diff --git a/assets/agw-docs/pages/reference/api/api-22x.md b/assets/agw-docs/pages/reference/api/api-22x.md index 24c19b00d..80ff82821 100644 --- a/assets/agw-docs/pages/reference/api/api-22x.md +++ b/assets/agw-docs/pages/reference/api/api-22x.md @@ -1,4 +1,3 @@ - - [agentgateway.dev/v1alpha1](#agentgatewaydevv1alpha1) @@ -7,8 +6,11 @@ ### Resource Types - [AgentgatewayBackend](#agentgatewaybackend) +- [AgentgatewayBackendList](#agentgatewaybackendlist) - [AgentgatewayParameters](#agentgatewayparameters) +- [AgentgatewayParametersList](#agentgatewayparameterslist) - [AgentgatewayPolicy](#agentgatewaypolicy) +- [AgentgatewayPolicyList](#agentgatewaypolicylist) @@ -134,7 +136,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | | `mode` _[APIKeyAuthenticationMode](#apikeyauthenticationmode)_ | Validation mode for api key authentication. | Strict | Enum: [Strict Optional]
Optional: \{\}
| -| `secretRef` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#localobjectreference-v1-core)_ | secretRef references a Kubernetes secret storing a set of API Keys. If there are many keys, 'secretSelector' can be
used instead.
Each entry in the Secret represents one API Key. The key is an arbitrary identifier. The value can either be:
* A string, representing the API Key.
* A JSON object, with two fields, `key` and `metadata`. `key` contains the API Key. `metadata` contains arbitrary JSON
metadata associated with the key, which may be used by other policies. For example, you may write an authorization
policy allow `apiKey.group == 'sales'`.
Example:
apiVersion: v1
kind: Secret
metadata:
name: api-key
stringData:
client1: \|
\{
"key": "k-123",
"metadata": \{
"group": "sales",
"created_at": "2024-10-01T12:00:00Z",
\}
\}
client2: "k-456" | | Optional: \{\}
| +| `secretRef` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#localobjectreference-v1-core)_ | secretRef references a Kubernetes secret storing a set of API Keys. If there are many keys, 'secretSelector' can be
used instead.
Each entry in the Secret represents one API Key. The key is an arbitrary identifier. The value can either be:
* A string, representing the API Key.
* A JSON object, with two fields, `key` and `metadata`. `key` contains the API Key. `metadata` contains arbitrary JSON
metadata associated with the key, which may be used by other policies. For example, you may write an authorization
policy allow `apiKey.group == 'sales'`.
Example:
apiVersion: v1
kind: Secret
metadata:
name: api-key
stringData:
client1: \|
\{
"key": "k-123",
"metadata": \{
"group": "sales",
"created_at": "2024-10-01T12:00:00Z",
\}
\}
client2: "k-456" | | Optional: \{\}
| | `secretSelector` _[SecretSelector](#secretselector)_ | secretSelector selects multiple secrets containing API Keys. If the same key is defined in multiple secrets, the
behavior is undefined.
Each entry in the Secret represents one API Key. The key is an arbitrary identifier. The value can either be:
* A string, representing the API Key.
* A JSON object, with two fields, `key` and `metadata`. `key` contains the API Key. `metadata` contains arbitrary JSON
metadata associated with the key, which may be used by other policies. For example, you may write an authorization
policy allow `apiKey.group == 'sales'`.
Example:
apiVersion: v1
kind: Secret
metadata:
name: api-key
stringData:
client1: \|
\{
"key": "k-123",
"metadata": \{
"group": "sales",
"created_at": "2024-10-01T12:00:00Z",
\}
\}
client2: "k-456" | | Optional: \{\}
| @@ -255,7 +257,8 @@ _Appears in:_ - +_Appears in:_ +- [AgentgatewayBackendList](#agentgatewaybackendlist) | Field | Description | Default | Validation | | --- | --- | --- | --- | @@ -263,11 +266,31 @@ _Appears in:_ | `kind` _string_ | `AgentgatewayBackend` | | | | `kind` _string_ | Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | | Optional: \{\}
| | `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | | Optional: \{\}
| -| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. | | Optional: \{\}
| +| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. | | Optional: \{\}
| | `spec` _[AgentgatewayBackendSpec](#agentgatewaybackendspec)_ | spec defines the desired state of AgentgatewayBackend. | | ExactlyOneOf: [ai static dynamicForwardProxy mcp]
Required: \{\}
| | `status` _[AgentgatewayBackendStatus](#agentgatewaybackendstatus)_ | status defines the current state of AgentgatewayBackend. | | Optional: \{\}
| +#### AgentgatewayBackendList + + + + + + + + + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `apiVersion` _string_ | `agentgateway.dev/v1alpha1` | | | +| `kind` _string_ | `AgentgatewayBackendList` | | | +| `kind` _string_ | Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | | Optional: \{\}
| +| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | | Optional: \{\}
| +| `metadata` _[ListMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#listmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. | | | +| `items` _[AgentgatewayBackend](#agentgatewaybackend) array_ | | | | + + #### AgentgatewayBackendSpec @@ -302,7 +325,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `conditions` _[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#condition-v1-meta) array_ | Conditions is the list of conditions for the backend. | | MaxItems: 8
Optional: \{\}
| +| `conditions` _[Condition](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#condition-v1-meta) array_ | Conditions is the list of conditions for the backend. | | MaxItems: 8
Optional: \{\}
| #### AgentgatewayParameters @@ -316,7 +339,8 @@ https://gateway-api.sigs.k8s.io/reference/spec/#gatewayinfrastructure - +_Appears in:_ +- [AgentgatewayParametersList](#agentgatewayparameterslist) | Field | Description | Default | Validation | | --- | --- | --- | --- | @@ -324,7 +348,7 @@ https://gateway-api.sigs.k8s.io/reference/spec/#gatewayinfrastructure | `kind` _string_ | `AgentgatewayParameters` | | | | `kind` _string_ | Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | | Optional: \{\}
| | `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | | Optional: \{\}
| -| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. | | Optional: \{\}
| +| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. | | Optional: \{\}
| | `spec` _[AgentgatewayParametersSpec](#agentgatewayparametersspec)_ | spec defines the desired state of AgentgatewayParameters. | | Required: \{\}
| | `status` _[AgentgatewayParametersStatus](#agentgatewayparametersstatus)_ | status defines the current state of AgentgatewayParameters. | | Optional: \{\}
| @@ -343,14 +367,34 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | | `logging` _[AgentgatewayParametersLogging](#agentgatewayparameterslogging)_ | logging configuration for Agentgateway. By default, all logs are set to "info" level. | | Optional: \{\}
| -| `rawConfig` _[JSON](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#json-v1-apiextensions-k8s-io)_ | rawConfig provides an opaque mechanism to configure the agentgateway
config file (the agentgateway binary has a '-f' option to specify a
config file, and this is that file). This will be merged with
configuration derived from typed fields like
AgentgatewayParametersLogging.Format, and those typed fields will take
precedence.
Example:
rawConfig:
binds:
- port: 3000
listeners:
- routes:
- policies:
cors:
allowOrigins:
- "*"
allowHeaders:
- mcp-protocol-version
- content-type
- cache-control
backends:
- mcp:
targets:
- name: everything
stdio:
cmd: npx
args: ["@modelcontextprotocol/server-everything"] | | Type: object
Optional: \{\}
| +| `rawConfig` _[JSON](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#json-v1-apiextensions-k8s-io)_ | rawConfig provides an opaque mechanism to configure the agentgateway
config file (the agentgateway binary has a '-f' option to specify a
config file, and this is that file). This will be merged with
configuration derived from typed fields like
AgentgatewayParametersLogging.Format, and those typed fields will take
precedence.
