header3"]
-
- Output:
- GET /foo HTTP/1.1
- my-header2: bar
- items:
- type: string
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- set:
- description: |-
- Set overwrites the request with the given header (name, value)
- before the action.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- set:
- - name: "my-header"
- value: "bar"
-
- Output:
- GET /foo HTTP/1.1
- my-header: bar
- items:
- description: HTTPHeader represents an HTTP Header
- name and value as defined by RFC 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP Header
- to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- requestMirror:
- description: |+
- RequestMirror defines a schema for a filter that mirrors requests.
- Requests are sent to the specified destination, but responses from
- that destination are ignored.
-
- This filter can be used multiple times within the same rule. Note that
- not all implementations will be able to support mirroring to multiple
- backends.
-
- Support: Extended
-
- properties:
- backendRef:
- description: |-
- BackendRef references a resource where mirrored requests are sent.
-
- Mirrored requests must be sent only to a single destination endpoint
- within this BackendRef, irrespective of how many endpoints are present
- within this BackendRef.
-
- If the referent cannot be found, this BackendRef is invalid and must be
- dropped from the Gateway. The controller must ensure the "ResolvedRefs"
- condition on the Route status is set to `status: False` and not configure
- this backend in the underlying implementation.
-
- If there is a cross-namespace reference to an *existing* object
- that is not allowed by a ReferenceGrant, the controller must ensure the
- "ResolvedRefs" condition on the Route is set to `status: False`,
- with the "RefNotPermitted" reason and not configure this backend in the
- underlying implementation.
-
- In either error case, the Message of the `ResolvedRefs` Condition
- should be used to provide more detail about the problem.
-
- Support: Extended for Kubernetes Service
-
- Support: Implementation-specific for any other resource
- properties:
- group:
- default: ""
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Service
- description: |-
- Kind is the Kubernetes resource kind of the referent. For example
- "Service".
-
- Defaults to "Service" when not specified.
-
- ExternalName services can refer to CNAME DNS records that may live
- outside of the cluster and as such are difficult to reason about in
- terms of conformance. They also may not be safe to forward to (see
- CVE-2021-25740 for more information). Implementations SHOULD NOT
- support ExternalName Services.
-
- Support: Core (Services with a type other than ExternalName)
-
- Support: Implementation-specific (Services with type ExternalName)
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the backend. When unspecified, the local
- namespace is inferred.
-
- Note that when a namespace different than the local namespace is specified,
- a ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port specifies the destination port number to use for this resource.
- Port is required when the referent is a Kubernetes Service. In this
- case, the port number is the service port number, not the target port.
- For other resources, destination port might be derived from the referent
- resource or this field.
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- required:
- - name
- type: object
- x-kubernetes-validations:
- - message: Must have port for Service reference
- rule: '(size(self.group) == 0 && self.kind == ''Service'')
- ? has(self.port) : true'
- required:
- - backendRef
- type: object
- responseHeaderModifier:
- description: |-
- ResponseHeaderModifier defines a schema for a filter that modifies response
- headers.
-
- Support: Extended
- properties:
- add:
- description: |-
- Add adds the given header(s) (name, value) to the request
- before the action. It appends to any existing values associated
- with the header name.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- add:
- - name: "my-header"
- value: "bar,baz"
-
- Output:
- GET /foo HTTP/1.1
- my-header: foo,bar,baz
- items:
- description: HTTPHeader represents an HTTP Header
- name and value as defined by RFC 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP Header
- to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- remove:
- description: |-
- Remove the given header(s) from the HTTP request before the action. The
- value of Remove is a list of HTTP header names. Note that the header
- names are case-insensitive (see
- https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).
-
- Input:
- GET /foo HTTP/1.1
- my-header1: foo
- my-header2: bar
- my-header3: baz
-
- Config:
- remove: ["my-header1", "my-header3"]
-
- Output:
- GET /foo HTTP/1.1
- my-header2: bar
- items:
- type: string
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- set:
- description: |-
- Set overwrites the request with the given header (name, value)
- before the action.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- set:
- - name: "my-header"
- value: "bar"
-
- Output:
- GET /foo HTTP/1.1
- my-header: bar
- items:
- description: HTTPHeader represents an HTTP Header
- name and value as defined by RFC 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP Header
- to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- type:
- description: |+
- Type identifies the type of filter to apply. As with other API fields,
- types are classified into three conformance levels:
-
- - Core: Filter types and their corresponding configuration defined by
- "Support: Core" in this package, e.g. "RequestHeaderModifier". All
- implementations supporting GRPCRoute MUST support core filters.
-
- - Extended: Filter types and their corresponding configuration defined by
- "Support: Extended" in this package, e.g. "RequestMirror". Implementers
- are encouraged to support extended filters.
-
- - Implementation-specific: Filters that are defined and supported by specific vendors.
- In the future, filters showing convergence in behavior across multiple
- implementations will be considered for inclusion in extended or core
- conformance levels. Filter-specific configuration for such filters
- is specified using the ExtensionRef field. `Type` MUST be set to
- "ExtensionRef" for custom filters.
-
- Implementers are encouraged to define custom implementation types to
- extend the core API with implementation-specific behavior.
-
- If a reference to a custom filter type cannot be resolved, the filter
- MUST NOT be skipped. Instead, requests that would have been processed by
- that filter MUST receive a HTTP error response.
-
- enum:
- - ResponseHeaderModifier
- - RequestHeaderModifier
- - RequestMirror
- - ExtensionRef
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: filter.requestHeaderModifier must be nil if the
- filter.type is not RequestHeaderModifier
- rule: '!(has(self.requestHeaderModifier) && self.type !=
- ''RequestHeaderModifier'')'
- - message: filter.requestHeaderModifier must be specified
- for RequestHeaderModifier filter.type
- rule: '!(!has(self.requestHeaderModifier) && self.type ==
- ''RequestHeaderModifier'')'
- - message: filter.responseHeaderModifier must be nil if the
- filter.type is not ResponseHeaderModifier
- rule: '!(has(self.responseHeaderModifier) && self.type !=
- ''ResponseHeaderModifier'')'
- - message: filter.responseHeaderModifier must be specified
- for ResponseHeaderModifier filter.type
- rule: '!(!has(self.responseHeaderModifier) && self.type
- == ''ResponseHeaderModifier'')'
- - message: filter.requestMirror must be nil if the filter.type
- is not RequestMirror
- rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')'
- - message: filter.requestMirror must be specified for RequestMirror
- filter.type
- rule: '!(!has(self.requestMirror) && self.type == ''RequestMirror'')'
- - message: filter.extensionRef must be nil if the filter.type
- is not ExtensionRef
- rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')'
- - message: filter.extensionRef must be specified for ExtensionRef
- filter.type
- rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')'
- maxItems: 16
- type: array
- x-kubernetes-validations:
- - message: RequestHeaderModifier filter cannot be repeated
- rule: self.filter(f, f.type == 'RequestHeaderModifier').size()
- <= 1
- - message: ResponseHeaderModifier filter cannot be repeated
- rule: self.filter(f, f.type == 'ResponseHeaderModifier').size()
- <= 1
- matches:
- description: |-
- Matches define conditions used for matching the rule against incoming
- gRPC requests. Each match is independent, i.e. this rule will be matched
- if **any** one of the matches is satisfied.
-
- For example, take the following matches configuration:
-
- ```
- matches:
- - method:
- service: foo.bar
- headers:
- values:
- version: 2
- - method:
- service: foo.bar.v2
- ```
-
- For a request to match against this rule, it MUST satisfy
- EITHER of the two conditions:
-
- - service of foo.bar AND contains the header `version: 2`
- - service of foo.bar.v2
-
- See the documentation for GRPCRouteMatch on how to specify multiple
- match conditions to be ANDed together.
-
- If no matches are specified, the implementation MUST match every gRPC request.
-
- Proxy or Load Balancer routing configuration generated from GRPCRoutes
- MUST prioritize rules based on the following criteria, continuing on
- ties. Merging MUST not be done between GRPCRoutes and HTTPRoutes.
- Precedence MUST be given to the rule with the largest number of:
-
- * Characters in a matching non-wildcard hostname.
- * Characters in a matching hostname.
- * Characters in a matching service.
- * Characters in a matching method.
- * Header matches.
-
- If ties still exist across multiple Routes, matching precedence MUST be
- determined in order of the following criteria, continuing on ties:
-
- * The oldest Route based on creation timestamp.
- * The Route appearing first in alphabetical order by
- "{namespace}/{name}".
-
- If ties still exist within the Route that has been given precedence,
- matching precedence MUST be granted to the first matching rule meeting
- the above criteria.
- items:
- description: |-
- GRPCRouteMatch defines the predicate used to match requests to a given
- action. Multiple match types are ANDed together, i.e. the match will
- evaluate to true only if all conditions are satisfied.
-
- For example, the match below will match a gRPC request only if its service
- is `foo` AND it contains the `version: v1` header:
-
- ```
- matches:
- - method:
- type: Exact
- service: "foo"
- headers:
- - name: "version"
- value "v1"
-
- ```
- properties:
- headers:
- description: |-
- Headers specifies gRPC request header matchers. Multiple match values are
- ANDed together, meaning, a request MUST match all the specified headers
- to select the route.
- items:
- description: |-
- GRPCHeaderMatch describes how to select a gRPC route by matching gRPC request
- headers.
- properties:
- name:
- description: |-
- Name is the name of the gRPC Header to be matched.
-
- If multiple entries specify equivalent header names, only the first
- entry with an equivalent name MUST be considered for a match. Subsequent
- entries with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- type:
- default: Exact
- description: Type specifies how to match against
- the value of the header.
- enum:
- - Exact
- - RegularExpression
- type: string
- value:
- description: Value is the value of the gRPC Header
- to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- method:
- description: |-
- Method specifies a gRPC request service/method matcher. If this field is
- not specified, all services and methods will match.
- properties:
- method:
- description: |-
- Value of the method to match against. If left empty or omitted, will
- match all services.
-
- At least one of Service and Method MUST be a non-empty string.
- maxLength: 1024
- type: string
- service:
- description: |-
- Value of the service to match against. If left empty or omitted, will
- match any service.
-
- At least one of Service and Method MUST be a non-empty string.
- maxLength: 1024
- type: string
- type:
- default: Exact
- description: |-
- Type specifies how to match against the service and/or method.
- Support: Core (Exact with service and method specified)
-
- Support: Implementation-specific (Exact with method specified but no service specified)
-
- Support: Implementation-specific (RegularExpression)
- enum:
- - Exact
- - RegularExpression
- type: string
- type: object
- x-kubernetes-validations:
- - message: One or both of 'service' or 'method' must be
- specified
- rule: 'has(self.type) ? has(self.service) || has(self.method)
- : true'
- - message: service must only contain valid characters
- (matching ^(?i)\.?[a-z_][a-z_0-9]*(\.[a-z_][a-z_0-9]*)*$)
- rule: '(!has(self.type) || self.type == ''Exact'') &&
- has(self.service) ? self.service.matches(r"""^(?i)\.?[a-z_][a-z_0-9]*(\.[a-z_][a-z_0-9]*)*$"""):
- true'
- - message: method must only contain valid characters (matching
- ^[A-Za-z_][A-Za-z_0-9]*$)
- rule: '(!has(self.type) || self.type == ''Exact'') &&
- has(self.method) ? self.method.matches(r"""^[A-Za-z_][A-Za-z_0-9]*$"""):
- true'
- type: object
- maxItems: 8
- type: array
- type: object
- maxItems: 16
- type: array
- x-kubernetes-validations:
- - message: While 16 rules and 64 matches per rule are allowed, the
- total number of matches across all rules in a route must be less
- than 128
- rule: '(self.size() > 0 ? (has(self[0].matches) ? self[0].matches.size()
- : 0) : 0) + (self.size() > 1 ? (has(self[1].matches) ? self[1].matches.size()
- : 0) : 0) + (self.size() > 2 ? (has(self[2].matches) ? self[2].matches.size()
- : 0) : 0) + (self.size() > 3 ? (has(self[3].matches) ? self[3].matches.size()
- : 0) : 0) + (self.size() > 4 ? (has(self[4].matches) ? self[4].matches.size()
- : 0) : 0) + (self.size() > 5 ? (has(self[5].matches) ? self[5].matches.size()
- : 0) : 0) + (self.size() > 6 ? (has(self[6].matches) ? self[6].matches.size()
- : 0) : 0) + (self.size() > 7 ? (has(self[7].matches) ? self[7].matches.size()
- : 0) : 0) + (self.size() > 8 ? (has(self[8].matches) ? self[8].matches.size()
- : 0) : 0) + (self.size() > 9 ? (has(self[9].matches) ? self[9].matches.size()
- : 0) : 0) + (self.size() > 10 ? (has(self[10].matches) ? self[10].matches.size()
- : 0) : 0) + (self.size() > 11 ? (has(self[11].matches) ? self[11].matches.size()
- : 0) : 0) + (self.size() > 12 ? (has(self[12].matches) ? self[12].matches.size()
- : 0) : 0) + (self.size() > 13 ? (has(self[13].matches) ? self[13].matches.size()
- : 0) : 0) + (self.size() > 14 ? (has(self[14].matches) ? self[14].matches.size()
- : 0) : 0) + (self.size() > 15 ? (has(self[15].matches) ? self[15].matches.size()
- : 0) : 0) <= 128'
- type: object
- status:
- description: Status defines the current state of GRPCRoute.
- properties:
- parents:
- description: |-
- Parents is a list of parent resources (usually Gateways) that are
- associated with the route, and the status of the route with respect to
- each parent. When this route attaches to a parent, the controller that
- manages the parent must add an entry to this list when the controller
- first sees the route and should update the entry as appropriate when the
- route or gateway is modified.
-
- Note that parent references that cannot be resolved by an implementation
- of this API will not be added to this list. Implementations of this API
- can only populate Route status for the Gateways/parent resources they are
- responsible for.
-
- A maximum of 32 Gateways will be represented in this list. An empty list
- means the route has not been attached to any Gateway.
- items:
- description: |-
- RouteParentStatus describes the status of a route with respect to an
- associated Parent.
- properties:
- conditions:
- description: |-
- Conditions describes the status of the route with respect to the Gateway.
- Note that the route's availability is also subject to the Gateway's own
- status conditions and listener status.
-
- If the Route's ParentRef specifies an existing Gateway that supports
- Routes of this kind AND that Gateway's controller has sufficient access,
- then that Gateway's controller MUST set the "Accepted" condition on the
- Route, to indicate whether the route has been accepted or rejected by the
- Gateway, and why.
-
- A Route MUST be considered "Accepted" if at least one of the Route's
- rules is implemented by the Gateway.
-
- There are a number of cases where the "Accepted" condition may not be set
- due to lack of controller visibility, that includes when:
-
- * The Route refers to a non-existent parent.
- * The Route is of a type that the controller does not support.
- * The Route is in a namespace the controller does not have access to.
- items:
- description: Condition contains details for one aspect of
- the current state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False,
- Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- maxItems: 8
- minItems: 1
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- controllerName:
- description: |-
- ControllerName is a domain/path string that indicates the name of the
- controller that wrote this status. This corresponds with the
- controllerName field on GatewayClass.
-
- Example: "example.net/gateway-controller".
-
- The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
- valid Kubernetes names
- (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
-
- Controllers MUST populate this field when writing status. Controllers should ensure that
- entries to status populated with their ControllerName are cleaned up when they are no
- longer necessary.
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
- type: string
- parentRef:
- description: |-
- ParentRef corresponds with a ParentRef in the spec that this
- RouteParentStatus struct describes the status of.
- properties:
- group:
- default: gateway.networking.k8s.io
- description: |-
- Group is the group of the referent.
- When unspecified, "gateway.networking.k8s.io" is inferred.
- To set the core API group (such as for a "Service" kind referent),
- Group must be explicitly set to "" (empty string).
-
- Support: Core
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Gateway
- description: |-
- Kind is kind of the referent.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- Support for other resources is Implementation-Specific.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: |-
- Name is the name of the referent.
-
- Support: Core
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referent. When unspecified, this refers
- to the local namespace of the Route.
-
- Note that there are specific rules for ParentRefs which cross namespace
- boundaries. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example:
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable any other kind of cross-namespace reference.
-
-
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port is the network port this Route targets. It can be interpreted
- differently based on the type of parent resource.
-
- When the parent resource is a Gateway, this targets all listeners
- listening on the specified port that also support this kind of Route(and
- select this Route). It's not recommended to set `Port` unless the
- networking behaviors specified in a Route must apply to a specific port
- as opposed to a listener(s) whose port(s) may be changed. When both Port
- and SectionName are specified, the name and port of the selected listener
- must match both specified values.
-
-
-
- Implementations MAY choose to support other parent resources.
- Implementations supporting other types of parent resources MUST clearly
- document how/if Port is interpreted.
-
- For the purpose of status, an attachment is considered successful as
- long as the parent resource accepts it partially. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
- from the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route,
- the Route MUST be considered detached from the Gateway.
-
- Support: Extended
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- sectionName:
- description: |-
- SectionName is the name of a section within the target resource. In the
- following resources, SectionName is interpreted as the following:
-
- * Gateway: Listener name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
- * Service: Port name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
-
- Implementations MAY choose to support attaching Routes to other resources.
- If that is the case, they MUST clearly document how SectionName is
- interpreted.
-
- When unspecified (empty string), this will reference the entire resource.
- For the purpose of status, an attachment is considered successful if at
- least one section in the parent resource accepts it. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
- the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route, the
- Route MUST be considered detached from the Gateway.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- required:
- - name
- type: object
- required:
- - controllerName
- - parentRef
- type: object
- maxItems: 32
- type: array
- required:
- - parents
- type: object
- type: object
- served: true
- storage: true
- subresources:
- status: {}
-status:
- acceptedNames:
- kind: ""
- plural: ""
- conditions: null
- storedVersions: null
----
-#
-# config/crd/standard/gateway.networking.k8s.io_httproutes.yaml
-#
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
- gateway.networking.k8s.io/bundle-version: v1.2.1
- gateway.networking.k8s.io/channel: standard
- creationTimestamp: null
- name: httproutes.gateway.networking.k8s.io
-spec:
- group: gateway.networking.k8s.io
- names:
- categories:
- - gateway-api
- kind: HTTPRoute
- listKind: HTTPRouteList
- plural: httproutes
- singular: httproute
- scope: Namespaced
- versions:
- - additionalPrinterColumns:
- - jsonPath: .spec.hostnames
- name: Hostnames
- type: string
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- name: v1
- schema:
- openAPIV3Schema:
- description: |-
- HTTPRoute provides a way to route HTTP requests. This includes the capability
- to match requests by hostname, path, header, or query param. Filters can be
- used to specify additional processing steps. Backends specify where matching
- requests should be routed.
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: Spec defines the desired state of HTTPRoute.
- properties:
- hostnames:
- description: |-
- Hostnames defines a set of hostnames that should match against the HTTP Host
- header to select a HTTPRoute used to process the request. Implementations
- MUST ignore any port value specified in the HTTP Host header while
- performing a match and (absent of any applicable header modification
- configuration) MUST forward this header unmodified to the backend.
-
- Valid values for Hostnames are determined by RFC 1123 definition of a
- hostname with 2 notable exceptions:
-
- 1. IPs are not allowed.
- 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard
- label must appear by itself as the first label.
-
- If a hostname is specified by both the Listener and HTTPRoute, there
- must be at least one intersecting hostname for the HTTPRoute to be
- attached to the Listener. For example:
-
- * A Listener with `test.example.com` as the hostname matches HTTPRoutes
- that have either not specified any hostnames, or have specified at
- least one of `test.example.com` or `*.example.com`.
- * A Listener with `*.example.com` as the hostname matches HTTPRoutes
- that have either not specified any hostnames or have specified at least
- one hostname that matches the Listener hostname. For example,
- `*.example.com`, `test.example.com`, and `foo.test.example.com` would
- all match. On the other hand, `example.com` and `test.example.net` would
- not match.
-
- Hostnames that are prefixed with a wildcard label (`*.`) are interpreted
- as a suffix match. That means that a match for `*.example.com` would match
- both `test.example.com`, and `foo.test.example.com`, but not `example.com`.
-
- If both the Listener and HTTPRoute have specified hostnames, any
- HTTPRoute hostnames that do not match the Listener hostname MUST be
- ignored. For example, if a Listener specified `*.example.com`, and the
- HTTPRoute specified `test.example.com` and `test.example.net`,
- `test.example.net` must not be considered for a match.
-
- If both the Listener and HTTPRoute have specified hostnames, and none
- match with the criteria above, then the HTTPRoute is not accepted. The
- implementation must raise an 'Accepted' Condition with a status of
- `False` in the corresponding RouteParentStatus.
-
- In the event that multiple HTTPRoutes specify intersecting hostnames (e.g.
- overlapping wildcard matching and exact matching hostnames), precedence must
- be given to rules from the HTTPRoute with the largest number of:
-
- * Characters in a matching non-wildcard hostname.
- * Characters in a matching hostname.
-
- If ties exist across multiple Routes, the matching precedence rules for
- HTTPRouteMatches takes over.
-
- Support: Core
- items:
- description: |-
- Hostname is the fully qualified domain name of a network host. This matches
- the RFC 1123 definition of a hostname with 2 notable exceptions:
-
- 1. IPs are not allowed.
- 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard
- label must appear by itself as the first label.
-
- Hostname can be "precise" which is a domain name without the terminating
- dot of a network host (e.g. "foo.example.com") or "wildcard", which is a
- domain name prefixed with a single wildcard label (e.g. `*.example.com`).
-
- Note that as per RFC1035 and RFC1123, a *label* must consist of lower case
- alphanumeric characters or '-', and must start and end with an alphanumeric
- character. No other punctuation is allowed.
