KubeLB Enterprise Edition CRD References

Enterprise Edition

API Reference

Packages

kubelb.k8c.io/v1alpha1

kubelb.k8c.io/v1alpha1

Package v1alpha1 contains API Schema definitions for the kubelb.k8c.io v1alpha1 API group

Resource Types

Addresses
AddressesList
Config
ConfigList
Insight
InsightList
LoadBalancer
LoadBalancerList
Route
RouteList
SyncSecret
SyncSecretList
Tenant
TenantList
TenantState
TenantStateList
TenantWAFPolicy
TenantWAFPolicyList
Tunnel
TunnelList
WAFPolicy
WAFPolicyList

Addresses

Addresses is the Schema for the addresses API

Appears in:

AddressesList

Field	Description	Default	Validation
`apiVersion` string	`kubelb.k8c.io/v1alpha1`
`kind` string	`Addresses`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` AddressesSpec
`status` AddressesStatus

AddressesList

AddressesList contains a list of Addresses

Field	Description	Default	Validation
`apiVersion` string	`kubelb.k8c.io/v1alpha1`
`kind` string	`AddressesList`
`metadata` ListMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`items` Addresses array

AddressesSpec

AddressesSpec defines the desired state of Addresses

Appears in:

Addresses

Field	Description	Default	Validation
`addresses` EndpointAddress array	Addresses contains a list of addresses.		MinItems: 1

AddressesStatus

AddressesStatus defines the observed state of Addresses

Appears in:

Addresses

AnnotatedResource

Underlying type: string

Validation:

Enum: [all service ingress gateway httproute grpcroute tcproute udproute tlsroute]

Appears in:

AnnotationSettings
ConfigSpec
TenantSpec

Field	Description
`all`
`service`
`ingress`
`gateway`
`httproute`
`grpcroute`
`tcproute`
`udproute`
`tlsroute`

AnnotationSettings

Appears in:

ConfigSpec
TenantSpec

Field	Description	Validation
`propagatedAnnotations` map[string]string	PropagatedAnnotations defines the set of annotation key patterns that will be propagated to load balancing resources. Keys support shell-style glob patterns (e.g. “nginx.ingress.kubernetes.io/*”). Keep the value empty to allow any value; otherwise the value is a comma-separated list of permitted values for exact match. Tenant configuration has higher precedence than the annotations specified at the Config level.	Optional: {}
`propagateAllAnnotations` boolean	PropagateAllAnnotations defines whether all annotations will be propagated to load balancing resources. If set to true, PropagatedAnnotations is ignored. DeniedAnnotations still applies on top of this flag. Tenant configuration has higher precedence than the value specified at the Config level.	Optional: {}
`deniedAnnotations` string array	DeniedAnnotations is a list of annotation key patterns that are excluded from propagation, regardless of PropagateAllAnnotations or PropagatedAnnotations. Patterns support shell-style globbing (e.g. “nginx.ingress.kubernetes.io/*”). Tenant configuration has higher precedence than the value specified at the Config level.	Optional: {}
`defaultAnnotations` object (keys:AnnotatedResource, values:Annotations)	DefaultAnnotations defines the list of annotations(key-value pairs) that will be set on the load balancing resources if not already present. A special key `all` can be used to apply the same set of annotations to all resources. Tenant configuration has higher precedence than the annotations specified at the Config level.	Optional: {}

Annotations

Underlying type: object

Appears in:

AnnotationSettings
ConfigSpec
TenantSpec

BackendTransport

Appears in:

ConfigSpec
TenantStateStatus

Field	Description	Default	Validation
`mode` BackendTransportMode	Mode controls how management Envoy connects to tenant backends. Direct preserves the existing node-address plus workload NodePort topology. MTLS routes L7 and L4 TCP traffic through a KubeLB-managed tenant Envoy proxy. MTLS is a Beta / Technical Preview feature: safe to enable and supported, but its configuration surface may still change between releases with migration instructions. See https://docs.kubermatic.com/kubermatic/main/architecture/feature-stages/	Direct	Enum: [Direct MTLS] Optional: {}
`udp` BackendTransportUDP	UDP configures how UDP traffic reaches tenant backends when Mode is MTLS. It has no effect in Direct mode.		Optional: {}
`tenantProxy` TenantProxy	TenantProxy tunes the KubeLB-managed tenant Envoy proxy used in the MTLS topology. It has no effect in Direct mode.		Optional: {}

BackendTransportMode

Underlying type: string

Appears in:

BackendTransport

Field	Description
`Direct`
`MTLS`

BackendTransportUDP

Appears in:

BackendTransport

Field	Description	Default	Validation
`mode` BackendTransportUDPMode	Mode selects the UDP transport in the MTLS topology. Tunnel wraps each UDP session in CONNECT-UDP over the encrypted mTLS tenant proxy port. Direct is an escape hatch that keeps UDP on plain per-service NodePorts (unencrypted) for workloads sensitive to the tunnel’s MTU overhead or Envoy’s upstream CONNECT-UDP maturity.	Tunnel	Enum: [Tunnel Direct] Optional: {}

BackendTransportUDPMode

Underlying type: string

Appears in:

BackendTransportUDP

Field	Description
`Tunnel`
`Direct`

CertificatesSettings

CertificatesSettings defines the settings for the certificates.

Appears in:

TenantSpec

Field	Description	Default	Validation
`disable` boolean	Disable is a flag that can be used to disable certificate automation for a tenant.
`defaultClusterIssuer` string	DefaultClusterIssuer is the Cluster Issuer to use for the certificates by default. This is applied when the cluster issuer is not specified in the annotations on the resource itself.
`allowedDomains` string array	AllowedDomains is a list of allowed domains for automated Certificate management. Has a higher precedence than the value specified in the Config. If empty, the value specified in `tenant.spec.allowedDomains` will be used. Examples: - [".example.com"] -> this allows subdomains at the root level such as example.com and test.example.com but won’t allow domains at one level above like test.test.example.com - [".example.com"] -> this allows all subdomains of example.com such as test.dns.example.com and dns.example.com - [“example.com”] -> this allows only example.com - [""] or [""] -> this allows all domains Note: “*” was added as a special case to allow any levels of subdomains that come before it. “” works for only 1 level.

CircuitBreaker

CircuitBreaker defines the Circuit Breaker configuration for Envoy clusters. Circuit breakers prevent cascading failures by limiting connections/requests to upstream clusters. For more info: https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/circuit_breaking

Appears in:

ConfigSpec
TenantSpec

Field	Description	Validation
`maxConnections` integer	MaxConnections is the maximum number of connections that Envoy will establish to all endpoints in the cluster. If not specified, the default is 1024.	Maximum: 4.294967295e+09 Minimum: 0 Optional: {}
`maxPendingRequests` integer	MaxPendingRequests is the maximum number of pending requests that Envoy will queue to the cluster. If not specified, the default is 1024.	Maximum: 4.294967295e+09 Minimum: 0 Optional: {}
`maxParallelRequests` integer	MaxParallelRequests is the maximum number of parallel requests that Envoy will make to the cluster. This is applicable to HTTP/2 and gRPC connections. If not specified, the default is 1024.	Maximum: 4.294967295e+09 Minimum: 0 Optional: {}
`maxParallelRetries` integer	MaxParallelRetries is the maximum number of parallel retries that Envoy will make to the cluster. If not specified, the default is 3.	Maximum: 4.294967295e+09 Minimum: 0 Optional: {}
`maxRequestsPerConnection` integer	MaxRequestsPerConnection is the maximum number of requests that Envoy will make over a single connection to the cluster. If not specified, there is no limit.	Maximum: 4.294967295e+09 Minimum: 0 Optional: {}
`perEndpoint` PerEndpointCircuitBreaker	PerEndpoint configures circuit breaker thresholds that apply to individual endpoints rather than the whole cluster.	Optional: {}

Config

Config is the object that represents the Config for the KubeLB management controller.

Appears in:

ConfigList

Field	Description	Default	Validation
`apiVersion` string	`kubelb.k8c.io/v1alpha1`
`kind` string	`Config`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` ConfigSpec
`status` ConfigStatus

ConfigCertificatesSettings

ConfigCertificatesSettings defines the global settings for the certificates.

Appears in:

ConfigSpec

Field	Description	Default	Validation
`disable` boolean	Disable is a flag that can be used to disable certificate automation globally for all the tenants.
`defaultClusterIssuer` string	DefaultClusterIssuer is the Cluster Issuer to use for the certificates by default. This is applied when the cluster issuer is not specified in the annotations on the resource itself.

ConfigDNSSettings

ConfigDNSSettings defines the global settings for DNS management and automation.

Appears in:

ConfigSpec

Field	Description	Validation
`disable` boolean	Disable is a flag that can be used to disable DNS automation globally for all the tenants.
`wildcardDomain` string	WildcardDomain is the domain that will be used as the base domain to create wildcard DNS records for DNS resources. This is only used for determining the hostname for LoadBalancer and Tunnel resources.	Optional: {}
`allowExplicitHostnames` boolean	AllowExplicitHostnames is a flag that can be used to allow explicit hostnames to be used for DNS resources. This is only used when LoadBalancer.Spec.Hostname or Tunnel.Spec.Hostname is set.	Optional: {}
`useDNSAnnotations` boolean	UseDNSAnnotations is a flag that can be used to add DNS annotations to DNS resources. This is only used when LoadBalancer.Spec.Hostname or Tunnel.Spec.Hostname is set.	Optional: {}
`useCertificateAnnotations` boolean	UseCertificateAnnotations is a flag that can be used to add Certificate annotations to Certificate resources. This is only used when LoadBalancer.Spec.Hostname or Tunnel.Spec.Hostname is set.	Optional: {}

ConfigList

ConfigList contains a list of Config

Field	Description	Default	Validation
`apiVersion` string	`kubelb.k8c.io/v1alpha1`
`kind` string	`ConfigList`
`metadata` ListMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`items` Config array

ConfigSpec

ConfigSpec defines the desired state of the Config

Appears in:

