Traefik & Kubernetes with Gateway API

The Kubernetes Gateway API, The Experimental Way.

Gateway API is the evolution of Kubernetes APIs that relate to Services, such as Ingress. The Gateway API project is part of Kubernetes, working under SIG-NETWORK.

The Kubernetes Gateway provider is a Traefik implementation of the Gateway API specifications from the Kubernetes Special Interest Groups (SIGs).

This provider is proposed as an experimental feature and partially supports the Gateway API v0.3.0 specification.

Enabling The Experimental Kubernetes Gateway Provider

Since this provider is still experimental, it needs to be activated in the experimental section of the static configuration.

File (YAML)

  1. experimental:
  2. kubernetesGateway: true
  3. providers:
  4. kubernetesGateway: {}
  5. #...

File (TOML)

  1. [experimental]
  2. kubernetesGateway = true
  3. [providers.kubernetesGateway]
  4. #...

CLI

  1. --experimental.kubernetesgateway=true --providers.kubernetesgateway=true #...

Configuration Requirements

All Steps for a Successful Deployment

  • Add/update the Kubernetes Gateway API definitions.
  • Add/update the RBAC for the Traefik custom resources.
  • Add all needed Kubernetes Gateway API resources.

Examples

Kubernetes Gateway Provider Basic Example

Gateway API

  1. ---
  2. kind: GatewayClass
  3. apiVersion: networking.x-k8s.io/v1alpha1
  4. metadata:
  5. name: my-gateway-class
  6. spec:
  7. controller: traefik.io/gateway-controller
  8. ---
  9. kind: Gateway
  10. apiVersion: networking.x-k8s.io/v1alpha1
  11. metadata:
  12. name: my-gateway
  13. spec:
  14. gatewayClassName: my-gateway-class
  15. listeners:
  16. - protocol: HTTPS
  17. port: 443
  18. tls:
  19. certificateRef:
  20. group: "core"
  21. kind: "Secret"
  22. name: "mysecret"
  23. routes:
  24. kind: HTTPRoute
  25. selector:
  26. matchLabels:
  27. app: foo
  28. ---
  29. kind: HTTPRoute
  30. apiVersion: networking.x-k8s.io/v1alpha1
  31. metadata:
  32. name: http-app-1
  33. namespace: default
  34. labels:
  35. app: foo
  36. spec:
  37. hostnames:
  38. - "whoami"
  39. rules:
  40. - matches:
  41. - path:
  42. type: Exact
  43. value: /foo
  44. forwardTo:
  45. - serviceName: whoami
  46. port: 80
  47. weight: 1

Whoami Service

  1. ---
  2. kind: Deployment
  3. apiVersion: apps/v1
  4. metadata:
  5. name: whoami
  6. spec:
  7. replicas: 2
  8. selector:
  9. matchLabels:
  10. app: whoami
  11. template:
  12. metadata:
  13. labels:
  14. app: whoami
  15. spec:
  16. containers:
  17. - name: whoami
  18. image: traefik/whoami
  19. ---
  20. apiVersion: v1
  21. kind: Service
  22. metadata:
  23. name: whoami
  24. spec:
  25. ports:
  26. - protocol: TCP
  27. port: 80
  28. selector:
  29. app: whoami

Traefik Service

  1. ---
  2. apiVersion: v1
  3. kind: ServiceAccount
  4. metadata:
  5. name: traefik-controller
  6. ---
  7. kind: Deployment
  8. apiVersion: apps/v1
  9. metadata:
  10. name: traefik
  11. spec:
  12. replicas: 1
  13. selector:
  14. matchLabels:
  15. app: traefik-lb
  16. template:
  17. metadata:
  18. labels:
  19. app: traefik-lb
  20. spec:
  21. serviceAccountName: traefik-controller
  22. containers:
  23. - name: traefik
  24. image: traefik/traefik:latest
  25. imagePullPolicy: IfNotPresent
  26. args:
  27. - --entrypoints.web.address=:80
  28. - --entrypoints.websecure.address=:443
  29. - --experimental.kubernetesgateway
  30. - --providers.kubernetesgateway
  31. ports:
  32. - name: web
  33. containerPort: 80
  34. - name: websecure
  35. containerPort: 443
  36. ---
  37. apiVersion: v1
  38. kind: Service
  39. metadata:
  40. name: traefik
  41. spec:
  42. selector:
  43. app: traefik-lb
  44. ports:
  45. - protocol: TCP
  46. port: 80
  47. targetPort: web
  48. name: web
  49. - protocol: TCP
  50. port: 443
  51. targetPort: websecure
  52. name: websecure
  53. type: LoadBalancer