Example:
rawConfig:
binds:
- port: 3000
listeners:
- routes:
- policies:
cors:
allowOrigins:
- "*"
allowHeaders:
- mcp-protocol-version
- content-type
- cache-control
backends:
- mcp:
targets:
- name: everything
stdio:
cmd: npx
args: ["@modelcontextprotocol/server-everything"] | | Type: object
Optional: \{\}
| | `image` _[Image](#image)_ | The agentgateway container image. See
https://kubernetes.io/docs/concepts/containers/images
for details.
Default values, which may be overridden individually:
registry: cr.agentgateway.dev
repository: agentgateway
tag:
pullPolicy: | | Optional: \{\}
| -| `env` _[EnvVar](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#envvar-v1-core) array_ | The container environment variables. These override any existing
values. If you want to delete an environment variable entirely, use
`$patch: delete` with AgentgatewayParametersOverlays instead. Note that
[variable
expansion](https://kubernetes.io/docs/tasks/inject-data-application/define-interdependent-environment-variables/)
does apply, but is highly discouraged -- to set dependent environment
variables, you can use $(VAR_NAME), but it's highly
discouraged. `$$(VAR_NAME)` avoids expansion and results in a literal
`$(VAR_NAME)`. | | Optional: \{\}
| -| `resources` _[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#resourcerequirements-v1-core)_ | The compute resources required by this container. See
https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
for details. | | Optional: \{\}
| +| `env` _[EnvVar](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#envvar-v1-core) array_ | The container environment variables. These override any existing
values. If you want to delete an environment variable entirely, use
`$patch: delete` with AgentgatewayParametersOverlays instead. Note that
[variable
expansion](https://kubernetes.io/docs/tasks/inject-data-application/define-interdependent-environment-variables/)
does apply, but is highly discouraged -- to set dependent environment
variables, you can use $(VAR_NAME), but it's highly
discouraged. `$$(VAR_NAME)` avoids expansion and results in a literal
`$(VAR_NAME)`. | | Optional: \{\}
| +| `resources` _[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#resourcerequirements-v1-core)_ | The compute resources required by this container. See
https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
for details. | | Optional: \{\}
| | `shutdown` _[ShutdownSpec](#shutdownspec)_ | Shutdown delay configuration. How graceful planned or unplanned data
plane changes happen is in tension with how quickly rollouts of the data
plane complete. How long a data plane pod must wait for shutdown to be
perfectly graceful depends on how you have configured your Gateways. | | Optional: \{\}
| | `istio` _[IstioSpec](#istiospec)_ | Configure Istio integration. If enabled, Agentgateway can natively connect to Istio enabled pods with mTLS. | | Optional: \{\}
| +#### AgentgatewayParametersList + + + + + + + + + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `apiVersion` _string_ | `agentgateway.dev/v1alpha1` | | | +| `kind` _string_ | `AgentgatewayParametersList` | | | +| `kind` _string_ | Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | | Optional: \{\}
| +| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | | Optional: \{\}
| +| `metadata` _[ListMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#listmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. | | | +| `items` _[AgentgatewayParameters](#agentgatewayparameters) array_ | | | | + + #### AgentgatewayParametersLogging @@ -387,6 +431,23 @@ _Appears in:_ | `text` | | +#### AgentgatewayParametersObjectMetadata + + + + + + + +_Appears in:_ +- [KubernetesResourceOverlay](#kubernetesresourceoverlay) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `labels` _object (keys:string, values:string)_ | Map of string keys and values that can be used to organize and categorize
(scope and select) objects. May match selectors of replication controllers
and services.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels | | Optional: \{\}
| +| `annotations` _object (keys:string, values:string)_ | Annotations is an unstructured key value map stored with a resource that may be
set by external tools to store and retrieve arbitrary metadata. They are not
queryable and should be preserved when modifying objects.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations | | Optional: \{\}
| + + #### AgentgatewayParametersOverlays @@ -421,10 +482,10 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | | `logging` _[AgentgatewayParametersLogging](#agentgatewayparameterslogging)_ | logging configuration for Agentgateway. By default, all logs are set to "info" level. | | Optional: \{\}
| -| `rawConfig` _[JSON](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#json-v1-apiextensions-k8s-io)_ | rawConfig provides an opaque mechanism to configure the agentgateway
config file (the agentgateway binary has a '-f' option to specify a
config file, and this is that file). This will be merged with
configuration derived from typed fields like
AgentgatewayParametersLogging.Format, and those typed fields will take
precedence.
Example:
rawConfig:
binds:
- port: 3000
listeners:
- routes:
- policies:
cors:
allowOrigins:
- "*"
allowHeaders:
- mcp-protocol-version
- content-type
- cache-control
backends:
- mcp:
targets:
- name: everything
stdio:
cmd: npx
args: ["@modelcontextprotocol/server-everything"] | | Type: object
Optional: \{\}
| +| `rawConfig` _[JSON](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#json-v1-apiextensions-k8s-io)_ | rawConfig provides an opaque mechanism to configure the agentgateway
config file (the agentgateway binary has a '-f' option to specify a
config file, and this is that file). This will be merged with
configuration derived from typed fields like
AgentgatewayParametersLogging.Format, and those typed fields will take
precedence.
Example:
rawConfig:
binds:
- port: 3000
listeners:
- routes:
- policies:
cors:
allowOrigins:
- "*"
allowHeaders:
- mcp-protocol-version
- content-type
- cache-control
backends:
- mcp:
targets:
- name: everything
stdio:
cmd: npx
args: ["@modelcontextprotocol/server-everything"] | | Type: object
Optional: \{\}
| | `image` _[Image](#image)_ | The agentgateway container image. See
https://kubernetes.io/docs/concepts/containers/images
for details.
