apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.17.2 name: apisixconsumers.apisix.apache.org spec: group: apisix.apache.org names: kind: ApisixConsumer listKind: ApisixConsumerList plural: apisixconsumers shortNames: - ac singular: apisixconsumer scope: Namespaced versions: - name: v2 schema: openAPIV3Schema: description: ApisixConsumer defines configuration of a consumer and their authentication details. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: ApisixConsumerSpec defines the consumer authentication configuration. properties: authParameter: description: AuthParameter defines the authentication credentials and configuration for this consumer. properties: basicAuth: description: BasicAuth configures the basic authentication details. properties: secretRef: description: SecretRef references a Kubernetes Secret containing the basic authentication credentials. properties: name: default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string type: object x-kubernetes-map-type: atomic value: description: Value specifies the basic authentication credentials. properties: password: description: Password is the basic authentication password. type: string username: description: Username is the basic authentication username. type: string required: - password - username type: object type: object hmacAuth: description: HMACAuth configures the HMAC authentication details. properties: secretRef: description: |- SecretRef references a Kubernetes Secret containing the HMAC credentials. Unlike Value, the Secret stores signed_headers as a single string listing the header names separated by commas or whitespace, for example "X-Date, Host". properties: name: default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string type: object x-kubernetes-map-type: atomic value: description: Value specifies HMAC authentication credentials. oneOf: - required: - key_id - secret_key - required: - access_key - secret_key properties: access_key: description: AccessKey is the identifier used to look up the HMAC secret. Deprecated from consumer configuration type: string algorithm: description: Algorithm specifies the hashing algorithm (e.g., "hmac-sha256"). Deprecated from consumer configuration type: string clock_skew: description: ClockSkew is the allowed time difference (in seconds) between client and server clocks. Deprecated from consumer configuration format: int64 type: integer encode_uri_params: description: EncodeURIParams indicates whether URI parameters are encoded when calculating the signature. Deprecated from consumer configuration type: boolean keep_headers: description: KeepHeaders determines whether the HMAC signature headers are preserved after verification. Deprecated from consumer configuration type: boolean key_id: description: KeyID is the identifier used to look up the HMAC secret. type: string max_req_body: description: MaxReqBody sets the maximum size (in bytes) of the request body that can be validated. Deprecated from consumer configuration format: int64 type: integer secret_key: description: SecretKey is the HMAC secret used to sign the request. type: string signed_headers: description: SignedHeaders lists the headers that must be included in the signature. Deprecated from consumer configuration items: type: string type: array validate_request_body: description: ValidateRequestBody enables HMAC validation of the request body. Deprecated from consumer configuration type: boolean required: - secret_key type: object type: object jwtAuth: description: JwtAuth configures the JWT authentication details. properties: secretRef: description: SecretRef references a Kubernetes Secret containing JWT authentication credentials. properties: name: default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string type: object x-kubernetes-map-type: atomic value: description: Value specifies JWT authentication credentials. properties: algorithm: description: |- Algorithm specifies the signing algorithm. Can be `HS256`, `HS384`, `HS512`, `RS256`, `RS384`, `RS512`, `ES256`, `ES384`, `ES512`, `PS256`, `PS384`, `PS512`, or `EdDSA`. type: string base64_secret: description: Base64Secret indicates whether the secret is base64-encoded. type: boolean exp: description: Exp is the token expiration period in seconds. format: int64 type: integer key: description: Key is the unique identifier for the JWT credential. type: string lifetime_grace_period: description: LifetimeGracePeriod is the allowed clock skew in seconds for token expiration. format: int64 type: integer private_key: description: PrivateKey is the private key used to sign the JWT (for asymmetric algorithms). type: string public_key: description: PublicKey is the public key used to verify JWT signatures (for asymmetric algorithms). type: string secret: description: Secret is the shared secret used to sign the JWT (for symmetric algorithms). type: string required: - key type: object x-kubernetes-validations: - message: algorithms other than HS256/HS384/HS512 require at least one non-empty public_key or private_key rule: '!has(self.algorithm) || size(self.algorithm) == 0 || self.algorithm in [''HS256'',''HS384'',''HS512''] || (has(self.public_key) && size(self.public_key.trim()) > 0) || (has(self.private_key) && size(self.private_key.trim()) > 0)' type: object keyAuth: description: KeyAuth configures the key authentication details. properties: secretRef: description: SecretRef references a Kubernetes Secret containing the key authentication credentials. properties: name: default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string type: object x-kubernetes-map-type: atomic value: description: Value specifies the key authentication credentials. properties: key: description: Key is the credential used for key authentication. type: string required: - key type: object type: object ldapAuth: description: LDAPAuth configures the LDAP authentication details. properties: secretRef: description: SecretRef references a Kubernetes Secret containing the LDAP credentials. properties: name: default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string type: object x-kubernetes-map-type: atomic value: description: Value specifies LDAP authentication credentials. properties: user_dn: description: UserDN is the distinguished name (DN) of the LDAP user. type: string required: - user_dn type: object required: - secretRef type: object wolfRBAC: description: WolfRBAC configures the Wolf RBAC authentication details. properties: secretRef: description: SecretRef references a Kubernetes Secret containing the Wolf RBAC token. properties: name: default: "" description: |- Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names type: string type: object x-kubernetes-map-type: atomic value: description: Value specifies the Wolf RBAC token. properties: appid: description: Appid is the application identifier used when communicating with the Wolf RBAC server. type: string header_prefix: description: HeaderPrefix is the prefix added to request headers for RBAC enforcement. type: string server: description: Server is the URL of the Wolf RBAC server. type: string type: object type: object type: object ingressClassName: description: |- IngressClassName is the name of an IngressClass cluster resource. The controller uses this field to decide whether the resource should be managed. type: string plugins: description: |- Plugins lists additional consumer-scoped plugins to attach to this consumer. These plugins are applied alongside any authentication plugin derived from AuthParameter. An enabled plugin with the same name as the auth plugin derived from AuthParameter takes precedence. items: description: ApisixRoutePlugin represents an APISIX plugin. properties: config: description: Plugin configuration. x-kubernetes-preserve-unknown-fields: true enable: default: true description: Whether this plugin is in use, default is true. type: boolean name: description: The plugin name. type: string secretRef: description: Plugin configuration secretRef. type: string required: - enable - name type: object type: array type: object status: description: ApisixStatus is the status report for Apisix ingress Resources properties: conditions: items: description: Condition contains details for one aspect of the current state of this API Resource. properties: lastTransitionTime: description: |- lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: |- message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: |- observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: |- reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object type: array type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.17.2 name: apisixglobalrules.apisix.apache.org spec: group: apisix.apache.org names: kind: ApisixGlobalRule listKind: ApisixGlobalRuleList plural: apisixglobalrules shortNames: - agr singular: apisixglobalrule scope: Namespaced versions: - name: v2 schema: openAPIV3Schema: description: ApisixGlobalRule defines configuration for global plugins. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: ApisixGlobalRuleSpec defines the global plugin configuration. properties: ingressClassName: description: |- IngressClassName is the name of an IngressClass cluster resource. The controller uses this field to decide whether the resource should be managed. type: string plugins: description: Plugins contain a list of global plugins. items: description: ApisixRoutePlugin represents an APISIX plugin. properties: config: description: Plugin configuration. x-kubernetes-preserve-unknown-fields: true enable: default: true description: Whether this plugin is in use, default is true. type: boolean name: description: The plugin name. type: string secretRef: description: Plugin configuration secretRef. type: string required: - enable - name type: object type: array required: - plugins type: object status: description: ApisixStatus is the status report for Apisix ingress Resources properties: conditions: items: description: Condition contains details for one aspect of the current state of this API Resource. properties: lastTransitionTime: description: |- lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: |- message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: |- observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: |- reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object type: array type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.17.2 name: apisixpluginconfigs.apisix.apache.org spec: group: apisix.apache.org names: kind: ApisixPluginConfig listKind: ApisixPluginConfigList plural: apisixpluginconfigs shortNames: - apc singular: apisixpluginconfig scope: Namespaced versions: - name: v2 schema: openAPIV3Schema: description: ApisixPluginConfig defines a reusable set of plugin configuration that can be referenced by routes. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: ApisixPluginConfigSpec defines the plugin config configuration. properties: ingressClassName: description: |- IngressClassName is the name of an IngressClass cluster resource. The controller uses this field to decide whether the resource should be managed. type: string plugins: description: Plugins contain a list of plugins. items: description: ApisixRoutePlugin represents an APISIX plugin. properties: config: description: Plugin configuration. x-kubernetes-preserve-unknown-fields: true enable: default: true description: Whether this plugin is in use, default is true. type: boolean name: description: The plugin name. type: string secretRef: description: Plugin configuration secretRef. type: string required: - enable - name type: object type: array required: - plugins type: object status: description: ApisixStatus is the status report for Apisix ingress Resources properties: conditions: items: description: Condition contains details for one aspect of the current state of this API Resource. properties: lastTransitionTime: description: |- lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: |- message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: |- observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: |- reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object type: array type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.17.2 name: apisixroutes.apisix.apache.org spec: group: apisix.apache.org names: kind: ApisixRoute listKind: ApisixRouteList plural: apisixroutes shortNames: - ar singular: apisixroute scope: Namespaced versions: - additionalPrinterColumns: - description: HTTP Hosts jsonPath: .spec.http[].match.hosts name: Hosts type: string - description: HTTP Paths jsonPath: .spec.http[].match.paths name: URIs type: string - description: Backend Service for HTTP jsonPath: .spec.http[].backends[].serviceName name: Target Service (HTTP) priority: 1 type: string - description: TCP Ingress Port jsonPath: .spec.tcp[].match.ingressPort name: Ingress Port (TCP) priority: 1 type: integer - description: Backend Service for TCP jsonPath: .spec.tcp[].match.backend.serviceName name: Target Service (TCP) priority: 1 type: string - description: Creation time jsonPath: .metadata.creationTimestamp name: Age type: date name: v2 schema: openAPIV3Schema: description: ApisixRoute defines configuration for HTTP and stream routes. