-spec:
- workloads: # required
- filter: "Service.Meta.version == v1"
- names: ["api", "admin"]
- prefixes: ["", ""]
- bootstrapConfig:
- dogstatsdUrl:
- overrideJsonTpl:
- prometheusBindAddr: <0.0.0.0>
- readyBindAddr:
- staticClustersJson:
- staticListenersJson:
- statsBindAddr: <0.0.0.0>
- statsConfigJson:
- statsFlushInterval: 5000ms
- statsSinkJson:
- statsTags:
- -
- statsdUrl:
- telemetryCollectorBindSocketDir:
- tracingConfigJson:
- dynamicConfig:
- accessLogs:
- enabled: false
- disableListenerLogs: false
- jsonFormat:
- path:
- textFormat:
- type:
- exposeConfig:
- exposePaths:
- listenerPort: 42
- localPathPort: 4242
- path:
- protocol:
- inboundConnections:
- balanceInboundConnections:
- maxInboundConnections: 1024
- listenerTracingJson:
- localClusterJson:
- localConnection:
- connectTimeout: <1s>
- requestTimeout: <1s>
- meshGatewayMode:
- mode:
- publicListenerJson:
- transparentProxy:
- dialedDirectly: false
- outboundListenerPort: 15001
-```
-
-## Specification
-
-This section provides details about the fields you can configure in the `ProxyConfiguration` custom resource definition (CRD).
-
-### `apiVersion`
-
-Specifies the version of the Consul API for integrating with Kubernetes. The value must be `mesh.consul.hashicorp.com/v2beta1`.
-
-#### Values
-
-- Default: None
-- This field is required.
-- String value that must be set to `mesh.consul.hashicorp.com/v2beta1`.
-
-### `kind`
-
-Specifies the type of CRD to implement. Must be set to `ProxyConfiguration`.
-
-#### Values
-
-- Default: None
-- This field is required.
-- Data type: String value that must be set to `ProxyConfiguration`.
-
-### `metadata`
-
-Map that contains an arbitrary name for the CRD and the namespace it applies to.
-
-#### Values
-
-- Default: None
-- Data type: Map
-
-### `metadata.name`
-
-Specifies a name for the CRD. The name is metadata that you can use to reference the resource when performing Consul operations, such as using the `consul resource` command. Refer to [`consul resource`](/consul/docs/k8s/connect/multiport/reference/resource-command) for more information.
-
-#### Values
-
-- Default: None
-- This field is required.
-- Data type: String
-
-### `metadata.namespace`
-
-Specifies the namespace that the proxy configuration applies to. Refer to [namespaces](/consul/docs/enterprise/namespaces) for more information.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec`
-
-Map that contains the details about the `ProxyConfiguration` CRD. The `apiVersion`, `kind`, and `metadata` fields are siblings of the spec field. All other configurations are children.
-
-#### Values
-
-- Default: None
-- This field is required.
-- Data type: Map
-
-### `spec.workloads`
-
-Specifies the workloads that the proxy configuration applies to. You can select workloads by name, prefix, or by using a filter expression.
-
-#### Values
-
-- Default: None
-- This field is required.
-- Data type: Map that can contain the following parameters:
-
- | Parameter | Description | Data type | Default |
- | :------------ | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- | ------- |
- | `filter` | Specifies an expression that filters workloads. For more information about creating and using expressions to filter, refer to [filtering](/consul/api-docs/features/filtering). | String | None |
- | `names` | Specifies one or more names of workloads the proxy configuration applies to. | Array of strings | None |
- | `prefixes` | Specifies one or more prefixes. Proxy configurations apply to workloads with one of the prefixes. | Array of strings | None |
-
-### `spec.bootstrapConfig`
-
-Specifies initial bootstrap settings for the Envoy proxy, as well as proxy configuration settings that require the proxy to restart when applied. For more information, refer to [Envoy proxy bootstrap configuration](/consul/docs/connect/proxies/envoy#bootstrap-configuration).
-
-#### Values
-
-- Default: None
-- Data type: Map
-
-### `spec.bootstrapConfig.dogstatsdUrl`
-
-Specifies a URL that identifies a DataDog DogStatsD listener. Envoy sends metrics to this listener.
-
-Format the URL as `udp://ip:port` or `unix://uds/path`. For example, `udp://127.0.0.1:8125` configures a local UDP DogStatsD listener for every host. TCP is not supported.
-
-The UDP URL must use an IP address. DNS names are not supported.
-
-For more information about configuring a UNIX domain socket with DogStatsD, refer to [the DataDog documentation](https://docs.datadoghq.com/developers/dogstatsd/unix_socket?tab=kubernetes#setup).
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec.bootstrapConfig.overrideJsonTpl`
-
-
-This field offers complete control of the proxy's bootstrap. Be aware that major deviations from the default template may break Consul's ability to correctly manage the proxy or enforce its security model.
-
-
-Specifies a template in Go template syntax to use in place of [the default template](https://github.com/hashicorp/consul/blob/71d45a34601423abdfc0a64d44c6a55cf88fa2fc/command/connect/envoy/bootstrap_tpl.go#L129) when generating the bootstrap configuration using the [`consul connect envoy` command](/consul/commands/connect/envoy). For information about the variables Consul can interpolate in the template, refer to the [documentation in `bootstrap_tpl.go`](https://github.com/hashicorp/consul/blob/71d45a34601423abdfc0a64d44c6a55cf88fa2fc/command/connect/envoy/bootstrap_tpl.go#L5).
-
-Refer to [Envoy proxy escape-hatch overrides](/consul/docs/connect/proxies/envoy#escape-hatch-overrides) for more information.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec.bootstrapConfig.prometheusBindAddr`
-
-Configures the proxy to expose a Prometheus metrics endpoint to the public network. Format the endpoint as `ip:port`. The port and IP and port combination must be free within the network namespace where the proxy runs. The IP `0.0.0.0` binds to all available interfaces or a pod IP address if supported by your existing network settings.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec.bootstrapConfig.readyBindAddr`
-
-Specifies the location to configure the proxy's readiness probe. Format as `ip:port`.
-
- By default, the proxy does not have a readiness probe configured on it.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec.bootstrapConfig.staticClustersJson`
-
-Specifies one or more [Envoy clusters](https://www.envoyproxy.io/docs/envoy/v1.17.2/api-v3/config/cluster/v3/cluster.proto) to append to the array of [static clusters](https://www.envoyproxy.io/docs/envoy/v1.17.2/api-v3/config/bootstrap/v3/bootstrap.proto#envoy-v3-api-field-config-bootstrap-v3-bootstrap-staticresources-clusters) in the bootstrap configuration.
-
-This field enables you to add custom clusters, such as tracing sinks, to the bootstrap configuration. In order to configure a single cluster, specify a single JSON object with the cluster details.
