Last changed in Kgateway v2.3.9
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
GatewayExtensionSpec defines the desired state of GatewayExtension.
ExtAuth configuration for ExtAuth extension type.
ClearRouteCache determines if the route cache should be cleared to allow the external authentication service to correctly affect routing decisions.
FailOpen determines if requests are allowed when the ext auth service is unavailable. Defaults to false, meaning requests will be denied if the ext auth service is unavailable.
GrpcService is the GRPC service that will handle the auth. Mutually exclusive with HttpService.
Authority is the authority header to use for the GRPC service.
BackendRef references the backend GRPC service.
Group is the group of the referent. For example, "gateway.networking.k8s.io". When unspecified or empty string, core API group is inferred.
Kind is the Kubernetes resource kind of the referent. For example "Service". Defaults to "Service" when not specified. ExternalName services can refer to CNAME DNS records that may live outside of the cluster and as such are difficult to reason about in terms of conformance. They also may not be safe to forward to (see CVE-2021-25740 for more information). Implementations SHOULD NOT support ExternalName Services. Support: Core (Services with a type other than ExternalName) Support: Implementation-specific (Services with type ExternalName)
Name is the name of the referent.
Namespace is the namespace of the backend. When unspecified, the local namespace is inferred. Note that when a namespace different than the local namespace is specified, a ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. Support: Core
Port specifies the destination port number to use for this resource. Port is required when the referent is a Kubernetes Service. In this case, the port number is the service port number, not the target port. For other resources, destination port might be derived from the referent resource or this field.
Weight specifies the proportion of requests forwarded to the referenced backend. This is computed as weight/(sum of all weights in this BackendRefs list). For non-zero values, there may be some epsilon from the exact proportion defined here depending on the precision an implementation supports. Weight is not a percentage and the sum of weights does not need to equal 100. If only one backend is specified and it has a weight greater than 0, 100% of the traffic is forwarded to that backend. If weight is set to 0, no traffic should be forwarded for this entry. If unspecified, weight defaults to 1. Support for this field varies based on the context where used.
RequestTimeout is the timeout for the gRPC request. This is the timeout for a specific request.
Retry specifies the retry policy for gRPC streams associated with the service.
Attempts specifies the number of retry attempts for a request. Defaults to 1 attempt if not set. A value of 0 effectively disables retries.
Backoff specifies the retry backoff strategy. If not set, a default backoff with a base interval of 1000ms is used. The default max interval is 10 times the base interval.
BaseInterval specifies the base interval used with a fully jittered exponential back-off between retries.
MaxInterval specifies the maximum interval between retry attempts. Defaults to 10 times the BaseInterval if not set.
HeadersToForward specifies which headers from the client request should be forwarded to the external authorization service. HTTP services by default have the following headers forwarded: Host, Method, Path, Content-Length, Authorization. If this field is omitted, gRPC services will have all client request headers forwarded, while HTTP services will only receive the default headers described above. Common examples: ["cookie", "authorization", "x-forwarded-for"] More info is available on the [Envoy docs](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto#envoy-v3-api-field-extensions-filters-http-ext-authz-v3-extauthz-allowed-headers)
HttpService is the HTTP service that will handle the auth. Mutually exclusive with GrpcService.
AuthorizationRequest configures the authorization request to the external service.
HeadersToAdd specifies additional headers to add to the authorization request. These headers are sent to the authorization service in addition to the original request headers. Client request headers with the same key will be overridden. The keys are header names and values are envoy format specifiers, see https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto#envoy-v3-api-field-extensions-filters-http-ext-authz-v3-authorizationrequest-headers-to-add.
AuthorizationResponse configures the authorization response from the external service.
HeadersToBackend specifies which headers from the authorization response should be forwarded to the upstream service when the request is authorized. Common examples: ["x-current-user", "x-user-id", "x-auth-request-email"]
BackendRef references the backend HTTP service.
Group is the group of the referent. For example, "gateway.networking.k8s.io". When unspecified or empty string, core API group is inferred.
