Skip to content
API Enriched

Create Route.

POST
/api/config/namespaces/{metadata.namespace}/routes
curl --request POST \
  --url https://example-corp.console.ves.volterra.io/api/v1/api/production/us-east-1/namespaces/default/api/config/namespaces/example/routes \
  --header 'Authorization: <Authorization>' \
  --header 'Content-Type: application/json' \
  --data '{ "metadata": { "annotations": {}, "description": "example", "disable": true, "labels": {}, "name": "example", "namespace": "example" }, "spec": { "routes": [ { "bot_defense_javascript_injection": { "javascript_location": "AFTER_HEAD", "javascript_tags": [ { "javascript_url": "example", "tag_attributes": [ { "javascript_tag": "JS_ATTR_ID", "tag_value": "example" } ] } ] }, "disable_location_add": true, "inherited_bot_defense_javascript_injection": {}, "inherited_waf_exclusion": {}, "match": [ { "headers": [ { "exact": "example", "invert_match": true, "name": "example", "presence": true, "regex": "example" } ], "http_method": "ANY", "incoming_port": { "no_port_match": {}, "port": 1, "port_ranges": "example" }, "path": { "path": "example", "prefix": "example", "regex": "example" }, "query_params": [ { "exact": "example", "key": "example", "regex": "example" } ] } ], "request_cookies_to_add": [ { "name": "example", "overwrite": true, "secret_value": { "blindfold_secret_info": { "decryption_provider": "example", "location": "example", "store_provider": "example" }, "clear_secret_info": { "provider": "example", "url": "https://example.com" } }, "value": "example" } ], "request_cookies_to_remove": [ "example" ], "request_headers_to_add": [ { "append": true, "name": "example", "secret_value": { "blindfold_secret_info": { "decryption_provider": "example", "location": "example", "store_provider": "example" }, "clear_secret_info": { "provider": "example", "url": "https://example.com" } }, "value": "example" } ], "request_headers_to_remove": [ "example" ], "response_cookies_to_add": [ { "add_domain": "example", "add_expiry": "example", "add_httponly": {}, "add_partitioned": {}, "add_path": "example", "add_secure": {}, "ignore_domain": {}, "ignore_expiry": {}, "ignore_httponly": {}, "ignore_max_age": {}, "ignore_partitioned": {}, "ignore_path": {}, "ignore_samesite": {}, "ignore_secure": {}, "ignore_value": {}, "max_age_value": 1, "name": "example", "overwrite": true, "samesite_lax": {}, "samesite_none": {}, "samesite_strict": {}, "secret_value": { "blindfold_secret_info": { "decryption_provider": "example", "location": "example", "store_provider": "example" }, "clear_secret_info": { "provider": "example", "url": "https://example.com" } }, "value": "example" } ], "response_cookies_to_remove": [ "example" ], "response_headers_to_add": [ { "append": true, "name": "example", "secret_value": { "blindfold_secret_info": { "decryption_provider": "example", "location": "example", "store_provider": "example" }, "clear_secret_info": { "provider": "example", "url": "https://example.com" } }, "value": "example" } ], "response_headers_to_remove": [ "example" ], "route_destination": { "auto_host_rewrite": true, "buffer_policy": { "disabled": true, "max_request_bytes": 1 }, "cors_policy": { "allow_credentials": true, "allow_headers": "example", "allow_methods": "example", "allow_origin": [ "example" ], "allow_origin_regex": [ "example" ], "disabled": true, "expose_headers": "example", "maximum_age": 1 }, "csrf_policy": { "all_load_balancer_domains": {}, "custom_domain_list": { "domains": [ "example" ] }, "disabled": {} }, "destinations": [ { "cluster": [ { "name": "example", "namespace": "example" } ], "endpoint_subsets": {}, "priority": 1, "weight": 1 } ], "do_not_retract_cluster": {}, "endpoint_subsets": {}, "hash_policy": [ { "cookie": { "add_httponly": {}, "add_secure": {}, "ignore_httponly": {}, "ignore_samesite": {}, "ignore_secure": {}, "name": "example", "path": "example", "samesite_lax": {}, "samesite_none": {}, "samesite_strict": {}, "ttl": 1 }, "header_name": "example", "source_ip": true, "terminal": true } ], "host_rewrite": "example", "mirror_policy": { "cluster": [ { "name": "example", "namespace": "example" } ], "percent": { "denominator": "HUNDRED", "numerator": 1 } }, "prefix_rewrite": "example", "priority": "DEFAULT", "query_params": { "remove_all_params": {}, "replace_params": "example", "retain_all_params": {} }, "regex_rewrite": { "pattern": "example", "substitution": "example" }, "retract_cluster": {}, "retry_policy": { "back_off": { "base_interval": 1, "max_interval": 1 }, "num_retries": 1, "per_try_timeout": 1, "retriable_status_codes": [ 1 ], "retry_condition": [ "example" ] }, "spdy_config": { "use_spdy": true }, "timeout": 1, "web_socket_config": { "use_websocket": true } }, "route_direct_response": { "response_body_encoded": "example", "response_code": 1 }, "route_redirect": { "host_redirect": "example", "path_redirect": "example", "prefix_rewrite": "example", "proto_redirect": "example", "remove_all_params": {}, "replace_params": "example", "response_code": 1, "retain_all_params": {} }, "service_policy": { "disable": true }, "waf_exclusion_policy": { "name": "example", "namespace": "example" }, "waf_type": { "app_firewall": { "app_firewall": [ { "name": "example", "namespace": "example" } ] }, "disable_waf": {}, "inherit_waf": {} } } ] } }'

Create route object in a given namespace. Route object is list of route rules. Each rule has match condition to match incoming requests and actions to take on matching requests. Virtual host object has reference to route object.

Examples of this operation.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
metadata.namespace
required
string

Namespace This defines the workspace within which each the configuration object is to be created. Must be a DNS_LABEL format. For a namespace object itself, namespace value will be ""

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
CreateRequest is used to create an instance of route

This is the input message of the ‘Create’ RPC.

object
metadata
object
annotations
annotations

Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects.

object
description
description

Human readable description for the object.

string
>= 21 characters <= 1200 characters
disable
disable

A value of true will administratively disable the object.

boolean format: boolean
labels
labels

Map of string keys and values that can be used to organize and categorize (scope and select) objects as chosen by the user. Values specified here will be used by selector expression.

object
name
name

This is the name of configuration object. It has to be unique within the namespace. It can only be specified during create API and cannot be changed during replace API. The value of name has to follow DNS-1035 format. Required: YES.

string
>= 6 characters <= 1024 characters
namespace
namespace

This defines the workspace within which each the configuration object is to be created. Must be a DNS_LABEL format. For a namespace object itself, namespace value will be ""

string
>= 6 characters <= 1024 characters
spec
object
routes

List of routes to match for incoming request

Required: YES.

Array<object>
<= 257 items
RouteType

Each RouteType is a rule which has match condition and action. When the condition is matched for incoming request, the specified action is taken.

object
bot_defense_javascript_injection
object
javascript_location
string
default: AFTER_HEAD
Allowed values: AFTER_HEAD AFTER_TITLE_END BEFORE_SCRIPT
javascript_tags
javascript_tags

Select Add item to configure your javascript tag. If adding both Bot Adv and Fraud, the Bot Javascript should be added first.

Required: YES.

Array<object>
>= 1 items <= 5 items
JavaScriptTag

JavaScript URL and attributes.

object
javascript_url
JavaScriptURL

Please enter the full URL (include domain and path), or relative path. Required: YES.

string
>= 1 characters <= 2048 characters
tag_attributes
TagAttributes

Add the tag attributes you want to include in your Javascript tag.

Array<object>
<= 9 items
TagAttribute

Attribute for JavaScript tag.

object
javascript_tag
string
default: JS_ATTR_ID
Allowed values: JS_ATTR_ID JS_ATTR_CID JS_ATTR_CN JS_ATTR_API_DOMAIN JS_ATTR_API_URL JS_ATTR_API_PATH JS_ATTR_ASYNC JS_ATTR_DEFER
tag_value
TagValue

Add the tag attribute value.

string
<= 1024 characters
disable_location_add
disable_location_add

Disables append of x-F5 Distributed Cloud-location = at route level, if it is configured at virtual-host level. This configuration is ignored on CE sites.

boolean format: boolean
inherited_bot_defense_javascript_injection
object
inherited_waf_exclusion
object
match
match

Route match condition.