Gateway API CRDs

  1. # All resources definition must be declared
  2. ---
  3. apiVersion: apiextensions.k8s.io/v1
  4. kind: CustomResourceDefinition
  5. metadata:
  6. annotations:
  7. controller-gen.kubebuilder.io/version: v0.5.0
  8. creationTimestamp: null
  9. name: gatewayclasses.networking.x-k8s.io
  10. spec:
  11. group: networking.x-k8s.io
  12. names:
  13. categories:
  14. - gateway-api
  15. kind: GatewayClass
  16. listKind: GatewayClassList
  17. plural: gatewayclasses
  18. shortNames:
  19. - gc
  20. singular: gatewayclass
  21. scope: Cluster
  22. versions:
  23. - additionalPrinterColumns:
  24. - jsonPath: .spec.controller
  25. name: Controller
  26. type: string
  27. - jsonPath: .metadata.creationTimestamp
  28. name: Age
  29. type: date
  30. name: v1alpha1
  31. schema:
  32. openAPIV3Schema:
  33. description: "GatewayClass describes a class of Gateways available to the
  34. user for creating Gateway resources. \n GatewayClass is a Cluster level
  35. resource."
  36. properties:
  37. apiVersion:
  38. description: 'APIVersion defines the versioned schema of this representation
  39. of an object. Servers should convert recognized schemas to the latest
  40. internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  41. type: string
  42. kind:
  43. description: 'Kind is a string value representing the REST resource this
  44. object represents. Servers may infer this from the endpoint the client
  45. submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  46. type: string
  47. metadata:
  48. type: object
  49. spec:
  50. description: Spec defines the desired state of GatewayClass.
  51. properties:
  52. controller:
  53. description: "Controller is a domain/path string that indicates the
  54. controller that is managing Gateways of this class. \n Example:
  55. \"acme.io/gateway-controller\". \n This field is not mutable and
  56. cannot be empty. \n The format of this field is DOMAIN \"/\" PATH,
  57. where DOMAIN and PATH are valid Kubernetes names (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
  58. \n Support: Core"
  59. maxLength: 253
  60. type: string
  61. parametersRef:
  62. description: "ParametersRef is a reference to a resource that contains
  63. the configuration parameters corresponding to the GatewayClass.
  64. This is optional if the controller does not require any additional
  65. configuration. \n ParametersRef can reference a standard Kubernetes
  66. resource, i.e. ConfigMap, or an implementation-specific custom resource.
  67. The resource can be cluster-scoped or namespace-scoped. \n If the
  68. referent cannot be found, the GatewayClass's \"InvalidParameters\"
  69. status condition will be true. \n Support: Custom"
  70. properties:
  71. group:
  72. description: Group is the group of the referent.
  73. maxLength: 253
  74. minLength: 1
  75. type: string
  76. kind:
  77. description: Kind is kind of the referent.
  78. maxLength: 253
  79. minLength: 1
  80. type: string
  81. name:
  82. description: Name is the name of the referent.
  83. maxLength: 253
  84. minLength: 1
  85. type: string
  86. namespace:
  87. description: Namespace is the namespace of the referent. This
  88. field is required when scope is set to "Namespace" and ignored
  89. when scope is set to "Cluster".
  90. maxLength: 253
  91. minLength: 1
  92. type: string
  93. scope:
  94. default: Cluster
  95. description: Scope represents if the referent is a Cluster or
  96. Namespace scoped resource. This may be set to "Cluster" or "Namespace".
  97. enum:
  98. - Cluster
  99. - Namespace
  100. type: string
  101. required:
  102. - group
  103. - kind
  104. - name
  105. type: object
  106. required:
  107. - controller
  108. type: object
  109. status:
  110. default:
  111. conditions:
  112. - lastTransitionTime: "1970-01-01T00:00:00Z"
  113. message: Waiting for controller
  114. reason: Waiting
  115. status: "False"
  116. type: Admitted
  117. description: Status defines the current state of GatewayClass.
  118. properties:
  119. conditions:
  120. default:
  121. - lastTransitionTime: "1970-01-01T00:00:00Z"
  122. message: Waiting for controller
  123. reason: Waiting
  124. status: "False"
  125. type: Admitted
  126. description: "Conditions is the current status from the controller
  127. for this GatewayClass. \n Controllers should prefer to publish conditions
  128. using values of GatewayClassConditionType for the type of each Condition."
  129. items:
  130. description: "Condition contains details for one aspect of the current
  131. state of this API Resource. --- This struct is intended for direct
  132. use as an array at the field path .status.conditions. For example,
  133. type FooStatus struct{ // Represents the observations of a
  134. foo's current state. // Known .status.conditions.type are:
  135. \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type
  136. \ // +patchStrategy=merge // +listType=map // +listMapKey=type
  137. \ Conditions []metav1.Condition `json:\"conditions,omitempty\"
  138. patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`
  139. \n // other fields }"
  140. properties:
  141. lastTransitionTime:
  142. description: lastTransitionTime is the last time the condition
  143. transitioned from one status to another. This should be when
  144. the underlying condition changed. If that is not known, then
  145. using the time when the API field changed is acceptable.
  146. format: date-time
  147. type: string
  148. message:
  149. description: message is a human readable message indicating
  150. details about the transition. This may be an empty string.
  151. maxLength: 32768
  152. type: string
  153. observedGeneration:
  154. description: observedGeneration represents the .metadata.generation
  155. that the condition was set based upon. For instance, if .metadata.generation
  156. is currently 12, but the .status.conditions[x].observedGeneration
  157. is 9, the condition is out of date with respect to the current
  158. state of the instance.
  159. format: int64
  160. minimum: 0
  161. type: integer
  162. reason:
  163. description: reason contains a programmatic identifier indicating
  164. the reason for the condition's last transition. Producers
  165. of specific condition types may define expected values and
  166. meanings for this field, and whether the values are considered
  167. a guaranteed API. The value should be a CamelCase string.
  168. This field may not be empty.
  169. maxLength: 1024
  170. minLength: 1
  171. pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
  172. type: string
  173. status:
  174. description: status of the condition, one of True, False, Unknown.
  175. enum:
  176. - "True"
  177. - "False"
  178. - Unknown
  179. type: string
  180. type:
  181. description: type of condition in CamelCase or in foo.example.com/CamelCase.
  182. --- Many .condition.type values are consistent across resources
  183. like Available, but because arbitrary conditions can be useful
  184. (see .node.status.conditions), the ability to deconflict is
  185. important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
  186. maxLength: 316
  187. pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
  188. type: string
  189. required:
  190. - lastTransitionTime
  191. - message
  192. - reason
  193. - status
  194. - type
  195. type: object
  196. maxItems: 8
  197. type: array
  198. x-kubernetes-list-map-keys:
  199. - type
  200. x-kubernetes-list-type: map
  201. type: object
  202. type: object
  203. served: true
  204. storage: true
  205. subresources:
  206. status: {}
  207. status:
  208. acceptedNames:
  209. kind: ""
  210. plural: ""
  211. conditions: []
  212. storedVersions: []
  213. ---
  214. apiVersion: apiextensions.k8s.io/v1
  215. kind: CustomResourceDefinition
  216. metadata:
  217. annotations:
  218. controller-gen.kubebuilder.io/version: v0.5.0
  219. creationTimestamp: null
  220. name: gateways.networking.x-k8s.io
  221. spec:
  222. group: networking.x-k8s.io
  223. names:
  224. categories:
  225. - gateway-api
  226. kind: Gateway
  227. listKind: GatewayList
  228. plural: gateways
  229. shortNames:
  230. - gtw
  231. singular: gateway
  232. scope: Namespaced
  233. versions:
  234. - additionalPrinterColumns:
  235. - jsonPath: .spec.gatewayClassName
  236. name: Class
  237. type: string
  238. - jsonPath: .metadata.creationTimestamp
  239. name: Age
  240. type: date
  241. name: v1alpha1
  242. schema:
  243. openAPIV3Schema:
  244. description: "Gateway represents an instantiation of a service-traffic handling
  245. infrastructure by binding Listeners to a set of IP addresses. \n Implementations
  246. should add the `gateway-exists-finalizer.networking.x-k8s.io` finalizer
  247. on the associated GatewayClass whenever Gateway(s) is running. This ensures
  248. that a GatewayClass associated with a Gateway(s) is not deleted while in
  249. use."
  250. properties:
  251. apiVersion:
  252. description: 'APIVersion defines the versioned schema of this representation
  253. of an object. Servers should convert recognized schemas to the latest
  254. internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  255. type: string
  256. kind:
  257. description: 'Kind is a string value representing the REST resource this
  258. object represents. Servers may infer this from the endpoint the client
  259. submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  260. type: string
  261. metadata:
  262. type: object
  263. spec:
  264. description: Spec defines the desired state of Gateway.
  265. properties:
  266. addresses:
  267. description: "Addresses requested for this gateway. This is optional
  268. and behavior can depend on the GatewayClass. If a value is set in
  269. the spec and the requested address is invalid, the GatewayClass
  270. MUST indicate this in the associated entry in GatewayStatus.Addresses.
  271. \n If no Addresses are specified, the GatewayClass may schedule
  272. the Gateway in an implementation-defined manner, assigning an appropriate
  273. set of Addresses. \n The GatewayClass MUST bind all Listeners to
  274. every GatewayAddress that it assigns to the Gateway. \n Support:
  275. Core"
  276. items:
  277. description: GatewayAddress describes an address that can be bound
  278. to a Gateway.
  279. properties:
  280. type:
  281. default: IPAddress
  282. description: "Type of the address. \n Support: Extended"
  283. enum:
  284. - IPAddress
  285. - NamedAddress
  286. type: string
  287. value:
  288. description: "Value of the address. The validity of the values
  289. will depend on the type and support by the controller. \n
  290. Examples: `1.2.3.4`, `128::1`, `my-ip-address`."
  291. maxLength: 253
  292. minLength: 1
  293. type: string
  294. required:
  295. - value
  296. type: object
  297. maxItems: 16
  298. type: array
  299. gatewayClassName:
  300. description: GatewayClassName used for this Gateway. This is the name
  301. of a GatewayClass resource.
  302. maxLength: 253
  303. minLength: 1
  304. type: string
  305. listeners:
  306. description: "Listeners associated with this Gateway. Listeners define
  307. logical endpoints that are bound on this Gateway's addresses. At
  308. least one Listener MUST be specified. \n An implementation MAY group
  309. Listeners by Port and then collapse each group of Listeners into
  310. a single Listener if the implementation determines that the Listeners
  311. in the group are \"compatible\". An implementation MAY also group
  312. together and collapse compatible Listeners belonging to different
  313. Gateways. \n For example, an implementation might consider Listeners
  314. to be compatible with each other if all of the following conditions
  315. are met: \n 1. Either each Listener within the group specifies the
  316. \"HTTP\" Protocol or each Listener within the group specifies
  317. either the \"HTTPS\" or \"TLS\" Protocol. \n 2. Each Listener
  318. within the group specifies a Hostname that is unique within the
  319. group. \n 3. As a special case, one Listener within a group may
  320. omit Hostname, in which case this Listener matches when no other
  321. Listener matches. \n If the implementation does collapse compatible
  322. Listeners, the hostname provided in the incoming client request
  323. MUST be matched to a Listener to find the correct set of Routes.
  324. The incoming hostname MUST be matched using the Hostname field for
  325. each Listener in order of most to least specific. That is, exact
  326. matches must be processed before wildcard matches. \n If this field