- maxLength: 253
- minLength: 1
- pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- maxItems: 16
- type: array
- parentRefs:
- description: |+
- ParentRefs references the resources (usually Gateways) that a Route wants
- to be attached to. Note that the referenced parent resource needs to
- allow this for the attachment to be complete. For Gateways, that means
- the Gateway needs to allow attachment from Routes of this kind and
- namespace. For Services, that means the Service must either be in the same
- namespace for a "producer" route, or the mesh implementation must support
- and allow "consumer" routes for the referenced Service. ReferenceGrant is
- not applicable for governing ParentRefs to Services - it is not possible to
- create a "producer" route for a Service in a different namespace from the
- Route.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- This API may be extended in the future to support additional kinds of parent
- resources.
-
- ParentRefs must be _distinct_. This means either that:
-
- * They select different objects. If this is the case, then parentRef
- entries are distinct. In terms of fields, this means that the
- multi-part key defined by `group`, `kind`, `namespace`, and `name` must
- be unique across all parentRef entries in the Route.
- * They do not select different objects, but for each optional field used,
- each ParentRef that selects the same object must set the same set of
- optional fields to different values. If one ParentRef sets a
- combination of optional fields, all must set the same combination.
-
- Some examples:
-
- * If one ParentRef sets `sectionName`, all ParentRefs referencing the
- same object must also set `sectionName`.
- * If one ParentRef sets `port`, all ParentRefs referencing the same
- object must also set `port`.
- * If one ParentRef sets `sectionName` and `port`, all ParentRefs
- referencing the same object must also set `sectionName` and `port`.
-
- It is possible to separately reference multiple distinct objects that may
- be collapsed by an implementation. For example, some implementations may
- choose to merge compatible Gateway Listeners together. If that is the
- case, the list of routes attached to those resources should also be
- merged.
-
- Note that for ParentRefs that cross namespace boundaries, there are specific
- rules. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example,
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable other kinds of cross-namespace reference.
-
-
-
-
-
-
- items:
- description: |-
- ParentReference identifies an API object (usually a Gateway) that can be considered
- a parent of this resource (usually a route). There are two kinds of parent resources
- with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- This API may be extended in the future to support additional kinds of parent
- resources.
-
- The API object must be valid in the cluster; the Group and Kind must
- be registered in the cluster for this reference to be valid.
- properties:
- group:
- default: gateway.networking.k8s.io
- description: |-
- Group is the group of the referent.
- When unspecified, "gateway.networking.k8s.io" is inferred.
- To set the core API group (such as for a "Service" kind referent),
- Group must be explicitly set to "" (empty string).
-
- Support: Core
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Gateway
- description: |-
- Kind is kind of the referent.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- Support for other resources is Implementation-Specific.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: |-
- Name is the name of the referent.
-
- Support: Core
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referent. When unspecified, this refers
- to the local namespace of the Route.
-
- Note that there are specific rules for ParentRefs which cross namespace
- boundaries. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example:
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable any other kind of cross-namespace reference.
-
-
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port is the network port this Route targets. It can be interpreted
- differently based on the type of parent resource.
-
- When the parent resource is a Gateway, this targets all listeners
- listening on the specified port that also support this kind of Route(and
- select this Route). It's not recommended to set `Port` unless the
- networking behaviors specified in a Route must apply to a specific port
- as opposed to a listener(s) whose port(s) may be changed. When both Port
- and SectionName are specified, the name and port of the selected listener
- must match both specified values.
-
-
-
- Implementations MAY choose to support other parent resources.
- Implementations supporting other types of parent resources MUST clearly
- document how/if Port is interpreted.
-
- For the purpose of status, an attachment is considered successful as
- long as the parent resource accepts it partially. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
- from the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route,
- the Route MUST be considered detached from the Gateway.
-
- Support: Extended
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- sectionName:
- description: |-
- SectionName is the name of a section within the target resource. In the
- following resources, SectionName is interpreted as the following:
-
- * Gateway: Listener name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
- * Service: Port name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
-
- Implementations MAY choose to support attaching Routes to other resources.
- If that is the case, they MUST clearly document how SectionName is
- interpreted.
-
- When unspecified (empty string), this will reference the entire resource.
- For the purpose of status, an attachment is considered successful if at
- least one section in the parent resource accepts it. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
- the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route, the
- Route MUST be considered detached from the Gateway.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- required:
- - name
- type: object
- maxItems: 32
- type: array
- x-kubernetes-validations:
- - message: sectionName must be specified when parentRefs includes
- 2 or more references to the same parent
- rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind
- == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__)
- || p1.__namespace__ == '''') && (!has(p2.__namespace__) || p2.__namespace__
- == '''')) || (has(p1.__namespace__) && has(p2.__namespace__) &&
- p1.__namespace__ == p2.__namespace__ )) ? ((!has(p1.sectionName)
- || p1.sectionName == '''') == (!has(p2.sectionName) || p2.sectionName
- == '''')) : true))'
- - message: sectionName must be unique when parentRefs includes 2 or
- more references to the same parent
- rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind
- == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__)
- || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__
- == '')) || (has(p1.__namespace__) && has(p2.__namespace__) &&
- p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName)
- || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName
- == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName
- == p2.sectionName))))
- rules:
- default:
- - matches:
- - path:
- type: PathPrefix
- value: /
- description: |+
- Rules are a list of HTTP matchers, filters and actions.
-
- items:
- description: |-
- HTTPRouteRule defines semantics for matching an HTTP request based on
- conditions (matches), processing it (filters), and forwarding the request to
- an API object (backendRefs).
- properties:
- backendRefs:
- description: |-
- BackendRefs defines the backend(s) where matching requests should be
- sent.
-
- Failure behavior here depends on how many BackendRefs are specified and
- how many are invalid.
-
- If *all* entries in BackendRefs are invalid, and there are also no filters
- specified in this route rule, *all* traffic which matches this rule MUST
- receive a 500 status code.
-
- See the HTTPBackendRef definition for the rules about what makes a single
- HTTPBackendRef invalid.
-
- When a HTTPBackendRef is invalid, 500 status codes MUST be returned for
- requests that would have otherwise been routed to an invalid backend. If
- multiple backends are specified, and some are invalid, the proportion of
- requests that would otherwise have been routed to an invalid backend
- MUST receive a 500 status code.
-
- For example, if two backends are specified with equal weights, and one is
- invalid, 50 percent of traffic must receive a 500. Implementations may
- choose how that 50 percent is determined.
-
- When a HTTPBackendRef refers to a Service that has no ready endpoints,
- implementations SHOULD return a 503 for requests to that backend instead.
- If an implementation chooses to do this, all of the above rules for 500 responses
- MUST also apply for responses that return a 503.
-
- Support: Core for Kubernetes Service
-
- Support: Extended for Kubernetes ServiceImport
-
- Support: Implementation-specific for any other resource
-
- Support for weight: Core
- items:
- description: |-
- HTTPBackendRef defines how a HTTPRoute forwards a HTTP request.
-
- Note that when a namespace different than the local namespace is specified, a
- ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
-
-
- When the BackendRef points to a Kubernetes Service, implementations SHOULD
- honor the appProtocol field if it is set for the target Service Port.
-
- Implementations supporting appProtocol SHOULD recognize the Kubernetes
- Standard Application Protocols defined in KEP-3726.
-
- If a Service appProtocol isn't specified, an implementation MAY infer the
- backend protocol through its own means. Implementations MAY infer the
- protocol from the Route type referring to the backend Service.
-
- If a Route is not able to send traffic to the backend using the specified
- protocol then the backend is considered invalid. Implementations MUST set the
- "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason.
-
-
- properties:
- filters:
- description: |-
- Filters defined at this level should be executed if and only if the
- request is being forwarded to the backend defined here.
-
- Support: Implementation-specific (For broader support of filters, use the
- Filters field in HTTPRouteRule.)
- items:
- description: |-
- HTTPRouteFilter defines processing steps that must be completed during the
- request or response lifecycle. HTTPRouteFilters are meant as an extension
- point to express processing that may be done in Gateway implementations. Some
- examples include request or response modification, implementing
- authentication strategies, rate-limiting, and traffic shaping. API
- guarantee/conformance is defined based on the type of the filter.
- properties:
- extensionRef:
- description: |-
- ExtensionRef is an optional, implementation-specific extension to the
- "filter" behavior. For example, resource "myroutefilter" in group
- "networking.example.net"). ExtensionRef MUST NOT be used for core and
- extended filters.
-
- This filter can be used multiple times within the same rule.
-
- Support: Implementation-specific
- properties:
- group:
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is kind of the referent. For
- example "HTTPRoute" or "Service".
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- required:
- - group
- - kind
- - name
- type: object
- requestHeaderModifier:
- description: |-
- RequestHeaderModifier defines a schema for a filter that modifies request
- headers.
-
- Support: Core
- properties:
- add:
- description: |-
- Add adds the given header(s) (name, value) to the request
- before the action. It appends to any existing values associated
- with the header name.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- add:
- - name: "my-header"
- value: "bar,baz"
-
- Output:
- GET /foo HTTP/1.1
- my-header: foo,bar,baz
- items:
- description: HTTPHeader represents an HTTP
- Header name and value as defined by RFC
- 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP
- Header to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- remove:
- description: |-
- Remove the given header(s) from the HTTP request before the action. The
- value of Remove is a list of HTTP header names. Note that the header
- names are case-insensitive (see
- https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).
-
- Input:
- GET /foo HTTP/1.1
- my-header1: foo
- my-header2: bar
- my-header3: baz
-
- Config:
- remove: ["my-header1", "my-header3"]
-
- Output:
- GET /foo HTTP/1.1
- my-header2: bar
- items:
- type: string
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- set:
- description: |-
- Set overwrites the request with the given header (name, value)
- before the action.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- set:
- - name: "my-header"
- value: "bar"
-
- Output:
- GET /foo HTTP/1.1
- my-header: bar
- items:
- description: HTTPHeader represents an HTTP
- Header name and value as defined by RFC
- 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP
- Header to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- requestMirror:
- description: |+
- RequestMirror defines a schema for a filter that mirrors requests.
- Requests are sent to the specified destination, but responses from
- that destination are ignored.
-
- This filter can be used multiple times within the same rule. Note that
- not all implementations will be able to support mirroring to multiple
- backends.
-
- Support: Extended
-
- properties:
- backendRef:
- description: |-
- BackendRef references a resource where mirrored requests are sent.
-
- Mirrored requests must be sent only to a single destination endpoint
- within this BackendRef, irrespective of how many endpoints are present
- within this BackendRef.
-
- If the referent cannot be found, this BackendRef is invalid and must be
- dropped from the Gateway. The controller must ensure the "ResolvedRefs"
- condition on the Route status is set to `status: False` and not configure
- this backend in the underlying implementation.
-
- If there is a cross-namespace reference to an *existing* object
- that is not allowed by a ReferenceGrant, the controller must ensure the
- "ResolvedRefs" condition on the Route is set to `status: False`,
- with the "RefNotPermitted" reason and not configure this backend in the
- underlying implementation.
-
- In either error case, the Message of the `ResolvedRefs` Condition
- should be used to provide more detail about the problem.
-
- Support: Extended for Kubernetes Service
-
- Support: Implementation-specific for any other resource
- properties:
- group:
- default: ""
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Service
- description: |-
- Kind is the Kubernetes resource kind of the referent. For example
- "Service".
-
- Defaults to "Service" when not specified.
-
- ExternalName services can refer to CNAME DNS records that may live
- outside of the cluster and as such are difficult to reason about in
- terms of conformance. They also may not be safe to forward to (see
- CVE-2021-25740 for more information). Implementations SHOULD NOT
- support ExternalName Services.
-
- Support: Core (Services with a type other than ExternalName)
-
- Support: Implementation-specific (Services with type ExternalName)
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the backend. When unspecified, the local
- namespace is inferred.
-
- Note that when a namespace different than the local namespace is specified,
- a ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port specifies the destination port number to use for this resource.
- Port is required when the referent is a Kubernetes Service. In this
- case, the port number is the service port number, not the target port.
- For other resources, destination port might be derived from the referent
- resource or this field.
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- required:
- - name
- type: object
- x-kubernetes-validations:
- - message: Must have port for Service reference
- rule: '(size(self.group) == 0 && self.kind
- == ''Service'') ? has(self.port) : true'
- required:
- - backendRef
- type: object
- requestRedirect:
- description: |-
- RequestRedirect defines a schema for a filter that responds to the
- request with an HTTP redirection.
-
- Support: Core
- properties:
- hostname:
- description: |-
- Hostname is the hostname to be used in the value of the `Location`
- header in the response.
- When empty, the hostname in the `Host` header of the request is used.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- path:
- description: |-
- Path defines parameters used to modify the path of the incoming request.
- The modified path is then used to construct the `Location` header. When
- empty, the request path is used as-is.
-
- Support: Extended
- properties:
- replaceFullPath:
- description: |-
- ReplaceFullPath specifies the value with which to replace the full path
- of a request during a rewrite or redirect.
- maxLength: 1024
- type: string
- replacePrefixMatch:
- description: |-
- ReplacePrefixMatch specifies the value with which to replace the prefix
- match of a request during a rewrite or redirect. For example, a request
- to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch
- of "/xyz" would be modified to "/xyz/bar".
-
- Note that this matches the behavior of the PathPrefix match type. This
- matches full path elements. A path element refers to the list of labels
- in the path split by the `/` separator. When specified, a trailing `/` is
- ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all
- match the prefix `/abc`, but the path `/abcd` would not.
-
- ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.
- Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in
- the implementation setting the Accepted Condition for the Route to `status: False`.
-
- Request Path | Prefix Match | Replace Prefix | Modified Path
- maxLength: 1024
- type: string
- type:
- description: |-
- Type defines the type of path modifier. Additional types may be
- added in a future release of the API.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
- enum:
- - ReplaceFullPath
- - ReplacePrefixMatch
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: replaceFullPath must be specified
- when type is set to 'ReplaceFullPath'
- rule: 'self.type == ''ReplaceFullPath'' ?
- has(self.replaceFullPath) : true'
- - message: type must be 'ReplaceFullPath' when
- replaceFullPath is set
- rule: 'has(self.replaceFullPath) ? self.type
- == ''ReplaceFullPath'' : true'
- - message: replacePrefixMatch must be specified
- when type is set to 'ReplacePrefixMatch'
- rule: 'self.type == ''ReplacePrefixMatch''
- ? has(self.replacePrefixMatch) : true'
- - message: type must be 'ReplacePrefixMatch'
- when replacePrefixMatch is set
- rule: 'has(self.replacePrefixMatch) ? self.type
- == ''ReplacePrefixMatch'' : true'
- port:
- description: |-
- Port is the port to be used in the value of the `Location`
- header in the response.
-
- If no port is specified, the redirect port MUST be derived using the
- following rules:
-
- * If redirect scheme is not-empty, the redirect port MUST be the well-known
- port associated with the redirect scheme. Specifically "http" to port 80
- and "https" to port 443. If the redirect scheme does not have a
- well-known port, the listener port of the Gateway SHOULD be used.
- * If redirect scheme is empty, the redirect port MUST be the Gateway
- Listener port.
-
- Implementations SHOULD NOT add the port number in the 'Location'
- header in the following cases:
-
- * A Location header that will use HTTP (whether that is determined via
- the Listener protocol or the Scheme field) _and_ use port 80.
- * A Location header that will use HTTPS (whether that is determined via
- the Listener protocol or the Scheme field) _and_ use port 443.
-
- Support: Extended
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- scheme:
- description: |-
- Scheme is the scheme to be used in the value of the `Location` header in
- the response. When empty, the scheme of the request is used.
-
- Scheme redirects can affect the port of the redirect, for more information,
- refer to the documentation for the port field of this filter.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
-
- Support: Extended
- enum:
- - http
- - https
- type: string
- statusCode:
- default: 302
- description: |-
- StatusCode is the HTTP status code to be used in response.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
-
- Support: Core
- enum:
- - 301
- - 302
- type: integer
- type: object
- responseHeaderModifier:
- description: |-
- ResponseHeaderModifier defines a schema for a filter that modifies response
- headers.
-
- Support: Extended
- properties:
- add:
- description: |-
- Add adds the given header(s) (name, value) to the request
- before the action. It appends to any existing values associated
- with the header name.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- add:
- - name: "my-header"
- value: "bar,baz"
-
- Output:
- GET /foo HTTP/1.1
- my-header: foo,bar,baz
- items:
- description: HTTPHeader represents an HTTP
- Header name and value as defined by RFC
- 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP
- Header to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- remove:
- description: |-
- Remove the given header(s) from the HTTP request before the action. The
- value of Remove is a list of HTTP header names. Note that the header
- names are case-insensitive (see
- https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).
-
- Input:
- GET /foo HTTP/1.1
- my-header1: foo
- my-header2: bar
- my-header3: baz
-
- Config:
- remove: ["my-header1", "my-header3"]
-
- Output:
- GET /foo HTTP/1.1
- my-header2: bar
- items:
- type: string
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- set:
- description: |-
- Set overwrites the request with the given header (name, value)
- before the action.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- set:
- - name: "my-header"
- value: "bar"
-
- Output:
- GET /foo HTTP/1.1
- my-header: bar
- items:
- description: HTTPHeader represents an HTTP
- Header name and value as defined by RFC
- 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP
- Header to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- type:
- description: |-
- Type identifies the type of filter to apply. As with other API fields,
- types are classified into three conformance levels:
-
- - Core: Filter types and their corresponding configuration defined by
- "Support: Core" in this package, e.g. "RequestHeaderModifier". All
- implementations must support core filters.
-
- - Extended: Filter types and their corresponding configuration defined by
- "Support: Extended" in this package, e.g. "RequestMirror". Implementers
- are encouraged to support extended filters.
-
- - Implementation-specific: Filters that are defined and supported by
- specific vendors.
- In the future, filters showing convergence in behavior across multiple
- implementations will be considered for inclusion in extended or core
- conformance levels. Filter-specific configuration for such filters
- is specified using the ExtensionRef field. `Type` should be set to
- "ExtensionRef" for custom filters.
-
- Implementers are encouraged to define custom implementation types to
- extend the core API with implementation-specific behavior.
-
- If a reference to a custom filter type cannot be resolved, the filter
- MUST NOT be skipped. Instead, requests that would have been processed by
- that filter MUST receive a HTTP error response.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
- enum:
- - RequestHeaderModifier
- - ResponseHeaderModifier
- - RequestMirror
- - RequestRedirect
- - URLRewrite
- - ExtensionRef
- type: string
- urlRewrite:
- description: |-
- URLRewrite defines a schema for a filter that modifies a request during forwarding.
-
- Support: Extended
- properties:
- hostname:
- description: |-
- Hostname is the value to be used to replace the Host header value during
- forwarding.
-
- Support: Extended
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- path:
- description: |-
- Path defines a path rewrite.
-
- Support: Extended
- properties:
- replaceFullPath:
- description: |-
- ReplaceFullPath specifies the value with which to replace the full path
- of a request during a rewrite or redirect.
- maxLength: 1024
- type: string
- replacePrefixMatch:
- description: |-
- ReplacePrefixMatch specifies the value with which to replace the prefix
- match of a request during a rewrite or redirect. For example, a request
- to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch
- of "/xyz" would be modified to "/xyz/bar".
-
- Note that this matches the behavior of the PathPrefix match type. This
- matches full path elements. A path element refers to the list of labels
- in the path split by the `/` separator. When specified, a trailing `/` is
- ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all
- match the prefix `/abc`, but the path `/abcd` would not.
-
- ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.
- Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in
- the implementation setting the Accepted Condition for the Route to `status: False`.
-
- Request Path | Prefix Match | Replace Prefix | Modified Path
- maxLength: 1024
- type: string
- type:
- description: |-
- Type defines the type of path modifier. Additional types may be
- added in a future release of the API.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
- enum:
- - ReplaceFullPath
- - ReplacePrefixMatch
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: replaceFullPath must be specified
- when type is set to 'ReplaceFullPath'
- rule: 'self.type == ''ReplaceFullPath'' ?
