GCPAuthzPolicy
networking.gke.io / v1
apiVersion: networking.gke.io/v1
kind: GCPAuthzPolicy
metadata:
name: example
apiVersion
string
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
kind
string
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
metadata
object
spec object required
Spec defines the implementation of this definition.
action
string
The action to take if the request is matched with the rules. Default is ALLOW if not specified.
customProviders object
CustomProviders defines the extension providers for authorization policy.
extensionRefs []object required
ExtensionRefs identifies a list of Authz Extensions.
Limited to 2 ExtensionRefs.
minItems:
1maxItems:
2
group
string required
Group is the group of the referent. For example, "gateway.networking.k8s.io".
When unspecified or empty string, core API group is inferred.
pattern:
^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$maxLength:
253
kind
string required
Kind is kind of the referent. For example "HTTPRoute" or "Service".
pattern:
^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$minLength:
1maxLength:
63
name
string required
Name is the name of the referent.
minLength:
1maxLength:
253
enforcementLevel
string required
Type specifies the type of the authorization policy.
enum:
L7, L4
policyProfile
string
PolicyProfile defines the type of authorization being performed.
Defaults to REQUEST_AUTHZ if not specified. This field is immutable.
enum:
REQUEST_AUTHZ, CONTENT_AUTHZrules []object
A list of rules to match the request.
maxItems:
10from object
From specifies the source of a request.
If not set, any source is allowed.
notSources []object
NotSources specifies the not sources of a request.
maxItems:
5principals []object
Principals includes the list of peer identities derived from the peer certificate.
The peer identity is in the format of `"<TRUST_DOMAIN>/ns/<NAMESPACE>/sa/<SERVICE_ACCOUNT>"`,
for example, `"{projectid}.svc.id.goog/ns/foo/sa/productpage"`.
This field requires mTLS enabled.
maxItems:
10principal object required
Principal is a non-empty string whose value is matched against the
principal value based on the principal_selector. Only exact match can
be applied for CLIENT_CERT_URI_SAN, CLIENT_CERT_DNS_NAME_SAN,
CLIENT_CERT_COMMON_NAME selectors.
ignoreCase
boolean
IgnoreCase is true then the matching should be case insensitive.
type
string required
Type is the type of the string match criteria.
enum:
Exact, Prefix, Suffix, Contains
value
string required
Value is the match.
principalSelector
string
PrincipalSelector is an enum to decide what principal value the principal rule
will match against. If not specified, the PrincipalSelector is
CLIENT_CERT_URI_SAN.
One of CLIENT_CERT_URI_SAN, CLIENT_CERT_DNS_NAME_SAN, or CLIENT_CERT_COMMON_NAME.
enum:
CLIENT_CERT_URI_SAN, CLIENT_CERT_DNS_NAME_SAN, CLIENT_CERT_COMMON_NAMEresources []object
Resources describes the properties of a client VM
resource accessing the internal application load balancers.
maxItems:
10iamServiceAccount object
IAMServiceAccount to match against the GCP IAM service account
associated with the source VM of a request.
ignoreCase
boolean
IgnoreCase is true then the matching should be case insensitive.
type
string required
Type is the type of the string match criteria.
enum:
Exact, Prefix, Suffix, Contains
value
string required
Value is the match.
tagValueIdSet
[]integer
TagValueIDSet is a list of resource tag value permanent IDs to match against
the resource manager tag values associated with the source VM of a request.
All IDs must match.
minItems:
1maxItems:
10sources []object
Sources specifies the source of a request.
maxItems:
5principals []object
Principals includes the list of peer identities derived from the peer certificate.
The peer identity is in the format of `"<TRUST_DOMAIN>/ns/<NAMESPACE>/sa/<SERVICE_ACCOUNT>"`,
for example, `"{projectid}.svc.id.goog/ns/foo/sa/productpage"`.
This field requires mTLS enabled.
maxItems:
10principal object required
Principal is a non-empty string whose value is matched against the
principal value based on the principal_selector. Only exact match can
be applied for CLIENT_CERT_URI_SAN, CLIENT_CERT_DNS_NAME_SAN,
CLIENT_CERT_COMMON_NAME selectors.
ignoreCase
boolean
IgnoreCase is true then the matching should be case insensitive.
type
string required
Type is the type of the string match criteria.
enum:
Exact, Prefix, Suffix, Contains
value
string required
Value is the match.
principalSelector
string
PrincipalSelector is an enum to decide what principal value the principal rule
will match against. If not specified, the PrincipalSelector is
CLIENT_CERT_URI_SAN.