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: ApisixRouteSpec defines HTTP and stream route configuration. properties: http: description: |- HTTP defines a list of HTTP route rules. Each rule specifies conditions to match HTTP requests and how to forward them. items: description: ApisixRouteHTTP represents a single HTTP route configuration. properties: authentication: description: Authentication holds authentication-related configuration for this route. properties: enable: description: Enable toggles authentication on or off. type: boolean jwtAuth: description: JwtAuth defines configuration for JWT authentication. properties: cookie: description: Cookie specifies the cookie name to look for the JWT token. type: string header: description: Header specifies the HTTP header name to look for the JWT token. type: string query: description: Query specifies the URL query parameter name to look for the JWT token. type: string type: object keyAuth: description: KeyAuth defines configuration for key authentication. properties: header: description: Header specifies the HTTP header name to look for the key authentication token. type: string type: object ldapAuth: description: LDAPAuth defines configuration for LDAP authentication. properties: base_dn: description: BaseDN is the base distinguished name (DN) for LDAP searches. type: string ldap_uri: description: LDAPURI is the URI of the LDAP server. type: string uid: description: UID is the user identifier attribute in LDAP. type: string use_tls: description: UseTLS indicates whether to use TLS for the LDAP connection. type: boolean type: object type: description: Type specifies the authentication type. type: string required: - enable - type type: object backends: description: |- Backends lists potential backend services to proxy requests to. If more than one backend is specified, the `traffic-split` plugin is used to distribute traffic according to backend weights. items: description: ApisixRouteHTTPBackend represents an HTTP backend (Kubernetes Service). properties: resolveGranularity: description: |- ResolveGranularity determines how the backend service is resolved. Valid values are `endpoints` and `service`. When set to `endpoints`, individual pod IPs will be used; otherwise, the Service's ClusterIP or ExternalIP is used. The default is `endpoints`. type: string serviceName: description: |- ServiceName is the name of the Kubernetes Service. Cross-namespace references are not supported—ensure the ApisixRoute and the Service are in the same namespace. type: string servicePort: anyOf: - type: integer - type: string description: |- ServicePort is the port of the Kubernetes Service. This can be either the port name or port number. x-kubernetes-int-or-string: true subset: description: |- Subset specifies a named subset of the target Service. The subset must be pre-defined in the corresponding ApisixUpstream resource. type: string weight: description: Weight specifies the relative traffic weight for this backend. type: integer required: - serviceName - servicePort type: object type: array match: description: Match defines the HTTP request matching criteria. properties: exprs: description: NginxVars defines match conditions based on Nginx variables. items: description: ApisixRouteHTTPMatchExpr represents a binary expression used to match requests based on Nginx variables. properties: op: description: |- Op specifies the operator used in the expression. Can be `Equal`, `NotEqual`, `GreaterThan`, `GreaterThanEqual`, `LessThan`, `LessThanEqual`, `RegexMatch`, `RegexNotMatch`, `RegexMatchCaseInsensitive`, `RegexNotMatchCaseInsensitive`, `In`, or `NotIn`. type: string set: description: |- Set provides a list of acceptable values for the expression. This should be used when Op is `In` or `NotIn`. items: type: string type: array subject: description: |- Subject defines the left-hand side of the expression. It can be any [APISIX variable](https://apisix.apache.org/docs/apisix/apisix-variable) or string literal. properties: name: description: |- Name is the name of the subject within the given scope: the header name, query parameter name, cookie name, Nginx variable name, or body field name (dot-notation JSON path supported for Body scope). Optional when Scope is Path. type: string scope: description: |- Scope specifies the subject scope. Supported values: `Header`, `Query`, `Path`, `Cookie`, `Variable`, `Body`. When Scope is `Path`, Name will be ignored. When Scope is `Body`, Name supports dot-notation JSON path (e.g., "model.version", "messages[*].role") and maps to APISIX's `post_arg.` variable, which works with application/json, application/x-www-form-urlencoded, and multipart/form-data. enum: - Header - Query - Path - Cookie - Variable - Body type: string required: - scope type: object x-kubernetes-validations: - message: name is required when scope is not Path rule: self.scope == 'Path' || size(self.name) > 0 value: description: |- Value defines a single value to compare against the subject. This should be used when Op is not `In` or `NotIn`. Set and Value are mutually exclusive—only one should be set at a time. type: string required: - op - subject type: object type: array filter_func: description: |- FilterFunc is a user-defined function for advanced request filtering. The function can use Nginx variables through the `vars` parameter. type: string hosts: description: |- Hosts specifies Host header values to match. Supports exact and wildcard domains. Only one level of wildcard is allowed (e.g., `*.example.com` is valid, but `*.*.example.com` is not). items: type: string type: array methods: description: Methods specifies the HTTP methods to match. items: type: string type: array paths: description: |- Paths is a list of URI path patterns to match. At least one path must be specified. Supports exact matches and prefix matches. For prefix matches, append `*` to the path, such as `/foo*`. items: type: string type: array remoteAddrs: description: |- RemoteAddrs is a list of source IP addresses or CIDR ranges to match. Supports both IPv4 and IPv6 formats. items: type: string type: array required: - paths type: object name: description: Name is the unique rule name and cannot be empty. type: string plugin_config_name: description: PluginConfigName specifies the name of the plugin config to apply. type: string plugin_config_namespace: description: |- PluginConfigNamespace specifies the namespace of the plugin config. Defaults to the namespace of the ApisixRoute if not set. type: string plugins: description: Plugins lists additional plugins applied to this route. items: description: ApisixRoutePlugin represents an APISIX plugin. properties: config: description: Plugin configuration. x-kubernetes-preserve-unknown-fields: true enable: default: true description: Whether this plugin is in use, default is true. type: boolean name: description: The plugin name. type: string secretRef: description: Plugin configuration secretRef. type: string required: - enable - name type: object type: array priority: description: |- Priority defines the route priority when multiple routes share the same URI path. Higher values mean higher priority in route matching. type: integer timeout: description: Timeout specifies upstream timeout settings. properties: connect: description: Connect timeout for establishing a connection to the upstream. type: string read: description: Read timeout for reading data from the upstream. type: string send: description: Send timeout for sending data to the upstream. type: string type: object upstreams: description: Upstreams references ApisixUpstream CRDs. items: description: |- ApisixRouteUpstreamReference references an ApisixUpstream CRD to be used as a backend. It can be used in traffic-splitting scenarios or to select a specific upstream configuration. properties: name: description: Name is the name of the ApisixUpstream resource. type: string weight: description: Weight is the weight assigned to this upstream. type: integer type: object type: array websocket: description: Websocket enables or disables websocket support for this route. type: boolean required: - name type: object type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map ingressClassName: description: |- IngressClassName is the name of the IngressClass this route belongs to. It allows multiple controllers to watch and reconcile different routes. type: string stream: description: |- Stream defines a list of stream route rules. Each rule specifies conditions to match TCP/UDP traffic and how to forward them. items: description: ApisixRouteStream defines the configuration for a Layer 4 (TCP/UDP) route. properties: backend: description: Backend specifies the destination service to which traffic should be forwarded. properties: resolveGranularity: default: endpoint description: |- ResolveGranularity determines how the backend service is resolved. Valid values are `endpoint` and `service`. When set to `endpoint`, individual pod IPs will be used; otherwise, the Service's ClusterIP or ExternalIP is used. The default is `endpoint`. enum: - endpoint - service type: string serviceName: description: |- ServiceName is the name of the Kubernetes Service. Cross-namespace references are not supported—ensure the ApisixRoute and the Service are in the same namespace. type: string servicePort: anyOf: - type: integer - type: string description: |- ServicePort is the port of the Kubernetes Service. This can be either the port name or port number. x-kubernetes-int-or-string: true subset: description: |- Subset specifies a named subset of the target Service. The subset must be pre-defined in the corresponding ApisixUpstream resource. type: string required: - serviceName - servicePort type: object match: description: Match defines the criteria used to match incoming TCP or UDP connections. properties: host: description: Host is the destination host address used to match the incoming TCP/UDP traffic. type: string ingressPort: description: |- IngressPort is the port on which the APISIX Ingress proxy server listens. This must be a statically configured port, as APISIX does not support dynamic port binding. format: int32 maximum: 65535 minimum: 0 type: integer required: - ingressPort type: object name: description: Name is a unique identifier for the route. This field must not be empty. type: string plugins: description: Plugins defines a list of plugins to apply to this route. items: description: ApisixRoutePlugin represents an APISIX plugin. properties: config: description: Plugin configuration. x-kubernetes-preserve-unknown-fields: true enable: default: true description: Whether this plugin is in use, default is true. type: boolean name: description: The plugin name. type: string secretRef: description: Plugin configuration secretRef. type: string required: - enable - name type: object type: array protocol: description: Protocol specifies the L4 protocol to match. Can be `TCP` or `UDP`. enum: - TCP - UDP type: string required: - backend - match - name - protocol type: object type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map type: object status: description: ApisixStatus is the status report for Apisix ingress Resources properties: conditions: items: description: Condition contains details for one aspect of the current state of this API Resource. properties: lastTransitionTime: description: |- lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: |- message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: |- observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: |- reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object type: array type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.17.2 name: apisixtlses.apisix.apache.org spec: group: apisix.apache.org names: kind: ApisixTls listKind: ApisixTlsList plural: apisixtlses shortNames: - atls singular: apisixtls scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .spec.hosts name: SNIs type: string - jsonPath: .spec.secret.name name: Secret Name type: string - jsonPath: .spec.secret.namespace name: Secret Namespace type: string - jsonPath: .metadata.creationTimestamp name: Age type: date - jsonPath: .spec.client.ca.name name: Client CA Secret Name type: string - jsonPath: .spec.client.ca.namespace name: Client CA Secret Namespace type: string name: v2 schema: openAPIV3Schema: description: ApisixTls defines configuration for TLS and mutual TLS (mTLS). properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: ApisixTlsSpec defines the TLS configuration. properties: client: description: Client defines mutual TLS (mTLS) settings, such as the CA certificate and verification depth. properties: caSecret: description: CASecret references the secret containing the CA certificate for client certificate validation. properties: name: description: Name is the name of the Kubernetes Secret. minLength: 1 type: string namespace: description: Namespace is the namespace where the Kubernetes Secret is located. minLength: 1 type: string required: - name - namespace type: object depth: description: Depth specifies the maximum verification depth for the client certificate chain. type: integer skip_mtls_uri_regex: description: SkipMTLSUriRegex contains RegEx patterns for URIs to skip mutual TLS verification. items: type: string type: array type: object hosts: description: |- Hosts lists the SNI (Server Name Indication) hostnames that this TLS configuration applies to. Must contain at least one host. items: pattern: ^\*?