Array<object>
<= 16 items
RouteMatch

Route Match can be specified to match five things

  1. In case of HTTP “path” specifies URI part URL (path excluding hostname) in request.
  2. List of headers to match in incoming request.
  3. Query parameters (key, value) in the request. (Not the Query expression)
  4. HTTP method
  5. The port on which the request is received.
object
headers
headers

List of (key, value) headers.

Array<object>
<= 16 items
HeaderMatcherType

Header match is done using the name of the header and its value. The value match is done using one of the following regex match on value exact match of value presence of header

Header Match can also be inverse of above, which be used to check missing header or non-matching value.

object
exact
exact

Exclusive with [presence regex] Header value to match exactly.

string
<= 256 characters
invert_match
invert_match

Invert the result of the match to detect missing header or non-matching value.

boolean format: boolean
name
name

Name of the header Required: YES.

string
>= 1 characters <= 256 characters
presence
presence

Exclusive with [exact regex] If true, check for presence of header.

boolean format: boolean
regex
regex

Exclusive with [exact presence] Regex match of the header value in re2 format.

string
<= 256 characters
http_method
string
default: ANY
Allowed values: ANY GET HEAD POST PUT DELETE CONNECT OPTIONS TRACE PATCH COPY
incoming_port
object
no_port_match
object
port
port

Exclusive with [no_port_match port_ranges] Exact Port to match.

integer format: int64
>= 1 <= 65535
port_ranges
port_range

Exclusive with [no_port_match port] Port range to match.

string
>= 1 characters <= 32 characters
path
object
path
exact

Exclusive with [prefix regex] Exact path value to match.

string
<= 256 characters
prefix
prefix

Exclusive with [path regex] Path prefix to match (e.g. The value / will match on all paths)

string
<= 256 characters
regex
regex

Exclusive with [path prefix] Regular expression of path match (e.g. The value .* will match on all paths)

string
>= 1 characters <= 256 characters
query_params
query_params

List of (key, value) query parameters.

Array<object>
<= 16 items
QueryParameterMatcherType

Query parameter match can be either regex match on value or exact match of value for given key An example for HTTP request with query parameter https://gitlab.com/dashboard/issues?assignee_username=xxyyxx.

object
exact
exact

Exclusive with [regex] Exact match value for the query parameter key.

string
<= 1024 characters
key
key

Query parameter key In the above example, assignee_username is the key Required: YES.

string
>= 1 characters <= 256 characters
regex
regex

Exclusive with [exact] Regex match value for the query parameter key.

string
>= 1 characters <= 256 characters
request_cookies_to_add
Cookies to add in request

Cookies are key-value pairs to be added to HTTP request being routed towards upstream.

Array<object>
<= 32 items
CookieValueOption

Cookie name and value for cookie header.

object
name
name

Name of the cookie in Cookie header. Required: YES.

string
>= 6 characters <= 256 characters
overwrite
overwrite

Should the value be overwritten? If true, the value is overwritten to existing values. Default value is do not overwrite.

boolean format: boolean
secret_value
object
blindfold_secret_info
object
decryption_provider
Decryption Provider

Name of the Secret Management Access object that contains information about the backend Secret Management service.

string
<= 1024 characters
location
Location

Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location Required: YES.

string
>= 4 characters <= 1024 characters
store_provider
Store Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string
<= 1024 characters
clear_secret_info
object
provider
Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string
>= 3 characters <= 1024 characters
url
URL

URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will GET Secret bytes after Base64 decoding. Required: YES.

string format: uri
<= 131072 characters
value
value

Exclusive with [secret_value] Value of the Cookie header.

string
>= 3 characters <= 8096 characters
request_cookies_to_remove
Cookies to be removed from request

List of keys of Cookies to be removed from the HTTP request being sent towards upstream.

Array<string>
<= 32 items
request_headers_to_add
Headers to add in request

Headers are key-value pairs to be added to HTTP requests being sent towards upstream. Headers specified at this level are applied before headers from the enclosing VirtualHost object level.

Array<object>
<= 32 items
HeaderManipulationOptionType

HTTP header is a key-value pair. The name acts as key of HTTP header The value acts as the data/value of HTTP header Example HTTP header Host: user.F5 Distributed cloud.com In the above example, Host is the name or key of HTTP header In the above example, user.F5 Distributed cloud.com is the value of HTTP header.

object
append
append

Should the value be appended? If true, the value is appended to existing values. Default value is do not append.

boolean format: boolean
name
name

Name of the HTTP header. Required: YES.

string
>= 6 characters <= 256 characters
secret_value
object
blindfold_secret_info
object
decryption_provider
Decryption Provider

Name of the Secret Management Access object that contains information about the backend Secret Management service.

string
<= 1024 characters
location
Location

Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location Required: YES.

string
>= 4 characters <= 1024 characters
store_provider
Store Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string
<= 1024 characters
clear_secret_info
object
provider
Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string
>= 3 characters <= 1024 characters
url
URL

URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will GET Secret bytes after Base64 decoding. Required: YES.

string format: uri
<= 131072 characters
value
value

Exclusive with [secret_value] Value of the HTTP header.

string
>= 3 characters <= 8096 characters
request_headers_to_remove
Header to be removed from request

List of keys of Headers to be removed from the HTTP request being sent towards upstream.

Array<string>
<= 32 items
response_cookies_to_add
Cookies to add in set-cookie header in response

Cookies are name-value pairs along with optional attribute parameters to be added to HTTP response being sent towards downstream.

Array<object>
<= 32 items
SetCookieValueOption

Cookie name and its attribute values in set-cookie header.

object
add_domain
add_domain

Exclusive with [ignore_domain] Add domain attribute.

string
>= 1 characters <= 256 characters
add_expiry
add_expiry

Exclusive with [ignore_expiry] Add expiry attribute.

string
<= 256 characters
add_httponly
object
add_partitioned
object
add_path
add_path

Exclusive with [ignore_path] Add path attribute.

string
<= 256 characters
add_secure
object
ignore_domain
object
ignore_expiry
object
ignore_httponly
object
ignore_max_age
object
ignore_partitioned
object
ignore_path
object
ignore_samesite
object
ignore_secure
object
ignore_value
object
max_age_value
add_max_age

Exclusive with [ignore_max_age] Add max age attribute.

integer format: int32
name
name

Name of the cookie in Cookie header. Required: YES.

string
>= 6 characters <= 256 characters
overwrite
overwrite

Should the value be overwritten? If true, the value is overwritten to existing values. Default value is do not overwrite.

boolean format: boolean
samesite_lax
object
samesite_none
object
samesite_strict
object
secret_value
object
blindfold_secret_info
object
decryption_provider
Decryption Provider

Name of the Secret Management Access object that contains information about the backend Secret Management service.

string
<= 1024 characters
location
Location

Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location Required: YES.

string
>= 4 characters <= 1024 characters
store_provider
Store Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string
<= 1024 characters
clear_secret_info
object
provider
Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string
>= 3 characters <= 1024 characters
url
URL

URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will GET Secret bytes after Base64 decoding. Required: YES.

string format: uri
<= 131072 characters
value
value

Exclusive with [ignore_value secret_value] Value of the Cookie header.

string
>= 3 characters <= 8096 characters
response_cookies_to_remove
Cookies to be removed from response

List of name of Cookies to be removed from the HTTP response being sent towards downstream. Entire set-cookie header will be removed.

Array<string>
<= 32 items
response_headers_to_add
Headers to add in response

Headers are key-value pairs to be added to HTTP response being sent towards downstream. Headers specified at this level are applied before headers from the enclosing VirtualHost object level.

