Gateway API Resources

Nantian Gateway implements the Kubernetes Gateway API v1.5.1 specification and declares support for 55 features. This page lists all supported resource types, core fields, and feature coverage.

Resource Inventory

Resource	API Version	Purpose
`GatewayClass`	`gateway.networking.k8s.io/v1`	Defines the gateway implementation type, claimed by the control plane
`Gateway`	`gateway.networking.k8s.io/v1`	Defines listeners, configures ports, protocols, and TLS
`HTTPRoute`	`gateway.networking.k8s.io/v1`	HTTP and HTTPS traffic routing
`GRPCRoute`	`gateway.networking.k8s.io/v1`	gRPC traffic routing with method-level matching
`TCPRoute`	`gateway.networking.k8s.io/v1alpha2`	TCP traffic routing
`UDPRoute`	`gateway.networking.k8s.io/v1alpha2`	UDP traffic routing
`TLSRoute`	`gateway.networking.k8s.io/v1alpha2`	TLS passthrough routing
`BackendTLSPolicy`	`gateway.networking.k8s.io/v1alpha3`	Backend TLS verification policy
`ReferenceGrant`	`gateway.networking.k8s.io/v1beta1`	Cross-namespace reference authorization

GatewayClass

GatewayClass is a cluster-scoped resource that defines the gateway implementation type. The Nantian Gateway control plane watches for and claims GatewayClasses whose spec.controllerName is gateway.networking.k8s.io/nantian-gw.

apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: nantian-gw
spec:
  controllerName: gateway.networking.k8s.io/nantian-gw

Once a GatewayClass is claimed by the control plane, status.conditions will show Accepted=True, indicating the GatewayClass is ready and Gateway resources referencing it can be processed.

Gateway

Gateway defines a set of listeners, each specifying a port, protocol, and optional TLS configuration. Route resources bind to specific Gateway instances and listeners through the parentRefs field.

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: example-gateway
  namespace: default
spec:
  gatewayClassName: nantian-gw
  listeners:
    - name: http
      protocol: HTTP
      port: 80
      allowedRoutes:
        namespaces:
          from: Same
    - name: https
      protocol: HTTPS
      port: 443
      hostname: "*.example.com"
      tls:
        mode: Terminate
        certificateRefs:
          - name: example-tls
      allowedRoutes:
        namespaces:
          from: All

Supported Listener Protocols

Protocol	Description
`HTTP`	HTTP/1.1 and HTTP/2 (h2c)
`HTTPS`	TLS termination + HTTP/1.1 and HTTP/2
`TLS`	TLS passthrough mode
`TCP`	TCP stream proxy
`UDP`	UDP stream proxy

Supported TLS Modes

Mode	Description
`Terminate`	Terminate TLS at the gateway layer, using keys from certificate references
`Passthrough`	Pass TLS traffic through to the backend without decryption at the gateway

HTTPRoute

HTTPRoute is the most frequently used route resource, handling routing decisions for HTTP and HTTPS traffic.

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: example-route
  namespace: default
spec:
  parentRefs:
    - name: example-gateway
  hostnames:
    - "api.example.com"
  rules:
    - matches:
        - path:
            type: PathPrefix
            value: /v1
          headers:
            - name: x-version
              value: v2
          method: GET
      filters:
        - type: RequestHeaderModifier
          requestHeaderModifier:
            add:
              - name: x-gateway
                value: nantian-gw
        - type: URLRewrite
          urlRewrite:
            hostname: internal.example.com
            path:
              type: ReplacePrefixMatch
              replacePrefixMatch: /api
      backendRefs:
        - name: backend-v1
          port: 8080
          weight: 80
        - name: backend-v2
          port: 8080
          weight: 20
      timeouts:
        request: 30s
        backendRequest: 10s

Supported Route Matches

Match Type	Description
`path`	Path matching, supports `Exact`, `PathPrefix`, `RegularExpression`
`headers`	Request header matching, supports `Exact`, `RegularExpression`
`queryParams`	Query parameter matching, supports `Exact`, `RegularExpression`
`method`	HTTP method matching (GET, POST, PUT, DELETE, etc.)

Supported Filters

Filter	Description
`RequestHeaderModifier`	Modify request headers (add, set, remove)
`ResponseHeaderModifier`	Modify response headers (add, set, remove)
`URLRewrite`	URL rewriting, supports hostname and path rewriting
`RequestRedirect`	Request redirection, supports 301, 302, 303, 307, 308 status codes
`RequestMirror`	Request mirroring, copies a percentage of requests to other backends
`ExtensionRef`	Custom extension filter, can reference Wasm plugins, etc.