[0-9a-zA-Z-.]+$ type: string minItems: 1 type: array ingressClassName: description: |- IngressClassName specifies which IngressClass this resource is associated with. The APISIX controller only processes this resource if the class matches its own. type: string secret: description: |- Secret refers to the Kubernetes TLS secret containing the certificate and private key. This secret must exist in the specified namespace and contain valid TLS data. properties: name: description: Name is the name of the Kubernetes Secret. minLength: 1 type: string namespace: description: Namespace is the namespace where the Kubernetes Secret is located. minLength: 1 type: string required: - name - namespace type: object required: - hosts - secret type: object status: description: ApisixStatus is the status report for Apisix ingress Resources properties: conditions: items: description: Condition contains details for one aspect of the current state of this API Resource. properties: lastTransitionTime: description: |- lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: |- message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: |- observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: |- reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object type: array type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.17.2 name: apisixupstreams.apisix.apache.org spec: group: apisix.apache.org names: kind: ApisixUpstream listKind: ApisixUpstreamList plural: apisixupstreams shortNames: - au singular: apisixupstream scope: Namespaced versions: - name: v2 schema: openAPIV3Schema: description: ApisixUpstream defines configuration for upstream services. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: ApisixUpstreamSpec defines the upstream configuration. properties: discovery: description: Discovery configures service discovery for the upstream. properties: args: additionalProperties: type: string description: |- Args contains additional configuration parameters required by the discovery provider. These are passed as key-value pairs. type: object serviceName: description: ServiceName is the name of the service to discover. type: string type: description: Type is the name of the service discovery provider. type: string required: - serviceName - type type: object externalNodes: description: |- ExternalNodes defines a static list of backend nodes. These can be external hosts outside the cluster or cluster-internal Services specified by their DNS name. When this field is set, the upstream will route traffic directly to these nodes without DNS resolution or service discovery. items: description: |- ApisixUpstreamExternalNode defines configuration for an external upstream node. This allows referencing services outside the cluster. properties: name: description: Name is the hostname or IP address of the external node. type: string port: description: Port specifies the port number on which the external node is accepting traffic. maximum: 65535 minimum: 1 type: integer type: description: Type indicates the kind of external node. Can be `Domain`, or `Service`. type: string weight: description: |- Weight defines the load balancing weight of this node. Higher values increase the share of traffic sent to this node. type: integer type: object minItems: 1 type: array healthCheck: description: HealthCheck defines the active and passive health check configuration for the upstream. properties: active: description: Active health checks proactively send requests to upstream nodes to determine their availability. properties: concurrency: description: Concurrency sets the number of targets to be checked at the same time. minimum: 0 type: integer healthy: description: Healthy configures the rules that define an upstream node as healthy. properties: httpCodes: description: HTTPCodes define a list of HTTP status codes that are considered healthy. items: type: integer minItems: 1 type: array interval: description: Interval defines the time interval for checking targets, in seconds. type: string successes: description: Successes define the number of successful probes to define a healthy target. maximum: 254 minimum: 0 type: integer type: object host: description: Host sets the upstream host. type: string httpPath: description: HTTPPath sets the HTTP probe request path. type: string port: description: Port sets the upstream port. format: int32 maximum: 65535 minimum: 1 type: integer requestHeaders: description: RequestHeaders sets the request headers. items: type: string type: array strictTLS: description: StrictTLS sets whether to enforce TLS. type: boolean timeout: description: Timeout sets health check timeout in seconds. format: int64 type: integer type: default: http description: Type is the health check type. Can be `http`, `https`, or `tcp`. enum: - http - https - tcp type: string unhealthy: description: Unhealthy configures the rules that define an upstream node as unhealthy. properties: httpCodes: description: HTTPCodes define a list of HTTP status codes that are considered unhealthy. items: type: integer minItems: 1 type: array httpFailures: description: HTTPFailures define the number of HTTP failures to define an unhealthy target. maximum: 254 minimum: 0 type: integer interval: description: Interval defines the time interval for checking targets, in seconds. type: string tcpFailures: description: TCPFailures define the number of TCP failures to define an unhealthy target. maximum: 254 minimum: 0 type: integer timeout: description: Timeout sets the number of timeouts to define an unhealthy target. maximum: 254 minimum: 1 type: integer type: object type: object passive: description: Passive health checks evaluate upstream health based on observed traffic, such as timeouts or errors. properties: healthy: description: Healthy defines the conditions under which an upstream node is considered healthy. properties: httpCodes: description: HTTPCodes define a list of HTTP status codes that are considered healthy. items: type: integer minItems: 1 type: array successes: description: Successes define the number of successful probes to define a healthy target. maximum: 254 minimum: 0 type: integer type: object type: default: http description: |- Type specifies the type of passive health check. Can be `http`, `https`, or `tcp`. enum: - http - https - tcp type: string unhealthy: description: Unhealthy defines the conditions under which an upstream node is considered unhealthy. properties: httpCodes: description: HTTPCodes define a list of HTTP status codes that are considered unhealthy. items: type: integer minItems: 1 type: array httpFailures: description: HTTPFailures define the number of HTTP failures to define an unhealthy target. maximum: 254 minimum: 0 type: integer tcpFailures: description: TCPFailures define the number of TCP failures to define an unhealthy target. maximum: 254 minimum: 0 type: integer timeout: description: Timeout sets the number of timeouts to define an unhealthy target. maximum: 254 minimum: 1 type: integer type: object type: object required: - active type: object ingressClassName: description: |- IngressClassName is the name of an IngressClass cluster resource. Controller implementations use this field to determine whether they should process this ApisixUpstream resource. type: string loadbalancer: description: LoadBalancer specifies the load balancer configuration for Kubernetes Service. properties: hashOn: default: vars description: |- HashOn specified the type of field used for hashing, required when type is `chash`. Default is `vars`. Can be `vars`, `header`, `cookie`, `consumer`, or `vars_combinations`. enum: - vars - header - cookie - consumer - vars_combinations type: string key: description: |- Key is used with HashOn, generally required when type is `chash`. When HashOn is `header` or `cookie`, specifies the name of the header or cookie. When HashOn is `consumer`, key is not required, as the consumer name is used automatically. When HashOn is `vars` or `vars_combinations`, key refers to one or a combination of [APISIX variables](https://apisix.apache.org/docs/apisix/apisix-variable). type: string type: default: roundrobin description: |- Type specifies the load balancing algorithms to route traffic to the backend. Default is `roundrobin`. Can be `roundrobin`, `chash`, `ewma`, or `least_conn`. enum: - roundrobin - chash - ewma - least_conn type: string required: - type type: object passHost: description: |- PassHost configures how the host header should be determined when a request is forwarded to the upstream. Default is `pass`. Can be `pass`, `node` or `rewrite`: * `pass`: preserve the original Host header * `node`: use the upstream node’s host * `rewrite`: set to a custom host via upstreamHost enum: - pass - node - rewrite type: string portLevelSettings: description: |- PortLevelSettings allows fine-grained upstream configuration for specific ports, useful when a backend service exposes multiple ports with different behaviors or protocols. items: description: |- PortLevelSettings configures the ApisixUpstreamConfig for each individual port. It inherits configuration from the outer level (the whole Kubernetes Service) and overrides some of them if they are set on the port level. properties: discovery: description: Discovery configures service discovery for the upstream. properties: args: additionalProperties: type: string description: |- Args contains additional configuration parameters required by the discovery provider. These are passed as key-value pairs. type: object serviceName: description: ServiceName is the name of the service to discover. type: string type: description: Type is the name of the service discovery provider. type: string required: - serviceName - type type: object healthCheck: description: HealthCheck defines the active and passive health check configuration for the upstream. properties: active: description: Active health checks proactively send requests to upstream nodes to determine their availability. properties: concurrency: description: Concurrency sets the number of targets to be checked at the same time. minimum: 0 type: integer healthy: description: Healthy configures the rules that define an upstream node as healthy. properties: httpCodes: description: HTTPCodes define a list of HTTP status codes that are considered healthy. items: type: integer minItems: 1 type: array interval: description: Interval defines the time interval for checking targets, in seconds. type: string successes: description: Successes define the number of successful probes to define a healthy target. maximum: 254 minimum: 0 type: integer type: object host: description: Host sets the upstream host. type: string httpPath: description: HTTPPath sets the HTTP probe request path. type: string port: description: Port