-
-Refer to [Envoy proxy advanced bootstrap options](/consul/docs/connect/proxies/envoy#advanced-bootstrap-options) for more information and examples.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec.bootstrapConfig.staticListenersJson`
-
-Specifies one or more [Envoy listeners](https://www.envoyproxy.io/docs/envoy/v1.17.2/api-v3/config/listener/v3/listener.proto) to append to the array of [static listeners](https://www.envoyproxy.io/docs/envoy/v1.17.2/api-v3/config/bootstrap/v3/bootstrap.proto#envoy-v3-api-field-config-bootstrap-v3-bootstrap-staticresources-listeners) definitions.
-
-You can use this field to set up limited access that bypasses the service mesh's mTLS or authorization for health checks or metrics.
-
-Refer to [Envoy proxy advanced bootstrap options](/consul/docs/connect/proxies/envoy#advanced-bootstrap-options) for more information and examples.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec.bootstrapConfig.statsBindAddr`
-
-Specifies that the proxy should expose the `/stats` prefix to the _public_ network at the `ip:port` provided. The IP and port combination must be free within the network namespace where the proxy runs. The IP `0.0.0.0` binds to all available interfaces or a pod IP address if supported by your existing network settings.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec.bootstrapConfig.statsConfigJson`
-
-Specifies a complete [stats config](https://www.envoyproxy.io/docs/envoy/v1.17.2/api-v3/config/bootstrap/v3/bootstrap.proto#envoy-v3-api-field-config-bootstrap-v3-bootstrap-stats-config).
-
-When provided, this field overrides [`spec.bootstrapConfig.statsTags`](#spec-bootstrapconfig-statstags) and enables full control over dynamic tag replacements.
-
-Refer to [Envoy proxy advanced bootstrap options](/consul/docs/connect/proxies/envoy#advanced-bootstrap-options) for more information and examples.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec.bootstrapConfig.statsFlushInterval`
-
- Configures Envoy's [`stats_flush_interval`](https://www.envoyproxy.io/docs/envoy/v1.17.2/api-v3/config/bootstrap/v3/bootstrap.proto#envoy-v3-api-field-config-bootstrap-v3-bootstrap-stats-flush-interval), which measures the length of the interval between stats sink flushes.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec.bootstrapConfig.statsSinkJson`
-
-Specifies one or more [stats sinks](https://www.envoyproxy.io/docs/envoy/v1.17.2/api-v3/config/bootstrap/v3/bootstrap.proto#envoy-v3-api-field-config-bootstrap-v3-bootstrap-stats-sinks) to append to sinks defined using [`spec.bootstrapConfig.statsdUrl`](#spec-bootstrapconfig-statsdurl) or [`spec.bootstrapConfig.dogstatsdUrl`](#spec-bootstrapconfig-dogstatsdurl).
-
-Refer to [Envoy proxy advanced bootstrap options](/consul/docs/connect/proxies/envoy#advanced-bootstrap-options) for more information and examples.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec.bootstrapConfig.statsTags`
-
-Specifies one or more static tags to add to all metrics produced by the proxy.
-
-#### Values
-
-- Default: None
-- Data type: Array of strings
-
-### `spec.bootstrapConfig.statsdUrl`
-
-Specifies a URL that identifies a StatsD listener. Envoy sends metrics to this listener.
-
-Format the URL as `udp://ip:port`. For example, `udp://127.0.0.1:8125` configures a local StatsD listener for every host. TCP is not supported.
-
-The URL must use an IP address. DNS names are not supported.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec.bootstrapConfig.telemetryCollectorBindSocketDir`
-
-Specifies the directory of the Unix socket Envoy sends metrics to so that the Consul telemetry collector can collect them.
-
-The socket is not configured by default.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec.bootstrapConfig.tracingConfigJson`
-
-Specifies a configuration for an external tracing provider as described in [the Envoy documentation](https://www.envoyproxy.io/docs/envoy/v1.17.2/api-v3/config/bootstrap/v3/bootstrap.proto#envoy-v3-api-field-config-bootstrap-v3-bootstrap-tracing). Most tracing providers also require adding static clusters to define the endpoints to send tracing data to.
-
-Refer to [Envoy proxy advanced bootstrap options](/consul/docs/connect/proxies/envoy#advanced-bootstrap-options) for more information and examples.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec.dynamicConfig`
-
-Specifies configuration settings for the Envoy proxy that are applied without restarting the proxy. For more information, refer to [Envoy proxy dynamic configuration](/consul/docs/connect/proxies/envoy#dynamic-configuration).
-
-#### Values
-
-- Default: None
-- Data type: Map
-
-### `spec.dynamicConfig.accessLogs`
-
-Specifies the format and output for the proxy's access logs.
-
-#### Values
-
-- Default: None
-- Data type: Map
-
-### `spec.dynamicConfig.accessLogs.enabled`
-
-When set to `true`, this parameter enables access logs for the proxy.
-
-#### Values
-
-- Default: `false`
-- Data type: Boolean
-
-### `spec.dynamicConfig.accessLogs.usableListenerLogs`
-
-When set to `true`, this parameter disables listener logs for connections that the proxy rejected because they did not have a matching listener filter.
-
-#### Values
-
-- Default: `false`
-- Data type: Boolean
-
-### `spec.dynamicConfig.accessLogs.jsonFormat`
-
-Specifies a JSON format dictionary for the access logs. Refer to [format dictionaries in the Envoy documentation](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#format-dictionaries) for more information.
-
-When this field is specified, you cannot also specify [`spec.dynamicConfig.accessLogs.textFormat`](#spec-dynamicconfig-accesslogs-textformat) in the same configuration.
-
-### `spec.dynamicConfig.accessLogs.path`
-
-Specifies a file output path for the access logs.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec.dynamicConfig.accessLogs.textFormat`
-
-Specifies a format string for the access logs. Refer to [default format string in the Envoy documentation](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#default-format-string) for more information.
-
-When this field is specified, you cannot also specify [`spec.dynamicConfig.accessLogs.jsonFormat`](#spec-dynamicconfig-accesslogs-jsonformat) in the same configuration.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec.dynamicConfig.accessLogs.type`
-
-Specifies the output type for the access logs.
-
-#### Values
-
-- Default: None
-- Data type: String containing one of the following values:
-
- - `LOG_SINK_TYPE_DEFAULT`
- - `LOG_SINK_TYPE_FILE`
- - `LOG_SINK_TYPE_STDERR`
- - `LOG_SINK_TYPE_STDOUT`
-
-### `spec.dynamicConfig.exposeConfig`
-
-Specifies configurations for exposing the proxy.
-
-Refer to [expose paths configuration reference](/consul/docs/connect/proxies/proxy-config-reference#expose-paths-configuration-reference) for more information.
-
-#### Values
-
-- Default: None
-- Data type: Map
-
-### `spec.dynamicConfig.exposeConfig.exposePaths`
-
-Specifies a configuration for exposing an HTTP path through the proxy.
