consul/website/content/docs/connect/gateways/api-gateway/configuration/gatewayclassconfig.mdx

---
layout: docs
page_title: GatewayClassConfig Resource Configuration
description: >-
  The `GatewayClassConfig` resource specifies connection information and settings that Consul API Gateway uses to connect to Consul. Learn about its configuration model and reference specifications, and review an example configuration.
---

# GatewayClassConfig Resource Configuration

This topic provides full details about the `GatewayClassConfig` resource.

## Introduction

The `GatewayClassConfig` object contains Consul API Gateway-related configuration parameters. Apply the parameters by adding the [`GatewayClass`](#gatewayclass) object to your Kubernetes values file and specifying the name of the `GatewayClassConfig`.

## Configuration model

The following outline shows how to format the configurations in the `GatewayClassConfig` object. Click on a property name to view details about the configuration.

* [`consul`](#consul): object | optional
  * [`address`](#consul-address): string | optional
  * [`authentication`](#consul-authentication): object | optional
    * [`account`](#consul-authentication-account): string | optional
    * [`managed`](#consul-authentication-managed): bool  | optional
    * [`method`](#consul-authentication-method): string | optional
    * [`namespace`](#consul-authentication-namespace): string  | optional
  * [`ports`](#consul-ports): object  | optional
    * [`grpc`](#consul-ports-grpc): integer | optional
    * [`http`](#consul-ports-http): integer | optional
  * [`scheme`](#consul-scheme): string  | optional
* [`copyAnnotations`](#copyannotations): object | optional
  * [`service`](#copyannotations-service): array of strings | optional
* [`deployment`](#deployment): object | optional
  * [`defaultInstances`](#deployment-defaultinstances): integer | optional
  * [`maxInstances`](#deployment-maxinstances): integer | optional
  * [`minInstances`](#deployment-mininstances): integer | optional
* [`image`](#image): object | optional
  * [`consulAPIGateway`](#image-consulapigateway): string | optional
  * [`envoy`](#image-envoy): string | optional
* [`logLevel`](#loglevel): string | optional
* [`mapPrivilegedContainerPorts`](#mapprivilegedcontainerports): integer | optional
* [`nodeSelector`](#nodeselector): string | optional
* [`openshiftSCCName`](#openshiftsccname): string | optional
* [`serviceType`](#servicetype): string | optional
* [`useHostPorts`](#usehostports): boolean | optional

## Specification

This topic provides details about the configuration parameters.

### consul
Specifies configurations that enable an instance of Consul API Gateway to interact with Consul.
* Type: object
* Required: optional

### consul.address
Specifies the address of the Consul server that the `Gateway` communicates with in the gateway pod. If unspecified, the pod attempts to use a local agent on the host where the pod is running.
* Type: string
* Required: optional
* Default: local agent

### consul.authentication.account
Specifies the [Kubernetes service account](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/) to use for authentication.
* Type: string
* Required: optional

### consul.authentication.managed
Set to `true` to enable deployments to run with managed service accounts created by the gateway controller. The `consul.authentication.account` field is ignored when this option is enabled.
* Type: boolean
* Required: optional
* Default: `false`

### consul.authentication.method
Specifies the [Consul auth method](/consul/docs/security/acl/auth-methods) used for initial authentication by Consul API Gateway.
* Type: string
* Required: optional

### consul.authentication.namespace
Specifies the Consul namespace to use for authentication.
* Type: string
* Required: optional

### consul.ports.grpc
Specifies the gRPC port for Consul's xDS server.
* Type: integer
* Required: optional
* Default: `8502`

### consul.ports.http
Specifies the Consul HTTP port to use for authentication.
* Type: integer
* Required: optional
* Default: `8500`

### consul.scheme
Specifies the scheme to use for connecting to Consul.
* Type: string
* Required: optional
* Default: `http`

You can specify the following strings:
* `http`
* `https`

### copyAnnotations.service
Specifies an array of Kubernetes [annotations](https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/) to copy to the gateway service.
* Type: Array of strings
* Required: optional

