API version: v1alpha2
This release includes improvements to our webhook, including:
- Migrating kube-webhook-certgen to k8s.gcr.io/ingress-nginx:v1.1.1. #1126
- New validation to ensure that a HTTPRouterFilter Type matches its value #1071
- A fix to ensure that Path match validation actually works #1071
API version: v1alpha2
This release is intended to verify our webhook image tagging process.
- Update image generation process with more consistent naming #1034
API version: v1alpha2
This release contains minor bug fixes for v1alpha2.
- ControllerName now prints correctly in kubectl output for GatewayClass #909
- Namespace can no longer be left unspecified in ReferencePolicy #964
- Wildcard characters can no longer be used in redirect Hostname values #956
API version: v1alpha2
This release contains significant breaking changes as we strive for a concise API. We anticipate that this API will be very similar to a future v1beta1 release.
The following changes have been made since v0.3.0:
-
The Gateway API APIGroup has moved from
networking.x-k8s.io
togateway.networking.k8s.io
. This means that, as far as the apiserver is concerned, this version is wholly distinct from v1alpha1, and automatic conversion is not possible. As part of this process, Gateway API is now subject to Kubernetes API review, the same as changes made to core API resources. More details in #780 and #716. -
Gateway-Route binding changes (GEP-724): In v1alpha1, Gateways chose which Routes were attached using a combination of object and namespace selectors, with the option of also specifying object names. This resulted in a very complex config, that's easy to misinterpret. As part of v1alpha2, we're changing to:
- Gateways may specify what kind of Routes they support (defaults to same protocol if not specified), and where those Routes can be (defaults to same namespace).
- Routes must directly reference the Gateways the want to attach to, this is a list, so a Route can attach to more than one Gateway.
- The Route becomes attached only when the specifications intersect.
We believe this is quite a bit easier to understand, and still gives good flexibility for most use cases. GEP added in #725. Implemented in #754. Further documentation was added in #762.
-
Safer cross-namespace references (GEP-709): This concerns (currently), references from Routes to Backends, and Gateways to Secrets. The new behavior is:
- By default, references across namespaces are not permitted; creating a reference across a namespace (like a Route referencing a Service in another namespace) must be rejected by implementations.
- These references can be accepted by creating a ReferencePolicy in the referent (target) namespace, that specifies what Kind is allowed to accept incoming references, and from what namespace and Kind the references may be.
The intent here is that the owner of the referent namespace must explicitly accept incoming references, otherwise we can run into all sorts of bad things from breaking the namespace security model. Implemented in #741.
-
Attaching Policy to objects (GEP-713): This has been added so that we have an extensible mechanism for adding a cascading set of policy to Gateway API objects.
What policy? Well, it's kind of up to the implementations, but the best example to begin with is timeout policy.
Timeout policy for HTTP connections is highly depedent on how the underlying implementation handles policy - it's very difficult to extract commonalities.
This is intended to allow things like:
- Attach a policy that specifies the default connection timeout for backends to a GatewayClass. All Gateways that are part of that Class will have Routes get that default connection timeout unless they specify differently.
- If a Gateway that's a member of the GatewayClass has a different default attached, then that will beat the GatewayClass (for defaults, more specific object beats less specific object).
- Alternatively, a Policy that mandates that you can't set the client timeout to "no timeout" can be attached to a GatewayClass as an override. An override will always take effect, with less specific beating more specific.
This one is a bit complex, but will allow implementations to solve some things that currently require tools like admission control. Implemented in #736.
-
As part of GEP-713,
BackendPolicy
has been removed, as its functionality is now better handled using that mechanism. #732. -
Removal of certificate references from HTTPRoutes (GEP-746): In v1alpha1, HTTPRoute objects have a stanza that allows referencing a TLS keypair, intended to allow people to have a more self-service model, where an app owner can provision a TLS keypair inside their own namespace, attach it to a HTTPRoute they control, and then have that used to secure their app. When implementing this, however, there are a large number of edge cases that are complex, hard to handle, and poorly defined - about checking SNI, hostname, and overrides, that made even writing a spec on how to implement this very difficult, let alone actually implementing it.
In removing certificate references from HTTPRoute, we're using the ReferencePolicy from GEP-709 to allow Gateways to securely create a cross-namespace reference to TLS keypairs in app namespaces. We're hopeful that this will hit most of the self-service use case, and even if not, provide a basis to build from to meet it eventually. GEP added in #749. Implemented in #768.
GEP-851 was a follow up on this change that allowed multiple Certificate Refs per Gateway Listener. This was implemented in #852.
