# API reference



## Overview
NGINX Gateway API Reference
<p>Packages:</p>
<ul>
<li>
<a href="#gateway.nginx.org%2fv1alpha1">gateway.nginx.org/v1alpha1</a>
</li>
<li>
<a href="#gateway.nginx.org%2fv1alpha2">gateway.nginx.org/v1alpha2</a>
</li>
</ul>
<h2 id="gateway.nginx.org/v1alpha1">gateway.nginx.org/v1alpha1</h2>
<p>
<p>Package v1alpha1 contains API Schema definitions for the
gateway.nginx.org API group.</p>
</p>
Resource Types:
<ul><li>
<a href="#gateway.nginx.org/v1alpha1.AuthenticationFilter">AuthenticationFilter</a>
</li><li>
<a href="#gateway.nginx.org/v1alpha1.ClientSettingsPolicy">ClientSettingsPolicy</a>
</li><li>
<a href="#gateway.nginx.org/v1alpha1.NginxGateway">NginxGateway</a>
</li><li>
<a href="#gateway.nginx.org/v1alpha1.ProxySettingsPolicy">ProxySettingsPolicy</a>
</li><li>
<a href="#gateway.nginx.org/v1alpha1.RateLimitPolicy">RateLimitPolicy</a>
</li><li>
<a href="#gateway.nginx.org/v1alpha1.SnippetsFilter">SnippetsFilter</a>
</li><li>
<a href="#gateway.nginx.org/v1alpha1.SnippetsPolicy">SnippetsPolicy</a>
</li><li>
<a href="#gateway.nginx.org/v1alpha1.UpstreamSettingsPolicy">UpstreamSettingsPolicy</a>
</li><li>
<a href="#gateway.nginx.org/v1alpha1.WAFPolicy">WAFPolicy</a>
</li></ul>
<h3 id="gateway.nginx.org/v1alpha1.AuthenticationFilter">AuthenticationFilter
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.AuthenticationFilter" title="Permanent link">¶</a>
</h3>
<p>
<p>AuthenticationFilter configures request authentication and is
referenced by HTTPRoute and GRPCRoute filters using ExtensionRef.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>apiVersion</code><br/>
string</td>
<td>
<code>
gateway.nginx.org/v1alpha1
</code>
</td>
</tr>
<tr>
<td>
<code>kind</code><br/>
string
</td>
<td><code>AuthenticationFilter</code></td>
</tr>
<tr>
<td>
<code>metadata</code><br/>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#objectmeta-v1-meta">
Kubernetes meta/v1.ObjectMeta
</a>
</em>
</td>
<td>
Refer to the Kubernetes API documentation for the fields of the
<code>metadata</code> field.
</td>
</tr>
<tr>
<td>
<code>spec</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.AuthenticationFilterSpec">
AuthenticationFilterSpec
</a>
</em>
</td>
<td>
<p>Spec defines the desired state of the AuthenticationFilter.</p>
<br/>
<br/>
<table class="table table-bordered table-striped">
<tr>
<td>
<code>basic</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.BasicAuth">
BasicAuth
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Basic configures HTTP Basic Authentication.</p>
</td>
</tr>
<tr>
<td>
<code>oidc</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.OIDCAuth">
OIDCAuth
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>OIDC configures OpenID Connect Authentication (NGINX Plus).</p>
</td>
</tr>
<tr>
<td>
<code>jwt</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.JWTAuth">
JWTAuth
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>JWT configures JSON Web Token authentication (NGINX Plus).</p>
</td>
</tr>
<tr>
<td>
<code>type</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.AuthType">
AuthType
</a>
</em>
</td>
<td>
<p>Type selects the authentication mechanism.</p>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<code>status</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.AuthenticationFilterStatus">
AuthenticationFilterStatus
</a>
</em>
</td>
<td>
<p>Status defines the state of the AuthenticationFilter.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.ClientSettingsPolicy">ClientSettingsPolicy
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.ClientSettingsPolicy" title="Permanent link">¶</a>
</h3>
<p>
<p>ClientSettingsPolicy is an Inherited Attached Policy. It provides a way to configure the behavior of the connection
between the client and NGINX Gateway Fabric.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>apiVersion</code><br/>
string</td>
<td>
<code>
gateway.nginx.org/v1alpha1
</code>
</td>
</tr>
<tr>
<td>
<code>kind</code><br/>
string
</td>
<td><code>ClientSettingsPolicy</code></td>
</tr>
<tr>
<td>
<code>metadata</code><br/>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#objectmeta-v1-meta">
Kubernetes meta/v1.ObjectMeta
</a>
</em>
</td>
<td>
Refer to the Kubernetes API documentation for the fields of the
<code>metadata</code> field.
</td>
</tr>
<tr>
<td>
<code>spec</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.ClientSettingsPolicySpec">
ClientSettingsPolicySpec
</a>
</em>
</td>
<td>
<p>Spec defines the desired state of the ClientSettingsPolicy.</p>
<br/>
<br/>
<table class="table table-bordered table-striped">
<tr>
<td>
<code>body</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.ClientBody">
ClientBody
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Body defines the client request body settings.</p>
</td>
</tr>
<tr>
<td>
<code>keepAlive</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.ClientKeepAlive">
ClientKeepAlive
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>KeepAlive defines the keep-alive settings.</p>
</td>
</tr>
<tr>
<td>
<code>targetRef</code><br/>
<em>
<a href="https://pkg.go.dev/sigs.k8s.io/gateway-api/apis/v1#LocalPolicyTargetReference">
sigs.k8s.io/gateway-api/apis/v1.LocalPolicyTargetReference
</a>
</em>
</td>
<td>
<p>TargetRef identifies an API object to apply the policy to.
Object must be in the same namespace as the policy.
Support: Gateway, HTTPRoute, GRPCRoute.</p>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<code>status</code><br/>
<em>
<a href="https://pkg.go.dev/sigs.k8s.io/gateway-api/apis/v1#PolicyStatus">
sigs.k8s.io/gateway-api/apis/v1.PolicyStatus
</a>
</em>
</td>
<td>
<p>Status defines the state of the ClientSettingsPolicy.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.NginxGateway">NginxGateway
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.NginxGateway" title="Permanent link">¶</a>
</h3>
<p>
<p>NginxGateway represents the dynamic configuration for an NGINX Gateway Fabric control plane.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>apiVersion</code><br/>
string</td>
<td>
<code>
gateway.nginx.org/v1alpha1
</code>
</td>
</tr>
<tr>
<td>
<code>kind</code><br/>
string
</td>
<td><code>NginxGateway</code></td>
</tr>
<tr>
<td>
<code>metadata</code><br/>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#objectmeta-v1-meta">
Kubernetes meta/v1.ObjectMeta
</a>
</em>
</td>
<td>
Refer to the Kubernetes API documentation for the fields of the
<code>metadata</code> field.
</td>
</tr>
<tr>
<td>
<code>spec</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.NginxGatewaySpec">
NginxGatewaySpec
</a>
</em>
</td>
<td>
<p>NginxGatewaySpec defines the desired state of the NginxGateway.</p>
<br/>
<br/>
<table class="table table-bordered table-striped">
<tr>
<td>
<code>logging</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.Logging">
Logging
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Logging defines logging related settings for the control plane.</p>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<code>status</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.NginxGatewayStatus">
NginxGatewayStatus
</a>
</em>
</td>
<td>
<p>NginxGatewayStatus defines the state of the NginxGateway.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.ProxySettingsPolicy">ProxySettingsPolicy
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.ProxySettingsPolicy" title="Permanent link">¶</a>
</h3>
<p>
<p>ProxySettingsPolicy is an Inherited Attached Policy. It provides a way to configure the behavior of the connection
between NGINX Gateway Fabric and the upstream applications (backends).</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>apiVersion</code><br/>
string</td>
<td>
<code>
gateway.nginx.org/v1alpha1
</code>
</td>
</tr>
<tr>
<td>
<code>kind</code><br/>
string
</td>
<td><code>ProxySettingsPolicy</code></td>
</tr>
<tr>
<td>
<code>metadata</code><br/>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#objectmeta-v1-meta">
Kubernetes meta/v1.ObjectMeta
</a>
</em>
</td>
<td>
Refer to the Kubernetes API documentation for the fields of the
<code>metadata</code> field.
</td>
</tr>
<tr>
<td>
<code>spec</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.ProxySettingsPolicySpec">
ProxySettingsPolicySpec
</a>
</em>
</td>
<td>
<p>Spec defines the desired state of the ProxySettingsPolicy.</p>
<br/>
<br/>
<table class="table table-bordered table-striped">
<tr>
<td>
<code>buffering</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.ProxyBuffering">
ProxyBuffering
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Buffering configures the buffering of responses from the proxied server.</p>
</td>
</tr>
<tr>
<td>
<code>timeout</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.ProxyTimeout">
ProxyTimeout
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Timeout configures timeouts for the connection to the proxied server.</p>
</td>
</tr>
<tr>
<td>
<code>targetRefs</code><br/>
<em>
<a href="https://pkg.go.dev/sigs.k8s.io/gateway-api/apis/v1#LocalPolicyTargetReference">
[]sigs.k8s.io/gateway-api/apis/v1.LocalPolicyTargetReference
</a>
</em>
</td>
<td>
<p>TargetRefs identifies the API object(s) to apply the policy to.
Objects must be in the same namespace as the policy.
Support: Gateway, HTTPRoute, GRPCRoute</p>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<code>status</code><br/>
<em>
<a href="https://pkg.go.dev/sigs.k8s.io/gateway-api/apis/v1#PolicyStatus">
sigs.k8s.io/gateway-api/apis/v1.PolicyStatus
</a>
</em>
</td>
<td>
<p>Status defines the state of the ProxySettingsPolicy.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.RateLimitPolicy">RateLimitPolicy
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.RateLimitPolicy" title="Permanent link">¶</a>
</h3>
<p>
<p>RateLimitPolicy is an Inherited Attached Policy. It provides a way to set local rate limiting rules in NGINX.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>apiVersion</code><br/>
string</td>
<td>
<code>
gateway.nginx.org/v1alpha1
</code>
</td>
</tr>
<tr>
<td>
<code>kind</code><br/>
string
</td>
<td><code>RateLimitPolicy</code></td>
</tr>
<tr>
<td>
<code>metadata</code><br/>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#objectmeta-v1-meta">
Kubernetes meta/v1.ObjectMeta
</a>
</em>
</td>
<td>
Refer to the Kubernetes API documentation for the fields of the
<code>metadata</code> field.
</td>
</tr>
<tr>
<td>
<code>spec</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.RateLimitPolicySpec">
RateLimitPolicySpec
</a>
</em>
</td>
<td>
<p>Spec defines the desired state of the RateLimitPolicy.</p>
<br/>
<br/>
<table class="table table-bordered table-striped">
<tr>
<td>
<code>rateLimit</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.RateLimit">
RateLimit
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>RateLimit defines the Rate Limit settings.</p>
</td>
</tr>
<tr>
<td>
<code>targetRefs</code><br/>
<em>
<a href="https://pkg.go.dev/sigs.k8s.io/gateway-api/apis/v1#LocalPolicyTargetReference">
[]sigs.k8s.io/gateway-api/apis/v1.LocalPolicyTargetReference
</a>
</em>
</td>
<td>
<p>TargetRefs identifies API object(s) to apply the policy to.
Objects must be in the same namespace as the policy.</p>
<p>Support: Gateway, HTTPRoute, GRPCRoute</p>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<code>status</code><br/>
<em>
<a href="https://pkg.go.dev/sigs.k8s.io/gateway-api/apis/v1#PolicyStatus">
sigs.k8s.io/gateway-api/apis/v1.PolicyStatus
</a>
</em>
</td>
<td>
<p>Status defines the state of the RateLimitPolicy.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.SnippetsFilter">SnippetsFilter
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.SnippetsFilter" title="Permanent link">¶</a>
</h3>
<p>
<p>SnippetsFilter is a filter that allows inserting NGINX configuration into the
generated NGINX config for HTTPRoute and GRPCRoute resources.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>apiVersion</code><br/>
string</td>
<td>
<code>
gateway.nginx.org/v1alpha1
</code>
</td>
</tr>
<tr>
<td>
<code>kind</code><br/>
string
</td>
<td><code>SnippetsFilter</code></td>
</tr>
<tr>
<td>
<code>metadata</code><br/>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#objectmeta-v1-meta">
Kubernetes meta/v1.ObjectMeta
</a>
</em>
</td>
<td>
Refer to the Kubernetes API documentation for the fields of the
<code>metadata</code> field.
</td>
</tr>
<tr>
<td>
<code>spec</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.SnippetsFilterSpec">
SnippetsFilterSpec
</a>
</em>
</td>
<td>
<p>Spec defines the desired state of the SnippetsFilter.</p>
<br/>
<br/>
<table class="table table-bordered table-striped">
<tr>
<td>
<code>snippets</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.Snippet">
[]Snippet
</a>
</em>
</td>
<td>
<p>Snippets is a list of NGINX configuration snippets.
There can only be one snippet per context.
Allowed contexts: main, http, http.server, http.server.location.</p>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<code>status</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.SnippetsFilterStatus">
SnippetsFilterStatus
</a>
</em>
</td>
<td>
<p>Status defines the state of the SnippetsFilter.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.SnippetsPolicy">SnippetsPolicy
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.SnippetsPolicy" title="Permanent link">¶</a>
</h3>
<p>
<p>SnippetsPolicy provides a way to inject NGINX snippets into the configuration on Gateway level.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>apiVersion</code><br/>
string</td>
<td>
<code>
gateway.nginx.org/v1alpha1
</code>
</td>
</tr>
<tr>
<td>
<code>kind</code><br/>
string
</td>
<td><code>SnippetsPolicy</code></td>
</tr>
<tr>
<td>
<code>metadata</code><br/>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#objectmeta-v1-meta">
Kubernetes meta/v1.ObjectMeta
</a>
</em>
</td>
<td>
Refer to the Kubernetes API documentation for the fields of the
<code>metadata</code> field.
</td>
</tr>
<tr>
<td>
<code>spec</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.SnippetsPolicySpec">
SnippetsPolicySpec
</a>
</em>
</td>
<td>
<p>Spec defines the desired state of the SnippetsPolicy.</p>
<br/>
<br/>
<table class="table table-bordered table-striped">
<tr>
<td>
<code>targetRefs</code><br/>
<em>
<a href="https://pkg.go.dev/sigs.k8s.io/gateway-api/apis/v1#LocalPolicyTargetReference">
[]sigs.k8s.io/gateway-api/apis/v1.LocalPolicyTargetReference
</a>
</em>
</td>
<td>
<p>TargetRefs identifies API object(s) to apply the policy to.</p>
</td>
</tr>
<tr>
<td>
<code>snippets</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.Snippet">
[]Snippet
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Snippets is a list of snippets to be injected into the NGINX configuration.</p>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<code>status</code><br/>
<em>
<a href="https://pkg.go.dev/sigs.k8s.io/gateway-api/apis/v1#PolicyStatus">
sigs.k8s.io/gateway-api/apis/v1.PolicyStatus
</a>
</em>
</td>
<td>
<p>Status defines the current state of the SnippetsPolicy.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.UpstreamSettingsPolicy">UpstreamSettingsPolicy
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.UpstreamSettingsPolicy" title="Permanent link">¶</a>
</h3>
<p>
<p>UpstreamSettingsPolicy is a Direct Attached Policy. It provides a way to configure the behavior of
the connection between NGINX and the upstream applications.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>apiVersion</code><br/>
string</td>
<td>
<code>
gateway.nginx.org/v1alpha1
</code>
</td>
</tr>
<tr>
<td>
<code>kind</code><br/>
string
</td>
<td><code>UpstreamSettingsPolicy</code></td>
</tr>
<tr>
<td>
<code>metadata</code><br/>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#objectmeta-v1-meta">
Kubernetes meta/v1.ObjectMeta
</a>
</em>
</td>
<td>
Refer to the Kubernetes API documentation for the fields of the
<code>metadata</code> field.
</td>
</tr>
<tr>
<td>
<code>spec</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.UpstreamSettingsPolicySpec">
UpstreamSettingsPolicySpec
</a>
</em>
</td>
<td>
<p>Spec defines the desired state of the UpstreamSettingsPolicy.</p>
<br/>
<br/>
<table class="table table-bordered table-striped">
<tr>
<td>
<code>zoneSize</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.Size">
Size
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>ZoneSize is the size of the shared memory zone used by the upstream. This memory zone is used to share
the upstream configuration between nginx worker processes. The more servers that an upstream has,
the larger memory zone is required.
Default: OSS: 512k, Plus: 1m.
Directive: <a href="https://nginx.org/en/docs/http/ngx_http_upstream_module.html#zone">https://nginx.org/en/docs/http/ngx_http_upstream_module.html#zone</a></p>
</td>
</tr>
<tr>
<td>
<code>keepAlive</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.UpstreamKeepAlive">
UpstreamKeepAlive
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>KeepAlive defines the keep-alive settings.</p>
</td>
</tr>
<tr>
<td>
<code>loadBalancingMethod</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.LoadBalancingType">
LoadBalancingType
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>LoadBalancingMethod specifies the load balancing algorithm to be used for the upstream.
If not specified, NGINX Gateway Fabric defaults to <code>random two least_conn</code>,
which differs from the standard NGINX default <code>round-robin</code>.</p>
</td>
</tr>
<tr>
<td>
<code>hashMethodKey</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.HashMethodKey">
HashMethodKey
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>HashMethodKey defines the key used for hash-based load balancing methods.
This field is required when <code>LoadBalancingMethod</code> is set to <code>hash</code> or <code>hash consistent</code>.</p>
</td>
</tr>
<tr>
<td>
<code>targetRefs</code><br/>
<em>
<a href="https://pkg.go.dev/sigs.k8s.io/gateway-api/apis/v1#LocalPolicyTargetReference">
[]sigs.k8s.io/gateway-api/apis/v1.LocalPolicyTargetReference
</a>
</em>
</td>
<td>
<p>TargetRefs identifies API object(s) to apply the policy to.