Config

Field	Description	Validation
`propagatedAnnotations` map[string]string	PropagatedAnnotations defines the set of annotation key patterns that will be propagated to load balancing resources. Keys support shell-style glob patterns (e.g. “nginx.ingress.kubernetes.io/*”). Keep the value empty to allow any value; otherwise the value is a comma-separated list of permitted values for exact match. Tenant configuration has higher precedence than the annotations specified at the Config level.	Optional: {}
`propagateAllAnnotations` boolean	PropagateAllAnnotations defines whether all annotations will be propagated to load balancing resources. If set to true, PropagatedAnnotations is ignored. DeniedAnnotations still applies on top of this flag. Tenant configuration has higher precedence than the value specified at the Config level.	Optional: {}
`deniedAnnotations` string array	DeniedAnnotations is a list of annotation key patterns that are excluded from propagation, regardless of PropagateAllAnnotations or PropagatedAnnotations. Patterns support shell-style globbing (e.g. “nginx.ingress.kubernetes.io/*”). Tenant configuration has higher precedence than the value specified at the Config level.	Optional: {}
`defaultAnnotations` object (keys:AnnotatedResource, values:Annotations)	DefaultAnnotations defines the list of annotations(key-value pairs) that will be set on the load balancing resources if not already present. A special key `all` can be used to apply the same set of annotations to all resources. Tenant configuration has higher precedence than the annotations specified at the Config level.	Optional: {}
`envoyProxy` EnvoyProxy	EnvoyProxy defines the desired state of the Envoy Proxy
`backendTransport` BackendTransport	BackendTransport controls how management Envoy connects to tenant backends. Defaults to Direct for backward compatibility.	Optional: {}
`loadBalancer` LoadBalancerSettings
`ingress` IngressSettings
`gatewayAPI` GatewayAPISettings
`dns` ConfigDNSSettings
`certificates` ConfigCertificatesSettings
`tunnel` TunnelSettings
`circuitBreaker` CircuitBreaker	CircuitBreaker defines the default circuit breaker configuration for all Envoy clusters. These settings can be overridden at the Tenant level.	Optional: {}
`timeouts` EnvoyTimeouts	Timeouts defines default Envoy timeouts applied to all routes and load balancers in this cluster. Tenant and Route/LoadBalancer settings override these defaults per-field.	Optional: {}
`loadBalancerPolicy` LoadBalancerPolicy	LoadBalancerPolicy defines the default load balancing policy for all Envoy clusters. These settings can be overridden at the Tenant and LoadBalancer/Route level.	Enum: [RoundRobin LeastRequest Random] Optional: {}
`healthCheck` HealthCheck	HealthCheck defines the default active health check for all Envoy clusters. Whole-struct override: Tenant and LoadBalancer/Route settings replace this entirely rather than merging per-field.	Optional: {}
`waf` WAFSettings	WAF defines WAF-related settings.	Optional: {}
`prometheus` PrometheusSettings	Prometheus, when set, gives the manager a Prometheus query endpoint to read metrics from. Optional and bring-your-own: KubeLB does not run a Prometheus.	Optional: {}
`networkPolicy` NetworkPolicySettings	NetworkPolicy defines the default network policy settings for all tenant namespaces. Tenant has higher precedence than the settings specified at the Config level.	Optional: {}
`insights` InsightsSettings	Insights defines settings for the KubeLB insights engine. It only takes effect when the manager runs with –enable-insights.	Optional: {}

ConfigStatus

ConfigStatus defines the observed state of the Config.

Appears in:

Config

Field	Description	Default	Validation
`version` Version

DNSSettings

DNSSettings defines the tenant specific settings for DNS management and automation.

Appears in:

TenantSpec

Field	Description	Validation
`disable` boolean	Disable is a flag that can be used to disable DNS automation for a tenant.
`allowedDomains` string array	AllowedDomains is a list of allowed domains for automated DNS management. Has a higher precedence than the value specified in the Config. If empty, the value specified in `tenant.spec.allowedDomains` will be used. Examples: - [".example.com"] -> this allows subdomains at the root level such as example.com and test.example.com but won’t allow domains at one level above like test.test.example.com - [".example.com"] -> this allows all subdomains of example.com such as test.dns.example.com and dns.example.com - [“example.com”] -> this allows only example.com - [""] or [""] -> this allows all domains Note: “*” was added as a special case to allow any levels of subdomains that come before it. “” works for only 1 level.
`wildcardDomain` string	WildcardDomain is the domain that will be used as the base domain to create wildcard DNS records for DNS resources. This is only used for determining the hostname for LoadBalancer and Tunnel resources.	Optional: {}
`allowExplicitHostnames` boolean	AllowExplicitHostnames is a flag that can be used to allow explicit hostnames to be used for DNS resources. This is only used when LoadBalancer.Spec.Hostname or Tunnel.Spec.Hostname is set.	Optional: {}
`useDNSAnnotations` boolean	UseDNSAnnotations is a flag that can be used to add DNS annotations to DNS resources. This is only used when LoadBalancer.Spec.Hostname or Tunnel.Spec.Hostname is set.	Optional: {}
`useCertificateAnnotations` boolean	UseCertificateAnnotations is a flag that can be used to add Certificate annotations to Certificate resources. This is only used when LoadBalancer.Spec.Hostname or Tunnel.Spec.Hostname is set.	Optional: {}

EndpointAddress

EndpointAddress is a tuple that describes a single endpoint address. At least one of IP or Hostname must be set.

Appears in:

AddressesSpec
LoadBalancerEndpoints

Field	Description	Default	Validation
`ip` string	The IP of the endpoint. This can be an IPv4 or IPv6 address. The IP address must not be IP CIDR, Loopback (127.0.0.0/8), link-local (169.254.0.0/16), or link-local multicast ((224.0.0.0/24) addresses.		Optional: {}
`hostname` string	The Hostname of this endpoint. Used when the backend has no stable IP and must be resolved by DNS. If both ip and hostname are set, ip wins.		Optional: {}

EndpointPort

EndpointPort is a tuple that describes a single port.

Appears in:

LoadBalancerEndpoints

Field	Description	Validation
`name` string	The name of this port. This must match the ’name’ field in the corresponding ServicePort. Must be a DNS_LABEL. Optional only if one port is defined.	Optional: {}
`port` integer	The port number of the endpoint.
`protocol` Protocol	The IP protocol for this port. Defaults to “TCP”.	Enum: [TCP UDP]

EnvoyProxy

EnvoyProxy defines the desired state of the EnvoyProxy

Appears in:

ConfigSpec

Field	Description	Default	Validation
`topology` EnvoyProxyTopology	Topology defines the deployment topology for Envoy Proxy. The only supported value is: shared. DEPRECATION NOTICE: The values “dedicated” and “global” are deprecated and will be removed in a future release. They will now default to shared topology.	shared	Enum: [shared dedicated global] Optional: {}
`useDaemonset` boolean	UseDaemonset defines whether Envoy Proxy will run as daemonset. By default, Envoy Proxy will run as deployment. If set to true, Replicas will be ignored.		Optional: {}
`replicas` integer	Replicas defines the number of replicas for Envoy Proxy. This field is ignored if UseDaemonset is set to true.	3	Minimum: 1 Optional: {}
`singlePodPerNode` boolean	SinglePodPerNode defines whether Envoy Proxy pods will be spread across nodes. This ensures that multiple replicas are not running on the same node.		Optional: {}
`nodeSelector` object (keys:string, values:string)	NodeSelector is used to select nodes to run Envoy Proxy. If specified, the node must have all the indicated labels.		Optional: {}
`tolerations` Toleration array	Tolerations is used to schedule Envoy Proxy pods on nodes with matching taints.		Optional: {}
`resources` ResourceRequirements	Resources defines the resource requirements for Envoy Proxy.		Optional: {}
`affinity` Affinity	Affinity is used to schedule Envoy Proxy pods on nodes with matching affinity.		Optional: {}
`image` string	Image defines the Envoy Proxy image to use.		Optional: {}
`gracefulShutdown` EnvoyProxyGracefulShutdown	GracefulShutdown defines the graceful shutdown configuration for Envoy Proxy.		Optional: {}
`overloadManager` EnvoyProxyOverloadManager	OverloadManager defines the overload manager configuration for Envoy XDS bootstrap.		Optional: {}
`maxEndpointsPerCluster` integer	MaxEndpointsPerCluster limits the number of upstream endpoint addresses per Envoy cluster. When set to a positive value, only the first N endpoints are included in the xDS as upstream addresses. Defaults to 0, which means no limit.		Optional: {}
`imagePullSecrets` LocalObjectReference array	ImagePullSecrets is a list of references to secrets in the same namespace to use for pulling the Envoy Proxy image. If not set, imagePullSecrets are auto-detected from the manager pod.		Optional: {}
`podMonitor` EnvoyProxyPodMonitor	PodMonitor enables creation of PodMonitor resources for Envoy Proxy pods to enable metrics scraping by Prometheus Operator.		Optional: {}
`headerLimits` EnvoyProxyHeaderLimits	HeaderLimits configures the client header size and count limits for the KubeLB-managed Envoy Proxy. Unset fields default to Envoy’s maximum so the managed proxy never rejects headers that the edge proxy already accepted.		Optional: {}

EnvoyProxyGracefulShutdown

EnvoyProxyGracefulShutdown defines the graceful shutdown configuration for Envoy Proxy

Appears in:

EnvoyProxy

Field	Description	Default	Validation
`disabled` boolean	Disabled controls whether graceful shutdown is disabled		Optional: {}
`drainTimeout` Duration	DrainTimeout is the maximum time to wait for connections to drain. Defaults to 60s. Must be less than TerminationGracePeriodSeconds.	60s	Optional: {}
`minDrainDuration` Duration	MinDrainDuration is the minimum time to wait before checking connection count. This prevents premature termination. Defaults to 5s.	5s	Optional: {}
`terminationGracePeriodSeconds` integer	TerminationGracePeriodSeconds is the grace period for pod termination. Must be greater than DrainTimeout. Defaults to 300s.	300	Minimum: 30 Optional: {}
`shutdownManagerImage` string	ShutdownManagerImage is the Docker image for the shutdown-manager sidecar. Defaults to “docker.io/envoyproxy/gateway:v1.8.3”		Optional: {}

EnvoyProxyHeaderLimits

EnvoyProxyHeaderLimits configures the client header size and count limits for the KubeLB-managed Envoy Proxy. Envoy rejects requests whose headers exceed its 60 KiB default with HTTP 431; these fields raise that ceiling.