Array<object>
<= 32 items
HeaderManipulationOptionType

HTTP header is a key-value pair. The name acts as key of HTTP header The value acts as the data/value of HTTP header Example HTTP header Host: user.F5 Distributed cloud.com In the above example, Host is the name or key of HTTP header In the above example, user.F5 Distributed cloud.com is the value of HTTP header.

object
append
append

Should the value be appended? If true, the value is appended to existing values. Default value is do not append.

boolean format: boolean
name
name

Name of the HTTP header. Required: YES.

string
>= 6 characters <= 256 characters
secret_value
object
blindfold_secret_info
object
decryption_provider
Decryption Provider

Name of the Secret Management Access object that contains information about the backend Secret Management service.

string
<= 1024 characters
location
Location

Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location Required: YES.

string
>= 4 characters <= 1024 characters
store_provider
Store Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string
<= 1024 characters
clear_secret_info
object
provider
Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string
>= 3 characters <= 1024 characters
url
URL

URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will GET Secret bytes after Base64 decoding. Required: YES.

string format: uri
<= 131072 characters
value
value

Exclusive with [secret_value] Value of the HTTP header.

string
>= 3 characters <= 8096 characters
response_headers_to_remove
Header to be removed from response

List of keys of Headers to be removed from the HTTP response being sent towards downstream.

Array<string>
<= 32 items
route_destination
object
auto_host_rewrite
Auto Host Rewrite

Exclusive with [host_rewrite] Indicates that during forwarding, the host header will be swapped with the hostname of the upstream host chosen by the cluster.

boolean format: boolean
buffer_policy
object
disabled
disable

Disable buffering for a particular route. This is useful when virtual-host has buffering, but we need to disable it on a specific route. The value of this field is ignored for virtual-host.

boolean format: boolean
max_request_bytes
max_request_bytes

The maximum request size that the filter will buffer before the connection manager will stop buffering and return a RequestEntityTooLarge (413) response.

integer format: int64
cors_policy
object
allow_credentials
allow_credentials

Specifies whether the resource allows credentials.

boolean format: boolean
allow_headers
allow_headers

Specifies the content for the access-control-allow-headers header.

string
<= 1024 characters
allow_methods
allow_methods

Specifies the content for the access-control-allow-methods header.

string
<= 1024 characters
allow_origin
allow_origin

Specifies the origins that will be allowed to do CORS requests. An origin is allowed if either allow_origin or allow_origin_regex match.

Array<string>
<= 128 items
allow_origin_regex
allow_origin_regex

Specifies regex patterns that match allowed origins. An origin is allowed if either allow_origin or allow_origin_regex match.

Array<string>
<= 16 items
disabled
disabled

Disable the CorsPolicy for a particular route. This is useful when virtual-host has CorsPolicy, but we need to disable it on a specific route. The value of this field is ignored for virtual-host.

boolean format: boolean
expose_headers
expose_headers

Specifies the content for the access-control-expose-headers header.

string
<= 1024 characters
maximum_age
maximum_age

Specifies the content for the access-control-max-age header in seconds. This indicates the maximum number of seconds the results can be cached A value of -1 will disable caching. Maximum permitted value is 86400 seconds (24 hours)

integer format: int32
csrf_policy
object
all_load_balancer_domains
object
custom_domain_list
object
domains
Domains

A list of domain names that will be matched to loadbalancer. These domains are not used for SNI match. Wildcard names are supported in the suffix or prefix form. Required: YES.

Array<string>
>= 1 items <= 32 items
disabled
object
destinations
destinations

When requests have to distributed among multiple upstream clusters, multiple destinations are configured, each having its own cluster and weight. Traffic is distributed among clusters based on the weight configured.

Example: destinations:

  • cluster:
  • kind: F5 xc.vega.cfg.adc.cluster.object uid: cluster-1 weight: 20
  • cluster:
  • kind: F5 xc.vega.cfg.adc.cluster.object uid: cluster-2 weight: 30
  • cluster:
  • kind: F5 xc.vega.cfg.adc.cluster.object uid: cluster-3 weight: 50

This indicates that out of every 100 requests, 50 goes to cluster-3, 30 to cluster-2 and 20 to cluster-1

When single destination is configured, weight is ignored. All the requests are sent to the cluster specified in the destination

Required: YES.

Array<object>
<= 16 items
RouteDestination

Each destination is a reference to cluster, it’s priority, weight and subset criteria.

object
cluster
cluster

Indicates the upstream cluster to which the request should be sent. If the cluster does not exist ServiceUnavailable response will be sent

Required: YES.

Array<object>
<= 1 items
ObjectRefType

This type establishes a ‘direct reference’ from one object(the referrer) to another(the referred). Such a reference is in form of tenant/namespace/name for public API and Uid for private API This type of reference is called direct because the relation is explicit and concrete (as opposed to selector reference which builds a group based on labels of selectee objects)

object
kind
kind

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then kind will hold the referred object’s kind (e.g. “route”)

string
>= 12 characters <= 1024 characters
name
name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name.

string
>= 6 characters <= 1024 characters
namespace
namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string
>= 6 characters <= 1024 characters
tenant
tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string
>= 6 characters <= 1024 characters
uid
uid

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then uid will hold the referred object’s(e.g. Route’s) uid.

string format: uuid
>= 36 characters <= 1024 characters
endpoint_subsets
endpoint_subsets

Upstream cluster may be configured to divide its endpoints into subsets based on metadata attached to the endpoints. Routes may then specify the metadata that a endpoint must match in order to be selected by the load balancer

Labels field of endpoint object’s metadata is used for subset matching. For endpoints which are discovered in K8s or Consul cluster, the label of the service is merged with endpoint’s labels. In case of Consul, the label is derived from the “Tag” field. For labels that are common between configured endpoint and discovered service, labels from discovered service takes precedence.

List of key-value pairs that will be used as matching metadata. Only those endpoints of upstream cluster which match this metadata will be selected for load balancing.

object
priority
Priority

Priority of this cluster, valid only with multiple destinations are configured. Value of 0 will make the cluster as lowest priority upstream cluster Priority of 1 means highest priority and is considered active. When active cluster is not available, lower priority clusters are made active as per the increasing priority.

integer format: int64
weight
weight

When requests have to distributed among multiple upstream clusters, multiple destinations are configured, each having its own cluster and weight. Traffic is distributed among clusters based on the weight configured.

Example: destinations:

  • cluster:
  • kind: F5 xc.vega.cfg.adc.cluster.object uid: cluster-1 weight: 20
  • cluster:
  • kind: F5 xc.vega.cfg.adc.cluster.object uid: cluster-2 weight: 30
  • cluster:
  • kind: F5 xc.vega.cfg.adc.cluster.object uid: cluster-3 weight: 10

This indicates that out of every 60 requests, 10 goes to cluster-3, 30 to cluster-2 and 20 to cluster-1

When single destination is configured, weight is ignored. All the requests are sent to the cluster specified in the destination.

integer format: int64
do_not_retract_cluster
object
endpoint_subsets
endpoint_subsets

Upstream cluster may be configured to divide its endpoints into subsets based on metadata attached to the endpoints. Routes may then specify the metadata that a endpoint must match in order to be selected by the load balancer

Labels field of endpoint object’s metadata is used for subset matching. For endpoint’s which are discovered in K8s or Consul cluster, the label of the service is merged with endpoint’s labels. In case of Consul, the label is derived from the “Tag” field. For labels that are common between configured endpoint and discovered service, labels from discovered service takes precedence.

List of key-value pairs that will be used as matching metadata. Only those endpoints of upstream cluster which match this metadata will be selected for load balancing.

object
hash_policy
hash_policy

Specifies a list of hash policies to use for ring hash load balancing. Each hash policy is evaluated individually and the combined result is used to route the request.