Default values, which may be overridden individually:
registry: cr.agentgateway.dev
repository: agentgateway
tag:
pullPolicy: | | Optional: \{\}
| -| `env` _[EnvVar](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#envvar-v1-core) array_ | The container environment variables. These override any existing
values. If you want to delete an environment variable entirely, use
`$patch: delete` with AgentgatewayParametersOverlays instead. Note that
[variable
expansion](https://kubernetes.io/docs/tasks/inject-data-application/define-interdependent-environment-variables/)
does apply, but is highly discouraged -- to set dependent environment
variables, you can use $(VAR_NAME), but it's highly
discouraged. `$$(VAR_NAME)` avoids expansion and results in a literal
`$(VAR_NAME)`. | | Optional: \{\}
| -| `resources` _[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#resourcerequirements-v1-core)_ | The compute resources required by this container. See
https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
for details. | | Optional: \{\}
| +| `env` _[EnvVar](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#envvar-v1-core) array_ | The container environment variables. These override any existing
values. If you want to delete an environment variable entirely, use
`$patch: delete` with AgentgatewayParametersOverlays instead. Note that
[variable
expansion](https://kubernetes.io/docs/tasks/inject-data-application/define-interdependent-environment-variables/)
does apply, but is highly discouraged -- to set dependent environment
variables, you can use $(VAR_NAME), but it's highly
discouraged. `$$(VAR_NAME)` avoids expansion and results in a literal
`$(VAR_NAME)`. | | Optional: \{\}
| +| `resources` _[ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#resourcerequirements-v1-core)_ | The compute resources required by this container. See
https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
for details. | | Optional: \{\}
| | `shutdown` _[ShutdownSpec](#shutdownspec)_ | Shutdown delay configuration. How graceful planned or unplanned data
plane changes happen is in tension with how quickly rollouts of the data
plane complete. How long a data plane pod must wait for shutdown to be
perfectly graceful depends on how you have configured your Gateways. | | Optional: \{\}
| | `istio` _[IstioSpec](#istiospec)_ | Configure Istio integration. If enabled, Agentgateway can natively connect to Istio enabled pods with mTLS. | | Optional: \{\}
| | `deployment` _[KubernetesResourceOverlay](#kubernetesresourceoverlay)_ | deployment allows specifying overrides for the generated Deployment resource. | | Optional: \{\}
| @@ -455,7 +516,8 @@ _Appears in:_ - +_Appears in:_ +- [AgentgatewayPolicyList](#agentgatewaypolicylist) | Field | Description | Default | Validation | | --- | --- | --- | --- | @@ -463,11 +525,31 @@ _Appears in:_ | `kind` _string_ | `AgentgatewayPolicy` | | | | `kind` _string_ | Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | | Optional: \{\}
| | `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | | Optional: \{\}
| -| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. | | Optional: \{\}
| +| `metadata` _[ObjectMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#objectmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. | | Optional: \{\}
| | `spec` _[AgentgatewayPolicySpec](#agentgatewaypolicyspec)_ | spec defines the desired state of AgentgatewayPolicy. | | ExactlyOneOf: [targetRefs targetSelectors]
Required: \{\}
| | `status` _[PolicyStatus](#policystatus)_ | status defines the current state of AgentgatewayPolicy. | | Optional: \{\}
| +#### AgentgatewayPolicyList + + + + + + + + + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `apiVersion` _string_ | `agentgateway.dev/v1alpha1` | | | +| `kind` _string_ | `AgentgatewayPolicyList` | | | +| `kind` _string_ | Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds | | Optional: \{\}
| +| `apiVersion` _string_ | APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources | | Optional: \{\}
| +| `metadata` _[ListMeta](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#listmeta-v1-meta)_ | Refer to Kubernetes API documentation for fields of `metadata`. | | | +| `items` _[AgentgatewayPolicy](#agentgatewaypolicy) array_ | | | | + + #### AgentgatewayPolicySpec @@ -536,7 +618,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `secretRef` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#localobjectreference-v1-core)_ | SecretRef references a Kubernetes Secret containing the AWS credentials.
The Secret must have keys "accessKey", "secretKey", and optionally "sessionToken". | | Required: \{\}
| +| `secretRef` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#localobjectreference-v1-core)_ | SecretRef references a Kubernetes Secret containing the AWS credentials.
The Secret must have keys "accessKey", "secretKey", and optionally "sessionToken". | | Required: \{\}
| #### AzureOpenAIConfig @@ -589,7 +671,7 @@ _Appears in:_ _Validation:_ -- ExactlyOneOf: [key secretRef passthrough aws gcp] +- ExactlyOneOf: [key secretRef passthrough aws] _Appears in:_ - [BackendFull](#backendfull) @@ -600,10 +682,9 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | | `key` _string_ | key provides an inline key to use as the value of the Authorization header.
This option is the least secure; usage of a Secret is preferred. | | MaxLength: 2048
Optional: \{\}
| -| `secretRef` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#localobjectreference-v1-core)_ | secretRef references a Kubernetes secret storing the key to use the authorization value. This must be stored in the
'Authorization' key. | | Optional: \{\}
| +| `secretRef` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#localobjectreference-v1-core)_ | secretRef references a Kubernetes secret storing the key to use the authorization value. This must be stored in the
'Authorization' key. | | Optional: \{\}
| | `passthrough` _[BackendAuthPassthrough](#backendauthpassthrough)_ | passthrough passes through an existing token that has been sent by the client and validated. Other policies, like
JWT and API Key authentication, will strip the original client credentials. Passthrough backend authentication
causes the original token to be added back into the request. If there are no client authentication policies on the
request, the original token would be unchanged, so this would have no effect. | | Optional: \{\}
| | `aws` _[AwsAuth](#awsauth)_ | Auth specifies an explicit AWS authentication method for the backend.
When omitted, we will try to use the default AWS SDK authentication methods. | | Optional: \{\}
| -| `gcp` _[GcpAuth](#gcpauth)_ | Auth specifies to use a Google authentication method for the backend.
When omitted, we will try to use the default AWS SDK authentication methods. | | Optional: \{\}
| #### BackendAuthPassthrough @@ -637,7 +718,7 @@ _Appears in:_ | `tcp` _[BackendTCP](#backendtcp)_ | tcp defines settings for managing TCP connections to the backend. | | Optional: \{\}
| | `tls` _[BackendTLS](#backendtls)_ | tls defines settings for managing TLS connections to the backend.
If this field is set, TLS will be initiated to the backend; the system trusted CA certificates will be used to
validate the server, and the SNI will automatically be set based on the destination. | | AtMostOneOf: [verifySubjectAltNames insecureSkipVerify]
Optional: \{\}
| | `http` _[BackendHTTP](#backendhttp)_ | http defines settings for managing HTTP requests to the backend. | | Optional: \{\}
| -| `auth` _[BackendAuth](#backendauth)_ | auth defines settings for managing authentication to the backend | | ExactlyOneOf: [key secretRef passthrough aws gcp]
Optional: \{\}
| +| `auth` _[BackendAuth](#backendauth)_ | auth defines settings for managing authentication to the backend | | ExactlyOneOf: [key secretRef passthrough aws]
Optional: \{\}
| | `ai` _[BackendAI](#backendai)_ | ai specifies settings for AI workloads. This is only applicable when connecting to a Backend of type 'ai'. | | AtLeastOneOf: [prompt promptGuard defaults overrides modelAliases promptCaching routes]
Optional: \{\}
| | `mcp` _[BackendMCP](#backendmcp)_ | mcp specifies settings for MCP workloads. This is only applicable when connecting to a Backend of type 'mcp'. | | AtLeastOneOf: [authorization authentication]
Optional: \{\}
| @@ -659,7 +740,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | | `version` _[HTTPVersion](#httpversion)_ | version specifies the HTTP protocol version to use when connecting to the backend.
If not specified, the version is automatically determined:
* Service types can specify it with 'appProtocol' on the Service port.
* If traffic is identified as gRPC, HTTP2 is used.
* If the incoming traffic was plaintext HTTP, the original protocol will be used.
* If the incoming traffic was HTTPS, HTTP1 will be used. This is because most clients will
transparently upgrade HTTPS traffic to HTTP2, even if the backend doesn't support it | | Enum: [HTTP1 HTTP2]
Optional: \{\}
| -| `requestTimeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#duration-v1-meta)_ | requestTimeout specifies the deadline for receiving a response from the backend. | | Optional: \{\}
| +| `requestTimeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#duration-v1-meta)_ | requestTimeout specifies the deadline for receiving a response from the backend. | | Optional: \{\}
| #### BackendMCP @@ -700,7 +781,7 @@ _Appears in:_ | `tcp` _[BackendTCP](#backendtcp)_ | tcp defines settings for managing TCP connections to the backend. | | Optional: \{\}
| | `tls` _[BackendTLS](#backendtls)_ | tls defines settings for managing TLS connections to the backend.