Kind is the Kubernetes resource kind of the referent. For example "Service". Defaults to "Service" when not specified. ExternalName services can refer to CNAME DNS records that may live outside of the cluster and as such are difficult to reason about in terms of conformance. They also may not be safe to forward to (see CVE-2021-25740 for more information). Implementations SHOULD NOT support ExternalName Services. Support: Core (Services with a type other than ExternalName) Support: Implementation-specific (Services with type ExternalName)
Name is the name of the referent.
Namespace is the namespace of the backend. When unspecified, the local namespace is inferred. Note that when a namespace different than the local namespace is specified, a ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. Support: Core
Port specifies the destination port number to use for this resource. Port is required when the referent is a Kubernetes Service. In this case, the port number is the service port number, not the target port. For other resources, destination port might be derived from the referent resource or this field.
Weight specifies the proportion of requests forwarded to the referenced backend. This is computed as weight/(sum of all weights in this BackendRefs list). For non-zero values, there may be some epsilon from the exact proportion defined here depending on the precision an implementation supports. Weight is not a percentage and the sum of weights does not need to equal 100. If only one backend is specified and it has a weight greater than 0, 100% of the traffic is forwarded to that backend. If weight is set to 0, no traffic should be forwarded for this entry. If unspecified, weight defaults to 1. Support for this field varies based on the context where used.
PathPrefix specifies a prefix to the value of the authorization request's path header. This allows customizing the path at which the authorization server expects to receive requests. For example, if the authorization server expects requests at "/verify", set this to "/verify". If not specified, the original request path is used.
RequestTimeout is the timeout for the HTTP request. Default timeout is 2 seconds.
Retry specifies the retry policy for HTTP requests to the authorization service.
Attempts specifies the number of retry attempts for a request. Defaults to 1 attempt if not set. A value of 0 effectively disables retries.
Backoff specifies the retry backoff strategy. If not set, a default backoff with a base interval of 1000ms is used. The default max interval is 10 times the base interval.
BaseInterval specifies the base interval used with a fully jittered exponential back-off between retries.
MaxInterval specifies the maximum interval between retry attempts. Defaults to 10 times the BaseInterval if not set.
StatPrefix is an optional prefix to include when emitting stats from the extauthz filter, enabling different instances of the filter to have unique stats.
StatusOnError sets the HTTP status response code that is returned to the client when the auth server returns an error or cannot be reached. Must be in the range of 100-511 inclusive. The default matches the deny response code of 403 Forbidden.
WithRequestBody allows the request body to be buffered and sent to the auth service. Warning: buffering has implications for streaming and therefore performance.
AllowPartialMessage determines if partial messages should be allowed. When true, requests will be sent to the auth service even if they exceed maxRequestBytes. The default behavior is false.
MaxRequestBytes sets the maximum size of a message body to buffer. Requests exceeding this size will receive HTTP 413 and not be sent to the auth service.
PackAsBytes determines if the body should be sent as raw bytes. When true, the body is sent as raw bytes in the raw_body field. When false, the body is sent as UTF-8 string in the body field. The default behavior is false.
ExtProc configuration for ExtProc extension type.
AllowProcessingModeOverride determines if the processing mode can be overridden. Defaults to false, meaning the processing mode cannot be overridden.
AllowedProcessingModeOverrides specifies which processing modes are allowed to override the default. Empty or unspecified means all overrides are allowed (if AllowProcessingModeOverride is true). This is an allowlist; any processing mode in this list will allow the override to the specified mode. If AllowProcessingModeOverride is false, this field is ignored. See: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_proc/v3/ext_proc.proto#envoy-v3-api-field-extensions-filters-http-ext-proc-v3-externalprocessor-allowed-override-modes
RequestBodyMode determines how to handle the request body
RequestHeaderMode determines how to handle the request headers
RequestTrailerMode determines how to handle the request trailers
ResponseBodyMode determines how to handle the response body
ResponseHeaderMode determines how to handle the response headers
ResponseTrailerMode determines how to handle the response trailers
FailOpen determines if requests are allowed when the ext proc service is unavailable. Defaults to true, meaning requests are allowed upstream even if the ext proc service is unavailable.
GrpcService is the GRPC service that will handle the processing.