- has(self.replaceFullPath) : true'
- - message: type must be 'ReplaceFullPath' when
- replaceFullPath is set
- rule: 'has(self.replaceFullPath) ? self.type
- == ''ReplaceFullPath'' : true'
- - message: replacePrefixMatch must be specified
- when type is set to 'ReplacePrefixMatch'
- rule: 'self.type == ''ReplacePrefixMatch''
- ? has(self.replacePrefixMatch) : true'
- - message: type must be 'ReplacePrefixMatch'
- when replacePrefixMatch is set
- rule: 'has(self.replacePrefixMatch) ? self.type
- == ''ReplacePrefixMatch'' : true'
- type: object
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: filter.requestHeaderModifier must be nil
- if the filter.type is not RequestHeaderModifier
- rule: '!(has(self.requestHeaderModifier) && self.type
- != ''RequestHeaderModifier'')'
- - message: filter.requestHeaderModifier must be specified
- for RequestHeaderModifier filter.type
- rule: '!(!has(self.requestHeaderModifier) && self.type
- == ''RequestHeaderModifier'')'
- - message: filter.responseHeaderModifier must be nil
- if the filter.type is not ResponseHeaderModifier
- rule: '!(has(self.responseHeaderModifier) && self.type
- != ''ResponseHeaderModifier'')'
- - message: filter.responseHeaderModifier must be specified
- for ResponseHeaderModifier filter.type
- rule: '!(!has(self.responseHeaderModifier) && self.type
- == ''ResponseHeaderModifier'')'
- - message: filter.requestMirror must be nil if the filter.type
- is not RequestMirror
- rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')'
- - message: filter.requestMirror must be specified for
- RequestMirror filter.type
- rule: '!(!has(self.requestMirror) && self.type ==
- ''RequestMirror'')'
- - message: filter.requestRedirect must be nil if the
- filter.type is not RequestRedirect
- rule: '!(has(self.requestRedirect) && self.type !=
- ''RequestRedirect'')'
- - message: filter.requestRedirect must be specified
- for RequestRedirect filter.type
- rule: '!(!has(self.requestRedirect) && self.type ==
- ''RequestRedirect'')'
- - message: filter.urlRewrite must be nil if the filter.type
- is not URLRewrite
- rule: '!(has(self.urlRewrite) && self.type != ''URLRewrite'')'
- - message: filter.urlRewrite must be specified for URLRewrite
- filter.type
- rule: '!(!has(self.urlRewrite) && self.type == ''URLRewrite'')'
- - message: filter.extensionRef must be nil if the filter.type
- is not ExtensionRef
- rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')'
- - message: filter.extensionRef must be specified for
- ExtensionRef filter.type
- rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')'
- maxItems: 16
- type: array
- x-kubernetes-validations:
- - message: May specify either httpRouteFilterRequestRedirect
- or httpRouteFilterRequestRewrite, but not both
- rule: '!(self.exists(f, f.type == ''RequestRedirect'')
- && self.exists(f, f.type == ''URLRewrite''))'
- - message: May specify either httpRouteFilterRequestRedirect
- or httpRouteFilterRequestRewrite, but not both
- rule: '!(self.exists(f, f.type == ''RequestRedirect'')
- && self.exists(f, f.type == ''URLRewrite''))'
- - message: RequestHeaderModifier filter cannot be repeated
- rule: self.filter(f, f.type == 'RequestHeaderModifier').size()
- <= 1
- - message: ResponseHeaderModifier filter cannot be repeated
- rule: self.filter(f, f.type == 'ResponseHeaderModifier').size()
- <= 1
- - message: RequestRedirect filter cannot be repeated
- rule: self.filter(f, f.type == 'RequestRedirect').size()
- <= 1
- - message: URLRewrite filter cannot be repeated
- rule: self.filter(f, f.type == 'URLRewrite').size()
- <= 1
- group:
- default: ""
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Service
- description: |-
- Kind is the Kubernetes resource kind of the referent. For example
- "Service".
-
- Defaults to "Service" when not specified.
-
- ExternalName services can refer to CNAME DNS records that may live
- outside of the cluster and as such are difficult to reason about in
- terms of conformance. They also may not be safe to forward to (see
- CVE-2021-25740 for more information). Implementations SHOULD NOT
- support ExternalName Services.
-
- Support: Core (Services with a type other than ExternalName)
-
- Support: Implementation-specific (Services with type ExternalName)
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the backend. When unspecified, the local
- namespace is inferred.
-
- Note that when a namespace different than the local namespace is specified,
- a ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port specifies the destination port number to use for this resource.
- Port is required when the referent is a Kubernetes Service. In this
- case, the port number is the service port number, not the target port.
- For other resources, destination port might be derived from the referent
- resource or this field.
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- weight:
- default: 1
- description: |-
- Weight specifies the proportion of requests forwarded to the referenced
- backend. This is computed as weight/(sum of all weights in this
- BackendRefs list). For non-zero values, there may be some epsilon from
- the exact proportion defined here depending on the precision an
- implementation supports. Weight is not a percentage and the sum of
- weights does not need to equal 100.
-
- If only one backend is specified and it has a weight greater than 0, 100%
- of the traffic is forwarded to that backend. If weight is set to 0, no
- traffic should be forwarded for this entry. If unspecified, weight
- defaults to 1.
-
- Support for this field varies based on the context where used.
- format: int32
- maximum: 1000000
- minimum: 0
- type: integer
- required:
- - name
- type: object
- x-kubernetes-validations:
- - message: Must have port for Service reference
- rule: '(size(self.group) == 0 && self.kind == ''Service'')
- ? has(self.port) : true'
- maxItems: 16
- type: array
- filters:
- description: |-
- Filters define the filters that are applied to requests that match
- this rule.
-
- Wherever possible, implementations SHOULD implement filters in the order
- they are specified.
-
- Implementations MAY choose to implement this ordering strictly, rejecting
- any combination or order of filters that can not be supported. If implementations
- choose a strict interpretation of filter ordering, they MUST clearly document
- that behavior.
-
- To reject an invalid combination or order of filters, implementations SHOULD
- consider the Route Rules with this configuration invalid. If all Route Rules
- in a Route are invalid, the entire Route would be considered invalid. If only
- a portion of Route Rules are invalid, implementations MUST set the
- "PartiallyInvalid" condition for the Route.
-
- Conformance-levels at this level are defined based on the type of filter:
-
- - ALL core filters MUST be supported by all implementations.
- - Implementers are encouraged to support extended filters.
- - Implementation-specific custom filters have no API guarantees across
- implementations.
-
- Specifying the same filter multiple times is not supported unless explicitly
- indicated in the filter.
-
- All filters are expected to be compatible with each other except for the
- URLRewrite and RequestRedirect filters, which may not be combined. If an
- implementation can not support other combinations of filters, they must clearly
- document that limitation. In cases where incompatible or unsupported
- filters are specified and cause the `Accepted` condition to be set to status
- `False`, implementations may use the `IncompatibleFilters` reason to specify
- this configuration error.
-
- Support: Core
- items:
- description: |-
- HTTPRouteFilter defines processing steps that must be completed during the
- request or response lifecycle. HTTPRouteFilters are meant as an extension
- point to express processing that may be done in Gateway implementations. Some
- examples include request or response modification, implementing
- authentication strategies, rate-limiting, and traffic shaping. API
- guarantee/conformance is defined based on the type of the filter.
- properties:
- extensionRef:
- description: |-
- ExtensionRef is an optional, implementation-specific extension to the
- "filter" behavior. For example, resource "myroutefilter" in group
- "networking.example.net"). ExtensionRef MUST NOT be used for core and
- extended filters.
-
- This filter can be used multiple times within the same rule.
-
- Support: Implementation-specific
- properties:
- group:
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is kind of the referent. For example
- "HTTPRoute" or "Service".
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- required:
- - group
- - kind
- - name
- type: object
- requestHeaderModifier:
- description: |-
- RequestHeaderModifier defines a schema for a filter that modifies request
- headers.
-
- Support: Core
- properties:
- add:
- description: |-
- Add adds the given header(s) (name, value) to the request
- before the action. It appends to any existing values associated
- with the header name.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- add:
- - name: "my-header"
- value: "bar,baz"
-
- Output:
- GET /foo HTTP/1.1
- my-header: foo,bar,baz
- items:
- description: HTTPHeader represents an HTTP Header
- name and value as defined by RFC 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP Header
- to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- remove:
- description: |-
- Remove the given header(s) from the HTTP request before the action. The
- value of Remove is a list of HTTP header names. Note that the header
- names are case-insensitive (see
- https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).
-
- Input:
- GET /foo HTTP/1.1
- my-header1: foo
- my-header2: bar
- my-header3: baz
-
- Config:
- remove: ["my-header1", "my-header3"]
-
- Output:
- GET /foo HTTP/1.1
- my-header2: bar
- items:
- type: string
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- set:
- description: |-
- Set overwrites the request with the given header (name, value)
- before the action.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- set:
- - name: "my-header"
- value: "bar"
-
- Output:
- GET /foo HTTP/1.1
- my-header: bar
- items:
- description: HTTPHeader represents an HTTP Header
- name and value as defined by RFC 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP Header
- to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- requestMirror:
- description: |+
- RequestMirror defines a schema for a filter that mirrors requests.
- Requests are sent to the specified destination, but responses from
- that destination are ignored.
-
- This filter can be used multiple times within the same rule. Note that
- not all implementations will be able to support mirroring to multiple
- backends.
-
- Support: Extended
-
- properties:
- backendRef:
- description: |-
- BackendRef references a resource where mirrored requests are sent.
-
- Mirrored requests must be sent only to a single destination endpoint
- within this BackendRef, irrespective of how many endpoints are present
- within this BackendRef.
-
- If the referent cannot be found, this BackendRef is invalid and must be
- dropped from the Gateway. The controller must ensure the "ResolvedRefs"
- condition on the Route status is set to `status: False` and not configure
- this backend in the underlying implementation.
-
- If there is a cross-namespace reference to an *existing* object
- that is not allowed by a ReferenceGrant, the controller must ensure the
- "ResolvedRefs" condition on the Route is set to `status: False`,
- with the "RefNotPermitted" reason and not configure this backend in the
- underlying implementation.
-
- In either error case, the Message of the `ResolvedRefs` Condition
- should be used to provide more detail about the problem.
-
- Support: Extended for Kubernetes Service
-
- Support: Implementation-specific for any other resource
- properties:
- group:
- default: ""
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Service
- description: |-
- Kind is the Kubernetes resource kind of the referent. For example
- "Service".
-
- Defaults to "Service" when not specified.
-
- ExternalName services can refer to CNAME DNS records that may live
- outside of the cluster and as such are difficult to reason about in
- terms of conformance. They also may not be safe to forward to (see
- CVE-2021-25740 for more information). Implementations SHOULD NOT
- support ExternalName Services.
-
- Support: Core (Services with a type other than ExternalName)
-
- Support: Implementation-specific (Services with type ExternalName)
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the backend. When unspecified, the local
- namespace is inferred.
-
- Note that when a namespace different than the local namespace is specified,
- a ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port specifies the destination port number to use for this resource.
- Port is required when the referent is a Kubernetes Service. In this
- case, the port number is the service port number, not the target port.
- For other resources, destination port might be derived from the referent
- resource or this field.
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- required:
- - name
- type: object
- x-kubernetes-validations:
- - message: Must have port for Service reference
- rule: '(size(self.group) == 0 && self.kind == ''Service'')
- ? has(self.port) : true'
- required:
- - backendRef
- type: object
- requestRedirect:
- description: |-
- RequestRedirect defines a schema for a filter that responds to the
- request with an HTTP redirection.
-
- Support: Core
- properties:
- hostname:
- description: |-
- Hostname is the hostname to be used in the value of the `Location`
- header in the response.
- When empty, the hostname in the `Host` header of the request is used.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- path:
- description: |-
- Path defines parameters used to modify the path of the incoming request.
- The modified path is then used to construct the `Location` header. When
- empty, the request path is used as-is.
-
- Support: Extended
- properties:
- replaceFullPath:
- description: |-
- ReplaceFullPath specifies the value with which to replace the full path
- of a request during a rewrite or redirect.
- maxLength: 1024
- type: string
- replacePrefixMatch:
- description: |-
- ReplacePrefixMatch specifies the value with which to replace the prefix
- match of a request during a rewrite or redirect. For example, a request
- to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch
- of "/xyz" would be modified to "/xyz/bar".
-
- Note that this matches the behavior of the PathPrefix match type. This
- matches full path elements. A path element refers to the list of labels
- in the path split by the `/` separator. When specified, a trailing `/` is
- ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all
- match the prefix `/abc`, but the path `/abcd` would not.
-
- ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.
- Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in
- the implementation setting the Accepted Condition for the Route to `status: False`.
-
- Request Path | Prefix Match | Replace Prefix | Modified Path
- maxLength: 1024
- type: string
- type:
- description: |-
- Type defines the type of path modifier. Additional types may be
- added in a future release of the API.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
- enum:
- - ReplaceFullPath
- - ReplacePrefixMatch
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: replaceFullPath must be specified when
- type is set to 'ReplaceFullPath'
- rule: 'self.type == ''ReplaceFullPath'' ? has(self.replaceFullPath)
- : true'
- - message: type must be 'ReplaceFullPath' when replaceFullPath
- is set
- rule: 'has(self.replaceFullPath) ? self.type ==
- ''ReplaceFullPath'' : true'
- - message: replacePrefixMatch must be specified when
- type is set to 'ReplacePrefixMatch'
- rule: 'self.type == ''ReplacePrefixMatch'' ? has(self.replacePrefixMatch)
- : true'
- - message: type must be 'ReplacePrefixMatch' when
- replacePrefixMatch is set
- rule: 'has(self.replacePrefixMatch) ? self.type
- == ''ReplacePrefixMatch'' : true'
- port:
- description: |-
- Port is the port to be used in the value of the `Location`
- header in the response.
-
- If no port is specified, the redirect port MUST be derived using the
- following rules:
-
- * If redirect scheme is not-empty, the redirect port MUST be the well-known
- port associated with the redirect scheme. Specifically "http" to port 80
- and "https" to port 443. If the redirect scheme does not have a
- well-known port, the listener port of the Gateway SHOULD be used.
- * If redirect scheme is empty, the redirect port MUST be the Gateway
- Listener port.
-
- Implementations SHOULD NOT add the port number in the 'Location'
- header in the following cases:
-
- * A Location header that will use HTTP (whether that is determined via
- the Listener protocol or the Scheme field) _and_ use port 80.
- * A Location header that will use HTTPS (whether that is determined via
- the Listener protocol or the Scheme field) _and_ use port 443.
-
- Support: Extended
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- scheme:
- description: |-
- Scheme is the scheme to be used in the value of the `Location` header in
- the response. When empty, the scheme of the request is used.
-
- Scheme redirects can affect the port of the redirect, for more information,
- refer to the documentation for the port field of this filter.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
-
- Support: Extended
- enum:
- - http
- - https
- type: string
- statusCode:
- default: 302
- description: |-
- StatusCode is the HTTP status code to be used in response.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
-
- Support: Core
- enum:
- - 301
- - 302
- type: integer
- type: object
- responseHeaderModifier:
- description: |-
- ResponseHeaderModifier defines a schema for a filter that modifies response
- headers.
-
- Support: Extended
- properties:
- add:
- description: |-
- Add adds the given header(s) (name, value) to the request
- before the action. It appends to any existing values associated
- with the header name.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- add:
- - name: "my-header"
- value: "bar,baz"
-
- Output:
- GET /foo HTTP/1.1
- my-header: foo,bar,baz
- items:
- description: HTTPHeader represents an HTTP Header
- name and value as defined by RFC 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP Header
- to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- remove:
- description: |-
- Remove the given header(s) from the HTTP request before the action. The
- value of Remove is a list of HTTP header names. Note that the header
- names are case-insensitive (see
- https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).
-
- Input:
- GET /foo HTTP/1.1
- my-header1: foo
- my-header2: bar
- my-header3: baz
-
- Config:
- remove: ["my-header1", "my-header3"]
-
- Output:
- GET /foo HTTP/1.1
- my-header2: bar
- items:
- type: string
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- set:
- description: |-
- Set overwrites the request with the given header (name, value)
- before the action.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- set:
- - name: "my-header"
- value: "bar"
-
- Output:
- GET /foo HTTP/1.1
- my-header: bar
- items:
- description: HTTPHeader represents an HTTP Header
- name and value as defined by RFC 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP Header
- to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- type:
- description: |-
- Type identifies the type of filter to apply. As with other API fields,
- types are classified into three conformance levels:
-
- - Core: Filter types and their corresponding configuration defined by
- "Support: Core" in this package, e.g. "RequestHeaderModifier". All
- implementations must support core filters.
-
- - Extended: Filter types and their corresponding configuration defined by
- "Support: Extended" in this package, e.g. "RequestMirror". Implementers
- are encouraged to support extended filters.
-
- - Implementation-specific: Filters that are defined and supported by
- specific vendors.
- In the future, filters showing convergence in behavior across multiple
- implementations will be considered for inclusion in extended or core
- conformance levels. Filter-specific configuration for such filters
- is specified using the ExtensionRef field. `Type` should be set to
- "ExtensionRef" for custom filters.
-
- Implementers are encouraged to define custom implementation types to
- extend the core API with implementation-specific behavior.
-
- If a reference to a custom filter type cannot be resolved, the filter
- MUST NOT be skipped. Instead, requests that would have been processed by
- that filter MUST receive a HTTP error response.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
- enum:
- - RequestHeaderModifier
- - ResponseHeaderModifier
- - RequestMirror
- - RequestRedirect
- - URLRewrite
- - ExtensionRef
- type: string
- urlRewrite:
- description: |-
- URLRewrite defines a schema for a filter that modifies a request during forwarding.
-
- Support: Extended
- properties:
- hostname:
- description: |-
- Hostname is the value to be used to replace the Host header value during
- forwarding.
-
- Support: Extended
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- path:
- description: |-
- Path defines a path rewrite.
-
- Support: Extended
- properties:
- replaceFullPath:
- description: |-
- ReplaceFullPath specifies the value with which to replace the full path
- of a request during a rewrite or redirect.
- maxLength: 1024
- type: string
- replacePrefixMatch:
- description: |-
- ReplacePrefixMatch specifies the value with which to replace the prefix
- match of a request during a rewrite or redirect. For example, a request
- to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch
- of "/xyz" would be modified to "/xyz/bar".
-
- Note that this matches the behavior of the PathPrefix match type. This
- matches full path elements. A path element refers to the list of labels
- in the path split by the `/` separator. When specified, a trailing `/` is
- ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all
- match the prefix `/abc`, but the path `/abcd` would not.
-
- ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.
- Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in
- the implementation setting the Accepted Condition for the Route to `status: False`.
-
- Request Path | Prefix Match | Replace Prefix | Modified Path
- maxLength: 1024
- type: string
- type:
- description: |-
- Type defines the type of path modifier. Additional types may be
- added in a future release of the API.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
- enum:
- - ReplaceFullPath
- - ReplacePrefixMatch
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: replaceFullPath must be specified when
- type is set to 'ReplaceFullPath'
- rule: 'self.type == ''ReplaceFullPath'' ? has(self.replaceFullPath)
- : true'
- - message: type must be 'ReplaceFullPath' when replaceFullPath
- is set
- rule: 'has(self.replaceFullPath) ? self.type ==
- ''ReplaceFullPath'' : true'
- - message: replacePrefixMatch must be specified when
- type is set to 'ReplacePrefixMatch'
- rule: 'self.type == ''ReplacePrefixMatch'' ? has(self.replacePrefixMatch)
- : true'
- - message: type must be 'ReplacePrefixMatch' when
- replacePrefixMatch is set
- rule: 'has(self.replacePrefixMatch) ? self.type
- == ''ReplacePrefixMatch'' : true'
- type: object
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: filter.requestHeaderModifier must be nil if the
- filter.type is not RequestHeaderModifier
- rule: '!(has(self.requestHeaderModifier) && self.type !=
- ''RequestHeaderModifier'')'
- - message: filter.requestHeaderModifier must be specified
- for RequestHeaderModifier filter.type
- rule: '!(!has(self.requestHeaderModifier) && self.type ==
- ''RequestHeaderModifier'')'
- - message: filter.responseHeaderModifier must be nil if the
- filter.type is not ResponseHeaderModifier
- rule: '!(has(self.responseHeaderModifier) && self.type !=
- ''ResponseHeaderModifier'')'
- - message: filter.responseHeaderModifier must be specified
- for ResponseHeaderModifier filter.type
- rule: '!(!has(self.responseHeaderModifier) && self.type
- == ''ResponseHeaderModifier'')'
- - message: filter.requestMirror must be nil if the filter.type
- is not RequestMirror
- rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')'
- - message: filter.requestMirror must be specified for RequestMirror
- filter.type
- rule: '!(!has(self.requestMirror) && self.type == ''RequestMirror'')'
- - message: filter.requestRedirect must be nil if the filter.type
- is not RequestRedirect
- rule: '!(has(self.requestRedirect) && self.type != ''RequestRedirect'')'
- - message: filter.requestRedirect must be specified for RequestRedirect
- filter.type
- rule: '!(!has(self.requestRedirect) && self.type == ''RequestRedirect'')'
- - message: filter.urlRewrite must be nil if the filter.type
- is not URLRewrite
- rule: '!(has(self.urlRewrite) && self.type != ''URLRewrite'')'
- - message: filter.urlRewrite must be specified for URLRewrite
- filter.type
- rule: '!(!has(self.urlRewrite) && self.type == ''URLRewrite'')'
- - message: filter.extensionRef must be nil if the filter.type
- is not ExtensionRef
- rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')'
- - message: filter.extensionRef must be specified for ExtensionRef
- filter.type
- rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')'
- maxItems: 16
- type: array
- x-kubernetes-validations:
- - message: May specify either httpRouteFilterRequestRedirect
- or httpRouteFilterRequestRewrite, but not both
- rule: '!(self.exists(f, f.type == ''RequestRedirect'') &&
- self.exists(f, f.type == ''URLRewrite''))'
- - message: RequestHeaderModifier filter cannot be repeated
- rule: self.filter(f, f.type == 'RequestHeaderModifier').size()
- <= 1
- - message: ResponseHeaderModifier filter cannot be repeated
- rule: self.filter(f, f.type == 'ResponseHeaderModifier').size()
- <= 1
- - message: RequestRedirect filter cannot be repeated
- rule: self.filter(f, f.type == 'RequestRedirect').size() <=
- 1
- - message: URLRewrite filter cannot be repeated
- rule: self.filter(f, f.type == 'URLRewrite').size() <= 1
- matches:
- default:
- - path:
- type: PathPrefix
- value: /
- description: |-
- Matches define conditions used for matching the rule against incoming
- HTTP requests. Each match is independent, i.e. this rule will be matched
- if **any** one of the matches is satisfied.
-
- For example, take the following matches configuration:
-
- ```
- matches:
- - path:
- value: "/foo"
- headers:
- - name: "version"
- value: "v2"
- - path:
- value: "/v2/foo"
- ```
-
- For a request to match against this rule, a request must satisfy
- EITHER of the two conditions:
-
- - path prefixed with `/foo` AND contains the header `version: v2`
- - path prefix of `/v2/foo`
-
- See the documentation for HTTPRouteMatch on how to specify multiple
- match conditions that should be ANDed together.