Appears in:

EnvoyProxy

Field	Description	Validation
`maxRequestHeadersKb` integer	MaxRequestHeadersKb is the maximum request header block size in KiB. Envoy’s default is 60; defaults to 8192 (Envoy’s maximum) when unset.	Maximum: 8192 Minimum: 1 Optional: {}
`maxRequestHeadersCount` integer	MaxRequestHeadersCount is the maximum number of request headers. Envoy’s default is 100; defaults to 4096 when unset.	Minimum: 1 Optional: {}
`maxResponseHeadersKb` integer	MaxResponseHeadersKb is the maximum upstream response header block size in KiB. Envoy’s default is 60; defaults to 8192 (Envoy’s maximum) when unset.	Maximum: 8192 Minimum: 1 Optional: {}

EnvoyProxyOverloadManager

EnvoyProxyOverloadManager defines the overload manager configuration for Envoy XDS

Appears in:

EnvoyProxy

Field	Description	Validation
`enabled` boolean	Enabled controls whether overload manager is enabled	Optional: {}
`maxActiveDownstreamConnections` integer	MaxActiveDownstreamConnections is the maximum number of active downstream connections for the Envoy.	Optional: {}
`maxHeapSizeBytes` integer	MaxHeapSizeBytes is the maximum heap size for the Envoy in bytes. On reaching the limit, the Envoy will start to reject new connections.	Optional: {}

EnvoyProxyPodMonitor

EnvoyProxyPodMonitor defines the PodMonitor configuration for Envoy Proxy

Appears in:

EnvoyProxy

Field	Description	Default	Validation
`enabled` boolean	Enabled controls whether a PodMonitor is created for Envoy Proxy pods.		Optional: {}

EnvoyProxyTopology

Underlying type: string

Appears in:

EnvoyProxy

Field	Description
`shared`
`dedicated`
`global`

EnvoyTimeouts

EnvoyTimeouts configures upstream and connection timeouts on the KubeLB-managed Envoy proxy. Nil duration fields inherit from the next tier (Route/LB → Tenant → Config → built-in default). A value of 0s explicitly disables that timeout (Envoy semantics).

Appears in:

ConfigSpec
LoadBalancerSpec
RouteSpec
TenantSpec
TenantStateStatus

Field	Description	Validation
`request` Duration	Request is the total upstream request timeout for HTTP routes (Envoy route.timeout). Built-in default: 0 (disabled). Applies to: Ingress, HTTPRoute, GRPCRoute.	Optional: {}
`streamIdle` Duration	StreamIdle is the maximum time an HTTP stream can be idle without any bytes flowing in either direction (Envoy stream_idle_timeout). Built-in default: 1h. Applies to: Ingress, HTTPRoute, GRPCRoute.	Optional: {}
`requestHeaders` Duration	RequestHeaders is the maximum time to receive complete request headers (Envoy request_headers_timeout). Built-in default: 0 (disabled). Applies to: Ingress, HTTPRoute, GRPCRoute.	Optional: {}
`idleConnection` Duration	IdleConnection is the maximum HTTP connection idle time (Envoy common_http_protocol_options.idle_timeout). Built-in default: 1h. Applies to: Ingress, HTTPRoute, GRPCRoute.	Optional: {}
`tcpIdle` Duration	TCPIdle is the TCP proxy idle timeout (Envoy tcp_proxy.idle_timeout). Built-in default: 1h. Applies to: TCPRoute, TLSRoute, L4 LoadBalancer.	Optional: {}
`connect` Duration	Connect is the upstream cluster TCP connect timeout (Envoy cluster.connect_timeout). Built-in default: 5s. Applies to: all routes and L4 LoadBalancer.	Optional: {}
`udpIdle` Duration	UDPIdle is the UDP session idle timeout. When set, it applies to the management Envoy UDP proxy sessions (Envoy udp_proxy idle_timeout) and, in the MTLS topology, to the CONNECT-UDP tunnel streams on both hops. When unset, the per-hop Envoy defaults apply (60s udp_proxy session idle, 5m tunnel stream idle). Applies to: UDPRoute and L4 LoadBalancer UDP ports.	Optional: {}

GRPCHealthCheck

GRPCHealthCheck configures a gRPC active health check (grpc.health.v1.Health).

Appears in:

HealthCheck

Field	Description	Default	Validation
`serviceName` string	ServiceName is the value passed as the service name in the gRPC health check request. Empty checks overall server health. Optional.		Optional: {}
`authority` string	Authority is the value of the :authority header on the gRPC health check request. Defaults to the cluster name (Envoy default) when unset. Optional.		Optional: {}

GatewayAPISettings

GatewayAPISettings defines the settings for the gateway API.

Appears in:

ConfigSpec
TenantSpec

Field	Description	Validation
`class` string	Class is the class of the gateway API to use. This can be used to specify a specific gateway API implementation. This has higher precedence than the value specified in the Config.	Optional: {}
`classMappings` GatewayClassMapping array	ClassMappings defines gateway class name mappings from tenant clusters to the management cluster. Config mappings are defaults. Tenant mappings override Config mappings with the same source class.	MaxItems: 32 Optional: {}
`disable` boolean	Disable is a flag that can be used to disable Gateway API for a tenant.
`enforceReferenceGrants` boolean	EnforceReferenceGrants requires a ReferenceGrant in the target namespace for any cross-namespace backendRef (route -> Service) or Gateway TLS certificateRef (Gateway -> Secret) in the tenant cluster. References without a matching grant are dropped and reported via the ResolvedRefs=False/RefNotPermitted condition. The Tenant value overrides the Config value; unset means inherit (Tenant) or disabled (Config).	Optional: {}
`defaultGateway` ObjectReference	DefaultGateway is the default gateway reference to use for the tenant. This is only used for load balancer hostname and tunneling.	Optional: {}
`gateway` GatewaySettings
`disableHTTPRoute` boolean
`disableGRPCRoute` boolean
`disableTCPRoute` boolean
`disableUDPRoute` boolean
`disableTLSRoute` boolean
`disableBackendTrafficPolicy` boolean
`disableClientTrafficPolicy` boolean

GatewayAPIState

Appears in:

TenantStateStatus

Field	Description	Default	Validation
`classMappings` GatewayClassMapping array	ClassMappings defines effective gateway class name mappings from tenant clusters to the management cluster.		MaxItems: 32 Optional: {}
`enforceReferenceGrants` boolean	EnforceReferenceGrants is the effective (Config default, Tenant override) value of spec.gatewayAPI.enforceReferenceGrants for this tenant.		Optional: {}

GatewayAPIsSettings

Appears in:

GatewayAPISettings

Field	Description	Default	Validation
`disableHTTPRoute` boolean
`disableGRPCRoute` boolean
`disableTCPRoute` boolean
`disableUDPRoute` boolean
`disableTLSRoute` boolean
`disableBackendTrafficPolicy` boolean
`disableClientTrafficPolicy` boolean

GatewayClassMapping

GatewayClassMapping defines a gateway class mapping from tenant clusters to the management cluster.

Appears in:

GatewayAPISettings
GatewayAPIState

Field	Description	Default	Validation
`source` string	Source is the gateway class name in the tenant cluster.		MaxLength: 253 MinLength: 1
`target` string	Target is the gateway class name in the management cluster.		MaxLength: 253 MinLength: 1

GatewaySettings

GatewaySettings defines the settings for the gateway resource.

Appears in:

GatewayAPISettings

Field	Description	Default	Validation
`limit` integer	Limit is the maximum number of gateways to create. If a lower limit is set than the number of reources that exist, the limit will be disallow creation of new resources but will not delete existing resources. The reason behind this is that it is not possible for KubeLB to know which resources are safe to remove.

HTTPHealthCheck

HTTPHealthCheck configures an HTTP/1.1 active health check.

Appears in:

HealthCheck

Field	Description	Validation
`path` string	Path is the HTTP request path used for the health check. Defaults to “/”.	Optional: {}
`host` string	Host is the value of the Host/authority header on the health check request. Defaults to the cluster name (Envoy default) when unset.	Optional: {}
`expectedStatuses` integer array	ExpectedStatuses is the list of HTTP status codes considered healthy. Defaults to [200] when unset. Each value must be in the range 100-599.	items:Maximum: 599 items:Minimum: 100 Optional: {}

HealthCheck

HealthCheck configures Envoy active health checking for the upstream clusters backing this resource. When unset, KubeLB applies a default TCP connect-only check. This is a whole-struct override: the effective check is taken from the first tier that sets it (Route/LoadBalancer > Tenant > Config > built-in default), never merged field-by-field across tiers. Fields left unset within the chosen tier fall back to the built-in defaults documented below. For more info: https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/health_checking

Appears in:

ConfigSpec
LoadBalancerSpec
RouteSpec
TenantSpec

Field	Description	Validation
`type` HealthCheckType	Type of health check to perform. Defaults to TCP (connect-only) when unset.	Enum: [TCP HTTP GRPC] Optional: {}
`interval` Duration	Interval between health checks. Defaults to 5s.	Optional: {}
`timeout` Duration	Timeout for each health check attempt. Defaults to 5s.	Optional: {}
`healthyThreshold` integer	HealthyThreshold is the number of consecutive successful checks before an unhealthy endpoint is marked healthy. Defaults to 2.	Minimum: 1 Optional: {}
`unhealthyThreshold` integer	UnhealthyThreshold is the number of consecutive failed checks before a healthy endpoint is marked unhealthy. Defaults to 3.	Minimum: 1 Optional: {}
`http` HTTPHealthCheck	HTTP configures an HTTP health check. Used only when Type is HTTP.	Optional: {}
`grpc` GRPCHealthCheck	GRPC configures a gRPC health check. Used only when Type is GRPC.	Optional: {}

HealthCheckType

Underlying type: string

Validation:

Enum: [TCP HTTP GRPC]

Appears in:

HealthCheck

Field	Description
`TCP`
`HTTP`
`GRPC`

HostnameStatus

Appears in:

LoadBalancerStatus

Field	Description	Validation
`hostname` string	Hostname contains the hostname of the load-balancer.	Optional: {}
`tlsEnabled` boolean	TLSEnabled is true if certificate is created for the hostname.	Optional: {}
`dnsRecordCreated` boolean	DNSRecordCreated is true if DNS record is created for the hostname.	Optional: {}

IngressSettings

IngressSettings defines the settings for the ingress.