One of CLIENT_CERT_URI_SAN, CLIENT_CERT_DNS_NAME_SAN, or CLIENT_CERT_COMMON_NAME.
enum:
CLIENT_CERT_URI_SAN, CLIENT_CERT_DNS_NAME_SAN, CLIENT_CERT_COMMON_NAMEresources []object
Resources describes the properties of a client VM
resource accessing the internal application load balancers.
maxItems:
10iamServiceAccount object
IAMServiceAccount to match against the GCP IAM service account
associated with the source VM of a request.
ignoreCase
boolean
IgnoreCase is true then the matching should be case insensitive.
type
string required
Type is the type of the string match criteria.
enum:
Exact, Prefix, Suffix, Contains
value
string required
Value is the match.
tagValueIdSet
[]integer
TagValueIDSet is a list of resource tag value permanent IDs to match against
the resource manager tag values associated with the source VM of a request.
All IDs must match.
minItems:
1maxItems:
10to object
To specifies the operations of a request.
If not set, any operation is allowed.
notOperations []object
NotOperations specifies the not operation of a request.
maxItems:
5headers []object
Headers defines a set of headers to match against for a given request.
All headers in the set must match. Limited to 10 matches.
maxItems:
10
ignoreCase
boolean
IgnoreCase is true then the matching should be case insensitive.
name
string required
Name is the name of the header.
pattern:
^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$minLength:
1maxLength:
256
type
string required
Type specifies how to match against the value of the header.
enum:
Exact, Prefix, Suffix, Contains
value
string required
Value is the value of the header.
maxLength:
256hosts []object
Hosts is a list of HTTP Hosts to match against.
Limited to 10 matches.
maxItems:
10
ignoreCase
boolean
IgnoreCase is true then the matching should be case insensitive.
type
string required
Type is the type of the string match criteria.
enum:
Exact, Prefix, Suffix, Contains
value
string required
Value is the match.
mcp object
MCP defines MCP-specific matching criteria.
This field is only applicable for policies targeting Agent Gateways.
If omitted, the policy does not check MCP-level parameters, allowing all MCP traffic that
successfully passes through the matched HTTP routing envelope.
baseProtocolMethodsOption
string
BaseProtocolMethodsOption determines if lifecycle methods (ping, initialize) are matched.
Defaults to SKIP_BASE_PROTOCOL_METHODS.
enum:
SKIP_BASE_PROTOCOL_METHODS, MATCH_BASE_PROTOCOL_METHODSmethods []object
Methods is a list of specific MCP functional methods to match.
If specified, only MCP requests with a method
that matches one of these items will be authorized.
If empty or omitted, no method-level allowlisting is applied, meaning all
MCP methods (e.g., all tools, prompts, and resources) are permitted.
maxItems:
10
name
string required
Name is the MCP method to match against (e.g., 'tools/call').
Allowed values:
1. 'tools', 'prompts', 'resources': Matches all sub-methods under these categories.
2. 'prompts/list', 'tools/list', 'resources/list', 'resources/templates/list'.
3. 'prompts/get', 'tools/call', 'resources/subscribe', 'resources/unsubscribe', 'resources/read'.
Parameters cannot be specified for categories 1 and 2.
enum:
tools, prompts, resources, prompts/list, tools/list, resources/list, resources/templates/list, prompts/get, tools/call, resources/subscribe, resources/unsubscribe, resources/readparams []object
Params allows matching against specific arguments in the MCP request.
Only valid for 'get', 'call', 'subscribe', 'unsubscribe', and 'read' methods.
If empty or omitted, parameter-level allowlisting is not applied, meaning the method
is authorized regardless of the arguments passed in the request.
maxItems:
10
ignoreCase
boolean
IgnoreCase is true then the matching should be case insensitive.
type
string required
Type is the type of the string match criteria.
enum:
Exact, Prefix, Suffix, Contains
value
string required
Value is the match.
methods
[]string
Methods is a list of HTTP methods to match against.
Each entry must be a valid HTTP method name (GET, PUT, POST, HEAD, PATCH, DELETE, OPTIONS, CONNECT, TRACE).
