Service

API Group: compute.apoxy.dev/v1alpha1

Operations

List Service

GET/apis/compute.apoxy.dev/v1alpha1/services

List Service

Response

200: OK

Create Service

POST/apis/compute.apoxy.dev/v1alpha1/services

Create a Service

Request Body

Spec fields (ServiceSpec):

Field	Type	Description
`liveRevision`	string	LiveRevision selects which ServiceRevision serves: - empty: auto — the latest ready revision is served (continuous deploy for push, auto-promote for git). The served name is reported in status.liveRevision; the controller never writes this field. - set: pinned — exactly the named revision is served (rollback, or manual git promotion). New revisions are still minted but do not go live until this is repointed. The target must still be retained (see RevisionHistoryLimit).
`revisionHistoryLimit`	integer (int32)	RevisionHistoryLimit defaults to 10.
`source`	ServiceSource	Source is where the service's bundle comes from. Exactly one variant: a directly-pushed OCI bundle (oci) or a git/CI pipeline (git). The resolved digest always lands in the minted ServiceRevision.spec.bundle. (required)
`template`	ServiceTemplateSpec	Template is the desired serving config for the next minted revision. Always user-owned. A change to Template mints a ServiceRevision. (required)

Response

200: OK
201: Created
202: Accepted

Delete All Service

DELETE/apis/compute.apoxy.dev/v1alpha1/services

Delete collection of Service

Response

200: OK

Get Service

GET/apis/compute.apoxy.dev/v1alpha1/services/{name}

Get the specified Service

Response

200: OK

Replace Service

PUT/apis/compute.apoxy.dev/v1alpha1/services/{name}

Replace the specified Service

Request Body

Spec fields (ServiceSpec):

Field	Type	Description
`liveRevision`	string	LiveRevision selects which ServiceRevision serves: - empty: auto — the latest ready revision is served (continuous deploy for push, auto-promote for git). The served name is reported in status.liveRevision; the controller never writes this field. - set: pinned — exactly the named revision is served (rollback, or manual git promotion). New revisions are still minted but do not go live until this is repointed. The target must still be retained (see RevisionHistoryLimit).
`revisionHistoryLimit`	integer (int32)	RevisionHistoryLimit defaults to 10.
`source`	ServiceSource	Source is where the service's bundle comes from. Exactly one variant: a directly-pushed OCI bundle (oci) or a git/CI pipeline (git). The resolved digest always lands in the minted ServiceRevision.spec.bundle. (required)
`template`	ServiceTemplateSpec	Template is the desired serving config for the next minted revision. Always user-owned. A change to Template mints a ServiceRevision. (required)

Response

200: OK
201: Created

Update Service

PATCH/apis/compute.apoxy.dev/v1alpha1/services/{name}

Partially update the specified Service

Response

200: OK
201: Created

Delete Service

DELETE/apis/compute.apoxy.dev/v1alpha1/services/{name}

Delete a Service

Response

200: OK
202: Accepted

Schema Reference

ServiceSource

Field	Type	Description
`git`	GitSource	Git is a git/CI build pipeline (git model). Builds produce the digest and mint revisions.
`oci`	BundleRef	OCI is a directly-pushed OCI bundle (push model). The controller resolves its tag to a digest and mints a revision pinned to that digest.

GitSource

Field	Type	Description
`build`	BuildConfig	(required)
`credentialsRef`	OCICredentialsRef
`previews`	PreviewPolicy
`triggers`	Triggers	(required)
`url`	string	URL of the git repository. (required)

BuildConfig

Field	Type	Description
`builder`	string	Builder image used to produce the bundle (e.g. an image wrapping wrangler/esbuild).
`command`	string[]	Command overrides the builder default build command.
`env`	EnvVar[]
`output`	BundleRef	Output is where built bundles are pushed. The per-build digest lands in Build.Status. (required)
`rootDir`	string	RootDir within the repo, default ".".

