Project: Gloo (Orchestration & Management / API Gateway)
File: gateway.proto.sk.md

title: "gateway.proto" weight: 5 <!-- Code generated by solo-kit. DO NOT EDIT. --> Top-Level Resource A Gateway describes a single Listener (bind address:port) and the routing configuration to upstreams that are reachable via a specific port on the Gateway Proxy itself. ```yaml "ssl": bool "bindAddress": string "bindPort": int "options": .gloo.solo.io.ListenerOptions "namespacedStatuses": .core.solo.io.NamespacedStatuses "metadata": .core.solo.io.Metadata "useProxyProto": .google.protobuf.BoolValue "httpGateway": .gateway.solo.io.HttpGateway "tcpGateway": .gateway.solo.io.TcpGateway "hybridGateway": .gateway.solo.io.HybridGateway "proxyNames": []string "routeOptions": .gloo.solo.io.RouteConfigurationOptions ``` | Field | Type | Description | | -- | - | -- | | `ssl` | `bool` | if set to false, only use virtual services without ssl configured. if set to true, only use virtual services with ssl configured. this field is ignored if GatewayType is HybridGateway. | | `bindAddress` | `string` | the bind address the gateway should serve traffic on. | | `bindPort` | `int` | bind ports must not conflict across gateways for a single proxy. | | `options` | | top level optional configuration for all routes on the gateway. | | `namespacedStatuses` | | NamespacedStatuses indicates the validation status of this resource. NamespacedStatuses is read-only by clients, and set by gateway during validation. | | `metadata` | | Metadata contains the object metadata for this resource. | | `useProxyProto` | | Enable ProxyProtocol support for this listener. Deprecated: prefer setting the listener option. If configured, the listener option (filter config) overrides any setting here. | | `httpGateway` | | Only one of `httpGateway`, `tcpGateway`, or `hybridGateway` can be set. | | `tcpGateway` | | Only one of `tcpGateway`, `httpGateway`, or `hybridGateway` can be set. | | `hybridGateway` | | Only one of `hybridGateway`, `httpGateway`, or `tcpGateway` can be set. | | `proxyNames` | ` resources to generate from this gateway. If other gateways exist which point to the same proxy, Gloo will join them together. Proxies have a one-to-many relationship with Envoy bootstrap configuration. In order to connect to Gloo, the Envoy bootstrap configuration sets a `role` in the Envoy instances announce their `role` to Gloo, which maps to the `{{ .Namespace }}~{{ .Name }}` of the Proxy resource. The template for this value can be seen in the Note: this field also accepts fields written in camel-case. They will be converted to kebab-case in the Proxy name. This allows use of the for this field Defaults to `["gateway-proxy"]`. | | `routeOptions` | | Route configuration options that live under Envoy's . | ```yaml "tcpHosts": []gloo.solo.io.TcpHost "options": .gloo.solo.io.TcpListenerOptions ``` | Field | Type | Description | | -- | - | -- | | `tcpHosts` | | TCP hosts that the gateway can route to. | | `options` | | TCP Gateway configuration. | ```yaml "matchedGateways": []gateway.solo.io.MatchedGateway "delegatedHttpGateways": .gateway.solo.io.DelegatedHttpGateway "delegatedTcpGateways": .gateway.solo.io.DelegatedTcpGateway ``` | Field | Type | Description | | -- | - | -- | | `matchedGateways` | | MatchedGateways can be used to define both HttpGateways and TcpGateways directly on the Gateway resource. If `MatchedGateways` is provided, then `DelegatedHttpGateways` and `DelegatedTcpGateways` are ignored. | | `delegatedHttpGateways` | | DelegatedHttpGateways can be used to configure multiple HttpGateways using the MatchableHttpGateway CR and select them on this Gateway using a resourceRef or label selection. If `MatchedGateways` is provided, then `DelegatedHttpGateways` is ignored. | | `delegatedTcpGateways` | | DelegatedTcpGateways can be used to configure multiple TcpGateways using the MatchableTcpGateway CR and select them on this Gateway using a resourceRef or label selection. If `MatchedGateways` is provided, then `DelegatedTcpGateways` is ignored. | ```yaml "ref": .core.solo.io.ResourceRef "selector": .selectors.core.gloo.solo.io.Selector "preventChildOverrides": bool "httpConnectionManagerSettings": .hcm.options.gloo.solo.io.HttpConnectionManagerSettings "sslConfig":