-
The
RouteForwardTo
(YAML:routeForwardTo
) struct/stanza has been reworked into theBackendRef
(YAML:backendRef
) struct/stanza, GEP-718. As part of this change, theServiceName
(YAML:serviceName
) field has been removed, and Service references must instead now use theBackendRef
/backendRef
struct/stanza.
-
Extension points within match blocks from all Routes have been removed #829. Implements GEP-820. These extension points have been removed because they are currently not used, are poorly understood, and we don't have good use cases for them. We may consider re-adding them in the future.
-
Controller is now a required field in Gateway references from Route status. #671.
-
Header Matching, Query Param Matching, and HTTPRequestHeaderFilter now use named subobjects instead of maps. #657 and #681
-
#796 API Review suggestions:
- listener.routes has been renamed to listener.allowedRoutes
- The
NoSuchGatewayClass
has been removed after it was deprecated in v1alpha1 *
is no longer a valid hostname. Instead, leaving hostname unspecified is interpreted as*
.
-
The
scope
field has been removed from all object references. #882 -
"Controller" has been renamed to "ControllerName" #839
-
"Admitted" condition has been renamed to "Accepted" and now defaults to an "Unknown" state instead of "False" #839
-
HTTPRequestRedirectFilter's Protocol field has been renamed to Scheme. #863
-
ImplementationSpecific match types in HTTPRoute's path, query, and header matches have been removed. #850
-
The "Prefix" path match type has been renamed "PathPrefix". #898
-
HTTP Method matching is now added into HTTPRoute, with Extended support: #733.
-
GatewayClass now has a 'Description' field that is printed as a column in
kubectl get
output. You can now end up with output that looks like this:$> kubectl get gatewayclass NAME CONTROLLER DESCRIPTION internal gateway-controller-internal For non-internet-facing Gateways. external gateway-controller-external For internet-facing Gateways.
- Ensure TLSConfig is empty when the protocol is HTTP, TCP, or UDP #886
- Ensure Hostname is empty when the protocol is TCP or UDP. #886
- Listener ProtocolType now has validation. #871
- HTTP Path match values are now validated for PathMatchExact and PathMatchPrefix match types. #894
- TLS options keys are now subject to the same validation as Kubernetes annotations. #886
- TLS options values now have a max length of 4096 characters. #886
- Make
MirrorFilter.BackendRef
a required field when the mirror filter is used #837.
- Updated guidance on how HTTP and TLS Route status should be populated when hostnames do not match. #859
- Aligned path prefix matching with Ingress by clarifying that it is a prefix of path elements. #869
- HTTP listeners may now be used for Cleartext HTTP/2. #879
- Added clarification that implementation-specific TLS options MUST be domain-prefixed. #899
- #782 : Restructure docs and split into versioned and unversioned
- #777 : Fix typo
- #765 : document multi-value headers as undefined
- #761 : minor improvements to navigation on docs site
- #760 : Remove references of vendor configurations in GatewayTLSConfig
- #756 : Clarify docs on invalid serviceName
- #755 : Document the supported kubernetes versions
- #745 : Remove RouteTLSConfig requirement for gateway TLS passthrough.
- #744 : automate nav for GEPs
- #743 : Add READY and ADDRESS to gateway printer columns
- #742 : Moving method match to v1alpha2 example
- #729 : Adding suggested reasons for when conditions are healthy
- #728 : Fixing wording in enhancement template
- #723 : Clarifying Redirect Support levels
- #756 : Clarify docs on invalid serviceName
- #880 : Reworking Policy vs. Filter Documentation
- #878 : Clarifying the fields that all Route types must include
- #875 : Fix HTTP path match documentation.
- #864 : Merging v1alpha2 concepts docs into unversioned docs
- #858 : Fixing broken link to spec page
- #857 : Adding missing references pages to docs navigation
- #853 : docs: Use v0.4.0-rc1 in "Getting started with Gateway APIs" for v1alpha2
- #845 : Fix markdown list formatting.
- #844 : docs: add ssl passthrough note in FAQ
- #843 : Add APISIX implementation
- #834 : Fixes some broken links
- #807 : docs: update multiple-ns guide for v1alpha2
- #888 : Corrected broken getting started
- #885 : Fix incorrect urls
- #890 : Updating HTTPRoute docs for v1alpha2
- #870 : Adding guidance on Kind vs. Resource in implementation guidelines
- #865 : Route cleanup for v1alpha2 sig-network review
- #766 : comment out the GEP notice
- #758 : bump up mkdocs and deps
- #751 : bump up deps to k8s v1.22
- #748 : fix kustomize to install v1a2 crds
- #747 : Cleaning up GEP Template
- #889 : remove outdated version label
- #883 : validating webhook cleanup
- #872 : Remove duplicate validation from CRD & Webhook
API version: v1alpha2
The group expects that this release candidate has no changes before we release v1alpha2 final, but are cutting here to allow implementations a chance to check before we go to the final release.