Array<object>
<= 8 items
HashPolicyType

HashPolicyType specifies the field of the incoming request that will be used for generating hash key. When multiple hash policies are configured, this can also specify if the current hash policy is terminal policy or not.

object
cookie
object
add_httponly
object
add_secure
object
ignore_httponly
object
ignore_samesite
object
ignore_secure
object
name
name

The name of the cookie that will be used to obtain the hash key. If the cookie is not present and TTL below is not set, no hash will be produced Required: YES.

string
>= 1 characters <= 256 characters
path
path

The name of the path for the cookie. If no path is specified here, no path will be set for the cookie.

string
<= 1024 characters
samesite_lax
object
samesite_none
object
samesite_strict
object
ttl
ttl

If specified, a cookie with the TTL will be generated if the cookie is not present. If the TTL is present and zero, the generated cookie will be a session cookie. TTL value is in milliseconds.

integer format: int64
header_name
Header

Exclusive with [cookie source_ip] The name or key of the request header that will be used to obtain the hash key.

string
>= 1 characters <= 256 characters
source_ip
Source IP

Exclusive with [cookie header_name] Hash based on source IP address.

boolean format: boolean
terminal
terminal

Specify if its a terminal policy.

boolean format: boolean
host_rewrite
HostRewrite

Exclusive with [auto_host_rewrite] Indicates that during forwarding, the host header will be swapped with this value.

string
>= 1 characters <= 256 characters
mirror_policy
object
cluster
cluster

Specifies the cluster to which the requests will be mirrored. The cluster object referred here must be present.

Required: YES.

Array<object>
<= 1 items
ObjectRefType

This type establishes a ‘direct reference’ from one object(the referrer) to another(the referred). Such a reference is in form of tenant/namespace/name for public API and Uid for private API This type of reference is called direct because the relation is explicit and concrete (as opposed to selector reference which builds a group based on labels of selectee objects)

object
kind
kind

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then kind will hold the referred object’s kind (e.g. “route”)

string
>= 12 characters <= 1024 characters
name
name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name.

string
>= 6 characters <= 1024 characters
namespace
namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string
>= 6 characters <= 1024 characters
tenant
tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string
>= 6 characters <= 1024 characters
uid
uid

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then uid will hold the referred object’s(e.g. Route’s) uid.

string format: uuid
>= 36 characters <= 1024 characters
percent
object
denominator
string
default: HUNDRED
Allowed values: HUNDRED TEN_THOUSAND MILLION
numerator
numerator

Sampled parts per denominator. If denominator was 10000, then value of 5 will be 5 in 10000 Required: YES.

integer format: int64
prefix_rewrite
prefix_rewrite

Exclusive with [regex_rewrite] prefix_rewrite indicates that during forwarding, the matched prefix (or path) should be swapped with its value. When using regex path matching, the entire path (not including the query string) will be swapped with this value. This option allows application URLs to be rooted at a different path from those exposed at the reverse proxy layer.

Example : gcSpec: routes:

  • match:
  • headers: [] path: prefix : /register/ query_params: []
  • headers: [] path: prefix: /register query_params: [] routeDestination: prefixRewrite: ”/” destinations:
  • cluster:
  • kind: cluster.object uid: cluster-1

Having above entries in the config, requests to /register will be stripped to /, while requests to /register/public will be stripped to /public.

string
<= 256 characters
priority
string
default: DEFAULT
Allowed values: DEFAULT HIGH
query_params
object
remove_all_params
object
replace_params
Replace All Params

Exclusive with [remove_all_params retain_all_params]

string
>= 1 characters <= 256 characters
retain_all_params
object
regex_rewrite
object
pattern
Pattern

The regular expression used to find portions of a string that should be replaced.

string
>= 1 characters <= 256 characters
substitution
Substitution

The string that should be substituted into matching portions of the subject string during a substitution operation to produce a new string.

string
<= 256 characters
retract_cluster
object
retry_policy
object
back_off
object
base_interval
base_interval

Specifies the base interval between retries in milliseconds.

integer format: int64
max_interval
max_interval

Specifies the maximum interval between retries in milliseconds. This parameter is optional, but must be greater than or equal to the base_interval if set. The default is 10 times the base_interval.

integer format: int64
num_retries
num_retries

Specifies the allowed number of retries. Defaults to 1. Retries can be done any number of times. An exponential back-off algorithm is used between each retry.

integer format: int64
per_try_timeout
per_try_timeout

Specifies a non-zero timeout per retry attempt. In milliseconds.

integer format: int64
retriable_status_codes
Retriable status Code

HTTP status codes that should trigger a retry in addition to those specified by retry_on.

Array<integer>
<= 16 items
retry_condition
retry_condition

Specifies the conditions under which retry takes place. Retries can be on different types of condition depending on application requirements. For example, network failure, all 5xx response codes, idempotent 4xx response codes, etc

The possible values are

“5xx” : Retry will be done if the upstream server responds with any 5xx response code, or does not respond at all (disconnect/reset/read timeout).

“gateway-error” : Retry will be done only if the upstream server responds with 502, 503 or 504 responses (Included in 5xx)

“connect-failure” : Retry will be done if the request fails because of a connection failure to the upstream server (connect timeout, etc.). (Included in 5xx)

“refused-stream” : Retry is done if the upstream server resets the stream with a REFUSED_STREAM error code (Included in 5xx)

“retriable-4xx” : Retry is done if the upstream server responds with a retriable 4xx response code. The only response code in this category is HTTP CONFLICT (409)

“retriable-status-codes” : Retry is done if the upstream server responds with any response code matching one defined in retriable_status_codes field

“reset” : Retry is done if the upstream server does not respond at all (disconnect/reset/read timeout.) Required: YES.

Array<string>
>= 1 items <= 7 items
spdy_config
object
use_spdy
use_spdy

Specifies that the HTTP client connection to this route is allowed to upgrade to a SPDY connection.

boolean format: boolean
timeout
timeout

Specifies the timeout for the route in milliseconds. This timeout includes all retries. For server side streaming, configure this field with higher value or leave it un-configured for infinite timeout.

integer format: int64
web_socket_config
object
use_websocket
use_websocket

Specifies that the HTTP client connection to this route is allowed to upgrade to a WebSocket connection.

boolean format: boolean
route_direct_response
object
response_body_encoded
response_body

Response body to send. Currently supported URL schemes is string:/// for which message should be encoded in Base64 format. The message can be either plain text or HTML. E.g. ”

Access Denied

”. Base64 encoded string URL for this is string:///PHA+IEFjY2VzcyBEZW5pZWQgPC9wPg==.

string
<= 65536 characters
response_code
response_code

Response code to send.

integer format: int64
route_redirect
object
host_redirect
host_redirect

Swap host part of incoming URL in redirect URL.

string
<= 1024 characters
path_redirect
path_redirect

Exclusive with [prefix_rewrite] swap path part of incoming URL in redirect URL.

string
<= 256 characters
prefix_rewrite
prefix_rewrite

Exclusive with [path_redirect] In Redirect response, the matched prefix (or path) should be swapped with this value. This option allows redirect URLs be dynamically created based on the request.

string
<= 256 characters
proto_redirect
proto_redirect

Swap protocol part of incoming URL in redirect URL The protocol can be swapped with either HTTP or HTTPS When incoming-proto option is specified, swapping of protocol is not done.

string
<= 1024 characters
remove_all_params
object
replace_params
Replace All Params

Exclusive with [remove_all_params retain_all_params]

string
>= 1 characters <= 256 characters
response_code
response_code

The HTTP status code to use in the redirect response.

integer format: int64
retain_all_params
object
service_policy
object
disable
disable

Exclusive with [] disable service policy at route level, if it is configured at virtual-host level.

boolean format: boolean
waf_exclusion_policy
object
name
name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name. Required: YES.

string
>= 1 characters <= 128 characters
namespace
namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string
>= 6 characters <= 64 characters
tenant
tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string
>= 6 characters <= 64 characters
waf_type
object
app_firewall
object
app_firewall
app_firewall

References to an Application Firewall configuration object

Required: YES.

Array<object>
ObjectRefType

This type establishes a ‘direct reference’ from one object(the referrer) to another(the referred). Such a reference is in form of tenant/namespace/name for public API and Uid for private API This type of reference is called direct because the relation is explicit and concrete (as opposed to selector reference which builds a group based on labels of selectee objects)

object
kind
kind

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then kind will hold the referred object’s kind (e.g. “route”)

string
>= 12 characters <= 1024 characters
name
name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name.

string
>= 6 characters <= 1024 characters
namespace
namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string
>= 6 characters <= 1024 characters
tenant
tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string
>= 6 characters <= 1024 characters
uid
uid

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then uid will hold the referred object’s(e.g. Route’s) uid.

string format: uuid
>= 36 characters <= 1024 characters
disable_waf
object
inherit_waf
object

Responses

Section titled “Responses”

200

Section titled “200”

A successful response.