sets the upstream port. format: int32 maximum: 65535 minimum: 1 type: integer requestHeaders: description: RequestHeaders sets the request headers. items: type: string type: array strictTLS: description: StrictTLS sets whether to enforce TLS. type: boolean timeout: description: Timeout sets health check timeout in seconds. format: int64 type: integer type: default: http description: Type is the health check type. Can be `http`, `https`, or `tcp`. enum: - http - https - tcp type: string unhealthy: description: Unhealthy configures the rules that define an upstream node as unhealthy. properties: httpCodes: description: HTTPCodes define a list of HTTP status codes that are considered unhealthy. items: type: integer minItems: 1 type: array httpFailures: description: HTTPFailures define the number of HTTP failures to define an unhealthy target. maximum: 254 minimum: 0 type: integer interval: description: Interval defines the time interval for checking targets, in seconds. type: string tcpFailures: description: TCPFailures define the number of TCP failures to define an unhealthy target. maximum: 254 minimum: 0 type: integer timeout: description: Timeout sets the number of timeouts to define an unhealthy target. maximum: 254 minimum: 1 type: integer type: object type: object passive: description: Passive health checks evaluate upstream health based on observed traffic, such as timeouts or errors. properties: healthy: description: Healthy defines the conditions under which an upstream node is considered healthy. properties: httpCodes: description: HTTPCodes define a list of HTTP status codes that are considered healthy. items: type: integer minItems: 1 type: array successes: description: Successes define the number of successful probes to define a healthy target. maximum: 254 minimum: 0 type: integer type: object type: default: http description: |- Type specifies the type of passive health check. Can be `http`, `https`, or `tcp`. enum: - http - https - tcp type: string unhealthy: description: Unhealthy defines the conditions under which an upstream node is considered unhealthy. properties: httpCodes: description: HTTPCodes define a list of HTTP status codes that are considered unhealthy. items: type: integer minItems: 1 type: array httpFailures: description: HTTPFailures define the number of HTTP failures to define an unhealthy target. maximum: 254 minimum: 0 type: integer tcpFailures: description: TCPFailures define the number of TCP failures to define an unhealthy target. maximum: 254 minimum: 0 type: integer timeout: description: Timeout sets the number of timeouts to define an unhealthy target. maximum: 254 minimum: 1 type: integer type: object type: object required: - active type: object loadbalancer: description: LoadBalancer specifies the load balancer configuration for Kubernetes Service. properties: hashOn: default: vars description: |- HashOn specified the type of field used for hashing, required when type is `chash`. Default is `vars`. Can be `vars`, `header`, `cookie`, `consumer`, or `vars_combinations`. enum: - vars - header - cookie - consumer - vars_combinations type: string key: description: |- Key is used with HashOn, generally required when type is `chash`. When HashOn is `header` or `cookie`, specifies the name of the header or cookie. When HashOn is `consumer`, key is not required, as the consumer name is used automatically. When HashOn is `vars` or `vars_combinations`, key refers to one or a combination of [APISIX variables](https://apisix.apache.org/docs/apisix/apisix-variable). type: string type: default: roundrobin description: |- Type specifies the load balancing algorithms to route traffic to the backend. Default is `roundrobin`. Can be `roundrobin`, `chash`, `ewma`, or `least_conn`. enum: - roundrobin - chash - ewma - least_conn type: string required: - type type: object passHost: description: |- PassHost configures how the host header should be determined when a request is forwarded to the upstream. Default is `pass`. Can be `pass`, `node` or `rewrite`: * `pass`: preserve the original Host header * `node`: use the upstream node’s host * `rewrite`: set to a custom host via upstreamHost enum: - pass - node - rewrite type: string port: description: Port is a Kubernetes Service port. format: int32 maximum: 65535 minimum: 1 type: integer retries: description: |- Retries defines the number of retry attempts APISIX should make when a failure occurs. Failures include timeouts, network errors, or 5xx status codes. format: int64 type: integer scheme: description: |- Scheme is the protocol used to communicate with the upstream. Default is `http`. For L7 proxy, it can be `http`, `https`, `grpc`, or `grpcs`. For L4 proxy, it can be `tcp`, `tls`, or `udp`. The L4 values apply to stream routes only; using them for an HTTP route makes the upstream unreachable. enum: - http - https - grpc - grpcs - tcp - tls - udp type: string subsets: description: |- Subsets defines labeled subsets of service endpoints, typically used for service versioning or canary deployments. items: description: ApisixUpstreamSubset defines a single endpoints group of one Service. properties: labels: additionalProperties: type: string description: Labels is the label set of this subset. type: object name: description: Name is the name of subset. type: string required: - labels - name type: object type: array timeout: description: Timeout specifies the connection, send, and read timeouts for upstream requests. properties: connect: description: Connect timeout for establishing a connection to the upstream. type: string read: description: Read timeout for reading data from the upstream. type: string send: description: Send timeout for sending data to the upstream. type: string type: object tlsSecret: description: |- TLSSecret references a Kubernetes Secret that contains the client certificate and key for mutual TLS when connecting to the upstream. properties: name: description: Name is the name of the Kubernetes Secret. minLength: 1 type: string namespace: description: Namespace is the namespace where the Kubernetes Secret is located. minLength: 1 type: string required: - name - namespace type: object upstreamHost: description: UpstreamHost sets a custom Host header when passHost is set to `rewrite`. type: string required: - port type: object type: array retries: description: |- Retries defines the number of retry attempts APISIX should make when a failure occurs. Failures include timeouts, network errors, or 5xx status codes. format: int64 type: integer scheme: description: |- Scheme is the protocol used to communicate with the upstream. Default is `http`. For L7 proxy, it can be `http`, `https`, `grpc`, or `grpcs`. For L4 proxy, it can be `tcp`, `tls`, or `udp`. The L4 values apply to stream routes only; using them for an HTTP route makes the upstream unreachable. enum: - http - https - grpc - grpcs - tcp - tls - udp type: string subsets: description: |- Subsets defines labeled subsets of service endpoints, typically used for service versioning or canary deployments. items: description: ApisixUpstreamSubset defines a single endpoints group of one Service. properties: labels: additionalProperties: type: string description: Labels is the label set of this subset. type: object name: description: Name is the name of subset. type: string required: - labels - name type: object type: array timeout: description: Timeout specifies the connection, send, and read timeouts for upstream requests. properties: connect: description: Connect timeout for establishing a connection to the upstream. type: string read: description: Read timeout for reading data from the upstream. type: string send: description: Send timeout for sending data to the upstream. type: string type: object tlsSecret: description: |- TLSSecret references a Kubernetes Secret that contains the client certificate and key for mutual TLS when connecting to the upstream. properties: name: description: Name is the name of the Kubernetes Secret. minLength: 1 type: string namespace: description: Namespace is the namespace where the Kubernetes Secret is located. minLength: 1 type: string required: - name - namespace type: object upstreamHost: description: UpstreamHost sets a custom Host header when passHost is set to `rewrite`. type: string type: object status: description: ApisixStatus is the status report for Apisix ingress Resources properties: conditions: items: description: Condition contains details for one aspect of the current state of this API Resource. properties: lastTransitionTime: description: |- lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: |- message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: |- observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: |- reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object type: array type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.17.2 name: backendtrafficpolicies.apisix.apache.org spec: group: apisix.apache.org names: kind: BackendTrafficPolicy listKind: BackendTrafficPolicyList plural: backendtrafficpolicies singular: backendtrafficpolicy scope: Namespaced versions: - name: v1alpha1 schema: openAPIV3Schema: description: BackendTrafficPolicy defines configuration for traffic handling policies applied to backend services. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: |- BackendTrafficPolicySpec defines traffic handling policies applied to backend services, such as load balancing strategy, connection settings, and failover behavior. properties: healthCheck: description: |- HealthCheck defines active and passive health check configuration for the upstream backends. When configured, APISIX will probe backends (active) or monitor live traffic (passive) to detect and bypass unhealthy nodes. properties: active: description: Active health checks proactively send requests to upstream nodes to determine their availability. properties: concurrency: description: Concurrency sets the number of targets to be checked at the same time. minimum: 0 type: integer healthy: description: Healthy configures the thresholds for marking a node healthy. properties: httpCodes: description: HTTPCodes is the list of HTTP status codes considered healthy. items: type: integer minItems: 1 type: array interval: description: |- Interval defines the time between health check probes. Minimum is 1s. type: string successes: description: Successes is the number of consecutive successful responses required to mark a node healthy. maximum: 254 minimum: 0 type: integer type: object host: description: Host sets the upstream host used in the health check request. type: string httpPath: description: HTTPPath sets the HTTP path for the probe request. type: string port: description: Port sets the port on the upstream node to probe. format: int32 maximum: 65535 minimum: 1 type: integer requestHeaders: description: RequestHeaders sets additional HTTP request headers for the probe. items: type: string type: array strictTLS: description: StrictTLS controls whether TLS certificate validation is enforced. type: boolean timeout: description: Timeout sets health check timeout. type: string type: default: http description: Type is the health check type. Can be `http`, `https`, or `tcp`. enum: - http - https - tcp type: string unhealthy: description: Unhealthy configures the thresholds for marking a node unhealthy. properties: httpCodes: description: HTTPCodes is the list of HTTP status codes considered unhealthy. items: type: integer minItems: 1 type: array httpFailures: description: HTTPFailures is the number of HTTP failures to mark a node unhealthy. maximum: 254 minimum: 0 type: integer interval: description: |- Interval defines the time between health check probes. Minimum is 1s. type: string tcpFailures: description: TCPFailures is the number of TCP failures to mark a node unhealthy. maximum: 254 minimum: 0 type: integer timeouts: description: Timeouts is the number of timeouts to mark a node unhealthy. maximum: 254 minimum: 1 type: integer type: object type: object passive: description: Passive health checks evaluate upstream health based on observed traffic (timeouts, errors). properties: healthy: description: Healthy defines conditions under which a node is considered healthy. properties: httpCodes: description: HTTPCodes is the list of HTTP status codes considered healthy. items: type: integer minItems: 1 type: array successes: description: Successes is the number of consecutive successful responses required to mark a node healthy. maximum: 