In general, most of the changes below have been made to reduce the complexity of the API for v1alpha2, on the assumption that we can add functionality in later in the API's lifecycle, but cannot remove it.
The following changes have been made since v0.4.0-rc1:
- Replace
CertificateRef
field withCertificateRefs
inGatewayTLSConfig
. #852. This implements GEP-851, Allow Multiple Certificate Refs per Gateway Listener. - Extension points within match blocks from all Routes have been removed #829. Implements GEP-820. These extension points have been removed because they are currently not used, are poorly understood, and we don't have good use cases for them. We may consider re-adding them in the future.
- Make
MirrorFilter.BackendRef
a required field when the mirror filter is used #837. - ImplementationSpecific match types in HTTPRoute's path, query, and header matches have been removed. #850
- The "Prefix" path match type has been renamed "PathPrefix".
- The "ClassName" field in PolicyTargetReference has been removed.
- A new optional "Name" field has been added to ReferencePolicyTo. #898
- "Controller" has been renamed to "ControllerName"
- "Admitted" condition has been renamed to "Accepted" and now defaults to an "Unknown" state instead of "False" #839
- HTTPRequestRedirectFilter's Protocol field has been renamed to Scheme. #863
- Validation: Ensure TLSConfig is empty when the protocol is HTTP, TCP, or UDP #886
- Validation: Ensure Hostname is empty when the protocol is TCP or UDP. #886
- Validation: Listener ProtocolType now has validation. #871
- Validation: HTTP Path match values are now validated for PathMatchExact and PathMatchPrefix match types. #894
- Updated guidance on how HTTP and TLS Route status should be populated when hostnames do not match. #859
- Aligned path prefix matching with Ingress by clarifying that it is a prefix of path elements. #869
- HTTP listeners may now be used for Cleartext HTTP/2. #879
- The
scope
field has been removed from all object references. - ParentRefs can no longer refer to cluster-scoped resources. #882
- TLS options keys are now subject to the same validation as Kubernetes annotations. #886
- TLS options values now have a max length of 4096 characters. #886
- Added clarification that implementation-specific TLS options MUST be domain-prefixed. #899
- #890 : Updating HTTPRoute docs for v1alpha2
- #889 : remove outdated version label
- #888 : Corrected broken getting started
- #885 : Fix incorrect urls
- #883 : v1alpha2 validation fix/update
- #880 : Reworking Policy vs. Filter Documentation
- #878 : Clarifying the fields that all Route types must include
- #875 : Fix HTTP path match documentation.
- #872 : Remove duplicate validation from CRD & Webhook
- #870 : Adding guidance on Kind vs. Resource in implementation guidelines
- #865 : Route cleanup for v1alpha2 sig-network review
- #864 : Merging v1alpha2 concepts docs into unversioned docs
- #858 : Fixing broken link to spec page
- #857 : Adding missing references pages to docs navigation
- #853 : docs: Use v0.4.0-rc1 in "Getting started with Gateway APIs" for v1alpha2
- #845 : Fix markdown list formatting.
- #844 : docs: add ssl passthrough note in FAQ
- #843 : Add APISIX implementation
- #834 : Fixes some broken links
- #807 : docs: update multiple-ns guide for v1alpha2
API version: v1alpha2
The working group expects that this release candidate is quite close to the final v1alpha2 API. However, breaking API changes are still possible.
This release candidate is suitable for implementors, but the working group does not recommend shipping products based on a release candidate API due to the possibility of incompatible changes prior to the final release.
-
The Gateway API APIGroup has moved from
networking.x-k8s.io
togateway.networking.k8s.io
. This means that, as far as the apiserver is concerned, this version is wholly distinct from v1alpha1, and automatic conversion is not possible. As part of this process, Gateway API is now subject to Kubernetes API review, the same as changes made to core API resources. More details in #780 and #716. -
Gateway-Route binding changes: GEP-724. Currently, Gateways choose which Routes are attached using a combination of object and namespace selectors, with the option of also specifying object names. This has made a very complex config, that's easy to misinterpret. As part of v1alpha2, we're changing to:
- Gateways may specify what kind of Routes they support (defaults to same protocol if not specified), and where those Routes can be (defaults to same namespace).
- Routes must directly reference the Gateways the want to attach to, this is a list, so a Route can attach to more than one Gateway.