EnvVar

Field	Type	Description
`name`	string	(required)
`value`	string	(required)

BundleRef

Field	Type	Description
`credentials`	OCICredentials	Only one of Credentials or CredentialsRef may be set.
`credentialsRef`	OCICredentialsRef
`digest`	string	Digest pins the exact artifact, e.g. "sha256:...". Strongly preferred: the serving path is digest-addressed and immutable.
`repo`	string	Repo is the OCI repository, e.g. "registry.apoxy.dev/acme/api". (required)
`tag`	string	Tag is resolved to a Digest by the controller if Digest is unset.

OCICredentials

Field	Type	Description
`accessToken`	string	AccessToken is a registry bearer token sent as-is (Authorization: Bearer), skipping the token-service exchange.
`password`	string	Password is the write-only plain-text form; use PasswordData when authoring programmatically.
`passwordData`	string	PasswordData is the RAW password bytes. NOT base64 of the password (unlike the extensions API field of the same name) — JSON's []byte encoding already handles the transport encoding. Takes precedence over Password when both are set.
`refreshToken`	string	RefreshToken is an OAuth2 refresh token (docker's "identity token") exchanged with the registry's token service for access tokens.
`username`	string

OCICredentialsRef

Field	Type	Description
`group`	string	(required)
`name`	string	(required)
`namespace`	string	(required)

PreviewPolicy

Field	Type	Description
`enabled`	boolean	Enabled spawns ephemeral preview Services (owned by this Service) per non-production branch / PR. (required)
`ttl`	Duration	TTL after which idle previews are garbage-collected.

Triggers

Field	Type	Description
`onPullRequest`	boolean	OnPullRequest enables preview builds for PR branches.
`paths`	string[]	Paths, if set, restricts triggering to changes under these globs.
`productionBranch`	string	ProductionBranch is built+promoted on push. Default "main".

ServiceTemplateSpec

Field	Type	Description
`spec`	ServiceConfigSpec	(required)

ServiceConfigSpec

Field	Type	Description
`backend`	BackendConfig	Backend selects backend mode and its settings; this is the default mode when neither member is set.
`bindings`	Binding[]
`egress`	ServiceEgress	Egress selects how outbound network traffic is mediated. Absent means the project "default" egress gateway (egress on by default); see ServiceEgress for the full semantics and the disabled opt-out.
`env`	EnvVar[]
`filter`	FilterConfig	Filter selects filter mode and its settings.
`runtime`	ServiceRuntime

BackendConfig

Field	Type	Description
`port`	integer (int32)	Port is only meaningful for tcp/udp; ignored for http1/http2.
`protocol`	string

Binding

Field	Type	Description
`kv`	KVBinding
`name`	string	Name is the identifier exposed to service code (env.<Name>). (required)
`secret`	SecretBinding
`service`	ServiceBinding
`type`	string	(required)

KVBinding

Field	Type	Description
`namespace`	string	Namespace identifies the KV store partition (a store name, not a k8s namespace). (required)

SecretBinding

Field	Type	Description
`key`	string	Key within the store's values map. (required)
`store`	string	Store names the SecretStore (cluster-scoped, same project). (required)

ServiceBinding

Field	Type	Description
`serviceRef`	string	(required)

ServiceEgress

Field	Type	Description
`disabled`	boolean	Disabled hard-denies all egress for this service (globalOutbound is unset in workerd and the sandbox netstack resets any outbound attempt). Mutually exclusive with a non-empty gatewayRef.
`gatewayRef`	string	GatewayRef names the compute.apoxy.dev EgressGateway that mediates this service's outbound traffic. Empty means the project "default" gateway. Existence is not validated at admission; a dangling ref surfaces as the EgressReady=False condition on Service status.

FilterConfig

Field	Type	Description
`failureMode`	string
`phase`	string

ServiceRuntime

Field	Type	Description
`compatibilityDate`	string	CompatibilityDate is required by workerd; pinned per revision. (required)
`compatibilityFlags`	string[]
`limits`	ServiceLimits
`timeout`	Duration	Timeout is the wall-clock request timeout. Default 30s.

ServiceLimits

Field	Type	Description
`cpuTime`	Duration	CPUTime is the per-request CPU budget (workerd-style), e.g. "50ms".
`memory`	string	Memory cap, e.g. "128Mi".