Application Gateway for Containers API specification for Kubernetes

"application-cookie"

AffinityTypeApplicationCookie is a session affinity type for an application cookie

"managed-cookie"

AffinityTypeManagedCookie is a session affinity type for a managed cookie

"Accepted"

AlbReasonAccepted indicates that the Application Gateway for Containers resource are accepted by the controller.

"Ready"

AlbReasonDeploymentReady indicates the Application Gateway for Containers resource deployment status.

"InProgress"

AlbReasonInProgress indicates whether the Application Gateway for Containers resource is in the process of being created, updated, or deleted.

"Accepted"

AlbConditionTypeAccepted indicates whether the Application Gateway for Containers resource are accepted by the controller.

"Deployment"

AlbConditionTypeDeployment indicates the deployment status of the Application Gateway for Containers resource.

Associations are subnet resource IDs the Application Gateway for Containers resource are associated with.

Known condition types are:

• “Accepted”
• “Ready”

Object’s metadata.

Spec is the specifications for Application Gateway for Containers resource.

Status defines the current state of Application Gateway for Containers resource.

Object’s metadata.

Spec is the BackendLoadBalancingPolicy specification.

Status defines the current state of BackendLoadBalancingPolicy.

"Accepted"

BackendLoadBalancingPolicyReasonAccepted is used to set the BackendLoadBalancingPolicyConditionReason to Accepted When the given BackendLoadBalancingPolicy is correctly configured

"Conflicted"

BackendLoadBalancingPolicyReasonConflicted is used when the target ref conflicts with a pre-existing policy target

"InvalidBackendLoadBalancingPolicy"

BackendLoadBalancingPolicyReasonInvalid is the reason when the BackendLoadBalancingPolicy isn’t Accepted

"InvalidGroup"

BackendLoadBalancingPolicyReasonInvalidGroup is used when the group is invalid

"InvalidKind"

BackendLoadBalancingPolicyReasonInvalidKind is used when the kind/group is invalid

"InvalidName"

BackendLoadBalancingPolicyReasonInvalidName is used when the name is invalid

"InvalidService"

BackendLoadBalancingPolicyReasonInvalidService is used when the Service is invalid

"NoTargetReference"

BackendLoadBalancingPolicyReasonNoTargetReference is used when there’s no target reference

"RefNotPermitted"

BackendLoadBalancingPolicyReasonRefNotPermitted is used when the ref isn’t permitted

"ResolvedRefs"

BackendLoadBalancingPolicyReasonResolvedRefs is used to set the BackendLoadBalancingPolicyConditionReason to ResolvedRefs when the given BackendLoadBalancingPolicy has correct references

"Accepted"

BackendLoadBalancingPolicyConditionAccepted is used to set the BackendLoadBalancingPolicyConditionType to Accepted

"ResolvedRefs"

BackendLoadBalancingPolicyConditionResolvedRefs is used to set the BackendLoadBalancingPolicyCondition to ResolvedRefs

Port is the port to use for connection to the backend

TargetRefs identifies a list of API objects to apply policy to.

LoadBalancing defines the schema for configuring Load Balancing options

Object’s metadata.

Spec is the BackendTLSPolicy specification.

Status defines the current state of BackendTLSPolicy.

(Members of CommonTLSPolicy are embedded into this type.)

Sni is the server name to use for the TLS connection to the backend.

Ports specifies the list of ports where the policy is applied.

ClientCertificateRef is the reference to the client certificate to use for the TLS connection to the backend.

Port is the port to use for the TLS connection to the backend

TargetRef identifies an API object to apply policy to.

Override defines policy configuration that should override policy configuration attached below the targeted resource in the hierarchy.

Note: Override is currently not supported and result in a validation error. Support for Override will be added in a future release.

Default defines default policy configuration for the targeted resource.

Conditions describe the current conditions of the BackendTLSPolicy.

Implementations should prefer to express BackendTLSPolicy conditions using the BackendTLSPolicyConditionType and BackendTLSPolicyConditionReason constants so that operators and tools can converge on a common vocabulary to describe BackendTLSPolicy state.

Known condition types are:

• “Accepted”
• “ResolvedRefs”

Verify provides the options to verify the peer certificate.

CaCertificateRef is the CA certificate used to verify peer certificate.

SubjectAltName is the subject alternative name used to verify peer certificate.

(Members of NamespacedPolicyTargetReference are embedded into this type.)