Media typeapplication/json
object
metadata
object
annotations
annotations

Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects.

object
description
description

Human readable description for the object.

string
>= 21 characters <= 1200 characters
disable
disable

A value of true will administratively disable the object.

boolean format: boolean
labels
labels

Map of string keys and values that can be used to organize and categorize (scope and select) objects as chosen by the user. Values specified here will be used by selector expression.

object
name
name

This is the name of configuration object. It has to be unique within the namespace. It can only be specified during create API and cannot be changed during replace API. The value of name has to follow DNS-1035 format. Required: YES.

string
>= 6 characters <= 1024 characters
namespace
namespace

This defines the workspace within which each the configuration object is to be created. Must be a DNS_LABEL format. For a namespace object itself, namespace value will be ""

string
>= 6 characters <= 1024 characters
spec
object
routes

List of routes to match for incoming request

Required: YES.

Array<object>
<= 257 items
RouteType

Each RouteType is a rule which has match condition and action. When the condition is matched for incoming request, the specified action is taken.

object
bot_defense_javascript_injection
object
javascript_location
string
default: AFTER_HEAD
Allowed values: AFTER_HEAD AFTER_TITLE_END BEFORE_SCRIPT
javascript_tags
javascript_tags

Select Add item to configure your javascript tag. If adding both Bot Adv and Fraud, the Bot Javascript should be added first.

Required: YES.

Array<object>
>= 1 items <= 5 items
JavaScriptTag

JavaScript URL and attributes.

object
javascript_url
JavaScriptURL

Please enter the full URL (include domain and path), or relative path. Required: YES.

string
>= 1 characters <= 2048 characters
tag_attributes
TagAttributes

Add the tag attributes you want to include in your Javascript tag.

Array<object>
<= 9 items
TagAttribute

Attribute for JavaScript tag.

object
javascript_tag
string
default: JS_ATTR_ID
Allowed values: JS_ATTR_ID JS_ATTR_CID JS_ATTR_CN JS_ATTR_API_DOMAIN JS_ATTR_API_URL JS_ATTR_API_PATH JS_ATTR_ASYNC JS_ATTR_DEFER
tag_value
TagValue

Add the tag attribute value.

string
<= 1024 characters
disable_location_add
disable_location_add

Disables append of x-F5 Distributed Cloud-location = at route level, if it is configured at virtual-host level. This configuration is ignored on CE sites.

boolean format: boolean
inherited_bot_defense_javascript_injection
object
inherited_waf_exclusion
object
match
match

Route match condition.

Array<object>
<= 16 items
RouteMatch

Route Match can be specified to match five things

  1. In case of HTTP “path” specifies URI part URL (path excluding hostname) in request.
  2. List of headers to match in incoming request.
  3. Query parameters (key, value) in the request. (Not the Query expression)
  4. HTTP method
  5. The port on which the request is received.
object
headers
headers

List of (key, value) headers.

Array<object>
<= 16 items
HeaderMatcherType

Header match is done using the name of the header and its value. The value match is done using one of the following regex match on value exact match of value presence of header

Header Match can also be inverse of above, which be used to check missing header or non-matching value.

object
exact
exact

Exclusive with [presence regex] Header value to match exactly.

string
<= 256 characters
invert_match
invert_match

Invert the result of the match to detect missing header or non-matching value.

boolean format: boolean
name
name

Name of the header Required: YES.

string
>= 1 characters <= 256 characters
presence
presence

Exclusive with [exact regex] If true, check for presence of header.

boolean format: boolean
regex
regex

Exclusive with [exact presence] Regex match of the header value in re2 format.

string
<= 256 characters
http_method
string
default: ANY
Allowed values: ANY GET HEAD POST PUT DELETE CONNECT OPTIONS TRACE PATCH COPY
incoming_port
object
no_port_match
object
port
port

Exclusive with [no_port_match port_ranges] Exact Port to match.

integer format: int64
>= 1 <= 65535
port_ranges
port_range

Exclusive with [no_port_match port] Port range to match.

string
>= 1 characters <= 32 characters
path
object
path
exact

Exclusive with [prefix regex] Exact path value to match.

string
<= 256 characters
prefix
prefix

Exclusive with [path regex] Path prefix to match (e.g. The value / will match on all paths)

string
<= 256 characters
regex
regex

Exclusive with [path prefix] Regular expression of path match (e.g. The value .* will match on all paths)

string
>= 1 characters <= 256 characters
query_params
query_params

List of (key, value) query parameters.

Array<object>
<= 16 items
QueryParameterMatcherType

Query parameter match can be either regex match on value or exact match of value for given key An example for HTTP request with query parameter https://gitlab.com/dashboard/issues?assignee_username=xxyyxx.

object
exact
exact

Exclusive with [regex] Exact match value for the query parameter key.

string
<= 1024 characters
key
key

Query parameter key In the above example, assignee_username is the key Required: YES.

string
>= 1 characters <= 256 characters
regex
regex

Exclusive with [exact] Regex match value for the query parameter key.

string
>= 1 characters <= 256 characters
request_cookies_to_add
Cookies to add in request

Cookies are key-value pairs to be added to HTTP request being routed towards upstream.

Array<object>
<= 32 items
CookieValueOption

Cookie name and value for cookie header.

object
name
name

Name of the cookie in Cookie header. Required: YES.

string
>= 6 characters <= 256 characters
overwrite
overwrite

Should the value be overwritten? If true, the value is overwritten to existing values. Default value is do not overwrite.

boolean format: boolean
secret_value
object
blindfold_secret_info
object
decryption_provider
Decryption Provider

Name of the Secret Management Access object that contains information about the backend Secret Management service.

string
<= 1024 characters
location
Location

Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location Required: YES.

string
>= 4 characters <= 1024 characters
store_provider
Store Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string
<= 1024 characters
clear_secret_info
object
provider
Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string
>= 3 characters <= 1024 characters
url
URL

URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will GET Secret bytes after Base64 decoding. Required: YES.

string format: uri
<= 131072 characters
value
value

Exclusive with [secret_value] Value of the Cookie header.

string
>= 3 characters <= 8096 characters
request_cookies_to_remove
Cookies to be removed from request

List of keys of Cookies to be removed from the HTTP request being sent towards upstream.

Array<string>
<= 32 items
request_headers_to_add
Headers to add in request

Headers are key-value pairs to be added to HTTP requests being sent towards upstream. Headers specified at this level are applied before headers from the enclosing VirtualHost object level.

Array<object>
<= 32 items
HeaderManipulationOptionType

HTTP header is a key-value pair. The name acts as key of HTTP header The value acts as the data/value of HTTP header Example HTTP header Host: user.F5 Distributed cloud.com In the above example, Host is the name or key of HTTP header In the above example, user.F5 Distributed cloud.com is the value of HTTP header.

object
append
append

Should the value be appended? If true, the value is appended to existing values. Default value is do not append.

boolean format: boolean
name
name

Name of the HTTP header. Required: YES.

string
>= 6 characters <= 256 characters
secret_value
object
blindfold_secret_info
object
decryption_provider
Decryption Provider

Name of the Secret Management Access object that contains information about the backend Secret Management service.

string
<= 1024 characters
location
Location

Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location Required: YES.

string
>= 4 characters <= 1024 characters
store_provider
Store Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string
<= 1024 characters
clear_secret_info
object
provider
Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string
>= 3 characters <= 1024 characters
url
URL

URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will GET Secret bytes after Base64 decoding. Required: YES.

string format: uri
<= 131072 characters
value
value

Exclusive with [secret_value] Value of the HTTP header.

string
>= 3 characters <= 8096 characters
request_headers_to_remove
Header to be removed from request

List of keys of Headers to be removed from the HTTP request being sent towards upstream.

