GatewayClass¶

Overview¶

GatewayClass is a cluster-scoped resource defined by the infrastructure provider. This resource represents a class of Gateways that can be instantiated. You must apply GatewayClass only once in a cluster. GatewayClass is applied at the global level.

When you delete a GatewayClass Custom Resource (CR) from the cluster, the data plane configuration is also deleted. When you reapply the GatewayClass, the other related CRs may not work automatically. Delete and reapply all related CRs to restore them. Perform CR operations only when the controller is in a running state.

CR Parameters¶

The table below describes the supported GatewayClass CR spec parameters.

Parameters	Description	Implementation Details
`controllerName`	The name of the controller that manages the Gateways of this class. The value must be a domain-prefixed path. This is a mandatory field. For example, f5.com/`<namespaceofcontroller>`-f5-cne-controller	`<namespaceofcontroller>`: The namespace in which the CNE controller is installed.
`description`	Specifies the definition of GatewayClass. For example, F5 BIG-IP Kubernetes Gateway	As per the Gateway API community standard.

GatewayClass CR Status¶

The GatewayClass resource includes a supportedFeatures field in its status. This field lists all Gateway API features that the installed controller supports. You can use this field to discover supported features directly from the cluster. The supportedFeatures list is sorted in ascending alphabetical order as required by GEP-2162.

F5 BIG-IP Kubernetes Gateway (f5-cne-controller) populates the supportedFeatures field in GatewayClass status during controller initialization. The controller sets this field before or at the same time it accepts the GatewayClass.

Note

The supportedFeatures list contains only Gateway-related features. Mesh features are not included.

Supported features¶

Feature	Description
`BackendTLSPolicy`	Support for BackendTLSPolicy to configure TLS settings for connections from the gateway to backend services.
`Gateway`	Core Gateway resource support, including listener configuration and address management.
`GatewayAddressEmpty`	Support for Gateways that do not specify an explicit address.
`GatewayHTTPListenerIsolation`	Support for isolating HTTP listeners so that routes attached to one listener do not affect traffic on other listeners.
`GatewayPort8080`	Support for Gateway listeners on port 8080.
`GatewayStaticAddresses`	Support for assigning static addresses to Gateway resources.
`GRPCRoute`	Core GRPCRoute resource support, including service and method matching for gRPC over HTTP/2.
`GRPCRouteNamedRule`	Support for named rules within a GRPCRoute.
`HTTPRoute`	Core HTTPRoute resource support, including path, header, method, and query parameter matching.
`HTTPRouteBackendProtocolH2C`	Support for forwarding traffic to backends using cleartext HTTP/2 (h2c).
`HTTPRouteBackendProtocolWebSocket`	Support for forwarding WebSocket upgrade requests to backends.
`HTTPRouteCORS`	Support for Cross-Origin Resource Sharing (CORS) configuration through the HTTPRoute CORS filter.
`HTTPRouteDestinationPortMatching`	Support for matching requests based on the destination port.
`HTTPRouteHostRewrite`	Support for rewriting the HTTP `Host` header when forwarding requests to backends.
`HTTPRouteMethodMatching`	Support for matching requests based on the HTTP method (for example, GET, POST).
`HTTPRouteNamedRouteRule`	Support for named rules within an HTTPRoute.
`HTTPRouteParentRefPort`	Support for specifying a port in the `parentRef` of an HTTPRoute to target a specific listener.
`HTTPRoutePathRedirect`	Support for redirecting requests with a modified path.
`HTTPRoutePathRewrite`	Support for rewriting the request URI path when forwarding to backends.
`HTTPRoutePortRedirect`	Support for redirecting requests to a different port.
`HTTPRouteQueryParamMatching`	Support for matching requests based on query parameter values.
`HTTPRouteResponseHeaderModification`	Support for adding, setting, or removing HTTP response headers.
`HTTPRouteSchemeRedirect`	Support for redirecting requests from HTTP to HTTPS (or the reverse).
`HTTPRouteTimeoutBackendRequest`	Support for configuring per-rule backend request timeouts.
`HTTPRouteTimeoutRequest`	Support for configuring per-rule overall request timeouts.
`ReferenceGrant`	Support for cross-namespace references using ReferenceGrant. Allows routes to reference backends in other namespaces.
`TLSRoute`	Core TLSRoute resource support, including Server Name Indication (SNI)-based TLS passthrough routing to backend services.

View supported features

To view the features the installed GatewayClass supports, run:

$ kubectl get gatewayclass <gatewayclass-name> -o yaml

Replace <gatewayclass-name> with the name of your GatewayClass resource.

Example output:

apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: distribute-http-gateway-class
spec:
  controllerName: f5.com/default-f5-cne-controller
  description: F5 BIG-IP Kubernetes Gateway
status:
  conditions:
    - lastTransitionTime: "2026-07-21T09:01:17Z"
      message: ""
      observedGeneration: 1
      reason: Accepted
      status: "True"
      type: Accepted
  supportedFeatures:
    - name: BackendTLSPolicy
    - name: Gateway
    - name: GatewayAddressEmpty
    - name: GatewayHTTPListenerIsolation
    - name: GatewayPort8080
    - name: GatewayStaticAddresses
    - name: GRPCRoute
    - name: GRPCRouteNamedRule
    - name: HTTPRoute
    - name: HTTPRouteBackendProtocolH2C
    - name: HTTPRouteBackendProtocolWebSocket
    - name: HTTPRouteCORS
    - name: HTTPRouteDestinationPortMatching
    - name: HTTPRouteHostRewrite
    - name: HTTPRouteMethodMatching
    - name: HTTPRouteNamedRouteRule
    - name: HTTPRouteParentRefPort
    - name: HTTPRoutePathRedirect
    - name: HTTPRoutePathRewrite
    - name: HTTPRoutePortRedirect
    - name: HTTPRouteQueryParamMatching
    - name: HTTPRouteResponseHeaderModification
    - name: HTTPRouteSchemeRedirect
    - name: HTTPRouteTimeoutBackendRequest
    - name: HTTPRouteTimeoutRequest
    - name: ReferenceGrant
    - name: TLSRoute

The Accepted condition of GatewayClass¶

conditions.status	conditions.reason	description
Unknown	Pending	Initial state. Waiting for the controller.
True	Accepted	Accepted

Sample CR¶

apiVersion: gateway.networking.k8s.io/v1
kind: GatewayClass
metadata:
  name: my-gateway-class
spec:
  controllerName: "f5.com/f5-bnk-instance-f5-cne-controller"
  description: "F5 BIG-IP Kubernetes Gateway"

Delete GatewayClass CR¶

After you delete the GatewayClass custom resource, verify the following before you reapply it:

Confirm that all IPAM and IPAMRange custom resources have been removed from the BNK namespace.
If you use Infoblox, confirm that the associated IPs have been released.
In public cloud environments, confirm that all WideIPs have been removed from the GTM.

Ensuring a clean state before you reapply the custom resource prevents unpredictable behavior.