Authority is the authority header to use for the GRPC service.
BackendRef references the backend GRPC service.
Group is the group of the referent. For example, "gateway.networking.k8s.io". When unspecified or empty string, core API group is inferred.
Kind is the Kubernetes resource kind of the referent. For example "Service". Defaults to "Service" when not specified. ExternalName services can refer to CNAME DNS records that may live outside of the cluster and as such are difficult to reason about in terms of conformance. They also may not be safe to forward to (see CVE-2021-25740 for more information). Implementations SHOULD NOT support ExternalName Services. Support: Core (Services with a type other than ExternalName) Support: Implementation-specific (Services with type ExternalName)
Name is the name of the referent.
Namespace is the namespace of the backend. When unspecified, the local namespace is inferred. Note that when a namespace different than the local namespace is specified, a ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. Support: Core
Port specifies the destination port number to use for this resource. Port is required when the referent is a Kubernetes Service. In this case, the port number is the service port number, not the target port. For other resources, destination port might be derived from the referent resource or this field.
Weight specifies the proportion of requests forwarded to the referenced backend. This is computed as weight/(sum of all weights in this BackendRefs list). For non-zero values, there may be some epsilon from the exact proportion defined here depending on the precision an implementation supports. Weight is not a percentage and the sum of weights does not need to equal 100. If only one backend is specified and it has a weight greater than 0, 100% of the traffic is forwarded to that backend. If weight is set to 0, no traffic should be forwarded for this entry. If unspecified, weight defaults to 1. Support for this field varies based on the context where used.
RequestTimeout is the timeout for the gRPC request. This is the timeout for a specific request.
Retry specifies the retry policy for gRPC streams associated with the service.
Attempts specifies the number of retry attempts for a request. Defaults to 1 attempt if not set. A value of 0 effectively disables retries.
Backoff specifies the retry backoff strategy. If not set, a default backoff with a base interval of 1000ms is used. The default max interval is 10 times the base interval.
BaseInterval specifies the base interval used with a fully jittered exponential back-off between retries.
MaxInterval specifies the maximum interval between retry attempts. Defaults to 10 times the BaseInterval if not set.
MaxMessageTimeout specifies the upper bound of override_message_timeout that may be sent from the external processing server. The default value 0, which effectively disables the override_message_timeout API.
MessageTimeout is the timeout for each message sent to the external processing server.
MetadataOptions allows configuring metadata namespaces to forwarded or received from the external processing server.
Forwarding defines the typed or untyped dynamic metadata namespaces to forward to the external processing server.
ProcessingMode defines how the filter should interact with the request/response streams.
RequestBodyMode determines how to handle the request body
RequestHeaderMode determines how to handle the request headers
RequestTrailerMode determines how to handle the request trailers
ResponseBodyMode determines how to handle the response body
ResponseHeaderMode determines how to handle the response headers
ResponseTrailerMode determines how to handle the response trailers
RouteCacheAction describes the route cache action to be taken when an external processor response is received in response to request headers. The default behavior is "FromResponse" which will only clear the route cache when an external processing response has the clear_route_cache field set.
StatPrefix is an optional prefix to include when emitting stats from the extproc filter, enabling different instances of the filter to have unique stats.
JWT configuration for JWT extension type.
Providers configures named JWT providers. If multiple providers are specified for a given JWT policy, the providers will be `OR`-ed together and will allow validation to any of the providers.
Audiences is the list of audiences to be used for the JWT provider. If specified an incoming JWT must have an 'aud' claim, and it must be in this list. If not specified, the audiences will not be checked in the token.
ClaimsToHeaders is the list of claims to headers to be used for the JWT provider. Optionally set the claims from the JWT payload that you want to extract and add as headers to the request before the request is forwarded to the upstream destination. Note: if ClaimsToHeaders is set, the Envoy route cache will be cleared. This allows the JWT filter to correctly affect routing decisions.
Header is the header the claim will be copied to, for example, "x-sub".
Name is the JWT claim name, for example, "sub".
ForwardToken configures if the JWT token is forwarded to the upstream backend. If true, the header containing the token will be forwarded upstream. If false or not set, the header containing the token will be removed.