-
-Refer to [expose paths configuration reference](/consul/docs/connect/proxies/proxy-config-reference#expose-paths-configuration-reference) for more information.
-
-#### Values
-
-- Default: None
-- Data type: Map
-
-### `spec.dynamicConfig.exposeConfig.exposePaths.listenerPort`
-
-Specifies the port where the proxy listens for connections. This port must be available for the listener to be set up. If the port is not free, Envoy does not expose a listener for the path but the proxy registration does not fail.
-
-#### Values
-
-- Default: None
-- Data type: Integer
-
-### `spec.dynamicConfig.exposeConfig.exposePaths.localPathPort`
-
-Specifies the port where the local service is listening for connections to the path.
-
-#### Values
-
-- Default: None
-- Data type: Integer
-
-### `spec.dynamicConfig.exposeConfig.exposePaths.path`
-
-The HTTP path to expose. Prefix the path with a slash. For example, `/metrics`.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec.dynamicConfig.exposeConfig.exposePaths.protocol`
-
-Specifies the protocol of the listener, either HTTP or HTTP/2. For gRPC, use HTTP/2.
-
-#### Values
-
-- Default: None
-- Data type: String containing one of the following values:
-
- - `EXPOSE_PATH_PROTOCOL_HTTP`
- - `EXPOSE_PATH_PROTOCOL_HTTP2`
-
-### `spec.dynamicConfig.inboundConnections`
-
-Specifies configurations for how the proxy handles inbound connections.
-
-#### Values
-
-- Default: None
-- Data type: Map
-
-### `spec.dynamicConfig.inboundConnections.balanceInboundConnections`
-
-Specifies the strategy for balancing inbound connections across Envoy worker threads. Consul's service mesh Envoy integration supports the following values:
-
-| Value | Description |
-| :---- | :---------- |
-| Empty string | Inbound connections are not balanced. |
-| `exact_balance` | Balances inbound connections with [Envoy's Exact Balance Strategy](https://cloudnative.to/envoy/api-v3/config/listener/v3/listener.proto.html#config-listener-v3-listener-connectionbalanceconfig-exactbalance). |
-
-#### Values
-
-- Default: `""`
-- Data type: String
-
-### `spec.dynamicConfig.inboundConnections.maxInboundConnections`
-
-Specifies the maximum number of concurrent inbound connections to the local application instance. If not specified, inherits the Envoy default of `1024`.
-
-#### Values
-
-- Default: `1024`
-- Data type: Integer
-
-### `spec.dynamicConfig.listenerTracingJson`
-
-Specifies a tracing configuration to be inserted in the proxy's public and upstreams listeners. Refer to [the Envoy documentation](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#envoy-v3-api-msg-extensions-filters-network-http-connection-manager-v3-httpconnectionmanager-tracing) for more information.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec.dynamicConfig.localClusterJson`
-
-Specifies a complete Envoy cluster to be delivered in place of the local application cluster. Use this field to customize timeouts, rate limits, and load balancing strategy.
-
-Refer to [cluster configuration in the Envoy documentation](https://www.envoyproxy.io/docs/envoy/v1.17.2/api-v3/config/cluster/v3/cluster.proto) for more information.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec.dynamicConfig.localConnection`
-
-Specifies timeout settings for the proxy's connection to the local application. Apply settings separately for each port.
-
-Specify this field as a map containing a key/value. The map keys correspond to port names on the workload. The value contains this parameter's sub-fields.
-
-#### Values
-
-- Default: None
-- Data type: Map
-
-### `spec.dynamicConfig.localConnection.connectTimeout`
-
-Specifies the length of time the proxy is allowed to attempt connections to the local application instance before timing out.
-
-This field accepts a string indicating the number of seconds. For example, indicate five seconds with `5s` and five milliseconds with `0.005s`.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec.dynamicConfig.localConnection.requestTimeout`
-
-Specifies the length of time the proxy is allowed to attempt HTTP requests to the local application instance. Applies to HTTP-based protocols only.
-
-This field accepts a string indicating the number of seconds. For example, indicate five seconds with `5s` and five milliseconds with `0.005s`.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec.dynamicConfig.meshGatewayMode`
-
-Specifies the proxy's mode of operation for resolving upstreams in remote datacenter destinations. Refer to [Mesh gateway configuration reference](/consul/docs/connect/proxies/proxy-config-reference#mesh-gateway-configuration-reference) for more information.
-
-#### Values
-
-- Default: None
-- Data type: String containing one of the following values:
-
- - `MESH_GATEWAY_MODE_UNSPECIFIED`
- - `MESH_GATEWAY_MODE_NONE`
- - `MESH_GATEWAY_MODE_LOCAL`
- - `MESH_GATEWAY_MODE_REMOTE`
-
-### `spec.dynamicConfig.mode`
-
-Configures the proxy to operate in transparent, direct, or default mode. Refer to [proxy modes](/consul/docs/connect/proxies/proxy-config-reference#proxy-modes) for more information.
-
-#### Values
-
-- Default: None
-- Data type: String containing one of the following values:
-
- - `PROXY_MODE_DEFAULT`
- - `PROXY_MODE_TRANSPARENT`
- - `PROXY_MODE_DIRECT`
-
-### `spec.dynamicConfig.publicListenerJson`
-
-Specifies a complete Envoy listener for Consul to deliver in place of the main public listener that the proxy uses to accept inbound connections. Refer to [escape-hatch overrides](/consul/docs/connect/proxies/envoy#escape-hatch-overrides) for more information
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec.dynamicConfig.transparentProxy`
-
-Specifies additional configurations for operating proxies in transparent proxy mode. Refer to [transparent proxy configuration reference](/consul/docs/connect/proxies/proxy-config-reference#transparent-proxy-configuration-reference) for more information.
-
-#### Values
-
-- Default: None
-- Data type: Map
-
-### `spec.dynamicConfig.transparentProxy.dialedDirectly`
-
-Determines whether this proxy instance's IP address can be dialed directly by transparent proxies. Transparent proxies typically dial upstreams using the _virtual_ tagged address, which load balances across instances. A database cluster with a leader is an example where dialing individual instances can be helpful.
-
-#### Values
-
-- Default: `false`
-- Data type: Boolean
-
-### `spec.dynamicConfig.transparentProxy.outboundListenerPort`
-
-Specifies the port the proxy listens on for outbound traffic to capture and redirect.
-
-#### Values
-
-- Default: `15001`
-- Data type: Integer
-
-## Examples
-
-The following examples demonstrate common ProxyConfiguration CRD configuration patterns for specific use cases.
-
-### Set a timeout on a subset of proxies
-
-The following example configures sidecar proxies scheduled with workloads whose names begin with `static-server-`. When these workloads attempt connections with the local `web` application, both requests and responses time out after 123 second.
