# EgressGateway

> API reference for Egress Gateways (compute.apoxy.dev/v1alpha1)

**API Group:** `compute.apoxy.dev/v1alpha1`

## Operations

### List EgressGateway

<APIEndpoint method="GET" path="/apis/compute.apoxy.dev/v1alpha1/egressgateways" />

List EgressGateway

**Response**

- `200`: OK

---

### Create EgressGateway

<APIEndpoint method="POST" path="/apis/compute.apoxy.dev/v1alpha1/egressgateways" />

create an EgressGateway

**Request Body**

Spec fields (`EgressGatewaySpec`):

| Field | Type | Description |
| --- | --- | --- |
| `defaultPolicy` | string | DefaultPolicy applies to traffic that matches no attached route. Defaults to deny-all: an explicitly created gateway fails closed. (The implicit built-in "default" gateway — which exists only when no object named "default" does — is allow-all; see DefaultEgressGatewayName.) |
| `listeners` | [EgressListener](#egresslistener)[] | Listeners declare interception capabilities by protocol layer. Routes attach to a specific listener by name via parentRef.sectionName. **(required)** |

**Response**

- `200`: OK
- `201`: Created
- `202`: Accepted

---

### Delete All EgressGateway

<APIEndpoint method="DELETE" path="/apis/compute.apoxy.dev/v1alpha1/egressgateways" />

Delete collection of EgressGateway

**Response**

- `200`: OK

---

### Get EgressGateway

<APIEndpoint method="GET" path="/apis/compute.apoxy.dev/v1alpha1/egressgateways/{name}" />

Get the specified EgressGateway

**Response**

- `200`: OK

---

### Replace EgressGateway

<APIEndpoint method="PUT" path="/apis/compute.apoxy.dev/v1alpha1/egressgateways/{name}" />

Replace the specified EgressGateway

**Request Body**

Spec fields (`EgressGatewaySpec`):

| Field | Type | Description |
| --- | --- | --- |
| `defaultPolicy` | string | DefaultPolicy applies to traffic that matches no attached route. Defaults to deny-all: an explicitly created gateway fails closed. (The implicit built-in "default" gateway — which exists only when no object named "default" does — is allow-all; see DefaultEgressGatewayName.) |
| `listeners` | [EgressListener](#egresslistener)[] | Listeners declare interception capabilities by protocol layer. Routes attach to a specific listener by name via parentRef.sectionName. **(required)** |

**Response**

- `200`: OK
- `201`: Created

---

### Update EgressGateway

<APIEndpoint method="PATCH" path="/apis/compute.apoxy.dev/v1alpha1/egressgateways/{name}" />

Partially update the specified EgressGateway

**Response**

- `200`: OK
- `201`: Created

---

### Delete EgressGateway

<APIEndpoint method="DELETE" path="/apis/compute.apoxy.dev/v1alpha1/egressgateways/{name}" />

delete an EgressGateway

**Response**

- `200`: OK
- `202`: Accepted

---

## Schema Reference

### EgressListener

| Field | Type | Description |
| --- | --- | --- |
| `name` | string | Name identifies this listener within the gateway. **(required)** |
| `port` | integer (int32) | Port constrains interception to a single destination port. If unset, all ports are intercepted at this protocol layer. |
| `protocol` | string | Protocol selects the interception layer. **(required)** |
| `tls` | [EgressListenerTLS](#egresslistenertls) | TLS configures TLS handling. Only meaningful when protocol=TLS (Passthrough vs Terminate); forbidden for TCP/HTTP/HTTPS. |

### EgressListenerTLS

| Field | Type | Description |
| --- | --- | --- |
| `caCertRef` | [SecretKeyRef](#secretkeyref) | CACertRef names the SecretStore key holding the PEM-encoded CA certificate + key bundle used for on-the-fly certificate minting. Required when mode=Terminate; forbidden for Passthrough. |
| `mode` | string | Mode controls TLS handling.   Passthrough: SNI-route only, no termination.   Terminate:   MITM decrypt for L7 inspection, re-encrypt to upstream. |

### SecretKeyRef

| Field | Type | Description |
| --- | --- | --- |
| `key` | string | Key within the store's values map. **(required)** |
| `store` | string | Store names the SecretStore. **(required)** |

---

**Navigation** (Reference)

- Previous: [Build](/docs/reference/compute/builds.md)
- Next: [EgressRoute](/docs/reference/compute/egressroutes.md)
- All pages: [index](/docs/llms.txt)