Kubernetes
The kubernetes section enables the in-process Kubernetes controller. When enabled, the gateway
programs its router from the Kubernetes Gateway API and Octopus CRDs. The block is optional and the
controller is disabled by default. For deployment guidance, see the Kubernetes
section.
kubernetes:
enabled: true
gateway_class: octopus
watch_namespaces: [team-a, team-b]
leader_election: true
terminate_tls: falsekubernetes01
| Key | Type | Default | Description |
enabled | boolean | false | Run the in-process Kubernetes controller. |
gateway_class | string | octopus | GatewayClass name this instance reconciles (controllerName gateway.octopus.io/gateway-controller). |
watch_namespaces | array of string | [] | Namespaces to watch. Empty means all namespaces. |
leader_election | boolean | true | Use a coordination.k8s.io/v1 Lease so only one replica writes resource status when scaled out. |
terminate_tls | boolean | false | Terminate TLS on the listener using certificates from HTTPS Gateway listeners' tls.certificateRefs Secrets (hot-reloaded). Opt-in; ignored when static gateway.tls is set. When enabled, the listen port serves HTTPS (SNI), not plain HTTP. |
terminate_tls is ignored when static gateway.tls is configured.
Choose one TLS source: static gateway certificates or operator-managed Secrets.
Status conditions02
After reconciling a resource the controller writes an Accepted condition to its
.status, so kubectl get -o yaml and kubectl wait --for=condition=Accepted work
against Octopus resources:
OctopusRoute/OctopusUpstream/OctopusPolicy— admitted resources getAccepted: True(reasonAccepted); structurally invalid ones (e.g. a route missing itspath/upstream, an upstream with no targets) getAccepted: False(reasonInvalid, with the failure in the message) and are not applied to the router.GatewayClass— classes whosespec.controllerNameisgateway.octopus.io/gateway-controllerare claimed withAccepted: True; classes owned by other controllers are left untouched.
Each condition carries the observedGeneration it was computed from. Writing status
requires the */status RBAC verbs (and gatewayclasses/status) in the bundled
Helm chart and manifests. With leader_election on, only the Lease
holder reconciles and writes status; pod identity comes from the POD_NAME /
POD_NAMESPACE downward-API env the manifests set.