Skip to main content
API7.ai Logo

Apply Plugins to L4 Routes

L4RoutePolicy attaches APISIX stream plugins to Gateway API TCP, UDP, and TLS routes. This guide applies an IP restriction to a TCPRoute and verifies that the policy blocks connections.

Product availability

L4RoutePolicy is available in APISIX Ingress Controller 2.2. API7 Ingress Controller has not yet published a release or chart that includes this resource.

Prerequisites​

  1. Complete Proxy TCP Traffic by Port using the Gateway API tab. The example creates the stream-route-mysql TCPRoute in the aic namespace.
  2. Verify that you can connect to the MySQL backend before applying the policy.

Apply a Stream Plugin​

Create an L4RoutePolicy that attaches the ip-restriction stream plugin to stream-route-mysql. The blacklist in this example blocks all IPv4 client addresses:

l4-route-policy.yaml
apiVersion: apisix.apache.org/v1alpha1
kind: L4RoutePolicy
metadata:
  name: block-mysql-connections
  namespace: aic
spec:
  targetRefs:
  - group: gateway.networking.k8s.io
    kind: TCPRoute
    name: stream-route-mysql
  plugins:
  - name: ip-restriction
    config:
      blacklist:
      - 0.0.0.0/0

Apply the policy:

kubectl apply -f l4-route-policy.yaml

Verify the Policy​

Check the policy status:

kubectl get l4routepolicy block-mysql-connections -n aic \
  -o jsonpath='{range .status.ancestors[*].conditions[*]}{.type}{"="}{.status}{" ("}{.reason}{")\n"}{end}'

The accepted policy should report:

Accepted=True (Accepted)

Try to connect to MySQL again:

mysqlsh --sqlc --host=127.0.0.1 --port=9100 --user=root --password

The connection should fail because the plugin rejects the client address.

Delete the policy and confirm that the connection succeeds again:

kubectl delete l4routepolicy block-mysql-connections -n aic

Policy Attachment Rules​

  • A policy can target TCPRoute, UDPRoute, or TLSRoute resources in the same namespace as the policy.
  • targetRefs must use the gateway.networking.k8s.io group. One policy can contain between 1 and 16 target references.
  • L4 routes do not expose addressable sections. A target reference with sectionName does not attach.
  • Only APISIX stream plugins are valid. For example, use ip-restriction or limit-conn; HTTP-only plugins cannot run on L4 routes.
  • If multiple policies target the same route, the oldest policy is applied. Later policies report Accepted=False with the Conflicted reason.