Array<string>
<= 32 items
response_cookies_to_add
Cookies to add in set-cookie header in response

Cookies are name-value pairs along with optional attribute parameters to be added to HTTP response being sent towards downstream.

Array<object>
<= 32 items
SetCookieValueOption

Cookie name and its attribute values in set-cookie header.

object
add_domain
add_domain

Exclusive with [ignore_domain] Add domain attribute.

string
>= 1 characters <= 256 characters
add_expiry
add_expiry

Exclusive with [ignore_expiry] Add expiry attribute.

string
<= 256 characters
add_httponly
object
add_partitioned
object
add_path
add_path

Exclusive with [ignore_path] Add path attribute.

string
<= 256 characters
add_secure
object
ignore_domain
object
ignore_expiry
object
ignore_httponly
object
ignore_max_age
object
ignore_partitioned
object
ignore_path
object
ignore_samesite
object
ignore_secure
object
ignore_value
object
max_age_value
add_max_age

Exclusive with [ignore_max_age] Add max age attribute.

integer format: int32
name
name

Name of the cookie in Cookie header. Required: YES.

string
>= 6 characters <= 256 characters
overwrite
overwrite

Should the value be overwritten? If true, the value is overwritten to existing values. Default value is do not overwrite.

boolean format: boolean
samesite_lax
object
samesite_none
object
samesite_strict
object
secret_value
object
blindfold_secret_info
object
decryption_provider
Decryption Provider

Name of the Secret Management Access object that contains information about the backend Secret Management service.

string
<= 1024 characters
location
Location

Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location Required: YES.

string
>= 4 characters <= 1024 characters
store_provider
Store Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string
<= 1024 characters
clear_secret_info
object
provider
Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string
>= 3 characters <= 1024 characters
url
URL

URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will GET Secret bytes after Base64 decoding. Required: YES.

string format: uri
<= 131072 characters
value
value

Exclusive with [ignore_value secret_value] Value of the Cookie header.

string
>= 3 characters <= 8096 characters
response_cookies_to_remove
Cookies to be removed from response

List of name of Cookies to be removed from the HTTP response being sent towards downstream. Entire set-cookie header will be removed.

Array<string>
<= 32 items
response_headers_to_add
Headers to add in response

Headers are key-value pairs to be added to HTTP response being sent towards downstream. Headers specified at this level are applied before headers from the enclosing VirtualHost object level.

Array<object>
<= 32 items
HeaderManipulationOptionType

HTTP header is a key-value pair. The name acts as key of HTTP header The value acts as the data/value of HTTP header Example HTTP header Host: user.F5 Distributed cloud.com In the above example, Host is the name or key of HTTP header In the above example, user.F5 Distributed cloud.com is the value of HTTP header.

object
append
append

Should the value be appended? If true, the value is appended to existing values. Default value is do not append.

boolean format: boolean
name
name

Name of the HTTP header. Required: YES.

string
>= 6 characters <= 256 characters
secret_value
object
blindfold_secret_info
object
decryption_provider
Decryption Provider

Name of the Secret Management Access object that contains information about the backend Secret Management service.

string
<= 1024 characters
location
Location

Location is the uri_ref. It could be in URL format for string:/// Or it could be a path if the store provider is an HTTP/HTTPS location Required: YES.

string
>= 4 characters <= 1024 characters
store_provider
Store Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string
<= 1024 characters
clear_secret_info
object
provider
Provider

Name of the Secret Management Access object that contains information about the store to GET encrypted bytes This field needs to be provided only if the URL scheme is not string:///.

string
>= 3 characters <= 1024 characters
url
URL

URL of the secret. Currently supported URL schemes is string:///. For string:/// scheme, Secret needs to be encoded Base64 format. When asked for this secret, caller will GET Secret bytes after Base64 decoding. Required: YES.

string format: uri
<= 131072 characters
value
value

Exclusive with [secret_value] Value of the HTTP header.

string
>= 3 characters <= 8096 characters
response_headers_to_remove
Header to be removed from response

List of keys of Headers to be removed from the HTTP response being sent towards downstream.

Array<string>
<= 32 items
route_destination
object
auto_host_rewrite
Auto Host Rewrite

Exclusive with [host_rewrite] Indicates that during forwarding, the host header will be swapped with the hostname of the upstream host chosen by the cluster.

boolean format: boolean
buffer_policy
object
disabled
disable

Disable buffering for a particular route. This is useful when virtual-host has buffering, but we need to disable it on a specific route. The value of this field is ignored for virtual-host.

boolean format: boolean
max_request_bytes
max_request_bytes

The maximum request size that the filter will buffer before the connection manager will stop buffering and return a RequestEntityTooLarge (413) response.

integer format: int64
cors_policy
object
allow_credentials
allow_credentials

Specifies whether the resource allows credentials.

boolean format: boolean
allow_headers
allow_headers

Specifies the content for the access-control-allow-headers header.

string
<= 1024 characters
allow_methods
allow_methods

Specifies the content for the access-control-allow-methods header.

string
<= 1024 characters
allow_origin
allow_origin

Specifies the origins that will be allowed to do CORS requests. An origin is allowed if either allow_origin or allow_origin_regex match.

Array<string>
<= 128 items
allow_origin_regex
allow_origin_regex

Specifies regex patterns that match allowed origins. An origin is allowed if either allow_origin or allow_origin_regex match.

Array<string>
<= 16 items
disabled
disabled

Disable the CorsPolicy for a particular route. This is useful when virtual-host has CorsPolicy, but we need to disable it on a specific route. The value of this field is ignored for virtual-host.

boolean format: boolean
expose_headers
expose_headers

Specifies the content for the access-control-expose-headers header.

string
<= 1024 characters
maximum_age
maximum_age

Specifies the content for the access-control-max-age header in seconds. This indicates the maximum number of seconds the results can be cached A value of -1 will disable caching. Maximum permitted value is 86400 seconds (24 hours)

integer format: int32
csrf_policy
object
all_load_balancer_domains
object
custom_domain_list
object
domains
Domains

A list of domain names that will be matched to loadbalancer. These domains are not used for SNI match. Wildcard names are supported in the suffix or prefix form. Required: YES.

Array<string>
>= 1 items <= 32 items
disabled
object
destinations
destinations

When requests have to distributed among multiple upstream clusters, multiple destinations are configured, each having its own cluster and weight. Traffic is distributed among clusters based on the weight configured.

Example: destinations:

  • cluster:
  • kind: F5 xc.vega.cfg.adc.cluster.object uid: cluster-1 weight: 20
  • cluster:
  • kind: F5 xc.vega.cfg.adc.cluster.object uid: cluster-2 weight: 30
  • cluster:
  • kind: F5 xc.vega.cfg.adc.cluster.object uid: cluster-3 weight: 50

This indicates that out of every 100 requests, 50 goes to cluster-3, 30 to cluster-2 and 20 to cluster-1

When single destination is configured, weight is ignored. All the requests are sent to the cluster specified in the destination

Required: YES.

Array<object>
<= 16 items
RouteDestination

Each destination is a reference to cluster, it’s priority, weight and subset criteria.

object
cluster
cluster

Indicates the upstream cluster to which the request should be sent. If the cluster does not exist ServiceUnavailable response will be sent

Required: YES.

Array<object>
<= 1 items
ObjectRefType

This type establishes a ‘direct reference’ from one object(the referrer) to another(the referred). Such a reference is in form of tenant/namespace/name for public API and Uid for private API This type of reference is called direct because the relation is explicit and concrete (as opposed to selector reference which builds a group based on labels of selectee objects)

object
kind
kind

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then kind will hold the referred object’s kind (e.g. “route”)

string
>= 12 characters <= 1024 characters
name
name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name.

string
>= 6 characters <= 1024 characters
namespace
namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string
>= 6 characters <= 1024 characters
tenant
tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string
>= 6 characters <= 1024 characters
uid
uid

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then uid will hold the referred object’s(e.g. Route’s) uid.

string format: uuid
>= 36 characters <= 1024 characters
endpoint_subsets
endpoint_subsets

Upstream cluster may be configured to divide its endpoints into subsets based on metadata attached to the endpoints. Routes may then specify the metadata that a endpoint must match in order to be selected by the load balancer

Labels field of endpoint object’s metadata is used for subset matching. For endpoints which are discovered in K8s or Consul cluster, the label of the service is merged with endpoint’s labels. In case of Consul, the label is derived from the “Tag” field. For labels that are common between configured endpoint and discovered service, labels from discovered service takes precedence.