Objects must be in the same namespace as the policy.
Support: Service</p>
<p>TargetRefs must be <em>distinct</em>. The <code>name</code> field must be unique for all targetRef entries in the UpstreamSettingsPolicy.</p>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<code>status</code><br/>
<em>
<a href="https://pkg.go.dev/sigs.k8s.io/gateway-api/apis/v1#PolicyStatus">
sigs.k8s.io/gateway-api/apis/v1.PolicyStatus
</a>
</em>
</td>
<td>
<p>Status defines the state of the UpstreamSettingsPolicy.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.WAFPolicy">WAFPolicy
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.WAFPolicy" title="Permanent link">¶</a>
</h3>
<p>
<p>WAFPolicy is an Inherited Attached Policy. It provides a way to configure F5 WAF for NGINX
for Gateways and Routes by referencing compiled WAF policy bundles. Bundles can be fetched directly from an
HTTP/HTTPS URL (type: HTTP), from an NGINX Instance Manager instance (type: NIM), or from an F5 NGINX One
Console instance (type: N1C).</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>apiVersion</code><br/>
string</td>
<td>
<code>
gateway.nginx.org/v1alpha1
</code>
</td>
</tr>
<tr>
<td>
<code>kind</code><br/>
string
</td>
<td><code>WAFPolicy</code></td>
</tr>
<tr>
<td>
<code>metadata</code><br/>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#objectmeta-v1-meta">
Kubernetes meta/v1.ObjectMeta
</a>
</em>
</td>
<td>
Refer to the Kubernetes API documentation for the fields of the
<code>metadata</code> field.
</td>
</tr>
<tr>
<td>
<code>spec</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.WAFPolicySpec">
WAFPolicySpec
</a>
</em>
</td>
<td>
<p>Spec defines the desired state of the WAFPolicy.</p>
<br/>
<br/>
<table class="table table-bordered table-striped">
<tr>
<td>
<code>targetRefs</code><br/>
<em>
<a href="https://pkg.go.dev/sigs.k8s.io/gateway-api/apis/v1#LocalPolicyTargetReference">
[]sigs.k8s.io/gateway-api/apis/v1.LocalPolicyTargetReference
</a>
</em>
</td>
<td>
<p>TargetRefs identifies API object(s) to apply the policy to.
Objects must be in the same namespace as the policy.
All targets must be of the same Kind (all Gateways OR all HTTPRoutes OR all GRPCRoutes).
Support: Gateway, HTTPRoute, GRPCRoute.</p>
</td>
</tr>
<tr>
<td>
<code>type</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.PolicySourceType">
PolicySourceType
</a>
</em>
</td>
<td>
<p>Type identifies the source type for the policy bundle.
HTTP fetches directly from a URL; NIM uses the NGINX Instance Manager bundles API;
N1C uses the F5 NGINX One Console security policies API.</p>
</td>
</tr>
<tr>
<td>
<code>policySource</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.PolicySource">
PolicySource
</a>
</em>
</td>
<td>
<p>PolicySource holds all policy bundle fetch configuration.</p>
</td>
</tr>
<tr>
<td>
<code>securityLogs</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.WAFSecurityLog">
[]WAFSecurityLog
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>SecurityLogs defines security logging configurations.</p>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<code>status</code><br/>
<em>
<a href="https://pkg.go.dev/sigs.k8s.io/gateway-api/apis/v1#PolicyStatus">
sigs.k8s.io/gateway-api/apis/v1.PolicyStatus
</a>
</em>
</td>
<td>
<p>Status defines the state of the WAFPolicy.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.AuthType">AuthType
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.AuthType" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.AuthenticationFilterSpec">AuthenticationFilterSpec</a>)
</p>
<p>
<p>AuthType defines the authentication mechanism.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"Basic"</p></td>
<td><p>AuthTypeBasic is the HTTP Basic Authentication mechanism.</p>
</td>
</tr><tr><td><p>"JWT"</p></td>
<td><p>AuthTypeJWT is the JWT Authentication mechanism.</p>
</td>
</tr><tr><td><p>"OIDC"</p></td>
<td><p>AuthTypeOIDC is the OpenID Connect Authentication mechanism.</p>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.AuthenticationFilterConditionReason">AuthenticationFilterConditionReason
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.AuthenticationFilterConditionReason" title="Permanent link">¶</a>
</h3>
<p>
<p>AuthenticationFilterConditionReason is a reason for an AuthenticationFilter condition type.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"Accepted"</p></td>
<td><p>AuthenticationFilterConditionReasonAccepted is used with the Accepted condition type when
the condition is true.</p>
</td>
</tr><tr><td><p>"Invalid"</p></td>
<td><p>AuthenticationFilterConditionReasonInvalid is used with the Accepted condition type when
the filter is invalid.</p>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.AuthenticationFilterConditionType">AuthenticationFilterConditionType
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.AuthenticationFilterConditionType" title="Permanent link">¶</a>
</h3>
<p>
<p>AuthenticationFilterConditionType is a type of condition associated with AuthenticationFilter.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"Accepted"</p></td>
<td><p>AuthenticationFilterConditionTypeAccepted indicates that the AuthenticationFilter is accepted.</p>
<p>Possible reasons for this condition to be True:
* Accepted</p>
<p>Possible reasons for this condition to be False:
* Invalid.</p>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.AuthenticationFilterSpec">AuthenticationFilterSpec
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.AuthenticationFilterSpec" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.AuthenticationFilter">AuthenticationFilter</a>)
</p>
<p>
<p>AuthenticationFilterSpec defines the desired configuration.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>basic</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.BasicAuth">
BasicAuth
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Basic configures HTTP Basic Authentication.</p>
</td>
</tr>
<tr>
<td>
<code>oidc</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.OIDCAuth">
OIDCAuth
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>OIDC configures OpenID Connect Authentication (NGINX Plus).</p>
</td>
</tr>
<tr>
<td>
<code>jwt</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.JWTAuth">
JWTAuth
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>JWT configures JSON Web Token authentication (NGINX Plus).</p>
</td>
</tr>
<tr>
<td>
<code>type</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.AuthType">
AuthType
</a>
</em>
</td>
<td>
<p>Type selects the authentication mechanism.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.AuthenticationFilterStatus">AuthenticationFilterStatus
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.AuthenticationFilterStatus" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.AuthenticationFilter">AuthenticationFilter</a>)
</p>
<p>
<p>AuthenticationFilterStatus defines the state of AuthenticationFilter.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>controllers</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.ControllerStatus">
[]ControllerStatus
</a>
</em>
</td>
<td>
<p>Controllers is a list of Gateway API controllers that processed the AuthenticationFilter
and the status of the AuthenticationFilter with respect to each controller.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.BasicAuth">BasicAuth
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.BasicAuth" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.AuthenticationFilterSpec">AuthenticationFilterSpec</a>)
</p>
<p>
<p>BasicAuth configures HTTP Basic Authentication.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>secretRef</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.LocalObjectReference">
LocalObjectReference
</a>
</em>
</td>
<td>
<p>SecretRef references a Secret containing credentials in the same namespace.</p>
</td>
</tr>
<tr>
<td>
<code>realm</code><br/>
<em>
string
</em>
</td>
<td>
<p>Realm used by NGINX <code>auth_basic</code> directive.
<a href="https://nginx.org/en/docs/http/ngx_http_auth_basic_module.html#auth_basic">https://nginx.org/en/docs/http/ngx_http_auth_basic_module.html#auth_basic</a>
Also configures “realm=”<realm_value>” in WWW-Authenticate header in error page location.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.BundleAuth">BundleAuth
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.BundleAuth" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.LogSource">LogSource</a>,
<a href="#gateway.nginx.org/v1alpha1.PolicySource">PolicySource</a>)
</p>
<p>
<p>BundleAuth configures authentication for bundle fetching.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>secretRef</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.LocalObjectReference">
LocalObjectReference
</a>
</em>
</td>
<td>
<p>SecretRef references a Kubernetes Secret in the same namespace as the WAFPolicy.
The Secret may contain:
- “username” and “password” fields for HTTP Basic Authentication
- “token” field for Bearer Token Authentication (NIM) or APIToken Authentication (N1C)</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.BundlePolling">BundlePolling
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.BundlePolling" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.LogSource">LogSource</a>,
<a href="#gateway.nginx.org/v1alpha1.PolicySource">PolicySource</a>)
</p>
<p>
<p>BundlePolling configures automatic re-fetching of a bundle.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>interval</code><br/>
<em>
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
Kubernetes meta/v1.Duration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Interval is the period between poll cycles.
Defaults to 5m when polling is enabled but no interval is set.</p>
</td>
</tr>
<tr>
<td>
<code>enabled</code><br/>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>Enabled activates periodic re-fetching of the bundle.
When true, NGF fetches the bundle on each interval and deploys it only if
its checksum differs from the last successfully fetched version.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.BundleValidation">BundleValidation
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.BundleValidation" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.LogSource">LogSource</a>,
<a href="#gateway.nginx.org/v1alpha1.PolicySource">PolicySource</a>)
</p>
<p>
<p>BundleValidation configures integrity verification for a bundle.
Exactly one of verifyChecksum or expectedChecksum may be set.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>expectedChecksum</code><br/>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>ExpectedChecksum is the expected SHA256 checksum of the bundle.
If set, the downloaded bundle must match this checksum or it will be rejected.
For N1C sources, the checksum reported by the N1C API is verified automatically;
set this field only if you want to enforce an additional, independently known value.</p>
</td>
</tr>
<tr>
<td>
<code>verifyChecksum</code><br/>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>VerifyChecksum enables automatic checksum verification by fetching a companion
checksum file at <url>.sha256 and comparing it against the downloaded bundle.
Only supported when the policy source type is HTTP (policySource.httpSource or
logSource.url); setting this for NIM or N1C sources is rejected at admission.
Note: for N1C sources, bundle integrity is always verified automatically using
the checksum returned by the N1C compile API — this field is not needed.
Mutually exclusive with expectedChecksum.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.ClientBody">ClientBody
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.ClientBody" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.ClientSettingsPolicySpec">ClientSettingsPolicySpec</a>)
</p>
<p>
<p>ClientBody contains the settings for the client request body.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>maxSize</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.Size">
Size
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>MaxSize sets the maximum allowed size of the client request body.
If the size in a request exceeds the configured value,
the 413 (Request Entity Too Large) error is returned to the client.
Setting size to 0 disables checking of client request body size.
Default: <a href="https://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size">https://nginx.org/en/docs/http/ngx_http_core_module.html#client_max_body_size</a>.</p>
</td>
</tr>
<tr>
<td>
<code>timeout</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.Duration">
Duration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Timeout defines a timeout for reading client request body. The timeout is set only for a period between
two successive read operations, not for the transmission of the whole request body.
If a client does not transmit anything within this time, the request is terminated with the
408 (Request Time-out) error.
Default: <a href="https://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_timeout">https://nginx.org/en/docs/http/ngx_http_core_module.html#client_body_timeout</a>.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.ClientKeepAlive">ClientKeepAlive
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.ClientKeepAlive" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.ClientSettingsPolicySpec">ClientSettingsPolicySpec</a>)
</p>
<p>
<p>ClientKeepAlive defines the keep-alive settings for clients.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>requests</code><br/>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>Requests sets the maximum number of requests that can be served through one keep-alive connection.
After the maximum number of requests are made, the connection is closed. Closing connections periodically
is necessary to free per-connection memory allocations. Therefore, using too high maximum number of requests
is not recommended as it can lead to excessive memory usage.
Default: <a href="https://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_requests">https://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_requests</a>.</p>
</td>
</tr>
<tr>
<td>
<code>time</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.Duration">
Duration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Time defines the maximum time during which requests can be processed through one keep-alive connection.
After this time is reached, the connection is closed following the subsequent request processing.
Default: <a href="https://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_time">https://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_time</a>.</p>
</td>
</tr>
<tr>
<td>
<code>timeout</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.ClientKeepAliveTimeout">
ClientKeepAliveTimeout
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Timeout defines the keep-alive timeouts for clients.</p>
</td>
</tr>
<tr>
<td>
<code>minTimeout</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.Duration">
Duration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>MinTimeout defines the timeout for which the keep-alive client connection
will not be closed on the server side for connection reuse or on
graceful shutdown of worker processes.
Default: <a href="https://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_min_timeout">https://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_min_timeout</a>.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.ClientKeepAliveTimeout">ClientKeepAliveTimeout
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.ClientKeepAliveTimeout" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.ClientKeepAlive">ClientKeepAlive</a>)
</p>
<p>
<p>ClientKeepAliveTimeout defines the timeouts related to keep-alive client connections.
Default: <a href="https://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout">https://nginx.org/en/docs/http/ngx_http_core_module.html#keepalive_timeout</a>.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>server</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.Duration">
Duration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Server sets the timeout during which a keep-alive client connection will stay open on the server side.
Setting this value to 0 disables keep-alive client connections.</p>
</td>
</tr>
<tr>
<td>
<code>header</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.Duration">
Duration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Header sets the timeout in the “Keep-Alive: timeout=time” response header field.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.ClientSettingsPolicySpec">ClientSettingsPolicySpec
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.ClientSettingsPolicySpec" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.ClientSettingsPolicy">ClientSettingsPolicy</a>)
</p>
<p>
<p>ClientSettingsPolicySpec defines the desired state of ClientSettingsPolicy.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>body</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.ClientBody">
ClientBody
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Body defines the client request body settings.</p>
</td>
</tr>
<tr>
<td>
<code>keepAlive</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.ClientKeepAlive">
ClientKeepAlive
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>KeepAlive defines the keep-alive settings.</p>
</td>
</tr>
<tr>
<td>
<code>targetRef</code><br/>
<em>
<a href="https://pkg.go.dev/sigs.k8s.io/gateway-api/apis/v1#LocalPolicyTargetReference">
sigs.k8s.io/gateway-api/apis/v1.LocalPolicyTargetReference
</a>
</em>
</td>
<td>
<p>TargetRef identifies an API object to apply the policy to.
Object must be in the same namespace as the policy.
Support: Gateway, HTTPRoute, GRPCRoute.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.ControllerLogLevel">ControllerLogLevel
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.ControllerLogLevel" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.Logging">Logging</a>)
</p>
<p>
<p>ControllerLogLevel type defines the logging level for the control plane.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"debug"</p></td>
<td><p>ControllerLogLevelDebug is the debug level for control plane logging.</p>
</td>
</tr><tr><td><p>"error"</p></td>
<td><p>ControllerLogLevelError is the error level for control plane logging.</p>
</td>
</tr><tr><td><p>"info"</p></td>
<td><p>ControllerLogLevelInfo is the info level for control plane logging.</p>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.ControllerStatus">ControllerStatus
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.ControllerStatus" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.AuthenticationFilterStatus">AuthenticationFilterStatus</a>,
<a href="#gateway.nginx.org/v1alpha1.SnippetsFilterStatus">SnippetsFilterStatus</a>)
</p>
<p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>controllerName</code><br/>
<em>
<a href="https://pkg.go.dev/sigs.k8s.io/gateway-api/apis/v1#GatewayController">
sigs.k8s.io/gateway-api/apis/v1.GatewayController
</a>
</em>
</td>
<td>
<p>ControllerName is a domain/path string that indicates the name of the
controller that wrote this status. This corresponds with the
controllerName field on GatewayClass.</p>
<p>Example: “example.net/gateway-controller”.</p>
<p>The format of this field is DOMAIN “/” PATH, where DOMAIN and PATH are
valid Kubernetes names
(<a href="https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names">https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names</a>).</p>
<p>Controllers MUST populate this field when writing status. Controllers should ensure that
entries to status populated with their ControllerName are cleaned up when they are no
longer necessary.</p>
</td>
</tr>
<tr>
<td>
<code>conditions</code><br/>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#condition-v1-meta">
[]Kubernetes meta/v1.Condition
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Conditions describe the status of the SnippetsFilter.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.DefaultLogProfile">DefaultLogProfile
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.DefaultLogProfile" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.LogSource">LogSource</a>)
</p>
<p>
<p>DefaultLogProfile identifies a built-in WAF log profile bundle.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"log_all"</p></td>
<td><p>DefaultLogProfileAll logs all events.</p>
</td>
</tr><tr><td><p>"log_blocked"</p></td>
<td><p>DefaultLogProfileBlocked logs blocked events.</p>
</td>
</tr><tr><td><p>"log_default"</p></td>
<td><p>DefaultLogProfileDefault logs illegal events (equivalent to log_illegal).</p>
</td>
</tr><tr><td><p>"log_grpc_all"</p></td>
<td><p>DefaultLogProfileGRPCAll logs all gRPC events.</p>
</td>
</tr><tr><td><p>"log_grpc_blocked"</p></td>
<td><p>DefaultLogProfileGRPCBlocked logs blocked gRPC events.</p>
</td>
</tr><tr><td><p>"log_grpc_illegal"</p></td>
<td><p>DefaultLogProfileGRPCIllegal logs illegal gRPC events.</p>
</td>
</tr><tr><td><p>"log_illegal"</p></td>
<td><p>DefaultLogProfileIllegal logs illegal events.</p>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.Duration">Duration
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.Duration" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.ClientBody">ClientBody</a>,
<a href="#gateway.nginx.org/v1alpha1.ClientKeepAlive">ClientKeepAlive</a>,
<a href="#gateway.nginx.org/v1alpha1.ClientKeepAliveTimeout">ClientKeepAliveTimeout</a>,
<a href="#gateway.nginx.org/v1alpha1.JWTAuth">JWTAuth</a>,
<a href="#gateway.nginx.org/v1alpha1.OIDCSessionConfig">OIDCSessionConfig</a>,
<a href="#gateway.nginx.org/v1alpha1.ProxyTimeout">ProxyTimeout</a>,
<a href="#gateway.nginx.org/v1alpha1.UpstreamKeepAlive">UpstreamKeepAlive</a>,
<a href="#gateway.nginx.org/v1alpha2.DNSResolver">DNSResolver</a>,
<a href="#gateway.nginx.org/v1alpha2.TelemetryExporter">TelemetryExporter</a>)
</p>
<p>
<p>Duration is a string value representing a duration in time.