-
-```yaml
-apiVersion: mesh.consul.hashicorp.com/v2beta1
-kind: ProxyConfiguration
-metadata:
- name: static-server-override-one
-spec:
- workloads:
- prefixes:
- - "static-server-"
- bootstrapConfig:
- statsBindAddr: "127.0.0.1:6666"
- dynamicConfig:
- # Only the web port should be enabled using the TPs
- localConnection:
- web:
- connectTimeout: "123s" # This ALWAYS has to end in 's'. If you want ms, you need to use "0.123s"
- requestTimeout: "123s"
-```
diff --git a/website/content/docs/k8s/multiport/reference/tcproute.mdx b/website/content/docs/k8s/multiport/reference/tcproute.mdx
deleted file mode 100644
index b9cda7a7b4..0000000000
--- a/website/content/docs/k8s/multiport/reference/tcproute.mdx
+++ /dev/null
@@ -1,345 +0,0 @@
----
-layout: docs
-page_title: TCPRoute resource configuration reference
-description: The TCPRoute resource CRD configures L4 TCP behavior within the service mesh. TCPRoute is a GAMMA resource that requires the v2 catalog API. Learn how to configure the TCPRoute CRD with specifications and example configurations.
----
-
-# TCPRoute resource configuration reference
-
-This page provides reference information for the `TCPRoute` resource, which defines Transport Layer (L4) TCP traffic within the service mesh.
-
-This custom resource definition (CRD) describes a resource related to the [Kubernetes GAMMA initiative](https://gateway-api.sigs.k8s.io/concepts/gamma/) that requires the [v2 catalog API](/consul/docs/architecture/v2/catalog). It is not compatible with the [v1 catalog API](/consul/docs/architecture/catalog). For more information about GAMMA resources, refer to the [Kubernetes Gateway API documentation](https://gateway-api.sigs.k8s.io/concepts/gamma/).
-
-## Configuration model
-
-The following list outlines field hierarchy, language-specific data types, and requirements in an TCP route CRD. Click on a property name to view additional details, including default values.
-
-
-
-
-
-- [`apiVersion`](#apiversion): string | required | must be set to `mesh.consul.hashicorp.com/v2beta1`
-- [`kind`](#kind): string | required | must be set to `TCPRoute`
-- [`metadata`](#metadata): map | required
- - [`name`](#metadata-name): string | required
- - [`namespace`](#metadata-namespace): string | optional
-- [`spec`](#spec): map | required
- - [`parentRefs`](#spec-parentrefs): map | required
- - [`port`](#spec-parentrefs-port): string
- - [`ref`](#spec-parentrefs-ref): string | required
- - [`name`](#spec-parentrefs-ref-name): string
- - [`type`](#spec-parentrefs-ref-type): map
- - [`group`](#spec-parentrefs-ref-type): string
- - [`groupVersion`](#spec-parentrefs-ref-type): string
- - [`kind`](#spec-parentrefs-ref-type): string
- - [`rules`](#spec-rules): map | required
- - [`backendRefs`](#spec-rules-backendrefs): map
- - [`backendRef`](#spec-rules-backendrefs-backendref): map
- - [`datacenter`](#spec-rules-backendrefs-backendref-datacenter): string
- - [`port`](#spec-rules-backendrefs-backendref-port): string
- - [`ref`](#spec-rules-backendrefs-backendref-ref): map
- - [`name`](#spec-rules-backendrefs-backendref-ref-name): string
- - [`type`](#spec-rules-backendrefs-backendref-ref-type): map
- - [`group`](#spec-rules-backendrefs-backendref-ref-type): string
- - [`groupVersion`](#spec-rules-backendrefs-backendref-ref-type): string
- - [`kind`](#spec-rules-backendrefs-backendref-ref-type): string
- - [`weight`](#spec-rules-backendrefs-weight): number
-
-
-
-
-## Complete configuration
-
-When every field is defined, a TCP route CRD has the following form:
-
-```yaml
-apiVersion: mesh.consul.hashicorp.com/v2beta1 # required
-kind: TCPRoute # required
-metadata:
- name:
- namespace:
-spec:
- parentRefs:
- port:
- - ref:
- name:
- type:
- group:
- groupVersion:
- kind:
- rules:
- - backendRefs:
- - backendRef:
- datacenter:
- port:
- ref:
- name:
- type:
- group:
- groupVersion:
- kind:
- weight: 1
-```
-
-## Specification
-
-This section provides details about the fields you can configure in the `TCPRoute` custom resource definition (CRD).
-
-### `apiVersion`
-
-Specifies the version of the Consul API for integrating with Kubernetes. The value must be `mesh.consul.hashicorp.com/v2beta1`.
-
-#### Values
-
-- Default: None
-- This field is required.
-- String value that must be set to `mesh.consul.hashicorp.com/v2beta1`.
-
-### `kind`
-
-Specifies the type of CRD to implement. Must be set to `TCPRoute`.
-
-#### Values
-
-- Default: None
-- This field is required.
-- Data type: String value that must be set to `TCPRoute`.
-
-### `metadata`
-
-Map that contains an arbitrary name for the CRD and the namespace it applies to.
-
-#### Values
-
-- Default: None
-- Data type: Map
-
-### `metadata.name`
-
-Specifies a name for the CRD. The name is metadata that you can use to reference the resource when performing Consul operations, such as using the `consul resource` command. Refer to [`consul resource`](/consul/docs/k8s/connect/multiport/reference/resource-command) for more information.
-
-#### Values
-
-- Default: None
-- This field is required.
-- Data type: String
-
-### `metadata.namespace`
-
-Specifies the namespace that the service resolver applies to. Refer to [namespaces](/consul/docs/enterprise/namespaces) for more information.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec`
-
-Map that contains the details about the `TCPRoute` CRD. The `apiVersion`, `kind`, and `metadata` fields are siblings of the spec field. All other configurations are children.
-
-When using this CRD, the `spec` field closely resembles the `TCPRoute` GAMMA resource. Refer to [TCPRoute in the Kubernetes documentation](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1alpha2.TCPRoute).
-
-#### Values
-
-- Default: None
-- This field is required.
-- Data type: Map
-
-### `spec.parentRefs`
-
-Specifies the services and other resources to attach the route to. You can only define one `parentsRefs` configuration for each route. To attach the route to multiple resources, specify additional [`spec.parentRefs.ref`](#spec-parentrefs-ref) configurations in the `parentsRefs` block. You can only specify one port for the route. Any resources that send traffic through the route use the same port.
-
-#### Values
-
-- Default: None
-- This field is required.
-- Data type: Map
-
-### `spec.parentRefs.port`
-
-Specifies the port for the Consul service that the configuration applies to. This parameter can be either a virtual port number, such as a Kubernetes service port, or a non-numeric target port value representing a named workload port.
-
-If you are not targeting a virtual port, specify the workload port name directly.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec.parentRefs.ref`
-
-Specifies the resource that the route attaches to.