Supported Backend Protocols

Protocol	Description
`HTTP/1.1`	Standard HTTP
`HTTP/2` (h2c)	Cleartext HTTP/2
`gRPC`	gRPC over HTTP/2
`WebSocket`	WebSocket upgrade

GRPCRoute

GRPCRoute provides precise routing for gRPC traffic, supporting service name and method name matching.

apiVersion: gateway.networking.k8s.io/v1
kind: GRPCRoute
metadata:
  name: grpc-example
  namespace: default
spec:
  parentRefs:
    - name: example-gateway
  hostnames:
    - "grpc.example.com"
  rules:
    - matches:
        - method:
            service: "example.v1.UserService"
            method: "GetUser"
      backendRefs:
        - name: user-service
          port: 50051
    - matches:
        - method:
            service: "example.v1.OrderService"
      backendRefs:
        - name: order-service
          port: 50051

Supported gRPC Matches

Match Type	Description
`service`	Exact match on gRPC service name
`method`	Exact match on gRPC method name
`headers`	Request header matching (gRPC metadata)

TCPRoute and UDPRoute

TCPRoute and UDPRoute handle non-HTTP stream traffic. Matching rules are based on port number.

apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TCPRoute
metadata:
  name: tcp-example
  namespace: default
spec:
  parentRefs:
    - name: example-gateway
  rules:
    - backendRefs:
        - name: tcp-backend
          port: 9090

apiVersion: gateway.networking.k8s.io/v1alpha2
kind: UDPRoute
metadata:
  name: udp-example
  namespace: default
spec:
  parentRefs:
    - name: example-gateway
  rules:
    - backendRefs:
        - name: udp-backend
          port: 5353

TLSRoute

TLSRoute handles TLS passthrough traffic, routing based on SNI hostname.

apiVersion: gateway.networking.k8s.io/v1alpha2
kind: TLSRoute
metadata:
  name: tls-example
  namespace: default
spec:
  parentRefs:
    - name: example-gateway
  hostnames:
    - "tls.example.com"
  rules:
    - backendRefs:
        - name: tls-backend
          port: 9443

BackendTLSPolicy

BackendTLSPolicy defines the TLS connection policy from the gateway to backend services, including certificate verification, SAN validation, and TLS version constraints.

apiVersion: gateway.networking.k8s.io/v1alpha3
kind: BackendTLSPolicy
metadata:
  name: backend-tls
  namespace: default
spec:
  targetRefs:
    - group: ""
      kind: Service
      name: secure-backend
  validation:
    hostname: secure-backend.example.com
    caCertificateRefs:
      - name: backend-ca
        group: ""
        kind: ConfigMap
    wellKnownCACertificates: "System"

Feature Support Matrix

Nantian Gateway declares support for 55 features in the Gateway API v1.5.1 specification. Key features are listed below by category:

Core Features

Feature	Status
GatewayClass	Supported
Gateway	Supported
HTTPRoute	Supported
ReferenceGrant	Supported

Extended Features

Feature	Status
HTTPRouteQueryParamMatch	Supported
HTTPRouteMethodMatch	Supported
HTTPRouteRequestMirror	Supported
HTTPRouteRequestTimeout	Supported
HTTPRouteBackendTimeout	Supported
HTTPRouteParentRefPort	Supported
HTTPRouteHostRewrite	Supported
HTTPRoutePathRewrite	Supported
HTTPRouteRequestRedirect	Supported
HTTPRouteResponseHeaderModification	Supported
HTTPRouteBackendProtocolH2C	Supported
HTTPRouteBackendProtocolWebSocket	Supported
GRPCRoute	Supported
GRPCRouteMethodMatch	Supported
TCPRoute	Supported
UDPRoute	Supported
TLSRoute	Supported
GatewayPort8080	Supported
GatewayStaticAddresses	Supported
BackendTLSPolicy	Supported
GatewayInfrastructurePropagation	Supported

Mesh Features

Feature	Status
MeshRoute	Supported
MeshConsumerRoute	Supported
MeshClusterIPMatching	Supported

Next Steps

See Custom CRDs for Nantian Gateway’s extension resources
See Quick Start to deploy your first gateway
See First Route to create your first routing rule