-
- If no matches are specified, the default is a prefix
- path match on "/", which has the effect of matching every
- HTTP request.
-
- Proxy or Load Balancer routing configuration generated from HTTPRoutes
- MUST prioritize matches based on the following criteria, continuing on
- ties. Across all rules specified on applicable Routes, precedence must be
- given to the match having:
-
- * "Exact" path match.
- * "Prefix" path match with largest number of characters.
- * Method match.
- * Largest number of header matches.
- * Largest number of query param matches.
-
- Note: The precedence of RegularExpression path matches are implementation-specific.
-
- If ties still exist across multiple Routes, matching precedence MUST be
- determined in order of the following criteria, continuing on ties:
-
- * The oldest Route based on creation timestamp.
- * The Route appearing first in alphabetical order by
- "{namespace}/{name}".
-
- If ties still exist within an HTTPRoute, matching precedence MUST be granted
- to the FIRST matching rule (in list order) with a match meeting the above
- criteria.
-
- When no rules matching a request have been successfully attached to the
- parent a request is coming from, a HTTP 404 status code MUST be returned.
- items:
- description: "HTTPRouteMatch defines the predicate used to
- match requests to a given\naction. Multiple match types
- are ANDed together, i.e. the match will\nevaluate to true
- only if all conditions are satisfied.\n\nFor example, the
- match below will match a HTTP request only if its path\nstarts
- with `/foo` AND it contains the `version: v1` header:\n\n```\nmatch:\n\n\tpath:\n\t
- \ value: \"/foo\"\n\theaders:\n\t- name: \"version\"\n\t
- \ value \"v1\"\n\n```"
- properties:
- headers:
- description: |-
- Headers specifies HTTP request header matchers. Multiple match values are
- ANDed together, meaning, a request must match all the specified headers
- to select the route.
- items:
- description: |-
- HTTPHeaderMatch describes how to select a HTTP route by matching HTTP request
- headers.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, only the first
- entry with an equivalent name MUST be considered for a match. Subsequent
- entries with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
-
- When a header is repeated in an HTTP request, it is
- implementation-specific behavior as to how this is represented.
- Generally, proxies should follow the guidance from the RFC:
- https://www.rfc-editor.org/rfc/rfc7230.html#section-3.2.2 regarding
- processing a repeated header, with special handling for "Set-Cookie".
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- type:
- default: Exact
- description: |-
- Type specifies how to match against the value of the header.
-
- Support: Core (Exact)
-
- Support: Implementation-specific (RegularExpression)
-
- Since RegularExpression HeaderMatchType has implementation-specific
- conformance, implementations can support POSIX, PCRE or any other dialects
- of regular expressions. Please read the implementation's documentation to
- determine the supported dialect.
- enum:
- - Exact
- - RegularExpression
- type: string
- value:
- description: Value is the value of HTTP Header to
- be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- method:
- description: |-
- Method specifies HTTP method matcher.
- When specified, this route will be matched only if the request has the
- specified method.
-
- Support: Extended
- enum:
- - GET
- - HEAD
- - POST
- - PUT
- - DELETE
- - CONNECT
- - OPTIONS
- - TRACE
- - PATCH
- type: string
- path:
- default:
- type: PathPrefix
- value: /
- description: |-
- Path specifies a HTTP request path matcher. If this field is not
- specified, a default prefix match on the "/" path is provided.
- properties:
- type:
- default: PathPrefix
- description: |-
- Type specifies how to match against the path Value.
-
- Support: Core (Exact, PathPrefix)
-
- Support: Implementation-specific (RegularExpression)
- enum:
- - Exact
- - PathPrefix
- - RegularExpression
- type: string
- value:
- default: /
- description: Value of the HTTP path to match against.
- maxLength: 1024
- type: string
- type: object
- x-kubernetes-validations:
- - message: value must be an absolute path and start with
- '/' when type one of ['Exact', 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? self.value.startsWith(''/'')
- : true'
- - message: must not contain '//' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''//'')
- : true'
- - message: must not contain '/./' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''/./'')
- : true'
- - message: must not contain '/../' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''/../'')
- : true'
- - message: must not contain '%2f' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''%2f'')
- : true'
- - message: must not contain '%2F' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''%2F'')
- : true'
- - message: must not contain '#' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''#'')
- : true'
- - message: must not end with '/..' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.endsWith(''/..'')
- : true'
- - message: must not end with '/.' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.endsWith(''/.'')
- : true'
- - message: type must be one of ['Exact', 'PathPrefix',
- 'RegularExpression']
- rule: self.type in ['Exact','PathPrefix'] || self.type
- == 'RegularExpression'
- - message: must only contain valid characters (matching
- ^(?:[-A-Za-z0-9/._~!$&'()*+,;=:@]|[%][0-9a-fA-F]{2})+$)
- for types ['Exact', 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? self.value.matches(r"""^(?:[-A-Za-z0-9/._~!$&''()*+,;=:@]|[%][0-9a-fA-F]{2})+$""")
- : true'
- queryParams:
- description: |-
- QueryParams specifies HTTP query parameter matchers. Multiple match
- values are ANDed together, meaning, a request must match all the
- specified query parameters to select the route.
-
- Support: Extended
- items:
- description: |-
- HTTPQueryParamMatch describes how to select a HTTP route by matching HTTP
- query parameters.
- properties:
- name:
- description: |-
- Name is the name of the HTTP query param to be matched. This must be an
- exact string match. (See
- https://tools.ietf.org/html/rfc7230#section-2.7.3).
-
- If multiple entries specify equivalent query param names, only the first
- entry with an equivalent name MUST be considered for a match. Subsequent
- entries with an equivalent query param name MUST be ignored.
-
- If a query param is repeated in an HTTP request, the behavior is
- purposely left undefined, since different data planes have different
- capabilities. However, it is *recommended* that implementations should
- match against the first value of the param if the data plane supports it,
- as this behavior is expected in other load balancing contexts outside of
- the Gateway API.
-
- Users SHOULD NOT route traffic based on repeated query params to guard
- themselves against potential differences in the implementations.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- type:
- default: Exact
- description: |-
- Type specifies how to match against the value of the query parameter.
-
- Support: Extended (Exact)
-
- Support: Implementation-specific (RegularExpression)
-
- Since RegularExpression QueryParamMatchType has Implementation-specific
- conformance, implementations can support POSIX, PCRE or any other
- dialects of regular expressions. Please read the implementation's
- documentation to determine the supported dialect.
- enum:
- - Exact
- - RegularExpression
- type: string
- value:
- description: Value is the value of HTTP query param
- to be matched.
- maxLength: 1024
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- maxItems: 64
- type: array
- timeouts:
- description: |-
- Timeouts defines the timeouts that can be configured for an HTTP request.
-
- Support: Extended
- properties:
- backendRequest:
- description: |-
- BackendRequest specifies a timeout for an individual request from the gateway
- to a backend. This covers the time from when the request first starts being
- sent from the gateway to when the full response has been received from the backend.
-
- Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout
- completely. Implementations that cannot completely disable the timeout MUST
- instead interpret the zero duration as the longest possible value to which
- the timeout can be set.
-
- An entire client HTTP transaction with a gateway, covered by the Request timeout,
- may result in more than one call from the gateway to the destination backend,
- for example, if automatic retries are supported.
-
- The value of BackendRequest must be a Gateway API Duration string as defined by
- GEP-2257. When this field is unspecified, its behavior is implementation-specific;
- when specified, the value of BackendRequest must be no more than the value of the
- Request timeout (since the Request timeout encompasses the BackendRequest timeout).
-
- Support: Extended
- pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
- type: string
- request:
- description: |-
- Request specifies the maximum duration for a gateway to respond to an HTTP request.
- If the gateway has not been able to respond before this deadline is met, the gateway
- MUST return a timeout error.
-
- For example, setting the `rules.timeouts.request` field to the value `10s` in an
- `HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds
- to complete.
-
- Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout
- completely. Implementations that cannot completely disable the timeout MUST
- instead interpret the zero duration as the longest possible value to which
- the timeout can be set.
-
- This timeout is intended to cover as close to the whole request-response transaction
- as possible although an implementation MAY choose to start the timeout after the entire
- request stream has been received instead of immediately after the transaction is
- initiated by the client.
-
- The value of Request is a Gateway API Duration string as defined by GEP-2257. When this
- field is unspecified, request timeout behavior is implementation-specific.
-
- Support: Extended
- pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
- type: string
- type: object
- x-kubernetes-validations:
- - message: backendRequest timeout cannot be longer than request
- timeout
- rule: '!(has(self.request) && has(self.backendRequest) &&
- duration(self.request) != duration(''0s'') && duration(self.backendRequest)
- > duration(self.request))'
- type: object
- x-kubernetes-validations:
- - message: RequestRedirect filter must not be used together with
- backendRefs
- rule: '(has(self.backendRefs) && size(self.backendRefs) > 0) ?
- (!has(self.filters) || self.filters.all(f, !has(f.requestRedirect))):
- true'
- - message: When using RequestRedirect filter with path.replacePrefixMatch,
- exactly one PathPrefix match must be specified
- rule: '(has(self.filters) && self.filters.exists_one(f, has(f.requestRedirect)
- && has(f.requestRedirect.path) && f.requestRedirect.path.type
- == ''ReplacePrefixMatch'' && has(f.requestRedirect.path.replacePrefixMatch)))
- ? ((size(self.matches) != 1 || !has(self.matches[0].path) ||
- self.matches[0].path.type != ''PathPrefix'') ? false : true)
- : true'
- - message: When using URLRewrite filter with path.replacePrefixMatch,
- exactly one PathPrefix match must be specified
- rule: '(has(self.filters) && self.filters.exists_one(f, has(f.urlRewrite)
- && has(f.urlRewrite.path) && f.urlRewrite.path.type == ''ReplacePrefixMatch''
- && has(f.urlRewrite.path.replacePrefixMatch))) ? ((size(self.matches)
- != 1 || !has(self.matches[0].path) || self.matches[0].path.type
- != ''PathPrefix'') ? false : true) : true'
- - message: Within backendRefs, when using RequestRedirect filter
- with path.replacePrefixMatch, exactly one PathPrefix match must
- be specified
- rule: '(has(self.backendRefs) && self.backendRefs.exists_one(b,
- (has(b.filters) && b.filters.exists_one(f, has(f.requestRedirect)
- && has(f.requestRedirect.path) && f.requestRedirect.path.type
- == ''ReplacePrefixMatch'' && has(f.requestRedirect.path.replacePrefixMatch)))
- )) ? ((size(self.matches) != 1 || !has(self.matches[0].path)
- || self.matches[0].path.type != ''PathPrefix'') ? false : true)
- : true'
- - message: Within backendRefs, When using URLRewrite filter with
- path.replacePrefixMatch, exactly one PathPrefix match must be
- specified
- rule: '(has(self.backendRefs) && self.backendRefs.exists_one(b,
- (has(b.filters) && b.filters.exists_one(f, has(f.urlRewrite)
- && has(f.urlRewrite.path) && f.urlRewrite.path.type == ''ReplacePrefixMatch''
- && has(f.urlRewrite.path.replacePrefixMatch))) )) ? ((size(self.matches)
- != 1 || !has(self.matches[0].path) || self.matches[0].path.type
- != ''PathPrefix'') ? false : true) : true'
- maxItems: 16
- type: array
- x-kubernetes-validations:
- - message: While 16 rules and 64 matches per rule are allowed, the
- total number of matches across all rules in a route must be less
- than 128
- rule: '(self.size() > 0 ? self[0].matches.size() : 0) + (self.size()
- > 1 ? self[1].matches.size() : 0) + (self.size() > 2 ? self[2].matches.size()
- : 0) + (self.size() > 3 ? self[3].matches.size() : 0) + (self.size()
- > 4 ? self[4].matches.size() : 0) + (self.size() > 5 ? self[5].matches.size()
- : 0) + (self.size() > 6 ? self[6].matches.size() : 0) + (self.size()
- > 7 ? self[7].matches.size() : 0) + (self.size() > 8 ? self[8].matches.size()
- : 0) + (self.size() > 9 ? self[9].matches.size() : 0) + (self.size()
- > 10 ? self[10].matches.size() : 0) + (self.size() > 11 ? self[11].matches.size()
- : 0) + (self.size() > 12 ? self[12].matches.size() : 0) + (self.size()
- > 13 ? self[13].matches.size() : 0) + (self.size() > 14 ? self[14].matches.size()
- : 0) + (self.size() > 15 ? self[15].matches.size() : 0) <= 128'
- type: object
- status:
- description: Status defines the current state of HTTPRoute.
- properties:
- parents:
- description: |-
- Parents is a list of parent resources (usually Gateways) that are
- associated with the route, and the status of the route with respect to
- each parent. When this route attaches to a parent, the controller that
- manages the parent must add an entry to this list when the controller
- first sees the route and should update the entry as appropriate when the
- route or gateway is modified.
-
- Note that parent references that cannot be resolved by an implementation
- of this API will not be added to this list. Implementations of this API
- can only populate Route status for the Gateways/parent resources they are
- responsible for.
-
- A maximum of 32 Gateways will be represented in this list. An empty list
- means the route has not been attached to any Gateway.
- items:
- description: |-
- RouteParentStatus describes the status of a route with respect to an
- associated Parent.
- properties:
- conditions:
- description: |-
- Conditions describes the status of the route with respect to the Gateway.
- Note that the route's availability is also subject to the Gateway's own
- status conditions and listener status.
-
- If the Route's ParentRef specifies an existing Gateway that supports
- Routes of this kind AND that Gateway's controller has sufficient access,
- then that Gateway's controller MUST set the "Accepted" condition on the
- Route, to indicate whether the route has been accepted or rejected by the
- Gateway, and why.
-
- A Route MUST be considered "Accepted" if at least one of the Route's
- rules is implemented by the Gateway.
-
- There are a number of cases where the "Accepted" condition may not be set
- due to lack of controller visibility, that includes when:
-
- * The Route refers to a non-existent parent.
- * The Route is of a type that the controller does not support.
- * The Route is in a namespace the controller does not have access to.
- items:
- description: Condition contains details for one aspect of
- the current state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False,
- Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- maxItems: 8
- minItems: 1
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- controllerName:
- description: |-
- ControllerName is a domain/path string that indicates the name of the
- controller that wrote this status. This corresponds with the
- controllerName field on GatewayClass.
-
- Example: "example.net/gateway-controller".
-
- The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
- valid Kubernetes names
- (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
-
- Controllers MUST populate this field when writing status. Controllers should ensure that
- entries to status populated with their ControllerName are cleaned up when they are no
- longer necessary.
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
- type: string
- parentRef:
- description: |-
- ParentRef corresponds with a ParentRef in the spec that this
- RouteParentStatus struct describes the status of.
- properties:
- group:
- default: gateway.networking.k8s.io
- description: |-
- Group is the group of the referent.
- When unspecified, "gateway.networking.k8s.io" is inferred.
- To set the core API group (such as for a "Service" kind referent),
- Group must be explicitly set to "" (empty string).
-
- Support: Core
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Gateway
- description: |-
- Kind is kind of the referent.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- Support for other resources is Implementation-Specific.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: |-
- Name is the name of the referent.
-
- Support: Core
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referent. When unspecified, this refers
- to the local namespace of the Route.
-
- Note that there are specific rules for ParentRefs which cross namespace
- boundaries. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example:
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable any other kind of cross-namespace reference.
-
-
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port is the network port this Route targets. It can be interpreted
- differently based on the type of parent resource.
-
- When the parent resource is a Gateway, this targets all listeners
- listening on the specified port that also support this kind of Route(and
- select this Route). It's not recommended to set `Port` unless the
- networking behaviors specified in a Route must apply to a specific port
- as opposed to a listener(s) whose port(s) may be changed. When both Port
- and SectionName are specified, the name and port of the selected listener
- must match both specified values.
-
-
-
- Implementations MAY choose to support other parent resources.
- Implementations supporting other types of parent resources MUST clearly
- document how/if Port is interpreted.
-
- For the purpose of status, an attachment is considered successful as
- long as the parent resource accepts it partially. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
- from the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route,
- the Route MUST be considered detached from the Gateway.
-
- Support: Extended
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- sectionName:
- description: |-
- SectionName is the name of a section within the target resource. In the
- following resources, SectionName is interpreted as the following:
-
- * Gateway: Listener name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
- * Service: Port name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
-
- Implementations MAY choose to support attaching Routes to other resources.
- If that is the case, they MUST clearly document how SectionName is
- interpreted.
-
- When unspecified (empty string), this will reference the entire resource.
- For the purpose of status, an attachment is considered successful if at
- least one section in the parent resource accepts it. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
- the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route, the
- Route MUST be considered detached from the Gateway.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- required:
- - name
- type: object
- required:
- - controllerName
- - parentRef
- type: object
- maxItems: 32
- type: array
- required:
- - parents
- type: object
- required:
- - spec
- type: object
- served: true
- storage: true
- subresources:
- status: {}
- - additionalPrinterColumns:
- - jsonPath: .spec.hostnames
- name: Hostnames
- type: string
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- name: v1beta1
- schema:
- openAPIV3Schema:
- description: |-
- HTTPRoute provides a way to route HTTP requests. This includes the capability
- to match requests by hostname, path, header, or query param. Filters can be
- used to specify additional processing steps. Backends specify where matching
- requests should be routed.
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: Spec defines the desired state of HTTPRoute.
- properties:
- hostnames:
- description: |-
- Hostnames defines a set of hostnames that should match against the HTTP Host
- header to select a HTTPRoute used to process the request. Implementations
- MUST ignore any port value specified in the HTTP Host header while
- performing a match and (absent of any applicable header modification
- configuration) MUST forward this header unmodified to the backend.
-
- Valid values for Hostnames are determined by RFC 1123 definition of a
- hostname with 2 notable exceptions:
-
- 1. IPs are not allowed.
- 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard
- label must appear by itself as the first label.
-
- If a hostname is specified by both the Listener and HTTPRoute, there
- must be at least one intersecting hostname for the HTTPRoute to be
- attached to the Listener. For example:
-
- * A Listener with `test.example.com` as the hostname matches HTTPRoutes
- that have either not specified any hostnames, or have specified at
- least one of `test.example.com` or `*.example.com`.
- * A Listener with `*.example.com` as the hostname matches HTTPRoutes
- that have either not specified any hostnames or have specified at least
- one hostname that matches the Listener hostname. For example,
- `*.example.com`, `test.example.com`, and `foo.test.example.com` would
- all match. On the other hand, `example.com` and `test.example.net` would
- not match.
-
- Hostnames that are prefixed with a wildcard label (`*.`) are interpreted
- as a suffix match. That means that a match for `*.example.com` would match
- both `test.example.com`, and `foo.test.example.com`, but not `example.com`.
-
- If both the Listener and HTTPRoute have specified hostnames, any
- HTTPRoute hostnames that do not match the Listener hostname MUST be
- ignored. For example, if a Listener specified `*.example.com`, and the
- HTTPRoute specified `test.example.com` and `test.example.net`,
- `test.example.net` must not be considered for a match.
-
- If both the Listener and HTTPRoute have specified hostnames, and none
- match with the criteria above, then the HTTPRoute is not accepted. The
- implementation must raise an 'Accepted' Condition with a status of
- `False` in the corresponding RouteParentStatus.
-
- In the event that multiple HTTPRoutes specify intersecting hostnames (e.g.
- overlapping wildcard matching and exact matching hostnames), precedence must
- be given to rules from the HTTPRoute with the largest number of:
-
- * Characters in a matching non-wildcard hostname.
- * Characters in a matching hostname.
-
- If ties exist across multiple Routes, the matching precedence rules for
- HTTPRouteMatches takes over.
-
- Support: Core
- items:
- description: |-
- Hostname is the fully qualified domain name of a network host. This matches
- the RFC 1123 definition of a hostname with 2 notable exceptions:
-
- 1. IPs are not allowed.
- 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard
- label must appear by itself as the first label.
-
- Hostname can be "precise" which is a domain name without the terminating
- dot of a network host (e.g. "foo.example.com") or "wildcard", which is a
- domain name prefixed with a single wildcard label (e.g. `*.example.com`).
-
- Note that as per RFC1035 and RFC1123, a *label* must consist of lower case
- alphanumeric characters or '-', and must start and end with an alphanumeric
- character. No other punctuation is allowed.
- maxLength: 253
- minLength: 1
- pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- maxItems: 16
- type: array
- parentRefs:
- description: |+
- ParentRefs references the resources (usually Gateways) that a Route wants
- to be attached to. Note that the referenced parent resource needs to
- allow this for the attachment to be complete. For Gateways, that means
- the Gateway needs to allow attachment from Routes of this kind and
- namespace. For Services, that means the Service must either be in the same
- namespace for a "producer" route, or the mesh implementation must support
- and allow "consumer" routes for the referenced Service. ReferenceGrant is
- not applicable for governing ParentRefs to Services - it is not possible to
- create a "producer" route for a Service in a different namespace from the
- Route.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- This API may be extended in the future to support additional kinds of parent
- resources.
-
- ParentRefs must be _distinct_. This means either that:
-
- * They select different objects. If this is the case, then parentRef
- entries are distinct. In terms of fields, this means that the
- multi-part key defined by `group`, `kind`, `namespace`, and `name` must
- be unique across all parentRef entries in the Route.
- * They do not select different objects, but for each optional field used,
- each ParentRef that selects the same object must set the same set of
- optional fields to different values. If one ParentRef sets a
- combination of optional fields, all must set the same combination.