Limited to 9 matches.
maxItems:
9paths []object
Paths is a list of paths to match against.
Limited to 10 matches.
maxItems:
10
ignoreCase
boolean
IgnoreCase is true then the matching should be case insensitive.
type
string required
Type is the type of the string match criteria.
enum:
Exact, Prefix, Suffix, Contains
value
string required
Value is the match.
ports []object
Ports is a list of ports to match against.
Limited to 10 matches.
maxItems:
10
ignoreCase
boolean
IgnoreCase is true then the matching should be case insensitive.
type
string required
Type is the type of the string match criteria.
enum:
Exact, Prefix, Suffix, Contains
value
string required
Value is the match.
operations []object
Operation specifies the operation of a request.
maxItems:
5headers []object
Headers defines a set of headers to match against for a given request.
All headers in the set must match. Limited to 10 matches.
maxItems:
10
ignoreCase
boolean
IgnoreCase is true then the matching should be case insensitive.
name
string required
Name is the name of the header.
pattern:
^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$minLength:
1maxLength:
256
type
string required
Type specifies how to match against the value of the header.
enum:
Exact, Prefix, Suffix, Contains
value
string required
Value is the value of the header.
maxLength:
256hosts []object
Hosts is a list of HTTP Hosts to match against.
Limited to 10 matches.
maxItems:
10
ignoreCase
boolean
IgnoreCase is true then the matching should be case insensitive.
type
string required
Type is the type of the string match criteria.
enum:
Exact, Prefix, Suffix, Contains
value
string required
Value is the match.
mcp object
MCP defines MCP-specific matching criteria.
This field is only applicable for policies targeting Agent Gateways.
If omitted, the policy does not check MCP-level parameters, allowing all MCP traffic that
successfully passes through the matched HTTP routing envelope.
baseProtocolMethodsOption
string
BaseProtocolMethodsOption determines if lifecycle methods (ping, initialize) are matched.
Defaults to SKIP_BASE_PROTOCOL_METHODS.
enum:
SKIP_BASE_PROTOCOL_METHODS, MATCH_BASE_PROTOCOL_METHODSmethods []object
Methods is a list of specific MCP functional methods to match.
If specified, only MCP requests with a method
that matches one of these items will be authorized.
If empty or omitted, no method-level allowlisting is applied, meaning all
MCP methods (e.g., all tools, prompts, and resources) are permitted.
maxItems:
10
name
string required
Name is the MCP method to match against (e.g., 'tools/call').
Allowed values:
1. 'tools', 'prompts', 'resources': Matches all sub-methods under these categories.
2. 'prompts/list', 'tools/list', 'resources/list', 'resources/templates/list'.
3. 'prompts/get', 'tools/call', 'resources/subscribe', 'resources/unsubscribe', 'resources/read'.
Parameters cannot be specified for categories 1 and 2.
enum:
tools, prompts, resources, prompts/list, tools/list, resources/list, resources/templates/list, prompts/get, tools/call, resources/subscribe, resources/unsubscribe, resources/readparams []object
Params allows matching against specific arguments in the MCP request.
Only valid for 'get', 'call', 'subscribe', 'unsubscribe', and 'read' methods.
If empty or omitted, parameter-level allowlisting is not applied, meaning the method
is authorized regardless of the arguments passed in the request.
maxItems:
10
ignoreCase
boolean
IgnoreCase is true then the matching should be case insensitive.
type
string required
Type is the type of the string match criteria.
enum:
Exact, Prefix, Suffix, Contains
value
string required
Value is the match.
methods
[]string
Methods is a list of HTTP methods to match against.
Each entry must be a valid HTTP method name (GET, PUT, POST, HEAD, PATCH, DELETE, OPTIONS, CONNECT, TRACE).
Limited to 9 matches.
maxItems:
9paths []object
Paths is a list of paths to match against.
Limited to 10 matches.
maxItems:
10
ignoreCase
boolean
IgnoreCase is true then the matching should be case insensitive.
type
string required
Type is the type of the string match criteria.
enum:
Exact, Prefix, Suffix, Contains
value
string required
Value is the match.
ports []object
Ports is a list of ports to match against.
Limited to 10 matches.
maxItems:
10
ignoreCase
boolean
IgnoreCase is true then the matching should be case insensitive.
type
string required
Type is the type of the string match criteria.
enum:
Exact, Prefix, Suffix, Contains
value
string required
Value is the match.
when
string
when specifies a list of additional conditions of a request.