Issuer of the JWT. the 'iss' claim of the JWT must match this.
JWKS is the source for the JSON Web Keys to be used to validate the JWT.
LocalJWKS configures getting the public keys to validate the JWT from a Kubernetes configmap, or inline (raw string) JWKS.
ConfigMapRef configures storing the JWK in a Kubernetes ConfigMap in the same namespace as the GatewayExtension. The ConfigMap must have a data key named 'jwks' that contains the JWKS.
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
Inline is the JWKS as the raw, inline JWKS string This can be an individual key, a key set or a pem block public key
RemoteJWKS configures getting the public keys to validate the JWT from a remote JWKS server.
BackendRef is reference to the backend of the JWKS server.
Group is the group of the referent. For example, "gateway.networking.k8s.io". When unspecified or empty string, core API group is inferred.
Kind is the Kubernetes resource kind of the referent. For example "Service". Defaults to "Service" when not specified. ExternalName services can refer to CNAME DNS records that may live outside of the cluster and as such are difficult to reason about in terms of conformance. They also may not be safe to forward to (see CVE-2021-25740 for more information). Implementations SHOULD NOT support ExternalName Services. Support: Core (Services with a type other than ExternalName) Support: Implementation-specific (Services with type ExternalName)
Name is the name of the referent.
Namespace is the namespace of the backend. When unspecified, the local namespace is inferred. Note that when a namespace different than the local namespace is specified, a ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. Support: Core
Port specifies the destination port number to use for this resource. Port is required when the referent is a Kubernetes Service. In this case, the port number is the service port number, not the target port. For other resources, destination port might be derived from the referent resource or this field.
Duration after which the cached JWKS expires. If unspecified, the default cache duration is 5 minutes.
URL is the URL of the remote JWKS server, it must be a full FQDN with protocol, host and path. For example, https://example.com/keys
Name is the unique name of the JWT provider.
TokenSource configures where to find the JWT of the current provider.
HeaderSource configures retrieving token from a header
Header is the name of the header. for example, "Authorization"
Prefix before the token. for example, "Bearer "
QueryParameter configures retrieving token from the query parameter
ValidationMode configures how JWT validation behaves. If unset or empty, Strict mode is used (JWT is required). If set to AllowMissing, unauthenticated requests without a JWT are allowed through. If using this mode, make sure to consider the security implications and consider using an `RBAC` policy to enforce authorization.
OAuth2 configuration for OAuth2 extension type.
AuthorizationEndpoint specifies the endpoint to redirect to for authorization in response to unauthorized requests. If both IssuerURI and this value are specified, the value discovered from the issuer will *not* be used and this takes precedence. Refer to https://datatracker.ietf.org/doc/html/rfc6749#section-3.1 for more details.
BackendRef specifies the Backend to use for the OAuth2 provider.
Group is the group of the referent. For example, "gateway.networking.k8s.io". When unspecified or empty string, core API group is inferred.
Kind is the Kubernetes resource kind of the referent. For example "Service". Defaults to "Service" when not specified. ExternalName services can refer to CNAME DNS records that may live outside of the cluster and as such are difficult to reason about in terms of conformance. They also may not be safe to forward to (see CVE-2021-25740 for more information). Implementations SHOULD NOT support ExternalName Services. Support: Core (Services with a type other than ExternalName) Support: Implementation-specific (Services with type ExternalName)
Name is the name of the referent.
Namespace is the namespace of the backend. When unspecified, the local namespace is inferred. Note that when a namespace different than the local namespace is specified, a ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. Support: Core
Port specifies the destination port number to use for this resource. Port is required when the referent is a Kubernetes Service. In this case, the port number is the service port number, not the target port. For other resources, destination port might be derived from the referent resource or this field.
Weight specifies the proportion of requests forwarded to the referenced backend. This is computed as weight/(sum of all weights in this BackendRefs list). For non-zero values, there may be some epsilon from the exact proportion defined here depending on the precision an implementation supports. Weight is not a percentage and the sum of weights does not need to equal 100. If only one backend is specified and it has a weight greater than 0, 100% of the traffic is forwarded to that backend. If weight is set to 0, no traffic should be forwarded for this entry. If unspecified, weight defaults to 1. Support for this field varies based on the context where used.