If this field is set, TLS will be initiated to the backend; the system trusted CA certificates will be used to
validate the server, and the SNI will automatically be set based on the destination. | | AtMostOneOf: [verifySubjectAltNames insecureSkipVerify]
Optional: \{\}
| | `http` _[BackendHTTP](#backendhttp)_ | http defines settings for managing HTTP requests to the backend. | | Optional: \{\}
| -| `auth` _[BackendAuth](#backendauth)_ | auth defines settings for managing authentication to the backend | | ExactlyOneOf: [key secretRef passthrough aws gcp]
Optional: \{\}
| +| `auth` _[BackendAuth](#backendauth)_ | auth defines settings for managing authentication to the backend | | ExactlyOneOf: [key secretRef passthrough aws]
Optional: \{\}
| #### BackendTCP @@ -720,7 +801,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | | `keepalive` _[Keepalive](#keepalive)_ | keepAlive defines settings for enabling TCP keepalives on the connection. | | Optional: \{\}
| -| `connectTimeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#duration-v1-meta)_ | connectTimeout defines the deadline for establishing a connection to the destination. | | Optional: \{\}
| +| `connectTimeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#duration-v1-meta)_ | connectTimeout defines the deadline for establishing a connection to the destination. | | Optional: \{\}
| #### BackendTLS @@ -740,8 +821,8 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `mtlsCertificateRef` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#localobjectreference-v1-core) array_ | mtlsCertificateRef enables mutual TLS to the backend, using the specified key (tls.key) and cert (tls.crt) from the
refenced Secret.
An optional 'ca.cert' field, if present, will be used to verify the server certificate if present. If
caCertificateRefs is also specified, the caCertificateRefs field takes priority.
If unspecified, no client certificate will be used. | | MaxItems: 1
Optional: \{\}
| -| `caCertificateRefs` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#localobjectreference-v1-core) array_ | caCertificateRefs defines the CA certificate ConfigMap to use to verify the server certificate.
If unset, the system's trusted certificates are used. | | MaxItems: 1
Optional: \{\}
| +| `mtlsCertificateRef` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#localobjectreference-v1-core) array_ | mtlsCertificateRef enables mutual TLS to the backend, using the specified key (tls.key) and cert (tls.crt) from the
refenced Secret.
An optional 'ca.cert' field, if present, will be used to verify the server certificate if present. If
caCertificateRefs is also specified, the caCertificateRefs field takes priority.
If unspecified, no client certificate will be used. | | MaxItems: 1
Optional: \{\}
| +| `caCertificateRefs` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#localobjectreference-v1-core) array_ | caCertificateRefs defines the CA certificate ConfigMap to use to verify the server certificate.
If unset, the system's trusted certificates are used. | | MaxItems: 1
Optional: \{\}
| | `insecureSkipVerify` _[InsecureTLSMode](#insecuretlsmode)_ | insecureSkipVerify originates TLS but skips verification of the backend's certificate.
WARNING: This is an insecure option that should only be used if the risks are understood.
There are two modes:
* All disables all TLS verification
* Hostname verifies the CA certificate is trusted, but ignores any mismatch of hostname/SANs. Note that this method
is still insecure; prefer setting verifySubjectAltNames to customize the valid hostnames if possible. | | Enum: [All Hostname]
Optional: \{\}
| | `sni` _[SNI](#sni)_ | sni specifies the Server Name Indicator (SNI) to be used in the TLS handshake. If unset, the SNI is automatically
set based on the destination hostname. | | MaxLength: 253
MinLength: 1
Pattern: `^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
Optional: \{\}
| | `verifySubjectAltNames` _[ShortString](#shortstring) array_ | verifySubjectAltNames specifies the Subject Alternative Names (SAN) to verify in the server certificate.
If not present, the destination hostname is automatically used. | | MaxItems: 16
MaxLength: 256
MinItems: 1
MinLength: 1
Optional: \{\}
| @@ -765,7 +846,7 @@ _Appears in:_ | `tcp` _[BackendTCP](#backendtcp)_ | tcp defines settings for managing TCP connections to the backend. | | Optional: \{\}
| | `tls` _[BackendTLS](#backendtls)_ | tls defines settings for managing TLS connections to the backend.
If this field is set, TLS will be initiated to the backend; the system trusted CA certificates will be used to
validate the server, and the SNI will automatically be set based on the destination. | | AtMostOneOf: [verifySubjectAltNames insecureSkipVerify]
Optional: \{\}
| | `http` _[BackendHTTP](#backendhttp)_ | http defines settings for managing HTTP requests to the backend. | | Optional: \{\}
| -| `auth` _[BackendAuth](#backendauth)_ | auth defines settings for managing authentication to the backend | | ExactlyOneOf: [key secretRef passthrough aws gcp]
Optional: \{\}
| +| `auth` _[BackendAuth](#backendauth)_ | auth defines settings for managing authentication to the backend | | ExactlyOneOf: [key secretRef passthrough aws]
Optional: \{\}
| | `ai` _[BackendAI](#backendai)_ | ai specifies settings for AI workloads. This is only applicable when connecting to a Backend of type 'ai'. | | AtLeastOneOf: [prompt promptGuard defaults overrides modelAliases promptCaching routes]
Optional: \{\}
| @@ -786,7 +867,7 @@ _Appears in:_ | `tcp` _[BackendTCP](#backendtcp)_ | tcp defines settings for managing TCP connections to the backend. | | Optional: \{\}
| | `tls` _[BackendTLS](#backendtls)_ | tls defines settings for managing TLS connections to the backend.
If this field is set, TLS will be initiated to the backend; the system trusted CA certificates will be used to
validate the server, and the SNI will automatically be set based on the destination. | | AtMostOneOf: [verifySubjectAltNames insecureSkipVerify]
Optional: \{\}
| | `http` _[BackendHTTP](#backendhttp)_ | http defines settings for managing HTTP requests to the backend. | | Optional: \{\}
| -| `auth` _[BackendAuth](#backendauth)_ | auth defines settings for managing authentication to the backend | | ExactlyOneOf: [key secretRef passthrough aws gcp]
Optional: \{\}
| +| `auth` _[BackendAuth](#backendauth)_ | auth defines settings for managing authentication to the backend | | ExactlyOneOf: [key secretRef passthrough aws]
Optional: \{\}
| | `mcp` _[BackendMCP](#backendmcp)_ | mcp specifies settings for MCP workloads. This is only applicable when connecting to a Backend of type 'mcp'. | | AtLeastOneOf: [authorization authentication]
Optional: \{\}
| @@ -807,7 +888,7 @@ _Appears in:_ | `mode` _[BasicAuthenticationMode](#basicauthenticationmode)_ | validation mode for basic auth authentication. | Strict | Enum: [Strict Optional]
Optional: \{\}
| | `realm` _string_ | realm specifies the 'realm' to return in the WWW-Authenticate header for failed authentication requests.
If unset, "Restricted" will be used. | | Optional: \{\}
| | `users` _string array_ | users provides an inline list of username/password pairs that will be accepted.
Each entry represents one line of the htpasswd format: https://httpd.apache.org/docs/2.4/programs/htpasswd.html.
Note: passwords should be the hash of the password, not the raw password. Use the `htpasswd` or similar commands
to generate a hash. MD5, bcrypt, crypt, and SHA-1 are supported.
Example:
users:
- "user1:$apr1$ivPt0D4C$DmRhnewfHRSrb3DQC.WHC."
- "user2:$2y$05$r3J4d3VepzFkedkd/q1vI.pBYIpSqjfN0qOARV3ScUHysatnS0cL2" | | MaxItems: 256
MinItems: 1
Optional: \{\}
| -| `secretRef` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#localobjectreference-v1-core)_ | secretRef references a Kubernetes secret storing the .htaccess file. The Secret must have a key named '.htaccess',
and should contain the complete .htaccess file.
Note: passwords should be the hash of the password, not the raw password. Use the `htpasswd` or similar commands
to generate a hash. MD5, bcrypt, crypt, and SHA-1 are supported.
