Gateway Domain

The Gateway domain configures the API Gateway at runtime. It manages routes, consumers, and their access relationships. While the architecture is designed to be gateway-agnostic, the current implementation uses Kong as the underlying gateway technology.

Custom Resources

Consumer

Consumer is the Schema for the consumers API

Group: gateway.cp.ei.telekom.de · Version: v1 · Scope: Namespaced

ConsumerSpec

Appears in: Consumer

ConsumerSpec defines the desired state of Consumer

Field	Type	Default	Validation
name	string	—	Required
realm	ObjectRef	—	Required
security	Security	—	Optional

ObjectRef

Appears in: ConsumerSpec, ConsumeRouteSpec, RealmSpec, RealmStatus, RouteSpec

ObjectRef is a reference to a Kubernetes object It is similar to types.NamespacedName but has the required json tags for serialization

Field	Type	Default	Validation
name	string	—	Required
namespace	string	—	Required
uid	string	—	Optional

Security

Appears in: ConsumerSpec

Security defines the security configuration for the Rover Security is optional, but if provided, exactly one of m2m or h2m must be set

Field	Type	Default	Validation
ipRestrictions	IpRestrictions	—	Optional

IpRestrictions

Appears in: Security

Field	Type	Default	Validation
allow	string[]	—	Optional
deny	string[]	—	Optional

ConsumerStatus

Appears in: Consumer, ConsumeRoute

ConsumerStatus defines the observed state of Consumer

Field	Type	Default	Validation
conditions	Condition[]	—	Optional
properties	map<string, string>	—	Optional

Condition

Appears in: ConsumerStatus, GatewayStatus, RealmStatus, RouteStatus

Field	Type	Default	Validation
lastTransitionTime	string	—	Required, Format: date-time
message	string	—	Required, maxLength: 32768
observedGeneration	integer	—	Optional, Format: int64, minimum: 0
reason	string	—	Required, minLength: 1, maxLength: 1024, pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
status	string	—	Required, Enum: True \| False \| Unknown
type	string	—	Required, maxLength: 316, pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$

ConsumeRoute

ConsumeRoute is the Schema for the consumeroutes API

Group: gateway.cp.ei.telekom.de · Version: v1 · Scope: Namespaced

ConsumeRouteSpec

Appears in: ConsumeRoute

ConsumeRouteSpec defines the desired state of ConsumeRoute

Field	Type	Default	Validation
consumerName	string	—	Required
route	ObjectRef	—	Required
security	ConsumeRouteSecurity	—	Optional
traffic	Traffic	—	Optional

ConsumeRouteSecurity

Appears in: ConsumeRouteSpec

Field	Type	Default	Validation
m2m	M2M	—	Optional

M2M

Appears in: ConsumeRouteSecurity

M2M defines machine-to-machine authentication configuration

Field	Type	Default	Validation
basic	Basic	—	Optional
client	Client	—	Optional
scopes	string[]	—	Optional, maxItems: 10

Basic

Appears in: M2M, RouteM2M, ExternalIDP

Basic defines basic authentication configuration

Field	Type	Default	Validation
password	string	—	Required, minLength: 1
username	string	—	Required, minLength: 1

Client

Appears in: M2M, ExternalIDP

Client defines client credentials for OAuth2

Field	Type	Default	Validation
clientId	string	—	Required, minLength: 1
clientKey	string	—	Optional
clientSecret	string	—	Optional

Traffic

Appears in: ConsumeRouteSpec

Field	Type	Default	Validation
rateLimit	RateLimit	—	Optional

RateLimit

Appears in: Traffic

RateLimit defines the rate limit configuration for the ConsumeRoute

Field	Type	Default	Validation
limits	Limits	—	Required

Limits

Appears in: RateLimit, RouteRateLimit

Limits defines the actual rate limit values for different time windows

Field	Type	Default	Validation
hour	integer	—	Optional, minimum: 0
minute	integer	—	Optional, minimum: 0
second	integer	—	Optional, minimum: 0

Gateway

Gateway is the Schema for the gateways API

Group: gateway.cp.ei.telekom.de · Version: v1 · Scope: Namespaced

GatewaySpec

Appears in: Gateway

GatewaySpec defines the desired state of Gateway

Field	Type	Default	Validation
admin	Admin	—	Optional
features	string[]	—	Optional
redis	Redis	—	Optional

Admin

Appears in: GatewaySpec

Field	Type	Default	Validation
clientId	string	—	Required
clientSecret	string	—	Required
issuerUrl	string	—	Required
url	string	—	Required

Redis

Appears in: GatewaySpec

Field	Type	Default	Validation
enableTLS	boolean	—	Required
host	string	—	Required
password	string	—	Required
port	integer	—	Required

GatewayStatus

Appears in: Gateway

GatewayStatus defines the observed state of Gateway

Field	Type	Default	Validation
conditions	Condition[]	—	Optional

Realm

Realm is the Schema for the realms API

Group: gateway.cp.ei.telekom.de · Version: v1 · Scope: Namespaced

RealmSpec

Appears in: Realm

RealmSpec defines the desired state of Realm

Field	Type	Default	Validation
defaultConsumers	string[]		Required
gateway	ObjectRef	—	Optional
issuerUrls	string[]	—	Required, minItems: 1
urls	string[]	—	Required, minItems: 1