-
- Some examples:
-
- * If one ParentRef sets `sectionName`, all ParentRefs referencing the
- same object must also set `sectionName`.
- * If one ParentRef sets `port`, all ParentRefs referencing the same
- object must also set `port`.
- * If one ParentRef sets `sectionName` and `port`, all ParentRefs
- referencing the same object must also set `sectionName` and `port`.
-
- It is possible to separately reference multiple distinct objects that may
- be collapsed by an implementation. For example, some implementations may
- choose to merge compatible Gateway Listeners together. If that is the
- case, the list of routes attached to those resources should also be
- merged.
-
- Note that for ParentRefs that cross namespace boundaries, there are specific
- rules. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example,
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable other kinds of cross-namespace reference.
-
-
-
-
-
-
- items:
- description: |-
- ParentReference identifies an API object (usually a Gateway) that can be considered
- a parent of this resource (usually a route). There are two kinds of parent resources
- with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- This API may be extended in the future to support additional kinds of parent
- resources.
-
- The API object must be valid in the cluster; the Group and Kind must
- be registered in the cluster for this reference to be valid.
- properties:
- group:
- default: gateway.networking.k8s.io
- description: |-
- Group is the group of the referent.
- When unspecified, "gateway.networking.k8s.io" is inferred.
- To set the core API group (such as for a "Service" kind referent),
- Group must be explicitly set to "" (empty string).
-
- Support: Core
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Gateway
- description: |-
- Kind is kind of the referent.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- Support for other resources is Implementation-Specific.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: |-
- Name is the name of the referent.
-
- Support: Core
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referent. When unspecified, this refers
- to the local namespace of the Route.
-
- Note that there are specific rules for ParentRefs which cross namespace
- boundaries. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example:
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable any other kind of cross-namespace reference.
-
-
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port is the network port this Route targets. It can be interpreted
- differently based on the type of parent resource.
-
- When the parent resource is a Gateway, this targets all listeners
- listening on the specified port that also support this kind of Route(and
- select this Route). It's not recommended to set `Port` unless the
- networking behaviors specified in a Route must apply to a specific port
- as opposed to a listener(s) whose port(s) may be changed. When both Port
- and SectionName are specified, the name and port of the selected listener
- must match both specified values.
-
-
-
- Implementations MAY choose to support other parent resources.
- Implementations supporting other types of parent resources MUST clearly
- document how/if Port is interpreted.
-
- For the purpose of status, an attachment is considered successful as
- long as the parent resource accepts it partially. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
- from the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route,
- the Route MUST be considered detached from the Gateway.
-
- Support: Extended
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- sectionName:
- description: |-
- SectionName is the name of a section within the target resource. In the
- following resources, SectionName is interpreted as the following:
-
- * Gateway: Listener name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
- * Service: Port name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
-
- Implementations MAY choose to support attaching Routes to other resources.
- If that is the case, they MUST clearly document how SectionName is
- interpreted.
-
- When unspecified (empty string), this will reference the entire resource.
- For the purpose of status, an attachment is considered successful if at
- least one section in the parent resource accepts it. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
- the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route, the
- Route MUST be considered detached from the Gateway.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- required:
- - name
- type: object
- maxItems: 32
- type: array
- x-kubernetes-validations:
- - message: sectionName must be specified when parentRefs includes
- 2 or more references to the same parent
- rule: 'self.all(p1, self.all(p2, p1.group == p2.group && p1.kind
- == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__)
- || p1.__namespace__ == '''') && (!has(p2.__namespace__) || p2.__namespace__
- == '''')) || (has(p1.__namespace__) && has(p2.__namespace__) &&
- p1.__namespace__ == p2.__namespace__ )) ? ((!has(p1.sectionName)
- || p1.sectionName == '''') == (!has(p2.sectionName) || p2.sectionName
- == '''')) : true))'
- - message: sectionName must be unique when parentRefs includes 2 or
- more references to the same parent
- rule: self.all(p1, self.exists_one(p2, p1.group == p2.group && p1.kind
- == p2.kind && p1.name == p2.name && (((!has(p1.__namespace__)
- || p1.__namespace__ == '') && (!has(p2.__namespace__) || p2.__namespace__
- == '')) || (has(p1.__namespace__) && has(p2.__namespace__) &&
- p1.__namespace__ == p2.__namespace__ )) && (((!has(p1.sectionName)
- || p1.sectionName == '') && (!has(p2.sectionName) || p2.sectionName
- == '')) || (has(p1.sectionName) && has(p2.sectionName) && p1.sectionName
- == p2.sectionName))))
- rules:
- default:
- - matches:
- - path:
- type: PathPrefix
- value: /
- description: |+
- Rules are a list of HTTP matchers, filters and actions.
-
- items:
- description: |-
- HTTPRouteRule defines semantics for matching an HTTP request based on
- conditions (matches), processing it (filters), and forwarding the request to
- an API object (backendRefs).
- properties:
- backendRefs:
- description: |-
- BackendRefs defines the backend(s) where matching requests should be
- sent.
-
- Failure behavior here depends on how many BackendRefs are specified and
- how many are invalid.
-
- If *all* entries in BackendRefs are invalid, and there are also no filters
- specified in this route rule, *all* traffic which matches this rule MUST
- receive a 500 status code.
-
- See the HTTPBackendRef definition for the rules about what makes a single
- HTTPBackendRef invalid.
-
- When a HTTPBackendRef is invalid, 500 status codes MUST be returned for
- requests that would have otherwise been routed to an invalid backend. If
- multiple backends are specified, and some are invalid, the proportion of
- requests that would otherwise have been routed to an invalid backend
- MUST receive a 500 status code.
-
- For example, if two backends are specified with equal weights, and one is
- invalid, 50 percent of traffic must receive a 500. Implementations may
- choose how that 50 percent is determined.
-
- When a HTTPBackendRef refers to a Service that has no ready endpoints,
- implementations SHOULD return a 503 for requests to that backend instead.
- If an implementation chooses to do this, all of the above rules for 500 responses
- MUST also apply for responses that return a 503.
-
- Support: Core for Kubernetes Service
-
- Support: Extended for Kubernetes ServiceImport
-
- Support: Implementation-specific for any other resource
-
- Support for weight: Core
- items:
- description: |-
- HTTPBackendRef defines how a HTTPRoute forwards a HTTP request.
-
- Note that when a namespace different than the local namespace is specified, a
- ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
-
-
- When the BackendRef points to a Kubernetes Service, implementations SHOULD
- honor the appProtocol field if it is set for the target Service Port.
-
- Implementations supporting appProtocol SHOULD recognize the Kubernetes
- Standard Application Protocols defined in KEP-3726.
-
- If a Service appProtocol isn't specified, an implementation MAY infer the
- backend protocol through its own means. Implementations MAY infer the
- protocol from the Route type referring to the backend Service.
-
- If a Route is not able to send traffic to the backend using the specified
- protocol then the backend is considered invalid. Implementations MUST set the
- "ResolvedRefs" condition to "False" with the "UnsupportedProtocol" reason.
-
-
- properties:
- filters:
- description: |-
- Filters defined at this level should be executed if and only if the
- request is being forwarded to the backend defined here.
-
- Support: Implementation-specific (For broader support of filters, use the
- Filters field in HTTPRouteRule.)
- items:
- description: |-
- HTTPRouteFilter defines processing steps that must be completed during the
- request or response lifecycle. HTTPRouteFilters are meant as an extension
- point to express processing that may be done in Gateway implementations. Some
- examples include request or response modification, implementing
- authentication strategies, rate-limiting, and traffic shaping. API
- guarantee/conformance is defined based on the type of the filter.
- properties:
- extensionRef:
- description: |-
- ExtensionRef is an optional, implementation-specific extension to the
- "filter" behavior. For example, resource "myroutefilter" in group
- "networking.example.net"). ExtensionRef MUST NOT be used for core and
- extended filters.
-
- This filter can be used multiple times within the same rule.
-
- Support: Implementation-specific
- properties:
- group:
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is kind of the referent. For
- example "HTTPRoute" or "Service".
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- required:
- - group
- - kind
- - name
- type: object
- requestHeaderModifier:
- description: |-
- RequestHeaderModifier defines a schema for a filter that modifies request
- headers.
-
- Support: Core
- properties:
- add:
- description: |-
- Add adds the given header(s) (name, value) to the request
- before the action. It appends to any existing values associated
- with the header name.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- add:
- - name: "my-header"
- value: "bar,baz"
-
- Output:
- GET /foo HTTP/1.1
- my-header: foo,bar,baz
- items:
- description: HTTPHeader represents an HTTP
- Header name and value as defined by RFC
- 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP
- Header to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- remove:
- description: |-
- Remove the given header(s) from the HTTP request before the action. The
- value of Remove is a list of HTTP header names. Note that the header
- names are case-insensitive (see
- https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).
-
- Input:
- GET /foo HTTP/1.1
- my-header1: foo
- my-header2: bar
- my-header3: baz
-
- Config:
- remove: ["my-header1", "my-header3"]
-
- Output:
- GET /foo HTTP/1.1
- my-header2: bar
- items:
- type: string
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- set:
- description: |-
- Set overwrites the request with the given header (name, value)
- before the action.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- set:
- - name: "my-header"
- value: "bar"
-
- Output:
- GET /foo HTTP/1.1
- my-header: bar
- items:
- description: HTTPHeader represents an HTTP
- Header name and value as defined by RFC
- 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP
- Header to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- requestMirror:
- description: |+
- RequestMirror defines a schema for a filter that mirrors requests.
- Requests are sent to the specified destination, but responses from
- that destination are ignored.
-
- This filter can be used multiple times within the same rule. Note that
- not all implementations will be able to support mirroring to multiple
- backends.
-
- Support: Extended
-
- properties:
- backendRef:
- description: |-
- BackendRef references a resource where mirrored requests are sent.
-
- Mirrored requests must be sent only to a single destination endpoint
- within this BackendRef, irrespective of how many endpoints are present
- within this BackendRef.
-
- If the referent cannot be found, this BackendRef is invalid and must be
- dropped from the Gateway. The controller must ensure the "ResolvedRefs"
- condition on the Route status is set to `status: False` and not configure
- this backend in the underlying implementation.
-
- If there is a cross-namespace reference to an *existing* object
- that is not allowed by a ReferenceGrant, the controller must ensure the
- "ResolvedRefs" condition on the Route is set to `status: False`,
- with the "RefNotPermitted" reason and not configure this backend in the
- underlying implementation.
-
- In either error case, the Message of the `ResolvedRefs` Condition
- should be used to provide more detail about the problem.
-
- Support: Extended for Kubernetes Service
-
- Support: Implementation-specific for any other resource
- properties:
- group:
- default: ""
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Service
- description: |-
- Kind is the Kubernetes resource kind of the referent. For example
- "Service".
-
- Defaults to "Service" when not specified.
-
- ExternalName services can refer to CNAME DNS records that may live
- outside of the cluster and as such are difficult to reason about in
- terms of conformance. They also may not be safe to forward to (see
- CVE-2021-25740 for more information). Implementations SHOULD NOT
- support ExternalName Services.
-
- Support: Core (Services with a type other than ExternalName)
-
- Support: Implementation-specific (Services with type ExternalName)
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the backend. When unspecified, the local
- namespace is inferred.
-
- Note that when a namespace different than the local namespace is specified,
- a ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port specifies the destination port number to use for this resource.
- Port is required when the referent is a Kubernetes Service. In this
- case, the port number is the service port number, not the target port.
- For other resources, destination port might be derived from the referent
- resource or this field.
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- required:
- - name
- type: object
- x-kubernetes-validations:
- - message: Must have port for Service reference
- rule: '(size(self.group) == 0 && self.kind
- == ''Service'') ? has(self.port) : true'
- required:
- - backendRef
- type: object
- requestRedirect:
- description: |-
- RequestRedirect defines a schema for a filter that responds to the
- request with an HTTP redirection.
-
- Support: Core
- properties:
- hostname:
- description: |-
- Hostname is the hostname to be used in the value of the `Location`
- header in the response.
- When empty, the hostname in the `Host` header of the request is used.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- path:
- description: |-
- Path defines parameters used to modify the path of the incoming request.
- The modified path is then used to construct the `Location` header. When
- empty, the request path is used as-is.
-
- Support: Extended
- properties:
- replaceFullPath:
- description: |-
- ReplaceFullPath specifies the value with which to replace the full path
- of a request during a rewrite or redirect.
- maxLength: 1024
- type: string
- replacePrefixMatch:
- description: |-
- ReplacePrefixMatch specifies the value with which to replace the prefix
- match of a request during a rewrite or redirect. For example, a request
- to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch
- of "/xyz" would be modified to "/xyz/bar".
-
- Note that this matches the behavior of the PathPrefix match type. This
- matches full path elements. A path element refers to the list of labels
- in the path split by the `/` separator. When specified, a trailing `/` is
- ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all
- match the prefix `/abc`, but the path `/abcd` would not.
-
- ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.
- Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in
- the implementation setting the Accepted Condition for the Route to `status: False`.
-
- Request Path | Prefix Match | Replace Prefix | Modified Path
- maxLength: 1024
- type: string
- type:
- description: |-
- Type defines the type of path modifier. Additional types may be
- added in a future release of the API.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
- enum:
- - ReplaceFullPath
- - ReplacePrefixMatch
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: replaceFullPath must be specified
- when type is set to 'ReplaceFullPath'
- rule: 'self.type == ''ReplaceFullPath'' ?
- has(self.replaceFullPath) : true'
- - message: type must be 'ReplaceFullPath' when
- replaceFullPath is set
- rule: 'has(self.replaceFullPath) ? self.type
- == ''ReplaceFullPath'' : true'
- - message: replacePrefixMatch must be specified
- when type is set to 'ReplacePrefixMatch'
- rule: 'self.type == ''ReplacePrefixMatch''
- ? has(self.replacePrefixMatch) : true'
- - message: type must be 'ReplacePrefixMatch'
- when replacePrefixMatch is set
- rule: 'has(self.replacePrefixMatch) ? self.type
- == ''ReplacePrefixMatch'' : true'
- port:
- description: |-
- Port is the port to be used in the value of the `Location`
- header in the response.
-
- If no port is specified, the redirect port MUST be derived using the
- following rules:
-
- * If redirect scheme is not-empty, the redirect port MUST be the well-known
- port associated with the redirect scheme. Specifically "http" to port 80
- and "https" to port 443. If the redirect scheme does not have a
- well-known port, the listener port of the Gateway SHOULD be used.
- * If redirect scheme is empty, the redirect port MUST be the Gateway
- Listener port.
-
- Implementations SHOULD NOT add the port number in the 'Location'
- header in the following cases:
-
- * A Location header that will use HTTP (whether that is determined via
- the Listener protocol or the Scheme field) _and_ use port 80.
- * A Location header that will use HTTPS (whether that is determined via
- the Listener protocol or the Scheme field) _and_ use port 443.
-
- Support: Extended
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- scheme:
- description: |-
- Scheme is the scheme to be used in the value of the `Location` header in
- the response. When empty, the scheme of the request is used.
-
- Scheme redirects can affect the port of the redirect, for more information,
- refer to the documentation for the port field of this filter.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
-
- Support: Extended
- enum:
- - http
- - https
- type: string
- statusCode:
- default: 302
- description: |-
- StatusCode is the HTTP status code to be used in response.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
-
- Support: Core
- enum:
- - 301
- - 302
- type: integer
- type: object
- responseHeaderModifier:
- description: |-
- ResponseHeaderModifier defines a schema for a filter that modifies response
- headers.
-
- Support: Extended
- properties:
- add:
- description: |-
- Add adds the given header(s) (name, value) to the request
- before the action. It appends to any existing values associated
- with the header name.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- add:
- - name: "my-header"
- value: "bar,baz"
-
- Output:
- GET /foo HTTP/1.1
- my-header: foo,bar,baz
- items:
- description: HTTPHeader represents an HTTP
- Header name and value as defined by RFC
- 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP
- Header to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- remove:
- description: |-
- Remove the given header(s) from the HTTP request before the action. The
- value of Remove is a list of HTTP header names. Note that the header
- names are case-insensitive (see
- https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).
-
- Input:
- GET /foo HTTP/1.1
- my-header1: foo
- my-header2: bar
- my-header3: baz
-
- Config:
- remove: ["my-header1", "my-header3"]
-
- Output:
- GET /foo HTTP/1.1
- my-header2: bar
- items:
- type: string
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- set:
- description: |-
- Set overwrites the request with the given header (name, value)
- before the action.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- set:
- - name: "my-header"
- value: "bar"
-
- Output:
- GET /foo HTTP/1.1
- my-header: bar
- items:
- description: HTTPHeader represents an HTTP
- Header name and value as defined by RFC
- 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP
- Header to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- type:
- description: |-
- Type identifies the type of filter to apply. As with other API fields,
- types are classified into three conformance levels:
-
- - Core: Filter types and their corresponding configuration defined by
- "Support: Core" in this package, e.g. "RequestHeaderModifier". All
- implementations must support core filters.
-
- - Extended: Filter types and their corresponding configuration defined by
- "Support: Extended" in this package, e.g. "RequestMirror". Implementers
- are encouraged to support extended filters.
-
- - Implementation-specific: Filters that are defined and supported by
- specific vendors.
- In the future, filters showing convergence in behavior across multiple
- implementations will be considered for inclusion in extended or core
- conformance levels. Filter-specific configuration for such filters
- is specified using the ExtensionRef field. `Type` should be set to
- "ExtensionRef" for custom filters.
-
- Implementers are encouraged to define custom implementation types to
- extend the core API with implementation-specific behavior.
-
- If a reference to a custom filter type cannot be resolved, the filter
- MUST NOT be skipped. Instead, requests that would have been processed by
- that filter MUST receive a HTTP error response.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
- enum:
- - RequestHeaderModifier
- - ResponseHeaderModifier
- - RequestMirror
- - RequestRedirect
- - URLRewrite
- - ExtensionRef
- type: string
- urlRewrite:
- description: |-
- URLRewrite defines a schema for a filter that modifies a request during forwarding.
-
- Support: Extended
- properties:
- hostname:
- description: |-
- Hostname is the value to be used to replace the Host header value during
- forwarding.
-
- Support: Extended
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- path:
- description: |-
- Path defines a path rewrite.
-
- Support: Extended
- properties:
- replaceFullPath:
- description: |-
- ReplaceFullPath specifies the value with which to replace the full path
- of a request during a rewrite or redirect.
- maxLength: 1024
- type: string
- replacePrefixMatch:
- description: |-
- ReplacePrefixMatch specifies the value with which to replace the prefix
- match of a request during a rewrite or redirect. For example, a request
- to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch
- of "/xyz" would be modified to "/xyz/bar".
-
- Note that this matches the behavior of the PathPrefix match type. This
- matches full path elements. A path element refers to the list of labels
- in the path split by the `/` separator. When specified, a trailing `/` is
- ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all
- match the prefix `/abc`, but the path `/abcd` would not.
-
- ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.
- Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in
- the implementation setting the Accepted Condition for the Route to `status: False`.
-
- Request Path | Prefix Match | Replace Prefix | Modified Path
- maxLength: 1024
- type: string
- type:
- description: |-
- Type defines the type of path modifier. Additional types may be
- added in a future release of the API.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
- enum:
- - ReplaceFullPath
- - ReplacePrefixMatch
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: replaceFullPath must be specified
- when type is set to 'ReplaceFullPath'
- rule: 'self.type == ''ReplaceFullPath'' ?
- has(self.replaceFullPath) : true'
- - message: type must be 'ReplaceFullPath' when
- replaceFullPath is set
- rule: 'has(self.replaceFullPath) ? self.type
- == ''ReplaceFullPath'' : true'
- - message: replacePrefixMatch must be specified
- when type is set to 'ReplacePrefixMatch'
- rule: 'self.type == ''ReplacePrefixMatch''
- ? has(self.replacePrefixMatch) : true'
- - message: type must be 'ReplacePrefixMatch'
- when replacePrefixMatch is set
- rule: 'has(self.replacePrefixMatch) ? self.type
- == ''ReplacePrefixMatch'' : true'
- type: object
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: filter.requestHeaderModifier must be nil
- if the filter.type is not RequestHeaderModifier
- rule: '!(has(self.requestHeaderModifier) && self.type
- != ''RequestHeaderModifier'')'
- - message: filter.requestHeaderModifier must be specified
- for RequestHeaderModifier filter.type
- rule: '!(!has(self.requestHeaderModifier) && self.type
- == ''RequestHeaderModifier'')'
- - message: filter.responseHeaderModifier must be nil
- if the filter.type is not ResponseHeaderModifier
- rule: '!(has(self.responseHeaderModifier) && self.type
- != ''ResponseHeaderModifier'')'
- - message: filter.responseHeaderModifier must be specified
- for ResponseHeaderModifier filter.type
- rule: '!(!has(self.responseHeaderModifier) && self.type
- == ''ResponseHeaderModifier'')'
- - message: filter.requestMirror must be nil if the filter.type
- is not RequestMirror
- rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')'
- - message: filter.requestMirror must be specified for
- RequestMirror filter.type
- rule: '!(!has(self.requestMirror) && self.type ==
- ''RequestMirror'')'
- - message: filter.requestRedirect must be nil if the
- filter.type is not RequestRedirect
- rule: '!(has(self.requestRedirect) && self.type !=
- ''RequestRedirect'')'
- - message: filter.requestRedirect must be specified
- for RequestRedirect filter.type
- rule: '!(!has(self.requestRedirect) && self.type ==
- ''RequestRedirect'')'
- - message: filter.urlRewrite must be nil if the filter.type
- is not URLRewrite
- rule: '!(has(self.urlRewrite) && self.type != ''URLRewrite'')'
- - message: filter.urlRewrite must be specified for URLRewrite
- filter.type
- rule: '!(!has(self.urlRewrite) && self.type == ''URLRewrite'')'
- - message: filter.extensionRef must be nil if the filter.type
- is not ExtensionRef
- rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')'
- - message: filter.extensionRef must be specified for
- ExtensionRef filter.type
- rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')'
- maxItems: 16
- type: array
- x-kubernetes-validations:
- - message: May specify either httpRouteFilterRequestRedirect
- or httpRouteFilterRequestRewrite, but not both
- rule: '!(self.exists(f, f.type == ''RequestRedirect'')
- && self.exists(f, f.type == ''URLRewrite''))'
- - message: May specify either httpRouteFilterRequestRedirect
- or httpRouteFilterRequestRewrite, but not both
- rule: '!(self.exists(f, f.type == ''RequestRedirect'')
- && self.exists(f, f.type == ''URLRewrite''))'
- - message: RequestHeaderModifier filter cannot be repeated
- rule: self.filter(f, f.type == 'RequestHeaderModifier').size()
- <= 1
- - message: ResponseHeaderModifier filter cannot be repeated
- rule: self.filter(f, f.type == 'ResponseHeaderModifier').size()
- <= 1
- - message: RequestRedirect filter cannot be repeated
- rule: self.filter(f, f.type == 'RequestRedirect').size()
- <= 1
- - message: URLRewrite filter cannot be repeated
- rule: self.filter(f, f.type == 'URLRewrite').size()
- <= 1
- group:
- default: ""
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Service
- description: |-
- Kind is the Kubernetes resource kind of the referent. For example
- "Service".