  327. specifies multiple Listeners that have the same Port value but are
  328. not compatible, the implementation must raise a \"Conflicted\" condition
  329. in the Listener status. \n Support: Core"
  330. items:
  331. description: Listener embodies the concept of a logical endpoint
  332. where a Gateway can accept network connections. Each listener
  333. in a Gateway must have a unique combination of Hostname, Port,
  334. and Protocol. This will be enforced by a validating webhook.
  335. properties:
  336. hostname:
  337. description: "Hostname specifies the virtual hostname to match
  338. for protocol types that define this concept. When unspecified,
  339. \"\", or `*`, all hostnames are matched. This field can be
  340. omitted for protocols that don't require hostname based matching.
  341. \n Hostname is the fully qualified domain name of a network
  342. host, as defined by RFC 3986. Note the following deviations
  343. from the \"host\" part of the URI as defined in the RFC: \n
  344. 1. IP literals are not allowed. 2. The `:` delimiter is not
  345. respected because ports are not allowed. \n Hostname can be
  346. \"precise\" which is a domain name without the terminating
  347. dot of a network host (e.g. \"foo.example.com\") or \"wildcard\",
  348. which is a domain name prefixed with a single wildcard label
  349. (e.g. `*.example.com`). The wildcard character `*` must appear
  350. by itself as the first DNS label and matches only a single
  351. label. \n Support: Core"
  352. maxLength: 253
  353. minLength: 1
  354. type: string
  355. port:
  356. description: "Port is the network port. Multiple listeners may
  357. use the same port, subject to the Listener compatibility rules.
  358. \n Support: Core"
  359. format: int32
  360. maximum: 65535
  361. minimum: 1
  362. type: integer
  363. protocol:
  364. description: "Protocol specifies the network protocol this listener
  365. expects to receive. The GatewayClass MUST apply the Hostname
  366. match appropriately for each protocol: \n * For the \"TLS\"
  367. protocol, the Hostname match MUST be applied to the [SNI](https://tools.ietf.org/html/rfc6066#section-3)
  368. \ server name offered by the client. * For the \"HTTP\" protocol,
  369. the Hostname match MUST be applied to the host portion of
  370. the [effective request URI](https://tools.ietf.org/html/rfc7230#section-5.5)
  371. \ or the [:authority pseudo-header](https://tools.ietf.org/html/rfc7540#section-8.1.2.3)
  372. * For the \"HTTPS\" protocol, the Hostname match MUST be applied
  373. at both the TLS and HTTP protocol layers. \n Support: Core"
  374. type: string
  375. routes:
  376. description: "Routes specifies a schema for associating routes
  377. with the Listener using selectors. A Route is a resource capable
  378. of servicing a request and allows a cluster operator to expose
  379. a cluster resource (i.e. Service) by externally-reachable
  380. URL, load-balance traffic and terminate SSL/TLS. Typically,
  381. a route is a \"HTTPRoute\" or \"TCPRoute\" in group \"networking.x-k8s.io\",
  382. however, an implementation may support other types of resources.
  383. \n The Routes selector MUST select a set of objects that are
  384. compatible with the application protocol specified in the
  385. Protocol field. \n Although a client request may technically
  386. match multiple route rules, only one rule may ultimately receive
  387. the request. Matching precedence MUST be determined in order
  388. of the following criteria: \n * The most specific match. For
  389. example, the most specific HTTPRoute match is determined
  390. by the longest matching combination of hostname and path.
  391. * The oldest Route based on creation timestamp. For example,
  392. a Route with a creation timestamp of \"2020-09-08 01:02:03\"
  393. is given precedence over a Route with a creation timestamp
  394. of \"2020-09-08 01:02:04\". * If everything else is equivalent,
  395. the Route appearing first in alphabetical order (namespace/name)
  396. should be given precedence. For example, foo/bar is given
  397. precedence over foo/baz. \n All valid portions of a Route
  398. selected by this field should be supported. Invalid portions
  399. of a Route can be ignored (sometimes that will mean the full
  400. Route). If a portion of a Route transitions from valid to
  401. invalid, support for that portion of the Route should be dropped
  402. to ensure consistency. For example, even if a filter specified
  403. by a Route is invalid, the rest of the Route should still
  404. be supported. \n Support: Core"
  405. properties:
  406. group:
  407. default: networking.x-k8s.io
  408. description: "Group is the group of the route resource to
  409. select. Omitting the value or specifying the empty string
  410. indicates the networking.x-k8s.io API group. For example,
  411. use the following to select an HTTPRoute: \n routes: kind:
  412. HTTPRoute \n Otherwise, if an alternative API group is
  413. desired, specify the desired group: \n routes: group:
  414. acme.io kind: FooRoute \n Support: Core"
  415. maxLength: 253
  416. minLength: 1
  417. type: string
  418. kind:
  419. description: "Kind is the kind of the route resource to
  420. select. \n Kind MUST correspond to kinds of routes that
  421. are compatible with the application protocol specified
  422. in the Listener's Protocol field. \n If an implementation
  423. does not support or recognize this resource type, it SHOULD
  424. set the \"ResolvedRefs\" condition to false for this listener
  425. with the \"InvalidRoutesRef\" reason. \n Support: Core"
  426. type: string
  427. namespaces:
  428. default:
  429. from: Same
  430. description: "Namespaces indicates in which namespaces Routes
  431. should be selected for this Gateway. This is restricted
  432. to the namespace of this Gateway by default. \n Support:
  433. Core"
  434. properties:
  435. from:
  436. default: Same
  437. description: "From indicates where Routes will be selected
  438. for this Gateway. Possible values are: * All: Routes
  439. in all namespaces may be used by this Gateway. * Selector:
  440. Routes in namespaces selected by the selector may
  441. be used by this Gateway. * Same: Only Routes in
  442. the same namespace may be used by this Gateway. \n
  443. Support: Core"
  444. enum:
  445. - All
  446. - Selector
  447. - Same
  448. type: string
  449. selector:
  450. description: "Selector must be specified when From is
  451. set to \"Selector\". In that case, only Routes in
  452. Namespaces matching this Selector will be selected
  453. by this Gateway. This field is ignored for other values
  454. of \"From\". \n Support: Core"
  455. properties:
  456. matchExpressions:
  457. description: matchExpressions is a list of label
  458. selector requirements. The requirements are ANDed.
  459. items:
  460. description: A label selector requirement is a
  461. selector that contains values, a key, and an
  462. operator that relates the key and values.
  463. properties:
  464. key:
  465. description: key is the label key that the
  466. selector applies to.
  467. type: string
  468. operator:
  469. description: operator represents a key's relationship
  470. to a set of values. Valid operators are
  471. In, NotIn, Exists and DoesNotExist.
  472. type: string
  473. values:
  474. description: values is an array of string
  475. values. If the operator is In or NotIn,
  476. the values array must be non-empty. If the
  477. operator is Exists or DoesNotExist, the
  478. values array must be empty. This array is
  479. replaced during a strategic merge patch.
  480. items:
  481. type: string
  482. type: array
  483. required:
  484. - key
  485. - operator
  486. type: object
  487. type: array
  488. matchLabels:
  489. additionalProperties:
  490. type: string
  491. description: matchLabels is a map of {key,value}
  492. pairs. A single {key,value} in the matchLabels
  493. map is equivalent to an element of matchExpressions,
  494. whose key field is "key", the operator is "In",
  495. and the values array contains only "value". The
  496. requirements are ANDed.
  497. type: object
  498. type: object
  499. type: object
  500. selector:
  501. description: "Selector specifies a set of route labels used
  502. for selecting routes to associate with the Gateway. If
  503. this Selector is defined, only routes matching the Selector
  504. are associated with the Gateway. An empty Selector matches
  505. all routes. \n Support: Core"
  506. properties:
  507. matchExpressions:
  508. description: matchExpressions is a list of label selector
  509. requirements. The requirements are ANDed.
  510. items:
  511. description: A label selector requirement is a selector
  512. that contains values, a key, and an operator that
  513. relates the key and values.
  514. properties:
  515. key:
  516. description: key is the label key that the selector
  517. applies to.
  518. type: string
  519. operator:
  520. description: operator represents a key's relationship
  521. to a set of values. Valid operators are In,
  522. NotIn, Exists and DoesNotExist.
  523. type: string
  524. values:
  525. description: values is an array of string values.
  526. If the operator is In or NotIn, the values array
  527. must be non-empty. If the operator is Exists
  528. or DoesNotExist, the values array must be empty.
  529. This array is replaced during a strategic merge
  530. patch.
  531. items:
  532. type: string
  533. type: array
  534. required:
  535. - key
  536. - operator
  537. type: object
  538. type: array
  539. matchLabels:
  540. additionalProperties:
  541. type: string
  542. description: matchLabels is a map of {key,value} pairs.
  543. A single {key,value} in the matchLabels map is equivalent
  544. to an element of matchExpressions, whose key field
  545. is "key", the operator is "In", and the values array
  546. contains only "value". The requirements are ANDed.
  547. type: object
  548. type: object
  549. required:
  550. - kind
  551. type: object
  552. tls:
  553. description: "TLS is the TLS configuration for the Listener.
  554. This field is required if the Protocol field is \"HTTPS\"
  555. or \"TLS\" and ignored otherwise. \n The association of SNIs
  556. to Certificate defined in GatewayTLSConfig is defined based
  557. on the Hostname field for this listener. \n The GatewayClass
  558. MUST use the longest matching SNI out of all available certificates
  559. for any TLS handshake. \n Support: Core"
  560. properties:
  561. certificateRef:
  562. description: "CertificateRef is a reference to a Kubernetes
  563. object that contains a TLS certificate and private key.
  564. This certificate is used to establish a TLS handshake
  565. for requests that match the hostname of the associated
  566. listener. The referenced object MUST reside in the same
  567. namespace as Gateway. \n This field is required when mode
  568. is set to \"Terminate\" (default) and optional otherwise.
  569. \n CertificateRef can reference a standard Kubernetes
  570. resource, i.e. Secret, or an implementation-specific custom
  571. resource. \n Support: Core (Kubernetes Secrets) \n Support:
  572. Implementation-specific (Other resource types)"
  573. properties:
  574. group:
  575. description: Group is the group of the referent.
  576. maxLength: 253
  577. minLength: 1
  578. type: string
  579. kind:
  580. description: Kind is kind of the referent.
  581. maxLength: 253
  582. minLength: 1
  583. type: string
  584. name:
  585. description: Name is the name of the referent.
  586. maxLength: 253
  587. minLength: 1
  588. type: string
  589. required:
  590. - group
  591. - kind
  592. - name
  593. type: object
  594. mode:
  595. default: Terminate
  596. description: "Mode defines the TLS behavior for the TLS
  597. session initiated by the client. There are two possible
  598. modes: - Terminate: The TLS session between the downstream
  599. client and the Gateway is terminated at the Gateway.
  600. This mode requires certificateRef to be set. - Passthrough:
  601. The TLS session is NOT terminated by the Gateway. This
  602. \ implies that the Gateway can't decipher the TLS stream
  603. except for the ClientHello message of the TLS protocol.
  604. \ CertificateRef field is ignored in this mode. \n Support:
  605. Core"
  606. enum:
  607. - Terminate
  608. - Passthrough
  609. type: string
  610. options:
  611. additionalProperties:
  612. type: string
  613. description: "Options are a list of key/value pairs to give
  614. extended options to the provider. \n There variation among