Duration can be specified in milliseconds (ms), seconds (s), minutes (m), hours (h).
A value without a suffix is seconds.
Examples: 120s, 50ms, 5m, 1h.</p>
</p>
<h3 id="gateway.nginx.org/v1alpha1.HTTPBundleSource">HTTPBundleSource
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.HTTPBundleSource" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.LogSource">LogSource</a>,
<a href="#gateway.nginx.org/v1alpha1.PolicySource">PolicySource</a>)
</p>
<p>
<p>HTTPBundleSource configures direct bundle fetching from an HTTP/HTTPS URL.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>url</code><br/>
<em>
string
</em>
</td>
<td>
<p>URL is the full URL of the compiled policy bundle (.tgz),
e.g. “<a href="https://storage.example.com/bundles/policy.tgz"">https://storage.example.com/bundles/policy.tgz”</a>.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.HashMethodKey">HashMethodKey
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.HashMethodKey" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.UpstreamSettingsPolicySpec">UpstreamSettingsPolicySpec</a>)
</p>
<p>
<p>HashMethodKey defines the key used for hash-based load balancing methods.
The key must be a valid NGINX variable name starting with ‘$’ followed by lowercase
letters and underscores only.
For a full list of NGINX variables,
refer to: <a href="https://nginx.org/en/docs/http/ngx_http_upstream_module.html#variables">https://nginx.org/en/docs/http/ngx_http_upstream_module.html#variables</a></p>
</p>
<h3 id="gateway.nginx.org/v1alpha1.JWTAuth">JWTAuth
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.JWTAuth" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.AuthenticationFilterSpec">AuthenticationFilterSpec</a>)
</p>
<p>
<p>JWTAuth configures JWT-based authentication (NGINX Plus).</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>file</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.JWTFileKeySource">
JWTFileKeySource
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>File specifies local JWKS configuration.
Required when Source == File.</p>
</td>
</tr>
<tr>
<td>
<code>keyCache</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.Duration">
Duration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>KeyCache is the cache duration for keys.
Configures <code>auth_jwt_key_cache</code> directive.
<a href="https://nginx.org/en/docs/http/ngx_http_auth_jwt_module.html#auth_jwt_key_cache">https://nginx.org/en/docs/http/ngx_http_auth_jwt_module.html#auth_jwt_key_cache</a>
Example: “auth_jwt_key_cache 10m;”.</p>
</td>
</tr>
<tr>
<td>
<code>remote</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.JWTRemoteKeySource">
JWTRemoteKeySource
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Remote specifies remote JWKS configuration.
Required when Source == Remote.</p>
</td>
</tr>
<tr>
<td>
<code>realm</code><br/>
<em>
string
</em>
</td>
<td>
<p>Realm used by NGINX <code>auth_jwt</code> directive
<a href="https://nginx.org/en/docs/http/ngx_http_auth_jwt_module.html#auth_jwt">https://nginx.org/en/docs/http/ngx_http_auth_jwt_module.html#auth_jwt</a>
Configures “realm=”<realm_value>” in WWW-Authenticate header in error page location.</p>
</td>
</tr>
<tr>
<td>
<code>source</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.JWTKeySource">
JWTKeySource
</a>
</em>
</td>
<td>
<p>Source selects how JWT keys are provided: local file or remote JWKS.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.JWTFileKeySource">JWTFileKeySource
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.JWTFileKeySource" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.JWTAuth">JWTAuth</a>)
</p>
<p>
<p>JWTFileKeySource specifies local JWKS key configuration.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>secretRef</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.LocalObjectReference">
LocalObjectReference
</a>
</em>
</td>
<td>
<p>SecretRef references a Secret containing the JWKS.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.JWTKeySource">JWTKeySource
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.JWTKeySource" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.JWTAuth">JWTAuth</a>)
</p>
<p>
<p>JWTKeySource specifies the source of the keys used to verify JWT signatures.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"File"</p></td>
<td><p>JWTKeySourceFile configures JWT to fetch JWKS from a local secret.</p>
</td>
</tr><tr><td><p>"Remote"</p></td>
<td><p>JWTKeySourceRemote configures JWT to fetch JWKS from a remote source.</p>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.JWTRemoteKeySource">JWTRemoteKeySource
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.JWTRemoteKeySource" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.JWTAuth">JWTAuth</a>)
</p>
<p>
<p>JWTRemoteKeySource specifies remote JWKS configuration.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>uri</code><br/>
<em>
string
</em>
</td>
<td>
<p>URI is the JWKS endpoint.</p>
</td>
</tr>
<tr>
<td>
<code>caCertificateRefs</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.LocalObjectReference">
[]LocalObjectReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>CACertificateRefs references a list of secrets containing trusted CA certificates
in PEM format used to verify the server certificate of the JWKS endpoint.
The referenced secrets must contain an entry with the key “ca.crt”.
Only one secret can be referenced currently.
If not specified, the system CA bundle is used.</p>
<p>Directive: <a href="https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_trusted_certificate">https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_trusted_certificate</a></p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.LoadBalancingType">LoadBalancingType
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.LoadBalancingType" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.UpstreamSettingsPolicySpec">UpstreamSettingsPolicySpec</a>)
</p>
<p>
<p>LoadBalancingType defines the supported load balancing methods.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"hash"</p></td>
<td><p>LoadBalancingTypeHash enables generic hash-based load balancing,
routing requests to upstream servers based on a hash of a specified key
HashMethodKey field must be set when this method is selected.
Example configuration: hash $binary_remote_addr;.</p>
</td>
</tr><tr><td><p>"hash consistent"</p></td>
<td><p>LoadBalancingTypeHashConsistent enables consistent hash-based load balancing,
which minimizes the number of keys remapped when a server is added or removed.
HashMethodKey field must be set when this method is selected.
Example configuration: hash $binary_remote_addr consistent;.</p>
</td>
</tr><tr><td><p>"ip_hash"</p></td>
<td><p>LoadBalancingTypeIPHash enables IP hash-based load balancing,
ensuring requests from the same client IP are routed to the same upstream server.</p>
</td>
</tr><tr><td><p>"least_conn"</p></td>
<td><p>LoadBalancingTypeLeastConnection enables least-connections load balancing,
routing requests to the upstream server with the fewest active connections.</p>
</td>
</tr><tr><td><p>"least_time header"</p></td>
<td><p>LoadBalancingTypeLeastTimeHeader enables least-time load balancing,
routing requests to the upstream server with the least time to receive the response header.</p>
</td>
</tr><tr><td><p>"least_time header inflight"</p></td>
<td><p>LoadBalancingTypeLeastTimeHeaderInflight enables least-time load balancing,
routing requests to the upstream server with the least time to receive the response header,
considering the incomplete requests.</p>
</td>
</tr><tr><td><p>"least_time last_byte"</p></td>
<td><p>LoadBalancingTypeLeastTimeLastByte enables least-time load balancing,
routing requests to the upstream server with the least time to receive the full response.</p>
</td>
</tr><tr><td><p>"least_time last_byte inflight"</p></td>
<td><p>LoadBalancingTypeLeastTimeLastByteInflight enables least-time load balancing,
routing requests to the upstream server with the least time to receive the full response,
considering the incomplete requests.</p>
</td>
</tr><tr><td><p>"random"</p></td>
<td><p>LoadBalancingTypeRandom enables random load balancing,
routing requests to upstream servers in a random manner.</p>
</td>
</tr><tr><td><p>"random two"</p></td>
<td><p>LoadBalancingTypeRandomTwo enables a variation of random load balancing
that randomly selects two servers and forwards traffic to one of them.
The default method is least_conn which passes a request to a server with the least number of active connections.</p>
</td>
</tr><tr><td><p>"random two least_conn"</p></td>
<td><p>LoadBalancingTypeRandomTwoLeastConnection enables a variation of least-connections
balancing that randomly selects two servers and forwards traffic to the one with
fewer active connections.</p>
</td>
</tr><tr><td><p>"random two least_time=header"</p></td>
<td><p>LoadBalancingTypeRandomTwoLeastTimeHeader enables a variation of least-time load balancing
that randomly selects two servers and forwards traffic to the one with the least
time to receive the response header.</p>
</td>
</tr><tr><td><p>"random two least_time=last_byte"</p></td>
<td><p>LoadBalancingTypeRandomTwoLeastTimeLastByte enables a variation of least-time load balancing
that randomly selects two servers and forwards traffic to the one with the least time
to receive the full response.</p>
</td>
</tr><tr><td><p>"round_robin"</p></td>
<td><p>LoadBalancingTypeRoundRobin enables round-robin load balancing,
distributing requests evenly across all upstream servers.</p>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.LocalObjectReference">LocalObjectReference
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.LocalObjectReference" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.BasicAuth">BasicAuth</a>,
<a href="#gateway.nginx.org/v1alpha1.BundleAuth">BundleAuth</a>,
<a href="#gateway.nginx.org/v1alpha1.JWTFileKeySource">JWTFileKeySource</a>,
<a href="#gateway.nginx.org/v1alpha1.JWTRemoteKeySource">JWTRemoteKeySource</a>,
<a href="#gateway.nginx.org/v1alpha1.LogSource">LogSource</a>,
<a href="#gateway.nginx.org/v1alpha1.OIDCAuth">OIDCAuth</a>,
<a href="#gateway.nginx.org/v1alpha1.PolicySource">PolicySource</a>)
</p>
<p>
<p>LocalObjectReference specifies a local Kubernetes object.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>name</code><br/>
<em>
string
</em>
</td>
<td>
<p>Name is the name of the referenced object.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.LocalRateLimit">LocalRateLimit
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.LocalRateLimit" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.RateLimit">RateLimit</a>)
</p>
<p>
<p>LocalRateLimit contains the local rate limit rules.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>rules</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.RateLimitRule">
[]RateLimitRule
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Rules contains the list of rate limit rules.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.LogSource">LogSource
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.LogSource" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.WAFSecurityLog">WAFSecurityLog</a>)
</p>
<p>
<p>LogSource holds all configuration for fetching a WAF log profile bundle.
Exactly one of DefaultProfile, HTTPSource, NIMSource, or N1CSource must be set.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>defaultProfile</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.DefaultLogProfile">
DefaultLogProfile
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>DefaultProfile selects one of the built-in WAF log profile bundles shipped with the WAF engine.
Mutually exclusive with HTTPSource, NIMSource, and N1CSource.</p>
</td>
</tr>
<tr>
<td>
<code>httpSource</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.HTTPBundleSource">
HTTPBundleSource
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>HTTPSource configures direct bundle fetching from an HTTP/HTTPS URL.
Mutually exclusive with DefaultProfile, NIMSource and N1CSource.</p>
</td>
</tr>
<tr>
<td>
<code>nimSource</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.NIMLogProfileBundleSource">
NIMLogProfileBundleSource
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>NIMSource configures bundle fetching from NGINX Instance Manager.
Mutually exclusive with DefaultProfile, HTTPSource and N1CSource.</p>
</td>
</tr>
<tr>
<td>
<code>n1cSource</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.N1CLogProfileBundleSource">
N1CLogProfileBundleSource
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>N1CSource configures bundle fetching from F5 NGINX One Console.
Mutually exclusive with DefaultProfile, HTTPSource, and NIMSource.</p>
</td>
</tr>
<tr>
<td>
<code>auth</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.BundleAuth">
BundleAuth
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Auth configures authentication credentials for fetching the log bundle.
Only applicable when url is set.</p>
</td>
</tr>
<tr>
<td>
<code>tlsSecret</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.LocalObjectReference">
LocalObjectReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>TLSSecretRef references a Secret containing a custom CA certificate (key: “ca.crt”).
Only applicable when url is set.</p>
</td>
</tr>
<tr>
<td>
<code>validation</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.BundleValidation">
BundleValidation
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Validation configures integrity verification for the downloaded log bundle.
Only applicable when url is set.</p>
</td>
</tr>
<tr>
<td>
<code>polling</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.BundlePolling">
BundlePolling
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Polling configures automatic periodic re-fetching of the log bundle.
Only applicable when url is set.</p>
</td>
</tr>
<tr>
<td>
<code>timeout</code><br/>
<em>
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
Kubernetes meta/v1.Duration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Timeout is the maximum duration for a single log bundle fetch attempt.
Defaults to 30s when not set. Only applicable when url is set.</p>
</td>
</tr>
<tr>
<td>
<code>retryAttempts</code><br/>
<em>
int32
</em>
</td>
<td>
<p>RetryAttempts is the maximum number of additional fetch attempts on transient failures
(network errors, HTTP 5xx). Set to 0 to disable retries. Defaults to 3.
Non-transient errors (HTTP 4xx, checksum mismatch) are never retried.
Only applicable when url is set.</p>
</td>
</tr>
<tr>
<td>
<code>insecureSkipVerify</code><br/>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>InsecureSkipVerify disables TLS certificate verification when fetching the bundle.
Not recommended for production use.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.Logging">Logging
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.Logging" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.NginxGatewaySpec">NginxGatewaySpec</a>)
</p>
<p>
<p>Logging defines logging related settings for the control plane.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>level</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.ControllerLogLevel">
ControllerLogLevel
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Level defines the logging level.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.N1CBundleSource">N1CBundleSource
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.N1CBundleSource" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.PolicySource">PolicySource</a>)
</p>
<p>
<p>N1CBundleSource configures bundle fetching from F5 NGINX One Console (N1C).
Exactly one of policyName or policyObjectID must be set.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>policyName</code><br/>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>PolicyName is the name of the security policy in N1C.
Mutually exclusive with policyObjectID.</p>
</td>
</tr>
<tr>
<td>
<code>policyObjectID</code><br/>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>PolicyObjectID is the unique object identifier of the security policy in N1C
(e.g. “pol_-IUuEUN7ST63oRC7AlQPLw”).
Mutually exclusive with policyName.</p>
</td>
</tr>
<tr>
<td>
<code>policyVersionID</code><br/>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>PolicyVersionID pins a specific version of the policy bundle using its opaque version ID
(e.g. “pv_UJ2gL5fOQ3Gnb3OVuVo1XA”). When omitted, the latest available version is used.</p>
</td>
</tr>
<tr>
<td>
<code>url</code><br/>
<em>
string
</em>
</td>
<td>
<p>URL is the base URL of the F5 NGINX One Console instance,
e.g. “https://<tenant>.console.ves.volterra.io”.</p>
</td>
</tr>
<tr>
<td>
<code>namespace</code><br/>
<em>
string
</em>
</td>
<td>
<p>Namespace is the NGINX One Console namespace that owns the security policy.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.N1CLogProfileBundleSource">N1CLogProfileBundleSource
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.N1CLogProfileBundleSource" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.LogSource">LogSource</a>)
</p>
<p>
<p>N1CLogProfileBundleSource configures log profile bundle fetching from F5 NGINX One Console (N1C).
Exactly one of profileName or profileObjectID must be set.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>profileName</code><br/>
<em>
string
</em>
</td>
<td>
<p>ProfileName is the name of the log profile in N1C that corresponds to the log profile bundle.</p>
</td>
</tr>
<tr>
<td>
<code>profileObjectID</code><br/>
<em>
string
</em>
</td>
<td>
<p>ProfileObjectID is the unique object identifier of the log profile in N1C
(e.g. “lp_8s8uZxLpThWwEGF7LTn_rA”) that corresponds to the log profile bundle.</p>
</td>
</tr>
<tr>
<td>
<code>url</code><br/>
<em>
string
</em>
</td>
<td>
<p>URL is the base URL of the F5 NGINX One Console instance,
e.g. “https://<tenant>.console.ves.volterra.io”.</p>
</td>
</tr>
<tr>
<td>
<code>namespace</code><br/>
<em>
string
</em>
</td>
<td>
<p>Namespace is the NGINX One Console namespace that owns the log profile.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.NIMBundleSource">NIMBundleSource
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.NIMBundleSource" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.PolicySource">PolicySource</a>)
</p>
<p>
<p>NIMBundleSource configures bundle fetching from NGINX Instance Manager (NIM).
Exactly one of policyName or policyUID must be set.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>policyName</code><br/>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>PolicyName is the name of the compiled policy bundle in NIM.
Mutually exclusive with policyUID.</p>
</td>
</tr>
<tr>
<td>
<code>policyUID</code><br/>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>PolicyUID is the unique identifier of the compiled policy bundle in NIM.
Mutually exclusive with policyName.
Must be a valid UUID (e.g. “2bc1e3ac-7990-4ca4-910a-8634c444c804”).</p>
</td>
</tr>
<tr>
<td>
<code>url</code><br/>
<em>
string
</em>
</td>
<td>
<p>URL is the base URL of the NGINX Instance Manager instance,
e.g. “<a href="https://nim.example.com"">https://nim.example.com”</a>.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.NIMLogProfileBundleSource">NIMLogProfileBundleSource
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.NIMLogProfileBundleSource" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.LogSource">LogSource</a>)
</p>
<p>
<p>NIMLogProfileBundleSource configures log profile bundle fetching from NGINX Instance Manager (NIM).</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>profileName</code><br/>
<em>
string
</em>
</td>
<td>
<p>ProfileName is the name of the compiled log profile bundle in NIM.</p>
</td>
</tr>
<tr>
<td>
<code>url</code><br/>
<em>
string
</em>
</td>
<td>
<p>URL is the base URL of the NGINX Instance Manager instance,
e.g. “<a href="https://nim.example.com"">https://nim.example.com”</a>.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.NginxContext">NginxContext
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.NginxContext" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.Snippet">Snippet</a>)
</p>
<p>
<p>NginxContext represents the NGINX configuration context.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"http"</p></td>
<td><p>NginxContextHTTP is the http context of the NGINX configuration.
<a href="https://nginx.org/en/docs/http/ngx_http_core_module.html#http">https://nginx.org/en/docs/http/ngx_http_core_module.html#http</a></p>
</td>
</tr><tr><td><p>"http.server"</p></td>
<td><p>NginxContextHTTPServer is the server context of the NGINX configuration.