SectionNames is the name of the section within the target resource. When unspecified, this targetRef targets the entire resource. In the following resources, SectionNames is interpreted as the following:

• Gateway: Listener Name
• Service: Port Name

If a SectionNames is specified, but doesn’t exist on the targeted object, the Policy fails to attach, and the policy implementation will record a ResolvedRefs or similar Condition in the Policy’s status.

Object’s metadata.

Spec is the FrontendTLSPolicy specification.

Status defines the current state of FrontendTLSPolicy.

Verify provides the options to verify the peer certificate.

Type is the type of the policy.

TargetRef identifies an API object to apply policy to.

Default defines default policy configuration for the targeted resource.

Override defines policy configuration that should override policy configuration attached below the targeted resource in the hierarchy.

Note: Override is currently not supported and result in a validation error. Support for Override will be added in a future release.

Conditions describe the current conditions of the FrontendTLSPolicy.

Implementations should prefer to express FrontendTLSPolicy conditions using the FrontendTLSPolicyConditionType and FrontendTLSPolicyConditionReason constants so that operators and tools can converge on a common vocabulary to describe FrontendTLSPolicy state.

Known condition types are:

• “Accepted”

"predefined"

PredefinedFrontendTLSPolicyType is the type of the predefined Frontend TLS Policy.

"2023-06"

PredefinedPolicy202306 is the name of the predefined Frontend TLS Policy for the policy “2023-06”.

"2023-06-S"

PredefinedPolicy202306Strict is the name of the predefined Frontend TLS Policy for the policy “2023-06-S”. This is a strict version of the policy “2023-06”.

Authority if present is used as the value of the Authority header in the health check.

Service allows the configuration of a Health check registered under a different service name.

Name is the name of the HTTP Header to be matched. Name matching MUST be case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).

If multiple entries specify equivalent header names, the first entry with an equivalent name MUST be considered for a match. Subsequent entries with an equivalent header name MUST be ignored. Due to the case-insensitivity of header names, “foo” and “Foo” are considered equivalent.

Value is the value of HTTP Header to be matched.

Body defines the HTTP body matchers to use for HealthCheck checks.

StatusCodes defines the HTTP status code matchers to use for HealthCheck checks.

Type defines the type of path modifier. More types may be added in a future release of the API.

Values may be added to this enum, implementations must ensure unknown values won’t cause a crash.

Unknown values here must result in the implementation setting the Accepted Condition for the rule to be false

ReplaceFullPath specifies the value with which to replace the full path of a request during a rewrite or redirect.

ReplacePrefixMatch specifies the value with which to replace the prefix match of a request during a rewrite or redirect. For example, a request to “/foo/bar” with a prefix match of “/foo” and a ReplacePrefixMatch of “/xyz” would be modified to “/xyz/bar”.

This matches the behavior of the PathPrefix match type. This matches full path elements. A path element refers to the list of labels in the path split by the / separator. When specified, a trailing / is ignored. For example, the paths /abc, /abc/, and /abc/def would all match the prefix /abc, but the path /abcd wouldn’t.

ReplacePrefixMatch is only compatible with a PathPrefix HTTPRouteMatch. Using any other HTTPRouteMatch type on the same HTTPRouteRule results in the implementation setting the Accepted Condition for the Route to status: False.

"ReplaceFullPath"

FullPathHTTPPathModifier replaces the full path with the specified value.

"ReplacePrefixMatch"

PrefixMatchHTTPPathModifier replaces any prefix path with the substitution value. For example, a path with a prefix match of “/foo” and a ReplacePrefixMatch substitution of “/bar” replace “/foo” with “/bar” in matching requests.

This matches the behavior of the PathPrefix match type. This matches full path elements. A path element refers to the list of labels in the path split by the / separator. When specified, a trailing / is ignored. For example, the paths /abc, /abc/, and /abc/def would all match the prefix /abc, but the path /abcd wouldn’t.

Host is the host header value to use for HealthCheck checks.

Path is the path to use for HealthCheck checks.

Match defines the HTTP matchers to use for HealthCheck checks.

Set overwrites the request with the given header (name, value) before the action.

Input: GET /foo HTTP/1.1 my-header: foo

Config: set: - name: “my-header” value: “bar”

Output: GET /foo HTTP/1.1 my-header: bar

Add adds the given header(s) (name, value) to the request before the action. It appends to any existing values associated with the header name.

