KubeLB Enterprise Edition CRD References

Enterprise Edition

API Reference

Packages

kubelb.k8c.io/v1alpha1

Package v1alpha1 contains API Schema definitions for the kubelb.k8c.io v1alpha1 API group

Resource Types

Addresses

Addresses is the Schema for the addresses API

Appears in:

Field Description Default Validation
apiVersion string kubelb.k8c.io/v1alpha1
kind string Addresses
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec AddressesSpec
status AddressesStatus

AddressesList

AddressesList contains a list of Addresses

Field Description Default Validation
apiVersion string kubelb.k8c.io/v1alpha1
kind string AddressesList
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items Addresses array

AddressesSpec

AddressesSpec defines the desired state of Addresses

Appears in:

Field Description Default Validation
addresses EndpointAddress array Addresses contains a list of addresses. MinItems: 1

AddressesStatus

AddressesStatus defines the observed state of Addresses

Appears in:

AnnotatedResource

Underlying type: string

Validation:

  • Enum: [all service ingress gateway httproute grpcroute tcproute udproute tlsroute]

Appears in:

Field Description
all
service
ingress
gateway
httproute
grpcroute
tcproute
udproute
tlsroute

AnnotationSettings

Appears in:

Field Description Default Validation
propagatedAnnotations map[string]string PropagatedAnnotations defines the set of annotation key patterns that will be propagated to load balancing resources.
Keys support shell-style glob patterns (e.g. “nginx.ingress.kubernetes.io/*”). Keep the value empty to allow any value;
otherwise the value is a comma-separated list of permitted values for exact match.
Tenant configuration has higher precedence than the annotations specified at the Config level.		 Optional: {}
propagateAllAnnotations boolean PropagateAllAnnotations defines whether all annotations will be propagated to load balancing resources.
If set to true, PropagatedAnnotations is ignored. DeniedAnnotations still applies on top of this flag.
Tenant configuration has higher precedence than the value specified at the Config level.		 Optional: {}
deniedAnnotations string array DeniedAnnotations is a list of annotation key patterns that are excluded from propagation, regardless of
PropagateAllAnnotations or PropagatedAnnotations. Patterns support shell-style globbing (e.g. “nginx.ingress.kubernetes.io/*”).
Tenant configuration has higher precedence than the value specified at the Config level.		 Optional: {}
defaultAnnotations object (keys:AnnotatedResource, values:Annotations) DefaultAnnotations defines the list of annotations(key-value pairs) that will be set on the load balancing resources if not already present. A special key all can be used to apply the same
set of annotations to all resources.
Tenant configuration has higher precedence than the annotations specified at the Config level.		 Optional: {}

Annotations

Underlying type: object

Appears in:

BackendTransport

Appears in:

Field Description Default Validation
mode BackendTransportMode Mode controls how management Envoy connects to tenant backends.
Direct preserves the existing node-address plus workload NodePort topology.
MTLS routes L7 and L4 TCP traffic through a KubeLB-managed tenant Envoy proxy.
MTLS is a Beta / Technical Preview feature: safe to enable and supported,
but its configuration surface may still change between releases with
migration instructions. See https://docs.kubermatic.com/kubermatic/main/architecture/feature-stages/		 Direct Enum: [Direct MTLS]
Optional: {}
udp BackendTransportUDP UDP configures how UDP traffic reaches tenant backends when Mode is MTLS.
It has no effect in Direct mode.		 Optional: {}
tenantProxy TenantProxy TenantProxy tunes the KubeLB-managed tenant Envoy proxy used in the
MTLS topology. It has no effect in Direct mode.		 Optional: {}

BackendTransportMode

Underlying type: string

Appears in:

Field Description
Direct
MTLS

BackendTransportUDP

Appears in:

Field Description Default Validation
mode BackendTransportUDPMode Mode selects the UDP transport in the MTLS topology.
Tunnel wraps each UDP session in CONNECT-UDP over the encrypted mTLS
tenant proxy port. Direct is an escape hatch that keeps UDP on plain
per-service NodePorts (unencrypted) for workloads sensitive to the
tunnel’s MTU overhead or Envoy’s upstream CONNECT-UDP maturity.		 Tunnel Enum: [Tunnel Direct]
Optional: {}

BackendTransportUDPMode

Underlying type: string

Appears in:

Field Description
Tunnel
Direct

CertificatesSettings

CertificatesSettings defines the settings for the certificates.

Appears in:

Field Description Default Validation
disable boolean Disable is a flag that can be used to disable certificate automation for a tenant.
defaultClusterIssuer string DefaultClusterIssuer is the Cluster Issuer to use for the certificates by default. This is applied when the cluster issuer is not specified in the annotations on the resource itself.
allowedDomains string array AllowedDomains is a list of allowed domains for automated Certificate management. Has a higher precedence than the value specified in the Config.
If empty, the value specified in tenant.spec.allowedDomains will be used.
Examples:
- [".example.com"] -> this allows subdomains at the root level such as example.com and test.example.com but won’t allow domains at one level above like test.test.example.com
- [".example.com"] -> this allows all subdomains of example.com such as test.dns.example.com and dns.example.com
- [“example.com”] -> this allows only example.com
- [""] or [""] -> this allows all domains
Note: “**” was added as a special case to allow any levels of subdomains that come before it. “*” works for only 1 level.

CircuitBreaker

CircuitBreaker defines the Circuit Breaker configuration for Envoy clusters. Circuit breakers prevent cascading failures by limiting connections/requests to upstream clusters. For more info: https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/circuit_breaking

Appears in:

Field Description Default Validation
maxConnections integer MaxConnections is the maximum number of connections that Envoy will establish to all endpoints in the cluster.
If not specified, the default is 1024.		 Maximum: 4.294967295e+09
Minimum: 0
Optional: {}
maxPendingRequests integer MaxPendingRequests is the maximum number of pending requests that Envoy will queue to the cluster.
If not specified, the default is 1024.		 Maximum: 4.294967295e+09
Minimum: 0
Optional: {}
maxParallelRequests integer MaxParallelRequests is the maximum number of parallel requests that Envoy will make to the cluster.
This is applicable to HTTP/2 and gRPC connections.
If not specified, the default is 1024.		 Maximum: 4.294967295e+09
Minimum: 0
Optional: {}
maxParallelRetries integer MaxParallelRetries is the maximum number of parallel retries that Envoy will make to the cluster.
If not specified, the default is 3.		 Maximum: 4.294967295e+09
Minimum: 0
Optional: {}
maxRequestsPerConnection integer MaxRequestsPerConnection is the maximum number of requests that Envoy will make over a single connection
to the cluster. If not specified, there is no limit.		 Maximum: 4.294967295e+09
Minimum: 0
Optional: {}
perEndpoint PerEndpointCircuitBreaker PerEndpoint configures circuit breaker thresholds that apply to individual endpoints rather than the whole cluster. Optional: {}

Config

Config is the object that represents the Config for the KubeLB management controller.

Appears in:

Field Description Default Validation
apiVersion string kubelb.k8c.io/v1alpha1
kind string Config
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec ConfigSpec
status ConfigStatus

ConfigCertificatesSettings

ConfigCertificatesSettings defines the global settings for the certificates.

Appears in:

Field Description Default Validation
disable boolean Disable is a flag that can be used to disable certificate automation globally for all the tenants.
defaultClusterIssuer string DefaultClusterIssuer is the Cluster Issuer to use for the certificates by default. This is applied when the cluster issuer is not specified in the annotations on the resource itself.

ConfigDNSSettings

ConfigDNSSettings defines the global settings for DNS management and automation.

Appears in:

Field Description Default Validation
disable boolean Disable is a flag that can be used to disable DNS automation globally for all the tenants.
wildcardDomain string WildcardDomain is the domain that will be used as the base domain to create wildcard DNS records for DNS resources.
This is only used for determining the hostname for LoadBalancer and Tunnel resources.		 Optional: {}
allowExplicitHostnames boolean AllowExplicitHostnames is a flag that can be used to allow explicit hostnames to be used for DNS resources.
This is only used when LoadBalancer.Spec.Hostname or Tunnel.Spec.Hostname is set.		 Optional: {}
useDNSAnnotations boolean UseDNSAnnotations is a flag that can be used to add DNS annotations to DNS resources.
This is only used when LoadBalancer.Spec.Hostname or Tunnel.Spec.Hostname is set.		 Optional: {}
useCertificateAnnotations boolean UseCertificateAnnotations is a flag that can be used to add Certificate annotations to Certificate resources.
This is only used when LoadBalancer.Spec.Hostname or Tunnel.Spec.Hostname is set.		 Optional: {}

ConfigList

ConfigList contains a list of Config

Field Description Default Validation
apiVersion string kubelb.k8c.io/v1alpha1
kind string ConfigList
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items Config array

ConfigSpec

ConfigSpec defines the desired state of the Config

Appears in:

Field Description Default Validation
propagatedAnnotations map[string]string PropagatedAnnotations defines the set of annotation key patterns that will be propagated to load balancing resources.
Keys support shell-style glob patterns (e.g. “nginx.ingress.kubernetes.io/*”). Keep the value empty to allow any value;
otherwise the value is a comma-separated list of permitted values for exact match.
Tenant configuration has higher precedence than the annotations specified at the Config level.		 Optional: {}
propagateAllAnnotations boolean PropagateAllAnnotations defines whether all annotations will be propagated to load balancing resources.
If set to true, PropagatedAnnotations is ignored. DeniedAnnotations still applies on top of this flag.
Tenant configuration has higher precedence than the value specified at the Config level.		 Optional: {}
deniedAnnotations string array DeniedAnnotations is a list of annotation key patterns that are excluded from propagation, regardless of
PropagateAllAnnotations or PropagatedAnnotations. Patterns support shell-style globbing (e.g. “nginx.ingress.kubernetes.io/*”).
Tenant configuration has higher precedence than the value specified at the Config level.		 Optional: {}
defaultAnnotations object (keys:AnnotatedResource, values:Annotations) DefaultAnnotations defines the list of annotations(key-value pairs) that will be set on the load balancing resources if not already present. A special key all can be used to apply the same
set of annotations to all resources.
Tenant configuration has higher precedence than the annotations specified at the Config level.		 Optional: {}
envoyProxy EnvoyProxy EnvoyProxy defines the desired state of the Envoy Proxy
backendTransport BackendTransport BackendTransport controls how management Envoy connects to tenant backends.
Defaults to Direct for backward compatibility.		 Optional: {}
loadBalancer LoadBalancerSettings
ingress IngressSettings
gatewayAPI GatewayAPISettings
dns ConfigDNSSettings
certificates ConfigCertificatesSettings
tunnel TunnelSettings
circuitBreaker CircuitBreaker CircuitBreaker defines the default circuit breaker configuration for all Envoy clusters.
These settings can be overridden at the Tenant level.		 Optional: {}
timeouts EnvoyTimeouts Timeouts defines default Envoy timeouts applied to all routes and
load balancers in this cluster. Tenant and Route/LoadBalancer
settings override these defaults per-field.		 Optional: {}
loadBalancerPolicy LoadBalancerPolicy LoadBalancerPolicy defines the default load balancing policy for all Envoy clusters.
These settings can be overridden at the Tenant and LoadBalancer/Route level.		 Enum: [RoundRobin LeastRequest Random]
Optional: {}
healthCheck HealthCheck HealthCheck defines the default active health check for all Envoy clusters.
Whole-struct override: Tenant and LoadBalancer/Route settings replace this
entirely rather than merging per-field.		 Optional: {}
waf WAFSettings WAF defines WAF-related settings. Optional: {}
prometheus PrometheusSettings Prometheus, when set, gives the manager a Prometheus query endpoint to
read metrics from. Optional and bring-your-own: KubeLB does not run a
Prometheus.		 Optional: {}
networkPolicy NetworkPolicySettings NetworkPolicy defines the default network policy settings for all tenant namespaces.
Tenant has higher precedence than the settings specified at the Config level.		 Optional: {}
insights InsightsSettings Insights defines settings for the KubeLB insights engine. It only takes
effect when the manager runs with –enable-insights.		 Optional: {}

ConfigStatus

ConfigStatus defines the observed state of the Config.

Appears in:

Field Description Default Validation
version Version

DNSSettings

DNSSettings defines the tenant specific settings for DNS management and automation.

Appears in:

Field Description Default Validation
disable boolean Disable is a flag that can be used to disable DNS automation for a tenant.
allowedDomains string array AllowedDomains is a list of allowed domains for automated DNS management. Has a higher precedence than the value specified in the Config.
If empty, the value specified in tenant.spec.allowedDomains will be used.
Examples:
- [".example.com"] -> this allows subdomains at the root level such as example.com and test.example.com but won’t allow domains at one level above like test.test.example.com
- [".example.com"] -> this allows all subdomains of example.com such as test.dns.example.com and dns.example.com
- [“example.com”] -> this allows only example.com
- [""] or [""] -> this allows all domains
Note: “**” was added as a special case to allow any levels of subdomains that come before it. “*” works for only 1 level.
wildcardDomain string WildcardDomain is the domain that will be used as the base domain to create wildcard DNS records for DNS resources.
This is only used for determining the hostname for LoadBalancer and Tunnel resources.		 Optional: {}
allowExplicitHostnames boolean AllowExplicitHostnames is a flag that can be used to allow explicit hostnames to be used for DNS resources.
This is only used when LoadBalancer.Spec.Hostname or Tunnel.Spec.Hostname is set.		 Optional: {}
useDNSAnnotations boolean UseDNSAnnotations is a flag that can be used to add DNS annotations to DNS resources.
This is only used when LoadBalancer.Spec.Hostname or Tunnel.Spec.Hostname is set.		 Optional: {}
useCertificateAnnotations boolean UseCertificateAnnotations is a flag that can be used to add Certificate annotations to Certificate resources.
This is only used when LoadBalancer.Spec.Hostname or Tunnel.Spec.Hostname is set.		 Optional: {}

EndpointAddress

EndpointAddress is a tuple that describes a single endpoint address. At least one of IP or Hostname must be set.

Appears in:

Field Description Default Validation
ip string The IP of the endpoint. This can be an IPv4 or IPv6 address.
The IP address must not be IP CIDR, Loopback (127.0.0.0/8), link-local (169.254.0.0/16), or link-local multicast ((224.0.0.0/24) addresses.		 Optional: {}
hostname string The Hostname of this endpoint. Used when the backend has no stable IP and
must be resolved by DNS. If both ip and hostname are set, ip wins.		 Optional: {}

EndpointPort

EndpointPort is a tuple that describes a single port.

Appears in:

Field Description Default Validation
name string The name of this port. This must match the ’name’ field in the
corresponding ServicePort.
Must be a DNS_LABEL.
Optional only if one port is defined.		 Optional: {}
port integer The port number of the endpoint.
protocol Protocol The IP protocol for this port. Defaults to “TCP”. Enum: [TCP UDP]

EnvoyProxy

EnvoyProxy defines the desired state of the EnvoyProxy

Appears in:

Field Description Default Validation
topology EnvoyProxyTopology Topology defines the deployment topology for Envoy Proxy. The only supported value is: shared.
DEPRECATION NOTICE: The values “dedicated” and “global” are deprecated and will be removed in a future release. They will now default to shared topology.		 shared Enum: [shared dedicated global]
Optional: {}
useDaemonset boolean UseDaemonset defines whether Envoy Proxy will run as daemonset. By default, Envoy Proxy will run as deployment.
If set to true, Replicas will be ignored.		 Optional: {}
replicas integer Replicas defines the number of replicas for Envoy Proxy. This field is ignored if UseDaemonset is set to true. 3 Minimum: 1
Optional: {}
singlePodPerNode boolean SinglePodPerNode defines whether Envoy Proxy pods will be spread across nodes. This ensures that multiple replicas are not running on the same node. Optional: {}
nodeSelector object (keys:string, values:string) NodeSelector is used to select nodes to run Envoy Proxy. If specified, the node must have all the indicated labels. Optional: {}
tolerations Toleration array Tolerations is used to schedule Envoy Proxy pods on nodes with matching taints. Optional: {}
resources ResourceRequirements Resources defines the resource requirements for Envoy Proxy. Optional: {}
affinity Affinity Affinity is used to schedule Envoy Proxy pods on nodes with matching affinity. Optional: {}
image string Image defines the Envoy Proxy image to use. Optional: {}
gracefulShutdown EnvoyProxyGracefulShutdown GracefulShutdown defines the graceful shutdown configuration for Envoy Proxy. Optional: {}
overloadManager EnvoyProxyOverloadManager OverloadManager defines the overload manager configuration for Envoy XDS bootstrap. Optional: {}
maxEndpointsPerCluster integer MaxEndpointsPerCluster limits the number of upstream endpoint addresses per Envoy cluster.
When set to a positive value, only the first N endpoints are included in the xDS as upstream addresses.
Defaults to 0, which means no limit.		 Optional: {}
imagePullSecrets LocalObjectReference array ImagePullSecrets is a list of references to secrets in the same namespace to use for pulling the Envoy Proxy image.
If not set, imagePullSecrets are auto-detected from the manager pod.		 Optional: {}
podMonitor EnvoyProxyPodMonitor PodMonitor enables creation of PodMonitor resources for Envoy Proxy pods
to enable metrics scraping by Prometheus Operator.		 Optional: {}
headerLimits EnvoyProxyHeaderLimits HeaderLimits configures the client header size and count limits for the
KubeLB-managed Envoy Proxy. Unset fields default to Envoy’s maximum so the
managed proxy never rejects headers that the edge proxy already accepted.		 Optional: {}

EnvoyProxyGracefulShutdown

EnvoyProxyGracefulShutdown defines the graceful shutdown configuration for Envoy Proxy

Appears in:

Field Description Default Validation
disabled boolean Disabled controls whether graceful shutdown is disabled Optional: {}
drainTimeout Duration DrainTimeout is the maximum time to wait for connections to drain.
Defaults to 60s. Must be less than TerminationGracePeriodSeconds.		 60s Optional: {}
minDrainDuration Duration MinDrainDuration is the minimum time to wait before checking connection count.
This prevents premature termination. Defaults to 5s.		 5s Optional: {}
terminationGracePeriodSeconds integer TerminationGracePeriodSeconds is the grace period for pod termination.
Must be greater than DrainTimeout. Defaults to 300s.		 300 Minimum: 30
Optional: {}
shutdownManagerImage string ShutdownManagerImage is the Docker image for the shutdown-manager sidecar.
Defaults to “docker.io/envoyproxy/gateway:v1.8.3”		 Optional: {}

EnvoyProxyHeaderLimits

EnvoyProxyHeaderLimits configures the client header size and count limits for the KubeLB-managed Envoy Proxy. Envoy rejects requests whose headers exceed its 60 KiB default with HTTP 431; these fields raise that ceiling.

