RoutePolicy

apiVersion: gwin.yandex.cloud/v1
kind: RoutePolicy
metadata:
  name: example-route-policy
  namespace: example-ns
spec:
  # Target Route resources
  targetRefs:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      name: example-http-route
    - group: gateway.networking.k8s.io
      kind: GRPCRoute
      name: example-grpc-route
  # Or use label selector
  selector:
    matchLabels:
      app: my-routes
    matchExpressions:
      - key: environment
        operator: In
        values: ["production", "staging"]
  # Route policy configuration
  policy:
    # Common rules settings (applies to all rules)
    rules:
      # Backend group configuration
      backends:
        http:
          useHTTP2: true  # enable HTTP/2 to backends
        grpc: {}  # gRPC-specific settings
        stream:
          enableProxy: true  # enable proxy protocol
          keepConnectionsOnHostHealthFailure: false  # drop failed connections
        
        balancing:
          mode: "ROUND_ROBIN"  # load balancing algorithm
          localityAwareRouting: 80  # prefer same zone
          strictLocality: false  # allow cross-zone routing
          panicThreshold: 50  # panic mode threshold
        
        # Health checks
        hc:
          timeout: "5s"  # health check timeout
          interval: "10s"  # check interval
          healthyThreshold: 2  # checks to mark healthy
          unhealthyThreshold: 3  # checks to mark unhealthy
          port: 8080  # health check port
          
          http:
            path: "/health"  # HTTP health check path
            host: "health.example.com"  # Host header
            useHTTP2: false  # use HTTP/1.1 for checks
            expectedStatuses: [200, 202]  # healthy status codes
          
          grpc:
            serviceName: "health.HealthService"  # gRPC service
          
          stream:
            send: "PING"  # TCP check data to send
            receive: "PONG"  # expected TCP response
          
          # Health check transport settings
          transportSettings:
            plaintext: true  # use plaintext for health checks
            tls:
              sni: "health.example.com"  # SNI for health check TLS
              trustedCA:
                id: "health-cert-123"  # health check TLS cert ID
        
        # Backend TLS configuration
        tls:
          sni: "backend.example.com"  # SNI for TLS
          trustedCA:
            id: "cert-123456"  # cloud certificate ID
        
        # Session affinity
        sessionAffinity:
          connection:
            sourceIP: true  # IP-based affinity
          cookie:
            name: "session"  # cookie name
            ttl: "3600s"  # cookie lifetime
          header:
            name: "X-Session-ID"  # header-based affinity
      
      # Route timeouts
      timeout: "60s"  # overall connection timeout
      idleTimeout: "300s"  # idle connection timeout
      
      # Rate limiting for routes
      rateLimit:
        allRequests:
          perSecond: 100  # route-level rate limit for all requests
          perMinute: 6000  # route-level rate limit for all requests
        requestsPerIP:
          perSecond: 10  # route-level rate limit per IP
          perMinute: 600  # route-level rate limit per IP
      
      # Host rewriting
      hostRewrite:
        auto: true  # automatically rewrite host to backend target
        replace: "backend.example.com"  # static host replacement
      
      # HTTP specific settings
      http:
        upgradeTypes: ["websocket"]  # supported upgrade protocols
        regexRewrite:
          regex: "^/service/([^/]+)(/.*)$"  # regex pattern for path rewriting
          substitute: "\\2/instance/\\1"  # substitution with capture groups
      
      # Security
      securityProfileID: "security-profile-1"  # WAF profile for routes
      rbac:
        action: "ALLOW"  # default RBAC action
        principals:
          admin:
            check-token:
              header:
                name: "authorization"
                exact: "Bearer admin123"
            check-ip:
              ip:
                remoteIp: "10.0.0.0/8"
    
    # Specific rule settings (conflict with global settings is an error)
    rule:
      api-rule:  # rule name from HTTPRoute
        backends:
          balancing:
            mode: "LEAST_REQUEST"  # per-rule balancing
        ...

    # Common hosts settings (applies to all hosts)
    hosts:
      securityProfileID: "host-security-profile-1"  # WAF profile for hosts
      rateLimit:
        allRequests:
          perSecond: 100  # global rate limit
          perMinute: 6000  # global rate limit
        requestsPerIP:
          perSecond: 10  # per-IP rate limit
          perMinute: 600  # per-IP rate limit
      rbac:
        action: "DENY"  # host-level RBAC action
        principals:
          blocked:
            bad-ip:
              ip:
                remoteIp: "192.168.1.0/24"
    
    # Specific host settings (conflict with global settings is an error)
    host:
      "api.example.com":  # specific hostname
        securityProfileID: "api-host-security"  # per-host WAF
        ...
status:
  conditions:
    - type: "Ready"
      status: "True"
      reason: "PolicyApplied"
  attachedRoutes: 5