<a href="https://nginx.org/en/docs/http/ngx_http_core_module.html#server">https://nginx.org/en/docs/http/ngx_http_core_module.html#server</a></p>
</td>
</tr><tr><td><p>"http.server.location"</p></td>
<td><p>NginxContextHTTPServerLocation is the location context of the NGINX configuration.
<a href="https://nginx.org/en/docs/http/ngx_http_core_module.html#location">https://nginx.org/en/docs/http/ngx_http_core_module.html#location</a></p>
</td>
</tr><tr><td><p>"main"</p></td>
<td><p>NginxContextMain is the main context of the NGINX configuration.</p>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.NginxGatewayConditionReason">NginxGatewayConditionReason
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.NginxGatewayConditionReason" title="Permanent link">¶</a>
</h3>
<p>
<p>NginxGatewayConditionReason defines the set of reasons that explain why a
particular NginxGateway condition type has been raised.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"Invalid"</p></td>
<td><p>NginxGatewayReasonInvalid is a reason that is used with the “Valid” condition when the condition is False.</p>
</td>
</tr><tr><td><p>"Valid"</p></td>
<td><p>NginxGatewayReasonValid is a reason that is used with the “Valid” condition when the condition is True.</p>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.NginxGatewayConditionType">NginxGatewayConditionType
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.NginxGatewayConditionType" title="Permanent link">¶</a>
</h3>
<p>
<p>NginxGatewayConditionType is a type of condition associated with an
NginxGateway. This type should be used with the NginxGatewayStatus.Conditions field.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"Valid"</p></td>
<td><p>NginxGatewayConditionValid is a condition that is true when the NginxGateway
configuration is syntactically and semantically valid.</p>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.NginxGatewaySpec">NginxGatewaySpec
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.NginxGatewaySpec" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.NginxGateway">NginxGateway</a>)
</p>
<p>
<p>NginxGatewaySpec defines the desired state of the NginxGateway.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>logging</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.Logging">
Logging
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Logging defines logging related settings for the control plane.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.NginxGatewayStatus">NginxGatewayStatus
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.NginxGatewayStatus" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.NginxGateway">NginxGateway</a>)
</p>
<p>
<p>NginxGatewayStatus defines the state of the NginxGateway.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>conditions</code><br/>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#condition-v1-meta">
[]Kubernetes meta/v1.Condition
</a>
</em>
</td>
<td>
<em>(Optional)</em>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.OIDCAuth">OIDCAuth
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.OIDCAuth" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.AuthenticationFilterSpec">AuthenticationFilterSpec</a>)
</p>
<p>
<p>OIDCAuth configures OpenID Connect Authentication.
Only available for NGINX Plus users.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>crlSecretRef</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.LocalObjectReference">
LocalObjectReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>CRLSecretRef references a Secret containing a certificate
revocation list in PEM format. The referenced Secret must contain an entry with the key “ca.crl”.
This is used to verify that certificates presented by the OpenID Provider endpoints have not been revoked.</p>
</td>
</tr>
<tr>
<td>
<code>configURL</code><br/>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>ConfigURL sets a custom URL to retrieve the OpenID Provider metadata.
Directive: <a href="https://nginx.org/en/docs/http/ngx_http_oidc_module.html#config_url">https://nginx.org/en/docs/http/ngx_http_oidc_module.html#config_url</a>
NGINX Default: <issuer>/.well-known/openid-configuration</p>
</td>
</tr>
<tr>
<td>
<code>pkce</code><br/>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>PKCE enables Proof Key for Code Exchange (PKCE) for the authentication flow.
If nil, NGINX automatically enables PKCE when the OpenID Provider requires it.
Directive: <a href="https://nginx.org/en/docs/http/ngx_http_oidc_module.html#pkce">https://nginx.org/en/docs/http/ngx_http_oidc_module.html#pkce</a></p>
</td>
</tr>
<tr>
<td>
<code>extraAuthArgs</code><br/>
<em>
map[string]string
</em>
</td>
<td>
<em>(Optional)</em>
<p>ExtraAuthArgs sets additional query arguments for the authentication request URL.
Arguments are appended with “&”. For example: “prompt=consent&audience=api”.
Directive: <a href="https://nginx.org/en/docs/http/ngx_http_oidc_module.html#extra_auth_args">https://nginx.org/en/docs/http/ngx_http_oidc_module.html#extra_auth_args</a></p>
</td>
</tr>
<tr>
<td>
<code>session</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.OIDCSessionConfig">
OIDCSessionConfig
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Session configures session management for OIDC authentication.</p>
</td>
</tr>
<tr>
<td>
<code>logout</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.OIDCLogoutConfig">
OIDCLogoutConfig
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Logout defines the logout behavior for OIDC authentication.</p>
</td>
</tr>
<tr>
<td>
<code>redirectURI</code><br/>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>RedirectURI sets a custom redirect URI for the OIDC callback.
If a path-only URI is specified, a callback location block is created to handle the redirect from the OIDC provider.
If a full URI is specified, it points to an external callback handler; no location block is created.
If not specified, defaults to /oidc<em>callback</em><filternamespace>_<filtername>.
Directive: <a href="https://nginx.org/en/docs/http/ngx_http_oidc_module.html#redirect_uri">https://nginx.org/en/docs/http/ngx_http_oidc_module.html#redirect_uri</a>
NGINX Default: /oidc_callback
Example: /oidc_callback, <a href="https://cafe.example.com:8442/oidc_callback">https://cafe.example.com:8442/oidc_callback</a></p>
</td>
</tr>
<tr>
<td>
<code>issuer</code><br/>
<em>
string
</em>
</td>
<td>
<p>Issuer is the URL of the OpenID Provider.
Must exactly match the “issuer” value from the provider’s
.well-known/openid-configuration endpoint.
Directive: <a href="https://nginx.org/en/docs/http/ngx_http_oidc_module.html#issuer">https://nginx.org/en/docs/http/ngx_http_oidc_module.html#issuer</a>
Examples:
- Keycloak: “<a href="https://keycloak.example.com/realms/my-realm"">https://keycloak.example.com/realms/my-realm”</a>
- Okta: “<a href="https://dev-123456.okta.com/oauth2/default"">https://dev-123456.okta.com/oauth2/default”</a>
- Auth0: “<a href="https://my-tenant.auth0.com/"">https://my-tenant.auth0.com/”</a></p>
</td>
</tr>
<tr>
<td>
<code>clientID</code><br/>
<em>
string
</em>
</td>
<td>
<p>ClientID is the client identifier registered with the OpenID Provider.
Directive: <a href="https://nginx.org/en/docs/http/ngx_http_oidc_module.html#client_id">https://nginx.org/en/docs/http/ngx_http_oidc_module.html#client_id</a></p>
</td>
</tr>
<tr>
<td>
<code>clientSecretRef</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.LocalObjectReference">
LocalObjectReference
</a>
</em>
</td>
<td>
<p>ClientSecretRef references a Kubernetes secret which contains the OIDC client secret to be used in the
Authentication Request: <a href="https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest">https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest</a>.
The referenced Secret must contain an entry with the key “client-secret”.
Directive: <a href="https://nginx.org/en/docs/http/ngx_http_oidc_module.html#client_secret">https://nginx.org/en/docs/http/ngx_http_oidc_module.html#client_secret</a></p>
</td>
</tr>
<tr>
<td>
<code>caCertificateRefs</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.LocalObjectReference">
[]LocalObjectReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>CACertificateRefs references a list of secrets containing trusted CA certificates
in PEM format used to verify the certificates of the OpenID Provider endpoints.
The referenced secrets must contain an entry with the key “ca.crt”.
Only one secret can be referenced currently.
If not specified, the system CA bundle is used.</p>
<p>Directive: <a href="https://nginx.org/en/docs/http/ngx_http_oidc_module.html#ssl_trusted_certificate">https://nginx.org/en/docs/http/ngx_http_oidc_module.html#ssl_trusted_certificate</a>
NGINX Default: system CA bundle</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.OIDCLogoutConfig">OIDCLogoutConfig
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.OIDCLogoutConfig" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.OIDCAuth">OIDCAuth</a>)
</p>
<p>
<p>OIDCLogoutConfig defines the logout behavior for OIDC authentication.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>uri</code><br/>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>URI defines the path for initiating session logout.
Directive: <a href="https://nginx.org/en/docs/http/ngx_http_oidc_module.html#logout_uri">https://nginx.org/en/docs/http/ngx_http_oidc_module.html#logout_uri</a>
Example: /logout</p>
</td>
</tr>
<tr>
<td>
<code>postLogoutURI</code><br/>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>PostLogoutURI defines the URI to redirect to after logout.
Must match the configuration on the provider’s side.
Directive: <a href="https://nginx.org/en/docs/http/ngx_http_oidc_module.html#post_logout_uri">https://nginx.org/en/docs/http/ngx_http_oidc_module.html#post_logout_uri</a>
Example: /after_logout, <a href="https://example.com/after_logout">https://example.com/after_logout</a></p>
</td>
</tr>
<tr>
<td>
<code>frontChannelLogoutURI</code><br/>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>FrontChannelLogoutURI defines the path for front-channel logout.
The OpenID Provider should be configured to set “iss” and “sid” arguments.
Directive: <a href="https://nginx.org/en/docs/http/ngx_http_oidc_module.html#frontchannel_logout_uri">https://nginx.org/en/docs/http/ngx_http_oidc_module.html#frontchannel_logout_uri</a>
Example: /frontchannel_logout</p>
</td>
</tr>
<tr>
<td>
<code>tokenHint</code><br/>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>TokenHint adds the id_token_hint argument to the provider’s Logout Endpoint.
Some OpenID Providers require this.
Directive: <a href="https://nginx.org/en/docs/http/ngx_http_oidc_module.html#logout_token_hint">https://nginx.org/en/docs/http/ngx_http_oidc_module.html#logout_token_hint</a>
NGINX Default: false</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.OIDCSessionConfig">OIDCSessionConfig
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.OIDCSessionConfig" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.OIDCAuth">OIDCAuth</a>)
</p>
<p>
<p>OIDCSessionConfig configures session management for OIDC authentication.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>cookieName</code><br/>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>CookieName sets the name of the session cookie.
Directive: <a href="https://nginx.org/en/docs/http/ngx_http_oidc_module.html#cookie_name">https://nginx.org/en/docs/http/ngx_http_oidc_module.html#cookie_name</a>
NGINX Default: NGX_OIDC_SESSION</p>
</td>
</tr>
<tr>
<td>
<code>timeout</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.Duration">
Duration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Timeout sets the session timeout duration.
Directive: <a href="https://nginx.org/en/docs/http/ngx_http_oidc_module.html#session_timeout">https://nginx.org/en/docs/http/ngx_http_oidc_module.html#session_timeout</a>
NGINX Default: 8h</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.PolicySource">PolicySource
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.PolicySource" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.WAFPolicySpec">WAFPolicySpec</a>)
</p>
<p>
<p>PolicySource holds all configuration for fetching a WAF policy bundle.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>httpSource</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.HTTPBundleSource">
HTTPBundleSource
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>HTTPSource configures direct bundle fetching from an HTTP/HTTPS URL.
Required when type is HTTP; must not be set for other types.</p>
</td>
</tr>
<tr>
<td>
<code>nimSource</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.NIMBundleSource">
NIMBundleSource
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>NIMSource configures bundle fetching from NGINX Instance Manager.
Required when type is NIM; must not be set for other types.</p>
</td>
</tr>
<tr>
<td>
<code>n1cSource</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.N1CBundleSource">
N1CBundleSource
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>N1CSource configures bundle fetching from F5 NGINX One Console.
Required when type is N1C; must not be set for other types.</p>
</td>
</tr>
<tr>
<td>
<code>auth</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.BundleAuth">
BundleAuth
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Auth configures authentication credentials for fetching the bundle.</p>
</td>
</tr>
<tr>
<td>
<code>tlsSecret</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.LocalObjectReference">
LocalObjectReference
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>TLSSecretRef references a Secret containing a custom CA certificate (key: “ca.crt”) for
verifying the bundle server’s TLS certificate.</p>
</td>
</tr>
<tr>
<td>
<code>validation</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.BundleValidation">
BundleValidation
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Validation configures integrity verification for the downloaded bundle.</p>
</td>
</tr>
<tr>
<td>
<code>polling</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.BundlePolling">
BundlePolling
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Polling configures automatic periodic re-fetching of the bundle.</p>
</td>
</tr>
<tr>
<td>
<code>timeout</code><br/>
<em>
<a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/apis/meta/v1#Duration">
Kubernetes meta/v1.Duration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Timeout is the maximum duration for a single bundle fetch attempt.
Defaults to 30s when not set.</p>
</td>
</tr>
<tr>
<td>
<code>retryAttempts</code><br/>
<em>
int32
</em>
</td>
<td>
<p>RetryAttempts is the maximum number of additional fetch attempts on transient failures
(network errors, HTTP 5xx). Set to 0 to disable retries. Defaults to 3.
Non-transient errors (HTTP 4xx, checksum mismatch) are never retried.</p>
</td>
</tr>
<tr>
<td>
<code>insecureSkipVerify</code><br/>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>InsecureSkipVerify disables TLS certificate verification when fetching the bundle.
Not recommended for production use.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.PolicySourceType">PolicySourceType
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.PolicySourceType" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.WAFPolicySpec">WAFPolicySpec</a>)
</p>
<p>
<p>PolicySourceType identifies the source type for a WAF bundle.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"HTTP"</p></td>
<td><p>PolicySourceTypeHTTP fetches a compiled .tgz bundle directly from an HTTP/HTTPS URL.</p>
</td>
</tr><tr><td><p>"N1C"</p></td>
<td><p>PolicySourceTypeN1C fetches a compiled bundle from the F5 NGINX One Console security policies API.
Requires managedSource.n1cNamespace in addition to managedSource.policyName.
Authentication uses the APIToken scheme: the “token” key from the referenced Secret is sent as
“Authorization: APIToken <token>”.</p>
</td>
</tr><tr><td><p>"NIM"</p></td>
<td><p>PolicySourceTypeNIM fetches a compiled bundle from the NGINX Instance Manager security policies API.</p>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.ProxyBuffering">ProxyBuffering
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.ProxyBuffering" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.ProxySettingsPolicySpec">ProxySettingsPolicySpec</a>)
</p>
<p>
<p>ProxyBuffering contains the settings for proxy buffering.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>disable</code><br/>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>Disable enables or disables buffering of responses from the proxied server.
If Disable is true, buffering is disabled. If Disable is false, or if Disable is not set, buffering is enabled.
Directive: <a href="https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffering">https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffering</a></p>
</td>
</tr>
<tr>
<td>
<code>bufferSize</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.Size">
Size
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>BufferSize sets the size of the buffer used for reading the first part of the response received from
the proxied server. This part usually contains a small response header.
Directive: <a href="https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffer_size">https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffer_size</a></p>
</td>
</tr>
<tr>
<td>
<code>buffers</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.ProxyBuffers">
ProxyBuffers
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Buffers sets the number and size of buffers used for reading a response from the proxied server,
for a single connection.
Directive: <a href="https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffers">https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_buffers</a></p>
</td>
</tr>
<tr>
<td>
<code>busyBuffersSize</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.Size">
Size
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>BusyBuffersSize sets the total size of buffers that can be busy sending a response to the client,
while the response is not yet fully read.
Directive: <a href="https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_busy_buffers_size">https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_busy_buffers_size</a></p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.ProxyBuffers">ProxyBuffers
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.ProxyBuffers" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.ProxyBuffering">ProxyBuffering</a>)
</p>
<p>
<p>ProxyBuffers defines the number and size of the proxy buffers.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>size</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.Size">
Size
</a>
</em>
</td>
<td>
<p>Size sets the size of each buffer.</p>
</td>
</tr>
<tr>
<td>
<code>number</code><br/>
<em>
int32
</em>
</td>
<td>
<p>Number sets the number of buffers.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.ProxySettingsPolicySpec">ProxySettingsPolicySpec
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.ProxySettingsPolicySpec" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.ProxySettingsPolicy">ProxySettingsPolicy</a>)
</p>
<p>
<p>ProxySettingsPolicySpec defines the desired state of the ProxySettingsPolicy.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>buffering</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.ProxyBuffering">
ProxyBuffering
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Buffering configures the buffering of responses from the proxied server.</p>
</td>
</tr>
<tr>
<td>
<code>timeout</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.ProxyTimeout">
ProxyTimeout
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Timeout configures timeouts for the connection to the proxied server.</p>
</td>
</tr>
<tr>
<td>
<code>targetRefs</code><br/>
<em>
<a href="https://pkg.go.dev/sigs.k8s.io/gateway-api/apis/v1#LocalPolicyTargetReference">
[]sigs.k8s.io/gateway-api/apis/v1.LocalPolicyTargetReference
</a>
</em>
</td>
<td>
<p>TargetRefs identifies the API object(s) to apply the policy to.
Objects must be in the same namespace as the policy.
Support: Gateway, HTTPRoute, GRPCRoute</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.ProxyTimeout">ProxyTimeout
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.ProxyTimeout" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.ProxySettingsPolicySpec">ProxySettingsPolicySpec</a>)
</p>
<p>
<p>ProxyTimeout defines timeout settings for the connection to the proxied server.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>connect</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.Duration">
Duration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Connect sets the timeout for establishing a connection with the proxied server.
Directive: <a href="https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_connect_timeout">https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_connect_timeout</a></p>
</td>
</tr>
<tr>
<td>
<code>read</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.Duration">
Duration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Read sets the timeout for reading a response from the proxied server.
Directive: <a href="https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_read_timeout">https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_read_timeout</a></p>
</td>
</tr>
<tr>
<td>
<code>send</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.Duration">
Duration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Send sets the timeout for transmitting a request to the proxied server.