Appears in:

Field Description Default Validation
maxRequestHeadersKb integer MaxRequestHeadersKb is the maximum request header block size in KiB.
Envoy’s default is 60; defaults to 8192 (Envoy’s maximum) when unset.		 Maximum: 8192
Minimum: 1
Optional: {}
maxRequestHeadersCount integer MaxRequestHeadersCount is the maximum number of request headers.
Envoy’s default is 100; defaults to 4096 when unset.		 Minimum: 1
Optional: {}
maxResponseHeadersKb integer MaxResponseHeadersKb is the maximum upstream response header block size in KiB.
Envoy’s default is 60; defaults to 8192 (Envoy’s maximum) when unset.		 Maximum: 8192
Minimum: 1
Optional: {}

EnvoyProxyOverloadManager

EnvoyProxyOverloadManager defines the overload manager configuration for Envoy XDS

Appears in:

Field Description Default Validation
enabled boolean Enabled controls whether overload manager is enabled Optional: {}
maxActiveDownstreamConnections integer MaxActiveDownstreamConnections is the maximum number of active downstream connections for the Envoy. Optional: {}
maxHeapSizeBytes integer MaxHeapSizeBytes is the maximum heap size for the Envoy in bytes. On reaching the limit, the Envoy will start to reject new connections. Optional: {}

EnvoyProxyPodMonitor

EnvoyProxyPodMonitor defines the PodMonitor configuration for Envoy Proxy

Appears in:

Field Description Default Validation
enabled boolean Enabled controls whether a PodMonitor is created for Envoy Proxy pods. Optional: {}

EnvoyProxyTopology

Underlying type: string

Appears in:

Field Description
shared
dedicated
global

EnvoyTimeouts

EnvoyTimeouts configures upstream and connection timeouts on the KubeLB-managed Envoy proxy. Nil duration fields inherit from the next tier (Route/LB → Tenant → Config → built-in default). A value of 0s explicitly disables that timeout (Envoy semantics).

Appears in:

Field Description Default Validation
request Duration Request is the total upstream request timeout for HTTP routes
(Envoy route.timeout). Built-in default: 0 (disabled).
Applies to: Ingress, HTTPRoute, GRPCRoute.		 Optional: {}
streamIdle Duration StreamIdle is the maximum time an HTTP stream can be idle without
any bytes flowing in either direction (Envoy stream_idle_timeout).
Built-in default: 1h.
Applies to: Ingress, HTTPRoute, GRPCRoute.		 Optional: {}
requestHeaders Duration RequestHeaders is the maximum time to receive complete request
headers (Envoy request_headers_timeout). Built-in default: 0
(disabled). Applies to: Ingress, HTTPRoute, GRPCRoute.		 Optional: {}
idleConnection Duration IdleConnection is the maximum HTTP connection idle time
(Envoy common_http_protocol_options.idle_timeout). Built-in
default: 1h. Applies to: Ingress, HTTPRoute, GRPCRoute.		 Optional: {}
tcpIdle Duration TCPIdle is the TCP proxy idle timeout (Envoy
tcp_proxy.idle_timeout). Built-in default: 1h.
Applies to: TCPRoute, TLSRoute, L4 LoadBalancer.		 Optional: {}
connect Duration Connect is the upstream cluster TCP connect timeout
(Envoy cluster.connect_timeout). Built-in default: 5s.
Applies to: all routes and L4 LoadBalancer.		 Optional: {}
udpIdle Duration UDPIdle is the UDP session idle timeout. When set, it applies to the
management Envoy UDP proxy sessions (Envoy udp_proxy idle_timeout)
and, in the MTLS topology, to the CONNECT-UDP tunnel streams on both
hops. When unset, the per-hop Envoy defaults apply (60s udp_proxy
session idle, 5m tunnel stream idle).
Applies to: UDPRoute and L4 LoadBalancer UDP ports.		 Optional: {}

GRPCHealthCheck

GRPCHealthCheck configures a gRPC active health check (grpc.health.v1.Health).

Appears in:

Field Description Default Validation
serviceName string ServiceName is the value passed as the service name in the gRPC health check
request. Empty checks overall server health. Optional.		 Optional: {}
authority string Authority is the value of the :authority header on the gRPC health check
request. Defaults to the cluster name (Envoy default) when unset. Optional.		 Optional: {}

GatewayAPISettings

GatewayAPISettings defines the settings for the gateway API.

Appears in:

Field Description Default Validation
class string Class is the class of the gateway API to use. This can be used to specify a specific gateway API implementation.
This has higher precedence than the value specified in the Config.		 Optional: {}
classMappings GatewayClassMapping array ClassMappings defines gateway class name mappings from tenant clusters to the management cluster.
Config mappings are defaults. Tenant mappings override Config mappings with the same source class.		 MaxItems: 32
Optional: {}
disable boolean Disable is a flag that can be used to disable Gateway API for a tenant.
enforceReferenceGrants boolean EnforceReferenceGrants requires a ReferenceGrant in the target namespace
for any cross-namespace backendRef (route -> Service) or Gateway TLS
certificateRef (Gateway -> Secret) in the tenant cluster. References
without a matching grant are dropped and reported via the
ResolvedRefs=False/RefNotPermitted condition. The Tenant value overrides
the Config value; unset means inherit (Tenant) or disabled (Config).		 Optional: {}
defaultGateway ObjectReference DefaultGateway is the default gateway reference to use for the tenant. This is only used for load balancer hostname and tunneling. Optional: {}
gateway GatewaySettings
disableHTTPRoute boolean
disableGRPCRoute boolean
disableTCPRoute boolean
disableUDPRoute boolean
disableTLSRoute boolean
disableBackendTrafficPolicy boolean
disableClientTrafficPolicy boolean

GatewayAPIState

Appears in:

Field Description Default Validation
classMappings GatewayClassMapping array ClassMappings defines effective gateway class name mappings from tenant clusters to the management cluster. MaxItems: 32
Optional: {}
enforceReferenceGrants boolean EnforceReferenceGrants is the effective (Config default, Tenant override)
value of spec.gatewayAPI.enforceReferenceGrants for this tenant.		 Optional: {}

GatewayAPIsSettings

Appears in:

Field Description Default Validation
disableHTTPRoute boolean
disableGRPCRoute boolean
disableTCPRoute boolean
disableUDPRoute boolean
disableTLSRoute boolean
disableBackendTrafficPolicy boolean
disableClientTrafficPolicy boolean

GatewayClassMapping

GatewayClassMapping defines a gateway class mapping from tenant clusters to the management cluster.

Appears in:

Field Description Default Validation
source string Source is the gateway class name in the tenant cluster. MaxLength: 253
MinLength: 1
target string Target is the gateway class name in the management cluster. MaxLength: 253
MinLength: 1

GatewaySettings

GatewaySettings defines the settings for the gateway resource.

Appears in:

Field Description Default Validation
limit integer Limit is the maximum number of gateways to create.
If a lower limit is set than the number of reources that exist, the limit will be disallow creation of new resources but will not delete existing resources. The reason behind this
is that it is not possible for KubeLB to know which resources are safe to remove.

HTTPHealthCheck

HTTPHealthCheck configures an HTTP/1.1 active health check.

Appears in:

Field Description Default Validation
path string Path is the HTTP request path used for the health check. Defaults to “/”. Optional: {}
host string Host is the value of the Host/authority header on the health check request.
Defaults to the cluster name (Envoy default) when unset.		 Optional: {}
expectedStatuses integer array ExpectedStatuses is the list of HTTP status codes considered healthy.
Defaults to [200] when unset. Each value must be in the range 100-599.		 items:Maximum: 599
items:Minimum: 100
Optional: {}

HealthCheck

HealthCheck configures Envoy active health checking for the upstream clusters backing this resource. When unset, KubeLB applies a default TCP connect-only check. This is a whole-struct override: the effective check is taken from the first tier that sets it (Route/LoadBalancer > Tenant > Config > built-in default), never merged field-by-field across tiers. Fields left unset within the chosen tier fall back to the built-in defaults documented below. For more info: https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/health_checking

Appears in:

Field Description Default Validation
type HealthCheckType Type of health check to perform. Defaults to TCP (connect-only) when unset. Enum: [TCP HTTP GRPC]
Optional: {}
interval Duration Interval between health checks. Defaults to 5s. Optional: {}
timeout Duration Timeout for each health check attempt. Defaults to 5s. Optional: {}
healthyThreshold integer HealthyThreshold is the number of consecutive successful checks before an
unhealthy endpoint is marked healthy. Defaults to 2.		 Minimum: 1
Optional: {}
unhealthyThreshold integer UnhealthyThreshold is the number of consecutive failed checks before a
healthy endpoint is marked unhealthy. Defaults to 3.		 Minimum: 1
Optional: {}
http HTTPHealthCheck HTTP configures an HTTP health check. Used only when Type is HTTP. Optional: {}
grpc GRPCHealthCheck GRPC configures a gRPC health check. Used only when Type is GRPC. Optional: {}

HealthCheckType

Underlying type: string

Validation:

  • Enum: [TCP HTTP GRPC]

Appears in:

Field Description
TCP
HTTP
GRPC

HostnameStatus

Appears in:

Field Description Default Validation
hostname string Hostname contains the hostname of the load-balancer. Optional: {}
tlsEnabled boolean TLSEnabled is true if certificate is created for the hostname. Optional: {}
dnsRecordCreated boolean DNSRecordCreated is true if DNS record is created for the hostname. Optional: {}

IngressSettings

IngressSettings defines the settings for the ingress.

