GatewayBackend

A GatewayBackend represents a generic HTTP backend, typically corresponding to an off-cluster resource.

Kind and version: gateway.linkerd.io/v1alpha1
Short name: gwbe

Example #

apiVersion: gateway.linkerd.io/v1alpha1
kind: GatewayBackend
metadata:
  name: databricks
  namespace: default
spec:
  baseURL: https://my-workspace.cloud.databricks.com/
  auth:
    type: ApiKey
    apiKey:
      secretRef:
        name: databricks-key
        key: api-key
      header: Authorization
      prefix: "Bearer "

Specification #

Field	Type	Required	Default
`baseURL`	string, `^https?://`	yes	—
`auth.type`	`None` \| `ApiKey` \| `OAuth2`	yes, if `auth` set	—

baseURL #

Base URL, without path prefix.

Authentication #

ApiKey #

Field	Required	Default
`apiKey.secretRef.name`	yes	—
`apiKey.secretRef.key`	yes	—
`apiKey.secretRef.namespace`	no	this namespace; requires a `ReferenceGrant`
`apiKey.header`	no	`Authorization`
`apiKey.prefix`	no	`Bearer` (note the trailing space)

OAuth2 #

RFC 6749 §4.4 client-credentials grant.

Field	Required	Default
`oauth2.tokenURL`	yes	—
`oauth2.clientID`	yes	—
`oauth2.clientSecretRef`	yes	—
`oauth2.scopes`	no (≤32)	—
`oauth2.clientAuthMethod`	no	`ClientSecretBasic`
`oauth2.audience`	no	—
`oauth2.extraParams`	no	—

tokenURL is stated explicitly and never derived from baseURL.

clientAuthMethod exists because RFC 6749 §2.3.1 says servers MUST accept Basic and MAY accept form-body credentials, and identity providers differ in practice.