Input: GET /foo HTTP/1.1 my-header: foo

Config: add: - name: “my-header” value: “bar,baz”

Output: GET /foo HTTP/1.1 my-header: foo,bar,baz

Remove the given header(s) from the HTTP request before the action. The value of Remove is a list of HTTP header names. Header names are case-insensitive (see https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).

Input: GET /foo HTTP/1.1 my-header1: foo my-header2: bar my-header3: baz

Config: remove: [“my-header1”, “my-header3”]

Output: GET /foo HTTP/1.1 my-header2: bar

Object’s metadata.

Spec is the HealthCheckPolicy specification.

Status defines the current state of HealthCheckPolicy.

"BackendTLSPolicyNotFound"

BackendTLSPolicyConditionNotFound is used when the BackendTLSPolicy is not found for the service.

"Accepted"

HealthCheckPolicyReasonAccepted is used to set the HealthCheckPolicyConditionReason to Accepted. When the given HealthCheckPolicy is correctly configured.

"InvalidHealthCheckPolicy"

HealthCheckPolicyReasonInvalid is the reason when the HealthCheckPolicy isn’t Accepted.

"InvalidGroup"

HealthCheckPolicyReasonInvalidGroup is used when the group is invalid.

"InvalidKind"

HealthCheckPolicyReasonInvalidKind is used when the kind/group is invalid.

"InvalidName"

HealthCheckPolicyReasonInvalidName is used when the name is invalid.

"InvalidPort"

HealthCheckPolicyReasonInvalidPort is used when the port is invalid.

"InvalidService"

HealthCheckPolicyReasonInvalidService is used when the Service is invalid.

"NoTargetReference"

HealthCheckPolicyReasonNoTargetReference is used when there’s no target reference.

"OverrideNotSupported"

HealthCheckPolicyReasonOverrideNotSupported is used when the override isn’t supported.

"RefNotPermitted"

HealthCheckPolicyReasonRefNotPermitted is used when the ref isn’t permitted.

"ResolvedRefs"

HealthCheckPolicyReasonResolvedRefs is used when the targetRef was resolved successfully.

"SectionNamesNotPermitted"

HealthCheckPolicyReasonSectionNamesNotPermitted is used when the section names aren’t permitted.

"UnsupportedStatusCodes"

HealthCheckPolicyReasonUnsupportedStatusCodes is used when the HealthCheckPolicy match StatusCodes are not supported.

"Accepted"

HealthCheckPolicyConditionAccepted is used to set the HealthCheckPolicyConditionType to Accepted.

"ResolvedRefs"

HealthCheckPolicyConditionResolvedRefs is used to set the HealthCheckPolicyCondition to ResolvedRefs.

Interval is the number of seconds between HealthCheck checks.

Timeout is the number of seconds after which the HealthCheck check is considered failed.

Port is the port to use for HealthCheck checks.

UnhealthyThreshold is the number of consecutive failed HealthCheck checks.

HealthyThreshold is the number of consecutive successful HealthCheck checks.

UseTLS indicates whether health check should enforce TLS. By default, health check will use the same protocol as the service if the same port is used for health check. If the port is different, health check will be plaintext.

HTTP defines the HTTP constraint specification for the HealthCheck of a target resource.

GRPC configures a gRPC v1 HealthCheck (https://github.com/grpc/grpc-proto/blob/master/grpc/health/v1/health.proto) against the target resource.

TargetRef identifies an API object to apply policy to.

Override defines policy configuration that should override policy configuration attached below the targeted resource in the hierarchy.

Note: Override is currently not supported and will result in a validation error. Support for Override will be added in a future release.

Default defines default policy configuration for the targeted resource.

Conditions describe the current conditions of the HealthCheckPolicy.

Implementations should prefer to express HealthCheckPolicy conditions using the HealthCheckPolicyConditionType and HealthCheckPolicyConditionReason constants so that operators and tools can converge on a common vocabulary to describe HealthCheckPolicy state.

Known condition types are:

• “Accepted”

Port indicates the port on the backend service

Name must refer to a name on a port on the backend service

Protocol should be one of “HTTP”, “HTTPS”

Service identifies the BackendSetting this status describes

Errors are a list of errors relating to this setting

Valid indicates that there are no validation errors present on this BackendSetting

Service is the name of a backend service that this configuration applies to

Ports can be used to indicate if the backend service is listening on HTTP or HTTPS

TrustedRootCertificate can be used to supply a certificate for the gateway to trust when communicating to the backend on a port specified as https

SessionAffinity allows client requests to be consistently given to the same backend

Timeouts define a set of timeout parameters to be applied to an Ingress

LoadBalancing defines the load balancing policy for the backend service

Object’s metadata.