List of key-value pairs that will be used as matching metadata. Only those endpoints of upstream cluster which match this metadata will be selected for load balancing.

object
priority
Priority

Priority of this cluster, valid only with multiple destinations are configured. Value of 0 will make the cluster as lowest priority upstream cluster Priority of 1 means highest priority and is considered active. When active cluster is not available, lower priority clusters are made active as per the increasing priority.

integer format: int64
weight
weight

When requests have to distributed among multiple upstream clusters, multiple destinations are configured, each having its own cluster and weight. Traffic is distributed among clusters based on the weight configured.

Example: destinations:

  • cluster:
  • kind: F5 xc.vega.cfg.adc.cluster.object uid: cluster-1 weight: 20
  • cluster:
  • kind: F5 xc.vega.cfg.adc.cluster.object uid: cluster-2 weight: 30
  • cluster:
  • kind: F5 xc.vega.cfg.adc.cluster.object uid: cluster-3 weight: 10

This indicates that out of every 60 requests, 10 goes to cluster-3, 30 to cluster-2 and 20 to cluster-1

When single destination is configured, weight is ignored. All the requests are sent to the cluster specified in the destination.

integer format: int64
do_not_retract_cluster
object
endpoint_subsets
endpoint_subsets

Upstream cluster may be configured to divide its endpoints into subsets based on metadata attached to the endpoints. Routes may then specify the metadata that a endpoint must match in order to be selected by the load balancer

Labels field of endpoint object’s metadata is used for subset matching. For endpoint’s which are discovered in K8s or Consul cluster, the label of the service is merged with endpoint’s labels. In case of Consul, the label is derived from the “Tag” field. For labels that are common between configured endpoint and discovered service, labels from discovered service takes precedence.

List of key-value pairs that will be used as matching metadata. Only those endpoints of upstream cluster which match this metadata will be selected for load balancing.

object
hash_policy
hash_policy

Specifies a list of hash policies to use for ring hash load balancing. Each hash policy is evaluated individually and the combined result is used to route the request.

Array<object>
<= 8 items
HashPolicyType

HashPolicyType specifies the field of the incoming request that will be used for generating hash key. When multiple hash policies are configured, this can also specify if the current hash policy is terminal policy or not.

object
cookie
object
add_httponly
object
add_secure
object
ignore_httponly
object
ignore_samesite
object
ignore_secure
object
name
name

The name of the cookie that will be used to obtain the hash key. If the cookie is not present and TTL below is not set, no hash will be produced Required: YES.

string
>= 1 characters <= 256 characters
path
path

The name of the path for the cookie. If no path is specified here, no path will be set for the cookie.

string
<= 1024 characters
samesite_lax
object
samesite_none
object
samesite_strict
object
ttl
ttl

If specified, a cookie with the TTL will be generated if the cookie is not present. If the TTL is present and zero, the generated cookie will be a session cookie. TTL value is in milliseconds.

integer format: int64
header_name
Header

Exclusive with [cookie source_ip] The name or key of the request header that will be used to obtain the hash key.

string
>= 1 characters <= 256 characters
source_ip
Source IP

Exclusive with [cookie header_name] Hash based on source IP address.

boolean format: boolean
terminal
terminal

Specify if its a terminal policy.

boolean format: boolean
host_rewrite
HostRewrite

Exclusive with [auto_host_rewrite] Indicates that during forwarding, the host header will be swapped with this value.

string
>= 1 characters <= 256 characters
mirror_policy
object
cluster
cluster

Specifies the cluster to which the requests will be mirrored. The cluster object referred here must be present.

Required: YES.

Array<object>
<= 1 items
ObjectRefType

This type establishes a ‘direct reference’ from one object(the referrer) to another(the referred). Such a reference is in form of tenant/namespace/name for public API and Uid for private API This type of reference is called direct because the relation is explicit and concrete (as opposed to selector reference which builds a group based on labels of selectee objects)

object
kind
kind

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then kind will hold the referred object’s kind (e.g. “route”)

string
>= 12 characters <= 1024 characters
name
name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name.

string
>= 6 characters <= 1024 characters
namespace
namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string
>= 6 characters <= 1024 characters
tenant
tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string
>= 6 characters <= 1024 characters
uid
uid

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then uid will hold the referred object’s(e.g. Route’s) uid.

string format: uuid
>= 36 characters <= 1024 characters
percent
object
denominator
string
default: HUNDRED
Allowed values: HUNDRED TEN_THOUSAND MILLION
numerator
numerator

Sampled parts per denominator. If denominator was 10000, then value of 5 will be 5 in 10000 Required: YES.

integer format: int64
prefix_rewrite
prefix_rewrite

Exclusive with [regex_rewrite] prefix_rewrite indicates that during forwarding, the matched prefix (or path) should be swapped with its value. When using regex path matching, the entire path (not including the query string) will be swapped with this value. This option allows application URLs to be rooted at a different path from those exposed at the reverse proxy layer.

Example : gcSpec: routes:

  • match:
  • headers: [] path: prefix : /register/ query_params: []
  • headers: [] path: prefix: /register query_params: [] routeDestination: prefixRewrite: ”/” destinations:
  • cluster:
  • kind: cluster.object uid: cluster-1

Having above entries in the config, requests to /register will be stripped to /, while requests to /register/public will be stripped to /public.

string
<= 256 characters
priority
string
default: DEFAULT
Allowed values: DEFAULT HIGH
query_params
object
remove_all_params
object
replace_params
Replace All Params

Exclusive with [remove_all_params retain_all_params]

string
>= 1 characters <= 256 characters
retain_all_params
object
regex_rewrite
object
pattern
Pattern

The regular expression used to find portions of a string that should be replaced.

string
>= 1 characters <= 256 characters
substitution
Substitution

The string that should be substituted into matching portions of the subject string during a substitution operation to produce a new string.

string
<= 256 characters
retract_cluster
object
retry_policy
object
back_off
object
base_interval
base_interval

Specifies the base interval between retries in milliseconds.

integer format: int64
max_interval
max_interval

Specifies the maximum interval between retries in milliseconds. This parameter is optional, but must be greater than or equal to the base_interval if set. The default is 10 times the base_interval.

integer format: int64
num_retries
num_retries

Specifies the allowed number of retries. Defaults to 1. Retries can be done any number of times. An exponential back-off algorithm is used between each retry.

integer format: int64
per_try_timeout
per_try_timeout

Specifies a non-zero timeout per retry attempt. In milliseconds.

integer format: int64
retriable_status_codes
Retriable status Code

HTTP status codes that should trigger a retry in addition to those specified by retry_on.

Array<integer>
<= 16 items
retry_condition
retry_condition

Specifies the conditions under which retry takes place. Retries can be on different types of condition depending on application requirements. For example, network failure, all 5xx response codes, idempotent 4xx response codes, etc

The possible values are

“5xx” : Retry will be done if the upstream server responds with any 5xx response code, or does not respond at all (disconnect/reset/read timeout).

“gateway-error” : Retry will be done only if the upstream server responds with 502, 503 or 504 responses (Included in 5xx)

“connect-failure” : Retry will be done if the request fails because of a connection failure to the upstream server (connect timeout, etc.). (Included in 5xx)

“refused-stream” : Retry is done if the upstream server resets the stream with a REFUSED_STREAM error code (Included in 5xx)

“retriable-4xx” : Retry is done if the upstream server responds with a retriable 4xx response code. The only response code in this category is HTTP CONFLICT (409)

“retriable-status-codes” : Retry is done if the upstream server responds with any response code matching one defined in retriable_status_codes field

“reset” : Retry is done if the upstream server does not respond at all (disconnect/reset/read timeout.) Required: YES.