Cookies specifies the configuration for the OAuth2 cookies.
DisableAccessTokenSetCookie specifies whether to disable setting the access token cookie. This can be used when the access token is too large to fit in a cookie. When true, the set-cookie response header for the access token will be omitted.
DisableIDTokenSetCookie specifies whether to disable setting the ID token cookie. This can be used when the ID token is too large to fit in a cookie. When true, the set-cookie response header for the ID token will be omitted.
DisableRefreshTokenSetCookie specifies whether to disable setting the refresh token cookie. This can be used when the refresh token is too large to fit in a cookie. When true, the set-cookie response header for the refresh token will be omitted.
CookieDomain specifies the domain to set on the access and ID token cookies. If set, the cookies will be set for the specified domain and all its subdomains. This is useful when requests to subdomains are not required to be re-authenticated after the user has logged into the parent domain. If not set, the cookies will default to the host of the request, not including the subdomains.
Names specifies the names of the cookies used to store the tokens. If not set, the default names will be used.
AccessToken specifies the name of the cookie used to store the access token.
IDToken specifies the name of the cookie used to store the ID token.
SameSite specifies the SameSite attribute for the OAuth2 cookies. If not set, the default is Lax.
Credentials specifies the Oauth2 client credentials to use for authentication.
ClientID specifies the client ID issued to the client during the registration process. Refer to https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1 for more details.
ClientSecretRef specifies a Secret that contains the client secret stored in the key 'client-secret' to use in the authentication request to obtain the access token. Refer to https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1 for more details.
Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
DenyRedirectMatcher specifies the matcher to match requests that should be denied redirects to the authorization endpoint. Matching requests will receive a 401 Unauthorized response instead of being redirected. This is useful for AJAX requests where redirects should be avoided.
Headers specifies the list of HTTP headers to match on requests that should be denied redirects.
Name is the name of the HTTP Header to be matched. Name matching MUST be case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). If multiple entries specify equivalent header names, only the first entry with an equivalent name MUST be considered for a match. Subsequent entries with an equivalent header name MUST be ignored. Due to the case-insensitivity of header names, "foo" and "Foo" are considered equivalent. When a header is repeated in an HTTP request, it is implementation-specific behavior as to how this is represented. Generally, proxies should follow the guidance from the RFC: https://www.rfc-editor.org/rfc/rfc7230.html#section-3.2.2 regarding processing a repeated header, with special handling for "Set-Cookie".
Type specifies how to match against the value of the header. Support: Core (Exact) Support: Implementation-specific (RegularExpression) Since RegularExpression HeaderMatchType has implementation-specific conformance, implementations can support POSIX, PCRE or any other dialects of regular expressions. Please read the implementation's documentation to determine the supported dialect.
Value is the value of HTTP Header to be matched. <gateway:experimental:description> Must consist of printable US-ASCII characters, optionally separated by single tabs or spaces. See: https://tools.ietf.org/html/rfc7230#section-3.2 </gateway:experimental:description> <gateway:experimental:validation:Pattern=`^[!-~]+([\t ]?[!-~]+)*$`>
EndSessionEndpoint specifies the URL that redirects a user's browser to in order to initiate a single logout across all applications and the OpenID provider. Users are directed to this endpoint when they access the logout path. This should only be set when the OpenID provider supports RP-Initiated Logout and "openid" is included in the list of scopes. If both IssuerURI and this value are specified, the value discovered from the issuer will *not* be used and this takes precedence. Refer to https://openid.net/specs/openid-connect-rpinitiated-1_0.html#RPLogout for more details.
ForwardAccessToken specifies whether to forward the access token to the backend service. If set to true, the token is forwarded over a cookie named BearerToken and is also set in the Authorization header. Defaults to false.