Directive: <a href="https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_send_timeout">https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_send_timeout</a></p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.Rate">Rate
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.Rate" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.RateLimitRule">RateLimitRule</a>)
</p>
<p>
<p>Rate is a string value representing a rate. Rate can be specified in r/s or r/m.</p>
</p>
<h3 id="gateway.nginx.org/v1alpha1.RateLimit">RateLimit
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.RateLimit" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.RateLimitPolicySpec">RateLimitPolicySpec</a>)
</p>
<p>
<p>RateLimit contains settings for Rate Limiting.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>local</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.LocalRateLimit">
LocalRateLimit
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Local defines the local rate limit rules for this policy.</p>
</td>
</tr>
<tr>
<td>
<code>dryRun</code><br/>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>DryRun enables the dry run mode. In this mode, the rate limit is not actually applied, but the number of excessive
requests is accounted as usual in the shared memory zone.</p>
<p>Directive: <a href="https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req_dry_run">https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req_dry_run</a></p>
</td>
</tr>
<tr>
<td>
<code>logLevel</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.RateLimitLogLevel">
RateLimitLogLevel
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>LogLevel sets the desired logging level for cases when the server refuses to process requests due to rate exceeding,
or delays request processing. Allowed values are info, notice, warn or error.</p>
<p>Directive: <a href="https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req_log_level">https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req_log_level</a></p>
</td>
</tr>
<tr>
<td>
<code>rejectCode</code><br/>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>RejectCode sets the status code to return in response to rejected requests. Must fall into the range 400-599.</p>
<p>Directive: <a href="https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req_status">https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req_status</a></p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.RateLimitLogLevel">RateLimitLogLevel
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.RateLimitLogLevel" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.RateLimit">RateLimit</a>)
</p>
<p>
<p>RateLimitLogLevel defines the log level for cases when the server refuses
to process requests due to rate exceeding, or delays request processing.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"error"</p></td>
<td><p>RateLimitLogLevelError is the error level rate limit logs.</p>
</td>
</tr><tr><td><p>"info"</p></td>
<td><p>RateLimitLogLevelInfo is the info level rate limit logs.</p>
</td>
</tr><tr><td><p>"notice"</p></td>
<td><p>RateLimitLogLevelNotice is the notice level rate limit logs.</p>
</td>
</tr><tr><td><p>"warn"</p></td>
<td><p>RateLimitLogLevelWarn is the warn level rate limit logs.</p>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.RateLimitPolicySpec">RateLimitPolicySpec
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.RateLimitPolicySpec" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.RateLimitPolicy">RateLimitPolicy</a>)
</p>
<p>
<p>RateLimitPolicySpec defines the desired state of the RateLimitPolicy.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>rateLimit</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.RateLimit">
RateLimit
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>RateLimit defines the Rate Limit settings.</p>
</td>
</tr>
<tr>
<td>
<code>targetRefs</code><br/>
<em>
<a href="https://pkg.go.dev/sigs.k8s.io/gateway-api/apis/v1#LocalPolicyTargetReference">
[]sigs.k8s.io/gateway-api/apis/v1.LocalPolicyTargetReference
</a>
</em>
</td>
<td>
<p>TargetRefs identifies API object(s) to apply the policy to.
Objects must be in the same namespace as the policy.</p>
<p>Support: Gateway, HTTPRoute, GRPCRoute</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.RateLimitRule">RateLimitRule
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.RateLimitRule" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.LocalRateLimit">LocalRateLimit</a>)
</p>
<p>
<p>RateLimitRule contains settings for a RateLimit Rule.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>zoneSize</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.Size">
Size
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>ZoneSize is the size of the shared memory zone.</p>
<p>Directive: <a href="https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req_zone">https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req_zone</a></p>
</td>
</tr>
<tr>
<td>
<code>delay</code><br/>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>Delay specifies a limit at which excessive requests become delayed.
Default value is zero, which means all excessive requests are delayed.</p>
<p>Directive: <a href="https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req">https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req</a></p>
</td>
</tr>
<tr>
<td>
<code>noDelay</code><br/>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>NoDelay disables the delaying of excessive requests while requests are being limited.
NoDelay cannot be true when Delay is also set.</p>
<p>Directive: <a href="https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req">https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req</a></p>
</td>
</tr>
<tr>
<td>
<code>burst</code><br/>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>Burst sets the maximum burst size of requests. If the requests rate exceeds the rate configured for a zone,
their processing is delayed such that requests are processed at a defined rate. Excessive requests are delayed
until their number exceeds the maximum burst size in which case the request is terminated with an error.</p>
<p>Directive: <a href="https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req">https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req</a></p>
</td>
</tr>
<tr>
<td>
<code>rate</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.Rate">
Rate
</a>
</em>
</td>
<td>
<p>Rate represents the rate of requests permitted. The rate is specified in requests per second (r/s)
or requests per minute (r/m).</p>
<p>Directive: <a href="https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req_zone">https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req_zone</a></p>
</td>
</tr>
<tr>
<td>
<code>key</code><br/>
<em>
string
</em>
</td>
<td>
<p>Key represents the key to which the rate limit is applied. The key can contain text, variables,
and their combination.</p>
<p>Directive: <a href="https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req_zone">https://nginx.org/en/docs/http/ngx_http_limit_req_module.html#limit_req_zone</a></p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.SecurityLogDestination">SecurityLogDestination
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.SecurityLogDestination" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.WAFSecurityLog">WAFSecurityLog</a>)
</p>
<p>
<p>SecurityLogDestination defines the destination for security logs.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>file</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.SecurityLogFile">
SecurityLogFile
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>File defines the file destination configuration.
Only valid when type is “file”.</p>
</td>
</tr>
<tr>
<td>
<code>syslog</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.SecurityLogSyslog">
SecurityLogSyslog
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Syslog defines the syslog destination configuration.
Only valid when type is “syslog”.</p>
</td>
</tr>
<tr>
<td>
<code>type</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.SecurityLogDestinationType">
SecurityLogDestinationType
</a>
</em>
</td>
<td>
<p>Type identifies the type of security log destination.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.SecurityLogDestinationType">SecurityLogDestinationType
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.SecurityLogDestinationType" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.SecurityLogDestination">SecurityLogDestination</a>)
</p>
<p>
<p>SecurityLogDestinationType defines the supported security log destination types.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"file"</p></td>
<td><p>SecurityLogDestinationTypeFile writes logs to a specified file path.</p>
</td>
</tr><tr><td><p>"stderr"</p></td>
<td><p>SecurityLogDestinationTypeStderr outputs logs to container stderr.</p>
</td>
</tr><tr><td><p>"syslog"</p></td>
<td><p>SecurityLogDestinationTypeSyslog sends logs to a syslog server via TCP.</p>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.SecurityLogFile">SecurityLogFile
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.SecurityLogFile" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.SecurityLogDestination">SecurityLogDestination</a>)
</p>
<p>
<p>SecurityLogFile defines the file destination configuration for security logs.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>path</code><br/>
<em>
string
</em>
</td>
<td>
<p>Path is the file path where security logs will be written.
Must be accessible to the waf-enforcer container.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.SecurityLogSyslog">SecurityLogSyslog
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.SecurityLogSyslog" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.SecurityLogDestination">SecurityLogDestination</a>)
</p>
<p>
<p>SecurityLogSyslog defines the syslog destination configuration for security logs.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>server</code><br/>
<em>
string
</em>
</td>
<td>
<p>Server is the syslog server address in the format “host:port”.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.Size">Size
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.Size" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.ClientBody">ClientBody</a>,
<a href="#gateway.nginx.org/v1alpha1.ProxyBuffering">ProxyBuffering</a>,
<a href="#gateway.nginx.org/v1alpha1.ProxyBuffers">ProxyBuffers</a>,
<a href="#gateway.nginx.org/v1alpha1.RateLimitRule">RateLimitRule</a>,
<a href="#gateway.nginx.org/v1alpha1.UpstreamSettingsPolicySpec">UpstreamSettingsPolicySpec</a>)
</p>
<p>
<p>Size is a string value representing a size. Size can be specified in bytes, kilobytes (k), megabytes (m),
or gigabytes (g).
Examples: 1024, 8k, 1m.</p>
</p>
<h3 id="gateway.nginx.org/v1alpha1.Snippet">Snippet
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.Snippet" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.SnippetsFilterSpec">SnippetsFilterSpec</a>,
<a href="#gateway.nginx.org/v1alpha1.SnippetsPolicySpec">SnippetsPolicySpec</a>)
</p>
<p>
<p>Snippet represents an NGINX configuration snippet.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>context</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.NginxContext">
NginxContext
</a>
</em>
</td>
<td>
<p>Context is the NGINX context to insert the snippet into.</p>
</td>
</tr>
<tr>
<td>
<code>value</code><br/>
<em>
string
</em>
</td>
<td>
<p>Value is the NGINX configuration snippet.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.SnippetsFilterConditionReason">SnippetsFilterConditionReason
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.SnippetsFilterConditionReason" title="Permanent link">¶</a>
</h3>
<p>
<p>SnippetsFilterConditionReason is a reason for a SnippetsFilter condition type.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"Accepted"</p></td>
<td><p>SnippetsFilterConditionReasonAccepted is used with the Accepted condition type when
the condition is true.</p>
</td>
</tr><tr><td><p>"Invalid"</p></td>
<td><p>SnippetsFilterConditionReasonInvalid is used with the Accepted condition type when
SnippetsFilter is invalid.</p>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.SnippetsFilterConditionType">SnippetsFilterConditionType
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.SnippetsFilterConditionType" title="Permanent link">¶</a>
</h3>
<p>
<p>SnippetsFilterConditionType is a type of condition associated with SnippetsFilter.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"Accepted"</p></td>
<td><p>SnippetsFilterConditionTypeAccepted indicates that the SnippetsFilter is accepted.</p>
<p>Possible reasons for this condition to be True:</p>
<ul>
<li>Accepted</li>
</ul>
<p>Possible reasons for this condition to be False:</p>
<ul>
<li>Invalid.</li>
</ul>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.SnippetsFilterSpec">SnippetsFilterSpec
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.SnippetsFilterSpec" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.SnippetsFilter">SnippetsFilter</a>)
</p>
<p>
<p>SnippetsFilterSpec defines the desired state of the SnippetsFilter.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>snippets</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.Snippet">
[]Snippet
</a>
</em>
</td>
<td>
<p>Snippets is a list of NGINX configuration snippets.
There can only be one snippet per context.
Allowed contexts: main, http, http.server, http.server.location.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.SnippetsFilterStatus">SnippetsFilterStatus
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.SnippetsFilterStatus" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.SnippetsFilter">SnippetsFilter</a>)
</p>
<p>
<p>SnippetsFilterStatus defines the state of SnippetsFilter.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>controllers</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.ControllerStatus">
[]ControllerStatus
</a>
</em>
</td>
<td>
<p>Controllers is a list of Gateway API controllers that processed the SnippetsFilter
and the status of the SnippetsFilter with respect to each controller.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.SnippetsPolicySpec">SnippetsPolicySpec
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.SnippetsPolicySpec" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.SnippetsPolicy">SnippetsPolicy</a>)
</p>
<p>
<p>SnippetsPolicySpec defines the desired state of the SnippetsPolicy.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>targetRefs</code><br/>
<em>
<a href="https://pkg.go.dev/sigs.k8s.io/gateway-api/apis/v1#LocalPolicyTargetReference">
[]sigs.k8s.io/gateway-api/apis/v1.LocalPolicyTargetReference
</a>
</em>
</td>
<td>
<p>TargetRefs identifies API object(s) to apply the policy to.</p>
</td>
</tr>
<tr>
<td>
<code>snippets</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.Snippet">
[]Snippet
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Snippets is a list of snippets to be injected into the NGINX configuration.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.SpanAttribute">SpanAttribute
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.SpanAttribute" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.Telemetry">Telemetry</a>,
<a href="#gateway.nginx.org/v1alpha2.Tracing">Tracing</a>)
</p>
<p>
<p>SpanAttribute is a key value pair to be added to a tracing span.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>key</code><br/>
<em>
string
</em>
</td>
<td>
<p>Key is the key for a span attribute.
Format: must have all ‘“’ escaped and must not contain any ‘$’ or end with an unescaped ‘\’</p>
</td>
</tr>
<tr>
<td>
<code>value</code><br/>
<em>
string
</em>
</td>
<td>
<p>Value is the value for a span attribute.
Format: must have all ‘“’ escaped and must not contain any ‘$’ or end with an unescaped ‘\’</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.UpstreamKeepAlive">UpstreamKeepAlive
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.UpstreamKeepAlive" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.UpstreamSettingsPolicySpec">UpstreamSettingsPolicySpec</a>)
</p>
<p>
<p>UpstreamKeepAlive defines the keep-alive settings for upstreams.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>connections</code><br/>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>Connections sets the maximum number of idle keep-alive connections to upstream servers that are preserved
in the cache of each nginx worker process. When this number is exceeded, the least recently used
connections are closed.
The keepAlive directive for upstreams defaults to 16. To override this value, set the connections field.
To disable the keepAlive directive, set connections to 0.
Directive: <a href="https://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive">https://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive</a></p>
</td>
</tr>
<tr>
<td>
<code>requests</code><br/>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>Requests sets the maximum number of requests that can be served through one keep-alive connection.
After the maximum number of requests are made, the connection is closed.
Directive: <a href="https://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive_requests">https://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive_requests</a></p>
</td>
</tr>
<tr>
<td>
<code>time</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.Duration">
Duration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Time defines the maximum time during which requests can be processed through one keep-alive connection.
After this time is reached, the connection is closed following the subsequent request processing.
Directive: <a href="https://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive_time">https://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive_time</a></p>
</td>
</tr>
<tr>
<td>
<code>timeout</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.Duration">
Duration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Timeout defines the keep-alive timeout for upstreams.
Directive: <a href="https://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive_timeout">https://nginx.org/en/docs/http/ngx_http_upstream_module.html#keepalive_timeout</a></p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.UpstreamSettingsPolicySpec">UpstreamSettingsPolicySpec
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.UpstreamSettingsPolicySpec" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.UpstreamSettingsPolicy">UpstreamSettingsPolicy</a>)
</p>
<p>
<p>UpstreamSettingsPolicySpec defines the desired state of the UpstreamSettingsPolicy.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>zoneSize</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.Size">
Size
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>ZoneSize is the size of the shared memory zone used by the upstream. This memory zone is used to share
the upstream configuration between nginx worker processes. The more servers that an upstream has,
the larger memory zone is required.
Default: OSS: 512k, Plus: 1m.
Directive: <a href="https://nginx.org/en/docs/http/ngx_http_upstream_module.html#zone">https://nginx.org/en/docs/http/ngx_http_upstream_module.html#zone</a></p>
</td>
</tr>
<tr>
<td>
<code>keepAlive</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.UpstreamKeepAlive">
UpstreamKeepAlive
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>KeepAlive defines the keep-alive settings.</p>
</td>
</tr>
<tr>
<td>
<code>loadBalancingMethod</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.LoadBalancingType">
LoadBalancingType
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>LoadBalancingMethod specifies the load balancing algorithm to be used for the upstream.
If not specified, NGINX Gateway Fabric defaults to <code>random two least_conn</code>,
which differs from the standard NGINX default <code>round-robin</code>.</p>
</td>
</tr>
<tr>
<td>
<code>hashMethodKey</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.HashMethodKey">
HashMethodKey
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>HashMethodKey defines the key used for hash-based load balancing methods.
This field is required when <code>LoadBalancingMethod</code> is set to <code>hash</code> or <code>hash consistent</code>.</p>
</td>
</tr>
<tr>
<td>
<code>targetRefs</code><br/>
<em>
<a href="https://pkg.go.dev/sigs.k8s.io/gateway-api/apis/v1#LocalPolicyTargetReference">
[]sigs.k8s.io/gateway-api/apis/v1.LocalPolicyTargetReference
</a>
</em>
</td>
<td>
<p>TargetRefs identifies API object(s) to apply the policy to.
Objects must be in the same namespace as the policy.
Support: Service</p>
<p>TargetRefs must be <em>distinct</em>. The <code>name</code> field must be unique for all targetRef entries in the UpstreamSettingsPolicy.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.WAFPolicySpec">WAFPolicySpec
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.WAFPolicySpec" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.WAFPolicy">WAFPolicy</a>)
</p>
<p>
<p>WAFPolicySpec defines the desired state of a WAFPolicy.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>targetRefs</code><br/>
<em>
<a href="https://pkg.go.dev/sigs.k8s.io/gateway-api/apis/v1#LocalPolicyTargetReference">
[]sigs.k8s.io/gateway-api/apis/v1.LocalPolicyTargetReference
</a>
</em>
</td>
<td>
<p>TargetRefs identifies API object(s) to apply the policy to.
Objects must be in the same namespace as the policy.
All targets must be of the same Kind (all Gateways OR all HTTPRoutes OR all GRPCRoutes).
Support: Gateway, HTTPRoute, GRPCRoute.</p>
</td>
</tr>
<tr>
<td>
<code>type</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.PolicySourceType">
PolicySourceType
</a>
</em>
</td>
<td>
<p>Type identifies the source type for the policy bundle.
HTTP fetches directly from a URL; NIM uses the NGINX Instance Manager bundles API;
N1C uses the F5 NGINX One Console security policies API.</p>
</td>
</tr>
<tr>
<td>
<code>policySource</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.PolicySource">
PolicySource
</a>
</em>
</td>
<td>
<p>PolicySource holds all policy bundle fetch configuration.</p>
</td>
</tr>
<tr>
<td>
<code>securityLogs</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.WAFSecurityLog">
[]WAFSecurityLog
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>SecurityLogs defines security logging configurations.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha1.WAFSecurityLog">WAFSecurityLog
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha1.WAFSecurityLog" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha1.WAFPolicySpec">WAFPolicySpec</a>)
</p>
<p>
<p>WAFSecurityLog defines security logging configuration for app_protect_security_log directives.