Array<string>
>= 1 items <= 7 items
spdy_config
object
use_spdy
use_spdy

Specifies that the HTTP client connection to this route is allowed to upgrade to a SPDY connection.

boolean format: boolean
timeout
timeout

Specifies the timeout for the route in milliseconds. This timeout includes all retries. For server side streaming, configure this field with higher value or leave it un-configured for infinite timeout.

integer format: int64
web_socket_config
object
use_websocket
use_websocket

Specifies that the HTTP client connection to this route is allowed to upgrade to a WebSocket connection.

boolean format: boolean
route_direct_response
object
response_body_encoded
response_body

Response body to send. Currently supported URL schemes is string:/// for which message should be encoded in Base64 format. The message can be either plain text or HTML. E.g. ”

Access Denied

”. Base64 encoded string URL for this is string:///PHA+IEFjY2VzcyBEZW5pZWQgPC9wPg==.

string
<= 65536 characters
response_code
response_code

Response code to send.

integer format: int64
route_redirect
object
host_redirect
host_redirect

Swap host part of incoming URL in redirect URL.

string
<= 1024 characters
path_redirect
path_redirect

Exclusive with [prefix_rewrite] swap path part of incoming URL in redirect URL.

string
<= 256 characters
prefix_rewrite
prefix_rewrite

Exclusive with [path_redirect] In Redirect response, the matched prefix (or path) should be swapped with this value. This option allows redirect URLs be dynamically created based on the request.

string
<= 256 characters
proto_redirect
proto_redirect

Swap protocol part of incoming URL in redirect URL The protocol can be swapped with either HTTP or HTTPS When incoming-proto option is specified, swapping of protocol is not done.

string
<= 1024 characters
remove_all_params
object
replace_params
Replace All Params

Exclusive with [remove_all_params retain_all_params]

string
>= 1 characters <= 256 characters
response_code
response_code

The HTTP status code to use in the redirect response.

integer format: int64
retain_all_params
object
service_policy
object
disable
disable

Exclusive with [] disable service policy at route level, if it is configured at virtual-host level.

boolean format: boolean
waf_exclusion_policy
object
name
name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name. Required: YES.

string
>= 1 characters <= 128 characters
namespace
namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string
>= 6 characters <= 64 characters
tenant
tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string
>= 6 characters <= 64 characters
waf_type
object
app_firewall
object
app_firewall
app_firewall

References to an Application Firewall configuration object

Required: YES.

Array<object>
ObjectRefType

This type establishes a ‘direct reference’ from one object(the referrer) to another(the referred). Such a reference is in form of tenant/namespace/name for public API and Uid for private API This type of reference is called direct because the relation is explicit and concrete (as opposed to selector reference which builds a group based on labels of selectee objects)

object
kind
kind

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then kind will hold the referred object’s kind (e.g. “route”)

string
>= 12 characters <= 1024 characters
name
name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name.

string
>= 6 characters <= 1024 characters
namespace
namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string
>= 6 characters <= 1024 characters
tenant
tenant

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant.

string
>= 6 characters <= 1024 characters
uid
uid

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then uid will hold the referred object’s(e.g. Route’s) uid.

string format: uuid
>= 36 characters <= 1024 characters
disable_waf
object
inherit_waf
object
system_metadata
object
creation_timestamp
creation_timestamp

CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC.

string format: date-time
<= 1024 characters
creator_class
creator_class

A value identifying the class of the user or service which created this configuration object.

string
<= 1024 characters
creator_id
creator_id

A value identifying the exact user or service that created this configuration object.

string
<= 1024 characters
deletion_timestamp
deletion_timestamp

DeletionTimestamp is RFC 3339 date and time at which this resource will be deleted. This field is set by the server when a graceful deletion is requested by the user, and is not directly settable by a client. The resource is expected to be deleted (no longer visible from resource lists, and not reachable by name) after the time in this field, once the finalizers list is empty. As long as the finalizers list contains items, deletion is blocked. Once the deletionTimestamp is set, this value may not be unset or be set further into the future, although it may be shortened or the resource may be deleted prior to this time. For example, a user may request that a pod is deleted in 30 seconds. The Kubelet will react by sending a graceful termination signal to the containers in the pod. After that 30 seconds, the Kubelet will send a hard termination signal (SIGKILL) to the container and after cleanup, remove the pod from the API. In the presence of network partitions, this object may still exist after this timestamp, until an administrator or automated process can determine the resource is fully terminated. If not set, graceful deletion of the object has not been requested.

Populated by the system when a graceful deletion is requested. Read-only.

string format: date-time
<= 1024 characters
finalizers
finalizers

Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed.

Array<string>
initializers
object
pending
pending

Pending is a list of initializers that must execute in order before this object is initialized. When the last pending initializer is removed, and no failing result is set, the initializers struct will be set to nil and the object is considered as initialized and visible to all clients.

Array<object>
InitializerType

Initializer is information about an initializer that has not yet completed.

object
name
name

Name of the service that is responsible for initializing this object.

string
>= 6 characters <= 1024 characters
result
object
code
code

Suggested HTTP return code for this status, 0 if not set.

integer format: int32
reason
reason

A human-readable description of why this operation is in the “Failure” status. If this value is empty there is no information available.

string
>= 27 characters <= 1024 characters
status
status

Status of the operation. One of: “Success” or “Failure”.

string
>= 17 characters <= 1024 characters
labels
labels

Map of string keys and values that can be used to organize and categorize (scope and select) objects as chosen by the operator or software. Values here can be interpreted by software(backend or frontend) to enable certain behavior e.g. Things marked as soft-deleted(restorable).

object
modification_timestamp
modification_timestamp

ModificationTimestamp is a timestamp representing the server time when this object was last modified.

string format: date-time
<= 1024 characters
object_index
object_index

Unique index for the object. Some objects need a unique integer index to be allocated for each object type. This field will be populated for all objects that need it and will be zero otherwise.

integer format: int64
owner_view
object
kind
kind

Kind of the view object.

string
>= 12 characters <= 1024 characters
name
name

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name.

string
>= 6 characters <= 1024 characters
namespace
namespace

When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace.

string
>= 6 characters <= 1024 characters
uid
uid

UID of the view object.

string format: uuid
>= 36 characters <= 1024 characters
tenant
tenant

Tenant to which this configuration object belongs to. The value for this is found from presented credentials.

string
>= 6 characters <= 1024 characters
uid
uid

Uid is the unique in time and space value for this object. It is generated by the server on successful creation of an object and is not allowed to change on Replace API. The value of is taken from uid field of ObjectMetaType, if provided.

string format: uuid
>= 36 characters <= 1024 characters
Example
{
  "spec": {
    "routes": [
      {
        "bot_defense_javascript_injection": {
          "javascript_location": "AFTER_HEAD",
          "javascript_tags": [
            {
              "tag_attributes": [
                {
                  "javascript_tag": "JS_ATTR_ID"
                }
              ]
            }
          ]
        },
        "match": [
          {
            "http_method": "ANY"
          }
        ],
        "route_destination": {
          "mirror_policy": {
            "percent": {
              "denominator": "HUNDRED"
            }
          },
          "priority": "DEFAULT"
        }
      }
    ]
  }
}

401

Section titled “401”

Returned when operation is not authorized.

Media typeapplication/json
string format: string
Examplegenerated
example

403

Section titled “403”

Returned when there is no permission to access resource.

Media typeapplication/json
string format: string
Examplegenerated
example

404

Section titled “404”

Returned when resource is not found.

Media typeapplication/json
string format: string
Examplegenerated
example

409

Section titled “409”

Returned when operation on resource is conflicting with current value.

Media typeapplication/json
string format: string
Examplegenerated
example

429

Section titled “429”

Returned when operation has been rejected as it is happening too frequently.

Media typeapplication/json
string format: string
Examplegenerated
example

500

Section titled “500”

Returned when server encountered an error in processing API.

Media typeapplication/json
string format: string
Examplegenerated
example

503

Section titled “503”

Returned when service is unavailable temporarily.

Media typeapplication/json
string format: string
Examplegenerated
example

504

Section titled “504”

Returned when server timed out processing request.

Media typeapplication/json
string format: string
Examplegenerated
example