-
-#### Values
-
-- Default: None
-- Data type: Map
-
-### `spec.parentRefs.ref.name`
-
-Specifies the user-defined name of the resource that the configuration applies to.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec.parentRefs.ref.type`
-
-Specifies the type of resource that the configuration applies to. To reference a service in the Consul catalog, configure the resource type as `catalog.v2beta1.Service`.
-
-#### Values
-
-- Default: None
-- Data type: Map containing the following parameters:
-
- | Parameter | Description | Data type | Default |
- | :------------ | :------------------------------------------------------------------- | :-------- | :------- |
- | `group` | Specifies a group for the resource type within the Kubernetes cluster. To reference a service in the Consul catalog, set this parameter to `catalog`. | String | None |
- | `groupVersion` | Specifies a groupVersion for the resource type within the Kubernetes cluster. To reference a service in the Consul catalog, set this parameter to `v2beta1`. | String | None |
- | `kind` | Specifies the kind of the Kubernetes object the resource applies to. To reference a service in the Consul catalog, set this parameter to `Service`. | String | None |
-
-### `spec.rules`
-
-Specifies rules for sidecar proxies to direct a service's TCP traffic within the service mesh.
-
-#### Values
-
-- Default: None
-- Data type: Map
-
-### `spec.rules.backendRefs`
-
-Specifies the Kubernetes Service backend to direct TCP traffic to when a request matches the service described in [`spec.parentRefs`](#spec-parentrefs). The Service backend is the collection of endpoint IPs for the service. Refer to [the Kubernetes Gateway API specification](https://gateway-api.sigs.k8s.io/concepts/gamma/#an-overview-of-the-gateway-api-for-service-mesh) for more information about Service backends.
-
-When a valid Service backend cannot be reached and no additional filters apply, traffic that matches the rule returns a 500 status code.
-
-When different Service backends are specified in [`spec.rules.backendRefs.weight`](#spec-rules-backendrefs-weight) and one of the backends is invalid, Consul continues to apply the specified weights instead of adjusting the relative weights to exclude traffic to the invalid backend. For example, when traffic is configured in a 50-50 split between `api` and `admin` and no valid endpoints for `admin` can be reached, the 50% of traffic intended for `admin` returns with a 500 status code.
-
-#### Values
-
-- Default: None
-- Data type: Map
-
-### `spec.rules.backendRefs.backendRef`
-
-Specifies an individual Service backend where matching requests should be sent.
-
-#### Values
-
-- Default: None
-- Data type: Map
-
-### `spec.rules.backendRefs.backendRef.datacenter`
-
-Specifies the name of the Consul datacenter that registered the Service backend that the configuration routes traffic to.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec.rules.backendRefs.backendRef.port`
-
-Specifies the port for the Consul service that the configuration routes traffic to. This parameter can be either a virtual port number, such as a Kubernetes service port, or a non-numeric target port value representing a named workload port.
-
-If you are not targeting a virtual port, specify the workload port name directly.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec.rules.backendRefs.backendRef.ref`
-
-The Consul service that the configuration routes traffic to.
-
-#### Values
-
-- Default: None
-- Data type: Map
-
-### `spec.rules.backendRefs.backendRef.ref.name`
-
-Specifies the user-defined name of the resource that the configuration routes traffic to.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec.rules.backendRefs.backendRef.ref.type`
-
-Specifies the type of resource that the configuration routes traffic to. To reference a service in the Consul catalog, configure the resource type as `catalog.v2beta1.Service`.
-
-#### Values
-
-- Default: None
-- Data type: Map containing the following parameters:
-
- | Parameter | Description | Data type | Default |
- | :------------ | :------------------------------------------------------------------- | :-------- | :------- |
- | `group` | Specifies a group for the resource type within the Kubernetes cluster. To reference a service in the Consul catalog, set this parameter to `catalog`. | String | None |
- | `groupVersion` | Specifies a groupVersion for the resource type within the Kubernetes cluster. To reference a service in the Consul catalog, set this parameter to `v2beta1`. | String | None |
- | `kind` | Specifies the kind of the Kubernetes object for the resource. To reference a service in the Consul catalog, set this parameter to `Service`. | String | None |
-
-### `spec.rules.backendRefs.weight`
-
-Specifies the proportion of requests routed to the specified service.
-
-This proportion is relative to the sum of all weights in the [`spec.rules.backendRefs`](#spec-rules-backendrefs) block. As a result, weights do not need to add up to 100. When only one backend is specified and the weight is greater then 0, Consul forwards 100% of traffic to the backend.
-
-When this parameter is not specified, Consul defaults to `1`.
-
-#### Values
-
-- Default: `1`
-- Data type: Integer
-
-## Examples
-
-The following examples demonstrate common TCPRoute CRD configuration patterns for specific use cases.
-
-### Split TCP traffic between two ports
-
-The following example splits traffic for the `api` service. TCP traffic for services registered to the Consul catalog that are available at the `api-workload` port is split so that 50% of the traffic routes to the service at the `api-workload` port and 50% routes to the service at the `admin-workload` port.
-
-```yaml
-apiVersion: mesh.consul.hashicorp.com/v2beta1
-kind: TCPRoute
-metadata:
- name: api-split
- namespace: default
-spec:
- parentRefs:
- - ref:
- type:
- group: catalog
- groupVersion: v2beta1
- kind: Service
- name: api
- # The virtual port number for the "api-workload" target port.
- port: "80"
- rules:
- - backendRefs:
- - backendRef:
- ref:
- type:
- group: catalog
- groupVersion: v2beta1
- kind: Service
- name: api
- # The virtual port number for the "api-workload" target port.
- port: "80"
- weight: 50
- - backendRef:
- ref:
- type:
- group: catalog
- groupVersion: v2beta1
- kind: Service
- name: api
- # The virtual port number for the "admin-workload" target port.
- port: "90"
- weight: 50
-```
diff --git a/website/content/docs/k8s/multiport/reference/trafficpermissions.mdx b/website/content/docs/k8s/multiport/reference/trafficpermissions.mdx
deleted file mode 100644
index 58a58fee6f..0000000000
--- a/website/content/docs/k8s/multiport/reference/trafficpermissions.mdx
+++ /dev/null
@@ -1,245 +0,0 @@
----
-layout: docs
-page_title: TrafficPermissions resource configuration reference
-description: The TrafficPermissions CRD defines rules for allowing and denying traffic between services within the service mesh. Learn how to configure traffic permissions for the v2 catalog to authorize service-to-service communication in a network with zero-trust security.
----
-
-# TrafficPermissions configuration reference
-
-This page provides reference information for the `TrafficPermissions` resource, which authorizes east-west traffic between services within the service mesh. The traffic permissions CRD replaces the service intentions CRD when using the v2 catalog API. Refer to [changes to Consul's existing architecture](/consul/docs/architecture/v2/catalog#changes-to-consul-s-existing-architecture) for more information.