254 minimum: 0 type: integer type: object type: default: http description: Type is the passive health check type. Can be `http`, `https`, or `tcp`. enum: - http - https - tcp type: string unhealthy: description: Unhealthy defines conditions under which a node is considered unhealthy. properties: httpCodes: description: HTTPCodes is the list of HTTP status codes considered unhealthy. items: type: integer minItems: 1 type: array httpFailures: description: HTTPFailures is the number of HTTP failures to mark a node unhealthy. maximum: 254 minimum: 0 type: integer tcpFailures: description: TCPFailures is the number of TCP failures to mark a node unhealthy. maximum: 254 minimum: 0 type: integer timeouts: description: Timeouts is the number of timeouts to mark a node unhealthy. maximum: 254 minimum: 1 type: integer type: object type: object required: - active type: object loadbalancer: description: |- LoadBalancer represents the load balancer configuration for Kubernetes Service. The default strategy is round robin. properties: hashOn: default: vars description: |- HashOn specified the type of field used for hashing, required when type is `chash`. Default is `vars`. Can be `vars`, `header`, `cookie`, `consumer`, or `vars_combinations`. enum: - vars - header - cookie - consumer - vars_combinations type: string key: description: |- Key is used with HashOn, generally required when type is `chash`. When HashOn is `header` or `cookie`, specifies the name of the header or cookie. When HashOn is `consumer`, key is not required, as the consumer name is used automatically. When HashOn is `vars` or `vars_combinations`, key refers to one or a combination of [APISIX variable](https://apisix.apache.org/docs/apisix/apisix-variable/). type: string type: default: roundrobin description: |- Type specifies the load balancing algorithms to route traffic to the backend. Default is `roundrobin`. Can be `roundrobin`, `chash`, `ewma`, or `least_conn`. enum: - roundrobin - chash - ewma - least_conn type: string required: - type type: object x-kubernetes-validations: - rule: '!(has(self.key) && self.type != ''chash'')' passHost: default: pass description: |- PassHost configures how the host header should be determined when a request is forwarded to the upstream. Default is `pass`. Can be `pass`, `node` or `rewrite`: * `pass`: preserve the original Host header * `node`: use the upstream node’s host * `rewrite`: set to a custom host via `upstreamHost` enum: - pass - node - rewrite type: string retries: description: |- Retries specify the number of times the gateway should retry sending requests when errors such as timeouts or 502 errors occur. type: integer scheme: default: http description: |- Scheme is the protocol used to communicate with the upstream. Default is `http`. For L7 proxy, it can be `http`, `https`, `grpc`, or `grpcs`. For L4 proxy, it can be `tcp`, `tls`, or `udp`. The L4 values apply to stream routes only; using them for an HTTP route makes the upstream unreachable. enum: - http - https - grpc - grpcs - tcp - tls - udp type: string targetRefs: description: |- TargetRef identifies an API object to apply policy to. Currently, Backends (i.e. Service, ServiceImport, or any implementation-specific backendRef) are the only valid API target references. items: description: |- LocalPolicyTargetReferenceWithSectionName identifies an API object to apply a direct policy to. This should be used as part of Policy resources that can target single resources. For more information on how this policy attachment mode works, and a sample Policy resource, refer to the policy attachment documentation for Gateway API. Note: This should only be used for direct policy attachment when references to SectionName are actually needed. In all other cases, LocalPolicyTargetReference should be used. properties: group: description: Group is the group of the target resource. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: description: Kind is kind of the target resource. maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: Name is the name of the target resource. maxLength: 253 minLength: 1 type: string sectionName: description: |- SectionName is the name of a section within the target resource. When unspecified, this targetRef targets the entire resource. In the following resources, SectionName is interpreted as the following: * Gateway: Listener name * HTTPRoute: HTTPRouteRule name * Service: Port name If a SectionName is specified, but does not exist on the targeted object, the Policy must fail to attach, and the policy implementation should record a `ResolvedRefs` or similar Condition in the Policy's status. maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string required: - group - kind - name type: object x-kubernetes-validations: - rule: self.kind == 'Service' && self.group == "" maxItems: 16 minItems: 1 type: array timeout: description: Timeout sets the read, send, and connect timeouts to the upstream. properties: connect: default: 60s description: Connection timeout. Default is `60s`. pattern: ^[0-9]+s$ type: string read: default: 60s description: Read timeout. Default is `60s`. pattern: ^[0-9]+s$ type: string send: default: 60s description: Send timeout. Default is `60s`. pattern: ^[0-9]+s$ type: string type: object upstreamHost: description: |- UpstreamHost specifies the host of the Upstream request. Used only if passHost is set to `rewrite`. maxLength: 253 minLength: 1 pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string required: - targetRefs type: object status: description: |- PolicyStatus defines the common attributes that all Policies should include within their status. properties: ancestors: description: |- Ancestors is a list of ancestor resources (usually Gateways) that are associated with the policy, and the status of the policy with respect to each ancestor. When this policy attaches to a parent, the controller that manages the parent and the ancestors MUST add an entry to this list when the controller first sees the policy and SHOULD update the entry as appropriate when the relevant ancestor is modified. Note that choosing the relevant ancestor is left to the Policy designers; an important part of Policy design is designing the right object level at which to namespace this status. Note also that implementations MUST ONLY populate ancestor status for the Ancestor resources they are responsible for. Implementations MUST use the ControllerName field to uniquely identify the entries in this list that they are responsible for. Note that to achieve this, the list of PolicyAncestorStatus structs MUST be treated as a map with a composite key, made up of the AncestorRef and ControllerName fields combined. A maximum of 16 ancestors will be represented in this list. An empty list means the Policy is not relevant for any ancestors. If this slice is full, implementations MUST NOT add further entries. Instead they MUST consider the policy unimplementable and signal that on any related resources such as the ancestor that would be referenced here. For example, if this list was full on BackendTLSPolicy, no additional Gateways would be able to reference the Service targeted by the BackendTLSPolicy. items: description: |- PolicyAncestorStatus describes the status of a route with respect to an associated Ancestor. Ancestors refer to objects that are either the Target of a policy or above it in terms of object hierarchy. For example, if a policy targets a Service, the Policy's Ancestors are, in order, the Service, the HTTPRoute, the Gateway, and the GatewayClass. Almost always, in this hierarchy, the Gateway will be the most useful object to place Policy status on, so we recommend that implementations SHOULD use Gateway as the PolicyAncestorStatus object unless the designers have a _very_ good reason otherwise. In the context of policy attachment, the Ancestor is used to distinguish which resource results in a distinct application of this policy. For example, if a policy targets a Service, it may have a distinct result per attached Gateway. Policies targeting the same resource may have different effects depending on the ancestors of those resources. For example, different Gateways targeting the same Service may have different capabilities, especially if they have different underlying implementations. For example, in BackendTLSPolicy, the Policy attaches to a Service that is used as a backend in a HTTPRoute that is itself attached to a Gateway. In this case, the relevant object for status is the Gateway, and that is the ancestor object referred to in this status. Note that a parent is also an ancestor, so for objects where the parent is the relevant object for status, this struct SHOULD still be used. This struct is intended to be used in a slice that's effectively a map, with a composite key made up of the AncestorRef and the ControllerName. properties: ancestorRef: description: |- AncestorRef corresponds with a ParentRef in the spec that this PolicyAncestorStatus struct describes the status of. properties: group: default: gateway.networking.k8s.io description: |- Group is the group of the referent. When unspecified, "gateway.networking.k8s.io" is inferred. To set the core API group (such as for a "Service" kind referent), Group must be explicitly set to "" (empty string). Support: Core maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: default: Gateway description: |- Kind is kind of the referent. There are two kinds of parent resources with "Core" support: * Gateway (Gateway conformance profile) * Service (Mesh conformance profile, ClusterIP Services only) Support for other resources is Implementation-Specific. maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: |- Name is the name of the referent. Support: Core maxLength: 253 minLength: 1 type: string namespace: description: |- Namespace is the namespace of the referent. When unspecified, this refers to the local namespace of the Route. Note that there are specific rules for ParentRefs which cross namespace boundaries. Cross-namespace references are only valid if they are explicitly allowed by something in the namespace they are referring to. For example: Gateway has the AllowedRoutes field, and ReferenceGrant provides a generic way to enable any other kind of cross-namespace reference. ParentRefs from a Route to a Service in the same namespace are "producer" routes, which apply default routing rules to inbound connections from any namespace to the Service. ParentRefs from a Route to a Service in a different namespace are "consumer" routes, and these routing rules are only applied to outbound connections originating from the same namespace as the Route, for which the intended destination of the connections are a Service targeted as a ParentRef of the Route. Support: Core maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string port: description: |- Port is the network port this Route targets. It can be interpreted differently based on the type of parent resource. When the parent resource is a Gateway, this targets all listeners listening on the specified port that also support this kind of Route(and select this Route). It's not recommended to set `Port` unless the networking behaviors specified in a Route must apply to a specific port as opposed to a listener(s) whose port(s) may be changed. When both Port and SectionName are specified, the name and port of the selected listener must match both specified values. When the parent resource is a Service, this targets a specific port in the Service spec. When both Port (experimental) and SectionName are specified, the name and port of the selected port must match both specified values. Implementations MAY choose to support other parent resources. Implementations supporting other types of parent resources MUST clearly document how/if Port is interpreted. For the purpose of status, an attachment is considered successful as long as the parent resource accepts it partially. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. Support: Extended format: int32 maximum: 65535 minimum: 1 type: integer sectionName: description: |- SectionName is the name of a section within the target resource. In the following resources, SectionName is interpreted as the following: * Gateway: Listener name. When both Port (experimental) and SectionName are specified, the name and port of the selected listener must match both specified values. * Service: Port name. When both Port (experimental) and SectionName are specified, the name and port of the selected listener must match both specified values. Implementations MAY choose to support attaching Routes to other resources. If that is the case, they MUST clearly document how SectionName is interpreted. When unspecified (empty string), this will reference the entire resource. For the purpose of status, an attachment is considered successful if at least one section in the parent resource accepts it. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. Support: Core maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string required: - name type: object conditions: description: |- Conditions describes the status of the Policy with respect to the given Ancestor. Notes for implementors: Conditions are a listType `map`, which means that they function like a map with a key of the `type` field _in the k8s apiserver_. This means that implementations must obey some rules when updating this section. * Implementations MUST perform a read-modify-write cycle on this field before modifying it. That is, when modifying this field, implementations must be confident they have fetched the most recent version of this field, and ensure that changes they make are on that recent version. * Implementations MUST NOT remove or reorder Conditions that they are not directly responsible for. For example, if an implementation sees a Condition with type `special.io/SomeField`, it MUST NOT remove, change or update that Condition. * Implementations MUST always _merge_ changes into Conditions of the same Type, rather than creating more than one Condition of the same Type. * Implementations MUST always update the `observedGeneration` field of the Condition to the `metadata.generation` of the Gateway at the time of update creation. * If the `observedGeneration` of a Condition is _greater than_ the value the implementation knows about, then it MUST NOT perform the update on that Condition, but must wait for a future reconciliation and status update. (The assumption is that the implementation's copy of the object is stale and an update will be re-triggered if relevant.) items: description: Condition contains details for one aspect of the current state of this API Resource. properties: lastTransitionTime: description: |- lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: |- message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: |- observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: |- reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object maxItems: 8 minItems: 1 type: array x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map controllerName: description: |- ControllerName is a domain/path string that indicates the name of the controller that wrote this status. This corresponds with the controllerName field on GatewayClass. Example: "example.net/gateway-controller". The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are valid Kubernetes names (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names). Controllers MUST populate this field when writing status. Controllers should ensure that entries to status populated with their ControllerName are cleaned up when they are no longer necessary. maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ type: string required: - ancestorRef - conditions - controllerName type: object maxItems: 16 type: array x-kubernetes-list-type: atomic required: - ancestors type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.17.2 name: consumers.apisix.apache.org spec: group: apisix.apache.org names: kind: Consumer listKind: ConsumerList plural: consumers singular: consumer scope: Namespaced versions: - name: v1alpha1 schema: openAPIV3Schema: description: Consumer defines configuration for a consumer. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: |- ConsumerSpec defines configuration for a consumer, including consumer name, authentication credentials, and plugin settings. properties: credentials: description: Credentials specifies the credential details of a consumer. items: oneOf: - required: - config - required: - secretRef properties: config: description: Config specifies the credential details for authentication. x-kubernetes-preserve-unknown-fields: true name: description: Name is the name of the credential. type: string secretRef: description: SecretRef references to the Secret that contains the credentials. properties: name: description: Name is the name of the secret. type: string namespace: description: Namespace is the namespace of the secret. type: string required: - name type: object type: description: |- Type specifies the type of authentication to configure credentials for. Can be `jwt-auth`, `basic-auth`, `key-auth`, or `hmac-auth`. enum: - jwt-auth - basic-auth - key-auth - hmac-auth type: string required: - type type: object type: array gatewayRef: description: GatewayRef specifies the gateway details. properties: group: default: gateway.networking.k8s.io description: Group is the API group the resource belongs to. Default is `gateway.networking.k8s.io`. type: string kind: default: Gateway description: Kind is the type of Kubernetes object. Default is `Gateway`. type: string name: description: Name is the name of the gateway. minLength: 1 type: string namespace: description: Namespace is namespace of the resource. type: string required: - name type: object plugins: description: Plugins define the plugins associated with a consumer. items: properties: config: description: Config is plugin configuration details. x-kubernetes-preserve-unknown-fields: true name: description: Name is the name of the plugin. type: string required: - name type: object type: array type: object status: properties: conditions: items: description: Condition contains details for one aspect of the current state of this API Resource. properties: lastTransitionTime: description: |- lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: |- message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: |- observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: |- reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object type: array type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.17.2 name: gatewayproxies.apisix.apache.org spec: group: apisix.apache.org names: kind: GatewayProxy listKind: GatewayProxyList plural: gatewayproxies singular: gatewayproxy scope: Namespaced versions: - name: v1alpha1 schema: openAPIV3Schema: description: GatewayProxy defines configuration for the gateway proxy instances used to route traffic to services. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: |- GatewayProxySpec defines configuration of gateway proxy instances, including networking settings, global plugins, and plugin metadata. properties: pluginMetadata: additionalProperties: x-kubernetes-preserve-unknown-fields: true description: PluginMetadata configures common configuration shared by all plugin instances of the same name. type: object plugins: description: Plugins configure global plugins. items: description: GatewayProxyPlugin contains plugin configuration. properties: config: description: Config defines the plugin's configuration details. x-kubernetes-preserve-unknown-fields: true enabled: description: Enabled defines whether the plugin is enabled. type: boolean name: description: Name is the name of the plugin. type: string type: object type: array provider: description: Provider configures the provider details. properties: controlPlane: description: ControlPlane specifies the configuration for control plane provider. properties: auth: description: Auth specifies the authentication configuration. properties: adminKey: description: AdminKey specifies the admin key authentication configuration. properties: value: description: Value sets the admin key value explicitly (not recommended for production). type: string valueFrom: description: ValueFrom specifies the source of the admin key. properties: secretKeyRef: description: SecretKeyRef references a key in a Secret. properties: key: description: Key is the key in the secret to retrieve the secret from. type: string name: description: Name is the name of the secret. type: string required: - key - name type: object type: object type: object x-kubernetes-validations: - message: exactly one of value or valueFrom must be specified rule: has(self.value) != has(self.valueFrom) type: description: |- Type specifies the type of authentication. Can only be `AdminKey`. enum: - AdminKey type: string required: - type type: object x-kubernetes-validations: - message: adminKey must be specified when type is AdminKey rule: 'self.type == ''AdminKey'' ? has(self.adminKey) : true' endpoints: description: Endpoints specifies the list of control plane endpoints. items: type: string minItems: 1 type: array mode: description: |- Mode specifies the mode of control plane provider. Can be `apisix` or `apisix-standalone`. type: string service: properties: name: description: Name is the name of the provider. type: string port: description: Port is the port of the provider. format: int32 maximum: 65535 minimum: 1 type: integer required: - name type: object tlsVerify: description: TlsVerify specifies whether to verify the TLS certificate of the control plane. type: boolean required: - auth type: object x-kubernetes-validations: - rule: has(self.endpoints) != has(self.service) - message: mode is immutable rule: oldSelf == null || (!has(self.mode) && !has(oldSelf.mode)) || self.mode == oldSelf.mode type: description: Type specifies the type of provider. Can only be `ControlPlane`. enum: - ControlPlane type: string required: - type type: object x-kubernetes-validations: - message: controlPlane must be specified when type is ControlPlane rule: 'self.type == ''ControlPlane'' ? has(self.controlPlane) : true' publishService: description: |- PublishService specifies the LoadBalancer-type Service whose external address the controller uses to update the status of Ingress resources. type: string statusAddress: description: |- StatusAddress specifies the external IP addresses that the controller uses to populate the status field of GatewayProxy or Ingress resources for developers to access. items: type: string type: array required: - provider type: object type: object served: true storage: true --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.17.2 name: httproutepolicies.apisix.apache.org spec: group: apisix.apache.org names: kind: HTTPRoutePolicy listKind: HTTPRoutePolicyList plural: httproutepolicies singular: httproutepolicy scope: Namespaced versions: - name: v1alpha1 schema: openAPIV3Schema: description: HTTPRoutePolicy defines configuration of traffic policies. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: |- HTTPRoutePolicySpec defines configuration of a HTTPRoutePolicy, including route priority and request matching conditions. properties: priority: description: |- Priority sets the priority for route. when multiple routes have the same URI path, a higher value sets a higher priority in route matching. format: int64 type: integer targetRefs: description: TargetRef identifies an API object (i.e. HTTPRoute, Ingress) to apply HTTPRoutePolicy to. items: description: |- LocalPolicyTargetReferenceWithSectionName identifies an API object to apply a direct policy to. This should be used as part of Policy resources that can target single resources. For more information on how this policy attachment mode works, and a sample Policy resource, refer to the policy attachment documentation for Gateway API. Note: This should only be used for direct policy attachment when references to SectionName are actually needed. In all other cases, LocalPolicyTargetReference should be used. properties: group: description: Group is the group of the target resource. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: description: Kind is kind of the target resource. maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: Name is the name of the target resource. maxLength: 253 minLength: 1 type: string sectionName: description: |- SectionName is the name of a section within the target resource. When unspecified, this targetRef targets the entire resource. In the following resources, SectionName is interpreted as the following: * Gateway: Listener name * HTTPRoute: HTTPRouteRule name * Service: Port name If a SectionName is specified, but does not exist on the targeted object, the Policy must fail to attach, and the policy implementation should record a `ResolvedRefs` or similar Condition in the Policy's status. maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string required: - group - kind - name type: object maxItems: 16 minItems: 1 type: array vars: description: Vars sets the request matching conditions. items: x-kubernetes-preserve-unknown-fields: true type: array required: - targetRefs type: object status: description: |- PolicyStatus defines the common attributes that all Policies should include within their status. properties: ancestors: description: |- Ancestors is a list of ancestor resources (usually Gateways) that are associated with the policy, and the status of the policy with respect to each ancestor. When this policy attaches to a parent, the controller that manages the parent and the ancestors MUST add an entry to this list when the controller first sees the policy and SHOULD update the entry as appropriate when the relevant ancestor is modified. Note that choosing the relevant ancestor is left to the Policy designers; an important part of Policy design is designing the right object level at which to namespace this status. Note also that implementations MUST ONLY populate ancestor status for the Ancestor resources they are responsible for. Implementations MUST use the ControllerName field to uniquely identify the entries in this list that they are responsible for. Note that to achieve this, the list of PolicyAncestorStatus structs MUST be treated as a map with a composite key, made up of the AncestorRef and ControllerName fields combined. A maximum of 16 ancestors will be represented in this list. An empty list means the Policy is not relevant for any ancestors. If this slice is full, implementations MUST NOT add further entries. Instead they MUST consider the policy unimplementable and signal that on any related resources such as the ancestor that would be referenced here. For example, if this list was full on BackendTLSPolicy, no additional Gateways would be able to reference the Service targeted by the BackendTLSPolicy. items: description: |- PolicyAncestorStatus describes the status of a route with respect to an associated Ancestor. Ancestors refer to objects that are either the Target of a policy or above it in terms of object hierarchy. For example, if a policy targets a Service, the Policy's Ancestors are, in order, the Service, the HTTPRoute, the Gateway, and the GatewayClass. Almost always, in this hierarchy, the Gateway will be the most useful object to place Policy status on, so we recommend that implementations SHOULD use Gateway as the PolicyAncestorStatus object unless the designers have a _very_ good reason otherwise. In the context of policy attachment, the Ancestor is used to distinguish which resource results in a distinct application of this policy. For example, if a policy targets a Service, it may have a distinct result per attached Gateway. Policies targeting the same resource may have different effects depending on the ancestors of those resources. For example, different Gateways targeting the same Service may have different capabilities, especially if they have different underlying implementations. For example, in BackendTLSPolicy, the Policy attaches to a Service that is used as a backend in a HTTPRoute that is itself attached to a Gateway. In this case, the relevant object for status is the Gateway, and that is the ancestor object referred to in this status. Note that a parent is also an ancestor, so for objects where the parent is the relevant object for status, this struct SHOULD still be used. This struct is intended to be used in a slice that's effectively a map, with a composite key made up of the AncestorRef and the ControllerName. properties: ancestorRef: description: |- AncestorRef corresponds with a ParentRef in the spec that this PolicyAncestorStatus struct describes the status of. properties: group: default: gateway.networking.k8s.io description: |- Group is the group of the referent. When unspecified, "gateway.networking.k8s.io" is inferred. To set the core API group (such as for a "Service" kind referent), Group must be explicitly set to "" (empty string). Support: Core maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: default: Gateway description: |- Kind is kind of the referent. There are two kinds of parent resources with "Core" support: * Gateway (Gateway conformance profile) * Service (Mesh conformance profile, ClusterIP Services only) Support for other resources is Implementation-Specific. maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: |- Name is the name of the referent. Support: Core maxLength: 253 minLength: 1 type: string namespace: description: |- Namespace is the namespace of the referent. When unspecified, this refers to the local namespace of the Route. Note that there are specific rules for ParentRefs which cross namespace boundaries. Cross-namespace references are only valid if they are explicitly allowed by something in the namespace they are referring to. For example: Gateway has the AllowedRoutes field, and ReferenceGrant provides a generic way to enable any other kind of cross-namespace reference. ParentRefs from a Route to a Service in the same namespace are "producer" routes, which apply default routing rules to inbound connections from any namespace to the Service. ParentRefs from a Route to a Service in a different namespace are "consumer" routes, and these routing rules are only applied to outbound connections originating from the same namespace as the Route, for which the intended destination of the connections are a Service targeted as a ParentRef of the Route. Support: Core maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string port: description: |- Port is the network port this Route targets. It can be interpreted differently based on the type of parent resource. When the parent resource is a Gateway, this targets all listeners listening on the specified port that also support this kind of Route(and select this Route). It's not recommended to set `Port` unless the networking behaviors specified in a Route must apply to a specific port as opposed to a listener(s) whose port(s) may be changed. When both Port and SectionName are specified, the name and port of the selected listener must match both specified values. When the parent resource is a Service, this targets a specific port in the Service spec. When both Port (experimental) and SectionName are specified, the name and port of the selected port must match both specified values. Implementations MAY choose to support other parent resources. Implementations supporting other types of parent resources MUST clearly document how/if Port is interpreted. For the purpose of status, an attachment is considered successful as long as the parent resource accepts it partially. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. Support: Extended format: int32 maximum: 65535 minimum: 1 type: integer sectionName: description: |- SectionName is the name of a section within the target resource. In the following resources, SectionName is interpreted as the following: * Gateway: Listener name. When both Port (experimental) and SectionName are specified, the name and port of the selected listener must match both specified values. * Service: Port name. When both Port (experimental) and SectionName are specified, the name and port of the selected listener must match both specified values. Implementations MAY choose to support attaching Routes to other resources. If that is the case, they MUST clearly document how SectionName is interpreted. When unspecified (empty string), this will reference the entire resource. For the purpose of status, an attachment is considered successful if at least one section in the parent resource accepts it. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. Support: Core maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string required: - name type: object conditions: description: |- Conditions describes the status of the Policy with respect to the given Ancestor. Notes for implementors: Conditions are a listType `map`, which means that they function like a map with a key of the `type` field _in the k8s apiserver_. This means that implementations must obey some rules when updating this section. * Implementations MUST perform a read-modify-write cycle on this field before modifying it. That is, when modifying this field, implementations must be confident they have fetched the most recent version of this field, and ensure that changes they make are on that recent version. * Implementations MUST NOT remove or reorder Conditions that they are not directly responsible for. For example, if an implementation sees a Condition with type `special.io/SomeField`, it MUST NOT remove, change or update that Condition. * Implementations MUST always _merge_ changes into Conditions of the same Type, rather than creating more than one Condition of the same Type. * Implementations MUST always update the `observedGeneration` field of the Condition to the `metadata.generation` of the Gateway at the time of update creation. * If the `observedGeneration` of a Condition is _greater than_ the value the implementation knows about, then it MUST NOT perform the update on that Condition, but must wait for a future reconciliation and status update. (The assumption is that the implementation's copy of the object is stale and an update will be re-triggered if relevant.) items: description: Condition contains details for one aspect of the current state of this API Resource. properties: lastTransitionTime: description: |- lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: |- message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: |- observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: |- reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object maxItems: 8 minItems: 1 type: array x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map controllerName: description: |- ControllerName is a domain/path string that indicates the name of the controller that wrote this status. This corresponds with the controllerName field on GatewayClass. Example: "example.net/gateway-controller". The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are valid Kubernetes names (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names). Controllers MUST populate this field when writing status. Controllers should ensure that entries to status populated with their ControllerName are cleaned up when they are no longer necessary. maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ type: string required: - ancestorRef - conditions - controllerName type: object maxItems: 16 type: array x-kubernetes-list-type: atomic required: - ancestors type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.17.2 name: l4routepolicies.apisix.apache.org spec: group: apisix.apache.org names: kind: L4RoutePolicy listKind: L4RoutePolicyList plural: l4routepolicies singular: l4routepolicy scope: Namespaced versions: - name: v1alpha1 schema: openAPIV3Schema: description: |- L4RoutePolicy defines plugin configuration for Gateway API L4 routes (TCPRoute, UDPRoute, TLSRoute). It follows the Gateway API Policy Attachment pattern and attaches APISIX stream plugins to the targeted L4 route resources. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: Spec defines the desired state of L4RoutePolicy. properties: plugins: description: |- Plugins is the list of APISIX stream plugins to attach to the targeted L4 routes. Plugin names should be valid APISIX stream plugin names (e.g., limit-conn, ip-restriction). items: properties: config: description: Config is plugin configuration details. x-kubernetes-preserve-unknown-fields: true name: description: Name is the name of the plugin. type: string required: - name type: object type: array targetRefs: description: |- TargetRefs identifies the L4 route resources (TCPRoute, UDPRoute, or TLSRoute) to which this policy applies. Only same-namespace targets are supported. items: description: |- LocalPolicyTargetReferenceWithSectionName identifies an API object to apply a direct policy to. This should be used as part of Policy resources that can target single resources. For more information on how this policy attachment mode works, and a sample Policy resource, refer to the policy attachment documentation for Gateway API. Note: This should only be used for direct policy attachment when references to SectionName are actually needed. In all other cases, LocalPolicyTargetReference should be used. properties: group: description: Group is the group of the target resource. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: description: Kind is kind of the target resource. maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: Name is the name of the target resource. maxLength: 253 minLength: 1 type: string sectionName: description: |- SectionName is the name of a section within the target resource. When unspecified, this targetRef targets the entire resource. In the following resources, SectionName is interpreted as the following: * Gateway: Listener name * HTTPRoute: HTTPRouteRule name * Service: Port name If a SectionName is specified, but does not exist on the targeted object, the Policy must fail to attach, and the policy implementation should record a `ResolvedRefs` or similar Condition in the Policy's status. maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string required: - group - kind - name type: object maxItems: 16 minItems: 1 type: array x-kubernetes-validations: - message: targetRefs kind must be TCPRoute, UDPRoute, or TLSRoute rule: self.all(r, r.kind == 'TCPRoute' || r.kind == 'UDPRoute' || r.kind == 'TLSRoute') - message: targetRefs group must be gateway.networking.k8s.io rule: self.all(r, r.group == 'gateway.networking.k8s.io') required: - targetRefs type: object status: description: |- PolicyStatus defines the common attributes that all Policies should include within their status. properties: ancestors: description: |- Ancestors is a list of ancestor resources (usually Gateways) that are associated with the policy, and the status of the policy with respect to each ancestor. When this policy attaches to a parent, the controller that manages the parent and the ancestors MUST add an entry to this list when the controller first sees the policy and SHOULD update the entry as appropriate when the relevant ancestor is modified. Note that choosing the relevant ancestor is left to the Policy designers; an important part of Policy design is designing the right object level at which to namespace this status. Note also that implementations MUST ONLY populate ancestor status for the Ancestor resources they are responsible for. Implementations MUST use the ControllerName field to uniquely identify the entries in this list that they are responsible for. Note that to achieve this, the list of PolicyAncestorStatus structs MUST be treated as a map with a composite key, made up of the AncestorRef and ControllerName fields combined. A maximum of 16 ancestors will be represented in this list. An empty list means the Policy is not relevant for any ancestors. If this slice is full, implementations MUST NOT add further entries. Instead they MUST consider the policy unimplementable and signal that on any related resources such as the ancestor that would be referenced here. For example, if this list was full on BackendTLSPolicy, no additional Gateways would be able to reference the Service targeted by the BackendTLSPolicy. items: description: |- PolicyAncestorStatus describes the status of a route with respect to an associated Ancestor. Ancestors refer to objects that are either the Target of a policy or above it in terms of object hierarchy. For example, if a policy targets a Service, the Policy's Ancestors are, in order, the Service, the HTTPRoute, the Gateway, and the GatewayClass. Almost always, in this hierarchy, the Gateway will be the most useful object to place Policy status on, so we recommend that implementations SHOULD use Gateway as the PolicyAncestorStatus object unless the designers have a _very_ good reason otherwise. In the context of policy attachment, the Ancestor is used to distinguish which resource results in a distinct application of this policy. For example, if a policy targets a Service, it may have a distinct result per attached Gateway. Policies targeting the same resource may have different effects depending on the ancestors of those resources. For example, different Gateways targeting the same Service may have different capabilities, especially if they have different underlying implementations. For example, in BackendTLSPolicy, the Policy attaches to a Service that is used as a backend in a HTTPRoute that is itself attached to a Gateway. In this case, the relevant object for status is the Gateway, and that is the ancestor object referred to in this status. Note that a parent is also an ancestor, so for objects where the parent is the relevant object for status, this struct SHOULD still be used. This struct is intended to be used in a slice that's effectively a map, with a composite key made up of the AncestorRef and the ControllerName. properties: ancestorRef: description: |- AncestorRef corresponds with a ParentRef in the spec that this PolicyAncestorStatus struct describes the status of. properties: group: default: gateway.networking.k8s.io description: |- Group is the group of the referent. When unspecified, "gateway.networking.k8s.io" is inferred. To set the core API group (such as for a "Service" kind referent), Group must be explicitly set to "" (empty string). Support: Core maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: default: Gateway description: |- Kind is kind of the referent. There are two kinds of parent resources with "Core" support: * Gateway (Gateway conformance profile) * Service (Mesh conformance profile, ClusterIP Services only) Support for other resources is Implementation-Specific. maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: |- Name is the name of the referent. Support: Core maxLength: 253 minLength: 1 type: string namespace: description: |- Namespace is the namespace of the referent. When unspecified, this refers to the local namespace of the Route. Note that there are specific rules for ParentRefs which cross namespace boundaries. Cross-namespace references are only valid if they are explicitly allowed by something in the namespace they are referring to. For example: Gateway has the AllowedRoutes field, and ReferenceGrant provides a generic way to enable any other kind of cross-namespace reference. ParentRefs from a Route to a Service in the same namespace are "producer" routes, which apply default routing rules to inbound connections from any namespace to the Service. ParentRefs from a Route to a Service in a different namespace are "consumer" routes, and these routing rules are only applied to outbound connections originating from the same namespace as the Route, for which the intended destination of the connections are a Service targeted as a ParentRef of the Route. Support: Core maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string port: description: |- Port is the network port this Route targets. It can be interpreted differently based on the type of parent resource. When the parent resource is a Gateway, this targets all listeners listening on the specified port that also support this kind of Route(and select this Route). It's not recommended to set `Port` unless the networking behaviors specified in a Route must apply to a specific port as opposed to a listener(s) whose port(s) may be changed. When both Port and SectionName are specified, the name and port of the selected listener must match both specified values. When the parent resource is a Service, this targets a specific port in the Service spec. When both Port (experimental) and SectionName are specified, the name and port of the selected port must match both specified values. Implementations MAY choose to support other parent resources. Implementations supporting other types of parent resources MUST clearly document how/if Port is interpreted. For the purpose of status, an attachment is considered successful as long as the parent resource accepts it partially. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. Support: Extended format: int32 maximum: 65535 minimum: 1 type: integer sectionName: description: |- SectionName is the name of a section within the target resource. In the following resources, SectionName is interpreted as the following: * Gateway: Listener name. When both Port (experimental) and SectionName are specified, the name and port of the selected listener must match both specified values. * Service: Port name. When both Port (experimental) and SectionName are specified, the name and port of the selected listener must match both specified values. Implementations MAY choose to support attaching Routes to other resources. If that is the case, they MUST clearly document how SectionName is interpreted. When unspecified (empty string), this will reference the entire resource. For the purpose of status, an attachment is considered successful if at least one section in the parent resource accepts it. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. Support: Core maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string required: - name type: object conditions: description: |- Conditions describes the status of the Policy with respect to the given Ancestor. Notes for implementors: Conditions are a listType `map`, which means that they function like a map with a key of the `type` field _in the k8s apiserver_. This means that implementations must obey some rules when updating this section. * Implementations MUST perform a read-modify-write cycle on this field before modifying it. That is, when modifying this field, implementations must be confident they have fetched the most recent version of this field, and ensure that changes they make are on that recent version. * Implementations MUST NOT remove or reorder Conditions that they are not directly responsible for. For example, if an implementation sees a Condition with type `special.io/SomeField`, it MUST NOT remove, change or update that Condition. * Implementations MUST always _merge_ changes into Conditions of the same Type, rather than creating more than one Condition of the same Type. * Implementations MUST always update the `observedGeneration` field of the Condition to the `metadata.generation` of the Gateway at the time of update creation. * If the `observedGeneration` of a Condition is _greater than_ the value the implementation knows about, then it MUST NOT perform the update on that Condition, but must wait for a future reconciliation and status update. (The assumption is that the implementation's copy of the object is stale and an update will be re-triggered if relevant.) items: description: Condition contains details for one aspect of the current state of this API Resource. properties: lastTransitionTime: description: |- lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: |- message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: |- observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: |- reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object maxItems: 8 minItems: 1 type: array x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map controllerName: description: |- ControllerName is a domain/path string that indicates the name of the controller that wrote this status. This corresponds with the controllerName field on GatewayClass. Example: "example.net/gateway-controller". The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are valid Kubernetes names (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names). Controllers MUST populate this field when writing status. Controllers should ensure that entries to status populated with their ControllerName are cleaned up when they are no longer necessary. maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ type: string required: - ancestorRef - conditions - controllerName type: object maxItems: 16 type: array x-kubernetes-list-type: atomic required: - ancestors type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.17.2 name: pluginconfigs.apisix.apache.org spec: group: apisix.apache.org names: kind: PluginConfig listKind: PluginConfigList plural: pluginconfigs singular: pluginconfig scope: Namespaced versions: - name: v1alpha1 schema: openAPIV3Schema: description: PluginConfig defines plugin configuration. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: |- PluginConfigSpec defines the desired state of a PluginConfig, in which plugins and their configuration are specified. properties: plugins: description: Plugins are an array of plugins and their configuration to be applied. items: properties: config: description: Config is plugin configuration details. x-kubernetes-preserve-unknown-fields: true name: description: Name is the name of the plugin. type: string required: - name type: object type: array required: - plugins type: object type: object served: true storage: true