ServiceRevision

API Group: compute.apoxy.dev/v1alpha1

Operations

List ServiceRevision

GET/apis/compute.apoxy.dev/v1alpha1/servicerevisions

List ServiceRevision

Response

200: OK

Create ServiceRevision

POST/apis/compute.apoxy.dev/v1alpha1/servicerevisions

Create a ServiceRevision

Request Body

Spec fields (ServiceRevisionSpec):

Field	Type	Description
`backend`	BackendConfig	Backend selects backend mode and its settings; this is the default mode when neither member is set.
`bindings`	Binding[]
`bundle`	BundleRef	Bundle is the resolved OCI artifact this revision runs. It is always digest-pinned and is set by the controller when minting the revision from spec.source; it is never user-authored. (required)
`egress`	ServiceEgress	Egress selects how outbound network traffic is mediated. Absent means the project "default" egress gateway (egress on by default); see ServiceEgress for the full semantics and the disabled opt-out.
`env`	EnvVar[]
`filter`	FilterConfig	Filter selects filter mode and its settings.
`runtime`	ServiceRuntime

Response

200: OK
201: Created
202: Accepted

Delete All ServiceRevision

DELETE/apis/compute.apoxy.dev/v1alpha1/servicerevisions

Delete collection of ServiceRevision

Response

200: OK

Get ServiceRevision

GET/apis/compute.apoxy.dev/v1alpha1/servicerevisions/{name}

Get the specified ServiceRevision

Response

200: OK

Replace ServiceRevision

PUT/apis/compute.apoxy.dev/v1alpha1/servicerevisions/{name}

Replace the specified ServiceRevision

Request Body

Spec fields (ServiceRevisionSpec):

Field	Type	Description
`backend`	BackendConfig	Backend selects backend mode and its settings; this is the default mode when neither member is set.
`bindings`	Binding[]
`bundle`	BundleRef	Bundle is the resolved OCI artifact this revision runs. It is always digest-pinned and is set by the controller when minting the revision from spec.source; it is never user-authored. (required)
`egress`	ServiceEgress	Egress selects how outbound network traffic is mediated. Absent means the project "default" egress gateway (egress on by default); see ServiceEgress for the full semantics and the disabled opt-out.
`env`	EnvVar[]
`filter`	FilterConfig	Filter selects filter mode and its settings.
`runtime`	ServiceRuntime

Response

200: OK
201: Created

Update ServiceRevision

PATCH/apis/compute.apoxy.dev/v1alpha1/servicerevisions/{name}

Partially update the specified ServiceRevision

Response

200: OK
201: Created

Delete ServiceRevision

DELETE/apis/compute.apoxy.dev/v1alpha1/servicerevisions/{name}

Delete a ServiceRevision

Response

200: OK
202: Accepted

Schema Reference

BackendConfig

Field	Type	Description
`port`	integer (int32)	Port is only meaningful for tcp/udp; ignored for http1/http2.
`protocol`	string

Binding

Field	Type	Description
`kv`	KVBinding
`name`	string	Name is the identifier exposed to service code (env.<Name>). (required)
`secret`	SecretBinding
`service`	ServiceBinding
`type`	string	(required)

KVBinding

Field	Type	Description
`namespace`	string	Namespace identifies the KV store partition (a store name, not a k8s namespace). (required)

SecretBinding

Field	Type	Description
`key`	string	Key within the store's values map. (required)
`store`	string	Store names the SecretStore (cluster-scoped, same project). (required)

ServiceBinding

Field	Type	Description
`serviceRef`	string	(required)

BundleRef

Field	Type	Description
`credentials`	OCICredentials	Only one of Credentials or CredentialsRef may be set.
`credentialsRef`	OCICredentialsRef
`digest`	string	Digest pins the exact artifact, e.g. "sha256:...". Strongly preferred: the serving path is digest-addressed and immutable.
`repo`	string	Repo is the OCI repository, e.g. "registry.apoxy.dev/acme/api". (required)
`tag`	string	Tag is resolved to a Digest by the controller if Digest is unset.

OCICredentials

Field	Type	Description
`accessToken`	string	AccessToken is a registry bearer token sent as-is (Authorization: Bearer), skipping the token-service exchange.
`password`	string	Password is the write-only plain-text form; use PasswordData when authoring programmatically.
`passwordData`	string	PasswordData is the RAW password bytes. NOT base64 of the password (unlike the extensions API field of the same name) — JSON's []byte encoding already handles the transport encoding. Takes precedence over Password when both are set.
`refreshToken`	string	RefreshToken is an OAuth2 refresh token (docker's "identity token") exchanged with the registry's token service for access tokens.
`username`	string

OCICredentialsRef

Field	Type	Description
`group`	string	(required)
`name`	string	(required)
`namespace`	string	(required)

ServiceEgress

Field	Type	Description
`disabled`	boolean	Disabled hard-denies all egress for this service (globalOutbound is unset in workerd and the sandbox netstack resets any outbound attempt). Mutually exclusive with a non-empty gatewayRef.
`gatewayRef`	string	GatewayRef names the compute.apoxy.dev EgressGateway that mediates this service's outbound traffic. Empty means the project "default" gateway. Existence is not validated at admission; a dangling ref surfaces as the EgressReady=False condition on Service status.

EnvVar

Field	Type	Description
`name`	string	(required)
`value`	string	(required)

FilterConfig

Field	Type	Description
`failureMode`	string
`phase`	string

ServiceRuntime

Field	Type	Description
`compatibilityDate`	string	CompatibilityDate is required by workerd; pinned per revision. (required)
`compatibilityFlags`	string[]
`limits`	ServiceLimits
`timeout`	Duration	Timeout is the wall-clock request timeout. Default 30s.

ServiceLimits

Field	Type	Description
`cpuTime`	Duration	CPUTime is the per-request CPU budget (workerd-style), e.g. "50ms".
`memory`	string	Memory cap, e.g. "128Mi".