-
-This custom resource definition (CRD) describes a resource related to the [Kubernetes GAMMA initiative](https://gateway-api.sigs.k8s.io/concepts/gamma/) that requires the [v2 catalog API](/consul/docs/architecture/v2/catalog). It is not compatible with the [v1 catalog API](/consul/docs/architecture/catalog). For more information about GAMMA resources, refer to the [Kubernetes Gateway API documentation](https://gateway-api.sigs.k8s.io/concepts/gamma/).
-
-## Configuration model
-
-The following list outlines field hierarchy, language-specific data types, and requirements in a traffic permissions CRD. Click on a property name to view additional details, including default values.
-
-- [`apiVersion`](#apiversion): string | required | must be set to `auth.consul.hashicorp.com/v2beta1`
-- [`kind`](#kind): string | required | must be set to `TrafficPermissions`
-- [`metadata`](#metadata): map | required
- - [`name`](#metadata-name): string | required
- - [`namespace`](#metadata-namespace): string | optional
-- [`spec`](#spec): map | required
- - [`destination`](#spec-destination): map
- - [`identityName`](#spec-destination-identityname): string
- - [`action`](#spec-action): string
- - [`permissions`](#spec-permissions): list of maps
- - [`sources`](#spec-permissions-sources): list of maps
- - [`identityName`](#spec-permissions-sources-identityname): string
- - [`destinationRules`](#spec-permissions-destinationrules): list of maps
- - [`portNames`](#spec-permissions-destinationrules-portnames): array of strings
-
-## Complete configuration
-
-When every field is defined, a traffic permissions CRD has the following form:
-
-```yaml
-apiVersion: auth.consul.hashicorp.com/v2beta1 # required
-kind: TrafficPermissions # required
-metadata:
- name:
- namespace:
-spec:
- destination:
- identityName:
- action: allow
- permissions:
- - sources:
- - identityName:
- destinationRules:
- - portNames:
- -
-```
-
-## Specification
-
-This section provides details about the fields you can configure in the `TrafficPermissions` custom resource definition (CRD).
-
-### `apiVersion`
-
-Specifies the version of the Consul API for integrating with Kubernetes. The value must be `auth.consul.hashicorp.com/v2beta1`.
-
-#### Values
-
-- Default: None
-- This field is required.
-- String value that must be set to `auth.consul.hashicorp.com/v2beta1`.
-
-### `kind`
-
-Specifies the type of CRD to implement. Must be set to `TrafficPermissions`.
-
-#### Values
-
-- Default: None
-- This field is required.
-- Data type: String value that must be set to `TrafficPermissions`.
-
-### `metadata`
-
-Map that contains an arbitrary name for the CRD and the namespace it applies to.
-
-#### Values
-
-- Default: None
-- Data type: Map
-
-### `metadata.name`
-
-Specifies a name for the CRD. The name is metadata that you can use to reference the resource when performing Consul operations, such as using the `consul resource` command. Refer to [`consul resource`](/consul/docs/k8s/connect/multiport/reference/resource-command) for more information.
-
-#### Values
-
-- Default: None
-- This field is required.
-- Data type: String
-
-### `metadata.namespace`
-
-Specifies the namespace that the service resolver applies to. Refer to [namespaces](/consul/docs/enterprise/namespaces) for more information.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec`
-
-Map that contains the details about the `TrafficPermissions` CRD. The `apiVersion`, `kind`, and `metadata` fields are siblings of the spec field. All other configurations are children.
-
-#### Values
-
-- Default: None
-- This field is required.
-- Data type: Map
-
-### `spec.destination`
-
-Specifies the proxies of the services where these traffic permissions apply.
-
-#### Values
-
-- Default: None
-- Data type: Map
-
-### `spec.destination.identityName`
-
-Specifies the Workload identity for a service. The permissions you configure in this `TrafficPermissions` CRD apply to sidecar proxies when a request has this identity as their destination.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec.action`
-
-Specifies whether the proxy should _allow traffic_ or _deny traffic_ between the destination in [`spec.destination`](#spec-destination) and the sources in [`spec.permissions.sources`](#spec-permissions-sources).
-
-`ACTION_DENY` is a governance feature available in Consul Enterprise that cannot be overridden by another `ACTION_ALLOW`.
-
-By default, Consul allows traffic between all services. When the Helm value `global.acls.manageSystemACLs` is set to `true`, then Consul operates in "default-deny" mode. In this mode, `TrafficPermissions` CRDs that allow traffic between services are required for service-to-service traffic.
-
-#### Values
-
-- Default: None
-- Data type: String that must contain one of the following values:
-
- - `ACTION_ALLOW`
- - `ACTION_DENY`
-
-### `spec.permissions`
-
-Permissions is a list of the traffic permissions Consul evaluates requests against. When the list contains more than one permission, Consul follows OR semantics to select the permission.
-
-#### Values
-
-- Default: None
-- Data type: List of maps
-
-### `spec.permissions.sources`
-
-Lists sources for traffic in the permission. This block contains information Consul uses to evaluate the service that originated the request when the sidecar proxy authorizes incoming traffic.
-
-To specify wildcard references in this block using `*`, omit all other fields. For example, you can apply traffic permissions to all namespaces using the wildcard, but you cannot specify an identity name, partition, peer, or sameness group in the same source.
-
-#### Values
-
-- Default: None
-- Data type: List of maps
-
-### `spec.permissions.sources.identityName`
-
-Specifies the Workload identity for the service that originates the request.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-### `spec.permissions.destinationRules`
-
-Specifies L7 properties to match against when Consul enforces traffic permissions.
-
-When [`spec.action`](#spec-action) _allows traffic_, Consul authorizes requests to the destination service when the request matches one or more rules defined in this block. Requests that do not match any rules are denied.
-
-When [`spec.action`](#spec-action) _denies traffic_, Consul denies authorization to requests that match one or more rules defined in this block. Requests that do not match any rules are allowed.
-
-#### Values
-
-- Default: None
-- Data type: List of maps
-
-### `spec.permissions.destinationRules.portNames`
-
-Specifies a port name that the Kubernetes Pod's container exposes at the destination.
-
-#### Values
-
-- Default: None
-- Data type: String
-
-## Examples
-
-The following examples demonstrate common `TrafficPermissions` CRD configuration patterns for specific use cases.
-
-### Allow traffic to multiple ports
-
-The following example configures traffic permissions to allow traffic when the `web` service makes a request to the `api` service on the `api` port or `admin` port.
-
-```yaml
-apiVersion: auth.consul.hashicorp.com/v2beta1
-kind: TrafficPermissions
-metadata:
- name: api-allow-web-all
-spec:
- destination:
- identityName: "api"
- action: ACTION_ALLOW
- permissions:
- - sources:
- - identityName: "web"
- destinationRules:
- - portNames: ["api", "admin"]
-
-```
-
-### Deny traffic between a service and a specific port
-
-The following example configures traffic permissions to deny traffic when the `web` service makes a request to the `api` service on the `admin` port.