IssuerURI specifies the OpenID provider's issuer URL to discover the OpenID provider's configuration. The Issuer must be a URI RFC 3986 [RFC3986] with a scheme component that must be https, a host component, and optionally, port and path components and no query or fragment components. It discovers the authorizationEndpoint, tokenEndpoint, endSessionEndpoint, and jwksURI if specified in the discovery response. Explicit configuration of these options will take precedence over the discovered values. Refer to https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig for more details. Note that the OpenID provider configuration is cached. It is refreshed periodically in the background, and a failed discovery is retried, so a provider that is unreachable when the configuration is first discovered is picked up once it becomes reachable. Discovery stops once authorizationEndpoint, tokenEndpoint, endSessionEndpoint, and jwksURI (when JWT parsing is configured) are all set explicitly, since none of the discovered values are then used.
JWT specifies the configuration for whether and how to process the retrieved access and ID tokens as JSON Web Token.
AccessToken specifies how to process the retrieved access token. This requires the access token cookie to be enabled. Requests missing the token will be rejected. The token will be verified against the provided JWKS. Successfully processed tokens have their payload made available as the 'accessToken' dynamic metadata in the 'envoy.filters.http.jwt_authn' namespace. If omitted, the token will not be attempted to be parsed and verified at all.
Audiences is the list of audiences to be used for the processed token. If specified the token must have an 'aud' claim, and it must be in this list. If not specified, the audiences will not be checked in the token.
ClaimsToHeaders is a list of claims from the token that should be forwarded upstream as a header. Optionally set the claims from the JWT payload that you want to extract and add as headers to the request before the request is forwarded to the upstream destination. Note: if ClaimsToHeaders is set, the Envoy route cache will be cleared. This allows the JWT filter to correctly affect routing decisions.
Header is the header the claim will be copied to, for example, "x-sub".
Name is the JWT claim name, for example, "sub".
IDToken specifies how to process the retrieved ID token. This requires the ID token cookie to be enabled. Requests missing the token will be rejected. The token will be verified against the provided JWKS. Successfully processed tokens have their payload made available as the 'idToken' dynamic metadata in the 'envoy.filters.http.jwt_authn' namespace. If omitted, the token will not be attempted to be parsed and verified at all.
Audiences is the list of audiences to be used for the processed token. If specified the token must have an 'aud' claim, and it must be in this list. If not specified, the audiences will not be checked in the token.
ClaimsToHeaders is a list of claims from the token that should be forwarded upstream as a header. Optionally set the claims from the JWT payload that you want to extract and add as headers to the request before the request is forwarded to the upstream destination. Note: if ClaimsToHeaders is set, the Envoy route cache will be cleared. This allows the JWT filter to correctly affect routing decisions.
Header is the header the claim will be copied to, for example, "x-sub".
Name is the JWT claim name, for example, "sub".
JWKSURI specifies the URL that public keys for validating JWTs should be retrieved from. This must be set if the retrieved access or ID token need to be parsed and IssuerURI is not set for discovery. If both IssuerURI and this value are specified, the value discovered from the issuer will *not* be used and this takes precedence. The URL must point to a valid JWKS definition. Refer to https://datatracker.ietf.org/doc/html/rfc7517#section-5 for more details.
LogoutPath specifies the path to log out a user, clearing their credential cookies. Defaults to /logout.
RedirectURI specifies the URL passed to the authorization endpoint. Defaults to <request-scheme>://<host>/oauth2/redirect, where the URL scheme and host are derived from the original request. Refer to https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.2 for more details.
List of OAuth scopes to be claimed in the authentication request. Defaults to "user" scope if not specified. When using OpenID, the "openid" scope must be included. Refer to https://datatracker.ietf.org/doc/html/rfc6749#section-3.3 for more details.
TokenEndpoint specifies the endpoint on the authorization server to retrieve the access token from. If both IssuerURI and this value are specified, the value discovered from the issuer will *not* be used and this takes precedence. Refer to https://datatracker.ietf.org/doc/html/rfc6749#section-3.2 for more details.
RateLimit configuration for RateLimit extension type.
Domain identifies a rate limiting configuration for the rate limit service. All rate limit requests must specify a domain, which enables the configuration to be per application without fear of overlap (e.g., "api", "web", "admin").
