Apply Plugins to L4 Routes

Attach APISIX stream plugins to Gateway API TCPRoute, UDPRoute, and TLSRoute resources by configuring and verifying an L4RoutePolicy.

Applies to:API7 Ingress Controller (drives API7 Gateway)APISIX Ingress Controller (drives Apache APISIX)

Goal

Attach a stream plugin to a Gateway API L4 route using an L4RoutePolicy and verify that the policy enforces the plugin rules.

Before you begin

Complete Proxy TCP Traffic by Port using the Gateway API tab. The example creates the stream-route-mysql TCPRoute in the aic namespace.
Verify that you can connect to the MySQL backend before applying the policy.
You have kubectl configured against the cluster used in the setup guide.

Set the variables this guide uses:

export TCP_ROUTE_NAME="stream-route-mysql"
export POLICY_NAME="block-mysql-connections"
export POLICY_NAMESPACE="aic"
export GATEWAY_TCP_PORT="9100"
export MYSQL_USER="root"

Steps

Step 1: Create the L4RoutePolicy

Create a manifest for an L4RoutePolicy that attaches the ip-restriction stream plugin to the existing TCPRoute. The blacklist in this example blocks all IPv4 client addresses:

l4-route-policy.yaml

apiVersion: apisix.apache.org/v1alpha1
kind: L4RoutePolicy
metadata:
  name: block-mysql-connections
  namespace: aic
spec:
  targetRefs:
  - group: gateway.networking.k8s.io
    kind: TCPRoute
    name: stream-route-mysql
  plugins:
  - name: ip-restriction
    config:
      blacklist:
      - 0.0.0.0/0

Apply the policy:

kubectl apply -f l4-route-policy.yaml

Validate

Check the status of the L4RoutePolicy:

kubectl get l4routepolicy ${POLICY_NAME} -n ${POLICY_NAMESPACE} \
  -o jsonpath='{.status.ancestors[0].conditions[0].type}{"\t"}{.status.ancestors[0].conditions[0].status}{"\t"}{.status.ancestors[0].conditions[0].reason}'

Expected output:

Accepted	True	Accepted

Try to connect to MySQL through the gateway again:

mysqlsh --sqlc --host=127.0.0.1 --port=${GATEWAY_TCP_PORT} --user=${MYSQL_USER} --password

The connection should fail because the ip-restriction plugin rejects the client address.

Roll back / Clean up

Delete the L4RoutePolicy:

kubectl delete l4routepolicy ${POLICY_NAME} -n ${POLICY_NAMESPACE}

Confirm that the MySQL connection works again:

mysqlsh --sqlc --host=127.0.0.1 --port=${GATEWAY_TCP_PORT} --user=${MYSQL_USER} --password

To remove the MySQL deployment and TCPRoute, follow the cleanup steps in Proxy TCP Traffic by Port.

Troubleshoot

Symptom	Cause	Fix
The policy status is not `Accepted=True`.	The `targetRefs` name or kind does not match an L4 route in the same namespace.	Confirm `TCP_ROUTE_NAME` exists in namespace `aic` and that `kind` is `TCPRoute` with `group: gateway.networking.k8s.io`.
MySQL still connects after the policy is applied.	The policy has not been synchronized, or the `ip-restriction` plugin is not in the stream plugin list.	Wait a few seconds, check the policy status, and verify the plugin name is `ip-restriction`.
MySQL cannot connect after the policy is deleted.	The gateway still has a cached connection or the route was also removed.	Check that only the `L4RoutePolicy` was deleted and that the `TCPRoute` still exists.