- The Route becomes attached only when the specifications intersect.
We believe this is quite a bit easier to understand, and still gives good flexibility for most use cases. GEP added in #725. Implemented in #754. Further documentation was added in #762.
-
Safer cross-namespace references: (GEP-709): This concerns (currently), references from Routes to Backends, and Gateways to Secrets. The new behavior is:
- By default, references across namespaces are not permitted; creating a reference across a namespace (like a Route referencing a Service in another namespace) must be rejected by implementations.
- These references can be accepted by creating a ReferencePolicy in the referent (target) namespace, that specifies what Kind is allowed to accept incoming references, and from what namespace and Kind the references may be.
The intent here is that the owner of the referent namespace must explicitly accept incoming references, otherwise we can run into all sorts of bad things from breaking the namespace security model. Implemented in #741.
-
Attaching Policy to objects: GEP-713: This has been added so that we have an extensible mechanism for adding a cascading set of policy to Gateway API objects.
What policy? Well, it's kind of up to the implementations, but the best example to begin with is timeout policy.
Timeout policy for HTTP connections is highly depedent on how the underlying implementation handles policy - it's very difficult to extract commonalities.
This is intended to allow things like:
- Attach a policy that specifies the default connection timeout for backends to a GatewayClass. All Gateways that are part of that Class will have Routes get that default connection timeout unless they specify differently.
- If a Gateway that's a member of the GatewayClass has a different default attached, then that will beat the GatewayClass (for defaults, more specific object beats less specific object).
- Alternatively, a Policy that mandates that you can't set the client timeout to "no timeout" can be attached to a GatewayClass as an override. An override will always take effect, with less specific beating more specific.
This one is a bit complex, but will allow implementations to solve some things that currently require tools like admission control. Implemented in #736.
-
As part of GEP-713,
BackendPolicy
has been removed, as its functionality is now better handled using that mechanism. #732. -
Removal of certificate references from HTTPRoutes: GEP-746: In v1alpha1, HTTPRoute objects have a stanza that allows referencing a TLS keypair, intended to allow people to have a more self-service model, where an app owner can provision a TLS keypair inside their own namespace, attach it to a HTTPRoute they control, and then have that used to secure their app. When implementing this, however, there are a large number of edge cases that are complex, hard to handle, and poorly defined - about checking SNI, hostname, and overrides, that made even writing a spec on how to implement this very difficult, let alone actually implementing it.
In removing certificate references from HTTPRoute, we're using the ReferencePolicy from GEP-709 to allow Gateways to securely create a cross-namespace reference to TLS keypairs in app namespaces. We're hopeful that this will hit most of the self-service use case, and even if not, provide a basis to build from to meet it eventually. GEP added in #749. Implemented in #768.
-
The
RouteForwardTo
(YAML:routeForwardTo
) struct/stanza has been reworked into theBackendRef
(YAML:backendRef
) struct/stanza, GEP-718. As part of this change, theServiceName
(YAML:serviceName
) field has been removed, and Service references must instead now use theBackendRef
/backendRef
struct/stanza.
-
HTTP Method matching is now added into HTTPRoute, with Extended support: #733.
-
GatewayClass now has a 'Description' field that is printed as a column in
kubectl get
output. You can now end up with output that looks like this:$> kubectl get gatewayclass NAME CONTROLLER DESCRIPTION internal gateway-controller-internal For non-internet-facing Gateways. external gateway-controller-external For internet-facing Gateways.
-
#671: Controller is now a required field in Gateway references from Route status. Fixes #669.
-
#657: and #681 Header Matching, Query Param Matching, and HTTPRequestHeaderFilter now use named subobjects instead of maps.
-
#796 API Review suggestions:
- listener.routes has been renamed to listener.allowedRoutes
- The
NoSuchGatewayClass
has been removed after it was deprecated in v1alpha1 *
is no longer a valid hostname. Instead, leaving hostname unspecified is interpreted as*
.
- #782 : Restructure docs and split into versioned and unversioned
- #777 : Fix typo
- #765 : document multi-value headers as undefined
- #761 : minor improvements to navigation on docs site
- #760 : Remove references of vendor configurations in GatewayTLSConfig
- #756 : Clarify docs on invalid serviceName
- #755 : Document the supported kubernetes versions
- #745 : Remove RouteTLSConfig requirement for gateway TLS passthrough.