Example:
apiVersion: v1
kind: Secret
metadata:
name: basic-auth
stringData:
.htaccess: \|
alice:$apr1$3zSE0Abt$IuETi4l5yO87MuOrbSE4V.
bob:$apr1$Ukb5LgRD$EPY2lIfY.A54jzLELNIId/ | | Optional: \{\}
| +| `secretRef` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#localobjectreference-v1-core)_ | secretRef references a Kubernetes secret storing the .htaccess file. The Secret must have a key named '.htaccess',
and should contain the complete .htaccess file.
Note: passwords should be the hash of the password, not the raw password. Use the `htpasswd` or similar commands
to generate a hash. MD5, bcrypt, crypt, and SHA-1 are supported.
Example:
apiVersion: v1
kind: Secret
metadata:
name: basic-auth
stringData:
.htaccess: \|
alice:$apr1$3zSE0Abt$IuETi4l5yO87MuOrbSE4V.
bob:$apr1$Ukb5LgRD$EPY2lIfY.A54jzLELNIId/ | | Optional: \{\}
| #### BasicAuthenticationMode @@ -988,7 +1069,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `backendRef` _[BackendObjectReference](https://gateway-api.sigs.k8s.io/reference/spec/#backendobjectreference)_ | backendRef references the External Authorization server to reach.
Supported types: Service and Backend. | | Required: \{\}
| +| `backendRef` _[BackendObjectReference](#backendobjectreference)_ | backendRef references the External Authorization server to reach.
Supported types: Service and Backend. | | Required: \{\}
| | `grpc` _[AgentExtAuthGRPC](#agentextauthgrpc)_ | grpc specifies that the gRPC External Authorization
[protocol](https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/auth/v3/external_auth.proto) should be used. | | Optional: \{\}
| | `http` _[AgentExtAuthHTTP](#agentextauthhttp)_ | http specifies that the HTTP protocol should be used for connecting to the authorization server.
The authorization server must return a `200` status code, otherwise the request is considered an authorization failure. | | Optional: \{\}
| | `forwardBody` _[ExtAuthBody](#extauthbody)_ | forwardBody configures whether to include the HTTP body in the request. If enabled, the request body will be
buffered. | | Optional: \{\}
| @@ -1023,7 +1104,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `backendRef` _[BackendObjectReference](https://gateway-api.sigs.k8s.io/reference/spec/#backendobjectreference)_ | backendRef references the External Processor server to reach.
Supported types: Service and Backend. | | Required: \{\}
| +| `backendRef` _[BackendObjectReference](#backendobjectreference)_ | backendRef references the External Processor server to reach.
Supported types: Service and Backend. | | Required: \{\}
| #### FieldDefault @@ -1077,7 +1158,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | | `field` _[ShortString](#shortstring)_ | The name of the field. | | MaxLength: 256
MinLength: 1
Required: \{\}
| -| `value` _[JSON](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#json-v1-apiextensions-k8s-io)_ | The field default value, which can be any JSON Data Type. | | Required: \{\}
| +| `value` _[JSON](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#json-v1-apiextensions-k8s-io)_ | The field default value, which can be any JSON Data Type. | | Required: \{\}
| #### Frontend @@ -1116,12 +1197,12 @@ _Appears in:_ | --- | --- | --- | --- | | `maxBufferSize` _integer_ | maxBufferSize defines the maximum size HTTP body that will be buffered into memory.
Bodies will only be buffered for policies which require buffering.
If unset, this defaults to 2mb. | | Minimum: 1
Optional: \{\}
| | `http1MaxHeaders` _integer_ | http1MaxHeaders defines the maximum number of headers that are allowed in HTTP/1.1 requests.
If unset, this defaults to 100. | | Maximum: 4096
Minimum: 1
Optional: \{\}
| -| `http1IdleTimeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#duration-v1-meta)_ | http1IdleTimeout defines the timeout before an unused connection is closed.
If unset, this defaults to 10 minutes. | | Optional: \{\}
| +| `http1IdleTimeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#duration-v1-meta)_ | http1IdleTimeout defines the timeout before an unused connection is closed.
If unset, this defaults to 10 minutes. | | Optional: \{\}
| | `http2WindowSize` _integer_ | http2WindowSize indicates the initial window size for stream-level flow control for received data. | | Minimum: 1
Optional: \{\}
| | `http2ConnectionWindowSize` _integer_ | http2ConnectionWindowSize indicates the initial window size for connection-level flow control for received data. | | Minimum: 1
Optional: \{\}
| | `http2FrameSize` _integer_ | http2FrameSize sets the maximum frame size to use.
If unset, this defaults to 16kb | | Maximum: 1.677215e+06
Minimum: 16384
Optional: \{\}
| -| `http2KeepaliveInterval` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#duration-v1-meta)_ | | | Optional: \{\}
| -| `http2KeepaliveTimeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#duration-v1-meta)_ | | | Optional: \{\}
| +| `http2KeepaliveInterval` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#duration-v1-meta)_ | | | Optional: \{\}
| +| `http2KeepaliveTimeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#duration-v1-meta)_ | | | Optional: \{\}
| #### FrontendTCP @@ -1155,48 +1236,13 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `handshakeTimeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#duration-v1-meta)_ | handshakeTimeout specifies the deadline for a TLS handshake to complete.
If unset, this defaults to 15s. | | Optional: \{\}
| +| `handshakeTimeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#duration-v1-meta)_ | handshakeTimeout specifies the deadline for a TLS handshake to complete.
If unset, this defaults to 15s. | | Optional: \{\}
| | `alpnProtocols` _[TinyString](#tinystring)_ | alpnProtocols sets the Application Level Protocol Negotiation (ALPN) value to use in the TLS handshake.
If not present, defaults to ["h2", "http/1.1"]. | | MaxItems: 16
MaxLength: 64
MinItems: 1
MinLength: 1
Optional: \{\}
| | `minProtocolVersion` _[TLSVersion](#tlsversion)_ | MinTLSVersion configures the minimum TLS version to support. | | Enum: [1.2 1.3]
Optional: \{\}
| | `maxProtocolVersion` _[TLSVersion](#tlsversion)_ | MaxTLSVersion configures the maximum TLS version to support. | | Enum: [1.2 1.3]
Optional: \{\}
| | `cipherSuites` _[CipherSuite](#ciphersuite) array_ | CipherSuites configures the list of cipher suites for a TLS listener.
The value is a comma-separated list of cipher suites, e.g "TLS13_AES_256_GCM_SHA384,TLS13_AES_128_GCM_SHA256".
Use in the TLS options field of a TLS listener. | | Enum: [TLS13_AES_256_GCM_SHA384 TLS13_AES_128_GCM_SHA256 TLS13_CHACHA20_POLY1305_SHA256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256]
Optional: \{\}
| -#### GcpAuth - - - -gcp specifies how to authenticate on Google Cloud Platform - - - -_Appears in:_ -- [BackendAuth](#backendauth) - -| Field | Description | Default | Validation | -| --- | --- | --- | --- | -| `type` _[GcpAuthType](#gcpauthtype)_ | The type of token to generate. To authenticate to GCP services, generally an AccessToken is used. To authenticate
to CloudRun, an IdToken is used. | | Enum: [AccessToken IdToken]
Optional: \{\}
| -| `audience` _[ShortString](#shortstring)_ | audience allows explicitly configuring the `aud` of the ID Token. Ony valid with `IdToken` type.
If not set, the aud is automatically derived from the backend hostname. | | MaxLength: 256
MinLength: 1
Optional: \{\}
| - - -#### GcpAuthType - -_Underlying type:_ _string_ - - - -_Validation:_ -- Enum: [AccessToken IdToken] - -_Appears in:_ -- [GcpAuth](#gcpauth) - -| Field | Description | -| --- | --- | -| `AccessToken` | | -| `IdToken` | | - - #### GeminiConfig @@ -1227,7 +1273,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `backendRef` _[BackendObjectReference](https://gateway-api.sigs.k8s.io/reference/spec/#backendobjectreference)_ | backendRef references the Rate Limit server to reach.
