Apply Plugins to L4 Routes

L4RoutePolicy attaches APISIX stream plugins to Gateway API TCP, UDP, and TLS routes. This guide applies an IP restriction to a TCPRoute and verifies that the policy blocks connections.

Prerequisites

1. Complete Proxy TCP Traffic by Port using the Gateway API tab. The example creates the stream-route-mysql TCPRoute in the aic namespace.
2. Verify that you can connect to the MySQL backend before applying the policy.

Apply a Stream Plugin

Create an L4RoutePolicy that attaches the ip-restriction stream plugin to stream-route-mysql. The blacklist in this example blocks all IPv4 client addresses:

apiVersion: apisix.apache.org/v1alpha1
kind: L4RoutePolicy
metadata:
  name: block-mysql-connections
  namespace: aic
spec:
  targetRefs:
  - group: gateway.networking.k8s.io
    kind: TCPRoute
    name: stream-route-mysql
  plugins:
  - name: ip-restriction
    config:
      blacklist:
      - 0.0.0.0/0

Apply the policy:

kubectl apply -f l4-route-policy.yaml

Verify the Policy

Check the policy status:

kubectl get l4routepolicy block-mysql-connections -n aic \
  -o jsonpath='{range .status.ancestors[*].conditions[*]}{.type}{"="}{.status}{" ("}{.reason}{")\n"}{end}'

The accepted policy should report:

Accepted=True (Accepted)

Try to connect to MySQL again:

mysqlsh --sqlc --host=127.0.0.1 --port=9100 --user=root --password

The connection should fail because the plugin rejects the client address.

Delete the policy and confirm that the connection succeeds again:

kubectl delete l4routepolicy block-mysql-connections -n aic

Policy Attachment Rules

• A policy can target TCPRoute, UDPRoute, or TLSRoute resources in the same namespace as the policy.
• targetRefs must use the gateway.networking.k8s.io group. One policy can contain between 1 and 16 target references.
• L4 routes do not expose addressable sections. A target reference with sectionName does not attach.
• Only APISIX stream plugins are valid. For example, use ip-restriction or limit-conn; HTTP-only plugins cannot run on L4 routes.
• If multiple policies target the same route, the oldest policy is applied. Later policies report Accepted=False with the Conflicted reason.