Appears in:

ConfigSpec
TenantSpec

Field	Description	Default	Validation
`class` string	Class is the class of the ingress to use. This has higher precedence than the value specified in the Config.		Optional: {}
`disable` boolean	Disable is a flag that can be used to disable Ingress for a tenant.

Insight

Insight is a single finding produced by the KubeLB insights engine: a configuration or posture problem the management cluster can see and the operator can act on. Insights are operator-facing; they are not synced to tenant clusters.

Appears in:

InsightList

Field	Description	Default	Validation
`apiVersion` string	`kubelb.k8c.io/v1alpha1`
`kind` string	`Insight`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` InsightSpec
`status` InsightStatus

InsightCategory

Underlying type: string

InsightCategory groups findings by the kind of problem they describe.

Validation:

Enum: [security reliability cost hygiene migration]

Appears in:

InsightSpec

Field	Description
`security`
`reliability`
`cost`
`hygiene`
`migration`

InsightDismissalReason

Underlying type: string

InsightDismissalReason explains why a finding was dismissed. It is required on dismissal so the fleet-wide dismissal mix stays analysable.

Validation:

Enum: [working_as_intended accepted_risk false_positive low_priority other]

Appears in:

InsightTriage

Field	Description
`working_as_intended`
`accepted_risk`
`false_positive`
`low_priority`
`other`

InsightEvidence

InsightEvidence is a pointer into live cluster state that supports the finding. Evidence is always a reference, never a copy, so an Insight cannot go stale against the object it describes.

Appears in:

InsightSpec

Field	Description	Validation
`type` InsightEvidenceType	Type of reference.	Enum: [FieldRef Condition ObjectRef]
`ref` string	Ref is the reference itself, in “/#” form.	MaxLength: 512 MinLength: 1
`note` string	Note explains what the reference shows.	MaxLength: 512 Optional: {}

InsightEvidenceType

Underlying type: string

InsightEvidenceType describes what an evidence entry points at.

Validation:

Enum: [FieldRef Condition ObjectRef]

Appears in:

InsightEvidence

Field	Description
`FieldRef`	InsightEvidenceFieldRef points at a field on an object, e.g. “Config/default#spec.waf.skipValidation”.
`Condition`	InsightEvidenceCondition points at a status condition, e.g. “TenantState/default#BackendTransportChangePending”.
`ObjectRef`	InsightEvidenceObjectRef points at a whole object.

InsightList

InsightList contains a list of Insight.

Field	Description	Default	Validation
`apiVersion` string	`kubelb.k8c.io/v1alpha1`
`kind` string	`InsightList`
`metadata` ListMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`items` Insight array

InsightRemediation

InsightRemediation describes how to resolve a finding. KubeLB never applies it: the snippet is documentation, not an action.

Appears in:

InsightSpec

Field	Description	Default	Validation
`summary` string	Summary is the one-line fix.		MaxLength: 1024 Optional: {}
`snippet` string	Snippet is an optional YAML example of the fix. It is text only and is never applied by KubeLB.		MaxLength: 8192 Optional: {}

InsightSeverity

Underlying type: string

InsightSeverity is how much the finding matters. The values match the OpenReports severity enum so findings can be mirrored into Report objects without a translation table.

Validation:

Enum: [critical high medium low info]

Appears in:

InsightSpec

Field	Description
`critical`
`high`
`medium`
`low`
`info`

InsightSpec

InsightSpec is the finding. Everything except triage is written by the insights engine and is overwritten on every sweep.

Appears in:

Insight

Field	Description	Validation
`check` string	Check is the registry ID of the check that produced this finding, e.g. KLB001. It is immutable: a check ID is a permanent contract that docs, dashboards and suppression lists reference.	Pattern: `^KLB[0-9]\{3\}$`
`slug` string	Slug is the human-readable name of the check, e.g. waf-detection-only.	MaxLength: 63
`category` InsightCategory	Category groups the finding.	Enum: [security reliability cost hygiene migration]
`severity` InsightSeverity	Severity is how much the finding matters.	Enum: [critical high medium low info]
`message` string	Message describes this specific finding, including any fleet-relative context (“4 of 6 tenants with public routes enforce WAF”).	MaxLength: 1024
`targetRefs` InsightTargetRef array	TargetRefs are the objects the finding is about.	MaxItems: 32 MinItems: 1
`evidence` InsightEvidence array	Evidence points at the live state that produced the finding.	MaxItems: 16 Optional: {}
`remediation` InsightRemediation	Remediation describes how to fix the finding.	Optional: {}
`docsURL` string	DocsURL links to the check’s documentation.	MaxLength: 512 Optional: {}
`triage` InsightTriage	Triage is the operator’s verdict. It is the only user-owned field on this object: the engine reads it and never writes it.	Optional: {}

InsightState

Underlying type: string

InsightState is the effective state of a finding, computed by the engine from the detection result and the operator’s triage.

Validation:

Enum: [Open Acknowledged Snoozed Dismissed Fixed]

Appears in:

InsightStatus

Field	Description
`Open`
`Acknowledged`
`Snoozed`
`Dismissed`
`Fixed`	InsightStateFixed means the engine no longer detects the finding. It is machine-observed, never set by an operator.

InsightStatus

InsightStatus is the engine-computed effective state of a finding.

Appears in:

Insight

Field	Description	Validation
`state` InsightState	State combines the detection result with the operator’s triage.	Enum: [Open Acknowledged Snoozed Dismissed Fixed] Optional: {}
`firstSeen` Time	FirstSeen is when the finding was first detected. It survives a fix-and-reappear cycle so flapping stays visible.	Optional: {}
`lastEvaluated` Time	LastEvaluated is the last sweep that considered this finding.	Optional: {}
`fixedAt` Time	FixedAt is when the engine stopped detecting the finding. Fixed insights are deleted after a retention period.	Optional: {}

InsightTargetRef

InsightTargetRef identifies an object the finding is about.

Appears in:

InsightSpec

Field	Description	Validation
`apiVersion` string	APIVersion of the target.	MaxLength: 253 MinLength: 1
`name` string	Name of the target.	MaxLength: 253 MinLength: 1
`namespace` string	Namespace of the target. Empty for cluster-scoped objects.	MaxLength: 253 Optional: {}

InsightTriage

InsightTriage is the operator’s verdict on a finding. It is the only part of an Insight that users write; the engine preserves it verbatim across sweeps.

Appears in:

InsightSpec

Field	Description	Validation
`state` InsightTriageState	State is the verdict.	Enum: [Acknowledged Snoozed Dismissed]
`reason` InsightDismissalReason	Reason explains a dismissal. Required when state is Dismissed, forbidden otherwise.	Enum: [working_as_intended accepted_risk false_positive low_priority other] Optional: {}
`snoozeUntil` Time	SnoozeUntil is when the finding reopens. Required when state is Snoozed, forbidden otherwise.	Optional: {}

InsightTriageState

Underlying type: string

InsightTriageState is the operator’s verdict on a finding.

Validation:

Enum: [Acknowledged Snoozed Dismissed]

Appears in:

InsightTriage

Field	Description
`Acknowledged`	InsightTriageAcknowledged means the finding is seen and accepted as work to do. It keeps counting towards the posture score.
`Snoozed`	InsightTriageSnoozed hides the finding until snoozeUntil passes, after which it reopens on its own.
`Dismissed`	InsightTriageDismissed closes the finding for good. A dismissed finding that is detected again stays dismissed.

InsightsSettings

InsightsSettings defines the global settings for the insights engine.

Appears in:

ConfigSpec

Field	Description	Default	Validation
`disabledChecks` string array	DisabledChecks lists check IDs the engine must not run, for example [“KLB010”]. Existing findings for a disabled check are removed on the next sweep.		MaxItems: 64 items:Pattern: `^KLB[0-9]\{3\}$` Optional: {}

KubernetesSource

Appears in:

RouteSource

Field	Description	Default	Validation
`resource` Unstructured			EmbeddedResource: {} Optional: {}
`services` UpstreamService array	Services contains the list of services that are used as the source for the Route.

LoadBalancer

LoadBalancer is the Schema for the loadbalancers API

Appears in:

LoadBalancerList

Field	Description	Default	Validation
`apiVersion` string	`kubelb.k8c.io/v1alpha1`
`kind` string	`LoadBalancer`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` LoadBalancerSpec
`status` LoadBalancerStatus

LoadBalancerEndpoints

LoadBalancerEndpoints is a group of addresses with a common set of ports. The expanded set of endpoints is the Cartesian product of Addresses x Ports. For example, given:

{
  Addresses: [{"ip": "10.10.1.1"}, {"ip": "10.10.2.2"}],
  Ports:     [{"name": "a", "port": 8675}, {"name": "b", "port": 309}]
}

The resulting set of endpoints can be viewed as:

a: [ 10.10.1.1:8675, 10.10.2.2:8675 ],
b: [ 10.10.1.1:309, 10.10.2.2:309 ]

Appears in:

LoadBalancerSpec
RouteSpec

Field	Description	Validation
`name` string	Name is the name of the endpoints.
`addresses` EndpointAddress array	IP addresses which offer the related ports that are marked as ready. These endpoints should be considered safe for load balancers and clients to utilize.	MinItems: 1
`addressesReference` ObjectReference	AddressesReference is a reference to the Addresses object that contains the IP addresses. If this field is set, the Addresses field will be ignored.	Optional: {}
`ports` EndpointPort array	Port numbers available on the related IP addresses. This field is ignored for routes that are using kubernetes resources as the source.	MinItems: 1 Optional: {}

LoadBalancerList

LoadBalancerList contains a list of LoadBalancer

Field	Description	Default	Validation
`apiVersion` string	`kubelb.k8c.io/v1alpha1`
`kind` string	`LoadBalancerList`
`metadata` ListMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`items` LoadBalancer array

LoadBalancerPersistence

LoadBalancerPersistence configures backend persistence for a LoadBalancer.