-
- Defaults to "Service" when not specified.
-
- ExternalName services can refer to CNAME DNS records that may live
- outside of the cluster and as such are difficult to reason about in
- terms of conformance. They also may not be safe to forward to (see
- CVE-2021-25740 for more information). Implementations SHOULD NOT
- support ExternalName Services.
-
- Support: Core (Services with a type other than ExternalName)
-
- Support: Implementation-specific (Services with type ExternalName)
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the backend. When unspecified, the local
- namespace is inferred.
-
- Note that when a namespace different than the local namespace is specified,
- a ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port specifies the destination port number to use for this resource.
- Port is required when the referent is a Kubernetes Service. In this
- case, the port number is the service port number, not the target port.
- For other resources, destination port might be derived from the referent
- resource or this field.
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- weight:
- default: 1
- description: |-
- Weight specifies the proportion of requests forwarded to the referenced
- backend. This is computed as weight/(sum of all weights in this
- BackendRefs list). For non-zero values, there may be some epsilon from
- the exact proportion defined here depending on the precision an
- implementation supports. Weight is not a percentage and the sum of
- weights does not need to equal 100.
-
- If only one backend is specified and it has a weight greater than 0, 100%
- of the traffic is forwarded to that backend. If weight is set to 0, no
- traffic should be forwarded for this entry. If unspecified, weight
- defaults to 1.
-
- Support for this field varies based on the context where used.
- format: int32
- maximum: 1000000
- minimum: 0
- type: integer
- required:
- - name
- type: object
- x-kubernetes-validations:
- - message: Must have port for Service reference
- rule: '(size(self.group) == 0 && self.kind == ''Service'')
- ? has(self.port) : true'
- maxItems: 16
- type: array
- filters:
- description: |-
- Filters define the filters that are applied to requests that match
- this rule.
-
- Wherever possible, implementations SHOULD implement filters in the order
- they are specified.
-
- Implementations MAY choose to implement this ordering strictly, rejecting
- any combination or order of filters that can not be supported. If implementations
- choose a strict interpretation of filter ordering, they MUST clearly document
- that behavior.
-
- To reject an invalid combination or order of filters, implementations SHOULD
- consider the Route Rules with this configuration invalid. If all Route Rules
- in a Route are invalid, the entire Route would be considered invalid. If only
- a portion of Route Rules are invalid, implementations MUST set the
- "PartiallyInvalid" condition for the Route.
-
- Conformance-levels at this level are defined based on the type of filter:
-
- - ALL core filters MUST be supported by all implementations.
- - Implementers are encouraged to support extended filters.
- - Implementation-specific custom filters have no API guarantees across
- implementations.
-
- Specifying the same filter multiple times is not supported unless explicitly
- indicated in the filter.
-
- All filters are expected to be compatible with each other except for the
- URLRewrite and RequestRedirect filters, which may not be combined. If an
- implementation can not support other combinations of filters, they must clearly
- document that limitation. In cases where incompatible or unsupported
- filters are specified and cause the `Accepted` condition to be set to status
- `False`, implementations may use the `IncompatibleFilters` reason to specify
- this configuration error.
-
- Support: Core
- items:
- description: |-
- HTTPRouteFilter defines processing steps that must be completed during the
- request or response lifecycle. HTTPRouteFilters are meant as an extension
- point to express processing that may be done in Gateway implementations. Some
- examples include request or response modification, implementing
- authentication strategies, rate-limiting, and traffic shaping. API
- guarantee/conformance is defined based on the type of the filter.
- properties:
- extensionRef:
- description: |-
- ExtensionRef is an optional, implementation-specific extension to the
- "filter" behavior. For example, resource "myroutefilter" in group
- "networking.example.net"). ExtensionRef MUST NOT be used for core and
- extended filters.
-
- This filter can be used multiple times within the same rule.
-
- Support: Implementation-specific
- properties:
- group:
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: Kind is kind of the referent. For example
- "HTTPRoute" or "Service".
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- required:
- - group
- - kind
- - name
- type: object
- requestHeaderModifier:
- description: |-
- RequestHeaderModifier defines a schema for a filter that modifies request
- headers.
-
- Support: Core
- properties:
- add:
- description: |-
- Add adds the given header(s) (name, value) to the request
- before the action. It appends to any existing values associated
- with the header name.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- add:
- - name: "my-header"
- value: "bar,baz"
-
- Output:
- GET /foo HTTP/1.1
- my-header: foo,bar,baz
- items:
- description: HTTPHeader represents an HTTP Header
- name and value as defined by RFC 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP Header
- to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- remove:
- description: |-
- Remove the given header(s) from the HTTP request before the action. The
- value of Remove is a list of HTTP header names. Note that the header
- names are case-insensitive (see
- https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).
-
- Input:
- GET /foo HTTP/1.1
- my-header1: foo
- my-header2: bar
- my-header3: baz
-
- Config:
- remove: ["my-header1", "my-header3"]
-
- Output:
- GET /foo HTTP/1.1
- my-header2: bar
- items:
- type: string
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- set:
- description: |-
- Set overwrites the request with the given header (name, value)
- before the action.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- set:
- - name: "my-header"
- value: "bar"
-
- Output:
- GET /foo HTTP/1.1
- my-header: bar
- items:
- description: HTTPHeader represents an HTTP Header
- name and value as defined by RFC 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP Header
- to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- requestMirror:
- description: |+
- RequestMirror defines a schema for a filter that mirrors requests.
- Requests are sent to the specified destination, but responses from
- that destination are ignored.
-
- This filter can be used multiple times within the same rule. Note that
- not all implementations will be able to support mirroring to multiple
- backends.
-
- Support: Extended
-
- properties:
- backendRef:
- description: |-
- BackendRef references a resource where mirrored requests are sent.
-
- Mirrored requests must be sent only to a single destination endpoint
- within this BackendRef, irrespective of how many endpoints are present
- within this BackendRef.
-
- If the referent cannot be found, this BackendRef is invalid and must be
- dropped from the Gateway. The controller must ensure the "ResolvedRefs"
- condition on the Route status is set to `status: False` and not configure
- this backend in the underlying implementation.
-
- If there is a cross-namespace reference to an *existing* object
- that is not allowed by a ReferenceGrant, the controller must ensure the
- "ResolvedRefs" condition on the Route is set to `status: False`,
- with the "RefNotPermitted" reason and not configure this backend in the
- underlying implementation.
-
- In either error case, the Message of the `ResolvedRefs` Condition
- should be used to provide more detail about the problem.
-
- Support: Extended for Kubernetes Service
-
- Support: Implementation-specific for any other resource
- properties:
- group:
- default: ""
- description: |-
- Group is the group of the referent. For example, "gateway.networking.k8s.io".
- When unspecified or empty string, core API group is inferred.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Service
- description: |-
- Kind is the Kubernetes resource kind of the referent. For example
- "Service".
-
- Defaults to "Service" when not specified.
-
- ExternalName services can refer to CNAME DNS records that may live
- outside of the cluster and as such are difficult to reason about in
- terms of conformance. They also may not be safe to forward to (see
- CVE-2021-25740 for more information). Implementations SHOULD NOT
- support ExternalName Services.
-
- Support: Core (Services with a type other than ExternalName)
-
- Support: Implementation-specific (Services with type ExternalName)
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: Name is the name of the referent.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the backend. When unspecified, the local
- namespace is inferred.
-
- Note that when a namespace different than the local namespace is specified,
- a ReferenceGrant object is required in the referent namespace to allow that
- namespace's owner to accept the reference. See the ReferenceGrant
- documentation for details.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port specifies the destination port number to use for this resource.
- Port is required when the referent is a Kubernetes Service. In this
- case, the port number is the service port number, not the target port.
- For other resources, destination port might be derived from the referent
- resource or this field.
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- required:
- - name
- type: object
- x-kubernetes-validations:
- - message: Must have port for Service reference
- rule: '(size(self.group) == 0 && self.kind == ''Service'')
- ? has(self.port) : true'
- required:
- - backendRef
- type: object
- requestRedirect:
- description: |-
- RequestRedirect defines a schema for a filter that responds to the
- request with an HTTP redirection.
-
- Support: Core
- properties:
- hostname:
- description: |-
- Hostname is the hostname to be used in the value of the `Location`
- header in the response.
- When empty, the hostname in the `Host` header of the request is used.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- path:
- description: |-
- Path defines parameters used to modify the path of the incoming request.
- The modified path is then used to construct the `Location` header. When
- empty, the request path is used as-is.
-
- Support: Extended
- properties:
- replaceFullPath:
- description: |-
- ReplaceFullPath specifies the value with which to replace the full path
- of a request during a rewrite or redirect.
- maxLength: 1024
- type: string
- replacePrefixMatch:
- description: |-
- ReplacePrefixMatch specifies the value with which to replace the prefix
- match of a request during a rewrite or redirect. For example, a request
- to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch
- of "/xyz" would be modified to "/xyz/bar".
-
- Note that this matches the behavior of the PathPrefix match type. This
- matches full path elements. A path element refers to the list of labels
- in the path split by the `/` separator. When specified, a trailing `/` is
- ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all
- match the prefix `/abc`, but the path `/abcd` would not.
-
- ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.
- Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in
- the implementation setting the Accepted Condition for the Route to `status: False`.
-
- Request Path | Prefix Match | Replace Prefix | Modified Path
- maxLength: 1024
- type: string
- type:
- description: |-
- Type defines the type of path modifier. Additional types may be
- added in a future release of the API.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
- enum:
- - ReplaceFullPath
- - ReplacePrefixMatch
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: replaceFullPath must be specified when
- type is set to 'ReplaceFullPath'
- rule: 'self.type == ''ReplaceFullPath'' ? has(self.replaceFullPath)
- : true'
- - message: type must be 'ReplaceFullPath' when replaceFullPath
- is set
- rule: 'has(self.replaceFullPath) ? self.type ==
- ''ReplaceFullPath'' : true'
- - message: replacePrefixMatch must be specified when
- type is set to 'ReplacePrefixMatch'
- rule: 'self.type == ''ReplacePrefixMatch'' ? has(self.replacePrefixMatch)
- : true'
- - message: type must be 'ReplacePrefixMatch' when
- replacePrefixMatch is set
- rule: 'has(self.replacePrefixMatch) ? self.type
- == ''ReplacePrefixMatch'' : true'
- port:
- description: |-
- Port is the port to be used in the value of the `Location`
- header in the response.
-
- If no port is specified, the redirect port MUST be derived using the
- following rules:
-
- * If redirect scheme is not-empty, the redirect port MUST be the well-known
- port associated with the redirect scheme. Specifically "http" to port 80
- and "https" to port 443. If the redirect scheme does not have a
- well-known port, the listener port of the Gateway SHOULD be used.
- * If redirect scheme is empty, the redirect port MUST be the Gateway
- Listener port.
-
- Implementations SHOULD NOT add the port number in the 'Location'
- header in the following cases:
-
- * A Location header that will use HTTP (whether that is determined via
- the Listener protocol or the Scheme field) _and_ use port 80.
- * A Location header that will use HTTPS (whether that is determined via
- the Listener protocol or the Scheme field) _and_ use port 443.
-
- Support: Extended
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- scheme:
- description: |-
- Scheme is the scheme to be used in the value of the `Location` header in
- the response. When empty, the scheme of the request is used.
-
- Scheme redirects can affect the port of the redirect, for more information,
- refer to the documentation for the port field of this filter.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
-
- Support: Extended
- enum:
- - http
- - https
- type: string
- statusCode:
- default: 302
- description: |-
- StatusCode is the HTTP status code to be used in response.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
-
- Support: Core
- enum:
- - 301
- - 302
- type: integer
- type: object
- responseHeaderModifier:
- description: |-
- ResponseHeaderModifier defines a schema for a filter that modifies response
- headers.
-
- Support: Extended
- properties:
- add:
- description: |-
- Add adds the given header(s) (name, value) to the request
- before the action. It appends to any existing values associated
- with the header name.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- add:
- - name: "my-header"
- value: "bar,baz"
-
- Output:
- GET /foo HTTP/1.1
- my-header: foo,bar,baz
- items:
- description: HTTPHeader represents an HTTP Header
- name and value as defined by RFC 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP Header
- to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- remove:
- description: |-
- Remove the given header(s) from the HTTP request before the action. The
- value of Remove is a list of HTTP header names. Note that the header
- names are case-insensitive (see
- https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).
-
- Input:
- GET /foo HTTP/1.1
- my-header1: foo
- my-header2: bar
- my-header3: baz
-
- Config:
- remove: ["my-header1", "my-header3"]
-
- Output:
- GET /foo HTTP/1.1
- my-header2: bar
- items:
- type: string
- maxItems: 16
- type: array
- x-kubernetes-list-type: set
- set:
- description: |-
- Set overwrites the request with the given header (name, value)
- before the action.
-
- Input:
- GET /foo HTTP/1.1
- my-header: foo
-
- Config:
- set:
- - name: "my-header"
- value: "bar"
-
- Output:
- GET /foo HTTP/1.1
- my-header: bar
- items:
- description: HTTPHeader represents an HTTP Header
- name and value as defined by RFC 7230.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, the first entry with
- an equivalent name MUST be considered for a match. Subsequent entries
- with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- value:
- description: Value is the value of HTTP Header
- to be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- type:
- description: |-
- Type identifies the type of filter to apply. As with other API fields,
- types are classified into three conformance levels:
-
- - Core: Filter types and their corresponding configuration defined by
- "Support: Core" in this package, e.g. "RequestHeaderModifier". All
- implementations must support core filters.
-
- - Extended: Filter types and their corresponding configuration defined by
- "Support: Extended" in this package, e.g. "RequestMirror". Implementers
- are encouraged to support extended filters.
-
- - Implementation-specific: Filters that are defined and supported by
- specific vendors.
- In the future, filters showing convergence in behavior across multiple
- implementations will be considered for inclusion in extended or core
- conformance levels. Filter-specific configuration for such filters
- is specified using the ExtensionRef field. `Type` should be set to
- "ExtensionRef" for custom filters.
-
- Implementers are encouraged to define custom implementation types to
- extend the core API with implementation-specific behavior.
-
- If a reference to a custom filter type cannot be resolved, the filter
- MUST NOT be skipped. Instead, requests that would have been processed by
- that filter MUST receive a HTTP error response.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
- enum:
- - RequestHeaderModifier
- - ResponseHeaderModifier
- - RequestMirror
- - RequestRedirect
- - URLRewrite
- - ExtensionRef
- type: string
- urlRewrite:
- description: |-
- URLRewrite defines a schema for a filter that modifies a request during forwarding.
-
- Support: Extended
- properties:
- hostname:
- description: |-
- Hostname is the value to be used to replace the Host header value during
- forwarding.
-
- Support: Extended
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- path:
- description: |-
- Path defines a path rewrite.
-
- Support: Extended
- properties:
- replaceFullPath:
- description: |-
- ReplaceFullPath specifies the value with which to replace the full path
- of a request during a rewrite or redirect.
- maxLength: 1024
- type: string
- replacePrefixMatch:
- description: |-
- ReplacePrefixMatch specifies the value with which to replace the prefix
- match of a request during a rewrite or redirect. For example, a request
- to "/foo/bar" with a prefix match of "/foo" and a ReplacePrefixMatch
- of "/xyz" would be modified to "/xyz/bar".
-
- Note that this matches the behavior of the PathPrefix match type. This
- matches full path elements. A path element refers to the list of labels
- in the path split by the `/` separator. When specified, a trailing `/` is
- ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all
- match the prefix `/abc`, but the path `/abcd` would not.
-
- ReplacePrefixMatch is only compatible with a `PathPrefix` HTTPRouteMatch.
- Using any other HTTPRouteMatch type on the same HTTPRouteRule will result in
- the implementation setting the Accepted Condition for the Route to `status: False`.
-
- Request Path | Prefix Match | Replace Prefix | Modified Path
- maxLength: 1024
- type: string
- type:
- description: |-
- Type defines the type of path modifier. Additional types may be
- added in a future release of the API.
-
- Note that values may be added to this enum, implementations
- must ensure that unknown values will not cause a crash.
-
- Unknown values here must result in the implementation setting the
- Accepted Condition for the Route to `status: False`, with a
- Reason of `UnsupportedValue`.
- enum:
- - ReplaceFullPath
- - ReplacePrefixMatch
- type: string
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: replaceFullPath must be specified when
- type is set to 'ReplaceFullPath'
- rule: 'self.type == ''ReplaceFullPath'' ? has(self.replaceFullPath)
- : true'
- - message: type must be 'ReplaceFullPath' when replaceFullPath
- is set
- rule: 'has(self.replaceFullPath) ? self.type ==
- ''ReplaceFullPath'' : true'
- - message: replacePrefixMatch must be specified when
- type is set to 'ReplacePrefixMatch'
- rule: 'self.type == ''ReplacePrefixMatch'' ? has(self.replacePrefixMatch)
- : true'
- - message: type must be 'ReplacePrefixMatch' when
- replacePrefixMatch is set
- rule: 'has(self.replacePrefixMatch) ? self.type
- == ''ReplacePrefixMatch'' : true'
- type: object
- required:
- - type
- type: object
- x-kubernetes-validations:
- - message: filter.requestHeaderModifier must be nil if the
- filter.type is not RequestHeaderModifier
- rule: '!(has(self.requestHeaderModifier) && self.type !=
- ''RequestHeaderModifier'')'
- - message: filter.requestHeaderModifier must be specified
- for RequestHeaderModifier filter.type
- rule: '!(!has(self.requestHeaderModifier) && self.type ==
- ''RequestHeaderModifier'')'
- - message: filter.responseHeaderModifier must be nil if the
- filter.type is not ResponseHeaderModifier
- rule: '!(has(self.responseHeaderModifier) && self.type !=
- ''ResponseHeaderModifier'')'
- - message: filter.responseHeaderModifier must be specified
- for ResponseHeaderModifier filter.type
- rule: '!(!has(self.responseHeaderModifier) && self.type
- == ''ResponseHeaderModifier'')'
- - message: filter.requestMirror must be nil if the filter.type
- is not RequestMirror
- rule: '!(has(self.requestMirror) && self.type != ''RequestMirror'')'
- - message: filter.requestMirror must be specified for RequestMirror
- filter.type
- rule: '!(!has(self.requestMirror) && self.type == ''RequestMirror'')'
- - message: filter.requestRedirect must be nil if the filter.type
- is not RequestRedirect
- rule: '!(has(self.requestRedirect) && self.type != ''RequestRedirect'')'
- - message: filter.requestRedirect must be specified for RequestRedirect
- filter.type
- rule: '!(!has(self.requestRedirect) && self.type == ''RequestRedirect'')'
- - message: filter.urlRewrite must be nil if the filter.type
- is not URLRewrite
- rule: '!(has(self.urlRewrite) && self.type != ''URLRewrite'')'
- - message: filter.urlRewrite must be specified for URLRewrite
- filter.type
- rule: '!(!has(self.urlRewrite) && self.type == ''URLRewrite'')'
- - message: filter.extensionRef must be nil if the filter.type
- is not ExtensionRef
- rule: '!(has(self.extensionRef) && self.type != ''ExtensionRef'')'
- - message: filter.extensionRef must be specified for ExtensionRef
- filter.type
- rule: '!(!has(self.extensionRef) && self.type == ''ExtensionRef'')'
- maxItems: 16
- type: array
- x-kubernetes-validations:
- - message: May specify either httpRouteFilterRequestRedirect
- or httpRouteFilterRequestRewrite, but not both
- rule: '!(self.exists(f, f.type == ''RequestRedirect'') &&
- self.exists(f, f.type == ''URLRewrite''))'
- - message: RequestHeaderModifier filter cannot be repeated
- rule: self.filter(f, f.type == 'RequestHeaderModifier').size()
- <= 1
- - message: ResponseHeaderModifier filter cannot be repeated
- rule: self.filter(f, f.type == 'ResponseHeaderModifier').size()
- <= 1
- - message: RequestRedirect filter cannot be repeated
- rule: self.filter(f, f.type == 'RequestRedirect').size() <=
- 1
- - message: URLRewrite filter cannot be repeated
- rule: self.filter(f, f.type == 'URLRewrite').size() <= 1
- matches:
- default:
- - path:
- type: PathPrefix
- value: /
- description: |-
- Matches define conditions used for matching the rule against incoming
- HTTP requests. Each match is independent, i.e. this rule will be matched
- if **any** one of the matches is satisfied.
