EgressL4Route

API Group: clrk.apoxy.dev/v1alpha1

Operations

List EgressL4Route

GET/apis/clrk.apoxy.dev/v1alpha1/egressl4routes

List EgressL4Route

Response

200: OK

List EgressL4Route

GET/apis/clrk.apoxy.dev/v1alpha1/namespaces/{namespace}/egressl4routes

List EgressL4Route

Response

200: OK

Create EgressL4Route

POST/apis/clrk.apoxy.dev/v1alpha1/namespaces/{namespace}/egressl4routes

create an EgressL4Route

Request Body

Spec fields (EgressL4RouteSpec):

Field	Type	Description
`parentRefs`	ParentReference[]	ParentRefs attaches to EgressGateway TCP or UDP listeners. (required)
`rules`	EgressL4RouteRule[]	(required)

Response

200: OK
201: Created
202: Accepted

Delete All EgressL4Route

DELETE/apis/clrk.apoxy.dev/v1alpha1/namespaces/{namespace}/egressl4routes

Delete collection of EgressL4Route

Response

200: OK

Get EgressL4Route

GET/apis/clrk.apoxy.dev/v1alpha1/namespaces/{namespace}/egressl4routes/{name}

Get the specified EgressL4Route

Response

200: OK

Replace EgressL4Route

PUT/apis/clrk.apoxy.dev/v1alpha1/namespaces/{namespace}/egressl4routes/{name}

Replace the specified EgressL4Route

Request Body

Spec fields (EgressL4RouteSpec):

Field	Type	Description
`parentRefs`	ParentReference[]	ParentRefs attaches to EgressGateway TCP or UDP listeners. (required)
`rules`	EgressL4RouteRule[]	(required)

Response

200: OK
201: Created

Update EgressL4Route

PATCH/apis/clrk.apoxy.dev/v1alpha1/namespaces/{namespace}/egressl4routes/{name}

Partially update the specified EgressL4Route

Response

200: OK
201: Created

Delete EgressL4Route

DELETE/apis/clrk.apoxy.dev/v1alpha1/namespaces/{namespace}/egressl4routes/{name}

delete an EgressL4Route

Response

200: OK
202: Accepted

Schema Reference

EgressL4RouteRule

Field	Type	Description
`backendRefs`	BackendRef[]	BackendRefs optionally routes through an explicit proxy. Empty = passthrough to original destination.
`filters`	L4RouteFilter[]	Filters — ExtensionRef to LoggingPolicy, RateLimitPolicy, etc.
`matches`	L4RouteMatch[]

L4RouteFilter

Field	Type	Description
`extensionRef`	LocalObjectReference
`type`	string	(required)

L4RouteMatch

Field	Type	Description
`destinationCIDRs`	string[]	DestinationCIDRs matches by IP range. Single IPs as /32 or /128. IPv4 and IPv6 CIDRs are both honored.
`destinationHostnames`	string[]	DestinationHostnames matches by hostname. Exact (`api.openai.com`) and wildcard (`*.openai.com`) forms are accepted (gwapiv1.Hostname semantics — wildcard matches exactly one prefix label). On TLS-terminated listeners (protocol=TLS or HTTPS with mode=Terminate) the match runs against the SNI value the tls_inspector recorded on the connection. On plain TCP listeners the match runs against the DNS-bound destination name: the worker snoops UDP/53 responses, caches each `(resolved IP) → name` binding, and emits the hostname for the connection's destination IP via PROXY v2 TLVDstName so Envoy and L4 ext_proc records pick it up. Limitation: encrypted resolvers (DoT on TCP/853, DoH on TCP/443) bypass the snoop. Connections from agents that use those resolvers fall back to CIDR-only matching — no error, just no name binding. Use the kernel resolver (default) to guarantee hostname rules apply.
`ports`	L4PortMatch[]	Ports restricts to specific destination ports or port ranges.
`protocol`	string	Protocol selects TCP or UDP. Must be compatible with the parent listener's protocol. If unset, inherits from the listener.
`sourceAgents`	LabelSelector	SourceAgents narrows the match to traffic from specific Agent CRs.

L4PortMatch

Field	Type	Description
`endPort`	integer (int32)
`port`	integer (int32)	Port matches a single port.
`startPort`	integer (int32)	StartPort + EndPort define an inclusive range. Both must be set together. Mutually exclusive with Port.