Appears in:

LoadBalancerSpec

Field	Description	Default	Validation
`type` LoadBalancerPersistenceType	Type selects the persistence strategy. SourceIP uses the downstream source IP as observed by KubeLB Envoy.		Enum: [SourceIP]

LoadBalancerPersistenceType

Underlying type: string

LoadBalancerPersistenceType defines the supported backend persistence modes.

Validation:

Enum: [SourceIP]

Appears in:

LoadBalancerPersistence

Field	Description
`SourceIP`	LoadBalancerPersistenceTypeSourceIP routes connections from the same observed source IP to the same healthy backend endpoint when possible.

LoadBalancerPolicy

Underlying type: string

Validation:

Enum: [RoundRobin LeastRequest Random]

Appears in:

ConfigSpec
LoadBalancerSpec
RouteSpec
TenantSpec

Field	Description
`RoundRobin`
`LeastRequest`
`Random`

LoadBalancerPort

LoadBalancerPort contains information on service’s port.

Appears in:

LoadBalancerSpec

Field	Description	Validation
`name` string	The name of this port within the service. This must be a DNS_LABEL. All ports within a Spec must have unique names. When considering the endpoints for a Service, this must match the ’name’ field in the EndpointPort. Optional if only one ServicePort is defined on this service.	Optional: {}
`protocol` Protocol	The IP protocol for this port. Defaults to “TCP”.	Enum: [TCP UDP]
`port` integer	The port that will be exposed by the LoadBalancer.

LoadBalancerSettings

LoadBalancerSettings defines the settings for the load balancers.

Appears in:

ConfigSpec
TenantSpec

Field	Description	Validation
`class` string	Class is the class of the load balancer to use. This has higher precedence than the value specified in the Config.	Optional: {}
`limit` integer	Limit is the maximum number of load balancers to create. If a lower limit is set than the number of reources that exist, the limit will be disallow creation of new resources but will not delete existing resources. The reason behind this is that it is not possible for KubeLB to know which resources are safe to remove.
`disable` boolean	Disable is a flag that can be used to disable L4 load balancing for a tenant.

LoadBalancerSpec

LoadBalancerSpec defines the desired state of LoadBalancer

Appears in:

LoadBalancer

Field	Description	Default	Validation
`endpoints` LoadBalancerEndpoints array	Sets of addresses and ports that comprise an exposed user service on a cluster.		MinItems: 1 Required: {}
`ports` LoadBalancerPort array	The list of ports that are exposed by the load balancer service. only needed for layer 4		Optional: {}
`hostname` string	Hostname is the domain name at which the load balancer service will be accessible. When hostname is set, KubeLB will create a route(ingress or httproute) for the service, and expose it with TLS on the given hostname.		Optional: {}
`type` ServiceType	type determines how the Service is exposed. Defaults to ClusterIP. Valid options are ExternalName, ClusterIP, NodePort, and LoadBalancer. “ExternalName” maps to the specified externalName. “ClusterIP” allocates a cluster-internal IP address for load-balancing to endpoints. Endpoints are determined by the selector or if that is not specified, by manual construction of an Endpoints object. If clusterIP is “None”, no virtual IP is allocated and the endpoints are published as a set of endpoints rather than a stable IP. “NodePort” builds on ClusterIP and allocates a port on every node which routes to the clusterIP. “LoadBalancer” builds on NodePort and creates an external load-balancer (if supported in the current cloud) which routes to the clusterIP. More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types	ClusterIP	Optional: {}
`externalTrafficPolicy` ServiceExternalTrafficPolicy	externalTrafficPolicy denotes if this Service desires to route external traffic to node-local or cluster-wide endpoints. “Local” preserves the client source IP and avoids a second hop for LoadBalancer and Nodeport type services, but risks potentially imbalanced traffic spreading. “Cluster” obscures the client source IP and may cause a second hop to another node, but should have good overall load-spreading.		Optional: {}
`persistence` LoadBalancerPersistence	Persistence configures backend endpoint persistence. When omitted, KubeLB keeps the default non-sticky load balancing behavior. SourceIP persistence is based on the source IP observed by KubeLB Envoy for TCP and UDP traffic, which may be a gateway, node, or NAT address in proxied topologies. Takes precedence over LoadBalancerPolicy, which cannot be honoured at the same time: persistence is a correctness requirement the workload states, a distribution policy is a preference.		Optional: {}
`loadBalancerPolicy` LoadBalancerPolicy	LoadBalancerPolicy defines the load balancing policy for this LoadBalancer’s Envoy cluster. Overrides Tenant and Config-level settings.		Enum: [RoundRobin LeastRequest Random] Optional: {}
`timeouts` EnvoyTimeouts	Timeouts defines per-LoadBalancer Envoy timeouts. Overrides Tenant and Config timeouts per-field.		Optional: {}
`healthCheck` HealthCheck	HealthCheck defines the active health check for this LoadBalancer’s Envoy cluster. Whole-struct override: replaces Tenant and Config-level checks entirely.		Optional: {}
`upstreamTLS` UpstreamTLSConfig	UpstreamTLS configures TLS for connections from KubeLB’s Envoy proxy to backend endpoints. When not set, Envoy connects using plain TCP.		Optional: {}

LoadBalancerState

Appears in:

TenantStateStatus

Field	Description	Default	Validation
`disable` boolean
`limit` integer

LoadBalancerStatus

LoadBalancerStatus defines the observed state of LoadBalancer

Appears in:

LoadBalancer

Field	Description	Validation
`loadBalancer` LoadBalancerStatus	LoadBalancer contains the current status of the load-balancer, if one is present.	Optional: {}
`service` ServiceStatus	Service contains the current status of the LB service.	Optional: {}
`hostname` HostnameStatus	Hostname contains the status for hostname resources.	Optional: {}
`conditions` Condition array	Conditions describe the LoadBalancer as observed by the KubeLB manager.	Optional: {}

NamedNetworkPolicy

NamedNetworkPolicy is a NetworkPolicySpec with an explicit name.

Appears in:

NetworkPolicySettings

Field	Description	Default	Validation
`name` string	Name of the network policy.		MinLength: 1
`spec` NetworkPolicySpec	Spec is the NetworkPolicySpec for this policy.

NetworkPolicySettings

NetworkPolicySettings defines the network policy configuration for tenants. Default policies:

kubelb-deny-all-ingress: Default deny all ingress traffic to tenant namespace
kubelb-allow-same-namespace: Allow pod-to-pod traffic within tenant namespace
kubelb-allow-manager-ingress: Allow ingress from KubeLB manager namespace
kubelb-allow-dns-egress: Allow DNS resolution via kube-system (port 53 UDP/TCP)
kubelb-allow-xds-egress: Allow xDS control plane communication to manager (port 8001/TCP)
kubelb-allow-metrics-ingress: Allow Prometheus metrics scraping (port 19001/TCP)
kubelb-allow-envoy-ingress: Allow all ingress to envoy proxy pods for LoadBalancer traffic
kubelb-allow-envoy-egress: Allow all egress from envoy proxy pods to reach tenant NodePorts

Appears in:

ConfigSpec
TenantSpec

Field	Description	Validation
`enable` boolean	Enable to install network policies by default for all tenants. By default(null/false), network policy automation is disabled. This will be enabled by default in a future release.	Optional: {}
`disabledPolicies` string array	DisabledPolicies is a list of default policy names to skip (e.g. [“kubelb-deny-all-ingress”]).	Optional: {}
`additionalPolicies` NamedNetworkPolicy array	AdditionalPolicies are extra named network policies created alongside remaining defaults.	Optional: {}

PerEndpointCircuitBreaker

PerEndpointCircuitBreaker defines circuit breaker thresholds that apply to individual endpoints.

Appears in:

CircuitBreaker

Field	Description	Default	Validation
`maxConnections` integer	MaxConnections is the maximum number of connections that Envoy will establish to a single endpoint. If not specified, the default is 1024.		Maximum: 4.294967295e+09 Minimum: 0 Optional: {}

PrometheusSecretKeyReference

PrometheusSecretKeyReference selects one key from a Secret in the KubeLB manager namespace.

Appears in:

PrometheusSettings

Field	Description	Default	Validation
`name` string	Name of the Secret.
`key` string	Key within the Secret’s data.

PrometheusSettings

PrometheusSettings configures the Prometheus query endpoint the manager reads metrics from.

Appears in:

ConfigSpec

Field	Description	Validation
`url` string	URL is the base URL of the Prometheus query API, for example http://prometheus-operated.monitoring.svc:9090.	Pattern: `^https?://.+`
`bearerTokenSecretRef` PrometheusSecretKeyReference	BearerTokenSecretRef reads a bearer token used to authenticate to Prometheus.	Optional: {}
`caCertSecretRef` PrometheusSecretKeyReference	CACertSecretRef reads a PEM CA bundle used to verify a TLS Prometheus endpoint.	Optional: {}
`insecureSkipVerify` boolean	InsecureSkipVerify disables TLS certificate verification for the endpoint.	Optional: {}

ResourceState

Appears in:

RouteResourcesStatus
RouteServiceStatus

Field	Description	Default	Validation
`apiVersion` string	APIVersion is the API version of the resource.
`name` string	Name is the name of the resource.
`namespace` string	Namespace is the namespace of the resource.
`generatedName` string	GeneratedName is the generated name of the resource.
`status` RawExtension	Status is the actual status of the resource.
`conditions` Condition array

Route

Route is the object that represents a route in the cluster.