Supported types: Service and Backend. | | Required: \{\}
| +| `backendRef` _[BackendObjectReference](#backendobjectreference)_ | backendRef references the Rate Limit server to reach.
Supported types: Service and Backend. | | Required: \{\}
| | `domain` _[ShortString](#shortstring)_ | domain specifies the domain under which this limit should apply.
This is an arbitrary string that enables a rate limit server to distinguish between different applications. | | MaxLength: 256
MinLength: 1
Required: \{\}
| | `descriptors` _[RateLimitDescriptor](#ratelimitdescriptor) array_ | Descriptors define the dimensions for rate limiting. These values are passed to the rate limit service which applies
configured limits based on them. Each descriptor represents a single rate limit rule with one or more entries. | | MaxItems: 16
MinItems: 1
Required: \{\}
| @@ -1335,7 +1381,7 @@ _Appears in:_ | `repository` _string_ | The image repository (name). | | Optional: \{\}
| | `tag` _string_ | The image tag. | | Optional: \{\}
| | `digest` _string_ | The hash digest of the image, e.g. `sha256:12345...` | | Optional: \{\}
| -| `pullPolicy` _[PullPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#pullpolicy-v1-core)_ | The image pull policy for the container. See
https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy
for details. | | Optional: \{\}
| +| `pullPolicy` _[PullPolicy](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#pullpolicy-v1-core)_ | The image pull policy for the container. See
https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy
for details. | | Optional: \{\}
| #### InsecureTLSMode @@ -1461,8 +1507,29 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | | `retries` _integer_ | retries specifies the maximum number of keep-alive probes to send before dropping the connection.
If unset, this defaults to 9. | | Maximum: 64
Minimum: 1
Optional: \{\}
| -| `time` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#duration-v1-meta)_ | time specifies the number of seconds a connection needs to be idle before keep-alive probes start being sent.
If unset, this defaults to 180s. | | Optional: \{\}
| -| `interval` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#duration-v1-meta)_ | interval specifies the number of seconds between keep-alive probes.
If unset, this defaults to 180s. | | Optional: \{\}
| +| `time` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#duration-v1-meta)_ | time specifies the number of seconds a connection needs to be idle before keep-alive probes start being sent.
If unset, this defaults to 180s. | | Optional: \{\}
| +| `interval` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#duration-v1-meta)_ | interval specifies the number of seconds between keep-alive probes.
If unset, this defaults to 180s. | | Optional: \{\}
| + + +#### KubernetesResourceOverlay + + + +KubernetesResourceOverlay provides a mechanism to customize generated +Kubernetes resources using [Strategic Merge +Patch](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-api-machinery/strategic-merge-patch.md) +semantics. + + + +_Appears in:_ +- [AgentgatewayParametersOverlays](#agentgatewayparametersoverlays) +- [AgentgatewayParametersSpec](#agentgatewayparametersspec) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `metadata` _[AgentgatewayParametersObjectMetadata](#agentgatewayparametersobjectmetadata)_ | Refer to Kubernetes API documentation for fields of `metadata`. | | Optional: \{\}
| +| `spec` _[JSON](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#json-v1-apiextensions-k8s-io)_ | Spec provides an opaque mechanism to configure the resource Spec.
This field accepts a complete or partial Kubernetes resource spec (e.g., PodSpec, ServiceSpec)
and will be merged with the generated configuration using **Strategic Merge Patch** semantics.
The patch is applied after all other fields are applied.
If you merge-patch the same resource from AgentgatewayParameters on the
GatewayClass and also from AgentgatewayParameters on the Gateway, then
the GatewayClass merge-patch happens first.
# Strategic Merge Patch & Deletion Guide
This merge strategy allows you to override individual fields, merge lists, or delete items
without needing to provide the entire resource definition.
**1. Replacing Values (Scalars):**
Simple fields (strings, integers, booleans) in your config will overwrite the generated defaults.
**2. Merging Lists (Append/Merge):**
Lists with "merge keys" (like `containers` which merges on `name`, or `tolerations` which merges on `key`)
will append your items to the generated list, or update existing items if keys match.
**3. Deleting Fields or List Items ($patch: delete):**
To remove a field or list item from the generated resource, use the
`$patch: delete` directive. This works for both map fields and list items,
and is the recommended approach because it works with both client-side
and server-side apply.
spec:
template:
spec:
# Delete pod-level securityContext
securityContext:
$patch: delete
# Delete nodeSelector
nodeSelector:
$patch: delete
containers:
- name: agentgateway
# Delete container-level securityContext
securityContext:
$patch: delete
**4. Null Values (server-side apply only):**
Setting a field to `null` can also remove it, but this ONLY works with
`kubectl apply --server-side` or equivalent. With regular client-side
`kubectl apply`, null values are stripped by kubectl before reaching
the API server, so the deletion won't occur. Prefer `$patch: delete`
for consistent behavior across both apply modes.
spec:
template:
spec:
nodeSelector: null # Removes nodeSelector (server-side apply only!)
**5. Replacing Maps Entirely ($patch: replace):**
To replace an entire map with your values (instead of merging), use `$patch: replace`.
This removes all existing keys and replaces them with only your specified keys.
spec:
template:
spec:
nodeSelector:
$patch: replace
custom-key: custom-value
**6. Replacing Lists Entirely ($patch: replace):**
If you want to strictly define a list and ignore all generated defaults, use `$patch: replace`.
service:
spec:
ports:
- $patch: replace
- name: http
port: 80
targetPort: 8080
protocol: TCP
- name: https
port: 443
targetPort: 8443
protocol: TCP | | Type: object
Optional: \{\}
| #### LLMProvider @@ -1564,7 +1631,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `resourceMetadata` _object (keys:string, values:[JSON](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#json-v1-apiextensions-k8s-io))_ | ResourceMetadata defines the metadata to use for MCP resources. | | Optional: \{\}
| +| `resourceMetadata` _object (keys:string, values:[JSON](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#json-v1-apiextensions-k8s-io))_ | ResourceMetadata defines the metadata to use for MCP resources. | | Optional: \{\}
| | `provider` _[McpIDP](#mcpidp)_ | McpIDP specifies the identity provider to use for authentication | | Enum: [Auth0 Keycloak]
Optional: \{\}
| | `issuer` _[ShortString](#shortstring)_ | Issuer identifies the IdP that issued the JWT. This corresponds to the 'iss' claim (https://tools.ietf.org/html/rfc7519#section-4.1.1). | | MaxLength: 256
MinLength: 1
Optional: \{\}
| | `audiences` _string array_ | audiences specify the list of allowed audiences that are allowed access. This corresponds to the 'aud' claim (https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.3).
If unset, any audience is allowed. | | MaxItems: 64
MinItems: 1
Optional: \{\}
| @@ -1638,8 +1705,8 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `namespaces` _[LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#labelselector-v1-meta)_ | namespace is the label selector in which namespaces Services should be selected from.
If unset, only the namespace of the AgentgatewayBackend is searched. | | Optional: \{\}
| -| `services` _[LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#labelselector-v1-meta)_ | services is the label selector for which Services should be selected. | | Optional: \{\}
| +| `namespaces` _[LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#labelselector-v1-meta)_ | namespace is the label selector in which namespaces Services should be selected from.