Exactly one of logSource.defaultProfile, logSource.httpSource, logSource.nimSource, or logSource.n1cSource must be set.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>logSource</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.LogSource">
LogSource
</a>
</em>
</td>
<td>
<p>LogSource configures the log profile bundle source for this log entry.
Exactly one of url or defaultProfile must be set.</p>
</td>
</tr>
<tr>
<td>
<code>destination</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.SecurityLogDestination">
SecurityLogDestination
</a>
</em>
</td>
<td>
<p>Destination defines where security logs are sent.</p>
</td>
</tr>
</tbody>
</table>
<hr/>
<h2 id="gateway.nginx.org/v1alpha2">gateway.nginx.org/v1alpha2</h2>
<p>
<p>Package v1alpha2 contains API Schema definitions for the
gateway.nginx.org API group.</p>
</p>
Resource Types:
<ul><li>
<a href="#gateway.nginx.org/v1alpha2.NginxProxy">NginxProxy</a>
</li><li>
<a href="#gateway.nginx.org/v1alpha2.ObservabilityPolicy">ObservabilityPolicy</a>
</li></ul>
<h3 id="gateway.nginx.org/v1alpha2.NginxProxy">NginxProxy
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.NginxProxy" title="Permanent link">¶</a>
</h3>
<p>
<p>NginxProxy is a configuration object that can be referenced from a GatewayClass parametersRef
or a Gateway infrastructure.parametersRef. It provides a way to configure data plane settings.
If referenced from a GatewayClass, the settings apply to all Gateways attached to the GatewayClass.
If referenced from a Gateway, the settings apply to that Gateway alone. If both a Gateway and its GatewayClass
reference an NginxProxy, the settings are merged. Settings specified on the Gateway NginxProxy override those
set on the GatewayClass NginxProxy.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>apiVersion</code><br/>
string</td>
<td>
<code>
gateway.nginx.org/v1alpha2
</code>
</td>
</tr>
<tr>
<td>
<code>kind</code><br/>
string
</td>
<td><code>NginxProxy</code></td>
</tr>
<tr>
<td>
<code>metadata</code><br/>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#objectmeta-v1-meta">
Kubernetes meta/v1.ObjectMeta
</a>
</em>
</td>
<td>
Refer to the Kubernetes API documentation for the fields of the
<code>metadata</code> field.
</td>
</tr>
<tr>
<td>
<code>spec</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.NginxProxySpec">
NginxProxySpec
</a>
</em>
</td>
<td>
<p>Spec defines the desired state of the NginxProxy.</p>
<br/>
<br/>
<table class="table table-bordered table-striped">
<tr>
<td>
<code>ipFamily</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.IPFamilyType">
IPFamilyType
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>IPFamily specifies the IP family to be used by the NGINX.
Default is “dual”, meaning the server will use both IPv4 and IPv6.</p>
</td>
</tr>
<tr>
<td>
<code>telemetry</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.Telemetry">
Telemetry
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Telemetry specifies the OpenTelemetry configuration.</p>
</td>
</tr>
<tr>
<td>
<code>metrics</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.Metrics">
Metrics
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Metrics defines the configuration for Prometheus scraping metrics. Changing this value results in a
re-roll of the NGINX deployment.</p>
</td>
</tr>
<tr>
<td>
<code>rewriteClientIP</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.RewriteClientIP">
RewriteClientIP
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>RewriteClientIP defines configuration for rewriting the client IP to the original client’s IP.</p>
</td>
</tr>
<tr>
<td>
<code>logging</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.NginxLogging">
NginxLogging
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Logging defines logging related settings for NGINX.</p>
</td>
</tr>
<tr>
<td>
<code>nginxPlus</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.NginxPlus">
NginxPlus
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>NginxPlus specifies NGINX Plus additional settings.</p>
</td>
</tr>
<tr>
<td>
<code>disableHTTP2</code><br/>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>DisableHTTP2 defines if http2 should be disabled for all servers.
If not specified, or set to false, http2 will be enabled for all servers.</p>
</td>
</tr>
<tr>
<td>
<code>disableSNIHostValidation</code><br/>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>DisableSNIHostValidation disables the validation that ensures the SNI hostname
matches the Host header in HTTPS requests. When disabled, HTTPS connections can
be reused for requests to different hostnames covered by the same certificate.
This resolves HTTP/2 connection coalescing issues with wildcard certificates but
introduces security risks as described in Gateway API GEP-3567.
If not specified, defaults to false (validation enabled).</p>
</td>
</tr>
<tr>
<td>
<code>kubernetes</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.KubernetesSpec">
KubernetesSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Kubernetes contains the configuration for the NGINX Deployment and Service Kubernetes objects.</p>
</td>
</tr>
<tr>
<td>
<code>workerConnections</code><br/>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>WorkerConnections specifies the maximum number of simultaneous connections that can be opened by a worker process.
Default is 1024.</p>
</td>
</tr>
<tr>
<td>
<code>dnsResolver</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.DNSResolver">
DNSResolver
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>DNSResolver specifies the DNS resolver configuration for external name resolution.
This enables support for routing to ExternalName Services.</p>
</td>
</tr>
<tr>
<td>
<code>serverTokens</code><br/>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>ServerTokens configures whether NGINX emits its version in the “Server”
response header and on error pages.</p>
<p>OSS NGINX accepts:
- “on”: Shows nginx and version (e.g. “nginx/1.25.0”)
- “off”: Shows nginx only (e.g. “nginx”)
- “build”: Shows version and build name (e.g. “nginx/1.25.0 (build-name)”)</p>
<p>NGINX Plus additionally accepts:
- “”: Suppress the “Server” response header entirely
- <custom string>: Set a custom header value and supports variables</p>
<p>See: <a href="https://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens">https://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens</a>
NGINX directive: <a href="https://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens">https://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens</a>
Default is “off”.</p>
</td>
</tr>
<tr>
<td>
<code>waf</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.WAFSpec">
WAFSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>WAF configures NGINX App Protect WAF functionality.</p>
</td>
</tr>
</table>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.ObservabilityPolicy">ObservabilityPolicy
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.ObservabilityPolicy" title="Permanent link">¶</a>
</h3>
<p>
<p>ObservabilityPolicy is a Direct Attached Policy. It provides a way to configure observability settings for
the NGINX Gateway Fabric data plane. Used in conjunction with the NginxProxy CRD that is attached to the
GatewayClass parametersRef.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>apiVersion</code><br/>
string</td>
<td>
<code>
gateway.nginx.org/v1alpha2
</code>
</td>
</tr>
<tr>
<td>
<code>kind</code><br/>
string
</td>
<td><code>ObservabilityPolicy</code></td>
</tr>
<tr>
<td>
<code>metadata</code><br/>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#objectmeta-v1-meta">
Kubernetes meta/v1.ObjectMeta
</a>
</em>
</td>
<td>
Refer to the Kubernetes API documentation for the fields of the
<code>metadata</code> field.
</td>
</tr>
<tr>
<td>
<code>spec</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.ObservabilityPolicySpec">
ObservabilityPolicySpec
</a>
</em>
</td>
<td>
<p>Spec defines the desired state of the ObservabilityPolicy.</p>
<br/>
<br/>
<table class="table table-bordered table-striped">
<tr>
<td>
<code>tracing</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.Tracing">
Tracing
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Tracing allows for enabling and configuring tracing.</p>
</td>
</tr>
<tr>
<td>
<code>targetRefs</code><br/>
<em>
<a href="https://pkg.go.dev/sigs.k8s.io/gateway-api/apis/v1#LocalPolicyTargetReference">
[]sigs.k8s.io/gateway-api/apis/v1.LocalPolicyTargetReference
</a>
</em>
</td>
<td>
<p>TargetRefs identifies the API object(s) to apply the policy to.
Objects must be in the same namespace as the policy.
Support: HTTPRoute, GRPCRoute.</p>
<p>TargetRefs must be <em>distinct</em>. This means that the multi-part key defined by <code>kind</code> and <code>name</code> must
be unique across all targetRef entries in the ObservabilityPolicy.</p>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td>
<code>status</code><br/>
<em>
<a href="https://pkg.go.dev/sigs.k8s.io/gateway-api/apis/v1#PolicyStatus">
sigs.k8s.io/gateway-api/apis/v1.PolicyStatus
</a>
</em>
</td>
<td>
<p>Status defines the state of the ObservabilityPolicy.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.AgentLogLevel">AgentLogLevel
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.AgentLogLevel" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.NginxLogging">NginxLogging</a>)
</p>
<p>
<p>AgentLevel defines the log level of the NGINX agent process.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"debug"</p></td>
<td><p>AgentLogLevelDebug is the debug level NGINX agent logs.</p>
</td>
</tr><tr><td><p>"error"</p></td>
<td><p>AgentLogLevelError is the error level NGINX agent logs.</p>
</td>
</tr><tr><td><p>"fatal"</p></td>
<td><p>AgentLogLevelFatal is the fatal level NGINX agent logs.</p>
</td>
</tr><tr><td><p>"info"</p></td>
<td><p>AgentLogLevelInfo is the info level NGINX agent logs.</p>
</td>
</tr><tr><td><p>"panic"</p></td>
<td><p>AgentLogLevelPanic is the panic level NGINX agent logs.</p>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.AutoscalingSpec">AutoscalingSpec
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.AutoscalingSpec" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.DeploymentSpec">DeploymentSpec</a>)
</p>
<p>
<p>AutoscalingSpec is the configuration for the Horizontal Pod Autoscaling.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>behavior</code><br/>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#horizontalpodautoscalerbehavior-v2-autoscaling">
Kubernetes autoscaling/v2.HorizontalPodAutoscalerBehavior
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Behavior configures the scaling behavior of the target
in both Up and Down directions (scaleUp and scaleDown fields respectively).
If not set, the default HPAScalingRules for scale up and scale down are used.</p>
</td>
</tr>
<tr>
<td>
<code>targetCPUUtilizationPercentage</code><br/>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>Target cpu utilization percentage of HPA.</p>
</td>
</tr>
<tr>
<td>
<code>targetMemoryUtilizationPercentage</code><br/>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>Target memory utilization percentage of HPA.</p>
</td>
</tr>
<tr>
<td>
<code>minReplicas</code><br/>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>Minimum number of replicas.</p>
</td>
</tr>
<tr>
<td>
<code>metrics</code><br/>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#metricspec-v2-autoscaling">
[]Kubernetes autoscaling/v2.MetricSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Metrics configures additional metrics options.</p>
</td>
</tr>
<tr>
<td>
<code>maxReplicas</code><br/>
<em>
int32
</em>
</td>
<td>
<p>Maximum number of replicas.</p>
</td>
</tr>
<tr>
<td>
<code>enable</code><br/>
<em>
bool
</em>
</td>
<td>
<p>Enable or disable Horizontal Pod Autoscaler.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.ContainerSpec">ContainerSpec
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.ContainerSpec" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.DaemonSetSpec">DaemonSetSpec</a>,
<a href="#gateway.nginx.org/v1alpha2.DeploymentSpec">DeploymentSpec</a>)
</p>
<p>
<p>ContainerSpec defines container fields for the NGINX container.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>debug</code><br/>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>Debug enables debugging for NGINX by using the nginx-debug binary.</p>
</td>
</tr>
<tr>
<td>
<code>image</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.Image">
Image
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Image is the NGINX image to use.</p>
</td>
</tr>
<tr>
<td>
<code>resources</code><br/>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#resourcerequirements-v1-core">
Kubernetes core/v1.ResourceRequirements
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Resources describes the compute resource requirements.</p>
</td>
</tr>
<tr>
<td>
<code>lifecycle</code><br/>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#lifecycle-v1-core">
Kubernetes core/v1.Lifecycle
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Lifecycle describes actions that the management system should take in response to container lifecycle
events. For the PostStart and PreStop lifecycle handlers, management of the container blocks
until the action is complete, unless the container process fails, in which case the handler is aborted.</p>
</td>
</tr>
<tr>
<td>
<code>readinessProbe</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.ReadinessProbeSpec">
ReadinessProbeSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>ReadinessProbe defines the readiness probe for the NGINX container.</p>
</td>
</tr>
<tr>
<td>
<code>hostPorts</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.HostPort">
[]HostPort
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>HostPorts are the list of ports to expose on the host.</p>
</td>
</tr>
<tr>
<td>
<code>volumeMounts</code><br/>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#volumemount-v1-core">
[]Kubernetes core/v1.VolumeMount
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>VolumeMounts describe the mounting of Volumes within a container.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.DNSResolver">DNSResolver
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.DNSResolver" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.NginxProxySpec">NginxProxySpec</a>)
</p>
<p>
<p>DNSResolver specifies the DNS resolver configuration for NGINX.
This enables dynamic DNS resolution for ExternalName Services.
Corresponds to the NGINX resolver directive: <a href="https://nginx.org/en/docs/http/ngx_http_core_module.html#resolver">https://nginx.org/en/docs/http/ngx_http_core_module.html#resolver</a></p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>timeout</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.Duration">
Duration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Timeout specifies the timeout for name resolution.</p>
</td>
</tr>
<tr>
<td>
<code>cacheTTL</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.Duration">
Duration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>CacheTTL specifies how long to cache DNS responses.</p>
</td>
</tr>
<tr>
<td>
<code>disableIPv6</code><br/>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>DisableIPv6 disables IPv6 lookups.
If not specified, or set to false, IPv6 lookups will be enabled.</p>
</td>
</tr>
<tr>
<td>
<code>addresses</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.DNSResolverAddress">
[]DNSResolverAddress
</a>
</em>
</td>
<td>
<p>Addresses specifies the list of DNS server addresses.
Each address can be an IP address or hostname.
Example: [{“type”: “IPAddress”, “value”: “8.8.8.8”}, {“type”: “Hostname”, “value”: “dns.google”}]</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.DNSResolverAddress">DNSResolverAddress
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.DNSResolverAddress" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.DNSResolver">DNSResolver</a>)
</p>
<p>
<p>DNSResolverAddress specifies the address type and value for a DNS resolver address.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>type</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.DNSResolverAddressType">
DNSResolverAddressType
</a>
</em>
</td>
<td>
<p>Type specifies the type of address.</p>
</td>
</tr>
<tr>
<td>
<code>value</code><br/>
<em>
string
</em>
</td>
<td>
<p>Value specifies the address value.
When Type is “IPAddress”, this must be a valid IPv4 or IPv6 address.
When Type is “Hostname”, this must be a valid hostname.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.DNSResolverAddressType">DNSResolverAddressType
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.DNSResolverAddressType" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.DNSResolverAddress">DNSResolverAddress</a>)
</p>
<p>
<p>DNSResolverAddressType specifies the type of DNS resolver address.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"Hostname"</p></td>
<td><p>DNSResolverHostnameType specifies that the address is a hostname.</p>
</td>
</tr><tr><td><p>"IPAddress"</p></td>
<td><p>DNSResolverIPAddressType specifies that the address is an IP address.</p>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.DaemonSetSpec">DaemonSetSpec
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.DaemonSetSpec" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.KubernetesSpec">KubernetesSpec</a>)
</p>
<p>
<p>DaemonSet is the configuration for the NGINX DaemonSet.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>container</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.ContainerSpec">
ContainerSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Container defines container fields for the NGINX container.</p>
</td>
</tr>
<tr>
<td>
<code>wafContainers</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.WAFContainerSpec">
WAFContainerSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>WAFContainers defines container specifications for NGINX App Protect WAF v5 containers.
These containers are only deployed when WAF is enabled in the NginxProxy spec.</p>
</td>
</tr>
<tr>
<td>
<code>pod</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.PodSpec">
PodSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Pod defines Pod-specific fields.</p>
</td>
</tr>
<tr>
<td>
<code>patches</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.Patch">
[]Patch
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Patches are custom patches to apply to the NGINX DaemonSet.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.DeploymentSpec">DeploymentSpec
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.DeploymentSpec" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.KubernetesSpec">KubernetesSpec</a>)
</p>
<p>
<p>Deployment is the configuration for the NGINX Deployment.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>replicas</code><br/>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>Number of desired Pods.</p>
</td>
</tr>
<tr>
<td>
<code>autoscaling</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.AutoscalingSpec">
AutoscalingSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Autoscaling defines the configuration for Horizontal Pod Autoscaling.</p>
</td>
</tr>
<tr>
<td>
<code>wafContainers</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.WAFContainerSpec">
WAFContainerSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>WAFContainers defines container specifications for NGINX App Protect WAF v5 containers.
These containers are only deployed when WAF is enabled in the NginxProxy spec.</p>
</td>
</tr>
<tr>
<td>
<code>pod</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.PodSpec">
PodSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Pod defines Pod-specific fields.</p>
</td>
</tr>
<tr>
<td>
<code>container</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.ContainerSpec">
ContainerSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Container defines container fields for the NGINX container.</p>
</td>
</tr>
<tr>
<td>
<code>patches</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.Patch">
[]Patch
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Patches are custom patches to apply to the NGINX Deployment.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.DisableTelemetryFeature">DisableTelemetryFeature
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.DisableTelemetryFeature" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.Telemetry">Telemetry</a>)
</p>
<p>
<p>DisableTelemetryFeature is a telemetry feature that can be disabled.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"DisableTracing"</p></td>
<td><p>DisableTracing disables the OpenTelemetry tracing feature.</p>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.ExternalTrafficPolicy">ExternalTrafficPolicy
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.ExternalTrafficPolicy" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.ServiceSpec">ServiceSpec</a>)
</p>
<p>
<p>ExternalTrafficPolicy describes how nodes distribute service traffic they
receive on one of the Service’s “externally-facing” addresses (NodePorts, ExternalIPs,
and LoadBalancer IPs).</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"Cluster"</p></td>
<td><p>ExternalTrafficPolicyCluster routes traffic to all endpoints.</p>
</td>
</tr><tr><td><p>"Local"</p></td>
<td><p>ExternalTrafficPolicyLocal preserves the source IP of the traffic by
routing only to endpoints on the same node as the traffic was received on
(dropping the traffic if there are no local endpoints).</p>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.HostPort">HostPort
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.HostPort" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.ContainerSpec">ContainerSpec</a>)
</p>
<p>
<p>HostPort exposes an nginx container port on the host.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>port</code><br/>
<em>
int32
</em>
</td>
<td>
<p>Port to expose on the host.</p>
</td>
</tr>
<tr>
<td>
<code>containerPort</code><br/>
<em>
int32
</em>
</td>
<td>
<p>ContainerPort is the port on the nginx container to map to the HostPort.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.IPFamilyType">IPFamilyType
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.IPFamilyType" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.NginxProxySpec">NginxProxySpec</a>)
</p>
<p>
<p>IPFamilyType specifies the IP family to be used by NGINX.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"dual"</p></td>
<td><p>Dual specifies that NGINX will use both IPv4 and IPv6.</p>
</td>
</tr><tr><td><p>"ipv4"</p></td>
<td><p>IPv4 specifies that NGINX will use only IPv4.</p>
</td>
</tr><tr><td><p>"ipv6"</p></td>
<td><p>IPv6 specifies that NGINX will use only IPv6.</p>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.Image">Image
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.Image" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.ContainerSpec">ContainerSpec</a>,
<a href="#gateway.nginx.org/v1alpha2.WAFContainerConfig">WAFContainerConfig</a>)
</p>
<p>
<p>Image is the NGINX image to use.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>repository</code><br/>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>Repository is the image path.