FailOpen determines if requests are limited when the rate limit service is unavailable. Defaults to true, meaning requests are allowed upstream and not limited if the rate limit service is unavailable.
GrpcService is the GRPC service that will handle the rate limiting.
Authority is the authority header to use for the GRPC service.
BackendRef references the backend GRPC service.
Group is the group of the referent. For example, "gateway.networking.k8s.io". When unspecified or empty string, core API group is inferred.
Kind is the Kubernetes resource kind of the referent. For example "Service". Defaults to "Service" when not specified. ExternalName services can refer to CNAME DNS records that may live outside of the cluster and as such are difficult to reason about in terms of conformance. They also may not be safe to forward to (see CVE-2021-25740 for more information). Implementations SHOULD NOT support ExternalName Services. Support: Core (Services with a type other than ExternalName) Support: Implementation-specific (Services with type ExternalName)
Name is the name of the referent.
Namespace is the namespace of the backend. When unspecified, the local namespace is inferred. Note that when a namespace different than the local namespace is specified, a ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. Support: Core
Port specifies the destination port number to use for this resource. Port is required when the referent is a Kubernetes Service. In this case, the port number is the service port number, not the target port. For other resources, destination port might be derived from the referent resource or this field.
Weight specifies the proportion of requests forwarded to the referenced backend. This is computed as weight/(sum of all weights in this BackendRefs list). For non-zero values, there may be some epsilon from the exact proportion defined here depending on the precision an implementation supports. Weight is not a percentage and the sum of weights does not need to equal 100. If only one backend is specified and it has a weight greater than 0, 100% of the traffic is forwarded to that backend. If weight is set to 0, no traffic should be forwarded for this entry. If unspecified, weight defaults to 1. Support for this field varies based on the context where used.
RequestTimeout is the timeout for the gRPC request. This is the timeout for a specific request.
Retry specifies the retry policy for gRPC streams associated with the service.
Attempts specifies the number of retry attempts for a request. Defaults to 1 attempt if not set. A value of 0 effectively disables retries.
Backoff specifies the retry backoff strategy. If not set, a default backoff with a base interval of 1000ms is used. The default max interval is 10 times the base interval.
BaseInterval specifies the base interval used with a fully jittered exponential back-off between retries.
MaxInterval specifies the maximum interval between retry attempts. Defaults to 10 times the BaseInterval if not set.
Timeout provides an optional timeout value for requests to the rate limit service. For rate limiting, prefer using this timeout rather than setting the generic `timeout` on the `GrpcService`. See [envoy issue](https://github.com/envoyproxy/envoy/issues/20070) for more info.
XRateLimitHeaders configures the standard version to use for X-RateLimit headers emitted. See [envoy docs](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ratelimit/v3/rate_limit.proto#envoy-v3-api-field-extensions-filters-http-ratelimit-v3-ratelimit-enable-x-ratelimit-headers) for more info. Disabled by default.
Deprecated: Setting this field has no effect. Type indicates the type of the GatewayExtension to be used.
GatewayExtensionStatus defines the observed state of GatewayExtension.
Conditions is the list of conditions for the GatewayExtension.
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
message is a human readable message indicating details about the transition. This may be an empty string.
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
status of the condition, one of True, False, Unknown.
type of condition in CamelCase or in foo.example.com/CamelCase.
Source: gateway.kgateway.dev_gatewayextensions.yaml
Changes to GatewayExtension (gateway.kgateway.dev/v1alpha1) in each Kgateway version, compared to the version before it.
1 property has changed the description
Released · View GatewayExtension in v2.3.9
6 properties have been added
5 properties have changed the description
Released · View GatewayExtension in v2.3.0
7 properties have been added
1 property is now required
2 properties are no longer required
71 properties have changed the description
Released · View GatewayExtension in v2.2.0
15 properties have been added
Released · View GatewayExtension in v2.1.0
GatewayExtension was already present in this version of Kgateway, the oldest one on kubespec.dev
Released · View GatewayExtension in v2.0.0
No examples of GatewayExtension yet. Contribute one on GitHub.
kubespec.dev