``` | Field | Type | Description | | -- | - | -- | | `ref` | | Delegate to the resource with the given `name` and `namespace. Only one of `ref` or `selector` can be set. | | `selector` | | Delegate to the MatchableHttpGateways that match the given selector. Only one of `selector` or `ref` can be set. | | `preventChildOverrides` | `bool` | Used as a meta modifier to the `httpconnectionmanagersettings` and `sslconfig` fields in a DelegatedHttpGateway. When set, provided ancestor config cannot be overriden by matched HttpGateways. Useful in a multi-team context, where a controlling team managing a primary Gateway file may want to lock down specific functionality from other teams. For example: (DelegatedHttpGateway, MatchableHttpGateway) = {"a": "a1", "b": "b1"}, {"b": "b2", "c": "c2"} When true: getconfig(MatchableHttpGateway) --> {"a": "a1", "b": "b1", "c": "c2"} When false: getconfig(MatchableHttpGateway) --> {"a": "a1", "b": "b2", "c": "c2"}. | | `httpConnectionManagerSettings` | | Anscestry-level HTTP Gateway configuration. Options specified here will be passed down to each `MatchableHttpGateway` that is matched via `selector` or `ref`. Ultimately, said options will be consumed by instances of `MatchableHttpGateway.http_gateway`. | | `sslConfig` | | Anscestry-level TLS/SSL traffic configuration. Options specified here will be passed down to each `MatchableHttpGateway` that is matched via `selector` or `ref`. From there, they are passed to all VirtualServices associated with said `MatchableHttpGateway`s. | ```yaml "ref": .core.solo.io.ResourceRef "selector": .selectors.core.gloo.solo.io.Selector ``` | Field | Type | Description | | -- | - | -- | | `ref` | | Delegate to the resource with the given `name` and `namespace. Only one of `ref` or `selector` can be set. | | `selector` | | Delegate to the MatchableTcpGateways that match the given selector. Only one of `selector` or `ref` can be set. | ```yaml "matcher": .gateway.solo.io.Matcher "httpGateway": .gateway.solo.io.HttpGateway "tcpGateway": .gateway.solo.io.TcpGateway ``` | Field | Type | Description | | -- | - | -- | | `matcher` | | Matchers are used to define unique matching criteria for each MatchedGateway Each MatchedGateway within a HybridGateway must have a unique Matcher If multiple matchers in a HybridGateway are identical, the HybridGateway will not be accepted Empty Matchers are effectively catch-alls, and there can be no more than one empty Matcher per HybridGateway. | | `httpGateway` | | Only one of `httpGateway` or `tcpGateway` can be set. | | `tcpGateway` | | Only one of `tcpGateway` or `httpGateway` can be set. | ```yaml "sslConfig": .gloo.solo.io.SslConfig "sourcePrefixRanges": []solo.io.envoy.config.core.v3.CidrRange "passthroughCipherSuites": []string ``` | Field | Type | Description | | -- | - | -- | | `sslConfig` | | Gloo use SNI domains as matching criteria for Gateway selection The other ssl_config properties will be applied to the outputFilterChain's transport socket SslConfig from VirtualServices will be ignored in a MatchedGateway. | | `sourcePrefixRanges` | | CidrRange specifies an IP Address and a prefix length to construct the subnet mask for a CIDR range. See https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/address.proto#envoy-v3-api-msg-config-core-v3-cidrrange. | | `passthroughCipherSuites` | `[]string` | Enterprise-only: Passthrough cipher suites is an allow-list of OpenSSL cipher suite names for which TLS passthrough will be enabled. If a client does not support any ciphers that are natively supported by Envoy, but does support one of the ciphers in the passthrough list, then traffic will be routed via TCP Proxy to a destination specified by the TcpGateway, where TLS can then be terminated. This field is only applicable to TcpGateways. | <!-- Start of HubSpot Embed Code --> <script type="text/javascript" id="hs-script-loader" async defer src="//js.hs-scripts.com/5130874.js"></script> <!-- End of HubSpot Embed Code -->