Default is ghcr.io/nginx/nginx-gateway-fabric/nginx.</p>
</td>
</tr>
<tr>
<td>
<code>tag</code><br/>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>Tag is the image tag to use. Default matches the tag of the control plane.</p>
</td>
</tr>
<tr>
<td>
<code>pullPolicy</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.PullPolicy">
PullPolicy
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>PullPolicy describes a policy for if/when to pull a container image.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.KubernetesSpec">KubernetesSpec
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.KubernetesSpec" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.NginxProxySpec">NginxProxySpec</a>)
</p>
<p>
<p>KubernetesSpec contains the configuration for the NGINX Deployment and Service Kubernetes objects.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>deployment</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.DeploymentSpec">
DeploymentSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Deployment is the configuration for the NGINX Deployment.
This is the default deployment option.</p>
</td>
</tr>
<tr>
<td>
<code>daemonSet</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.DaemonSetSpec">
DaemonSetSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>DaemonSet is the configuration for the NGINX DaemonSet.</p>
</td>
</tr>
<tr>
<td>
<code>service</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.ServiceSpec">
ServiceSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Service is the configuration for the NGINX Service.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.Metrics">Metrics
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.Metrics" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.NginxProxySpec">NginxProxySpec</a>)
</p>
<p>
<p>Metrics defines the configuration for Prometheus scraping metrics.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>port</code><br/>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>Port where the Prometheus metrics are exposed.</p>
</td>
</tr>
<tr>
<td>
<code>disable</code><br/>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>Disable serving Prometheus metrics on the listen port.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.NginxAccessLog">NginxAccessLog
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.NginxAccessLog" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.NginxLogging">NginxLogging</a>)
</p>
<p>
<p>NginxAccessLog defines the configuration for an NGINX access log.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>disable</code><br/>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>Disable turns off access logging when set to true.</p>
</td>
</tr>
<tr>
<td>
<code>format</code><br/>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>Format specifies the custom log format string.
If not specified, NGINX default ‘combined’ format is used.
For now only path /dev/stdout can be used.
See <a href="https://nginx.org/en/docs/http/ngx_http_log_module.html#log_format">https://nginx.org/en/docs/http/ngx_http_log_module.html#log_format</a></p>
</td>
</tr>
<tr>
<td>
<code>escape</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.NginxAccessLogEscapeType">
NginxAccessLogEscapeType
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Escape specifies how to escape characters in variables for access log.
Possible values are: default, json, none.
If not specified, ‘default’ escaping is used.
See <a href="https://nginx.org/en/docs/http/ngx_http_log_module.html#log_format">https://nginx.org/en/docs/http/ngx_http_log_module.html#log_format</a></p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.NginxAccessLogEscapeType">NginxAccessLogEscapeType
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.NginxAccessLogEscapeType" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.NginxAccessLog">NginxAccessLog</a>)
</p>
<p>
<p>NginxAccessLogEscapeType defines the escape setting for variables in access log format.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"default"</p></td>
<td><p>NginxAccessLogEscapeDefault specifies that characters ‘\“’, ‘\’, and other characters with values less
than 32 or above 126 are escaped as ‘\xXX’.</p>
</td>
</tr><tr><td><p>"json"</p></td>
<td><p>NginxAccessLogEscapeJSON specifies that all characters not allowed in JSON strings are escaped.
Characters ‘\“’ and ‘\’ are escaped as ‘\”’ and ‘\’, characters with values less than 32 are
escaped as ‘\n’, ‘\r’, ‘\t’, ‘\b’, ‘\f’, or ‘\u00XX’.</p>
</td>
</tr><tr><td><p>"none"</p></td>
<td><p>NginxAccessLogEscapeNone disables escaping of characters.</p>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.NginxErrorLogLevel">NginxErrorLogLevel
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.NginxErrorLogLevel" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.NginxLogging">NginxLogging</a>)
</p>
<p>
<p>NginxErrorLogLevel type defines the log level of error logs for NGINX.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"alert"</p></td>
<td><p>NginxLogLevelAlert is the alert level for NGINX error logs.</p>
</td>
</tr><tr><td><p>"crit"</p></td>
<td><p>NginxLogLevelCrit is the crit level for NGINX error logs.</p>
</td>
</tr><tr><td><p>"debug"</p></td>
<td><p>NginxLogLevelDebug is the debug level for NGINX error logs.</p>
</td>
</tr><tr><td><p>"emerg"</p></td>
<td><p>NginxLogLevelEmerg is the emerg level for NGINX error logs.</p>
</td>
</tr><tr><td><p>"error"</p></td>
<td><p>NginxLogLevelError is the error level for NGINX error logs.</p>
</td>
</tr><tr><td><p>"info"</p></td>
<td><p>NginxLogLevelInfo is the info level for NGINX error logs.</p>
</td>
</tr><tr><td><p>"notice"</p></td>
<td><p>NginxLogLevelNotice is the notice level for NGINX error logs.</p>
</td>
</tr><tr><td><p>"warn"</p></td>
<td><p>NginxLogLevelWarn is the warn level for NGINX error logs.</p>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.NginxLogging">NginxLogging
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.NginxLogging" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.NginxProxySpec">NginxProxySpec</a>)
</p>
<p>
<p>NginxLogging defines logging related settings for NGINX.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>errorLevel</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.NginxErrorLogLevel">
NginxErrorLogLevel
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>ErrorLevel defines the error log level. Possible log levels listed in order of increasing severity are
debug, info, notice, warn, error, crit, alert, and emerg. Setting a certain log level will cause all messages
of the specified and more severe log levels to be logged. For example, the log level ‘error’ will cause error,
crit, alert, and emerg messages to be logged. <a href="https://nginx.org/en/docs/ngx_core_module.html#error_log">https://nginx.org/en/docs/ngx_core_module.html#error_log</a></p>
</td>
</tr>
<tr>
<td>
<code>agentLevel</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.AgentLogLevel">
AgentLogLevel
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>AgentLevel defines the log level of the NGINX agent process. Changing this value results in a
re-roll of the NGINX deployment.</p>
</td>
</tr>
<tr>
<td>
<code>accessLog</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.NginxAccessLog">
NginxAccessLog
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>AccessLog defines the access log settings, including format itself and disabling option.
For now only path /dev/stdout can be used.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.NginxPlus">NginxPlus
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.NginxPlus" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.NginxProxySpec">NginxProxySpec</a>)
</p>
<p>
<p>NginxPlus specifies NGINX Plus additional settings. These will only be applied if NGINX Plus is being used.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>allowedAddresses</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.NginxPlusAllowAddress">
[]NginxPlusAllowAddress
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>AllowedAddresses specifies IPAddresses or CIDR blocks to the allow list for accessing the NGINX Plus API.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.NginxPlusAllowAddress">NginxPlusAllowAddress
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.NginxPlusAllowAddress" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.NginxPlus">NginxPlus</a>)
</p>
<p>
<p>NginxPlusAllowAddress specifies the address type and value for an NginxPlus allow address.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>type</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.NginxPlusAllowAddressType">
NginxPlusAllowAddressType
</a>
</em>
</td>
<td>
<p>Type specifies the type of address.</p>
</td>
</tr>
<tr>
<td>
<code>value</code><br/>
<em>
string
</em>
</td>
<td>
<p>Value specifies the address value.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.NginxPlusAllowAddressType">NginxPlusAllowAddressType
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.NginxPlusAllowAddressType" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.NginxPlusAllowAddress">NginxPlusAllowAddress</a>)
</p>
<p>
<p>NginxPlusAllowAddressType specifies the type of address.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"CIDR"</p></td>
<td><p>NginxPlusAllowCIDRAddressType specifies that the address is a CIDR block.</p>
</td>
</tr><tr><td><p>"IPAddress"</p></td>
<td><p>NginxPlusAllowIPAddressType specifies that the address is an IP address.</p>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.NginxProxySpec">NginxProxySpec
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.NginxProxySpec" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.NginxProxy">NginxProxy</a>)
</p>
<p>
<p>NginxProxySpec defines the desired state of the NginxProxy.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>ipFamily</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.IPFamilyType">
IPFamilyType
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>IPFamily specifies the IP family to be used by the NGINX.
Default is “dual”, meaning the server will use both IPv4 and IPv6.</p>
</td>
</tr>
<tr>
<td>
<code>telemetry</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.Telemetry">
Telemetry
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Telemetry specifies the OpenTelemetry configuration.</p>
</td>
</tr>
<tr>
<td>
<code>metrics</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.Metrics">
Metrics
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Metrics defines the configuration for Prometheus scraping metrics. Changing this value results in a
re-roll of the NGINX deployment.</p>
</td>
</tr>
<tr>
<td>
<code>rewriteClientIP</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.RewriteClientIP">
RewriteClientIP
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>RewriteClientIP defines configuration for rewriting the client IP to the original client’s IP.</p>
</td>
</tr>
<tr>
<td>
<code>logging</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.NginxLogging">
NginxLogging
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Logging defines logging related settings for NGINX.</p>
</td>
</tr>
<tr>
<td>
<code>nginxPlus</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.NginxPlus">
NginxPlus
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>NginxPlus specifies NGINX Plus additional settings.</p>
</td>
</tr>
<tr>
<td>
<code>disableHTTP2</code><br/>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>DisableHTTP2 defines if http2 should be disabled for all servers.
If not specified, or set to false, http2 will be enabled for all servers.</p>
</td>
</tr>
<tr>
<td>
<code>disableSNIHostValidation</code><br/>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>DisableSNIHostValidation disables the validation that ensures the SNI hostname
matches the Host header in HTTPS requests. When disabled, HTTPS connections can
be reused for requests to different hostnames covered by the same certificate.
This resolves HTTP/2 connection coalescing issues with wildcard certificates but
introduces security risks as described in Gateway API GEP-3567.
If not specified, defaults to false (validation enabled).</p>
</td>
</tr>
<tr>
<td>
<code>kubernetes</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.KubernetesSpec">
KubernetesSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Kubernetes contains the configuration for the NGINX Deployment and Service Kubernetes objects.</p>
</td>
</tr>
<tr>
<td>
<code>workerConnections</code><br/>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>WorkerConnections specifies the maximum number of simultaneous connections that can be opened by a worker process.
Default is 1024.</p>
</td>
</tr>
<tr>
<td>
<code>dnsResolver</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.DNSResolver">
DNSResolver
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>DNSResolver specifies the DNS resolver configuration for external name resolution.
This enables support for routing to ExternalName Services.</p>
</td>
</tr>
<tr>
<td>
<code>serverTokens</code><br/>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>ServerTokens configures whether NGINX emits its version in the “Server”
response header and on error pages.</p>
<p>OSS NGINX accepts:
- “on”: Shows nginx and version (e.g. “nginx/1.25.0”)
- “off”: Shows nginx only (e.g. “nginx”)
- “build”: Shows version and build name (e.g. “nginx/1.25.0 (build-name)”)</p>
<p>NGINX Plus additionally accepts:
- “”: Suppress the “Server” response header entirely
- <custom string>: Set a custom header value and supports variables</p>
<p>See: <a href="https://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens">https://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens</a>
NGINX directive: <a href="https://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens">https://nginx.org/en/docs/http/ngx_http_core_module.html#server_tokens</a>
Default is “off”.</p>
</td>
</tr>
<tr>
<td>
<code>waf</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.WAFSpec">
WAFSpec
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>WAF configures NGINX App Protect WAF functionality.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.NodePort">NodePort
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.NodePort" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.ServiceSpec">ServiceSpec</a>)
</p>
<p>
<p>NodePort creates a port on each node on which the NGINX data plane service is exposed. The NodePort MUST
map to a Gateway listener port, otherwise it will be ignored. If not specified, Kubernetes allocates a NodePort
automatically if required. The default NodePort range enforced by Kubernetes is 30000-32767.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>port</code><br/>
<em>
int32
</em>
</td>
<td>
<p>Port is the NodePort to expose.</p>
</td>
</tr>
<tr>
<td>
<code>listenerPort</code><br/>
<em>
int32
</em>
</td>
<td>
<p>ListenerPort is the Gateway listener port that this NodePort maps to.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.ObservabilityPolicySpec">ObservabilityPolicySpec
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.ObservabilityPolicySpec" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.ObservabilityPolicy">ObservabilityPolicy</a>)
</p>
<p>
<p>ObservabilityPolicySpec defines the desired state of the ObservabilityPolicy.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>tracing</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.Tracing">
Tracing
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Tracing allows for enabling and configuring tracing.</p>
</td>
</tr>
<tr>
<td>
<code>targetRefs</code><br/>
<em>
<a href="https://pkg.go.dev/sigs.k8s.io/gateway-api/apis/v1#LocalPolicyTargetReference">
[]sigs.k8s.io/gateway-api/apis/v1.LocalPolicyTargetReference
</a>
</em>
</td>
<td>
<p>TargetRefs identifies the API object(s) to apply the policy to.
Objects must be in the same namespace as the policy.
Support: HTTPRoute, GRPCRoute.</p>
<p>TargetRefs must be <em>distinct</em>. This means that the multi-part key defined by <code>kind</code> and <code>name</code> must
be unique across all targetRef entries in the ObservabilityPolicy.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.Patch">Patch
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.Patch" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.DaemonSetSpec">DaemonSetSpec</a>,
<a href="#gateway.nginx.org/v1alpha2.DeploymentSpec">DeploymentSpec</a>,
<a href="#gateway.nginx.org/v1alpha2.ServiceSpec">ServiceSpec</a>)
</p>
<p>
<p>Patch defines a patch to apply to a Kubernetes object.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>type</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.PatchType">
PatchType
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Type is the type of patch. Defaults to StrategicMerge.</p>
</td>
</tr>
<tr>
<td>
<code>value</code><br/>
<em>
k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1.JSON
</em>
</td>
<td>
<em>(Optional)</em>
<p>Value is the patch data as raw JSON.
For StrategicMerge and Merge patches, this should be a JSON object.
For JSONPatch patches, this should be a JSON array of patch operations.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.PatchType">PatchType
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.PatchType" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.Patch">Patch</a>)
</p>
<p>
<p>PatchType specifies the type of patch.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"JSONPatch"</p></td>
<td><p>PatchTypeJSONPatch uses JSON patch (RFC 6902).</p>
</td>
</tr><tr><td><p>"Merge"</p></td>
<td><p>PatchTypeMerge uses merge patch (RFC 7386).</p>
</td>
</tr><tr><td><p>"StrategicMerge"</p></td>
<td><p>PatchTypeStrategicMerge uses strategic merge patch.</p>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.PodSpec">PodSpec
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.PodSpec" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.DaemonSetSpec">DaemonSetSpec</a>,
<a href="#gateway.nginx.org/v1alpha2.DeploymentSpec">DeploymentSpec</a>)
</p>
<p>
<p>PodSpec defines Pod-specific fields.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>terminationGracePeriodSeconds</code><br/>
<em>
int64
</em>
</td>
<td>
<em>(Optional)</em>
<p>TerminationGracePeriodSeconds is the optional duration in seconds the pod needs to terminate gracefully.
Value must be non-negative integer. The value zero indicates stop immediately via
the kill signal (no opportunity to shut down).
If this value is nil, the default grace period will be used instead.
The grace period is the duration in seconds after the processes running in the pod are sent
a termination signal and the time when the processes are forcibly halted with a kill signal.
Set this value longer than the expected cleanup time for your process.
Defaults to 30 seconds.</p>
</td>
</tr>
<tr>
<td>
<code>affinity</code><br/>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#affinity-v1-core">
Kubernetes core/v1.Affinity
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Affinity is the pod’s scheduling constraints.</p>
</td>
</tr>
<tr>
<td>
<code>nodeSelector</code><br/>
<em>
map[string]string
</em>
</td>
<td>
<em>(Optional)</em>
<p>NodeSelector is a selector which must be true for the pod to fit on a node.
Selector which must match a node’s labels for the pod to be scheduled on that node.</p>
</td>
</tr>
<tr>
<td>
<code>tolerations</code><br/>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#toleration-v1-core">
[]Kubernetes core/v1.Toleration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Tolerations allow the scheduler to schedule Pods with matching taints.</p>
</td>
</tr>
<tr>
<td>
<code>volumes</code><br/>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#volume-v1-core">
[]Kubernetes core/v1.Volume
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Volumes represents named volumes in a pod that may be accessed by any container in the pod.</p>
</td>
</tr>
<tr>
<td>
<code>topologySpreadConstraints</code><br/>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#topologyspreadconstraint-v1-core">
[]Kubernetes core/v1.TopologySpreadConstraint
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>TopologySpreadConstraints describes how a group of Pods ought to spread across topology
domains. Scheduler will schedule Pods in a way which abides by the constraints.
