Last changed in Kgateway v2.4.0
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
BackendSpec defines the desired state of Backend.
Aws is the AWS backend configuration.
AccountId is the AWS account ID to use for the backend. Deprecated: Set accountId on spec.aws.lambda instead. This field is kept for backward compatibility. When both fields are set, spec.aws.lambda.accountId takes precedence.
Auth specifies an explicit AWS authentication method for the backend. When omitted, the following credential providers are tried in order, stopping when one of them returns an access key ID and a secret access key (the session token is optional): 1. Environment variables: when the environment variables AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN are set. 2. AssumeRoleWithWebIdentity API call: when the environment variables AWS_WEB_IDENTITY_TOKEN_FILE and AWS_ROLE_ARN are set. 3. EKS Pod Identity: when the environment variable AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE is set. See the Envoy docs for more info: https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/aws_request_signing_filter#credentials
AssumeRole configures STS role chaining. The backend's ambient credentials (the gateway ServiceAccount's IRSA identity for Lambda request signing, or the controller's identity for EC2 discovery; more generally any credential resolved by the default provider chain) are used to assume the target role. The resulting temporary credentials are then used to sign requests to the backend (Lambda) or to list instances (EC2). This enables per-backend, least-privilege roles without granting the gateway/controller role direct access to every target. Required when type is 'AssumeRole'.
RoleArn is the ARN of the IAM role to assume, e.g. "arn:aws:iam::123456789012:role/my-invoke-role".
SecretRef references a Kubernetes Secret containing the AWS credentials. The Secret must have keys "accessKey", "secretKey", and optionally "sessionToken". Required when type is 'Secret'.
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
Type specifies the authentication method to use for the backend.
Ec2 configures dynamic discovery of AWS EC2 instances.
AddressType selects whether to route to the instance private or public IP. Defaults to PrivateIP.
Filters select which instances should be associated with this backend. When multiple filters are provided, an instance must match all of them. If this list is omitted or empty, all running instances in the configured region are selected. Be careful: an accidentally empty filter list broadens the backend to the whole regional fleet rather than matching nothing.
Key matches instances that contain the given tag key, regardless of value.
KeyValue matches instances that contain the given tag key/value pair.
Key is the tag key to match.
Value is the tag value to match.
Port is the port to use for discovered instances. Defaults to 80.
Lambda configures the AWS Lambda service.
AccountId is the AWS account ID to use for the backend. This is the preferred location for Lambda backends.
EndpointURL is the URL or domain for the Lambda service. This is primarily useful for testing and development purposes. When omitted, the default lambda hostname will be used.
FunctionName is the name of the Lambda function to invoke.
InvocationMode defines how to invoke the Lambda function. Defaults to Sync.
PayloadTransformation specifies payload transformation mode before it is sent to the Lambda function. Defaults to Envoy.
Qualifier is the alias or version for the Lambda function. Valid values include a numeric version (e.g. "1"), an alias name (alphanumeric plus "-" or "_"), or the special literal "$LATEST".
Region is the AWS region to use for the backend. Defaults to us-east-1 if not specified.
DynamicForwardProxy is the dynamic forward proxy backend configuration.
EnableTls enables TLS. When true, the backend will be configured to use TLS. System CA will be used for validation. The hostname will be used for SNI and auto SAN validation.
Gcp is the GCP backend configuration.
Audience is the GCP service account audience URL. When omitted, defaults to "https://{host}". This is used by the GCP authn filter to request the appropriate token.
Host is the hostname of the GCP service to connect to. This will be used for SNI and as the target address.
PriorityGroups is an ordered list of backend groups used for failover. Traffic is sent to the backends of the first group; each subsequent group is only used when the backends of all preceding groups are unhealthy. The health check can be configured via the BackendConfigPolicy that targets this Backend Note: This field is part of an experimental API and subject to breaking changes in future releases.
BackendRefs references the Backends that make up this priority group. Referenced Backends must be in the same namespace and must not be priority groups backends themselves.
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
Static is the static backend configuration.
AppProtocol is the application protocol to use when communicating with the backend.
Hosts is a list of hosts to use for the backend.
Host is the host name to use for the backend.
Port is the port to use for the backend.
Type indicates the type of the backend to be used. Deprecated: The Type field is deprecated and will be removed in a future release. The backend type is inferred from the configuration.
BackendStatus defines the observed state of Backend.
Conditions is the list of conditions for the backend.
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
message is a human readable message indicating details about the transition. This may be an empty string.
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
status of the condition, one of True, False, Unknown.
type of condition in CamelCase or in foo.example.com/CamelCase.
Source: gateway.kgateway.dev_backends.yaml
Changes to Backend (gateway.kgateway.dev/v1alpha1) in each Kgateway version, compared to the version before it.
4 properties have been added
2 properties are no longer required
3 properties have changed the description
Released · View Backend in v2.4.0
2 properties have been removed
1 property is now required
1 property is no longer required
32 properties have changed the description
Released · View Backend in v2.2.0
15 properties have been added
3 properties have been removed
2 properties are now required
Released · View Backend in v2.1.0
3 properties have been removed
Released · View Backend in v2.0.2
3 properties have been added
Released · View Backend in v2.0.1
Backend was already present in this version of Kgateway, the oldest one on kubespec.dev
Released · View Backend in v2.0.0
No examples of Backend yet. Contribute one on GitHub.
kubespec.dev