Appears in:

Field Description Default Validation
class string Class is the class of the ingress to use.
This has higher precedence than the value specified in the Config.		 Optional: {}
disable boolean Disable is a flag that can be used to disable Ingress for a tenant.

Insight

Insight is a single finding produced by the KubeLB insights engine: a configuration or posture problem the management cluster can see and the operator can act on. Insights are operator-facing; they are not synced to tenant clusters.

Appears in:

Field Description Default Validation
apiVersion string kubelb.k8c.io/v1alpha1
kind string Insight
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec InsightSpec
status InsightStatus

InsightCategory

Underlying type: string

InsightCategory groups findings by the kind of problem they describe.

Validation:

  • Enum: [security reliability cost hygiene migration]

Appears in:

Field Description
security
reliability
cost
hygiene
migration

InsightDismissalReason

Underlying type: string

InsightDismissalReason explains why a finding was dismissed. It is required on dismissal so the fleet-wide dismissal mix stays analysable.

Validation:

  • Enum: [working_as_intended accepted_risk false_positive low_priority other]

Appears in:

Field Description
working_as_intended
accepted_risk
false_positive
low_priority
other

InsightEvidence

InsightEvidence is a pointer into live cluster state that supports the finding. Evidence is always a reference, never a copy, so an Insight cannot go stale against the object it describes.

Appears in:

Field Description Default Validation
type InsightEvidenceType Type of reference. Enum: [FieldRef Condition ObjectRef]
ref string Ref is the reference itself, in “/#” form. MaxLength: 512
MinLength: 1
note string Note explains what the reference shows. MaxLength: 512
Optional: {}

InsightEvidenceType

Underlying type: string

InsightEvidenceType describes what an evidence entry points at.

Validation:

  • Enum: [FieldRef Condition ObjectRef]

Appears in:

Field Description
FieldRef InsightEvidenceFieldRef points at a field on an object, e.g.
“Config/default#spec.waf.skipValidation”.
Condition InsightEvidenceCondition points at a status condition, e.g.
“TenantState/default#BackendTransportChangePending”.
ObjectRef InsightEvidenceObjectRef points at a whole object.

InsightList

InsightList contains a list of Insight.

Field Description Default Validation
apiVersion string kubelb.k8c.io/v1alpha1
kind string InsightList
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items Insight array

InsightRemediation

InsightRemediation describes how to resolve a finding. KubeLB never applies it: the snippet is documentation, not an action.

Appears in:

Field Description Default Validation
summary string Summary is the one-line fix. MaxLength: 1024
Optional: {}
snippet string Snippet is an optional YAML example of the fix. It is text only and is
never applied by KubeLB.		 MaxLength: 8192
Optional: {}

InsightSeverity

Underlying type: string

InsightSeverity is how much the finding matters. The values match the OpenReports severity enum so findings can be mirrored into Report objects without a translation table.

Validation:

  • Enum: [critical high medium low info]

Appears in:

Field Description
critical
high
medium
low
info

InsightSpec

InsightSpec is the finding. Everything except triage is written by the insights engine and is overwritten on every sweep.

Appears in:

Field Description Default Validation
check string Check is the registry ID of the check that produced this finding, e.g.
KLB001. It is immutable: a check ID is a permanent contract that docs,
dashboards and suppression lists reference.		 Pattern: ^KLB[0-9]\{3\}$
slug string Slug is the human-readable name of the check, e.g. waf-detection-only. MaxLength: 63
category InsightCategory Category groups the finding. Enum: [security reliability cost hygiene migration]
severity InsightSeverity Severity is how much the finding matters. Enum: [critical high medium low info]
message string Message describes this specific finding, including any fleet-relative
context (“4 of 6 tenants with public routes enforce WAF”).		 MaxLength: 1024
targetRefs InsightTargetRef array TargetRefs are the objects the finding is about. MaxItems: 32
MinItems: 1
evidence InsightEvidence array Evidence points at the live state that produced the finding. MaxItems: 16
Optional: {}
remediation InsightRemediation Remediation describes how to fix the finding. Optional: {}
docsURL string DocsURL links to the check’s documentation. MaxLength: 512
Optional: {}
triage InsightTriage Triage is the operator’s verdict. It is the only user-owned field on this
object: the engine reads it and never writes it.		 Optional: {}

InsightState

Underlying type: string

InsightState is the effective state of a finding, computed by the engine from the detection result and the operator’s triage.

Validation:

  • Enum: [Open Acknowledged Snoozed Dismissed Fixed]

Appears in:

Field Description
Open
Acknowledged
Snoozed
Dismissed
Fixed InsightStateFixed means the engine no longer detects the finding. It is
machine-observed, never set by an operator.

InsightStatus

InsightStatus is the engine-computed effective state of a finding.

Appears in:

Field Description Default Validation
state InsightState State combines the detection result with the operator’s triage. Enum: [Open Acknowledged Snoozed Dismissed Fixed]
Optional: {}
firstSeen Time FirstSeen is when the finding was first detected. It survives a
fix-and-reappear cycle so flapping stays visible.		 Optional: {}
lastEvaluated Time LastEvaluated is the last sweep that considered this finding. Optional: {}
fixedAt Time FixedAt is when the engine stopped detecting the finding. Fixed insights
are deleted after a retention period.		 Optional: {}

InsightTargetRef

InsightTargetRef identifies an object the finding is about.

Appears in:

Field Description Default Validation
apiVersion string APIVersion of the target. MaxLength: 253
MinLength: 1
name string Name of the target. MaxLength: 253
MinLength: 1
namespace string Namespace of the target. Empty for cluster-scoped objects. MaxLength: 253
Optional: {}

InsightTriage

InsightTriage is the operator’s verdict on a finding. It is the only part of an Insight that users write; the engine preserves it verbatim across sweeps.

Appears in:

Field Description Default Validation
state InsightTriageState State is the verdict. Enum: [Acknowledged Snoozed Dismissed]
reason InsightDismissalReason Reason explains a dismissal. Required when state is Dismissed, forbidden
otherwise.		 Enum: [working_as_intended accepted_risk false_positive low_priority other]
Optional: {}
snoozeUntil Time SnoozeUntil is when the finding reopens. Required when state is Snoozed,
forbidden otherwise.		 Optional: {}

InsightTriageState

Underlying type: string

InsightTriageState is the operator’s verdict on a finding.

Validation:

  • Enum: [Acknowledged Snoozed Dismissed]

Appears in:

Field Description
Acknowledged InsightTriageAcknowledged means the finding is seen and accepted as work
to do. It keeps counting towards the posture score.
Snoozed InsightTriageSnoozed hides the finding until snoozeUntil passes, after
which it reopens on its own.
Dismissed InsightTriageDismissed closes the finding for good. A dismissed finding
that is detected again stays dismissed.

InsightsSettings

InsightsSettings defines the global settings for the insights engine.

Appears in:

Field Description Default Validation
disabledChecks string array DisabledChecks lists check IDs the engine must not run, for example
[“KLB010”]. Existing findings for a disabled check are removed on the
next sweep.		 MaxItems: 64
items:Pattern: ^KLB[0-9]\{3\}$
Optional: {}

KubernetesSource

Appears in:

Field Description Default Validation
resource Unstructured EmbeddedResource: {}
Optional: {}
services UpstreamService array Services contains the list of services that are used as the source for the Route.

LoadBalancer

LoadBalancer is the Schema for the loadbalancers API

Appears in:

Field Description Default Validation
apiVersion string kubelb.k8c.io/v1alpha1
kind string LoadBalancer
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec LoadBalancerSpec
status LoadBalancerStatus

LoadBalancerEndpoints

LoadBalancerEndpoints is a group of addresses with a common set of ports. The expanded set of endpoints is the Cartesian product of Addresses x Ports. For example, given:

{
  Addresses: [{"ip": "10.10.1.1"}, {"ip": "10.10.2.2"}],
  Ports:     [{"name": "a", "port": 8675}, {"name": "b", "port": 309}]
}

The resulting set of endpoints can be viewed as:

a: [ 10.10.1.1:8675, 10.10.2.2:8675 ],
b: [ 10.10.1.1:309, 10.10.2.2:309 ]

Appears in:

Field Description Default Validation
name string Name is the name of the endpoints.
addresses EndpointAddress array IP addresses which offer the related ports that are marked as ready. These endpoints
should be considered safe for load balancers and clients to utilize.		 MinItems: 1
addressesReference ObjectReference AddressesReference is a reference to the Addresses object that contains the IP addresses.
If this field is set, the Addresses field will be ignored.		 Optional: {}
ports EndpointPort array Port numbers available on the related IP addresses.
This field is ignored for routes that are using kubernetes resources as the source.		 MinItems: 1
Optional: {}

LoadBalancerList

LoadBalancerList contains a list of LoadBalancer

Field Description Default Validation
apiVersion string kubelb.k8c.io/v1alpha1
kind string LoadBalancerList
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items LoadBalancer array

LoadBalancerPersistence

LoadBalancerPersistence configures backend persistence for a LoadBalancer.