All topologySpreadConstraints are ANDed.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.PullPolicy">PullPolicy
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.PullPolicy" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.Image">Image</a>)
</p>
<p>
<p>PullPolicy describes a policy for if/when to pull a container image.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"Always"</p></td>
<td><p>PullAlways means that kubelet always attempts to pull the latest image. Container will fail if the pull fails.</p>
</td>
</tr><tr><td><p>"IfNotPresent"</p></td>
<td><p>PullIfNotPresent means that kubelet pulls if the image isn’t present on disk. Container will fail if the image
isn’t present and the pull fails.</p>
</td>
</tr><tr><td><p>"Never"</p></td>
<td><p>PullNever means that kubelet never pulls an image, but only uses a local image. Container will fail if the
image isn’t present.</p>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.ReadinessProbeSpec">ReadinessProbeSpec
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.ReadinessProbeSpec" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.ContainerSpec">ContainerSpec</a>)
</p>
<p>
<p>ReadinessProbeSpec defines the configuration for the NGINX readiness probe.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>port</code><br/>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>Port is the port on which the readiness endpoint is exposed.
If not specified, the default port is 8081.</p>
</td>
</tr>
<tr>
<td>
<code>path</code><br/>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>Path is the path on which the readiness endpoint is exposed.
If not specified, the default path is /readyz.
Must start with a forward slash and contain only valid URL path characters.</p>
</td>
</tr>
<tr>
<td>
<code>initialDelaySeconds</code><br/>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>InitialDelaySeconds is the number of seconds after the container has
started before the readiness probe is initiated.
If not specified, the default is 3 seconds.</p>
</td>
</tr>
<tr>
<td>
<code>expose</code><br/>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>Expose toggles whether the endpoint should be exposed through
the Gateway Service object. This allows an external LoadBalancer
to perform healthchecks. Default is false.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.RewriteClientIP">RewriteClientIP
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.RewriteClientIP" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.NginxProxySpec">NginxProxySpec</a>)
</p>
<p>
<p>RewriteClientIP specifies the configuration for rewriting the client’s IP address.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>mode</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.RewriteClientIPModeType">
RewriteClientIPModeType
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Mode defines how NGINX will rewrite the client’s IP address.
There are two possible modes:
- ProxyProtocol: NGINX will rewrite the client’s IP using the PROXY protocol header.
- XForwardedFor: NGINX will rewrite the client’s IP using the X-Forwarded-For header.
Sets NGINX directive real_ip_header: <a href="https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header">https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header</a></p>
</td>
</tr>
<tr>
<td>
<code>setIPRecursively</code><br/>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>SetIPRecursively configures whether recursive search is used when selecting the client’s address from
the X-Forwarded-For header. It is used in conjunction with TrustedAddresses.
If enabled, NGINX will recurse on the values in X-Forwarded-Header from the end of array
to start of array and select the first untrusted IP.
For example, if X-Forwarded-For is [11.11.11.11, 22.22.22.22, 55.55.55.1],
and TrustedAddresses is set to 55.55.55.<sup>1</sup>⁄<sub>32</sub>, NGINX will rewrite the client IP to 22.22.22.22.
If disabled, NGINX will select the IP at the end of the array.
In the previous example, 55.55.55.1 would be selected.
Sets NGINX directive real_ip_recursive: <a href="https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_recursive">https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_recursive</a></p>
</td>
</tr>
<tr>
<td>
<code>trustedAddresses</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.RewriteClientIPAddress">
[]RewriteClientIPAddress
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>TrustedAddresses specifies the addresses that are trusted to send correct client IP information.
If a request comes from a trusted address, NGINX will rewrite the client IP information,
and forward it to the backend in the X-Forwarded-For* and X-Real-IP headers.
If the request does not come from a trusted address, NGINX will not rewrite the client IP information.
To trust all addresses (not recommended for production), set to 0.0.0.0/0.
If no addresses are provided, NGINX will not rewrite the client IP information.
Sets NGINX directive set_real_ip_from: <a href="https://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from">https://nginx.org/en/docs/http/ngx_http_realip_module.html#set_real_ip_from</a>
This field is required if mode is set.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.RewriteClientIPAddress">RewriteClientIPAddress
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.RewriteClientIPAddress" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.RewriteClientIP">RewriteClientIP</a>)
</p>
<p>
<p>RewriteClientIPAddress specifies the address type and value for a RewriteClientIP address.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>type</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.RewriteClientIPAddressType">
RewriteClientIPAddressType
</a>
</em>
</td>
<td>
<p>Type specifies the type of address.</p>
</td>
</tr>
<tr>
<td>
<code>value</code><br/>
<em>
string
</em>
</td>
<td>
<p>Value specifies the address value.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.RewriteClientIPAddressType">RewriteClientIPAddressType
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.RewriteClientIPAddressType" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.RewriteClientIPAddress">RewriteClientIPAddress</a>)
</p>
<p>
<p>RewriteClientIPAddressType specifies the type of address.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"CIDR"</p></td>
<td><p>RewriteClientIPCIDRAddressType specifies that the address is a CIDR block.</p>
</td>
</tr><tr><td><p>"Hostname"</p></td>
<td><p>RewriteClientIPHostnameAddressType specifies that the address is a Hostname.</p>
</td>
</tr><tr><td><p>"IPAddress"</p></td>
<td><p>RewriteClientIPIPAddressType specifies that the address is an IP address.</p>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.RewriteClientIPModeType">RewriteClientIPModeType
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.RewriteClientIPModeType" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.RewriteClientIP">RewriteClientIP</a>)
</p>
<p>
<p>RewriteClientIPModeType defines how NGINX Gateway Fabric will determine the client’s original IP address.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"ProxyProtocol"</p></td>
<td><p>RewriteClientIPModeProxyProtocol configures NGINX to accept PROXY protocol and
set the client’s IP address to the IP address in the PROXY protocol header.
Sets the proxy_protocol parameter on the listen directive of all servers and sets real_ip_header
to proxy_protocol: <a href="https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header">https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header</a>.</p>
</td>
</tr><tr><td><p>"XForwardedFor"</p></td>
<td><p>RewriteClientIPModeXForwardedFor configures NGINX to set the client’s IP address to the
IP address in the X-Forwarded-For HTTP header.
<a href="https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header">https://nginx.org/en/docs/http/ngx_http_realip_module.html#real_ip_header</a>.</p>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.ServiceSpec">ServiceSpec
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.ServiceSpec" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.KubernetesSpec">KubernetesSpec</a>)
</p>
<p>
<p>ServiceSpec is the configuration for the NGINX Service.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>type</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.ServiceType">
ServiceType
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>ServiceType describes ingress method for the Service.</p>
</td>
</tr>
<tr>
<td>
<code>externalTrafficPolicy</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.ExternalTrafficPolicy">
ExternalTrafficPolicy
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>ExternalTrafficPolicy describes how nodes distribute service traffic they
receive on one of the Service’s “externally-facing” addresses (NodePorts, ExternalIPs,
and LoadBalancer IPs).</p>
</td>
</tr>
<tr>
<td>
<code>loadBalancerIP</code><br/>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>LoadBalancerIP is a static IP address for the load balancer. Requires service type to be LoadBalancer.</p>
</td>
</tr>
<tr>
<td>
<code>loadBalancerClass</code><br/>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>LoadBalancerClass is the class of the load balancer implementation this Service belongs to.
Requires service type to be LoadBalancer.</p>
</td>
</tr>
<tr>
<td>
<code>loadBalancerSourceRanges</code><br/>
<em>
[]string
</em>
</td>
<td>
<em>(Optional)</em>
<p>LoadBalancerSourceRanges are the IP ranges (CIDR) that are allowed to access the load balancer.
Requires service type to be LoadBalancer.</p>
</td>
</tr>
<tr>
<td>
<code>nodePorts</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.NodePort">
[]NodePort
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>NodePorts are the list of NodePorts to expose on the NGINX data plane service.
Each NodePort MUST map to a Gateway listener port, otherwise it will be ignored.
The default NodePort range enforced by Kubernetes is 30000-32767.</p>
</td>
</tr>
<tr>
<td>
<code>patches</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.Patch">
[]Patch
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Patches are custom patches to apply to the NGINX Service.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.ServiceType">ServiceType
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.ServiceType" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.ServiceSpec">ServiceSpec</a>)
</p>
<p>
<p>ServiceType describes ingress method for the Service.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"ClusterIP"</p></td>
<td><p>ServiceTypeClusterIP means a Service will only be accessible inside the
cluster, via the cluster IP.</p>
</td>
</tr><tr><td><p>"LoadBalancer"</p></td>
<td><p>ServiceTypeLoadBalancer means a Service will be exposed via an
external load balancer (if the cloud provider supports it), in addition
to ‘NodePort’ type.</p>
</td>
</tr><tr><td><p>"NodePort"</p></td>
<td><p>ServiceTypeNodePort means a Service will be exposed on one port of
every node, in addition to ‘ClusterIP’ type.</p>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.Telemetry">Telemetry
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.Telemetry" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.NginxProxySpec">NginxProxySpec</a>)
</p>
<p>
<p>Telemetry specifies the OpenTelemetry configuration.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>disabledFeatures</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.DisableTelemetryFeature">
[]DisableTelemetryFeature
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>DisabledFeatures specifies OpenTelemetry features to be disabled.</p>
</td>
</tr>
<tr>
<td>
<code>exporter</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.TelemetryExporter">
TelemetryExporter
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Exporter specifies OpenTelemetry export parameters.</p>
</td>
</tr>
<tr>
<td>
<code>serviceName</code><br/>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>ServiceName is the “service.name” attribute of the OpenTelemetry resource.
Default is ‘ngf:<gateway-namespace>:<gateway-name>’. If a value is provided by the user,
then the default becomes a prefix to that value.</p>
</td>
</tr>
<tr>
<td>
<code>spanAttributes</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.SpanAttribute">
[]SpanAttribute
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>SpanAttributes are custom key/value attributes that are added to each span.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.TelemetryExporter">TelemetryExporter
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.TelemetryExporter" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.Telemetry">Telemetry</a>)
</p>
<p>
<p>TelemetryExporter specifies OpenTelemetry export parameters.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>interval</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.Duration">
Duration
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Interval is the maximum interval between two exports.
Default: <a href="https://nginx.org/en/docs/ngx_otel_module.html#otel_exporter">https://nginx.org/en/docs/ngx_otel_module.html#otel_exporter</a></p>
</td>
</tr>
<tr>
<td>
<code>batchSize</code><br/>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>BatchSize is the maximum number of spans to be sent in one batch per worker.
Default: <a href="https://nginx.org/en/docs/ngx_otel_module.html#otel_exporter">https://nginx.org/en/docs/ngx_otel_module.html#otel_exporter</a></p>
</td>
</tr>
<tr>
<td>
<code>batchCount</code><br/>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>BatchCount is the number of pending batches per worker, spans exceeding the limit are dropped.
Default: <a href="https://nginx.org/en/docs/ngx_otel_module.html#otel_exporter">https://nginx.org/en/docs/ngx_otel_module.html#otel_exporter</a></p>
</td>
</tr>
<tr>
<td>
<code>endpoint</code><br/>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>Endpoint is the address of OTLP/gRPC endpoint that will accept telemetry data.
Format: alphanumeric hostname with optional http scheme and optional port.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.TraceContext">TraceContext
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.TraceContext" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.Tracing">Tracing</a>)
</p>
<p>
<p>TraceContext specifies how to propagate traceparent/tracestate headers.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"extract"</p></td>
<td><p>TraceContextExtract uses an existing trace context from the request, so that the identifiers
of a trace and the parent span are inherited from the incoming request.</p>
</td>
</tr><tr><td><p>"ignore"</p></td>
<td><p>TraceContextIgnore skips context headers processing.</p>
</td>
</tr><tr><td><p>"inject"</p></td>
<td><p>TraceContextInject adds a new context to the request, overwriting existing headers, if any.</p>
</td>
</tr><tr><td><p>"propagate"</p></td>
<td><p>TraceContextPropagate updates the existing context (combines extract and inject).</p>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.TraceStrategy">TraceStrategy
(<code>string</code> alias)</p><a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.TraceStrategy" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.Tracing">Tracing</a>)
</p>
<p>
<p>TraceStrategy defines the tracing strategy.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Value</th>
<th>Description</th>
</tr>
</thead>
<tbody><tr><td><p>"parent"</p></td>
<td><p>TraceStrategyParent enables tracing and only records spans if the parent span was sampled.</p>
</td>
</tr><tr><td><p>"ratio"</p></td>
<td><p>TraceStrategyRatio enables ratio-based tracing, defaulting to 100% sampling rate.</p>
</td>
</tr></tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.Tracing">Tracing
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.Tracing" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.ObservabilityPolicySpec">ObservabilityPolicySpec</a>)
</p>
<p>
<p>Tracing allows for enabling and configuring OpenTelemetry tracing.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>strategy</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.TraceStrategy">
TraceStrategy
</a>
</em>
</td>
<td>
<p>Strategy defines if tracing is ratio-based or parent-based.</p>
</td>
</tr>
<tr>
<td>
<code>ratio</code><br/>
<em>
int32
</em>
</td>
<td>
<em>(Optional)</em>
<p>Ratio is the percentage of traffic that should be sampled. Integer from 0 to 100.
By default, 100% of http requests are traced. Not applicable for parent-based tracing.
If ratio is set to 0, tracing is disabled.</p>
</td>
</tr>
<tr>
<td>
<code>context</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.TraceContext">
TraceContext
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Context specifies how to propagate traceparent/tracestate headers.
Default: <a href="https://nginx.org/en/docs/ngx_otel_module.html#otel_trace_context">https://nginx.org/en/docs/ngx_otel_module.html#otel_trace_context</a></p>
</td>
</tr>
<tr>
<td>
<code>spanName</code><br/>
<em>
string
</em>
</td>
<td>
<em>(Optional)</em>
<p>SpanName defines the name of the Otel span. By default is the name of the location for a request.
If specified, applies to all locations that are created for a route.
Format: must have all ‘“’ escaped and must not contain any ‘$’ or end with an unescaped ‘\’
Examples of invalid names: some-$value, quoted-“value”-name, unescaped</p>
</td>
</tr>
<tr>
<td>
<code>spanAttributes</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha1.SpanAttribute">
[]SpanAttribute
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>SpanAttributes are custom key/value attributes that are added to each span.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.WAFContainerConfig">WAFContainerConfig
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.WAFContainerConfig" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.WAFContainerSpec">WAFContainerSpec</a>)
</p>
<p>
<p>WAFContainerConfig defines the configuration for a single WAF container.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>image</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.Image">
Image
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Image is the container image to use for this WAF container.</p>
</td>
</tr>
<tr>
<td>
<code>resources</code><br/>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#resourcerequirements-v1-core">
Kubernetes core/v1.ResourceRequirements
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Resources describes the compute resource requirements for this WAF container.</p>
</td>
</tr>
<tr>
<td>
<code>volumeMounts</code><br/>
<em>
<a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#volumemount-v1-core">
[]Kubernetes core/v1.VolumeMount
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>VolumeMounts describe the mounting of Volumes within the WAF container.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.WAFContainerSpec">WAFContainerSpec
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.WAFContainerSpec" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.DaemonSetSpec">DaemonSetSpec</a>,
<a href="#gateway.nginx.org/v1alpha2.DeploymentSpec">DeploymentSpec</a>)
</p>
<p>
<p>WAFContainerSpec defines the container specifications for NGINX App Protect WAF v5.
NAP v5 requires two additional containers: waf-enforcer and waf-config-mgr.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>enforcer</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.WAFContainerConfig">
WAFContainerConfig
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>Enforcer defines the configuration for the WAF enforcer container.
This container performs the actual WAF enforcement and policy application.</p>
</td>
</tr>
<tr>
<td>
<code>configManager</code><br/>
<em>
<a href="#gateway.nginx.org/v1alpha2.WAFContainerConfig">
WAFContainerConfig
</a>
</em>
</td>
<td>
<em>(Optional)</em>
<p>ConfigManager defines the configuration for the WAF configuration manager container.
This container manages policy configuration and communication with the enforcer.</p>
</td>
</tr>
</tbody>
</table>
<h3 id="gateway.nginx.org/v1alpha2.WAFSpec">WAFSpec
<a class="headerlink" href="#gateway.nginx.org%2fv1alpha2.WAFSpec" title="Permanent link">¶</a>
</h3>
<p>
(<em>Appears on: </em>
<a href="#gateway.nginx.org/v1alpha2.NginxProxySpec">NginxProxySpec</a>)
</p>
<p>
<p>WAFSpec configures NGINX App Protect WAF.</p>
</p>
<table class="table table-bordered table-striped">
<thead>
<tr>
<th>Field</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>
<code>enable</code><br/>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>Enable enables NGINX App Protect WAF functionality.
When enabled, NGINX Gateway Fabric will deploy additional WAF containers
(waf-enforcer and waf-config-mgr) alongside the main NGINX container.
Default is false.</p>
</td>
</tr>
<tr>
<td>
<code>disableCookieSeed</code><br/>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>DisableCookieSeed disables the app_protect_cookie_seed directive.
By default, NGF sets this directive to a stable value derived from the Gateway UID,
ensuring WAF session cookies are consistent across multiple NGINX replicas.
Set this to true if you have pre-compiled the cookie seed into your WAF policy bundles
via the compiler global settings, to avoid conflicting with the compiled-in value.
Default is false.</p>
</td>
</tr>
<tr>
<td>
<code>bundleFailOpen</code><br/>
<em>
bool
</em>
</td>
<td>
<em>(Optional)</em>
<p>BundleFailOpen controls the behavior when a WAF policy bundle (policy or log profile)
has not yet been successfully fetched. When set to true, NGINX configuration is pushed
and traffic is served without WAF protection until the bundle becomes available. When
false (the default), the configuration push is withheld until the bundle is fetched,
maintaining a fail-closed posture.</p>
</td>
</tr>
</tbody>
</table>
<hr/>
<p><em>
Generated with <code>gen-crd-api-reference-docs</code>
</em></p>