  615. providers as to how ciphersuites are expressed. If there
  616. is a common subset for expressing ciphers then it will
  617. make sense to loft that as a core API construct. \n Support:
  618. Implementation-specific"
  619. type: object
  620. routeOverride:
  621. default:
  622. certificate: Deny
  623. description: "RouteOverride dictates if TLS settings can
  624. be configured via Routes or not. \n CertificateRef must
  625. be defined even if `routeOverride.certificate` is set
  626. to 'Allow' as it will be used as the default certificate
  627. for the listener. \n Support: Core"
  628. properties:
  629. certificate:
  630. default: Deny
  631. description: "Certificate dictates if TLS certificates
  632. can be configured via Routes. If set to 'Allow', a
  633. TLS certificate for a hostname defined in a Route
  634. takes precedence over the certificate defined in Gateway.
  635. \n Support: Core"
  636. enum:
  637. - Allow
  638. - Deny
  639. type: string
  640. type: object
  641. type: object
  642. required:
  643. - port
  644. - protocol
  645. - routes
  646. type: object
  647. maxItems: 64
  648. minItems: 1
  649. type: array
  650. required:
  651. - gatewayClassName
  652. - listeners
  653. type: object
  654. status:
  655. default:
  656. conditions:
  657. - lastTransitionTime: "1970-01-01T00:00:00Z"
  658. message: Waiting for controller
  659. reason: NotReconciled
  660. status: "False"
  661. type: Scheduled
  662. description: Status defines the current state of Gateway.
  663. properties:
  664. addresses:
  665. description: "Addresses lists the IP addresses that have actually
  666. been bound to the Gateway. These addresses may differ from the addresses
  667. in the Spec, e.g. if the Gateway automatically assigns an address
  668. from a reserved pool. \n These addresses should all be of type \"IPAddress\"."
  669. items:
  670. description: GatewayAddress describes an address that can be bound
  671. to a Gateway.
  672. properties:
  673. type:
  674. default: IPAddress
  675. description: "Type of the address. \n Support: Extended"
  676. enum:
  677. - IPAddress
  678. - NamedAddress
  679. type: string
  680. value:
  681. description: "Value of the address. The validity of the values
  682. will depend on the type and support by the controller. \n
  683. Examples: `1.2.3.4`, `128::1`, `my-ip-address`."
  684. maxLength: 253
  685. minLength: 1
  686. type: string
  687. required:
  688. - value
  689. type: object
  690. maxItems: 16
  691. type: array
  692. conditions:
  693. default:
  694. - lastTransitionTime: "1970-01-01T00:00:00Z"
  695. message: Waiting for controller
  696. reason: NotReconciled
  697. status: "False"
  698. type: Scheduled
  699. description: "Conditions describe the current conditions of the Gateway.
  700. \n Implementations should prefer to express Gateway conditions using
  701. the `GatewayConditionType` and `GatewayConditionReason` constants
  702. so that operators and tools can converge on a common vocabulary
  703. to describe Gateway state. \n Known condition types are: \n * \"Scheduled\"
  704. * \"Ready\""
  705. items:
  706. description: "Condition contains details for one aspect of the current
  707. state of this API Resource. --- This struct is intended for direct
  708. use as an array at the field path .status.conditions. For example,
  709. type FooStatus struct{ // Represents the observations of a
  710. foo's current state. // Known .status.conditions.type are:
  711. \"Available\", \"Progressing\", and \"Degraded\" // +patchMergeKey=type
  712. \ // +patchStrategy=merge // +listType=map // +listMapKey=type
  713. \ Conditions []metav1.Condition `json:\"conditions,omitempty\"
  714. patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`
  715. \n // other fields }"
  716. properties:
  717. lastTransitionTime:
  718. description: lastTransitionTime is the last time the condition
  719. transitioned from one status to another. This should be when
  720. the underlying condition changed. If that is not known, then
  721. using the time when the API field changed is acceptable.
  722. format: date-time
  723. type: string
  724. message:
  725. description: message is a human readable message indicating
  726. details about the transition. This may be an empty string.
  727. maxLength: 32768
  728. type: string
  729. observedGeneration:
  730. description: observedGeneration represents the .metadata.generation
  731. that the condition was set based upon. For instance, if .metadata.generation
  732. is currently 12, but the .status.conditions[x].observedGeneration
  733. is 9, the condition is out of date with respect to the current
  734. state of the instance.
  735. format: int64
  736. minimum: 0
  737. type: integer
  738. reason:
  739. description: reason contains a programmatic identifier indicating
  740. the reason for the condition's last transition. Producers
  741. of specific condition types may define expected values and
  742. meanings for this field, and whether the values are considered
  743. a guaranteed API. The value should be a CamelCase string.
  744. This field may not be empty.
  745. maxLength: 1024
  746. minLength: 1
  747. pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
  748. type: string
  749. status:
  750. description: status of the condition, one of True, False, Unknown.
  751. enum:
  752. - "True"
  753. - "False"
  754. - Unknown
  755. type: string
  756. type:
  757. description: type of condition in CamelCase or in foo.example.com/CamelCase.
  758. --- Many .condition.type values are consistent across resources
  759. like Available, but because arbitrary conditions can be useful
  760. (see .node.status.conditions), the ability to deconflict is
  761. important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
  762. maxLength: 316
  763. pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
  764. type: string
  765. required:
  766. - lastTransitionTime
  767. - message
  768. - reason
  769. - status
  770. - type
  771. type: object
  772. maxItems: 8
  773. type: array
  774. x-kubernetes-list-map-keys:
  775. - type
  776. x-kubernetes-list-type: map
  777. listeners:
  778. description: Listeners provide status for each unique listener port
  779. defined in the Spec.
  780. items:
  781. description: ListenerStatus is the status associated with a Listener.
  782. properties:
  783. conditions:
  784. description: Conditions describe the current condition of this
  785. listener.
  786. items:
  787. description: "Condition contains details for one aspect of
  788. the current state of this API Resource. --- This struct
  789. is intended for direct use as an array at the field path
  790. .status.conditions. For example, type FooStatus struct{
  791. \ // Represents the observations of a foo's current state.
  792. \ // Known .status.conditions.type are: \"Available\",
  793. \"Progressing\", and \"Degraded\" // +patchMergeKey=type
  794. \ // +patchStrategy=merge // +listType=map //
  795. +listMapKey=type Conditions []metav1.Condition `json:\"conditions,omitempty\"
  796. patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`
  797. \n // other fields }"
  798. properties:
  799. lastTransitionTime:
  800. description: lastTransitionTime is the last time the condition
  801. transitioned from one status to another. This should
  802. be when the underlying condition changed. If that is
  803. not known, then using the time when the API field changed
  804. is acceptable.
  805. format: date-time
  806. type: string
  807. message:
  808. description: message is a human readable message indicating
  809. details about the transition. This may be an empty string.
  810. maxLength: 32768
  811. type: string
  812. observedGeneration:
  813. description: observedGeneration represents the .metadata.generation
  814. that the condition was set based upon. For instance,
  815. if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration
  816. is 9, the condition is out of date with respect to the
  817. current state of the instance.
  818. format: int64
  819. minimum: 0
  820. type: integer
  821. reason:
  822. description: reason contains a programmatic identifier
  823. indicating the reason for the condition's last transition.
  824. Producers of specific condition types may define expected
  825. values and meanings for this field, and whether the
  826. values are considered a guaranteed API. The value should
  827. be a CamelCase string. This field may not be empty.
  828. maxLength: 1024
  829. minLength: 1
  830. pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
  831. type: string
  832. status:
  833. description: status of the condition, one of True, False,
  834. Unknown.
  835. enum:
  836. - "True"
  837. - "False"
  838. - Unknown
  839. type: string
  840. type:
  841. description: type of condition in CamelCase or in foo.example.com/CamelCase.
  842. --- Many .condition.type values are consistent across
  843. resources like Available, but because arbitrary conditions
  844. can be useful (see .node.status.conditions), the ability
  845. to deconflict is important. The regex it matches is
  846. (dns1123SubdomainFmt/)?(qualifiedNameFmt)
  847. maxLength: 316
  848. pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
  849. type: string
  850. required:
  851. - lastTransitionTime
  852. - message
  853. - reason
  854. - status
  855. - type
  856. type: object
  857. maxItems: 8
  858. type: array
  859. x-kubernetes-list-map-keys:
  860. - type
  861. x-kubernetes-list-type: map
  862. hostname:
  863. description: Hostname is the Listener hostname value for which
  864. this message is reporting the status.
  865. maxLength: 253
  866. minLength: 1
  867. type: string
  868. port:
  869. description: Port is the unique Listener port value for which
  870. this message is reporting the status.
  871. format: int32
  872. maximum: 65535
  873. minimum: 1
  874. type: integer
  875. protocol:
  876. description: Protocol is the Listener protocol value for which
  877. this message is reporting the status.
  878. type: string
  879. required:
  880. - conditions
  881. - port
  882. - protocol
  883. type: object
  884. maxItems: 64
  885. type: array
  886. x-kubernetes-list-map-keys:
  887. - port
  888. x-kubernetes-list-type: map
  889. type: object
  890. type: object
  891. served: true
  892. storage: true
  893. subresources:
  894. status: {}
  895. status:
  896. acceptedNames:
  897. kind: ""
  898. plural: ""
  899. conditions: []
  900. storedVersions: []
  901. ---
  902. apiVersion: apiextensions.k8s.io/v1
  903. kind: CustomResourceDefinition
  904. metadata:
  905. annotations:
  906. controller-gen.kubebuilder.io/version: v0.5.0
  907. creationTimestamp: null
  908. name: httproutes.networking.x-k8s.io
  909. spec:
  910. group: networking.x-k8s.io
  911. names:
  912. categories:
  913. - gateway-api
  914. kind: HTTPRoute
  915. listKind: HTTPRouteList
  916. plural: httproutes
  917. singular: httproute
  918. scope: Namespaced
  919. versions:
  920. - additionalPrinterColumns:
  921. - jsonPath: .spec.hostnames
  922. name: Hostnames
  923. type: string
  924. - jsonPath: .metadata.creationTimestamp
  925. name: Age
  926. type: date
  927. name: v1alpha1
  928. schema:
  929. openAPIV3Schema:
  930. description: HTTPRoute is the Schema for the HTTPRoute resource.
  931. properties:
  932. apiVersion:
  933. description: 'APIVersion defines the versioned schema of this representation
  934. of an object. Servers should convert recognized schemas to the latest
  935. internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
  936. type: string
  937. kind:
  938. description: 'Kind is a string value representing the REST resource this
  939. object represents. Servers may infer this from the endpoint the client
  940. submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
  941. type: string
  942. metadata:
  943. type: object
  944. spec:
  945. description: Spec defines the desired state of HTTPRoute.
  946. properties:
  947. gateways:
  948. default:
  949. allow: SameNamespace
  950. description: Gateways defines which Gateways can use this Route.
  951. properties:
  952. allow:
  953. default: SameNamespace
  954. description: 'Allow indicates which Gateways will be allowed to
  955. use this route. Possible values are: * All: Gateways in any
  956. namespace can use this route. * FromList: Only Gateways specified
  957. in GatewayRefs may use this route. * SameNamespace: Only Gateways
  958. in the same namespace may use this route.'
  959. enum:
  960. - All
  961. - FromList
  962. - SameNamespace