If not set, any condition is allowed.
It is supported via CEL expression.
minLength:
1maxLength:
512targetRefs []object
TargetRefs identifies a list of API objects to apply policy to.
Limited to 10 TargetRef, can not be empty.
minItems:
1maxItems:
10
group
string required
Group is the group of the referent. For example, "gateway.networking.k8s.io".
When unspecified or empty string, core API group is inferred.
pattern:
^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$maxLength:
253
kind
string required
Kind is kind of the referent. For example "Gateway" or "Pod".
pattern:
^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$minLength:
1maxLength:
63
name
string
Name is the name of the referent.
minLength:
1maxLength:
253selector object
Selector is the label selector of target objects of the specified kind.
matchLabels
object
MatchLabels is a map of {key, value} pairs which defines the pod labels to match.
status object
Status defines the current state of GCPAuthzPolicy.
ancestors []object required
Ancestors is a list of ancestor resources (usually Gateways) that are
associated with the policy, and the status of the policy with respect to
each ancestor. When this policy attaches to a parent, the controller that
manages the parent and the ancestors MUST add an entry to this list when
the controller first sees the policy and SHOULD update the entry as
appropriate when the relevant ancestor is modified.
Note that choosing the relevant ancestor is left to the Policy designers;
an important part of Policy design is designing the right object level at
which to namespace this status.
Note also that implementations MUST ONLY populate ancestor status for
the Ancestor resources they are responsible for. Implementations MUST
use the ControllerName field to uniquely identify the entries in this list
that they are responsible for.
Note that to achieve this, the list of PolicyAncestorStatus structs
MUST be treated as a map with a composite key, made up of the AncestorRef
and ControllerName fields combined.
A maximum of 16 ancestors will be represented in this list. An empty list
means the Policy is not relevant for any ancestors.
If this slice is full, implementations MUST NOT add further entries.
Instead they MUST consider the policy unimplementable and signal that
on any related resources such as the ancestor that would be referenced
here. For example, if this list was full on BackendTLSPolicy, no
additional Gateways would be able to reference the Service targeted by
the BackendTLSPolicy.
maxItems:
16ancestorRef object required
AncestorRef corresponds with a ParentRef in the spec that this
PolicyAncestorStatus struct describes the status of.
group
string
Group is the group of the referent.
When unspecified, "gateway.networking.k8s.io" is inferred.
To set the core API group (such as for a "Service" kind referent),
Group must be explicitly set to "" (empty string).
Support: Core
pattern:
^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$maxLength:
253
kind
string
Kind is kind of the referent.
There are two kinds of parent resources with "Core" support:
* Gateway (Gateway conformance profile)
* Service (Mesh conformance profile, ClusterIP Services only)
Support for other resources is Implementation-Specific.
pattern:
^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$minLength:
1maxLength:
63
name
string required
Name is the name of the referent.
Support: Core
minLength:
1maxLength:
253
namespace
string
Namespace is the namespace of the referent. When unspecified, this refers
to the local namespace of the Route.
Note that there are specific rules for ParentRefs which cross namespace
boundaries. Cross-namespace references are only valid if they are explicitly
allowed by something in the namespace they are referring to. For example:
Gateway has the AllowedRoutes field, and ReferenceGrant provides a
generic way to enable any other kind of cross-namespace reference.
<gateway:experimental:description>
ParentRefs from a Route to a Service in the same namespace are "producer"
routes, which apply default routing rules to inbound connections from
any namespace to the Service.
ParentRefs from a Route to a Service in a different namespace are
"consumer" routes, and these routing rules are only applied to outbound
connections originating from the same namespace as the Route, for which
the intended destination of the connections are a Service targeted as a
ParentRef of the Route.
</gateway:experimental:description>
Support: Core
pattern:
^[a-z0-9]([-a-z0-9]*[a-z0-9])?$minLength:
1maxLength:
63
port
integer
Port is the network port this Route targets. It can be interpreted
differently based on the type of parent resource.
When the parent resource is a Gateway, this targets all listeners
listening on the specified port that also support this kind of Route(and
select this Route). It's not recommended to set `Port` unless the
networking behaviors specified in a Route must apply to a specific port
as opposed to a listener(s) whose port(s) may be changed. When both Port
and SectionName are specified, the name and port of the selected listener
must match both specified values.