If unset, only the namespace of the AgentgatewayBackend is searched. | | Optional: \{\}
| +| `services` _[LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#labelselector-v1-meta)_ | services is the label selector for which Services should be selected. | | Optional: \{\}
| #### McpTarget @@ -1969,8 +2036,8 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | | `jwksPath` _string_ | Path to IdP jwks endpoint, relative to the root, commonly ".well-known/jwks.json". | | MaxLength: 2000
MinLength: 1
Required: \{\}
| -| `cacheDuration` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#duration-v1-meta)_ | | 5m | Optional: \{\}
| -| `backendRef` _[BackendObjectReference](https://gateway-api.sigs.k8s.io/reference/spec/#backendobjectreference)_ | backendRef references the remote JWKS server to reach.
Supported types are Service and (static) Backend. An AgentgatewayPolicy containing backend tls config
can then be attached to the service/backend in order to set tls options for a connection to the remote jwks source. | | Required: \{\}
| +| `cacheDuration` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#duration-v1-meta)_ | | 5m | Optional: \{\}
| +| `backendRef` _[BackendObjectReference](#backendobjectreference)_ | backendRef references the remote JWKS server to reach.
Supported types are Service and (static) Backend. An AgentgatewayPolicy containing backend tls config
can then be attached to the service/backend in order to set tls options for a connection to the remote jwks source. | | Required: \{\}
| #### ResourceAdd @@ -2132,7 +2199,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `request` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.34/#duration-v1-meta)_ | request specifies a timeout for an individual request from the gateway to a backend. This covers the time from when
the request first starts being sent from the gateway to when the full response has been received from the backend. | | Optional: \{\}
| +| `request` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v/#duration-v1-meta)_ | request specifies a timeout for an individual request from the gateway to a backend. This covers the time from when
the request first starts being sent from the gateway to when the full response has been received from the backend. | | Optional: \{\}
| @@ -2150,7 +2217,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `backendRef` _[BackendObjectReference](https://gateway-api.sigs.k8s.io/reference/spec/#backendobjectreference)_ | backendRef references the OTLP server to reach.
Supported types: Service and AgentgatewayBackend. | | Required: \{\}
| +| `backendRef` _[BackendObjectReference](#backendobjectreference)_ | backendRef references the OTLP server to reach.
Supported types: Service and AgentgatewayBackend. | | Required: \{\}
| | `protocol` _[TracingProtocol](#tracingprotocol)_ | protocol specifies the OTLP protocol variant to use. | HTTP | Enum: [HTTP GRPC]
Optional: \{\}
| | `attributes` _[LogTracingAttributes](#logtracingattributes)_ | attributes specify customizations to the key-value pairs that are included in the trace. | | AtLeastOneOf: [remove add]
Optional: \{\}
| | `resources` _[ResourceAdd](#resourceadd) array_ | resources describe the entity producing telemetry and specify the resources to be included in the trace. | | Optional: \{\}
| @@ -2277,122 +2344,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `backendRef` _[BackendObjectReference](https://gateway-api.sigs.k8s.io/reference/spec/#backendobjectreference)_ | backendRef references the webhook server to reach.
Supported types: Service and Backend. | | Required: \{\}
| +| `backendRef` _[BackendObjectReference](#backendobjectreference)_ | backendRef references the webhook server to reach.
Supported types: Service and Backend. | | Required: \{\}
| | `forwardHeaderMatches` _HTTPHeaderMatch array_ | ForwardHeaderMatches defines a list of HTTP header matches that will be
used to select the headers to forward to the webhook.
Request headers are used when forwarding requests and response headers
are used when forwarding responses.
By default, no headers are forwarded. | | Optional: \{\}
| - -## Shared Types - -The following types are defined in the shared package and used across multiple APIs. - -#### Authorization - -Authorization defines the configuration for role-based access control. - -| Field | Type | Description | -|-------|------|-------------| -| `policy` | [AuthorizationPolicy](#authorizationpolicy) | Policy specifies the Authorization rule to evaluate. A policy matches when **any** of the conditions evaluates to true. **Required.** | -| `action` | [AuthorizationPolicyAction](#authorizationpolicyaction) | Action defines whether the rule allows or denies the request if matched. If unspecified, the default is "Allow". | - -#### AuthorizationPolicy - -AuthorizationPolicy defines a single Authorization rule. - -| Field | Type | Description | -|-------|------|-------------| -| `matchExpressions` | [][CELExpression](#celexpression) | MatchExpressions defines a set of conditions that must be satisfied for the rule to match. These expression should be in the form of a Common Expression Language (CEL) expression. **Required.** | - -#### AuthorizationPolicyAction - -_Underlying type:_ _string_ - -AuthorizationPolicyAction defines the action to take when the RBACPolicies matches. - -#### CELExpression - -_Underlying type:_ _string_ - -CELExpression represents a Common Expression Language (CEL) expression. - -**Validation:** -- MinLength=1 -- MaxLength=16384 - -#### HeaderModifiers - -HeaderModifiers can be used to define the policy to modify request and response headers. - -**Validation:** -- AtLeastOneOf=request;response - -| Field | Type | Description | -|-------|------|-------------| -| `request` | *gwv1.HTTPHeaderFilter | Request modifies request headers. | -| `response` | *gwv1.HTTPHeaderFilter | Response modifies response headers. | - -#### KubernetesResourceOverlay - -KubernetesResourceOverlay provides a mechanism to customize generated Kubernetes resources using [Strategic Merge Patch](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-api-machinery/strategic-merge-patch.md) semantics. # Overlay Application Order Overlays are applied **after** all typed configuration fields have been processed. The full merge order is: 1. GatewayClass typed configuration fields (e.g., replicas, image settings from parametersRef) 2. Gateway typed configuration fields (from infrastructure.parametersRef) 3. GatewayClass overlays are applied 4. Gateway overlays are applied This ordering means Gateway-level configuration overrides GatewayClass-level configuration at each stage. For example, if both levels set the same label, the Gateway value wins. - -| Field | Type | Description | -|-------|------|-------------| -| `metadata` | *[ObjectMetadata](#objectmetadata) | metadata defines a subset of object metadata to be customized. Labels and annotations are merged with existing values. If both GatewayClass and Gateway parameters define the same label or annotation key, the Gateway value takes precedence (applied second). | -| `spec` | *apiextensionsv1.JSON | Spec provides an opaque mechanism to configure the resource Spec. This field accepts a complete or partial Kubernetes resource spec (e.g., PodSpec, ServiceSpec) and will be merged with the generated configuration using **Strategic Merge Patch** semantics. # Application Order Overlays are applied after all typed configuration fields from both levels. The full merge order is: 1. GatewayClass typed configuration fields 2. Gateway typed configuration fields 3. GatewayClass overlays 4. Gateway overlays (can override all previous values) # Strategic Merge Patch & Deletion Guide This merge strategy allows you to override individual fields, merge lists, or delete items without needing to provide the entire resource definition. **1. Replacing Values (Scalars):** Simple fields (strings, integers, booleans) in your config will overwrite the generated defaults. **2. Merging Lists (Append/Merge):** Lists with "merge keys" (like `containers` which merges on `name`, or `tolerations` which merges on `key`) will append your items to the generated list, or update existing items if keys match. **3. Deleting Fields or List Items ($patch: delete):** To remove a field or list item from the generated resource, use the `$patch: delete` directive. This works for both map fields