  963. type: string
  964. gatewayRefs:
  965. description: GatewayRefs must be specified when Allow is set to
  966. "FromList". In that case, only Gateways referenced in this list
  967. will be allowed to use this route. This field is ignored for
  968. other values of "Allow".
  969. items:
  970. description: GatewayReference identifies a Gateway in a specified
  971. namespace.
  972. properties:
  973. name:
  974. description: Name is the name of the referent.
  975. maxLength: 253
  976. minLength: 1
  977. type: string
  978. namespace:
  979. description: Namespace is the namespace of the referent.
  980. maxLength: 253
  981. minLength: 1
  982. type: string
  983. required:
  984. - name
  985. - namespace
  986. type: object
  987. type: array
  988. type: object
  989. hostnames:
  990. description: "Hostnames defines a set of hostname that should match
  991. against the HTTP Host header to select a HTTPRoute to process the
  992. request. Hostname is the fully qualified domain name of a network
  993. host, as defined by RFC 3986. Note the following deviations from
  994. the \"host\" part of the URI as defined in the RFC: \n 1. IPs are
  995. not allowed. 2. The `:` delimiter is not respected because ports
  996. are not allowed. \n Incoming requests are matched against the hostnames
  997. before the HTTPRoute rules. If no hostname is specified, traffic
  998. is routed based on the HTTPRouteRules. \n Hostname can be \"precise\"
  999. which is a domain name without the terminating dot of a network
  1000. host (e.g. \"foo.example.com\") or \"wildcard\", which is a domain
  1001. name prefixed with a single wildcard label (e.g. `*.example.com`).
  1002. The wildcard character `*` must appear by itself as the first DNS
  1003. label and matches only a single label. You cannot have a wildcard
  1004. label by itself (e.g. Host == `*`). Requests will be matched against
  1005. the Host field in the following order: \n 1. If Host is precise,
  1006. the request matches this rule if the HTTP Host header is equal
  1007. to Host. 2. If Host is a wildcard, then the request matches this
  1008. rule if the HTTP Host header is to equal to the suffix (removing
  1009. the first label) of the wildcard rule. \n Support: Core"
  1010. items:
  1011. description: Hostname is used to specify a hostname that should
  1012. be matched.
  1013. maxLength: 253
  1014. minLength: 1
  1015. type: string
  1016. maxItems: 16
  1017. type: array
  1018. rules:
  1019. default:
  1020. - matches:
  1021. - path:
  1022. type: Prefix
  1023. value: /
  1024. description: Rules are a list of HTTP matchers, filters and actions.
  1025. items:
  1026. description: HTTPRouteRule defines semantics for matching an HTTP
  1027. request based on conditions, optionally executing additional processing
  1028. steps, and forwarding the request to an API object.
  1029. properties:
  1030. filters:
  1031. description: "Filters define the filters that are applied to
  1032. requests that match this rule. \n The effects of ordering
  1033. of multiple behaviors are currently unspecified. This can
  1034. change in the future based on feedback during the alpha stage.
  1035. \n Conformance-levels at this level are defined based on the
  1036. type of filter: \n - ALL core filters MUST be supported by
  1037. all implementations. - Implementers are encouraged to support
  1038. extended filters. - Implementation-specific custom filters
  1039. have no API guarantees across implementations. \n Specifying
  1040. a core filter multiple times has unspecified or custom conformance.
  1041. \n Support: Core"
  1042. items:
  1043. description: 'HTTPRouteFilter defines additional processing
  1044. steps that must be completed during the request or response
  1045. lifecycle. HTTPRouteFilters are meant as an extension point
  1046. to express additional processing that may be done in Gateway
  1047. implementations. Some examples include request or response
  1048. modification, implementing authentication strategies, rate-limiting,
  1049. and traffic shaping. API guarantee/conformance is defined
  1050. based on the type of the filter. TODO(hbagdi): re-render
  1051. CRDs once controller-tools supports union tags: - https://github.com/kubernetes-sigs/controller-tools/pull/298
  1052. - https://github.com/kubernetes-sigs/controller-tools/issues/461'
  1053. properties:
  1054. extensionRef:
  1055. description: "ExtensionRef is an optional, implementation-specific
  1056. extension to the \"filter\" behavior. For example,
  1057. resource \"myroutefilter\" in group \"networking.acme.io\").
  1058. ExtensionRef MUST NOT be used for core and extended
  1059. filters. \n Support: Implementation-specific"
  1060. properties:
  1061. group:
  1062. description: Group is the group of the referent.
  1063. maxLength: 253
  1064. minLength: 1
  1065. type: string
  1066. kind:
  1067. description: Kind is kind of the referent.
  1068. maxLength: 253
  1069. minLength: 1
  1070. type: string
  1071. name:
  1072. description: Name is the name of the referent.
  1073. maxLength: 253
  1074. minLength: 1
  1075. type: string
  1076. required:
  1077. - group
  1078. - kind
  1079. - name
  1080. type: object
  1081. requestHeaderModifier:
  1082. description: "RequestHeaderModifier defines a schema for
  1083. a filter that modifies request headers. \n Support:
  1084. Core"
  1085. properties:
  1086. add:
  1087. additionalProperties:
  1088. type: string
  1089. description: "Add adds the given header (name, value)
  1090. to the request before the action. It appends to
  1091. any existing values associated with the header name.
  1092. \n Input: GET /foo HTTP/1.1 my-header: foo \n
  1093. Config: add: {\"my-header\": \"bar\"} \n Output:
  1094. \ GET /foo HTTP/1.1 my-header: foo my-header:
  1095. bar \n Support: Extended"
  1096. type: object
  1097. remove:
  1098. description: "Remove the given header(s) from the
  1099. HTTP request before the action. The value of RemoveHeader
  1100. is a list of HTTP header names. Note that the header
  1101. names are case-insensitive [RFC-2616 4.2]. \n Input:
  1102. \ GET /foo HTTP/1.1 my-header1: foo my-header2:
  1103. bar my-header3: baz \n Config: remove: [\"my-header1\",
  1104. \"my-header3\"] \n Output: GET /foo HTTP/1.1 my-header2:
  1105. bar \n Support: Extended"
  1106. items:
  1107. type: string
  1108. maxItems: 16
  1109. type: array
  1110. set:
  1111. additionalProperties:
  1112. type: string
  1113. description: "Set overwrites the request with the
  1114. given header (name, value) before the action. \n
  1115. Input: GET /foo HTTP/1.1 my-header: foo \n Config:
  1116. \ set: {\"my-header\": \"bar\"} \n Output: GET
  1117. /foo HTTP/1.1 my-header: bar \n Support: Extended"
  1118. type: object
  1119. type: object
  1120. requestMirror:
  1121. description: "RequestMirror defines a schema for a filter
  1122. that mirrors requests. \n Support: Extended"
  1123. properties:
  1124. backendRef:
  1125. description: "BackendRef is a local object reference
  1126. to mirror matched requests to. If both BackendRef
  1127. and ServiceName are specified, ServiceName will
  1128. be given precedence. \n If the referent cannot be
  1129. found, the rule is not included in the route. The
  1130. controller should raise the \"ResolvedRefs\" condition
  1131. on the Gateway with the \"DegradedRoutes\" reason.
  1132. The gateway status for this route should be updated
  1133. with a condition that describes the error more specifically.
  1134. \n Support: Custom"
  1135. properties:
  1136. group:
  1137. description: Group is the group of the referent.
  1138. maxLength: 253
  1139. minLength: 1
  1140. type: string
  1141. kind:
  1142. description: Kind is kind of the referent.
  1143. maxLength: 253
  1144. minLength: 1
  1145. type: string
  1146. name:
  1147. description: Name is the name of the referent.
  1148. maxLength: 253
  1149. minLength: 1
  1150. type: string
  1151. required:
  1152. - group
  1153. - kind
  1154. - name
  1155. type: object
  1156. port:
  1157. description: "Port specifies the destination port
  1158. number to use for the backend referenced by the
  1159. ServiceName or BackendRef field. \n If unspecified,
  1160. the destination port in the request is used when
  1161. forwarding to a backendRef or serviceName."
  1162. format: int32
  1163. maximum: 65535
  1164. minimum: 1
  1165. type: integer
  1166. serviceName:
  1167. description: "ServiceName refers to the name of the
  1168. Service to mirror matched requests to. When specified,
  1169. this takes the place of BackendRef. If both BackendRef
  1170. and ServiceName are specified, ServiceName will
  1171. be given precedence. \n If the referent cannot be
  1172. found, the rule is not included in the route. The
  1173. controller should raise the \"ResolvedRefs\" condition
  1174. on the Gateway with the \"DegradedRoutes\" reason.
  1175. The gateway status for this route should be updated
  1176. with a condition that describes the error more specifically.
  1177. \n Support: Core"
  1178. maxLength: 253
  1179. type: string
  1180. type: object
  1181. type:
  1182. description: "Type identifies the type of filter to apply.
  1183. As with other API fields, types are classified into
  1184. three conformance levels: \n - Core: Filter types and
  1185. their corresponding configuration defined by \"Support:
  1186. Core\" in this package, e.g. \"RequestHeaderModifier\".
  1187. All implementations must support core filters. \n
  1188. - Extended: Filter types and their corresponding configuration
  1189. defined by \"Support: Extended\" in this package,
  1190. e.g. \"RequestMirror\". Implementers are encouraged
  1191. to support extended filters. \n - Custom: Filters that
  1192. are defined and supported by specific vendors. In
  1193. the future, filters showing convergence in behavior
  1194. across multiple implementations will be considered
  1195. for inclusion in extended or core conformance levels.
  1196. Filter-specific configuration for such filters is
  1197. specified using the ExtensionRef field. `Type` should
  1198. be set to \"ExtensionRef\" for custom filters. \n
  1199. Implementers are encouraged to define custom implementation
  1200. types to extend the core API with implementation-specific
  1201. behavior."
  1202. enum:
  1203. - RequestHeaderModifier
  1204. - RequestMirror
  1205. - ExtensionRef
  1206. type: string
  1207. required:
  1208. - type
  1209. type: object
  1210. maxItems: 16
  1211. type: array
  1212. forwardTo:
  1213. description: ForwardTo defines the backend(s) where matching
  1214. requests should be sent. If unspecified, the rule performs
  1215. no forwarding. If unspecified and no filters are specified
  1216. that would result in a response being sent, a 503 error code
  1217. is returned.
  1218. items:
  1219. description: HTTPRouteForwardTo defines how a HTTPRoute should
  1220. forward a request.
  1221. properties:
  1222. backendRef:
  1223. description: "BackendRef is a reference to a backend to
  1224. forward matched requests to. If both BackendRef and
  1225. ServiceName are specified, ServiceName will be given
  1226. precedence. \n If the referent cannot be found, the
  1227. route must be dropped from the Gateway. The controller
  1228. should raise the \"ResolvedRefs\" condition on the Gateway
  1229. with the \"DegradedRoutes\" reason. The gateway status
  1230. for this route should be updated with a condition that
  1231. describes the error more specifically. \n Support: Custom"
  1232. properties:
  1233. group:
  1234. description: Group is the group of the referent.
  1235. maxLength: 253
  1236. minLength: 1
  1237. type: string
  1238. kind:
  1239. description: Kind is kind of the referent.
  1240. maxLength: 253
  1241. minLength: 1
  1242. type: string
  1243. name:
  1244. description: Name is the name of the referent.
  1245. maxLength: 253
  1246. minLength: 1
  1247. type: string
  1248. required:
  1249. - group
  1250. - kind
  1251. - name
  1252. type: object
  1253. filters:
  1254. description: "Filters defined at this-level should be
  1255. executed if and only if the request is being forwarded
  1256. to the backend defined here. \n Support: Custom (For
  1257. broader support of filters, use the Filters field in
  1258. HTTPRouteRule.)"
  1259. items:
  1260. description: 'HTTPRouteFilter defines additional processing
  1261. steps that must be completed during the request or
  1262. response lifecycle. HTTPRouteFilters are meant as
  1263. an extension point to express additional processing