### deployment.defaultInstances
Specifies the number of gateway instances to deploy per gateway configuration.
* Type: Integer
* Required: optional
* Default: `1`

### deployment.maxInstances
Specifies the maximum allowed number of gateway instances per gateway configuration.
* Type: Integer
* Required: optional
* Default: `8`

### deployment.minInstances
Specifies the minimum allowed number of gateway instances per gateway configuration.
* Type: Integer
* Required: optional
* Default: `1`

### image.consulAPIGateway
Specifies the Docker image to use for the `consul-api-gateway` container. View available image tags on [DockerHub](https://hub.docker.com/r/hashicorp/consul-api-gateway/tags).

The default value is suitable for most deployments, but you may require a specific version of the Consul API Gateway depending on your environment.
* Type: string
* Required: optional
* Default: `"hashicorp/consul-api-gateway:RELEASE_VERSION"`

### image.envoy
Specifies the Docker image to use for the Envoy proxy container. View available image tags on [DockerHub](https://hub.docker.com/r/hashicorp/consul-api-gateway/tags).

The default value is suitable for most deployments, but you may require a specific version of Envoy depending on your environment.
* Type: string
* Required: optional
* Default: `"envoyproxy/envoy:RELEASE_VERSION"`

### logLevel
Specifies the error reporting level for logs.
* Type: string
* Required: optional
* Default: `info`

You can specify the following strings:
* `error`
* `warning`
* `info`
* `debug`
* `trace`

### mapPrivilegedContainerPorts
Specifies a value that Consul adds to privileged ports defined in the gateway. Privileged ports are port numbers less than 1024 and some platforms, such as Red Hat OpenShift, explicitly configure Kubernetes to avoid running containers on privileged ports. The total value of the configured port number and the `mapPriviledgedContainerPorts` value must not exceed 65535, which is the highest possible TCP port number allowed.
for gateway containers
* Type: Integer
* Required: optional

You can specify an integer between `0` and `64512`

### nodeSelector
Pods normally run on multiple nodes. You can specify a set of parameters in the `nodeSelector` that constrain the nodes on which the pod can run, enabling the pod to fit on a node. The selector must match a node's labels for the pod to be scheduled on that node. Refer to the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/) for additional information.

* Type: string
* Required: optional

### openshiftSCCName
Specifies the OpenShift security context constraint (SCC) for the `GatewayClassConfig` to use. Refer to the [OpenShift SCC documentation](https://docs.openshift.com/container-platform/4.13/authentication/managing-security-context-constraints.html#default-sccs_configuring-internal-oauth) for additional information about the available default SCCs.
* Type: string
* Required: optional
* Default: `restricted-v2`

### serviceType
Specifies the ingress methods for the gateway's Kubernetes service.
* Type: string
* Required: optional

You can specify the following strings:
* `ClusterIP`: The gateway is only accessible from inside the cluster.
* `NodePort`: The gateway is exposed on each Kubernetes node at a static port.
* `LoadBalancer`: The gateway is exposed to external traffic by a load balancer.

For more on Kubernetes services, see [Publishing Services](https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types).

### useHostPorts
If set to `true`, then the Envoy container ports are mapped to host ports.
* Type: boolean
* Required: optional
* Default: `false`


## Example Configuration
The following example creates a gateway class configuration called `example-gateway-class-config`. Traffic that passes through gateways created from the class configuration authenticates with Consul over HTTPS on port `8501`. Consul client agents communicate with server agents on port `8502`:

<CodeBlockConfig filename="gateway.yaml">

  ```yaml
  apiVersion: api-gateway.consul.hashicorp.com/v1alpha1
  kind: GatewayClassConfig
  metadata:
    name: example-gateway-class-config
  spec:
    useHostPorts: true
    logLevel: 'trace'
    consul:
      scheme: 'https'
      ports:
        http: 8501
        grpc: 8502
```
</CodeBlockConfig>

Refer to the [Consul API Gateway repository](https://github.com/hashicorp/consul-api-gateway/blob/main/config/crd/bases/api-gateway.consul.hashicorp.com_gatewayclassconfigs.yaml) for the complete specification.