Module gateway_api 

Available on crate feature gateway-api only.

A Kubernetes Gateway API controller (gateway-api feature, 18.8.0, #19): rws watches GatewayClasses, Gateways and routes, serves their traffic, and reports what it accepted in their status. The plan and progress are in spec/GATEWAY_API.md.

• types — the Gateway API v1.6 objects rws reads (serde structs).
• resources — where each kind lives in the API, and the object types.
• translate — the pure step from a snapshot of the cluster to the configuration rws serves and the status every object should have.
• services — the Service each Gateway gets, and its port allocation.
• routes — routes compiled for the data plane, backends resolved to endpoints.
• dataplane / router — the ports served and how a request on one finds its listener, rule, backend and endpoint.
• controller — watches, the reconcile loop and status writes.

Modules

backend_tls

BackendTLSPolicy: which Service ports rws reaches over TLS, trusting which CAs, under which name. A policy targets Services in its namespace (optionally one port, by name); between two policies for the same target the older wins and the other is Conflicted, and a port’s own policy beats one for the whole Service. The client configuration is built once per distinct policy content and shared.

controller

The controller loop: one watcher per kind feeding a shared store, a debounced reconcile that runs translate over a snapshot of those stores, hands the result to the data plane, and writes the status that changed.

dataplane

The data plane: one accept loop (or UDP socket) per container port of a served listener, started, updated and stopped as the controller’s configuration changes. HTTP and HTTPS connections go through rws’s own serve_plain_connection / serve_tls_connection (HTTP/1.1, h2c, TLS with HTTP/2, PROXY protocol, timeouts, metrics) with a PortRouter as the application; TLS, TCP and UDP listeners through super::l4.

filters

HTTPRoute filters applied by the router: header modifiers (request, response, per backend), RequestRedirect, URLRewrite and CORS. Pure functions over the request/response, so each is tested on its own.

l4

TLS, TCP and UDP listeners: TLSRoutes (passthrough by SNI, or terminated with the listener’s certificates), TCPRoutes and UDPRoutes. A connection (or a UDP client’s datagrams) goes to one route — the one whose hostname best matches the SNI, else the oldest — and to a backend of its first rule by weight; bytes are relayed both ways.

lease

Leader election over a coordination.k8s.io/v1 Lease: every replica serves traffic, only the holder writes status and Services. The holder renews every RENEW; another replica takes over once a renewal is older than the lease’s duration. Updates carry the Lease’s resourceVersion, so two replicas can’t both win.

provision

The provisioned mode (RWS_CONFIG_GATEWAY_API_MODE=provisioned): every Gateway gets its own Deployment of rws data-plane pods, in the controller’s namespace and under its ServiceAccount, so no Gateway shares pods with another. Those pods run with RWS_CONFIG_GATEWAY_API_GATEWAY=<namespace>/<name>: they watch like the controller but serve only that Gateway and never write. The Gateway’s Service lists them in its EndpointSlice (super::services). A Deployment can’t be owned by an object in another namespace, so the controller deletes those whose Gateway is gone (stale).

resources

Where each Gateway API kind lives (group, version, plural), and the object types: kube::core::Object over our typed spec and status, read and written with kube::Api::*_with(client, &api_resource).

router

Routing one request on a Gateway listener port: pick the listener by hostname, the rule by the Gateway API’s precedence, a backend by weight, an endpoint, and forward — keeping the client’s Host.

routes

HTTPRoutes compiled for the data plane: matches, filters, and backends resolved to the ready endpoints of their Services (through the Service’s port → EndpointSlice port), so the router does no lookups per request.

services

The Service rws keeps for each Gateway: the Gateway’s own address (LoadBalancer by default), one port per listener port, each mapped to a container port allocated from a range — the pods tell Gateways apart by the port a connection arrives on, and never bind ports below 1024.

translate

The pure step of the controller: a Snapshot of the cluster in, the configuration rws serves (GatewayConfig) and the status every object should have (Desired) out. No I/O, so the Gateway API’s acceptance rules — which routes attach to which listeners, which references resolve, which conditions and reasons are reported — are unit-tested here.

types

Gateway API v1.6 objects — the fields rws acts on, as serde structs read through kube::core::Object<Spec, Status> (see super::resources). Field names follow the upstream Go types’ JSON tags exactly; anything not modeled is ignored on read and never written.

Constants

CONTROLLER_NAME

The controllerName GatewayClasses name to be handled by rws.

FIELD_MANAGER

The field manager rws writes status with.

RWS_CONFIG_GATEWAY_API_CONTROLLER_NAME

The controllerName handled (default CONTROLLER_NAME).

RWS_CONFIG_GATEWAY_API_ENABLED

RWS_CONFIG_GATEWAY_API_ENABLED ([gateway_api] enabled): run the controller and serve Gateways.

RWS_CONFIG_GATEWAY_API_GATEWAY

Set on provisioned pods: namespace/name of the one Gateway they serve; they don’t take the Lease or write anything.

RWS_CONFIG_GATEWAY_API_IMAGE

The image provisioned Deployments run.

RWS_CONFIG_GATEWAY_API_LEASE_NAMESPACE

Where the leader-election Lease lives (default: the pod’s namespace).

RWS_CONFIG_GATEWAY_API_MODE

shared (default: the controller’s pods serve every Gateway) or provisioned (a Deployment per Gateway, provision).

RWS_CONFIG_GATEWAY_API_POD_SELECTOR

The labels of the pods Gateways’ Services select, key=value,….

RWS_CONFIG_GATEWAY_API_PORT_RANGE

Container ports to allocate, first-last (default 10000-10999).

RWS_CONFIG_GATEWAY_API_SERVICE_ACCOUNT

The ServiceAccount provisioned pods run as (default: the pod’s, from POD_SERVICE_ACCOUNT).

RWS_CONFIG_GATEWAY_API_SERVICE_TYPE

Gateways’ Service type (default LoadBalancer).

Functions

enabled

Whether the controller is turned on.

own_gateway

namespace/name from RWS_CONFIG_GATEWAY_API_GATEWAY: this pod is a provisioned data plane for that Gateway only.

parse_labels

key=value,key=value.

parse_port_range

first-last.

settings_from_env

The translation settings, from RWS_CONFIG_GATEWAY_API_*.

start_from_env

When enabled, start the controller, leader election and data plane on the current tokio runtime, against the cluster rws runs in (or the kubeconfig). Returns at once.