Spec is the IngressExtension specification.

"Accepted"

IngressExtensionReasonAccepted is used to set the IngressExtensionConditionAccepted to Accepted

"HasValidationErrors"

IngressExtensionReasonHasErrors indicates there are some validation errors

"NoValidationErrors"

IngressExtensionReasonNoErrors indicates there are no validation errors

"PartiallyAcceptedWithErrors"

IngressExtensionReasonPartiallyAccepted is used to set the IngressExtensionConditionAccepted to Accepted, but with nonfatal validation errors

"Accepted"

IngressExtensionConditionAccepted indicates if the IngressExtension is accepted (reconciled) by the controller

"Errors"

IngressExtensionConditionErrors indicates if there are validation or build errors on the extension

Rules define the rules per host

BackendSettings defines a set of configuration options for Ingress service backends

Rules have detailed status information regarding each Rule

BackendSettings has detailed status information regarding each BackendSettings

Conditions describe the current conditions of the IngressExtension. Known condition types are:

• “Accepted”
• “Errors”

Type identifies the type of rewrite

RequestHeaderModifier defines a schema that modifies request headers.

RequestHeaderModifier defines a schema that modifies response headers.

URLRewrite defines a schema that modifies a request during forwarding.

Host is used to match against Ingress rules with the same hostname in order to identify which rules affect these settings

AdditionalHostnames specifies more hostnames to listen on

Rewrites defines the rewrites for the rule

RequestRedirect defines the redirect behavior for the rule

Host identifies the rule this status describes

Errors are a list of errors relating to this setting

Valid indicates that there are no validation errors present on this rule

RequestTimeout defines the timeout used by the load balancer when forwarding requests to a backend service

Strategy defines the policy to use when load balancing traffic to the backend service. Default is round-robin.

SlowStart defines the schema for Slow Start specification

"least-request"

LoadBalancingLeastRequest is used to set the LoadBalancingStrategy to least-request

"ring-hash"

LoadBalancingRingHash is used to set the LoadBalancingStrategy to ring-hash

"round-robin"

LoadBalancingRoundRobin is used to set the LoadBalancingStrategy to round-robin

CaCertificateRef is the CA certificate used to verify peer certificate.

SubjectAltNames is the list of subject alternative names used to verify peer certificate.

"Accepted"

"Conflicted"

"Deployed"

"DeploymentFailed"

"Invalid"

"InvalidCertificateRef"

"InvalidGroup"

"InvalidKind"

"InvalidName"

"InvalidService"

"InvalidTargetReference"

"NoDeployment"

"NoTargetReference"

"OperationFailed"

"OverrideNotSupported"

"Pending"

"Programmed"

"ProgrammingFailed"

"RefNotPermitted"

"ResolvedRefs"

"SectionNamesNotPermitted"

"Accepted"

"Deployment"

"Programmed"

"ResolvedRefs"

TargetRef is the reference to the target object that this policy applied to

Conditions describe the current conditions of the Application Gateway for Containers IP Access Rules as they relate to a particular targetRef.

Name is the name of the policy.

FrontendTLSPolicyType specifies the frontend TLS policy type

"HTTP"

ProtocolHTTP implies that the service uses HTTP.

"HTTPS"

ProtocolHTTPS implies that the service uses HTTPS.

"TCP"

ProtocolTCP implies that the service uses plain TCP.

Scheme is the scheme to be used in the value of the Location header in the response. When empty, the scheme of the request is used.

Hostname is the hostname to be used in the value of the Location header in the response. When empty, the hostname in the Host header of the request is used.

Path defines parameters used to modify the path of the incoming request. The modified path is then used to construct the Location header. When empty, the request path is used as-is.

Port is the port to be used in the value of the Location header in the response.

If no port is specified, the redirect port MUST be derived using the following rules:

• If redirect scheme is not-empty, the redirect port MUST be the well-known port associated with the redirect scheme. Specifically “http” to port 80 and “https” to port 443. If the redirect scheme doesn’t have a well-known port, the listener port of the Gateway SHOULD be used.
• If redirect scheme is empty, the redirect port MUST be the Gateway Listener port.