- #744 : automate nav for GEPs
- #743 : Add READY and ADDRESS to gateway printer columns
- #742 : Moving method match to v1alpha2 example
- #729 : Adding suggested reasons for when conditions are healthy
- #728 : Fixing wording in enhancement template
- #723 : Clarifying Redirect Support levels
- #756 : Clarify docs on invalid serviceName
- #766 : comment out the GEP notice
- #758 : bump up mkdocs and deps
- #751 : bump up deps to k8s v1.22
- #748 : fix kustomize to install v1a2 crds
- #747 : Cleaning up GEP Template
API Version: v1alpha1
- The
NoSuchGatewayClass
status reason has been deprecated. #635
.spec.rules.matches.path
now has a defaultprefix
match on the/
path. #584- Conflict resolution guidance has been added for rules within a route. #620
- HTTPRoute now supports query param matching. #631
- Route status now includes controller name for each Gateway. #616
- Conflict resolution guidance has been added for non-HTTP routes. #626
- Fields of type LocalObjectRef do not default to "secrets". All LocalObjectRef fields must be specified. #570
- CRDs have been added to gateway-api category #592
- New "Age" column has been added to all resources in
kubectl get
output. #592 - A variety of Go types have been changed to pointers to better reflect their optional status. #564 #572 #579
API Version: v1alpha1
Service APIs has been renamed to Gateway API. #536.
- The default status condition of GatewayClass resource is now
Admitted:false
instead ofInvalidParameters:Unknown
. #471. GatewayClass.spec.parametersRef
now has an optionalnamespace
field to refer to a namespace-scoped resource in addition to cluster-scoped resource. #543.
spec.listeners[].tls.mode
now defaults toTerminate
. #518.- Empty
hostname
in a listener matches all request. #525.
- New
set
property has been introduced forHTTPRequestHeader
Filter. Headers specified underset
are overriden instead of added. #475.
- Maximum limit for
forwardTo
has been increased from4
to16
for all route types. #493. - Various changes have been made in the Kubernetes and Go API to align with upstream Kubernetes API conventions. Some of the fields have been changed to pointers in the Go API for this reason. #538.
There are minor improvements to docs all around. New guides, clarifications and various typos have been fixed.
API Version: v1alpha1
- CRD now includes
gc
short name. - Change the standard condition for GatewayClass to
Admitted
, withInvalidParameters
as a sample reason for it to be false.
- CRD now includes
gtw
short name. - The
DroppedRoutes
condition has been renamed toDegradedRoutes
. ListenerStatus
now includesProtocol
andHostname
to uniquely link the status to each listener.
- HTTPRoute clarifications:
- Header name matching must be case-insensitive.
- Match tiebreaking semantics have been outlined in detail.
- TCPRoute, TLSRoute, and UDPRoute:
- At least 1 ForwardTo must be specified in each rule.
- Clarification that if no matches are specified, all requests should match a rule.
- TCPRoute and UDPRoute: Validation has been added to ensure that 1-16 rules are specified, matching other route types.
- TLSRoute: SNIs are now optional in matches. If no SNI or extensionRef are specified, all requests match.
- CRD now includes
bp
short name. - A new
networking.x-k8s.io/app-protocol
annotation can be used to specify AppProtocol on Services when the AppProtocol field is unavailable.
API Version: v1alpha-rc2
- A recommendation to set a
gateway-exists-finalizer.networking.x-k8s.io
finalizer on GatewayClass has been added. allowedGatewayNamespaces
has been removed from GatewayClass in favor of implementations with policy agents like Gatekeeper.
- Fields in
listeners.routes
have been renamed:routes.routeSelector
->routes.selector
routes.routeNamespaces
->routes.namespaces
clientCertificateRef
has been removed from BackendPolicy.- In Listeners,
routes.namespaces
now defaults to{from: "Same"}
. - In Listeners, support has been added for specifying custom, domain prefixed protocols.
- In Listeners,
hostname
now closely matches Route hostname matching with wildcard support. - A new
UnsupportedAddress
condition has been added to Listeners to indicate that a requested address is not supported. - Clarification has been added to note that listeners may be merged in certain instances.
- HeaderMatchType now includes a RegularExpression option.
- Minimum weight has been decreased from 1 to 0.
- Port is now required on all Routes.
- On HTTPRoute, filters have been renamed:
ModifyRequestHeader
->RequestHeaderModifier
MirrorRequest
->RequestMirror
Custom
->ExtensionRef
- TLSRoute can now specify as many as 16 SNIs instead of 10.
- Limiting the number of Gateways that may be stored in RouteGatewayStatus to 100.
- Support level of filters defined in ForwardTo has been clarified.
- Max weight has been increased to 1 million.
API Version: v1alpha-rc1
- Initial release candidate for v1alpha1.