-This `ACTION_DENY` cannot be overridden by another `ACTION_ALLOW`.
-
-```yaml
-apiVersion: auth.consul.hashicorp.com/v2beta1
-kind: TrafficPermissions
-metadata:
- name: web-to-admin-port-deny
-spec:
- destination:
- identityName: api
- action: ACTION_DENY
- permissions:
- - sources:
- - identityName: web
- destinationRules:
- - portNames: ["admin"]
-```
diff --git a/website/content/docs/k8s/multiport/traffic-split.mdx b/website/content/docs/k8s/multiport/traffic-split.mdx
deleted file mode 100644
index 4493c3d792..0000000000
--- a/website/content/docs/k8s/multiport/traffic-split.mdx
+++ /dev/null
@@ -1,113 +0,0 @@
----
-layout: docs
-page_title: Split traffic between multi-port services
-description: Learn how to configure Consul to split TCP traffic between two ports of a multi-port service using the TCPRoute resource and the v2 catalog API
----
-
-# Split TCP traffic between multi-port services
-
-
-
-The v2 catalog API is currently in beta. This documentation supports testing and development scenarios. Do not use the v2 catalog API in secure production environments.
-
-
-
-This page describes the process for splitting TCP, HTTP, and gRPC traffic between two ports of a multi-port service. It includes an example TCPRoute resource configuration to demonstrate Consul's multi-port features.
-
-## Prerequisites
-
-Splitting traffic between two ports of a multi-port service requires the [v2 catalog API](/consul/docs/architecture/v2/catalog).
-
-In addition, they are two different workflows for registering Services in Kubernetes using the v2 catalog API. The instructions on this page offer examples for two configuration methods:
-
-- **Method 1**: Register a Kubernetes service that select workloads which expose multiple ports
-- **Method 2**: Register multiple Kubernetes Services that direct traffic to an explicit port on the same workload
-
-For guidance on enabling the v2 catalog, deploying multi-port services using these methods, and applying traffic permissions to the services, refer to [configure multi-port services](/consul/docs/k8s/multiport/configure).
-
-## Overview
-
-Complete the following steps to implement a split in TCP traffic between two services:
-
-1. Define the resource's behavior in a custom resource definition (CRD).
-1. Apply the resource to your cluster.
-
-## Define route resource
-
-The following example splits traffic for the `api` service. TCP traffic for services registered to the Consul catalog that are available at the `api-workload` port is split so that 50% of the traffic routes to the service at the `api-workload` port and 50% routes to the service at the `admin-workload` port.
-
-
-
-```yaml
-apiVersion: mesh.consul.hashicorp.com/v2beta1
-kind: TCPRoute
-metadata:
- name: api-split
-spec:
- parentRefs:
- - ref:
- type:
- group: catalog
- groupVersion: v2beta1
- kind: Service
- name: api
- # The virtual port number for the "api-workload" target port.
- port: "80"
- rules:
- - backendRefs:
- - backendRef:
- ref:
- type:
- group: catalog
- groupVersion: v2beta1
- kind: Service
- name: api
- # The virtual port number for the "api-workload" target port.
- port: "80"
- weight: 50
- - backendRef:
- ref:
- type:
- group: catalog
- groupVersion: v2beta1
- kind: Service
- name: api
- # The virtual port number for the "admin-workload" target port.
- port: "90"
- weight: 50
-```
-
-
-
-## Apply the resource
-
-Use the `kubectl` command to apply the resource to your Consul cluster.
-
-```shell-session
-$ kubectl apply -f api-split.yaml
-```
-
-
-
-
-
-Then, open a shell session in the `web` container and test the `api` service on port 90.
-
-```shell-session
-$ kubectl exec -it ${WEB_POD} -c web -- curl api:90
-```
-
-
-
-
-
-Then, open a shell session in the `web` container and test the `api-admin` service on port 90.
-
-```shell-session
-$ kubectl exec -it ${WEB_POD} -c web -- curl api-admin:90
-```
-
-
-
-
-Half of the traffic should respond with the `hello world` response from port 80, instead of port 90's response of `hello world from 9090 admin`. Repeat the command several times to verify that you receive both responses.
diff --git a/website/content/docs/release-notes/consul/v1_17_x.mdx b/website/content/docs/release-notes/consul/v1_17_x.mdx
index da782d234b..378df6721e 100644
--- a/website/content/docs/release-notes/consul/v1_17_x.mdx
+++ b/website/content/docs/release-notes/consul/v1_17_x.mdx
@@ -15,13 +15,13 @@ We are pleased to announce the following Consul updates.
These APIs are the foundation for future versions of Consul and enable new functionalities, such as multi-port and host-name-based canary routing and routing traffic through headless services in native Kubernetes deployments.
- For more information, refer to the [Catalog API v2](/consul/docs/k8s/multiport#catalog-api-v2-beta) section in the documentation.
+ For more information, refer to the [Catalog API v2](/consul/docs/v1.17.x/k8s/multiport#catalog-api-v2-beta) section in the documentation.
These APIs are in beta and under active development, so we do not recommend using them in production.
- **Multi-port services in Consul:** You can now register services with multiple ports per service. The v2 catalog API enables a single sidecar proxy to support workloads on different ports. This significantly reduces the operational overhead for managing Consul service mesh. Support for other runtimes outside of Kubernetes is planned for future releases of Consul.
- Refer to the [Multi-port services for service mesh](/consul/docs/k8s/multiport#catalog-api-v2-beta) and [Configure multi-port services](/consul/docs/k8s/multiport/configure) for more information.
+ Refer to the [Multi-port services for service mesh](/consul/docs/v1.17.x/k8s/multiport#catalog-api-v2-beta) and [Configure multi-port services](/consul/docs/k8s/multiport/configure) for more information.
Multi-port is currently a beta feature in Consul v1.17.
diff --git a/website/content/docs/security/acl/acl-rules.mdx b/website/content/docs/security/acl/acl-rules.mdx
index 3503b589b9..a89985d528 100644
--- a/website/content/docs/security/acl/acl-rules.mdx
+++ b/website/content/docs/security/acl/acl-rules.mdx
@@ -19,7 +19,6 @@ The following table provides an overview of the resources you can use to create
| `partition`
`partition_prefix` | Controls access to one or more admin partitions.
See [Admin Partition Rules](#admin-partition-rules) for details. | Yes |
| `agent`
`agent_prefix` | Controls access to the utility operations in the [Agent API](/consul/api-docs/agent), such as `join` and `leave`.
See [Agent Rules](#agent-rules) for details. | Yes |
| `event`
`event_prefix` | Controls access to event operations in the [Event API](/consul/api-docs/event), such as firing and listing events.
See [Event Rules](#event-rules) for details. | Yes |
-| `identity`
`identity_prefix` | Controls access to workload identity operations in the [Catalog v2 group](/consul/docs/architecture/v2/catalog).
| `key`
`key_prefix` | Controls access to key/value store operations in the [KV API](/consul/api-docs/kv).