-
- For example, take the following matches configuration:
-
- ```
- matches:
- - path:
- value: "/foo"
- headers:
- - name: "version"
- value: "v2"
- - path:
- value: "/v2/foo"
- ```
-
- For a request to match against this rule, a request must satisfy
- EITHER of the two conditions:
-
- - path prefixed with `/foo` AND contains the header `version: v2`
- - path prefix of `/v2/foo`
-
- See the documentation for HTTPRouteMatch on how to specify multiple
- match conditions that should be ANDed together.
-
- If no matches are specified, the default is a prefix
- path match on "/", which has the effect of matching every
- HTTP request.
-
- Proxy or Load Balancer routing configuration generated from HTTPRoutes
- MUST prioritize matches based on the following criteria, continuing on
- ties. Across all rules specified on applicable Routes, precedence must be
- given to the match having:
-
- * "Exact" path match.
- * "Prefix" path match with largest number of characters.
- * Method match.
- * Largest number of header matches.
- * Largest number of query param matches.
-
- Note: The precedence of RegularExpression path matches are implementation-specific.
-
- If ties still exist across multiple Routes, matching precedence MUST be
- determined in order of the following criteria, continuing on ties:
-
- * The oldest Route based on creation timestamp.
- * The Route appearing first in alphabetical order by
- "{namespace}/{name}".
-
- If ties still exist within an HTTPRoute, matching precedence MUST be granted
- to the FIRST matching rule (in list order) with a match meeting the above
- criteria.
-
- When no rules matching a request have been successfully attached to the
- parent a request is coming from, a HTTP 404 status code MUST be returned.
- items:
- description: "HTTPRouteMatch defines the predicate used to
- match requests to a given\naction. Multiple match types
- are ANDed together, i.e. the match will\nevaluate to true
- only if all conditions are satisfied.\n\nFor example, the
- match below will match a HTTP request only if its path\nstarts
- with `/foo` AND it contains the `version: v1` header:\n\n```\nmatch:\n\n\tpath:\n\t
- \ value: \"/foo\"\n\theaders:\n\t- name: \"version\"\n\t
- \ value \"v1\"\n\n```"
- properties:
- headers:
- description: |-
- Headers specifies HTTP request header matchers. Multiple match values are
- ANDed together, meaning, a request must match all the specified headers
- to select the route.
- items:
- description: |-
- HTTPHeaderMatch describes how to select a HTTP route by matching HTTP request
- headers.
- properties:
- name:
- description: |-
- Name is the name of the HTTP Header to be matched. Name matching MUST be
- case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
-
- If multiple entries specify equivalent header names, only the first
- entry with an equivalent name MUST be considered for a match. Subsequent
- entries with an equivalent header name MUST be ignored. Due to the
- case-insensitivity of header names, "foo" and "Foo" are considered
- equivalent.
-
- When a header is repeated in an HTTP request, it is
- implementation-specific behavior as to how this is represented.
- Generally, proxies should follow the guidance from the RFC:
- https://www.rfc-editor.org/rfc/rfc7230.html#section-3.2.2 regarding
- processing a repeated header, with special handling for "Set-Cookie".
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- type:
- default: Exact
- description: |-
- Type specifies how to match against the value of the header.
-
- Support: Core (Exact)
-
- Support: Implementation-specific (RegularExpression)
-
- Since RegularExpression HeaderMatchType has implementation-specific
- conformance, implementations can support POSIX, PCRE or any other dialects
- of regular expressions. Please read the implementation's documentation to
- determine the supported dialect.
- enum:
- - Exact
- - RegularExpression
- type: string
- value:
- description: Value is the value of HTTP Header to
- be matched.
- maxLength: 4096
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- method:
- description: |-
- Method specifies HTTP method matcher.
- When specified, this route will be matched only if the request has the
- specified method.
-
- Support: Extended
- enum:
- - GET
- - HEAD
- - POST
- - PUT
- - DELETE
- - CONNECT
- - OPTIONS
- - TRACE
- - PATCH
- type: string
- path:
- default:
- type: PathPrefix
- value: /
- description: |-
- Path specifies a HTTP request path matcher. If this field is not
- specified, a default prefix match on the "/" path is provided.
- properties:
- type:
- default: PathPrefix
- description: |-
- Type specifies how to match against the path Value.
-
- Support: Core (Exact, PathPrefix)
-
- Support: Implementation-specific (RegularExpression)
- enum:
- - Exact
- - PathPrefix
- - RegularExpression
- type: string
- value:
- default: /
- description: Value of the HTTP path to match against.
- maxLength: 1024
- type: string
- type: object
- x-kubernetes-validations:
- - message: value must be an absolute path and start with
- '/' when type one of ['Exact', 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? self.value.startsWith(''/'')
- : true'
- - message: must not contain '//' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''//'')
- : true'
- - message: must not contain '/./' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''/./'')
- : true'
- - message: must not contain '/../' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''/../'')
- : true'
- - message: must not contain '%2f' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''%2f'')
- : true'
- - message: must not contain '%2F' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''%2F'')
- : true'
- - message: must not contain '#' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.contains(''#'')
- : true'
- - message: must not end with '/..' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.endsWith(''/..'')
- : true'
- - message: must not end with '/.' when type one of ['Exact',
- 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? !self.value.endsWith(''/.'')
- : true'
- - message: type must be one of ['Exact', 'PathPrefix',
- 'RegularExpression']
- rule: self.type in ['Exact','PathPrefix'] || self.type
- == 'RegularExpression'
- - message: must only contain valid characters (matching
- ^(?:[-A-Za-z0-9/._~!$&'()*+,;=:@]|[%][0-9a-fA-F]{2})+$)
- for types ['Exact', 'PathPrefix']
- rule: '(self.type in [''Exact'',''PathPrefix'']) ? self.value.matches(r"""^(?:[-A-Za-z0-9/._~!$&''()*+,;=:@]|[%][0-9a-fA-F]{2})+$""")
- : true'
- queryParams:
- description: |-
- QueryParams specifies HTTP query parameter matchers. Multiple match
- values are ANDed together, meaning, a request must match all the
- specified query parameters to select the route.
-
- Support: Extended
- items:
- description: |-
- HTTPQueryParamMatch describes how to select a HTTP route by matching HTTP
- query parameters.
- properties:
- name:
- description: |-
- Name is the name of the HTTP query param to be matched. This must be an
- exact string match. (See
- https://tools.ietf.org/html/rfc7230#section-2.7.3).
-
- If multiple entries specify equivalent query param names, only the first
- entry with an equivalent name MUST be considered for a match. Subsequent
- entries with an equivalent query param name MUST be ignored.
-
- If a query param is repeated in an HTTP request, the behavior is
- purposely left undefined, since different data planes have different
- capabilities. However, it is *recommended* that implementations should
- match against the first value of the param if the data plane supports it,
- as this behavior is expected in other load balancing contexts outside of
- the Gateway API.
-
- Users SHOULD NOT route traffic based on repeated query params to guard
- themselves against potential differences in the implementations.
- maxLength: 256
- minLength: 1
- pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
- type: string
- type:
- default: Exact
- description: |-
- Type specifies how to match against the value of the query parameter.
-
- Support: Extended (Exact)
-
- Support: Implementation-specific (RegularExpression)
-
- Since RegularExpression QueryParamMatchType has Implementation-specific
- conformance, implementations can support POSIX, PCRE or any other
- dialects of regular expressions. Please read the implementation's
- documentation to determine the supported dialect.
- enum:
- - Exact
- - RegularExpression
- type: string
- value:
- description: Value is the value of HTTP query param
- to be matched.
- maxLength: 1024
- minLength: 1
- type: string
- required:
- - name
- - value
- type: object
- maxItems: 16
- type: array
- x-kubernetes-list-map-keys:
- - name
- x-kubernetes-list-type: map
- type: object
- maxItems: 64
- type: array
- timeouts:
- description: |-
- Timeouts defines the timeouts that can be configured for an HTTP request.
-
- Support: Extended
- properties:
- backendRequest:
- description: |-
- BackendRequest specifies a timeout for an individual request from the gateway
- to a backend. This covers the time from when the request first starts being
- sent from the gateway to when the full response has been received from the backend.
-
- Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout
- completely. Implementations that cannot completely disable the timeout MUST
- instead interpret the zero duration as the longest possible value to which
- the timeout can be set.
-
- An entire client HTTP transaction with a gateway, covered by the Request timeout,
- may result in more than one call from the gateway to the destination backend,
- for example, if automatic retries are supported.
-
- The value of BackendRequest must be a Gateway API Duration string as defined by
- GEP-2257. When this field is unspecified, its behavior is implementation-specific;
- when specified, the value of BackendRequest must be no more than the value of the
- Request timeout (since the Request timeout encompasses the BackendRequest timeout).
-
- Support: Extended
- pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
- type: string
- request:
- description: |-
- Request specifies the maximum duration for a gateway to respond to an HTTP request.
- If the gateway has not been able to respond before this deadline is met, the gateway
- MUST return a timeout error.
-
- For example, setting the `rules.timeouts.request` field to the value `10s` in an
- `HTTPRoute` will cause a timeout if a client request is taking longer than 10 seconds
- to complete.
-
- Setting a timeout to the zero duration (e.g. "0s") SHOULD disable the timeout
- completely. Implementations that cannot completely disable the timeout MUST
- instead interpret the zero duration as the longest possible value to which
- the timeout can be set.
-
- This timeout is intended to cover as close to the whole request-response transaction
- as possible although an implementation MAY choose to start the timeout after the entire
- request stream has been received instead of immediately after the transaction is
- initiated by the client.
-
- The value of Request is a Gateway API Duration string as defined by GEP-2257. When this
- field is unspecified, request timeout behavior is implementation-specific.
-
- Support: Extended
- pattern: ^([0-9]{1,5}(h|m|s|ms)){1,4}$
- type: string
- type: object
- x-kubernetes-validations:
- - message: backendRequest timeout cannot be longer than request
- timeout
- rule: '!(has(self.request) && has(self.backendRequest) &&
- duration(self.request) != duration(''0s'') && duration(self.backendRequest)
- > duration(self.request))'
- type: object
- x-kubernetes-validations:
- - message: RequestRedirect filter must not be used together with
- backendRefs
- rule: '(has(self.backendRefs) && size(self.backendRefs) > 0) ?
- (!has(self.filters) || self.filters.all(f, !has(f.requestRedirect))):
- true'
- - message: When using RequestRedirect filter with path.replacePrefixMatch,
- exactly one PathPrefix match must be specified
- rule: '(has(self.filters) && self.filters.exists_one(f, has(f.requestRedirect)
- && has(f.requestRedirect.path) && f.requestRedirect.path.type
- == ''ReplacePrefixMatch'' && has(f.requestRedirect.path.replacePrefixMatch)))
- ? ((size(self.matches) != 1 || !has(self.matches[0].path) ||
- self.matches[0].path.type != ''PathPrefix'') ? false : true)
- : true'
- - message: When using URLRewrite filter with path.replacePrefixMatch,
- exactly one PathPrefix match must be specified
- rule: '(has(self.filters) && self.filters.exists_one(f, has(f.urlRewrite)
- && has(f.urlRewrite.path) && f.urlRewrite.path.type == ''ReplacePrefixMatch''
- && has(f.urlRewrite.path.replacePrefixMatch))) ? ((size(self.matches)
- != 1 || !has(self.matches[0].path) || self.matches[0].path.type
- != ''PathPrefix'') ? false : true) : true'
- - message: Within backendRefs, when using RequestRedirect filter
- with path.replacePrefixMatch, exactly one PathPrefix match must
- be specified
- rule: '(has(self.backendRefs) && self.backendRefs.exists_one(b,
- (has(b.filters) && b.filters.exists_one(f, has(f.requestRedirect)
- && has(f.requestRedirect.path) && f.requestRedirect.path.type
- == ''ReplacePrefixMatch'' && has(f.requestRedirect.path.replacePrefixMatch)))
- )) ? ((size(self.matches) != 1 || !has(self.matches[0].path)
- || self.matches[0].path.type != ''PathPrefix'') ? false : true)
- : true'
- - message: Within backendRefs, When using URLRewrite filter with
- path.replacePrefixMatch, exactly one PathPrefix match must be
- specified
- rule: '(has(self.backendRefs) && self.backendRefs.exists_one(b,
- (has(b.filters) && b.filters.exists_one(f, has(f.urlRewrite)
- && has(f.urlRewrite.path) && f.urlRewrite.path.type == ''ReplacePrefixMatch''
- && has(f.urlRewrite.path.replacePrefixMatch))) )) ? ((size(self.matches)
- != 1 || !has(self.matches[0].path) || self.matches[0].path.type
- != ''PathPrefix'') ? false : true) : true'
- maxItems: 16
- type: array
- x-kubernetes-validations:
- - message: While 16 rules and 64 matches per rule are allowed, the
- total number of matches across all rules in a route must be less
- than 128
- rule: '(self.size() > 0 ? self[0].matches.size() : 0) + (self.size()
- > 1 ? self[1].matches.size() : 0) + (self.size() > 2 ? self[2].matches.size()
- : 0) + (self.size() > 3 ? self[3].matches.size() : 0) + (self.size()
- > 4 ? self[4].matches.size() : 0) + (self.size() > 5 ? self[5].matches.size()
- : 0) + (self.size() > 6 ? self[6].matches.size() : 0) + (self.size()
- > 7 ? self[7].matches.size() : 0) + (self.size() > 8 ? self[8].matches.size()
- : 0) + (self.size() > 9 ? self[9].matches.size() : 0) + (self.size()
- > 10 ? self[10].matches.size() : 0) + (self.size() > 11 ? self[11].matches.size()
- : 0) + (self.size() > 12 ? self[12].matches.size() : 0) + (self.size()
- > 13 ? self[13].matches.size() : 0) + (self.size() > 14 ? self[14].matches.size()
- : 0) + (self.size() > 15 ? self[15].matches.size() : 0) <= 128'
- type: object
- status:
- description: Status defines the current state of HTTPRoute.
- properties:
- parents:
- description: |-
- Parents is a list of parent resources (usually Gateways) that are
- associated with the route, and the status of the route with respect to
- each parent. When this route attaches to a parent, the controller that
- manages the parent must add an entry to this list when the controller
- first sees the route and should update the entry as appropriate when the
- route or gateway is modified.
-
- Note that parent references that cannot be resolved by an implementation
- of this API will not be added to this list. Implementations of this API
- can only populate Route status for the Gateways/parent resources they are
- responsible for.
-
- A maximum of 32 Gateways will be represented in this list. An empty list
- means the route has not been attached to any Gateway.
- items:
- description: |-
- RouteParentStatus describes the status of a route with respect to an
- associated Parent.
- properties:
- conditions:
- description: |-
- Conditions describes the status of the route with respect to the Gateway.
- Note that the route's availability is also subject to the Gateway's own
- status conditions and listener status.
-
- If the Route's ParentRef specifies an existing Gateway that supports
- Routes of this kind AND that Gateway's controller has sufficient access,
- then that Gateway's controller MUST set the "Accepted" condition on the
- Route, to indicate whether the route has been accepted or rejected by the
- Gateway, and why.
-
- A Route MUST be considered "Accepted" if at least one of the Route's
- rules is implemented by the Gateway.
-
- There are a number of cases where the "Accepted" condition may not be set
- due to lack of controller visibility, that includes when:
-
- * The Route refers to a non-existent parent.
- * The Route is of a type that the controller does not support.
- * The Route is in a namespace the controller does not have access to.
- items:
- description: Condition contains details for one aspect of
- the current state of this API Resource.
- properties:
- lastTransitionTime:
- description: |-
- lastTransitionTime is the last time the condition transitioned from one status to another.
- This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
- format: date-time
- type: string
- message:
- description: |-
- message is a human readable message indicating details about the transition.
- This may be an empty string.
- maxLength: 32768
- type: string
- observedGeneration:
- description: |-
- observedGeneration represents the .metadata.generation that the condition was set based upon.
- For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
- with respect to the current state of the instance.
- format: int64
- minimum: 0
- type: integer
- reason:
- description: |-
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
- Producers of specific condition types may define expected values and meanings for this field,
- and whether the values are considered a guaranteed API.
- The value should be a CamelCase string.
- This field may not be empty.
- maxLength: 1024
- minLength: 1
- pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
- type: string
- status:
- description: status of the condition, one of True, False,
- Unknown.
- enum:
- - "True"
- - "False"
- - Unknown
- type: string
- type:
- description: type of condition in CamelCase or in foo.example.com/CamelCase.
- maxLength: 316
- pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
- type: string
- required:
- - lastTransitionTime
- - message
- - reason
- - status
- - type
- type: object
- maxItems: 8
- minItems: 1
- type: array
- x-kubernetes-list-map-keys:
- - type
- x-kubernetes-list-type: map
- controllerName:
- description: |-
- ControllerName is a domain/path string that indicates the name of the
- controller that wrote this status. This corresponds with the
- controllerName field on GatewayClass.
-
- Example: "example.net/gateway-controller".
-
- The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
- valid Kubernetes names
- (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
-
- Controllers MUST populate this field when writing status. Controllers should ensure that
- entries to status populated with their ControllerName are cleaned up when they are no
- longer necessary.
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
- type: string
- parentRef:
- description: |-
- ParentRef corresponds with a ParentRef in the spec that this
- RouteParentStatus struct describes the status of.
- properties:
- group:
- default: gateway.networking.k8s.io
- description: |-
- Group is the group of the referent.
- When unspecified, "gateway.networking.k8s.io" is inferred.
- To set the core API group (such as for a "Service" kind referent),
- Group must be explicitly set to "" (empty string).
-
- Support: Core
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- default: Gateway
- description: |-
- Kind is kind of the referent.
-
- There are two kinds of parent resources with "Core" support:
-
- * Gateway (Gateway conformance profile)
- * Service (Mesh conformance profile, ClusterIP Services only)
-
- Support for other resources is Implementation-Specific.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: |-
- Name is the name of the referent.
-
- Support: Core
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referent. When unspecified, this refers
- to the local namespace of the Route.
-
- Note that there are specific rules for ParentRefs which cross namespace
- boundaries. Cross-namespace references are only valid if they are explicitly
- allowed by something in the namespace they are referring to. For example:
- Gateway has the AllowedRoutes field, and ReferenceGrant provides a
- generic way to enable any other kind of cross-namespace reference.
-
-
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- port:
- description: |-
- Port is the network port this Route targets. It can be interpreted
- differently based on the type of parent resource.
-
- When the parent resource is a Gateway, this targets all listeners
- listening on the specified port that also support this kind of Route(and
- select this Route). It's not recommended to set `Port` unless the
- networking behaviors specified in a Route must apply to a specific port
- as opposed to a listener(s) whose port(s) may be changed. When both Port
- and SectionName are specified, the name and port of the selected listener
- must match both specified values.
-
-
-
- Implementations MAY choose to support other parent resources.
- Implementations supporting other types of parent resources MUST clearly
- document how/if Port is interpreted.
-
- For the purpose of status, an attachment is considered successful as
- long as the parent resource accepts it partially. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
- from the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route,
- the Route MUST be considered detached from the Gateway.
-
- Support: Extended
- format: int32
- maximum: 65535
- minimum: 1
- type: integer
- sectionName:
- description: |-
- SectionName is the name of a section within the target resource. In the
- following resources, SectionName is interpreted as the following:
-
- * Gateway: Listener name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
- * Service: Port name. When both Port (experimental) and SectionName
- are specified, the name and port of the selected listener must match
- both specified values.
-
- Implementations MAY choose to support attaching Routes to other resources.
- If that is the case, they MUST clearly document how SectionName is
- interpreted.
-
- When unspecified (empty string), this will reference the entire resource.
- For the purpose of status, an attachment is considered successful if at
- least one section in the parent resource accepts it. For example, Gateway
- listeners can restrict which Routes can attach to them by Route kind,
- namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
- the referencing Route, the Route MUST be considered successfully
- attached. If no Gateway listeners accept attachment from this Route, the
- Route MUST be considered detached from the Gateway.
-
- Support: Core
- maxLength: 253
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- required:
- - name
- type: object
- required:
- - controllerName
- - parentRef
- type: object
- maxItems: 32
- type: array
- required:
- - parents
- type: object
- required:
- - spec
- type: object
- served: true
- storage: false
- subresources:
- status: {}
-status:
- acceptedNames:
- kind: ""
- plural: ""
- conditions: null
- storedVersions: null
----
-#
-# config/crd/standard/gateway.networking.k8s.io_referencegrants.yaml
-#
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/3328
- gateway.networking.k8s.io/bundle-version: v1.2.1
- gateway.networking.k8s.io/channel: standard
- creationTimestamp: null
- name: referencegrants.gateway.networking.k8s.io
-spec:
- group: gateway.networking.k8s.io
- names:
- categories:
- - gateway-api
- kind: ReferenceGrant
- listKind: ReferenceGrantList
- plural: referencegrants
- shortNames:
- - refgrant
- singular: referencegrant
- scope: Namespaced
- versions:
- - additionalPrinterColumns:
- - jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- name: v1beta1
- schema:
- openAPIV3Schema:
- description: |-
- ReferenceGrant identifies kinds of resources in other namespaces that are
- trusted to reference the specified kinds of resources in the same namespace
- as the policy.
-
- Each ReferenceGrant can be used to represent a unique trust relationship.