  1264. that may be done in Gateway implementations. Some
  1265. examples include request or response modification,
  1266. implementing authentication strategies, rate-limiting,
  1267. and traffic shaping. API guarantee/conformance is
  1268. defined based on the type of the filter. TODO(hbagdi):
  1269. re-render CRDs once controller-tools supports union
  1270. tags: - https://github.com/kubernetes-sigs/controller-tools/pull/298
  1271. - https://github.com/kubernetes-sigs/controller-tools/issues/461'
  1272. properties:
  1273. extensionRef:
  1274. description: "ExtensionRef is an optional, implementation-specific
  1275. extension to the \"filter\" behavior. For example,
  1276. resource \"myroutefilter\" in group \"networking.acme.io\").
  1277. ExtensionRef MUST NOT be used for core and extended
  1278. filters. \n Support: Implementation-specific"
  1279. properties:
  1280. group:
  1281. description: Group is the group of the referent.
  1282. maxLength: 253
  1283. minLength: 1
  1284. type: string
  1285. kind:
  1286. description: Kind is kind of the referent.
  1287. maxLength: 253
  1288. minLength: 1
  1289. type: string
  1290. name:
  1291. description: Name is the name of the referent.
  1292. maxLength: 253
  1293. minLength: 1
  1294. type: string
  1295. required:
  1296. - group
  1297. - kind
  1298. - name
  1299. type: object
  1300. requestHeaderModifier:
  1301. description: "RequestHeaderModifier defines a schema
  1302. for a filter that modifies request headers. \n
  1303. Support: Core"
  1304. properties:
  1305. add:
  1306. additionalProperties:
  1307. type: string
  1308. description: "Add adds the given header (name,
  1309. value) to the request before the action. It
  1310. appends to any existing values associated
  1311. with the header name. \n Input: GET /foo
  1312. HTTP/1.1 my-header: foo \n Config: add:
  1313. {\"my-header\": \"bar\"} \n Output: GET
  1314. /foo HTTP/1.1 my-header: foo my-header:
  1315. bar \n Support: Extended"
  1316. type: object
  1317. remove:
  1318. description: "Remove the given header(s) from
  1319. the HTTP request before the action. The value
  1320. of RemoveHeader is a list of HTTP header names.
  1321. Note that the header names are case-insensitive
  1322. [RFC-2616 4.2]. \n Input: GET /foo HTTP/1.1
  1323. \ my-header1: foo my-header2: bar my-header3:
  1324. baz \n Config: remove: [\"my-header1\",
  1325. \"my-header3\"] \n Output: GET /foo HTTP/1.1
  1326. \ my-header2: bar \n Support: Extended"
  1327. items:
  1328. type: string
  1329. maxItems: 16
  1330. type: array
  1331. set:
  1332. additionalProperties:
  1333. type: string
  1334. description: "Set overwrites the request with
  1335. the given header (name, value) before the
  1336. action. \n Input: GET /foo HTTP/1.1 my-header:
  1337. foo \n Config: set: {\"my-header\": \"bar\"}
  1338. \n Output: GET /foo HTTP/1.1 my-header:
  1339. bar \n Support: Extended"
  1340. type: object
  1341. type: object
  1342. requestMirror:
  1343. description: "RequestMirror defines a schema for
  1344. a filter that mirrors requests. \n Support: Extended"
  1345. properties:
  1346. backendRef:
  1347. description: "BackendRef is a local object reference
  1348. to mirror matched requests to. If both BackendRef
  1349. and ServiceName are specified, ServiceName
  1350. will be given precedence. \n If the referent
  1351. cannot be found, the rule is not included
  1352. in the route. The controller should raise
  1353. the \"ResolvedRefs\" condition on the Gateway
  1354. with the \"DegradedRoutes\" reason. The gateway
  1355. status for this route should be updated with
  1356. a condition that describes the error more
  1357. specifically. \n Support: Custom"
  1358. properties:
  1359. group:
  1360. description: Group is the group of the referent.
  1361. maxLength: 253
  1362. minLength: 1
  1363. type: string
  1364. kind:
  1365. description: Kind is kind of the referent.
  1366. maxLength: 253
  1367. minLength: 1
  1368. type: string
  1369. name:
  1370. description: Name is the name of the referent.
  1371. maxLength: 253
  1372. minLength: 1
  1373. type: string
  1374. required:
  1375. - group
  1376. - kind
  1377. - name
  1378. type: object
  1379. port:
  1380. description: "Port specifies the destination
  1381. port number to use for the backend referenced
  1382. by the ServiceName or BackendRef field. \n
  1383. If unspecified, the destination port in the
  1384. request is used when forwarding to a backendRef
  1385. or serviceName."
  1386. format: int32
  1387. maximum: 65535
  1388. minimum: 1
  1389. type: integer
  1390. serviceName:
  1391. description: "ServiceName refers to the name
  1392. of the Service to mirror matched requests
  1393. to. When specified, this takes the place of
  1394. BackendRef. If both BackendRef and ServiceName
  1395. are specified, ServiceName will be given precedence.
  1396. \n If the referent cannot be found, the rule
  1397. is not included in the route. The controller
  1398. should raise the \"ResolvedRefs\" condition
  1399. on the Gateway with the \"DegradedRoutes\"
  1400. reason. The gateway status for this route
  1401. should be updated with a condition that describes
  1402. the error more specifically. \n Support: Core"
  1403. maxLength: 253
  1404. type: string
  1405. type: object
  1406. type:
  1407. description: "Type identifies the type of filter
  1408. to apply. As with other API fields, types are
  1409. classified into three conformance levels: \n -
  1410. Core: Filter types and their corresponding configuration
  1411. defined by \"Support: Core\" in this package,
  1412. e.g. \"RequestHeaderModifier\". All implementations
  1413. must support core filters. \n - Extended: Filter
  1414. types and their corresponding configuration defined
  1415. by \"Support: Extended\" in this package, e.g.
  1416. \"RequestMirror\". Implementers are encouraged
  1417. to support extended filters. \n - Custom: Filters
  1418. that are defined and supported by specific vendors.
  1419. \ In the future, filters showing convergence
  1420. in behavior across multiple implementations
  1421. will be considered for inclusion in extended or
  1422. core conformance levels. Filter-specific configuration
  1423. for such filters is specified using the ExtensionRef
  1424. field. `Type` should be set to \"ExtensionRef\"
  1425. for custom filters. \n Implementers are encouraged
  1426. to define custom implementation types to extend
  1427. the core API with implementation-specific behavior."
  1428. enum:
  1429. - RequestHeaderModifier
  1430. - RequestMirror
  1431. - ExtensionRef
  1432. type: string
  1433. required:
  1434. - type
  1435. type: object
  1436. maxItems: 16
  1437. type: array
  1438. port:
  1439. description: "Port specifies the destination port number
  1440. to use for the backend referenced by the ServiceName
  1441. or BackendRef field. If unspecified, the destination
  1442. port in the request is used when forwarding to a backendRef
  1443. or serviceName. \n Support: Core"
  1444. format: int32
  1445. maximum: 65535
  1446. minimum: 1
  1447. type: integer
  1448. serviceName:
  1449. description: "ServiceName refers to the name of the Service
  1450. to forward matched requests to. When specified, this
  1451. takes the place of BackendRef. If both BackendRef and
  1452. ServiceName are specified, ServiceName will be given
  1453. precedence. \n If the referent cannot be found, the
  1454. route must be dropped from the Gateway. The controller
  1455. should raise the \"ResolvedRefs\" condition on the Gateway
  1456. with the \"DegradedRoutes\" reason. The gateway status
  1457. for this route should be updated with a condition that
  1458. describes the error more specifically. \n The protocol
  1459. to use should be specified with the AppProtocol field
  1460. on Service resources. This field was introduced in Kubernetes
  1461. 1.18. If using an earlier version of Kubernetes, a `networking.x-k8s.io/app-protocol`
  1462. annotation on the BackendPolicy resource may be used
  1463. to define the protocol. If the AppProtocol field is
  1464. available, this annotation should not be used. The AppProtocol
  1465. field, when populated, takes precedence over the annotation
  1466. in the BackendPolicy resource. For custom backends,
  1467. it is encouraged to add a semantically-equivalent field
  1468. in the Custom Resource Definition. \n Support: Core"
  1469. maxLength: 253
  1470. type: string
  1471. weight:
  1472. default: 1
  1473. description: "Weight specifies the proportion of HTTP
  1474. requests forwarded to the backend referenced by the
  1475. ServiceName or BackendRef field. This is computed as
  1476. weight/(sum of all weights in this ForwardTo list).
  1477. For non-zero values, there may be some epsilon from
  1478. the exact proportion defined here depending on the precision
  1479. an implementation supports. Weight is not a percentage
  1480. and the sum of weights does not need to equal 100. \n
  1481. If only one backend is specified and it has a weight
  1482. greater than 0, 100% of the traffic is forwarded to
  1483. that backend. If weight is set to 0, no traffic should
  1484. be forwarded for this entry. If unspecified, weight
  1485. defaults to 1. \n Support: Core"
  1486. format: int32
  1487. maximum: 1000000
  1488. minimum: 0
  1489. type: integer
  1490. type: object
  1491. maxItems: 16
  1492. type: array
  1493. matches:
  1494. default:
  1495. - path:
  1496. type: Prefix
  1497. value: /
  1498. description: "Matches define conditions used for matching the
  1499. rule against incoming HTTP requests. Each match is independent,
  1500. i.e. this rule will be matched if **any** one of the matches
  1501. is satisfied. \n For example, take the following matches configuration:
  1502. \n ``` matches: - path: value: \"/foo\" headers: values:
  1503. \ version: \"2\" - path: value: \"/v2/foo\" ``` \n
  1504. For a request to match against this rule, a request should
  1505. satisfy EITHER of the two conditions: \n - path prefixed with
  1506. `/foo` AND contains the header `version: \"2\"` - path prefix
  1507. of `/v2/foo` \n See the documentation for HTTPRouteMatch on
  1508. how to specify multiple match conditions that should be ANDed
  1509. together. \n If no matches are specified, the default is a
  1510. prefix path match on \"/\", which has the effect of matching
  1511. every HTTP request. \n Each client request MUST map to a maximum
  1512. of one route rule. If a request matches multiple rules, matching
  1513. precedence MUST be determined in order of the following criteria,
  1514. continuing on ties: \n * The longest matching hostname. *
  1515. The longest matching path. * The largest number of header
  1516. matches. \n If ties still exist across multiple Routes, matching
  1517. precedence MUST be determined in order of the following criteria,
  1518. continuing on ties: \n * The oldest Route based on creation
  1519. timestamp. For example, a Route with a creation timestamp
  1520. of \"2020-09-08 01:02:03\" is given precedence over a Route
  1521. with a creation timestamp of \"2020-09-08 01:02:04\". * The
  1522. Route appearing first in alphabetical order by \"<namespace>/<name>\".
  1523. For example, foo/bar is given precedence over foo/baz. \n
  1524. If ties still exist within the Route that has been given precedence,
  1525. matching precedence MUST be granted to the first matching
  1526. rule meeting the above criteria."
  1527. items:
  1528. description: "HTTPRouteMatch defines the predicate used to
  1529. match requests to a given action. Multiple match types are
  1530. ANDed together, i.e. the match will evaluate to true only
  1531. if all conditions are satisfied. \n For example, the match
  1532. below will match a HTTP request only if its path starts
  1533. with `/foo` AND it contains the `version: \"1\"` header:
  1534. \n ``` match: path: value: \"/foo\" headers: values:
  1535. \ version: \"1\" ```"
  1536. properties:
  1537. extensionRef:
  1538. description: "ExtensionRef is an optional, implementation-specific
  1539. extension to the \"match\" behavior. For example, resource
  1540. \"myroutematcher\" in group \"networking.acme.io\".
  1541. If the referent cannot be found, the rule is not included
  1542. in the route. The controller should raise the \"ResolvedRefs\"
  1543. condition on the Gateway with the \"DegradedRoutes\"
  1544. reason. The gateway status for this route should be
  1545. updated with a condition that describes the error more
  1546. specifically. \n Support: Custom"
  1547. properties:
