Skip to content

Commit bc9a006

Browse files
Docs code review
Co-authored-by: Alan Dooley <[email protected]>
1 parent 383ddf9 commit bc9a006

File tree

1 file changed

+11
-10
lines changed

1 file changed

+11
-10
lines changed

site/content/overview/custom-policies.md

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
title: "Custom Policies"
2+
title: "Custom policies"
33
weight: 600
44
toc: true
55
docs: "DOCS-000"
@@ -8,7 +8,7 @@ docs: "DOCS-000"
88
## Overview
99

1010
Custom policies are NGINX Gateway Fabric CRDs (Custom Resource Definitions) that allow users to configure NGINX data plane features that are unavailable in the Gateway API.
11-
These custom policies follow the Gateway API's pattern of [Policy Attachment](https://gateway-api.sigs.k8s.io/reference/policy-attachment/), which allows users to extend the Gateway API functionality by creating implementation-specific policies and attaching them to Kubernetes objects such as HTTPRoutes, Gateways, and Services.
11+
These custom policies follow the Gateway API [Policy Attachment](https://gateway-api.sigs.k8s.io/reference/policy-attachment/) pattern, which allows users to extend the Gateway API functionality by creating implementation-specific policies and attaching them to Kubernetes objects such as HTTPRoutes, Gateways, and Services.
1212

1313
Policies are a Kubernetes object that augments the behavior of an object in a standard way. Policies can be attached to one object ([Direct Policy Attachment](#direct-policy-attachment)) or objects in a hierarchy ([Inherited Policy Attachment](#inherited-policy-attachment)).
1414
The following table summarizes NGINX Gateway Fabric custom policies:
@@ -20,9 +20,11 @@ The following table summarizes NGINX Gateway Fabric custom policies:
2020
| ClientSettingsPolicy | Configure connection behavior between client and NGINX | Inherited | Gateway, HTTPRoute, GRPCRoute | No | Yes | v1alpha1 |
2121
| [ObservabilityPolicy]({{<relref "/how-to/monitoring/tracing.md" >}}) | Define settings related to tracing, metrics, or logging | Direct | HTTPRoute, GRPCRoute | Yes | No | v1alpha1 |
2222

23+
{{</bootstrap-table>}}
24+
2325

2426
{{< important >}}
25-
NGINX Gateway Fabric policies do not work with [HTTPRoute matches](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.HTTPRouteMatch) with `headers`, `params`, or `method` matchers defined. This will be addressed in a future release.
27+
NGINX Gateway Fabric policies do not work with [HTTPRoute matches](https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.HTTPRouteMatch) with `headers`, `params`, or `method` matchers defined. It will be added in a future release.
2628
{{< /important >}}
2729

2830
## Terminology
@@ -34,19 +36,19 @@ NGINX Gateway Fabric policies do not work with [HTTPRoute matches](https://gatew
3436

3537
## Direct Policy Attachment
3638

37-
A Direct Policy Attachment is a policy that references a single object -- such as a Gateway or HTTPRoute. It is tightly bound to one instance of a particular Kind within a single Namespace or an instance of a single Kind at the cluster-scope. It affects _only_ the object specified in its TargetRef.
39+
A Direct Policy Attachment is a policy that references a single object, such as a Gateway or HTTPRoute. It is tightly bound to one instance of a particular Kind within a single Namespace or an instance of a single Kind at the cluster-scope. It affects _only_ the object specified in its TargetRef.
3840

3941
This diagram uses a fictional retry policy to show how Direct Policy Attachment works:
4042

41-
{{<img src="img/direct-policy-attachment.png" alt="Direct Policy Attachment">}}
43+
{{<img src="img/direct-policy-attachment.png" alt="">}}
4244

4345
The policy targets the HTTPRoute `baz` and sets `retries` to `3` and `timeout` to `60s`. Since this policy is a Direct Policy Attachment, its settings are only applied to the `baz` HTTPRoute.
4446

4547
## Inherited Policy Attachment
4648

47-
Inherited Policy Attachment is designed to allow settings to flow down a hierarchy. The hierarchy for Gateway API resources looks like this:
49+
Inherited Policy Attachment allows settings to cascade down a hierarchy. The hierarchy for Gateway API resources looks like this:
4850

49-
{{<img src="img/hierarchy.png" alt="Hierarchy">}}
51+
{{<img src="img/hierarchy.png" alt="">}}
5052

5153
Settings defined in a policy attached to an object in this hierarchy may be inherited by the resources below it. For example, the settings defined in a policy attached to a Gateway may be inherited by all the HTTPRoutes attached to that Gateway.
5254

@@ -57,7 +59,7 @@ Default values are given precedence from the bottom up. Therefore, a policy sett
5759

5860
The following diagram shows how Inherited Policies work in NGINX Gateway Fabric using a fictional retry policy:
5961

60-
{{<img src="img/inherited-policy-attachment.png" alt="Inherited Policy Attachment">}}
62+
{{<img src="img/inherited-policy-attachment.png" alt="">}}
6163

6264
There are three policies defined:
6365

@@ -113,7 +115,7 @@ timeout: 60s
113115
However, if both policies had the `retries` field set, then the policies cannot be merged. In this case, NGINX Gateway Fabric will choose which policy to configure based on the following criteria (continuing on ties):
114116

115117
1. The oldest policy by creation timestamp
116-
2. The policy appearing first in alphabetical order by "{namespace}/{name}"
118+
1. The policy appearing first in alphabetical order by "{namespace}/{name}"
117119

118120
If a policy conflicts with a configured policy, NGINX Gateway Fabric will set the policy `Accepted` status to false with a reason of `Conflicted`. See [Policy Status](#policy-status) for more details.
119121

@@ -133,7 +135,6 @@ NGINX Gateway Fabric sets the [PolicyStatus](https://gateway-api.sigs.k8s.io/ref
133135
- `Accepted/False/TargetNotFound`: the policy is not accepted because it targets a resource that is invalid or does not exist.
134136
- `Accepted/False/NginxProxyNotSet`: the policy is not accepted because it relies on the NginxProxy configuration which is missing or invalid.
135137

136-
137138
To check the status of a policy, use `kubectl describe`. This example checks the status of the `foo` ObservabilityPolicy, which is accepted:
138139

139140
```shell

0 commit comments

Comments
 (0)