Can also use the `list` access level when setting the policy disposition.
Has additional value options in Consul Enterprise for integrating with [Sentinel](https://docs.hashicorp.com/sentinel/consul).
See [Key/Value Rules](#key-value-rules) for details. | Yes |
| `keyring` | Controls access to keyring operations in the [Keyring API](/consul/api-docs/operator/keyring).
See [Keyring Rules](#keyring-rules) for details. | No |
| `mesh` | Provides operator-level permissions for resources in the admin partition, such as ingress gateways or mesh proxy defaults. See [Mesh Rules](#mesh-rules) for details. | No |
@@ -248,48 +247,6 @@ operation, so to enable this feature in a Consul environment with ACLs enabled,
give agents a token with access to this event prefix, in addition to configuring
[`disable_remote_exec`](/consul/docs/agent/config/config-files#disable_remote_exec) to `false`.
-## Identity Rules
-
-The `identity` and `identity_prefix` resources control workload-identity-level registration and read access to the [Catalog v2 API group](/consul/docs/architecture/v2/catalog).
-Specify the resource label in identity rules to set the scope of the rule.
-The resource label in the following example is empty. As a result, the rules allow read-only access to any workload identity name with the empty prefix.
-The rules also allow read-write access to the `app` identity and deny all access to the `admin` identity:
-
-
-
-```hcl
-identity_prefix "" {
- policy = "read"
-}
-identity "app" {
- policy = "write"
-}
-identity "admin" {
- policy = "deny"
-}
-```
-
-```json
-{
- "identity_prefix": {
- "": {
- "policy": "read"
- }
- },
- "identity": {
- "app": {
- "policy": "write"
- },
- "admin": {
- "policy": "deny"
- }
- }
-}
-```
-
-
-
-
## Key/Value Rules
The `key` and `key_prefix` resources control access to key/value store operations in the [KV API](/consul/api-docs/kv).
diff --git a/website/data/commands-nav-data.json b/website/data/commands-nav-data.json
index 8e35ee0beb..2199c036df 100644
--- a/website/data/commands-nav-data.json
+++ b/website/data/commands-nav-data.json
@@ -494,15 +494,6 @@
"title": "reload",
"path": "reload"
},
- {
- "title": "resource",
- "path": "resource",
- "badge": {
- "text": "v2",
- "type": "outlined",
- "color": "neutral"
- }
- },
{
"title": "rtt",
"path": "rtt"
diff --git a/website/data/docs-nav-data.json b/website/data/docs-nav-data.json
index 7a8c32c4c7..5fcbc5394c 100644
--- a/website/data/docs-nav-data.json
+++ b/website/data/docs-nav-data.json
@@ -106,23 +106,6 @@
"title": "v1 Catalog",
"path": "architecture/catalog"
},
- {
- "title": "v2 architecture",
- "routes": [
- {
- "title": "Overview",
- "path": "architecture/v2"
- },
- {
- "title": "Catalog",
- "path": "architecture/v2/catalog"
- },
- {
- "title": "Resource groups",
- "path": "architecture/v2/groups"
- }
- ]
- },
{
"title": "Improving Consul Resilience",
"path": "architecture/improving-consul-resilience"
@@ -1601,48 +1584,6 @@
}
]
},
- {
- "title": "V2 Catalog API",
- "routes": [
- {
- "title": "Overview",
- "path": "k8s/multiport"
- },
- {
- "title": "Configure multi-port services",
- "path": "k8s/multiport/configure"
- },
- {
- "title": "Split TCP traffic between multiple ports",
- "path": "k8s/multiport/traffic-split"
- },
- {
- "title": "Reference",
- "routes": [
- {
- "title": "GRPCRoute resource",
- "path": "k8s/multiport/reference/grpcroute"
- },
- {
- "title": "HTTPRoute resource",
- "path": "k8s/multiport/reference/httproute"
- },
- {
- "title": "ProxyConfiguration resource",
- "path": "k8s/multiport/reference/proxyconfiguration"
- },
- {
- "title": "TCPRoute resource",
- "path": "k8s/multiport/reference/tcproute"
- },
- {
- "title": "TrafficPermissions resource",
- "path": "k8s/multiport/reference/trafficpermissions"
- }
- ]
- }
- ]
- },
{
"title": "L7 traffic management",
"routes": [
diff --git a/website/redirects.js b/website/redirects.js
index aabd6e1d78..362b3526af 100644
--- a/website/redirects.js
+++ b/website/redirects.js
@@ -212,16 +212,6 @@ module.exports = [
destination: '/consul/docs/v1.8.x/agent/config-entries/:slug',
permanent: true,
},
- {
- source: '/consul/docs/k8s/multiport/reference/resource-command/:slug',
- destination: '/consul/commands/resource/:slug',
- permanent: true,
- },
- {
- source: '/consul/commands/:version(v1\.(?:8|9|10|11|12|13|14|15|16|17)\.x)/resource/:slug*',
- destination: '/consul/docs/:version/k8s/multiport/reference/resource-command/:slug',
- permanent: true
- },
{
source: '/consul/docs/architecture/catalog/v1/:slug',
destination: '/consul/docs/architecture/catalog/:slug',
@@ -230,26 +220,31 @@ module.exports = [
{
source: '/consul/docs/:version(v1\.(?:8|9|10|11|12|13|14|15|16|17)\.x)/architecture/catalog/:slug*',
destination: '/consul/docs/:version/architecture/catalog/v1/:slug',
- permanent: true
- },
- {
- source: '/consul/docs/architecture/catalog/v2/:slug',
- destination: '/consul/docs/architecture/v2/catalog/:slug',
permanent: true,
},
- {
- source: '/consul/docs/:version(v1\.(?:8|9|10|11|12|13|14|15|16|17)\.x)/architecture/v2/catalog/:slug*',
- destination: '/consul/docs/:version/architecture/catalog/v2/:slug',
- permanent: true
- },
{
source: '/consul/docs/nia/network-drivers/terraform-cloud',
destination: '/consul/docs/nia/network-drivers/hcp-terraform',
- permanent: true
+ permanent: true,
},
{
source: '/consul/docs/:version(v1\.(?:8|9|10|11|12|13|14|15|16|17)\.x)/nia/network-drivers/hcp-terraform',
destination: '/consul/docs/:version/nia/network-drivers/terraform-cloud',
- permanent: true
+ permanent: true,
+ },
+ {
+ source: '/consul/docs/k8s/multiport/:slug',
+ destination: '/consul/docs/architecture/catalog#v2-catalog',
+ permanent: true,
+ },
+ {
+ source: 'consul/docs/architecture/v2/:slug*',
+ destination: '/consul/docs/architecture/catalog#v2-catalog',
+ permanent: true,
+ },
+ {
+ source: '/consul/commands/resource/:slug',
+ destination: '/consul/docs/architecture/catalog#v2-catalog',
+ permanent: true,
},
]