  1548. group:
  1549. description: Group is the group of the referent.
  1550. maxLength: 253
  1551. minLength: 1
  1552. type: string
  1553. kind:
  1554. description: Kind is kind of the referent.
  1555. maxLength: 253
  1556. minLength: 1
  1557. type: string
  1558. name:
  1559. description: Name is the name of the referent.
  1560. maxLength: 253
  1561. minLength: 1
  1562. type: string
  1563. required:
  1564. - group
  1565. - kind
  1566. - name
  1567. type: object
  1568. headers:
  1569. description: Headers specifies a HTTP request header matcher.
  1570. properties:
  1571. type:
  1572. default: Exact
  1573. description: "Type specifies how to match against
  1574. the value of the header. \n Support: Core (Exact)
  1575. \n Support: Custom (RegularExpression, ImplementationSpecific)
  1576. \n Since RegularExpression PathType has custom conformance,
  1577. implementations can support POSIX, PCRE or any other
  1578. dialects of regular expressions. Please read the
  1579. implementation's documentation to determine the
  1580. supported dialect. \n HTTP Header name matching
  1581. MUST be case-insensitive (RFC 2616 - section 4.2)."
  1582. enum:
  1583. - Exact
  1584. - RegularExpression
  1585. - ImplementationSpecific
  1586. type: string
  1587. values:
  1588. additionalProperties:
  1589. type: string
  1590. description: "Values is a map of HTTP Headers to be
  1591. matched. It MUST contain at least one entry. \n
  1592. The HTTP header field name to match is the map key,
  1593. and the value of the HTTP header is the map value.
  1594. HTTP header field name matching MUST be case-insensitive.
  1595. \n Multiple match values are ANDed together, meaning,
  1596. a request must match all the specified headers to
  1597. select the route."
  1598. type: object
  1599. required:
  1600. - values
  1601. type: object
  1602. path:
  1603. default:
  1604. type: Prefix
  1605. value: /
  1606. description: Path specifies a HTTP request path matcher.
  1607. If this field is not specified, a default prefix match
  1608. on the "/" path is provided.
  1609. properties:
  1610. type:
  1611. default: Prefix
  1612. description: "Type specifies how to match against
  1613. the path Value. \n Support: Core (Exact, Prefix)
  1614. \n Support: Custom (RegularExpression, ImplementationSpecific)
  1615. \n Since RegularExpression PathType has custom conformance,
  1616. implementations can support POSIX, PCRE or any other
  1617. dialects of regular expressions. Please read the
  1618. implementation's documentation to determine the
  1619. supported dialect."
  1620. enum:
  1621. - Exact
  1622. - Prefix
  1623. - RegularExpression
  1624. - ImplementationSpecific
  1625. type: string
  1626. value:
  1627. default: /
  1628. description: Value of the HTTP path to match against.
  1629. type: string
  1630. type: object
  1631. queryParams:
  1632. description: QueryParams specifies a HTTP query parameter
  1633. matcher.
  1634. properties:
  1635. type:
  1636. default: Exact
  1637. description: "Type specifies how to match against
  1638. the value of the query parameter. \n Support: Extended
  1639. (Exact) \n Support: Custom (RegularExpression, ImplementationSpecific)
  1640. \n Since RegularExpression QueryParamMatchType has
  1641. custom conformance, implementations can support
  1642. POSIX, PCRE or any other dialects of regular expressions.
  1643. Please read the implementation's documentation to
  1644. determine the supported dialect."
  1645. enum:
  1646. - Exact
  1647. - RegularExpression
  1648. - ImplementationSpecific
  1649. type: string
  1650. values:
  1651. additionalProperties:
  1652. type: string
  1653. description: "Values is a map of HTTP query parameters
  1654. to be matched. It MUST contain at least one entry.
  1655. \n The query parameter name to match is the map
  1656. key, and the value of the query parameter is the
  1657. map value. \n Multiple match values are ANDed together,
  1658. meaning, a request must match all the specified
  1659. query parameters to select the route. \n HTTP query
  1660. parameter matching MUST be case-sensitive for both
  1661. keys and values. (See https://tools.ietf.org/html/rfc7230#section-2.7.3).
  1662. \n Note that the query parameter key MUST always
  1663. be an exact match by string comparison."
  1664. type: object
  1665. required:
  1666. - values
  1667. type: object
  1668. type: object
  1669. maxItems: 8
  1670. type: array
  1671. type: object
  1672. maxItems: 16
  1673. type: array
  1674. tls:
  1675. description: "TLS defines the TLS certificate to use for Hostnames
  1676. defined in this Route. This configuration only takes effect if the
  1677. AllowRouteOverride field is set to true in the associated Gateway
  1678. resource. \n Collisions can happen if multiple HTTPRoutes define
  1679. a TLS certificate for the same hostname. In such a case, conflict
  1680. resolution guiding principles apply, specifically, if hostnames
  1681. are same and two different certificates are specified then the certificate
  1682. in the oldest resource wins. \n Please note that HTTP Route-selection
  1683. takes place after the TLS Handshake (ClientHello). Due to this,
  1684. TLS certificate defined here will take precedence even if the request
  1685. has the potential to match multiple routes (in case multiple HTTPRoutes
  1686. share the same hostname). \n Support: Core"
  1687. properties:
  1688. certificateRef:
  1689. description: "CertificateRef is a reference to a Kubernetes object
  1690. that contains a TLS certificate and private key. This certificate
  1691. is used to establish a TLS handshake for requests that match
  1692. the hostname of the associated HTTPRoute. The referenced object
  1693. MUST reside in the same namespace as HTTPRoute. \n This field
  1694. is required when the TLS configuration mode of the associated
  1695. Gateway listener is set to \"Passthrough\". \n CertificateRef
  1696. can reference a standard Kubernetes resource, i.e. Secret, or
  1697. an implementation-specific custom resource. \n Support: Core
  1698. (Kubernetes Secrets) \n Support: Implementation-specific (Other
  1699. resource types)"
  1700. properties:
  1701. group:
  1702. description: Group is the group of the referent.
  1703. maxLength: 253
  1704. minLength: 1
  1705. type: string
  1706. kind:
  1707. description: Kind is kind of the referent.
  1708. maxLength: 253
  1709. minLength: 1
  1710. type: string
  1711. name:
  1712. description: Name is the name of the referent.
  1713. maxLength: 253
  1714. minLength: 1
  1715. type: string
  1716. required:
  1717. - group
  1718. - kind
  1719. - name
  1720. type: object
  1721. required:
  1722. - certificateRef
  1723. type: object
  1724. type: object
  1725. status:
  1726. description: Status defines the current state of HTTPRoute.
  1727. properties:
  1728. gateways:
  1729. description: "Gateways is a list of Gateways that are associated with
  1730. the route, and the status of the route with respect to each Gateway.
  1731. When a Gateway selects this route, the controller that manages the
  1732. Gateway must add an entry to this list when the controller first
  1733. sees the route and should update the entry as appropriate when the
  1734. route is modified. \n A maximum of 100 Gateways will be represented
  1735. in this list. If this list is full, there may be additional Gateways
  1736. using this Route that are not included in the list. An empty list
  1737. means the route has not been admitted by any Gateway."
  1738. items:
  1739. description: RouteGatewayStatus describes the status of a route
  1740. with respect to an associated Gateway.
  1741. properties:
  1742. conditions:
  1743. description: Conditions describes the status of the route with
  1744. respect to the Gateway. The "Admitted" condition must always
  1745. be specified by controllers to indicate whether the route
  1746. has been admitted or rejected by the Gateway, and why. Note
  1747. that the route's availability is also subject to the Gateway's
  1748. own status conditions and listener status.
  1749. items:
  1750. description: "Condition contains details for one aspect of
  1751. the current state of this API Resource. --- This struct
  1752. is intended for direct use as an array at the field path
  1753. .status.conditions. For example, type FooStatus struct{
  1754. \ // Represents the observations of a foo's current state.
  1755. \ // Known .status.conditions.type are: \"Available\",
  1756. \"Progressing\", and \"Degraded\" // +patchMergeKey=type
  1757. \ // +patchStrategy=merge // +listType=map //
  1758. +listMapKey=type Conditions []metav1.Condition `json:\"conditions,omitempty\"
  1759. patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`
  1760. \n // other fields }"
  1761. properties:
  1762. lastTransitionTime:
  1763. description: lastTransitionTime is the last time the condition
  1764. transitioned from one status to another. This should
  1765. be when the underlying condition changed. If that is
  1766. not known, then using the time when the API field changed
  1767. is acceptable.
  1768. format: date-time
  1769. type: string
  1770. message:
  1771. description: message is a human readable message indicating
  1772. details about the transition. This may be an empty string.
  1773. maxLength: 32768
  1774. type: string
  1775. observedGeneration:
  1776. description: observedGeneration represents the .metadata.generation
  1777. that the condition was set based upon. For instance,
  1778. if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration
  1779. is 9, the condition is out of date with respect to the
  1780. current state of the instance.
  1781. format: int64
  1782. minimum: 0
  1783. type: integer
  1784. reason:
  1785. description: reason contains a programmatic identifier
  1786. indicating the reason for the condition's last transition.
  1787. Producers of specific condition types may define expected
  1788. values and meanings for this field, and whether the
  1789. values are considered a guaranteed API. The value should
  1790. be a CamelCase string. This field may not be empty.
  1791. maxLength: 1024
  1792. minLength: 1
  1793. pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
  1794. type: string
  1795. status:
  1796. description: status of the condition, one of True, False,
  1797. Unknown.
  1798. enum:
  1799. - "True"
  1800. - "False"
  1801. - Unknown
  1802. type: string
  1803. type:
  1804. description: type of condition in CamelCase or in foo.example.com/CamelCase.
  1805. --- Many .condition.type values are consistent across
  1806. resources like Available, but because arbitrary conditions
  1807. can be useful (see .node.status.conditions), the ability
  1808. to deconflict is important. The regex it matches is
  1809. (dns1123SubdomainFmt/)?(qualifiedNameFmt)
  1810. maxLength: 316
  1811. pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
  1812. type: string
  1813. required:
  1814. - lastTransitionTime
  1815. - message
  1816. - reason
  1817. - status
  1818. - type
  1819. type: object
  1820. maxItems: 8
  1821. type: array
  1822. x-kubernetes-list-map-keys:
  1823. - type
  1824. x-kubernetes-list-type: map
  1825. gatewayRef:
  1826. description: GatewayRef is a reference to a Gateway object that
  1827. is associated with the route.
  1828. properties:
  1829. controller:
  1830. description: "Controller is a domain/path string that indicates
  1831. the controller implementing the Gateway. This corresponds
  1832. with the controller field on GatewayClass. \n Example:
  1833. \"acme.io/gateway-controller\". \n The format of this
  1834. field is DOMAIN \"/\" PATH, where DOMAIN and PATH are
  1835. valid Kubernetes names (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names)."
  1836. maxLength: 253
  1837. type: string
  1838. name:
  1839. description: Name is the name of the referent.
  1840. maxLength: 253
  1841. minLength: 1
  1842. type: string
  1843. namespace:
  1844. description: Namespace is the namespace of the referent.
  1845. maxLength: 253
  1846. minLength: 1
  1847. type: string
  1848. required:
  1849. - name
  1850. - namespace
  1851. type: object
  1852. required:
  1853. - gatewayRef
  1854. type: object
  1855. maxItems: 100
  1856. type: array
  1857. required:
  1858. - gateways
  1859. type: object
  1860. type: object
  1861. served: true
  1862. storage: true
  1863. subresources:
  1864. status: {}
  1865. status:
  1866. acceptedNames:
  1867. kind: ""
  1868. plural: ""
  1869. conditions: []
  1870. storedVersions: []