Appears in:

Field Description Default Validation
type LoadBalancerPersistenceType Type selects the persistence strategy.
SourceIP uses the downstream source IP as observed by KubeLB Envoy.		 Enum: [SourceIP]

LoadBalancerPersistenceType

Underlying type: string

LoadBalancerPersistenceType defines the supported backend persistence modes.

Validation:

  • Enum: [SourceIP]

Appears in:

Field Description
SourceIP LoadBalancerPersistenceTypeSourceIP routes connections from the same
observed source IP to the same healthy backend endpoint when possible.

LoadBalancerPolicy

Underlying type: string

Validation:

  • Enum: [RoundRobin LeastRequest Random]

Appears in:

Field Description
RoundRobin
LeastRequest
Random

LoadBalancerPort

LoadBalancerPort contains information on service’s port.

Appears in:

Field Description Default Validation
name string The name of this port within the service. This must be a DNS_LABEL.
All ports within a Spec must have unique names. When considering
the endpoints for a Service, this must match the ’name’ field in the
EndpointPort.
Optional if only one ServicePort is defined on this service.		 Optional: {}
protocol Protocol The IP protocol for this port. Defaults to “TCP”. Enum: [TCP UDP]
port integer The port that will be exposed by the LoadBalancer.

LoadBalancerSettings

LoadBalancerSettings defines the settings for the load balancers.

Appears in:

Field Description Default Validation
class string Class is the class of the load balancer to use.
This has higher precedence than the value specified in the Config.		 Optional: {}
limit integer Limit is the maximum number of load balancers to create.
If a lower limit is set than the number of reources that exist, the limit will be disallow creation of new resources but will not delete existing resources. The reason behind this
is that it is not possible for KubeLB to know which resources are safe to remove.
disable boolean Disable is a flag that can be used to disable L4 load balancing for a tenant.

LoadBalancerSpec

LoadBalancerSpec defines the desired state of LoadBalancer

Appears in:

Field Description Default Validation
endpoints LoadBalancerEndpoints array Sets of addresses and ports that comprise an exposed user service on a cluster. MinItems: 1
Required: {}
ports LoadBalancerPort array The list of ports that are exposed by the load balancer service.
only needed for layer 4		 Optional: {}
hostname string Hostname is the domain name at which the load balancer service will be accessible.
When hostname is set, KubeLB will create a route(ingress or httproute) for the service, and expose it with TLS on the given hostname.		 Optional: {}
type ServiceType type determines how the Service is exposed. Defaults to ClusterIP. Valid
options are ExternalName, ClusterIP, NodePort, and LoadBalancer.
“ExternalName” maps to the specified externalName.
“ClusterIP” allocates a cluster-internal IP address for load-balancing to
endpoints. Endpoints are determined by the selector or if that is not
specified, by manual construction of an Endpoints object. If clusterIP is
“None”, no virtual IP is allocated and the endpoints are published as a
set of endpoints rather than a stable IP.
“NodePort” builds on ClusterIP and allocates a port on every node which
routes to the clusterIP.
“LoadBalancer” builds on NodePort and creates an
external load-balancer (if supported in the current cloud) which routes
to the clusterIP.
More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types		 ClusterIP Optional: {}
externalTrafficPolicy ServiceExternalTrafficPolicy externalTrafficPolicy denotes if this Service desires to route external traffic to
node-local or cluster-wide endpoints. “Local” preserves the client source IP and avoids
a second hop for LoadBalancer and Nodeport type services, but risks potentially imbalanced
traffic spreading. “Cluster” obscures the client source IP and may cause a second hop to
another node, but should have good overall load-spreading.		 Optional: {}
persistence LoadBalancerPersistence Persistence configures backend endpoint persistence. When omitted,
KubeLB keeps the default non-sticky load balancing behavior.
SourceIP persistence is based on the source IP observed by KubeLB Envoy
for TCP and UDP traffic, which may be a gateway, node, or NAT address in
proxied topologies.
Takes precedence over LoadBalancerPolicy, which cannot be honoured at the
same time: persistence is a correctness requirement the workload states,
a distribution policy is a preference.		 Optional: {}
loadBalancerPolicy LoadBalancerPolicy LoadBalancerPolicy defines the load balancing policy for this LoadBalancer’s Envoy cluster.
Overrides Tenant and Config-level settings.		 Enum: [RoundRobin LeastRequest Random]
Optional: {}
timeouts EnvoyTimeouts Timeouts defines per-LoadBalancer Envoy timeouts. Overrides
Tenant and Config timeouts per-field.		 Optional: {}
healthCheck HealthCheck HealthCheck defines the active health check for this LoadBalancer’s Envoy cluster.
Whole-struct override: replaces Tenant and Config-level checks entirely.		 Optional: {}
upstreamTLS UpstreamTLSConfig UpstreamTLS configures TLS for connections from KubeLB’s Envoy proxy to backend endpoints.
When not set, Envoy connects using plain TCP.		 Optional: {}

LoadBalancerState

Appears in:

Field Description Default Validation
disable boolean
limit integer

LoadBalancerStatus

LoadBalancerStatus defines the observed state of LoadBalancer

Appears in:

Field Description Default Validation
loadBalancer LoadBalancerStatus LoadBalancer contains the current status of the load-balancer,
if one is present.		 Optional: {}
service ServiceStatus Service contains the current status of the LB service. Optional: {}
hostname HostnameStatus Hostname contains the status for hostname resources. Optional: {}
conditions Condition array Conditions describe the LoadBalancer as observed by the KubeLB manager. Optional: {}

NamedNetworkPolicy

NamedNetworkPolicy is a NetworkPolicySpec with an explicit name.

Appears in:

Field Description Default Validation
name string Name of the network policy. MinLength: 1
spec NetworkPolicySpec Spec is the NetworkPolicySpec for this policy.

NetworkPolicySettings

NetworkPolicySettings defines the network policy configuration for tenants. Default policies:

  • kubelb-deny-all-ingress: Default deny all ingress traffic to tenant namespace
  • kubelb-allow-same-namespace: Allow pod-to-pod traffic within tenant namespace
  • kubelb-allow-manager-ingress: Allow ingress from KubeLB manager namespace
  • kubelb-allow-dns-egress: Allow DNS resolution via kube-system (port 53 UDP/TCP)
  • kubelb-allow-xds-egress: Allow xDS control plane communication to manager (port 8001/TCP)
  • kubelb-allow-metrics-ingress: Allow Prometheus metrics scraping (port 19001/TCP)
  • kubelb-allow-envoy-ingress: Allow all ingress to envoy proxy pods for LoadBalancer traffic
  • kubelb-allow-envoy-egress: Allow all egress from envoy proxy pods to reach tenant NodePorts

Appears in:

Field Description Default Validation
enable boolean Enable to install network policies by default for all tenants.
By default(null/false), network policy automation is disabled. This will be enabled by default in a future release.		 Optional: {}
disabledPolicies string array DisabledPolicies is a list of default policy names to skip (e.g. [“kubelb-deny-all-ingress”]). Optional: {}
additionalPolicies NamedNetworkPolicy array AdditionalPolicies are extra named network policies created alongside remaining defaults. Optional: {}

PerEndpointCircuitBreaker

PerEndpointCircuitBreaker defines circuit breaker thresholds that apply to individual endpoints.

Appears in:

Field Description Default Validation
maxConnections integer MaxConnections is the maximum number of connections that Envoy will establish to a single endpoint.
If not specified, the default is 1024.		 Maximum: 4.294967295e+09
Minimum: 0
Optional: {}

PrometheusSecretKeyReference

PrometheusSecretKeyReference selects one key from a Secret in the KubeLB manager namespace.

Appears in:

Field Description Default Validation
name string Name of the Secret.
key string Key within the Secret’s data.

PrometheusSettings

PrometheusSettings configures the Prometheus query endpoint the manager reads metrics from.

Appears in:

Field Description Default Validation
url string URL is the base URL of the Prometheus query API, for example
http://prometheus-operated.monitoring.svc:9090.		 Pattern: ^https?://.+
bearerTokenSecretRef PrometheusSecretKeyReference BearerTokenSecretRef reads a bearer token used to authenticate to Prometheus. Optional: {}
caCertSecretRef PrometheusSecretKeyReference CACertSecretRef reads a PEM CA bundle used to verify a TLS Prometheus endpoint. Optional: {}
insecureSkipVerify boolean InsecureSkipVerify disables TLS certificate verification for the endpoint. Optional: {}

ResourceState

Appears in:

Field Description Default Validation
apiVersion string APIVersion is the API version of the resource.
name string Name is the name of the resource.
namespace string Namespace is the namespace of the resource.
generatedName string GeneratedName is the generated name of the resource.
status RawExtension Status is the actual status of the resource.
conditions Condition array

Route

Route is the object that represents a route in the cluster.