<gateway:experimental:description>
When the parent resource is a Service, this targets a specific port in the
Service spec. When both Port (experimental) and SectionName are specified,
the name and port of the selected port must match both specified values.
</gateway:experimental:description>
Implementations MAY choose to support other parent resources.
Implementations supporting other types of parent resources MUST clearly
document how/if Port is interpreted.
For the purpose of status, an attachment is considered successful as
long as the parent resource accepts it partially. For example, Gateway
listeners can restrict which Routes can attach to them by Route kind,
namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
from the referencing Route, the Route MUST be considered successfully
attached. If no Gateway listeners accept attachment from this Route,
the Route MUST be considered detached from the Gateway.
Support: Extended
format:
int32minimum:
1maximum:
65535
sectionName
string
SectionName is the name of a section within the target resource. In the
following resources, SectionName is interpreted as the following:
* Gateway: Listener name. When both Port (experimental) and SectionName
are specified, the name and port of the selected listener must match
both specified values.
* Service: Port name. When both Port (experimental) and SectionName
are specified, the name and port of the selected listener must match
both specified values.
Implementations MAY choose to support attaching Routes to other resources.
If that is the case, they MUST clearly document how SectionName is
interpreted.
When unspecified (empty string), this will reference the entire resource.
For the purpose of status, an attachment is considered successful if at
least one section in the parent resource accepts it. For example, Gateway
listeners can restrict which Routes can attach to them by Route kind,
namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
the referencing Route, the Route MUST be considered successfully
attached. If no Gateway listeners accept attachment from this Route, the
Route MUST be considered detached from the Gateway.
Support: Core
pattern:
^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$minLength:
1maxLength:
253conditions []object required
Conditions describes the status of the Policy with respect to the given Ancestor.
<gateway:util:excludeFromCRD>
Notes for implementors:
Conditions are a listType `map`, which means that they function like a
map with a key of the `type` field _in the k8s apiserver_.
This means that implementations must obey some rules when updating this
section.
* Implementations MUST perform a read-modify-write cycle on this field
before modifying it. That is, when modifying this field, implementations
must be confident they have fetched the most recent version of this field,
and ensure that changes they make are on that recent version.
* Implementations MUST NOT remove or reorder Conditions that they are not
directly responsible for. For example, if an implementation sees a Condition
with type `special.io/SomeField`, it MUST NOT remove, change or update that
Condition.
* Implementations MUST always _merge_ changes into Conditions of the same Type,
rather than creating more than one Condition of the same Type.
* Implementations MUST always update the `observedGeneration` field of the
Condition to the `metadata.generation` of the Gateway at the time of update creation.
* If the `observedGeneration` of a Condition is _greater than_ the value the
implementation knows about, then it MUST NOT perform the update on that Condition,
but must wait for a future reconciliation and status update. (The assumption is that
the implementation's copy of the object is stale and an update will be re-triggered
if relevant.)
</gateway:util:excludeFromCRD>
minItems:
1maxItems:
8
lastTransitionTime
string required
lastTransitionTime is the last time the condition transitioned from one status to another.
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
format:
date-time
message
string required
message is a human readable message indicating details about the transition.
This may be an empty string.
maxLength:
32768
observedGeneration
integer
observedGeneration represents the .metadata.generation that the condition was set based upon.
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
with respect to the current state of the instance.
format:
int64minimum:
0
reason
string required
reason contains a programmatic identifier indicating the reason for the condition's last transition.
Producers of specific condition types may define expected values and meanings for this field,
and whether the values are considered a guaranteed API.
The value should be a CamelCase string.
This field may not be empty.
pattern:
^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$minLength:
1maxLength:
1024
status
string required
status of the condition, one of True, False, Unknown.
enum:
True, False, Unknown
type
string required
type of condition in CamelCase or in foo.example.com/CamelCase.
pattern:
^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$maxLength:
316
controllerName
string required
ControllerName is a domain/path string that indicates the name of the
controller that wrote this status. This corresponds with the
controllerName field on GatewayClass.
Example: "example.net/gateway-controller".
The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
valid Kubernetes names
(https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
Controllers MUST populate this field when writing status. Controllers should ensure that
entries to status populated with their ControllerName are cleaned up when they are no
longer necessary.
pattern:
^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$minLength:
1maxLength:
253No matches. Try .spec.action for an exact path