RBAC

  1. ---
  2. apiVersion: rbac.authorization.k8s.io/v1
  3. kind: ClusterRole
  4. metadata:
  5. name: gateway-role
  6. rules:
  7. - apiGroups:
  8. - ""
  9. resources:
  10. - services
  11. - endpoints
  12. - secrets
  13. verbs:
  14. - get
  15. - list
  16. - watch
  17. - apiGroups:
  18. - networking.x-k8s.io
  19. resources:
  20. - gatewayclasses
  21. - gateways
  22. - httproutes
  23. - tcproutes
  24. - tlsroutes
  25. verbs:
  26. - get
  27. - list
  28. - watch
  29. - apiGroups:
  30. - networking.x-k8s.io
  31. resources:
  32. - gatewayclasses/status
  33. - gateways/status
  34. - httproutes/status
  35. - tcproutes/status
  36. - tlsroutes/status
  37. verbs:
  38. - update
  39. ---
  40. kind: ClusterRoleBinding
  41. apiVersion: rbac.authorization.k8s.io/v1beta1
  42. metadata:
  43. name: gateway-controller
  44. roleRef:
  45. apiGroup: rbac.authorization.k8s.io
  46. kind: ClusterRole
  47. name: gateway-role
  48. subjects:
  49. - kind: ServiceAccount
  50. name: traefik-controller
  51. namespace: default

The Kubernetes Gateway API project provides several guides on how to use the APIs. These guides can help you to go further than the example above. The getting started guide details how to install the CRDs from their repository.

Keep in mind that the Traefik Gateway provider only supports the v0.3.0 (v1alpha1).

For now, the Traefik Gateway Provider can be used while following the below guides:

Resource Configuration

When using Kubernetes Gateway API as a provider, Traefik uses Kubernetes Custom Resource Definitions to retrieve its routing configuration.

All concepts can be found in the official API concepts documentation. Traefik implements the following resources:

  • GatewayClass defines a set of Gateways that share a common configuration and behaviour.
  • Gateway describes how traffic can be translated to Services within the cluster.
  • HTTPRoute defines HTTP rules for mapping requests from a Gateway to Kubernetes Services.
  • TCPRoute defines TCP rules for mapping requests from a Gateway to Kubernetes Services.
  • TLSRoute defines TLS rules for mapping requests from a Gateway to Kubernetes Services.

Provider Configuration

endpoint

Optional, Default=””

The Kubernetes server endpoint URL.

When deployed into Kubernetes, Traefik reads the environment variables KUBERNETES_SERVICE_HOST and KUBERNETES_SERVICE_PORT or KUBECONFIG to construct the endpoint.

The access token is looked up in /var/run/secrets/kubernetes.io/serviceaccount/token and the SSL CA certificate in /var/run/secrets/kubernetes.io/serviceaccount/ca.crt. Both are mounted automatically when deployed inside Kubernetes.

The endpoint may be specified to override the environment variable values inside a cluster.

When the environment variables are not found, Traefik tries to connect to the Kubernetes API server with an external-cluster client. In this case, the endpoint is required. Specifically, it may be set to the URL used by kubectl proxy to connect to a Kubernetes cluster using the granted authentication and authorization of the associated kubeconfig.

File (YAML)

  1. providers:
  2. kubernetesGateway:
  3. endpoint: "http://localhost:8080"
  4. # ...

File (TOML)

  1. [providers.kubernetesGateway]
  2. endpoint = "http://localhost:8080"
  3. # ...

CLI

  1. --providers.kubernetesgateway.endpoint=http://localhost:8080

token

Optional, Default=””

Bearer token used for the Kubernetes client configuration.

File (YAML)

  1. providers:
  2. kubernetesGateway:
  3. token: "mytoken"
  4. # ...

File (TOML)

  1. [providers.kubernetesGateway]
  2. token = "mytoken"
  3. # ...

CLI

  1. --providers.kubernetesgateway.token=mytoken

certAuthFilePath

Optional, Default=””

Path to the certificate authority file. Used for the Kubernetes client configuration.

File (YAML)

  1. providers:
  2. kubernetesGateway:
  3. certAuthFilePath: "/my/ca.crt"
  4. # ...

File (TOML)

  1. [providers.kubernetesGateway]
  2. certAuthFilePath = "/my/ca.crt"
  3. # ...

CLI

  1. --providers.kubernetesgateway.certauthfilepath=/my/ca.crt

namespaces

Optional, Default: []

Array of namespaces to watch. If left empty, watches all namespaces if the value of namespaces.

File (YAML)

  1. providers:
  2. kubernetesGateway:
  3. namespaces:
  4. - "default"
  5. - "production"
  6. # ...

File (TOML)

  1. [providers.kubernetesGateway]
  2. namespaces = ["default", "production"]
  3. # ...

CLI

  1. --providers.kubernetesgateway.namespaces=default,production

labelselector

Optional, Default: “”

A label selector can be defined to filter on specific GatewayClass objects only. If left empty, Traefik processes all GatewayClass objects in the configured namespaces.

See label-selectors for details.

File (YAML)

  1. providers:
  2. kubernetesGateway:
  3. labelselector: "app=traefik"
  4. # ...

File (TOML)

  1. [providers.kubernetesGateway]
  2. labelselector = "app=traefik"
  3. # ...

CLI

  1. --providers.kubernetesgateway.labelselector="app=traefik"

throttleDuration

Optional, Default: 0

The throttleDuration option defines how often the provider is allowed to handle events from Kubernetes. This prevents a Kubernetes cluster that updates many times per second from continuously changing your Traefik configuration.

If left empty, the provider does not apply any throttling and does not drop any Kubernetes events.

The value of throttleDuration should be provided in seconds or as a valid duration format, see time.ParseDuration.

File (YAML)

  1. providers:
  2. kubernetesGateway:
  3. throttleDuration: "10s"
  4. # ...

File (TOML)

  1. [providers.kubernetesGateway]
  2. throttleDuration = "10s"
  3. # ...

CLI

  1. --providers.kubernetesgateway.throttleDuration=10s