Implementations SHOULD NOT add the port number in the ‘Location’ header in the following cases:

• A Location header that uses HTTP (whether that is determined via the Listener protocol or the Scheme field) and use port 80.
• A Location header that uses HTTPS (whether that is determined via the Listener protocol or the Scheme field) and use port 443.

StatusCode is the HTTP status code to be used in response.

Values may be added to this enum, implementations must ensure that unknown values won’t cause a crash.

"RequestHeaderModifier"

RequestHeaderModifier can be used to add or remove an HTTP header from an HTTP request before it’s sent to the upstream target.

"ResponseHeaderModifier"

ResponseHeaderModifier can be used to add or remove an HTTP header from an HTTP response before it’s sent to the client.

"URLRewrite"

URLRewrite can be used to modify a request during forwarding.

Object’s metadata.

Spec is the RoutePolicy specification.

Status defines the current state of RoutePolicy.

"Accepted"

RoutePolicyReasonAccepted is used to set the RoutePolicyConditionReason to Accepted When the given RoutePolicy is correctly configured

"AcceptedWithTimeoutConflict"

RoutePolicyReasonAcceptedWithTimeoutConflict is used to set the RoutePolicyConditionReason to AcceptedWithTimeoutConflict When the given RoutePolicy is correctly configured but has a timeout conflict with the target route

"InvalidRoutePolicy"

RoutePolicyReasonInvalid is the reason when the RoutePolicy isn’t Accepted

"InvalidGRPCRoute"

RoutePolicyReasonInvalidGRPCRoute is used when the GRPCRoute is invalid

"InvalidGroup"

RoutePolicyReasonInvalidGroup is used when the group is invalid

"InvalidHTTPRoute"

RoutePolicyReasonInvalidHTTPRoute is used when the HTTPRoute is invalid

"InvalidKind"

RoutePolicyReasonInvalidKind is used when the kind/group is invalid

"InvalidName"

RoutePolicyReasonInvalidName is used when the name is invalid

"NoTargetReference"

RoutePolicyReasonNoTargetReference is used when there’s no target reference

"OverrideNotSupported"

RoutePolicyReasonOverrideNotSupported is used when the override isn’t supported

"RefNotPermitted"

RoutePolicyReasonRefNotPermitted is used when the ref isn’t permitted

"SectionNamesNotPermitted"

RoutePolicyReasonSectionNamesNotPermitted is used when the section names aren’t permitted

"Accepted"

RoutePolicyConditionAccepted is used to set the RoutePolicyConditionType to Accepted

"ResolvedRefs"

RoutePolicyConditionResolvedRefs is used to set the RoutePolicyCondition to ResolvedRefs

Custom Timeouts Timeout for the target resource.

SessionAffinity defines the schema for Session Affinity specification

TargetRef identifies an API object to apply policy to.

Override defines policy configuration that should override policy configuration attached below the targeted resource in the hierarchy.

Note: Override is currently not supported and result in a validation error. Support for Override will be added in a future release.

Default defines default policy configuration for the targeted resource.

Conditions describe the current conditions of the RoutePolicy.

Implementations should prefer to express RoutePolicy conditions using the RoutePolicyConditionType and RoutePolicyConditionReason constants so that operators and tools can converge on a common vocabulary to describe RoutePolicy state.

Known condition types are:

• “Accepted”

RouteTimeout is the timeout for the route.

The duration of the slow start window.

The speed of traffic increase over the slow start window, must be greater than 0.0. Defaults to 1.0 if unspecified.

The minimum or starting percentage of traffic to send to new endpoints. Defaults to 10% if unspecified.

Start defines the start of the range of status codes to use for HealthCheck checks. This is inclusive.

End defines the end of the range of status codes to use for HealthCheck checks. This is inclusive.

TargetRef identifies an API object to apply policy to.

Ports specifies the list of ports on the target where the policy is applied.

Hostname is the value to be used to replace the Host header value during forwarding.

Path defines a path rewrite.

Object’s metadata.

Spec is the specifications for Application Gateway for Containers Security Policy child resource.

Status defines the current state of Application Gateway for Containers Security Policy child resource.

TargetRef identifies an API object to apply policy to.

WebApplicationFirewallPolicy is used to specify a WebApplicationPolicy resource

Known condition types are:

• “Accepted”
• “Deployment”
• “ResolvedRefs”
• “Programmed”