and list items, and is the recommended approach because it works with both client-side and server-side apply. spec: template: spec: # Delete pod-level securityContext securityContext: $patch: delete # Delete nodeSelector nodeSelector: $patch: delete containers: # Be sure to use the correct proxy name here or you will add a container instead of modifying a container: - name: proxy-name # Delete container-level securityContext securityContext: $patch: delete **4. Null Values (server-side apply only):** Setting a field to `null` can also remove it, but this ONLY works with `kubectl apply --server-side` or equivalent. With regular client-side `kubectl apply`, null values are stripped by kubectl before reaching the API server, so the deletion won't occur. Prefer `$patch: delete` for consistent behavior across both apply modes. spec: template: spec: nodeSelector: null # Removes nodeSelector (server-side apply only!) **5. Replacing Maps Entirely ($patch: replace):** To replace an entire map with your values (instead of merging), use `$patch: replace`. This removes all existing keys and replaces them with only your specified keys. spec: template: spec: nodeSelector: $patch: replace custom-key: custom-value **6. Replacing Lists Entirely ($patch: replace):** If you want to strictly define a list and ignore all generated defaults, use `$patch: replace`. service: spec: ports: - $patch: replace - name: http port: 80 targetPort: 8080 protocol: TCP - name: https port: 443 targetPort: 8443 protocol: TCP | - -#### LongString - -_Underlying type:_ _string_ - -**Validation:** -- MinLength=1 -- MaxLength=1024 - -#### ObjectMetadata - -ObjectMetadata contains labels and annotations for metadata overlays. - -| Field | Type | Description | -|-------|------|-------------| -| `labels` | map[string]string | Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels | -| `annotations` | map[string]string | Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations | - -#### PolicyAncestorStatus - -| Field | Type | Description | -|-------|------|-------------| -| `ancestorRef` | gwv1.ParentReference | AncestorRef corresponds with a ParentRef in the spec that this PolicyAncestorStatus struct describes the status of. **Required.** | -| `controllerName` | string | ControllerName is a domain/path string that indicates the name of the controller that wrote this status. This corresponds with the controllerName field on GatewayClass. Example: "example.net/gateway-controller". The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are valid Kubernetes names (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names). Controllers MUST populate this field when writing status. Controllers should ensure that entries to status populated with their ControllerName are cleaned up when they are no longer necessary. **Required.** | -| `conditions` | []metav1.Condition | Conditions describes the status of the Policy with respect to the given Ancestor. | - -#### PolicyStatus - -| Field | Type | Description | -|-------|------|-------------| -| `conditions` | []metav1.Condition | | -| `ancestors` | [][PolicyAncestorStatus](#policyancestorstatus) | **Required.** | - -#### SNI - -_Underlying type:_ _string_ - -**Validation:** -- MinLength=1 -- MaxLength=253 -- Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$` - -#### ShortString - -_Underlying type:_ _string_ - -**Validation:** -- MinLength=1 -- MaxLength=256 - -#### TinyString - -_Underlying type:_ _string_ - -**Validation:** -- MinLength=1 -- MaxLength=64 diff --git a/assets/agw-docs/pages/reference/helm/2.2.x/agentgateway.md b/assets/agw-docs/pages/reference/helm/2.2.x/agentgateway.md index 75c5fd356..a95fe9023 100644 --- a/assets/agw-docs/pages/reference/helm/2.2.x/agentgateway.md +++ b/assets/agw-docs/pages/reference/helm/2.2.x/agentgateway.md @@ -4,7 +4,7 @@ | Key | Type | Description | Default | |-----|------|-------------|---------| | affinity | object | Set affinity rules for pod scheduling, such as 'nodeAffinity:'. | `{}` | -| controller | object | Configure the agentgateway control plane deployment. | `{"extraEnv":{},"image":{"pullPolicy":"","registry":"","repository":"controller","tag":""},"logLevel":"info","replicaCount":1,"service":{"ports":{"agwGrpc":9978,"health":9093,"metrics":9092},"type":"ClusterIP"},"strategy":{},"xds":{"tls":{"enabled":false}}}` | +| controller | object | Configure the agentgateway control plane deployment. | `{"extraEnv":{},"image":{"pullPolicy":"","registry":"","repository":"controller","tag":""},"logLevel":"info","podDisruptionBudget":{},"replicaCount":1,"service":{"ports":{"agwGrpc":9978,"health":9093,"metrics":9092},"type":"ClusterIP"},"strategy":{},"xds":{"tls":{"enabled":false}}}` | | controller.extraEnv | object | Add extra environment variables to the controller container. | `{}` | | controller.image | object | Configure the controller container image. | `{"pullPolicy":"","registry":"","repository":"controller","tag":""}` | | controller.image.pullPolicy | string | Set the image pull policy for the controller. | `""` | @@ -12,6 +12,7 @@ | controller.image.repository | string | Set the image repository for the controller. | `"controller"` | | controller.image.tag | string | Set the image tag for the controller. | `""` | | controller.logLevel | string | Set the log level for the controller. | `"info"` | +| controller.podDisruptionBudget | object | Set pod disruption budget for the controller. Note that this does not affect the data plane. E.g.: podDisruptionBudget: minAvailable: 100% | `{}` | | controller.replicaCount | int | Set the number of controller pod replicas. | `1` | | controller.service | object | Configure the controller service. | `{"ports":{"agwGrpc":9978,"health":9093,"metrics":9092},"type":"ClusterIP"}` | | controller.service.ports | object | Set the service ports for gRPC and health endpoints. | `{"agwGrpc":9978,"health":9093,"metrics":9092}` | diff --git a/assets/agw-docs/snippets/metrics-control-plane-22x.md b/assets/agw-docs/snippets/metrics-control-plane-22x.md index 7f891565a..c9b07fc22 100644 --- a/assets/agw-docs/snippets/metrics-control-plane-22x.md +++ b/assets/agw-docs/snippets/metrics-control-plane-22x.md @@ -1,8 +1,11 @@ Name|Type|Labels|Help --|--|--|-- +kgateway_agentgateway_xds_rejects_total|counter||Total number of xDS responses rejected by agentgateway proxy kgateway_controller_reconcile_duration_seconds|histogram|controller, name, namespace|Reconcile duration for controller kgateway_controller_reconciliations_running|gauge|controller, name, namespace|Number of reconciliations currently running kgateway_controller_reconciliations_total|counter|controller, name, namespace, result|Total number of controller reconciliations +kgateway_envoy_xds_rejects_active|gauge|gateway_namespace, gateway_name, type_url|Number of xDS responses currently rejected by envoy proxy +kgateway_envoy_xds_rejects_total|counter|gateway_namespace, gateway_name, type_url|Total number of xDS responses rejected by envoy proxy kgateway_resources_managed|gauge|namespace, parent, resource|Current number of resources managed kgateway_resources_status_sync_duration_seconds|histogram|gateway, namespace, resource|Duration of time for a resource update to receive a status report kgateway_resources_status_syncs_completed_total|counter|gateway, namespace, resource|Total number of status syncs completed for resources @@ -14,6 +17,9 @@ kgateway_status_syncer_status_syncs_total|counter|name, namespace, syncer, resul kgateway_translator_translation_duration_seconds|histogram|name, namespace, translator|Translation duration kgateway_translator_translations_running|gauge|name, namespace, translator|Current number of translations running kgateway_translator_translations_total|counter|name, namespace, translator, result|Total number of translations +kgateway_xds_auth_rq_failure_total|counter||Total number of failed xDS auth requests +kgateway_xds_auth_rq_success_total|counter||Total number of successful xDS auth requests +kgateway_xds_auth_rq_total|counter||Total number of xDS auth requests kgateway_xds_snapshot_resources|gauge|gateway, namespace, resource|Current number of resources in XDS snapshot kgateway_xds_snapshot_sync_duration_seconds|histogram|gateway, namespace|Duration of time for a gateway resource update to be synced in an XDS snapshot kgateway_xds_snapshot_syncs_total|counter|gateway, namespace|Total number of XDS snapshot syncs