RealmStatus

Appears in: Realm

RealmStatus defines the observed state of Realm

Field	Type	Default	Validation
certsRoute	ObjectRef	—	Optional
certsUrl	string	—	Optional
conditions	Condition[]	—	Optional
discoveryRoute	ObjectRef	—	Optional
discoveryUrl	string	—	Optional
issuerRoute	ObjectRef	—	Optional
issuerUrl	string	—	Optional
virtual	boolean	—	Required

Route

Route is the Schema for the routes API

Group: gateway.cp.ei.telekom.de · Version: v1 · Scope: Namespaced

RouteSpec

Appears in: Route

RouteSpec defines the desired state of Route

Field	Type	Default	Validation
buffering	Buffering	—	Optional
downstreams	Downstream[]	—	Required, minItems: 1
passThrough	boolean	false	Required
realm	ObjectRef	—	Required
security	RouteSecurity	—	Optional
traffic	RouteTraffic	—	Required
transformation	Transformation	—	Optional
upstreams	Upstream[]	—	Required, minItems: 1

Buffering

Appears in: RouteSpec

Buffering configures Kong request/response body buffering for this route

Field	Type	Default	Validation
disableRequestBuffering	boolean	false	Optional
disableResponseBuffering	boolean	false	Optional

Downstream

Appears in: RouteSpec

Field	Type	Default	Validation
host	string	—	Required
issuerUrl	string	—	Optional
path	string	—	Required
port	integer	—	Required

RouteSecurity

Appears in: RouteSpec, Failover

Security is the security configuration for the route

Field	Type	Default	Validation
defaultConsumers	string[]	—	Optional
disableAccessControl	boolean	false	Optional
m2m	RouteM2M	—	Optional

RouteM2M

Appears in: RouteSecurity

M2M defines machine-to-machine authentication configuration

Field	Type	Default	Validation
basic	Basic	—	Optional
externalIDP	ExternalIDP	—	Optional
scopes	string[]	—	Optional, maxItems: 10

ExternalIDP

Appears in: RouteM2M

ExternalIDP defines external identity provider configuration

Field	Type	Default	Validation
basic	Basic	—	Optional
client	Client	—	Optional
grantType	string	—	Optional, Enum: client_credentials \| authorization_code \| password
tokenEndpoint	string	—	Required, Format: uri
tokenRequest	string	—	Optional, Enum: body \| header

RouteTraffic

Appears in: RouteSpec

Field	Type	Default	Validation
circuitBreaker	CircuitBreaker	—	Optional
dynamicUpstream	DynamicUpstream	—	Optional
failover	Failover	—	Optional
rateLimit	RouteRateLimit	—	Optional

CircuitBreaker

Appears in: RouteTraffic

Field	Type	Default	Validation
enabled	boolean	—	Optional

DynamicUpstream

Appears in: RouteTraffic

DynamicUpstream configures runtime upstream URL resolution. When set, the gateway resolves the actual upstream target from a request query parameter instead of using the static upstream.

Field	Type	Default	Validation
queryParameter	string	—	Required, minLength: 1, pattern: ^[a-zA-Z0-9_-]+$

Failover

Appears in: RouteTraffic

Field	Type	Default	Validation
security	RouteSecurity	—	Optional
targetZoneName	string	—	Required
upstreams	Upstream[]	—	Required

Upstream

Appears in: Failover, RouteSpec

Field	Type	Default	Validation
clientId	string	—	Optional
clientSecret	string	—	Optional
host	string	—	Required
issuerUrl	string	—	Optional
path	string	—	Required
port	integer	—	Required
scheme	string	—	Required
weight	integer	—	Optional

RouteRateLimit

Appears in: RouteTraffic

RateLimit defines rate limits for different time windows

Field	Type	Default	Validation
limits	Limits	—	Required
options	Options	—	Optional

Options

Appears in: RouteRateLimit

Options defines additional configuration options for rate limiting

Field	Type	Default	Validation
faultTolerant	boolean	true	Optional
hideClientHeaders	boolean	false	Optional

Transformation

Appears in: RouteSpec

Transformation defines optional request/response transformations for this API

Field	Type	Default	Validation
request	Request	—	Optional

Request

Appears in: Transformation

Request defines transformations applied to incoming API requests

Field	Type	Default	Validation
headers	Headers	—	Optional

Headers

Appears in: Request

Headers defines HTTP header modifications for requests

Field	Type	Default	Validation
add	string[]	—	Optional, minItems: 1, maxItems: 5
remove	string[]	—	Optional, minItems: 1, maxItems: 5

RouteStatus

Appears in: Route

RouteStatus defines the observed state of Route

Field	Type	Default	Validation
conditions	Condition[]	—	Optional
consumers	string[]	—	Optional
properties	map<string, string>	—	Optional

Feature Architecture

The Gateway operator uses a plugin-based feature system for configuring route behavior:

Feature	Description
PassThrough	Basic request forwarding.
AccessControl	Consumer-based access control.
RateLimit	Request rate limiting via Redis.
ExternalIDP	External identity provider authentication.
CustomScopes	Fine-grained OAuth2 scope enforcement.
LastMileSecurity	End-to-end security in cross-mesh scenarios.

Domain Interactions

• Admin domain — Zones define which gateway instance to use.
• API domain — Creates Routes for exposed APIs and ConsumeRoutes for subscriptions.
• Application domain — Creates Consumers for applications.
• Organization domain — Creates Consumers for teams.
• Event domain — Creates Routes for event publishing and SSE delivery.
• Rover domain — Configures rate limiting and load balancing via traffic management settings.

Related Pages

• Architecture: API Domain
• Architecture: Identity Domain