Appears in:

RouteList

Field	Description	Default	Validation
`apiVersion` string	`kubelb.k8c.io/v1alpha1`
`kind` string	`Route`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` RouteSpec
`status` RouteStatus

RouteList

RouteList contains a list of Routes

Field	Description	Default	Validation
`apiVersion` string	`kubelb.k8c.io/v1alpha1`
`kind` string	`RouteList`
`metadata` ListMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`items` Route array

RouteResourcesStatus

Appears in:

RouteStatus

Field	Description	Default	Validation
`source` string
`services` object (keys:string, values:RouteServiceStatus)
`route` ResourceState

RouteServiceStatus

Appears in:

RouteResourcesStatus

Field	Description	Default	Validation
`apiVersion` string	APIVersion is the API version of the resource.
`name` string	Name is the name of the resource.
`namespace` string	Namespace is the namespace of the resource.
`generatedName` string	GeneratedName is the generated name of the resource.
`status` RawExtension	Status is the actual status of the resource.
`conditions` Condition array
`ports` ServicePort array

RouteSource

Appears in:

RouteSpec

Field	Description	Default	Validation
`kubernetes` KubernetesSource	Kubernetes contains the information about the Kubernetes source. This field is automatically populated by the KubeLB CCM and in most cases, users should not set this field manually.

RouteSpec

RouteSpec defines the desired state of the Route.

Appears in:

Route

Field	Description	Validation
`endpoints` LoadBalancerEndpoints array	Sets of addresses and ports that comprise an exposed user service on a cluster. This field is required for Routes that represent traffic-forwarding resources (Ingress, Gateway routes). It is optional for policy resources like BackendTrafficPolicy.	Optional: {}
`source` RouteSource	Source contains the information about the source of the route. This is used when the route is created from external sources.	Optional: {}
`loadBalancerPolicy` LoadBalancerPolicy	LoadBalancerPolicy defines the load balancing policy for this Route’s Envoy clusters. Overrides Tenant and Config-level settings.	Enum: [RoundRobin LeastRequest Random] Optional: {}
`timeouts` EnvoyTimeouts	Timeouts defines per-Route Envoy timeouts. Overrides Tenant and Config timeouts per-field.	Optional: {}
`healthCheck` HealthCheck	HealthCheck defines the active health check for this Route’s Envoy clusters. Whole-struct override: replaces Tenant and Config-level checks entirely.	Optional: {}

RouteStatus

RouteStatus defines the observed state of the Route.

Appears in:

Route

Field	Description	Default	Validation
`resources` RouteResourcesStatus	Resources contains the list of resources that are created/processed as a result of the Route.

ServicePort

ServicePort contains information on service’s port.

Appears in:

ServiceStatus

Field	Description	Default	Validation
`name` string	The name of this port within the service. This must be a DNS_LABEL. All ports within a ServiceSpec must have unique names. When considering the endpoints for a Service, this must match the ’name’ field in the EndpointPort. Optional if only one ServicePort is defined on this service.		Optional: {}
`protocol` Protocol	The IP protocol for this port. Supports “TCP”, “UDP”, and “SCTP”. Default is TCP.	TCP	Optional: {}
`appProtocol` string	The application protocol for this port. This is used as a hint for implementations to offer richer behavior for protocols that they understand. This field follows standard Kubernetes label syntax. Valid values are either: * Un-prefixed protocol names - reserved for IANA standard service names (as per RFC-6335 and https://www.iana.org/assignments/service-names). * Kubernetes-defined prefixed names: * ‘kubernetes.io/h2c’ - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- * ‘kubernetes.io/ws’ - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 * ‘kubernetes.io/wss’ - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 * Other protocols should use implementation-defined prefixed names such as mycompany.com/my-custom-protocol.		Optional: {}
`port` integer	The port that will be exposed by this service.
`targetPort` IntOrString	Number or name of the port to access on the pods targeted by the service. Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. If this is a string, it will be looked up as a named port in the target Pod’s container ports. If this is not specified, the value of the ‘port’ field is used (an identity map). This field is ignored for services with clusterIP=None, and should be omitted or set equal to the ‘port’ field. More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service		Optional: {}
`nodePort` integer	The port on each node on which this service is exposed when type is NodePort or LoadBalancer. Usually assigned by the system. If a value is specified, in-range, and not in use it will be used, otherwise the operation will fail. If not specified, a port will be allocated if this Service requires one. If this field is specified when creating a Service which does not need it, creation will fail. This field will be wiped when updating a Service to no longer need it (e.g. changing type from NodePort to ClusterIP). More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport		Optional: {}
`upstreamTargetPort` integer

ServiceStatus

Appears in:

LoadBalancerStatus

Field	Description	Default	Validation
`ports` ServicePort array

SyncSecret

SyncSecret is a wrapper over Kubernetes Secret object. This is used to sync secrets from tenants to the LB cluster in a controlled and secure way.

Appears in:

SyncSecretList

Field	Description	Validation
`apiVersion` string	`kubelb.k8c.io/v1alpha1`
`kind` string	`SyncSecret`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`immutable` boolean		Optional: {}
`data` object (keys:string, values:integer array)		Optional: {}
`stringData` object (keys:string, values:string)		Optional: {}
`type` SecretType		Optional: {}
`status` SyncSecretStatus		Optional: {}

SyncSecretList

SyncSecretList contains a list of SyncSecrets

Field	Description	Default	Validation
`apiVersion` string	`kubelb.k8c.io/v1alpha1`
`kind` string	`SyncSecretList`
`metadata` ListMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`items` SyncSecret array

SyncSecretPhase

Underlying type: string

SyncSecretPhase represents the lifecycle phase of a SyncSecret.

Appears in:

SyncSecretStatus

Field	Description
`Pending`	SyncSecretPhasePending means the SyncSecret has not yet been synced.
`Synced`	SyncSecretPhaseSynced means the SyncSecret has been successfully synced to a Secret.
`Failed`	SyncSecretPhaseFailed means the SyncSecret sync failed.
`Terminating`	SyncSecretPhaseTerminating means the SyncSecret is being deleted.

SyncSecretStatus

SyncSecretStatus defines the observed state of SyncSecret.

Appears in:

SyncSecret

Field	Description	Validation
`observedGeneration` integer	ObservedGeneration is the most recent generation observed for this SyncSecret by the controller.	Optional: {}
`phase` SyncSecretPhase	Phase is the current lifecycle phase of the SyncSecret.	Optional: {}
`conditions` Condition array	Conditions represents the latest available observations of the SyncSecret’s state.	Optional: {}

Tenant

Tenant is the Schema for the tenants API

Appears in:

TenantList

Field	Description	Default	Validation
`apiVersion` string	`kubelb.k8c.io/v1alpha1`
`kind` string	`Tenant`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` TenantSpec
`status` TenantStatus

TenantEnvoyProxy

TenantEnvoyProxy defines tenant-level overrides for Envoy Proxy configuration.

Appears in:

TenantSpec

Field	Description	Default	Validation
`replicas` integer	Replicas is the number of Envoy Proxy replicas for this tenant. This field is ignored if Config.Spec.EnvoyProxy.UseDaemonset is true.		Minimum: 1 Optional: {}
`resources` ResourceRequirements	Resources defines the resource requirements for the Envoy Proxy container.		Optional: {}

TenantList

TenantList contains a list of Tenant

Field	Description	Default	Validation
`apiVersion` string	`kubelb.k8c.io/v1alpha1`
`kind` string	`TenantList`
`metadata` ListMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`items` Tenant array

TenantPhase

Underlying type: string

TenantPhase represents the lifecycle phase of a Tenant.

Appears in:

TenantStatus

Field	Description
`Pending`	TenantPhasePending means the Tenant is being provisioned.
`Ready`	TenantPhaseReady means the Tenant has been successfully reconciled.
`Failed`	TenantPhaseFailed means the Tenant reconciliation failed.
`Terminating`	TenantPhaseTerminating means the Tenant is being deleted.

TenantProxy

TenantProxy configures the tenant-cluster Envoy proxy for the MTLS backend transport.

Appears in:

BackendTransport

Field	Description	Default	Validation
`serviceType` TenantProxyServiceType	ServiceType selects the Service type used to expose the tenant proxy to the management Envoy. With NodePort (default), the CCM publishes node addresses plus the allocated NodePort. With LoadBalancer, the CCM publishes the Service’s load balancer ingress IPs/hostnames and the management Envoy dials the fixed tenant proxy port (15443).	NodePort	Enum: [NodePort LoadBalancer] Optional: {}
`workload` TenantProxyWorkload	Workload selects how the tenant proxy pods are scheduled. DaemonSet (default) runs one proxy per node. Deployment runs a fixed number of replicas spread across nodes; the CCM then publishes only the node addresses that host proxy pods so the management Envoy never dials a node without a local proxy.	DaemonSet	Enum: [DaemonSet Deployment] Optional: {}
`replicas` integer	Replicas is the number of tenant proxy pods when Workload is Deployment. Ignored for DaemonSet.	2	Minimum: 1 Optional: {}

TenantProxyServiceType

Underlying type: string

Appears in:

TenantProxy

Field	Description
`NodePort`
`LoadBalancer`

TenantProxyWorkload

Underlying type: string

Appears in:

TenantProxy

Field	Description
`DaemonSet`
`Deployment`

TenantSpec

TenantSpec defines the desired state of Tenant

Appears in:

Tenant

Field	Description	Default	Validation
`propagatedAnnotations` map[string]string	PropagatedAnnotations defines the set of annotation key patterns that will be propagated to load balancing resources. Keys support shell-style glob patterns (e.g. “nginx.ingress.kubernetes.io/*”). Keep the value empty to allow any value; otherwise the value is a comma-separated list of permitted values for exact match. Tenant configuration has higher precedence than the annotations specified at the Config level.		Optional: {}
`propagateAllAnnotations` boolean	PropagateAllAnnotations defines whether all annotations will be propagated to load balancing resources. If set to true, PropagatedAnnotations is ignored. DeniedAnnotations still applies on top of this flag. Tenant configuration has higher precedence than the value specified at the Config level.		Optional: {}
`deniedAnnotations` string array	DeniedAnnotations is a list of annotation key patterns that are excluded from propagation, regardless of PropagateAllAnnotations or PropagatedAnnotations. Patterns support shell-style globbing (e.g. “nginx.ingress.kubernetes.io/*”). Tenant configuration has higher precedence than the value specified at the Config level.		Optional: {}
`defaultAnnotations` object (keys:AnnotatedResource, values:Annotations)	DefaultAnnotations defines the list of annotations(key-value pairs) that will be set on the load balancing resources if not already present. A special key `all` can be used to apply the same set of annotations to all resources. Tenant configuration has higher precedence than the annotations specified at the Config level.		Optional: {}
`loadBalancer` LoadBalancerSettings
`ingress` IngressSettings
`gatewayAPI` GatewayAPISettings
`dns` DNSSettings
`certificates` CertificatesSettings
`tunnel` TenantTunnelSettings
`waf` TenantWAFSettings
`envoyProxy` TenantEnvoyProxy	EnvoyProxy defines tenant-level overrides for Envoy Proxy configuration. Fields set here take precedence over Config.Spec.EnvoyProxy.		Optional: {}
`circuitBreaker` CircuitBreaker	CircuitBreaker defines the circuit breaker configuration for this tenant’s Envoy clusters. Overrides Config-level settings.		Optional: {}
`timeouts` EnvoyTimeouts	Timeouts defines tenant-level Envoy timeouts. Overrides Config timeouts per-field. Route/LoadBalancer-level timeouts override these.		Optional: {}
`networkPolicy` NetworkPolicySettings	NetworkPolicy defines network policy settings for this tenant’s namespace. Tenant has higher precedence than the settings specified at the Config level.		Optional: {}
`loadBalancerPolicy` LoadBalancerPolicy	LoadBalancerPolicy defines the load balancing policy for this tenant’s Envoy clusters. Overrides Config-level settings.		Enum: [RoundRobin LeastRequest Random] Optional: {}
`healthCheck` HealthCheck	HealthCheck defines the active health check for this tenant’s Envoy clusters. Whole-struct override: replaces the Config-level check entirely. LoadBalancer/Route settings override this.		Optional: {}
`allowedDomains` string array	List of allowed domains for the tenant. This is used to restrict the domains that can be used for the tenant. If specified, applies on all the components such as Ingress, GatewayAPI, DNS, certificates, etc. Examples: - [".example.com"] -> this allows subdomains at the root level such as example.com and test.example.com but won’t allow domains at one level above like test.test.example.com - [".example.com"] -> this allows all subdomains of example.com such as test.dns.example.com and dns.example.com - [“example.com”] -> this allows only example.com - [""] or [""] -> this allows all domains Note: “” was added as a special case to allow any levels of subdomains that come before it. “*” works for only 1 level. Default: value is [""] and all domains are allowed.	[**]	Optional: {}

TenantState

TenantState is the Schema for the tenants API

Appears in:

TenantStateList

Field	Description	Default	Validation
`apiVersion` string	`kubelb.k8c.io/v1alpha1`
`kind` string	`TenantState`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` TenantStateSpec
`status` TenantStateStatus

TenantStateList

TenantStateList contains a list of TenantState

Field	Description	Default	Validation
`apiVersion` string	`kubelb.k8c.io/v1alpha1`
`kind` string	`TenantStateList`
`metadata` ListMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`items` TenantState array

TenantStateSpec

TenantStateSpec defines the desired state of TenantState.

Appears in:

TenantState

TenantStateStatus

TenantStateStatus defines the observed state of TenantState

Appears in:

TenantState

Field	Description	Validation
`version` Version
`lastUpdated` Time
`conditions` Condition array
`tunnel` TunnelState
`loadBalancer` LoadBalancerState
`gatewayAPI` GatewayAPIState
`backendTransport` BackendTransport
`allowedDomains` string array
`timeouts` EnvoyTimeouts	Timeouts is the tenant-effective Envoy timeout configuration (Tenant overrides merged over Config, per field). Consumed by the tenant-side proxy render, which cannot read Config or Tenant.	Optional: {}

TenantStatus

TenantStatus defines the observed state of Tenant

Appears in:

Tenant

Field	Description	Validation
`observedGeneration` integer	ObservedGeneration is the most recent generation observed for this Tenant by the controller.	Optional: {}
`phase` TenantPhase	Phase is the current lifecycle phase of the Tenant.	Optional: {}
`conditions` Condition array	Conditions represents the latest available observations of the Tenant’s state.	Optional: {}

TenantTunnelSettings

TenantTunnelSettings defines the settings for the tunnel.

Appears in:

TenantSpec

Field	Description	Default	Validation
`limit` integer	Limit is the maximum number of tunnels to create. If a lower limit is set than the number of reources that exist, the limit will be disallow creation of new resources but will not delete existing resources. The reason behind this is that it is not possible for KubeLB to know which resources are safe to remove.
`disable` boolean	Disable is a flag that can be used to disable tunneling for a tenant.

TenantWAFPolicy

TenantWAFPolicy defines a tenant-authored Web Application Firewall policy for L7 routes. Unlike the cluster-scoped WAFPolicy, it is namespaced and created by tenants in their own tenant cluster. It applies to HTTPRoute and GRPCRoute resources owned by that tenant only.

Appears in:

TenantWAFPolicyList

Field	Description	Default	Validation
`apiVersion` string	`kubelb.k8c.io/v1alpha1`
`kind` string	`TenantWAFPolicy`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` TenantWAFPolicySpec
`status` TenantWAFPolicyStatus

TenantWAFPolicyList

TenantWAFPolicyList contains a list of TenantWAFPolicy.

Field	Description	Default	Validation
`apiVersion` string	`kubelb.k8c.io/v1alpha1`
`kind` string	`TenantWAFPolicyList`
`metadata` ListMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`items` TenantWAFPolicy array

TenantWAFPolicySpec

TenantWAFPolicySpec defines the desired state of TenantWAFPolicy. Exactly one targeting method must be used: targetRef, targetSelector, or default. Setting multiple targeting methods is invalid. Policies without any targeting are ignored. Feature stage: Beta

Appears in:

TenantWAFPolicy

Field	Description	Default	Validation
`default` boolean	Default when set to true applies this policy to all of this tenant’s routes. It is the tenant-scoped analogue of WAFPolicy.global and never affects other tenants or global config. Mutually exclusive with TargetRef and TargetSelector. Policies without default, targetRef, or targetSelector are ignored.		Optional: {}
`targetRef` WAFTargetRef	TargetRef identifies a specific route by name and optionally namespace. For tenant policies, Kind is HTTPRoute or GRPCRoute and namespace/originNamespace refer to the tenant-cluster namespace. Mutually exclusive with Default and TargetSelector.		Optional: {}
`targetSelector` LabelSelector	TargetSelector selects routes or HTTPRoute/GRPCRoute resources by label. It checks whether the route has the labels or the labels of the HTTPRoute/GRPCRoute resource. In case of a conflict, the labels of the Route resource takes precedence. Mutually exclusive with Default and TargetRef.		Optional: {}
`directives` string array	Directives contains SecLang/ModSecurity directives passed to Coraza. Reference: https://coraza.io/docs/seclang/directives/ Tenant directives are untrusted. They are validated at sync time by SanitizeTenantDirectives, a default-deny allowlist: dangerous directives (SecRemoteRules, filesystem Include, log/path directives, exec/setenv, and ctl actions targeting admin rule IDs) are rejected. The MaxItems/MaxLength caps below are structural CRD limits; an admin can tighten them further at runtime via Config.spec.waf.maxDirectivesPerPolicy and maxDirectiveLength.		MaxItems: 64 items:MaxLength: 1024 Optional: {}
`failureMode` WAFFailureMode	FailureMode defines behavior when WAF filter creation fails. - Closed: Block traffic if WAF cannot be applied (default) - Open: Allow traffic without WAF protection Tenants may set this, but an admin enforceFailureMode on Config or Tenant overrides the tenant-chosen value.	Closed	Enum: [Open Closed] Optional: {}

TenantWAFPolicyStatus

TenantWAFPolicyStatus defines the observed state of TenantWAFPolicy.

Appears in:

TenantWAFPolicy

Field	Description	Default	Validation
`conditions` Condition array	Conditions describe the current state of the TenantWAFPolicy.		Optional: {}

TenantWAFSettings

TenantWAFSettings defines the tenant-scoped settings for tenant-authored WAF policies.

Appears in:

TenantSpec

Field	Description	Validation
`disableTenantPolicies` boolean	DisableTenantPolicies disables tenant-authored WAF policies (TenantWAFPolicy) for this tenant. Admin-authored WAF (WAFPolicy) still applies.	Optional: {}
`limit` integer	Limit is the maximum number of TenantWAFPolicies for this tenant. If a lower limit is set than the number of reources that exist, the limit will be disallow creation of new resources but will not delete existing resources. The reason behind this is that it is not possible for KubeLB to know which resources are safe to remove. Overrides Config.spec.waf.tenantPolicyLimit; Tenant has higher precedence than Config.	Optional: {}
`enforceFailureMode` WAFFailureMode	EnforceFailureMode, when set, overrides the tenant-chosen failureMode on this tenant’s TenantWAFPolicies. Takes precedence over the Config-level value.	Enum: [Open Closed] Optional: {}

Tunnel

Tunnel is the Schema for the tunnels API

Appears in:

TunnelList

Field	Description	Default	Validation
`apiVersion` string	`kubelb.k8c.io/v1alpha1`
`kind` string	`Tunnel`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` TunnelSpec
`status` TunnelStatus

TunnelList

TunnelList contains a list of Tunnel

Field	Description	Default	Validation
`apiVersion` string	`kubelb.k8c.io/v1alpha1`
`kind` string	`TunnelList`
`metadata` ListMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`items` Tunnel array

TunnelPhase

Underlying type: string

TunnelPhase represents the phase of tunnel

Appears in:

TunnelStatus

Field	Description
`Pending`	TunnelPhasePending means the tunnel is being provisioned
`Ready`	TunnelPhaseReady means the tunnel is ready to accept connections
`Failed`	TunnelPhaseFailed means the tunnel provisioning failed
`Terminating`	TunnelPhaseTerminating means the tunnel is being terminated

TunnelResources

TunnelResources contains references to resources created for the tunnel

Appears in:

TunnelStatus

Field	Description	Default	Validation
`serviceName` string	ServiceName is the name of the service created for this tunnel		Optional: {}
`routeRef` ObjectReference	RouteRef is a reference to the route (HTTPRoute or Ingress) created for this tunnel		Optional: {}

TunnelSettings

TunnelSettings defines the global settings for Tunnel resources.