Appears in:

Field Description Default Validation
apiVersion string kubelb.k8c.io/v1alpha1
kind string Route
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec RouteSpec
status RouteStatus

RouteList

RouteList contains a list of Routes

Field Description Default Validation
apiVersion string kubelb.k8c.io/v1alpha1
kind string RouteList
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items Route array

RouteResourcesStatus

Appears in:

Field Description Default Validation
source string
services object (keys:string, values:RouteServiceStatus)
route ResourceState

RouteServiceStatus

Appears in:

Field Description Default Validation
apiVersion string APIVersion is the API version of the resource.
name string Name is the name of the resource.
namespace string Namespace is the namespace of the resource.
generatedName string GeneratedName is the generated name of the resource.
status RawExtension Status is the actual status of the resource.
conditions Condition array
ports ServicePort array

RouteSource

Appears in:

Field Description Default Validation
kubernetes KubernetesSource Kubernetes contains the information about the Kubernetes source.
This field is automatically populated by the KubeLB CCM and in most cases, users should not set this field manually.

RouteSpec

RouteSpec defines the desired state of the Route.

Appears in:

Field Description Default Validation
endpoints LoadBalancerEndpoints array Sets of addresses and ports that comprise an exposed user service on a cluster.
This field is required for Routes that represent traffic-forwarding resources (Ingress, Gateway routes).
It is optional for policy resources like BackendTrafficPolicy.		 Optional: {}
source RouteSource Source contains the information about the source of the route. This is used when the route is created from external sources. Optional: {}
loadBalancerPolicy LoadBalancerPolicy LoadBalancerPolicy defines the load balancing policy for this Route’s Envoy clusters.
Overrides Tenant and Config-level settings.		 Enum: [RoundRobin LeastRequest Random]
Optional: {}
timeouts EnvoyTimeouts Timeouts defines per-Route Envoy timeouts. Overrides Tenant and
Config timeouts per-field.		 Optional: {}
healthCheck HealthCheck HealthCheck defines the active health check for this Route’s Envoy clusters.
Whole-struct override: replaces Tenant and Config-level checks entirely.		 Optional: {}

RouteStatus

RouteStatus defines the observed state of the Route.

Appears in:

Field Description Default Validation
resources RouteResourcesStatus Resources contains the list of resources that are created/processed as a result of the Route.

ServicePort

ServicePort contains information on service’s port.

Appears in:

Field Description Default Validation
name string The name of this port within the service. This must be a DNS_LABEL.
All ports within a ServiceSpec must have unique names. When considering
the endpoints for a Service, this must match the ’name’ field in the
EndpointPort.
Optional if only one ServicePort is defined on this service.		 Optional: {}
protocol Protocol The IP protocol for this port. Supports “TCP”, “UDP”, and “SCTP”.
Default is TCP.		 TCP Optional: {}
appProtocol string The application protocol for this port.
This is used as a hint for implementations to offer richer behavior for protocols that they understand.
This field follows standard Kubernetes label syntax.
Valid values are either:
* Un-prefixed protocol names - reserved for IANA standard service names (as per
RFC-6335 and https://www.iana.org/assignments/service-names).
* Kubernetes-defined prefixed names:
* ‘kubernetes.io/h2c’ - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior-
* ‘kubernetes.io/ws’ - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455
* ‘kubernetes.io/wss’ - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455
* Other protocols should use implementation-defined prefixed names such as
mycompany.com/my-custom-protocol.		 Optional: {}
port integer The port that will be exposed by this service.
targetPort IntOrString Number or name of the port to access on the pods targeted by the service.
Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME.
If this is a string, it will be looked up as a named port in the
target Pod’s container ports. If this is not specified, the value
of the ‘port’ field is used (an identity map).
This field is ignored for services with clusterIP=None, and should be
omitted or set equal to the ‘port’ field.
More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service		 Optional: {}
nodePort integer The port on each node on which this service is exposed when type is
NodePort or LoadBalancer. Usually assigned by the system. If a value is
specified, in-range, and not in use it will be used, otherwise the
operation will fail. If not specified, a port will be allocated if this
Service requires one. If this field is specified when creating a
Service which does not need it, creation will fail. This field will be
wiped when updating a Service to no longer need it (e.g. changing type
from NodePort to ClusterIP).
More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport		 Optional: {}
upstreamTargetPort integer

ServiceStatus

Appears in:

Field Description Default Validation
ports ServicePort array

SyncSecret

SyncSecret is a wrapper over Kubernetes Secret object. This is used to sync secrets from tenants to the LB cluster in a controlled and secure way.

Appears in:

Field Description Default Validation
apiVersion string kubelb.k8c.io/v1alpha1
kind string SyncSecret
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
immutable boolean Optional: {}
data object (keys:string, values:integer array) Optional: {}
stringData object (keys:string, values:string) Optional: {}
type SecretType Optional: {}
status SyncSecretStatus Optional: {}

SyncSecretList

SyncSecretList contains a list of SyncSecrets

Field Description Default Validation
apiVersion string kubelb.k8c.io/v1alpha1
kind string SyncSecretList
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items SyncSecret array

SyncSecretPhase

Underlying type: string

SyncSecretPhase represents the lifecycle phase of a SyncSecret.

Appears in:

Field Description
Pending SyncSecretPhasePending means the SyncSecret has not yet been synced.
Synced SyncSecretPhaseSynced means the SyncSecret has been successfully synced to a Secret.
Failed SyncSecretPhaseFailed means the SyncSecret sync failed.
Terminating SyncSecretPhaseTerminating means the SyncSecret is being deleted.

SyncSecretStatus

SyncSecretStatus defines the observed state of SyncSecret.

Appears in:

Field Description Default Validation
observedGeneration integer ObservedGeneration is the most recent generation observed for this SyncSecret by the controller. Optional: {}
phase SyncSecretPhase Phase is the current lifecycle phase of the SyncSecret. Optional: {}
conditions Condition array Conditions represents the latest available observations of the SyncSecret’s state. Optional: {}

Tenant

Tenant is the Schema for the tenants API

Appears in:

Field Description Default Validation
apiVersion string kubelb.k8c.io/v1alpha1
kind string Tenant
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec TenantSpec
status TenantStatus

TenantEnvoyProxy

TenantEnvoyProxy defines tenant-level overrides for Envoy Proxy configuration.

Appears in:

Field Description Default Validation
replicas integer Replicas is the number of Envoy Proxy replicas for this tenant.
This field is ignored if Config.Spec.EnvoyProxy.UseDaemonset is true.		 Minimum: 1
Optional: {}
resources ResourceRequirements Resources defines the resource requirements for the Envoy Proxy container. Optional: {}

TenantList

TenantList contains a list of Tenant

Field Description Default Validation
apiVersion string kubelb.k8c.io/v1alpha1
kind string TenantList
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items Tenant array

TenantPhase

Underlying type: string

TenantPhase represents the lifecycle phase of a Tenant.

Appears in:

Field Description
Pending TenantPhasePending means the Tenant is being provisioned.
Ready TenantPhaseReady means the Tenant has been successfully reconciled.
Failed TenantPhaseFailed means the Tenant reconciliation failed.
Terminating TenantPhaseTerminating means the Tenant is being deleted.

TenantProxy

TenantProxy configures the tenant-cluster Envoy proxy for the MTLS backend transport.

Appears in:

Field Description Default Validation
serviceType TenantProxyServiceType ServiceType selects the Service type used to expose the tenant proxy
to the management Envoy. With NodePort (default), the CCM publishes
node addresses plus the allocated NodePort. With LoadBalancer, the
CCM publishes the Service’s load balancer ingress IPs/hostnames and
the management Envoy dials the fixed tenant proxy port (15443).		 NodePort Enum: [NodePort LoadBalancer]
Optional: {}
workload TenantProxyWorkload Workload selects how the tenant proxy pods are scheduled. DaemonSet
(default) runs one proxy per node. Deployment runs a fixed number of
replicas spread across nodes; the CCM then publishes only the node
addresses that host proxy pods so the management Envoy never dials a
node without a local proxy.		 DaemonSet Enum: [DaemonSet Deployment]
Optional: {}
replicas integer Replicas is the number of tenant proxy pods when Workload is
Deployment. Ignored for DaemonSet.		 2 Minimum: 1
Optional: {}

TenantProxyServiceType

Underlying type: string

Appears in:

Field Description
NodePort
LoadBalancer

TenantProxyWorkload

Underlying type: string

Appears in:

Field Description
DaemonSet
Deployment

TenantSpec

TenantSpec defines the desired state of Tenant

Appears in:

Field Description Default Validation
propagatedAnnotations map[string]string PropagatedAnnotations defines the set of annotation key patterns that will be propagated to load balancing resources.
Keys support shell-style glob patterns (e.g. “nginx.ingress.kubernetes.io/*”). Keep the value empty to allow any value;
otherwise the value is a comma-separated list of permitted values for exact match.
Tenant configuration has higher precedence than the annotations specified at the Config level.		 Optional: {}
propagateAllAnnotations boolean PropagateAllAnnotations defines whether all annotations will be propagated to load balancing resources.
If set to true, PropagatedAnnotations is ignored. DeniedAnnotations still applies on top of this flag.
Tenant configuration has higher precedence than the value specified at the Config level.		 Optional: {}
deniedAnnotations string array DeniedAnnotations is a list of annotation key patterns that are excluded from propagation, regardless of
PropagateAllAnnotations or PropagatedAnnotations. Patterns support shell-style globbing (e.g. “nginx.ingress.kubernetes.io/*”).
Tenant configuration has higher precedence than the value specified at the Config level.		 Optional: {}
defaultAnnotations object (keys:AnnotatedResource, values:Annotations) DefaultAnnotations defines the list of annotations(key-value pairs) that will be set on the load balancing resources if not already present. A special key all can be used to apply the same
set of annotations to all resources.
Tenant configuration has higher precedence than the annotations specified at the Config level.		 Optional: {}
loadBalancer LoadBalancerSettings
ingress IngressSettings
gatewayAPI GatewayAPISettings
dns DNSSettings
certificates CertificatesSettings
tunnel TenantTunnelSettings
waf TenantWAFSettings
envoyProxy TenantEnvoyProxy EnvoyProxy defines tenant-level overrides for Envoy Proxy configuration.
Fields set here take precedence over Config.Spec.EnvoyProxy.		 Optional: {}
circuitBreaker CircuitBreaker CircuitBreaker defines the circuit breaker configuration for this tenant’s Envoy clusters.
Overrides Config-level settings.		 Optional: {}
timeouts EnvoyTimeouts Timeouts defines tenant-level Envoy timeouts. Overrides Config
timeouts per-field. Route/LoadBalancer-level timeouts override
these.		 Optional: {}
networkPolicy NetworkPolicySettings NetworkPolicy defines network policy settings for this tenant’s namespace.
Tenant has higher precedence than the settings specified at the Config level.		 Optional: {}
loadBalancerPolicy LoadBalancerPolicy LoadBalancerPolicy defines the load balancing policy for this tenant’s Envoy clusters.
Overrides Config-level settings.		 Enum: [RoundRobin LeastRequest Random]
Optional: {}
healthCheck HealthCheck HealthCheck defines the active health check for this tenant’s Envoy clusters.
Whole-struct override: replaces the Config-level check entirely.
LoadBalancer/Route settings override this.		 Optional: {}
allowedDomains string array List of allowed domains for the tenant. This is used to restrict the domains that can be used
for the tenant. If specified, applies on all the components such as Ingress, GatewayAPI, DNS, certificates, etc.
Examples:
- [".example.com"] -> this allows subdomains at the root level such as example.com and test.example.com but won’t allow domains at one level above like test.test.example.com
- [".example.com"] -> this allows all subdomains of example.com such as test.dns.example.com and dns.example.com
- [“example.com”] -> this allows only example.com
- [""] or [""] -> this allows all domains
Note: “” was added as a special case to allow any levels of subdomains that come before it. “*” works for only 1 level.
Default: value is [""] and all domains are allowed.		 [**] Optional: {}

TenantState

TenantState is the Schema for the tenants API

Appears in:

Field Description Default Validation
apiVersion string kubelb.k8c.io/v1alpha1
kind string TenantState
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec TenantStateSpec
status TenantStateStatus

TenantStateList

TenantStateList contains a list of TenantState

Field Description Default Validation
apiVersion string kubelb.k8c.io/v1alpha1
kind string TenantStateList
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items TenantState array

TenantStateSpec

TenantStateSpec defines the desired state of TenantState.

Appears in:

TenantStateStatus

TenantStateStatus defines the observed state of TenantState

Appears in:

Field Description Default Validation
version Version
lastUpdated Time
conditions Condition array
tunnel TunnelState
loadBalancer LoadBalancerState
gatewayAPI GatewayAPIState
backendTransport BackendTransport
allowedDomains string array
timeouts EnvoyTimeouts Timeouts is the tenant-effective Envoy timeout configuration
(Tenant overrides merged over Config, per field). Consumed by the
tenant-side proxy render, which cannot read Config or Tenant.		 Optional: {}

TenantStatus

TenantStatus defines the observed state of Tenant

Appears in:

Field Description Default Validation
observedGeneration integer ObservedGeneration is the most recent generation observed for this Tenant by the controller. Optional: {}
phase TenantPhase Phase is the current lifecycle phase of the Tenant. Optional: {}
conditions Condition array Conditions represents the latest available observations of the Tenant’s state. Optional: {}

TenantTunnelSettings

TenantTunnelSettings defines the settings for the tunnel.

Appears in:

Field Description Default Validation
limit integer Limit is the maximum number of tunnels to create.
If a lower limit is set than the number of reources that exist, the limit will be disallow creation of new resources but will not delete existing resources. The reason behind this
is that it is not possible for KubeLB to know which resources are safe to remove.
disable boolean Disable is a flag that can be used to disable tunneling for a tenant.

TenantWAFPolicy

TenantWAFPolicy defines a tenant-authored Web Application Firewall policy for L7 routes. Unlike the cluster-scoped WAFPolicy, it is namespaced and created by tenants in their own tenant cluster. It applies to HTTPRoute and GRPCRoute resources owned by that tenant only.

Appears in:

Field Description Default Validation
apiVersion string kubelb.k8c.io/v1alpha1
kind string TenantWAFPolicy
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec TenantWAFPolicySpec
status TenantWAFPolicyStatus

TenantWAFPolicyList

TenantWAFPolicyList contains a list of TenantWAFPolicy.

Field Description Default Validation
apiVersion string kubelb.k8c.io/v1alpha1
kind string TenantWAFPolicyList
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items TenantWAFPolicy array

TenantWAFPolicySpec

TenantWAFPolicySpec defines the desired state of TenantWAFPolicy. Exactly one targeting method must be used: targetRef, targetSelector, or default. Setting multiple targeting methods is invalid. Policies without any targeting are ignored. Feature stage: Beta

Appears in:

Field Description Default Validation
default boolean Default when set to true applies this policy to all of this tenant’s routes.
It is the tenant-scoped analogue of WAFPolicy.global and never affects other
tenants or global config.
Mutually exclusive with TargetRef and TargetSelector.
Policies without default, targetRef, or targetSelector are ignored.		 Optional: {}
targetRef WAFTargetRef TargetRef identifies a specific route by name and optionally namespace.
For tenant policies, Kind is HTTPRoute or GRPCRoute and
namespace/originNamespace refer to the tenant-cluster namespace.
Mutually exclusive with Default and TargetSelector.		 Optional: {}
targetSelector LabelSelector TargetSelector selects routes or HTTPRoute/GRPCRoute resources by label.
It checks whether the route has the labels or the labels of the HTTPRoute/GRPCRoute resource. In case of a
conflict, the labels of the Route resource takes precedence.
Mutually exclusive with Default and TargetRef.		 Optional: {}
directives string array Directives contains SecLang/ModSecurity directives passed to Coraza.
Reference: https://coraza.io/docs/seclang/directives/
Tenant directives are untrusted. They are validated at sync time by
SanitizeTenantDirectives, a default-deny allowlist: dangerous directives
(SecRemoteRules, filesystem Include, log/path directives, exec/setenv, and
ctl actions targeting admin rule IDs) are rejected. The MaxItems/MaxLength
caps below are structural CRD limits; an admin can tighten them further at
runtime via Config.spec.waf.maxDirectivesPerPolicy and maxDirectiveLength.		 MaxItems: 64
items:MaxLength: 1024
Optional: {}
failureMode WAFFailureMode FailureMode defines behavior when WAF filter creation fails.
- Closed: Block traffic if WAF cannot be applied (default)
- Open: Allow traffic without WAF protection
Tenants may set this, but an admin enforceFailureMode on Config or Tenant
overrides the tenant-chosen value.		 Closed Enum: [Open Closed]
Optional: {}

TenantWAFPolicyStatus

TenantWAFPolicyStatus defines the observed state of TenantWAFPolicy.

Appears in:

Field Description Default Validation
conditions Condition array Conditions describe the current state of the TenantWAFPolicy. Optional: {}

TenantWAFSettings

TenantWAFSettings defines the tenant-scoped settings for tenant-authored WAF policies.

Appears in:

Field Description Default Validation
disableTenantPolicies boolean DisableTenantPolicies disables tenant-authored WAF policies (TenantWAFPolicy)
for this tenant. Admin-authored WAF (WAFPolicy) still applies.		 Optional: {}
limit integer Limit is the maximum number of TenantWAFPolicies for this tenant.
If a lower limit is set than the number of reources that exist, the limit will be disallow creation of new resources but will not delete existing resources. The reason behind this
is that it is not possible for KubeLB to know which resources are safe to remove.
Overrides Config.spec.waf.tenantPolicyLimit; Tenant has higher precedence than Config.		 Optional: {}
enforceFailureMode WAFFailureMode EnforceFailureMode, when set, overrides the tenant-chosen failureMode on this
tenant’s TenantWAFPolicies. Takes precedence over the Config-level value.		 Enum: [Open Closed]
Optional: {}

Tunnel

Tunnel is the Schema for the tunnels API

Appears in:

Field Description Default Validation
apiVersion string kubelb.k8c.io/v1alpha1
kind string Tunnel
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec TunnelSpec
status TunnelStatus

TunnelList

TunnelList contains a list of Tunnel

Field Description Default Validation
apiVersion string kubelb.k8c.io/v1alpha1
kind string TunnelList
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items Tunnel array

TunnelPhase

Underlying type: string

TunnelPhase represents the phase of tunnel

Appears in:

Field Description
Pending TunnelPhasePending means the tunnel is being provisioned
Ready TunnelPhaseReady means the tunnel is ready to accept connections
Failed TunnelPhaseFailed means the tunnel provisioning failed
Terminating TunnelPhaseTerminating means the tunnel is being terminated

TunnelResources

TunnelResources contains references to resources created for the tunnel

Appears in:

Field Description Default Validation
serviceName string ServiceName is the name of the service created for this tunnel Optional: {}
routeRef ObjectReference RouteRef is a reference to the route (HTTPRoute or Ingress) created for this tunnel Optional: {}

TunnelSettings

TunnelSettings defines the global settings for Tunnel resources.