- Additional Reference Grants can be used to add to the set of trusted
- sources of inbound references for the namespace they are defined within.
-
- All cross-namespace references in Gateway API (with the exception of cross-namespace
- Gateway-route attachment) require a ReferenceGrant.
-
- ReferenceGrant is a form of runtime verification allowing users to assert
- which cross-namespace object references are permitted. Implementations that
- support ReferenceGrant MUST NOT permit cross-namespace references which have
- no grant, and MUST respond to the removal of a grant by revoking the access
- that the grant allowed.
- properties:
- apiVersion:
- description: |-
- APIVersion defines the versioned schema of this representation of an object.
- Servers should convert recognized schemas to the latest internal value, and
- may reject unrecognized values.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
- type: string
- kind:
- description: |-
- Kind is a string value representing the REST resource this object represents.
- Servers may infer this from the endpoint the client submits requests to.
- Cannot be updated.
- In CamelCase.
- More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
- type: string
- metadata:
- type: object
- spec:
- description: Spec defines the desired state of ReferenceGrant.
- properties:
- from:
- description: |-
- From describes the trusted namespaces and kinds that can reference the
- resources described in "To". Each entry in this list MUST be considered
- to be an additional place that references can be valid from, or to put
- this another way, entries MUST be combined using OR.
-
- Support: Core
- items:
- description: ReferenceGrantFrom describes trusted namespaces and
- kinds.
- properties:
- group:
- description: |-
- Group is the group of the referent.
- When empty, the Kubernetes core API group is inferred.
-
- Support: Core
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: |-
- Kind is the kind of the referent. Although implementations may support
- additional resources, the following types are part of the "Core"
- support level for this field.
-
- When used to permit a SecretObjectReference:
-
- * Gateway
-
- When used to permit a BackendObjectReference:
-
- * GRPCRoute
- * HTTPRoute
- * TCPRoute
- * TLSRoute
- * UDPRoute
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- namespace:
- description: |-
- Namespace is the namespace of the referent.
-
- Support: Core
- maxLength: 63
- minLength: 1
- pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
- type: string
- required:
- - group
- - kind
- - namespace
- type: object
- maxItems: 16
- minItems: 1
- type: array
- to:
- description: |-
- To describes the resources that may be referenced by the resources
- described in "From". Each entry in this list MUST be considered to be an
- additional place that references can be valid to, or to put this another
- way, entries MUST be combined using OR.
-
- Support: Core
- items:
- description: |-
- ReferenceGrantTo describes what Kinds are allowed as targets of the
- references.
- properties:
- group:
- description: |-
- Group is the group of the referent.
- When empty, the Kubernetes core API group is inferred.
-
- Support: Core
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: |-
- Kind is the kind of the referent. Although implementations may support
- additional resources, the following types are part of the "Core"
- support level for this field:
-
- * Secret when used to permit a SecretObjectReference
- * Service when used to permit a BackendObjectReference
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: |-
- Name is the name of the referent. When unspecified, this policy
- refers to all resources of the specified Group and Kind in the local
- namespace.
- maxLength: 253
- minLength: 1
- type: string
- required:
- - group
- - kind
- type: object
- maxItems: 16
- minItems: 1
- type: array
- required:
- - from
- - to
- type: object
- type: object
- served: true
- storage: true
- subresources: {}
-status:
- acceptedNames:
- kind: ""
- plural: ""
- conditions: null
- storedVersions: null
diff --git a/cluster/applications/monitoring/externalsecret.yaml b/cluster/applications/monitoring/externalsecret.yaml
deleted file mode 100644
index 7d97dc7..0000000
--- a/cluster/applications/monitoring/externalsecret.yaml
+++ /dev/null
@@ -1,27 +0,0 @@
-# ------------------------------------------------------------------------------
-# ExternalSecret — Grafana admin credentials
-# 1Password item: "grafana-admin" in the "mk-labs" vault
-# Fields: admin-user, admin-password
-# ------------------------------------------------------------------------------
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
- name: grafana-admin-secret
- namespace: monitoring
-spec:
- secretStoreRef:
- kind: ClusterSecretStore
- name: onepassword-connect
- refreshInterval: "1h"
- target:
- name: grafana-admin-secret
- creationPolicy: Owner
- data:
- - secretKey: admin-user
- remoteRef:
- key: grafana-admin
- property: admin-user
- - secretKey: admin-password
- remoteRef:
- key: grafana-admin
- property: admin-password
diff --git a/cluster/applications/monitoring/externalsecrets.yaml b/cluster/applications/monitoring/externalsecrets.yaml
new file mode 100644
index 0000000..3f94f1d
--- /dev/null
+++ b/cluster/applications/monitoring/externalsecrets.yaml
@@ -0,0 +1,67 @@
+# ------------------------------------------------------------------------------
+# ExternalSecrets — monitoring namespace secrets from 1Password
+# ------------------------------------------------------------------------------
+
+# Grafana admin credentials
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+ name: grafana-admin-secret
+ namespace: monitoring
+spec:
+ secretStoreRef:
+ kind: ClusterSecretStore
+ name: onepassword-connect
+ refreshInterval: "1h"
+ target:
+ name: grafana-admin-secret
+ creationPolicy: Owner
+ data:
+ - secretKey: admin-user
+ remoteRef:
+ key: grafana-admin
+ property: admin-user
+ - secretKey: admin-password
+ remoteRef:
+ key: grafana-admin
+ property: admin-password
+---
+# Proxmox VE Exporter API token
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+ name: pve-exporter-secret
+ namespace: monitoring
+spec:
+ secretStoreRef:
+ kind: ClusterSecretStore
+ name: onepassword-connect
+ refreshInterval: "1h"
+ target:
+ name: pve-exporter-secret
+ creationPolicy: Owner
+ data:
+ - secretKey: token-value
+ remoteRef:
+ key: proxmox-prometheus
+ property: token-value
+---
+# SNMP community string
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+ name: snmp-community-secret
+ namespace: monitoring
+spec:
+ secretStoreRef:
+ kind: ClusterSecretStore
+ name: onepassword-connect
+ refreshInterval: "1h"
+ target:
+ name: snmp-community-secret
+ creationPolicy: Owner
+ data:
+ - secretKey: community
+ remoteRef:
+ key: snmp-community
+ property: community
diff --git a/cluster/applications/monitoring/pve-exporter.yaml b/cluster/applications/monitoring/pve-exporter.yaml
new file mode 100644
index 0000000..e3750cd
--- /dev/null
+++ b/cluster/applications/monitoring/pve-exporter.yaml
@@ -0,0 +1,117 @@
+# ------------------------------------------------------------------------------
+# Proxmox VE Exporter
+# Scrapes the Proxmox cluster API for VM states, storage, CPU metrics.
+# Uses multi-target pattern — Prometheus passes the target node as a param.
+#
+# Credentials: prometheus@pve!prometheus-token
+# Config file mounted from Secret (populated by ESO from 1Password)
+# ------------------------------------------------------------------------------
+
+# ConfigMap for pve.yml — credentials file for the exporter
+# Token value injected at runtime from the Secret via init container
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: pve-exporter-config
+ namespace: monitoring
+data:
+ pve.yml: |
+ default:
+ user: prometheus@pve
+ token_name: prometheus-token
+ verify_ssl: false
+---
+# Deployment
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: pve-exporter
+ namespace: monitoring
+ labels:
+ app: pve-exporter
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app: pve-exporter
+ template:
+ metadata:
+ labels:
+ app: pve-exporter
+ spec:
+ securityContext:
+ runAsNonRoot: true
+ runAsUser: 1000
+ runAsGroup: 1000
+ seccompProfile:
+ type: RuntimeDefault
+ initContainers:
+ # Merge the token value from the secret into the config file
+ - name: config-init
+ image: busybox:1.36
+ command:
+ - sh
+ - -c
+ - |
+ cp /config-ro/pve.yml /config/pve.yml
+ echo " token_value: $(cat /secrets/token-value)" >> /config/pve.yml
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ volumeMounts:
+ - name: config-ro
+ mountPath: /config-ro
+ - name: config-rw
+ mountPath: /config
+ - name: secret
+ mountPath: /secrets
+ containers:
+ - name: pve-exporter
+ image: prompve/prometheus-pve-exporter:3.5.1
+ args:
+ - --config.file=/config/pve.yml
+ ports:
+ - containerPort: 9221
+ name: metrics
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ volumeMounts:
+ - name: config-rw
+ mountPath: /config
+ resources:
+ requests:
+ cpu: 50m
+ memory: 64Mi
+ limits:
+ cpu: 200m
+ memory: 128Mi
+ volumes:
+ - name: config-ro
+ configMap:
+ name: pve-exporter-config
+ - name: config-rw
+ emptyDir: {}
+ - name: secret
+ secret:
+ secretName: pve-exporter-secret
+---
+# Service
+apiVersion: v1
+kind: Service
+metadata:
+ name: pve-exporter
+ namespace: monitoring
+ labels:
+ app: pve-exporter
+spec:
+ selector:
+ app: pve-exporter
+ ports:
+ - name: metrics
+ port: 9221
+ targetPort: 9221
diff --git a/cluster/applications/monitoring/snmp-exporter.yaml b/cluster/applications/monitoring/snmp-exporter.yaml
new file mode 100644
index 0000000..e2b4aeb
--- /dev/null
+++ b/cluster/applications/monitoring/snmp-exporter.yaml
@@ -0,0 +1,152 @@
+# ------------------------------------------------------------------------------
+# SNMP Exporter
+# Scrapes UniFi network devices via SNMP v2c.
+# Uses multi-target pattern — Prometheus passes device IP as a param.
+#
+# Devices:
+# - world-drive (UDM Pro) 192.168.1.1
+# - usw-pro-agg (USW-Pro-Agg) 192.168.1.123
+# - usw-pro-max-24 (USW-Pro-Max-24) 192.168.1.226
+# - usw-lite-16-poe (USW-Lite-16) 192.168.1.136
+# - ups-tower (UPS-Tower) 192.168.1.233
+# ------------------------------------------------------------------------------
+
+# SNMP exporter config — if_mib module with community from secret
+# Uses an init container to inject the community string at runtime
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: snmp-exporter-config
+ namespace: monitoring
+data:
+ snmp.yml: |
+ auths:
+ mk_labs_v2c:
+ community: COMMUNITY_PLACEHOLDER
+ version: 2
+ modules:
+ if_mib:
+ walk:
+ - interfaces
+ auth: mk_labs_v2c
+ metrics:
+ - name: ifIndex
+ oid: 1.3.6.1.2.1.2.2.1.1
+ type: gauge
+ help: A unique value for each interface
+ - name: ifDescr
+ oid: 1.3.6.1.2.1.2.2.1.2
+ type: DisplayString
+ help: Interface description
+ - name: ifOperStatus
+ oid: 1.3.6.1.2.1.2.2.1.8
+ type: gauge
+ help: Interface operational status
+ - name: ifInOctets
+ oid: 1.3.6.1.2.1.2.2.1.10
+ type: counter
+ help: Bytes received
+ - name: ifOutOctets
+ oid: 1.3.6.1.2.1.2.2.1.16
+ type: counter
+ help: Bytes sent
+ - name: ifInErrors
+ oid: 1.3.6.1.2.1.2.2.1.14
+ type: counter
+ help: Inbound errors
+ - name: ifOutErrors
+ oid: 1.3.6.1.2.1.2.2.1.20
+ type: counter
+ help: Outbound errors
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: snmp-exporter
+ namespace: monitoring
+ labels:
+ app: snmp-exporter
+spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app: snmp-exporter
+ template:
+ metadata:
+ labels:
+ app: snmp-exporter
+ spec:
+ securityContext:
+ runAsNonRoot: true
+ runAsUser: 1000
+ runAsGroup: 1000
+ seccompProfile:
+ type: RuntimeDefault
+ initContainers:
+ - name: config-init
+ image: busybox:1.36
+ command:
+ - sh
+ - -c
+ - |
+ COMMUNITY=$(cat /secrets/community)
+ sed "s/COMMUNITY_PLACEHOLDER/$COMMUNITY/" /config-ro/snmp.yml > /config/snmp.yml
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ volumeMounts:
+ - name: config-ro
+ mountPath: /config-ro
+ - name: config-rw
+ mountPath: /config
+ - name: secret
+ mountPath: /secrets
+ containers:
+ - name: snmp-exporter
+ image: prom/snmp-exporter:v0.26.0
+ args:
+ - --config.file=/config/snmp.yml
+ ports:
+ - containerPort: 9116
+ name: metrics
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ volumeMounts:
+ - name: config-rw
+ mountPath: /config
+ resources:
+ requests:
+ cpu: 50m
+ memory: 64Mi
+ limits:
+ cpu: 200m
+ memory: 128Mi
+ volumes:
+ - name: config-ro
+ configMap:
+ name: snmp-exporter-config
+ - name: config-rw
+ emptyDir: {}
+ - name: secret
+ secret:
+ secretName: snmp-community-secret
+---
+apiVersion: v1
+kind: Service
+metadata:
+ name: snmp-exporter
+ namespace: monitoring
+ labels:
+ app: snmp-exporter
+spec:
+ selector:
+ app: snmp-exporter
+ ports:
+ - name: metrics
+ port: 9116
+ targetPort: 9116
diff --git a/cluster/applications/monitoring/values.yaml b/cluster/applications/monitoring/values.yaml
index f115600..c2506b7 100644
--- a/cluster/applications/monitoring/values.yaml
+++ b/cluster/applications/monitoring/values.yaml
@@ -4,11 +4,7 @@
# Version: 70.4.2
# ------------------------------------------------------------------------------
-# ─── Global ───────────────────────────────────────────────────────────────────
-fullnameOverride: ""
-
# ─── Alertmanager ─────────────────────────────────────────────────────────────
-# Deployed but unconfigured — wire into n8n later
alertmanager:
enabled: true
alertmanagerSpec:
@@ -25,11 +21,9 @@ alertmanager:
# ─── Prometheus ───────────────────────────────────────────────────────────────
prometheus:
prometheusSpec:
- # Retention
retention: 30d
retentionSize: "45GB"
- # Storage — NFS via csi-driver-nfs
storageSpec:
volumeClaimTemplate:
spec:
@@ -40,12 +34,11 @@ prometheus:
requests:
storage: 50Gi
- # Scrape all ServiceMonitors and PodMonitors regardless of namespace
+ # Scrape all ServiceMonitors/PodMonitors regardless of namespace
serviceMonitorSelectorNilUsesHelmValues: false
podMonitorSelectorNilUsesHelmValues: false
ruleSelectorNilUsesHelmValues: false
- # Resource limits — fastpass workers have reasonable headroom
resources:
requests:
cpu: 200m
@@ -54,32 +47,213 @@ prometheus:
cpu: 1000m
memory: 2Gi
+ # ─── Additional scrape configs — external targets ──────────────────────────
+ additionalScrapeConfigs:
+
+ # Proxmox nodes — Node Exporter on each hypervisor
+ - job_name: proxmox-nodes
+ scrape_interval: 30s
+ static_configs:
+ - targets:
+ - 10.1.71.11:9100
+ - 10.1.71.12:9100
+ - 10.1.71.13:9100
+ labels:
+ job: proxmox
+
+ # cinderella-castle — existing VM-side Prometheus host
+ # Remove this once cinderella-castle is decommissioned
+ - job_name: node-cinderella-castle
+ scrape_interval: 30s
+ static_configs:
+ - targets:
+ - 10.1.71.31:9100
+ labels:
+ hostname: cinderella-castle
+
+ # Traefik metrics
+ - job_name: traefik
+ scrape_interval: 30s
+ static_configs:
+ - targets:
+ - 10.1.71.35:8080
+ labels:
+ hostname: lightning-lane
+
+ # Proxmox VE Exporter — cluster-level metrics (VM states, storage, CPU)
+ # Multi-target pattern: Prometheus passes the cluster address as a param
+ - job_name: proxmox-cluster
+ scrape_interval: 30s
+ metrics_path: /pve
+ params:
+ module: [default]
+ cluster: ["1"]
+ node: [""]
+ static_configs:
+ - targets:
+ - 10.1.71.11 # main-street-usa — cluster API endpoint
+ labels:
+ cluster: magic-kingdom
+ relabel_configs:
+ - source_labels: [__address__]
+ target_label: __param_target
+ - source_labels: [__param_target]
+ target_label: instance
+ - target_label: __address__
+ replacement: pve-exporter.monitoring.svc.cluster.local:9221
+
+ # SNMP — UniFi devices (multi-target pattern)
+ # world-drive (UDM Pro)
+ - job_name: snmp-udm-pro
+ scrape_interval: 60s
+ scrape_timeout: 55s
+ metrics_path: /snmp
+ params:
+ auth: [mk_labs_v2c]
+ module: [if_mib]
+ static_configs:
+ - targets:
+ - 192.168.1.1
+ labels:
+ device: world-drive
+ model: UDM-Pro
+ relabel_configs:
+ - source_labels: [__address__]
+ target_label: __param_target
+ - source_labels: [__param_target]
+ target_label: instance
+ - target_label: __address__
+ replacement: snmp-exporter.monitoring.svc.cluster.local:9116
+
+ # usw-pro-aggregation
+ - job_name: snmp-usw-pro-aggregation
+ scrape_interval: 60s
+ scrape_timeout: 55s
+ metrics_path: /snmp
+ params:
+ auth: [mk_labs_v2c]
+ module: [if_mib]
+ static_configs:
+ - targets:
+ - 192.168.1.123
+ labels:
+ device: usw-pro-aggregation
+ model: USW-Pro-Aggregation
+ relabel_configs:
+ - source_labels: [__address__]
+ target_label: __param_target
+ - source_labels: [__param_target]
+ target_label: instance
+ - target_label: __address__
+ replacement: snmp-exporter.monitoring.svc.cluster.local:9116
+
+ # usw-pro-max-24
+ - job_name: snmp-usw-pro-max-24
+ scrape_interval: 60s
+ scrape_timeout: 55s
+ metrics_path: /snmp
+ params:
+ auth: [mk_labs_v2c]
+ module: [if_mib]
+ static_configs:
+ - targets:
+ - 192.168.1.226
+ labels:
+ device: usw-pro-max-24
+ model: USW-Pro-Max-24
+ relabel_configs:
+ - source_labels: [__address__]
+ target_label: __param_target
+ - source_labels: [__param_target]
+ target_label: instance
+ - target_label: __address__
+ replacement: snmp-exporter.monitoring.svc.cluster.local:9116
+
+ # usw-lite-16-poe
+ - job_name: snmp-usw-lite-16-poe
+ scrape_interval: 60s
+ scrape_timeout: 55s
+ metrics_path: /snmp
+ params:
+ auth: [mk_labs_v2c]
+ module: [if_mib]
+ static_configs:
+ - targets:
+ - 192.168.1.136
+ labels:
+ device: usw-lite-16-poe
+ model: USW-Lite-16-PoE
+ relabel_configs:
+ - source_labels: [__address__]
+ target_label: __param_target
+ - source_labels: [__param_target]
+ target_label: instance
+ - target_label: __address__
+ replacement: snmp-exporter.monitoring.svc.cluster.local:9116
+
+ # ups-tower
+ - job_name: snmp-ups-tower
+ scrape_interval: 60s
+ scrape_timeout: 55s
+ metrics_path: /snmp
+ params:
+ auth: [mk_labs_v2c]
+ module: [if_mib]
+ static_configs:
+ - targets:
+ - 192.168.1.233
+ labels:
+ device: ups-tower
+ model: UPS-Tower
+ relabel_configs:
+ - source_labels: [__address__]
+ target_label: __param_target
+ - source_labels: [__param_target]
+ target_label: instance
+ - target_label: __address__
+ replacement: snmp-exporter.monitoring.svc.cluster.local:9116
+
+ # Pure FlashArray — DEFERRED until Purity 6.7+
+ # Uncomment when utilidor is upgraded. Native OpenMetrics endpoint,
+ # no exporter container needed. Add API token to 1Password as
+ # item "pure-flasharray-utilidor" field "api-token".
+ # - job_name: pure-flasharray-utilidor
+ # scrape_interval: 30s
+ # metrics_path: /metrics/array
+ # scheme: https
+ # tls_config:
+ # insecure_skip_verify: true
+ # authorization:
+ # credentials_file: /etc/prometheus/secrets/pure-api-token/api-token
+ # params:
+ # namespace: ["purefa"]
+ # static_configs:
+ # - targets:
+ # - utilidor.local.mk-labs.cloud
+ # labels:
+ # array: utilidor
+ # array_type: physical
+
# ─── Grafana ──────────────────────────────────────────────────────────────────
grafana:
enabled: true
-
- # Stateless — dashboards managed as ConfigMaps, no PVC needed
persistence:
enabled: false
- # Admin credentials via ESO from 1Password
admin:
existingSecret: grafana-admin-secret
userKey: admin-user
passwordKey: admin-password
- # Grafana URL — used for redirects and OAuth callbacks
grafana.ini:
server:
root_url: https://grafana.local.mk-labs.cloud
auth:
disable_login_form: false
- # Default dashboards
defaultDashboardsEnabled: true
defaultDashboardsTimezone: browser
- # Node Exporter Full — dashboard 1860
dashboardProviders:
dashboardproviders.yaml:
apiVersion: 1
@@ -107,8 +281,15 @@ grafana:
gnetId: 6336
revision: 1
datasource: Prometheus
+ unifi-poller:
+ gnetId: 11315
+ revision: 9
+ datasource: Prometheus
+ proxmox-cluster:
+ gnetId: 10347
+ revision: 5
+ datasource: Prometheus
- # Sidecar for ConfigMap-based dashboards
sidecar:
dashboards:
enabled: true