Appears in:

ConfigSpec

Field	Description	Validation
`limit` integer	Limit is the maximum number of tunnels to create. If a lower limit is set than the number of reources that exist, the limit will be disallow creation of new resources but will not delete existing resources. The reason behind this is that it is not possible for KubeLB to know which resources are safe to remove.
`connectionManagerURL` string	ConnectionManagerURL is the URL of the connection manager service that handles tunnel connections. This is required if tunneling is enabled. For example: “https://con.example.com”	Optional: {}
`disable` boolean	Disable indicates whether tunneling feature should be disabled.	Optional: {}

TunnelSpec

TunnelSpec defines the desired state of Tunnel

Appears in:

Tunnel

Field	Description	Default	Validation
`hostname` string	Hostname is the hostname of the tunnel. If not specified, the hostname will be generated by KubeLB.		Optional: {}

TunnelState

Appears in:

TenantStateStatus

Field	Description	Default	Validation
`disable` boolean
`limit` integer
`connectionManagerURL` string

TunnelStatus

TunnelStatus defines the observed state of Tunnel

Appears in:

Tunnel

Field	Description	Validation
`hostname` string	Hostname contains the actual hostname assigned to the tunnel	Optional: {}
`url` string	URL contains the full URL to access the tunnel	Optional: {}
`connectionManagerURL` string	ConnectionManagerURL contains the URL that clients should use to establish tunnel connections	Optional: {}
`phase` TunnelPhase	Phase represents the current phase of the tunnel	Optional: {}
`resources` TunnelResources	Resources contains references to the resources created for this tunnel	Optional: {}
`conditions` Condition array	Conditions represents the current conditions of the tunnel	Optional: {}

UpstreamService

UpstreamService is a wrapper over the corev1.Service object. This is required as kubebuilder:validation:EmbeddedResource marker adds the x-kubernetes-embedded-resource to the array instead of the elements within it. Which results in a broken CRD; validation error. Without this marker, the embedded resource is not properly serialized to the CRD.

Appears in:

KubernetesSource

Field	Description	Validation
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.	Optional: {}
`spec` ServiceSpec	Spec defines the behavior of a service. https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status	Optional: {}
`status` ServiceStatus	Most recently observed status of the service. Populated by the system. Read-only. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status	Optional: {}

UpstreamTLSConfig

UpstreamTLSConfig configures TLS for connections from KubeLB’s Envoy proxy to backend endpoints. When not set, Envoy connects using plain TCP (no TLS).

Appears in:

LoadBalancerSpec

Field	Description	Default	Validation
`policy` UpstreamTLSPolicy	Policy defines the upstream TLS verification mode.		Enum: [Insecure Verify] Required: {}
`caSecretRef` LocalObjectReference	CASecretRef references a Secret containing the CA certificate for backend verification. The Secret must contain a “ca.crt” key. Required when policy is “Verify”.		Optional: {}

UpstreamTLSPolicy

Underlying type: string

UpstreamTLSPolicy defines how KubeLB’s Envoy proxy handles TLS to backends.

Validation:

Enum: [Insecure Verify]

Appears in:

UpstreamTLSConfig

Field	Description
`Insecure`	UpstreamTLSPolicyInsecure enables TLS but skips certificate verification (ACCEPT_UNTRUSTED). Use for self-signed certs, certs without SANs, or expired certs.
`Verify`	UpstreamTLSPolicyVerify enables TLS and verifies the backend certificate against a provided CA.

Version

Appears in:

ConfigStatus
TenantStateStatus

Field	Description	Default	Validation
`gitVersion` string
`gitCommit` string
`buildDate` string
`edition` string

WAFFailureMode

Underlying type: string

WAFFailureMode defines how routes behave when WAF filter creation fails.

Validation:

Enum: [Open Closed]

Appears in:

TenantWAFPolicySpec
TenantWAFSettings
WAFPolicySpec
WAFSettings

Field	Description
`Open`	WAFFailureModeOpen allows traffic through without WAF protection if filter fails.
`Closed`	WAFFailureModeClosed blocks traffic if WAF filter cannot be applied.

WAFPolicy

WAFPolicy defines Web Application Firewall policy for L7 routes. Applies to HTTPRoute and GRPCRoute resources.

Appears in:

WAFPolicyList

Field	Description	Default	Validation
`apiVersion` string	`kubelb.k8c.io/v1alpha1`
`kind` string	`WAFPolicy`
`metadata` ObjectMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`spec` WAFPolicySpec
`status` WAFPolicyStatus

WAFPolicyList

WAFPolicyList contains a list of WAFPolicy.

Field	Description	Default	Validation
`apiVersion` string	`kubelb.k8c.io/v1alpha1`
`kind` string	`WAFPolicyList`
`metadata` ListMeta	Refer to Kubernetes API documentation for fields of `metadata`.
`items` WAFPolicy array

WAFPolicySpec

WAFPolicySpec defines the desired state of WAFPolicy. Exactly one targeting method must be used: targetRef, targetSelector, or global. Setting multiple targeting methods is invalid. Policies without any targeting are ignored. Feature stage: Beta

Appears in:

WAFPolicy

Field	Description	Default	Validation
`global` boolean	Global when set to true applies this policy to all routes for all tenants within a KubeLB installation. Mutually exclusive with TargetRef and TargetSelector. Policies without global, targetRef, or targetSelector are ignored.		Optional: {}
`targetRef` WAFTargetRef	TargetRef identifies a specific route by name and optionally namespace. Mutually exclusive with Global and TargetSelector.		Optional: {}
`targetSelector` LabelSelector	TargetSelector selects routes or HTTPRoute/GRPCRoute resources by label. It checks whether the route has the labels or the labels of the HTTPRoute/GRPCRoute resource. In case of a conflict, the labels of the Route resource takes precedence. Mutually exclusive with Global and TargetRef.		Optional: {}
`directives` string array	Directives contains SecLang/ModSecurity directives passed to Coraza. Reference: https://coraza.io/docs/seclang/directives/ If empty, the following OWASP CRS defaults are applied: - SecRuleEngine On - SecRequestBodyAccess On - SecRequestBodyLimit 13107200 - Include @crs-setup-conf - Include @owasp_crs/*.conf The MaxItems/MaxLength caps below are structural CRD limits mirroring TenantWAFPolicy. They bound a single policy’s blast radius; the CRS ruleset itself lives in the WASM binary, not the directive list, so these caps do not limit the protections in effect.		MaxItems: 64 items:MaxLength: 1024 Optional: {}
`failureMode` WAFFailureMode	FailureMode defines behavior when WAF filter creation fails. - Closed: Block traffic if WAF cannot be applied (default) - Open: Allow traffic without WAF protection	Closed	Enum: [Open Closed] Optional: {}

WAFPolicyStatus

WAFPolicyStatus defines the observed state of WAFPolicy.

Appears in:

WAFPolicy

Field	Description	Default	Validation
`conditions` Condition array	Conditions describe the current state of the WAFPolicy.		Optional: {}

WAFSettings

WAFSettings defines settings for the WAF (Web Application Firewall).

Appears in:

ConfigSpec

Field	Description	Default	Validation
`wasmInitContainerImage` string	WASMInitContainerImage overrides the image used for the WASM init container. If empty, defaults to the kubelb-manager image detected at runtime.		Optional: {}
`skipValidation` boolean	SkipValidation skips directive validation for WAFPolicies. When true, all WAFPolicies are marked as valid without parsing.		Optional: {}
`enableTenantPolicies` boolean	EnableTenantPolicies is the global opt-in for tenant-authored WAF policies (TenantWAFPolicy). Defaults to false: when unset, TenantWAFPolicies are ignored and their CRD/controller stay inert, so upgrades see zero behavior change until an admin enables the feature.		Optional: {}
`enforceFailureMode` WAFFailureMode	EnforceFailureMode, when set, overrides the tenant-chosen failureMode on every TenantWAFPolicy cluster-wide. A per-Tenant EnforceFailureMode takes precedence over this value.		Enum: [Open Closed] Optional: {}
`tenantPolicyLimit` integer	TenantPolicyLimit is the maximum number of TenantWAFPolicies allowed per tenant. If a lower limit is set than the number of reources that exist, the limit will be disallow creation of new resources but will not delete existing resources. The reason behind this is that it is not possible for KubeLB to know which resources are safe to remove. If nil, the number of TenantWAFPolicies per tenant is unlimited.		Optional: {}
`maxDirectivesPerPolicy` integer	MaxDirectivesPerPolicy is the runtime cap on the number of directive lines per TenantWAFPolicy enforced by the sanitizer (multi-line directive items are counted per line). Defaults to 64, matching the TenantWAFPolicy CRD item cap. Set to 0 for unlimited.	64	Optional: {}
`maxDirectiveLength` integer	MaxDirectiveLength is the runtime cap on the length of a single tenant directive line enforced by the sanitizer. Defaults to 1024, matching the TenantWAFPolicy CRD per-item length cap. Set to 0 for unlimited.	1024	Optional: {}

WAFTargetRef

WAFTargetRef identifies a route by name.

Appears in:

TenantWAFPolicySpec
WAFPolicySpec

Field	Description	Default	Validation
`group` string	Group is the API group of the target resource.	gateway.networking.k8s.io
`namespace` string	Namespace is the management cluster namespace (e.g., tenant-primary). If omitted, matches across all namespaces.		Optional: {}
`originNamespace` string	OriginNamespace is the namespace of the original resource in the tenant cluster (the `kubelb.k8c.io/origin-ns`). Two routes synced into the same management namespace from different tenant-cluster namespaces can share an origin name; set OriginNamespace to disambiguate them. If omitted, origin namespace is not considered during matching.		Optional: {}
`name` string	Name is the name of the target resource which could either be the name of the resource in management cluster that is generated by KubeLB or the `kubelb.k8c.io/origin-name` that is the original name of the resource in the tenant cluster.		MinLength: 1