Appears in:

Field Description Default Validation
limit integer Limit is the maximum number of tunnels to create.
If a lower limit is set than the number of reources that exist, the limit will be disallow creation of new resources but will not delete existing resources. The reason behind this
is that it is not possible for KubeLB to know which resources are safe to remove.
connectionManagerURL string ConnectionManagerURL is the URL of the connection manager service that handles tunnel connections.
This is required if tunneling is enabled.
For example: “https://con.example.com”		 Optional: {}
disable boolean Disable indicates whether tunneling feature should be disabled. Optional: {}

TunnelSpec

TunnelSpec defines the desired state of Tunnel

Appears in:

Field Description Default Validation
hostname string Hostname is the hostname of the tunnel. If not specified, the hostname will be generated by KubeLB. Optional: {}

TunnelState

Appears in:

Field Description Default Validation
disable boolean
limit integer
connectionManagerURL string

TunnelStatus

TunnelStatus defines the observed state of Tunnel

Appears in:

Field Description Default Validation
hostname string Hostname contains the actual hostname assigned to the tunnel Optional: {}
url string URL contains the full URL to access the tunnel Optional: {}
connectionManagerURL string ConnectionManagerURL contains the URL that clients should use to establish tunnel connections Optional: {}
phase TunnelPhase Phase represents the current phase of the tunnel Optional: {}
resources TunnelResources Resources contains references to the resources created for this tunnel Optional: {}
conditions Condition array Conditions represents the current conditions of the tunnel Optional: {}

UpstreamService

UpstreamService is a wrapper over the corev1.Service object. This is required as kubebuilder:validation:EmbeddedResource marker adds the x-kubernetes-embedded-resource to the array instead of the elements within it. Which results in a broken CRD; validation error. Without this marker, the embedded resource is not properly serialized to the CRD.

Appears in:

Field Description Default Validation
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata. Optional: {}
spec ServiceSpec Spec defines the behavior of a service.
https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		 Optional: {}
status ServiceStatus Most recently observed status of the service.
Populated by the system.
Read-only.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status		 Optional: {}

UpstreamTLSConfig

UpstreamTLSConfig configures TLS for connections from KubeLB’s Envoy proxy to backend endpoints. When not set, Envoy connects using plain TCP (no TLS).

Appears in:

Field Description Default Validation
policy UpstreamTLSPolicy Policy defines the upstream TLS verification mode. Enum: [Insecure Verify]
Required: {}
caSecretRef LocalObjectReference CASecretRef references a Secret containing the CA certificate for backend verification.
The Secret must contain a “ca.crt” key. Required when policy is “Verify”.		 Optional: {}

UpstreamTLSPolicy

Underlying type: string

UpstreamTLSPolicy defines how KubeLB’s Envoy proxy handles TLS to backends.

Validation:

  • Enum: [Insecure Verify]

Appears in:

Field Description
Insecure UpstreamTLSPolicyInsecure enables TLS but skips certificate verification (ACCEPT_UNTRUSTED).
Use for self-signed certs, certs without SANs, or expired certs.
Verify UpstreamTLSPolicyVerify enables TLS and verifies the backend certificate against a provided CA.

Version

Appears in:

Field Description Default Validation
gitVersion string
gitCommit string
buildDate string
edition string

WAFFailureMode

Underlying type: string

WAFFailureMode defines how routes behave when WAF filter creation fails.

Validation:

  • Enum: [Open Closed]

Appears in:

Field Description
Open WAFFailureModeOpen allows traffic through without WAF protection if filter fails.
Closed WAFFailureModeClosed blocks traffic if WAF filter cannot be applied.

WAFPolicy

WAFPolicy defines Web Application Firewall policy for L7 routes. Applies to HTTPRoute and GRPCRoute resources.

Appears in:

Field Description Default Validation
apiVersion string kubelb.k8c.io/v1alpha1
kind string WAFPolicy
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec WAFPolicySpec
status WAFPolicyStatus

WAFPolicyList

WAFPolicyList contains a list of WAFPolicy.

Field Description Default Validation
apiVersion string kubelb.k8c.io/v1alpha1
kind string WAFPolicyList
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items WAFPolicy array

WAFPolicySpec

WAFPolicySpec defines the desired state of WAFPolicy. Exactly one targeting method must be used: targetRef, targetSelector, or global. Setting multiple targeting methods is invalid. Policies without any targeting are ignored. Feature stage: Beta

Appears in:

Field Description Default Validation
global boolean Global when set to true applies this policy to all routes for all tenants within a KubeLB installation.
Mutually exclusive with TargetRef and TargetSelector.
Policies without global, targetRef, or targetSelector are ignored.		 Optional: {}
targetRef WAFTargetRef TargetRef identifies a specific route by name and optionally namespace.
Mutually exclusive with Global and TargetSelector.		 Optional: {}
targetSelector LabelSelector TargetSelector selects routes or HTTPRoute/GRPCRoute resources by label.
It checks whether the route has the labels or the labels of the HTTPRoute/GRPCRoute resource. In case of a
conflict, the labels of the Route resource takes precedence.
Mutually exclusive with Global and TargetRef.		 Optional: {}
directives string array Directives contains SecLang/ModSecurity directives passed to Coraza.
Reference: https://coraza.io/docs/seclang/directives/
If empty, the following OWASP CRS defaults are applied:
- SecRuleEngine On
- SecRequestBodyAccess On
- SecRequestBodyLimit 13107200
- Include @crs-setup-conf
- Include @owasp_crs/*.conf
The MaxItems/MaxLength caps below are structural CRD limits mirroring
TenantWAFPolicy. They bound a single policy’s blast radius; the CRS ruleset
itself lives in the WASM binary, not the directive list, so these caps do
not limit the protections in effect.		 MaxItems: 64
items:MaxLength: 1024
Optional: {}
failureMode WAFFailureMode FailureMode defines behavior when WAF filter creation fails.
- Closed: Block traffic if WAF cannot be applied (default)
- Open: Allow traffic without WAF protection		 Closed Enum: [Open Closed]
Optional: {}

WAFPolicyStatus

WAFPolicyStatus defines the observed state of WAFPolicy.

Appears in:

Field Description Default Validation
conditions Condition array Conditions describe the current state of the WAFPolicy. Optional: {}

WAFSettings

WAFSettings defines settings for the WAF (Web Application Firewall).

Appears in:

Field Description Default Validation
wasmInitContainerImage string WASMInitContainerImage overrides the image used for the WASM init container.
If empty, defaults to the kubelb-manager image detected at runtime.		 Optional: {}
skipValidation boolean SkipValidation skips directive validation for WAFPolicies.
When true, all WAFPolicies are marked as valid without parsing.		 Optional: {}
enableTenantPolicies boolean EnableTenantPolicies is the global opt-in for tenant-authored WAF policies
(TenantWAFPolicy). Defaults to false: when unset, TenantWAFPolicies are
ignored and their CRD/controller stay inert, so upgrades see zero behavior
change until an admin enables the feature.		 Optional: {}
enforceFailureMode WAFFailureMode EnforceFailureMode, when set, overrides the tenant-chosen failureMode on
every TenantWAFPolicy cluster-wide. A per-Tenant EnforceFailureMode takes
precedence over this value.		 Enum: [Open Closed]
Optional: {}
tenantPolicyLimit integer TenantPolicyLimit is the maximum number of TenantWAFPolicies allowed per tenant.
If a lower limit is set than the number of reources that exist, the limit will be disallow creation of new resources but will not delete existing resources. The reason behind this
is that it is not possible for KubeLB to know which resources are safe to remove.
If nil, the number of TenantWAFPolicies per tenant is unlimited.		 Optional: {}
maxDirectivesPerPolicy integer MaxDirectivesPerPolicy is the runtime cap on the number of directive lines
per TenantWAFPolicy enforced by the sanitizer (multi-line directive items
are counted per line). Defaults to 64, matching the TenantWAFPolicy CRD item
cap. Set to 0 for unlimited.		 64 Optional: {}
maxDirectiveLength integer MaxDirectiveLength is the runtime cap on the length of a single tenant
directive line enforced by the sanitizer. Defaults to 1024, matching the
TenantWAFPolicy CRD per-item length cap. Set to 0 for unlimited.		 1024 Optional: {}

WAFTargetRef

WAFTargetRef identifies a route by name.

Appears in:

Field Description Default Validation
group string Group is the API group of the target resource. gateway.networking.k8s.io
namespace string Namespace is the management cluster namespace (e.g., tenant-primary).
If omitted, matches across all namespaces.		 Optional: {}
originNamespace string OriginNamespace is the namespace of the original resource in the tenant
cluster (the kubelb.k8c.io/origin-ns). Two routes synced into the same
management namespace from different tenant-cluster namespaces can share an
origin name; set OriginNamespace to disambiguate them. If omitted, origin
namespace is not considered during matching.		 Optional: {}
name string Name is the name of the target resource which could either be the name of the resource in management cluster
that is generated by KubeLB or the kubelb.k8c.io/origin-name that is the original name of the resource in the tenant cluster.		 MinLength: 1