APISIX

APISIX Gateway - API routing, TLS termination, plugin execution (:9080/:9443)
APISIX Controller - Syncs ApisixRoute/ApisixUpstream CRDs to APISIX config
APISIX Dashboard - Admin web UI for route management
etcd - Configuration store for gateway state
CRDs - ApisixRoute, ApisixUpstream, ApisixTls, ApisixConsumer per linked service

gateway - HTTP/API Gateway Route

Each gateway generates: ApisixConsumer (if api_key) + ApisixUpstream + ApisixRoute + ApisixTls in route/gateway.yaml. Upstream can include multiple weighted backends via gateway-external_source_code links.

Attribute	Example	Impact
subdomain REQ	api	Host match: {subdomain}.{domain}
api_key	secret123	Enables key-auth plugin + generates ApisixConsumer

Common link attributes also apply: apisix_oidc_enable, apisix_oidc_param, apisix_timeout, websocket, rate_limiting, cors, cors_headers, whitelist, ip_whitelist, proxy_rewrite, headers (see Common Link Attributes below)

ai_gateway - AI Model Gateway Route

Each ai_gateway generates: ApisixConsumer (if api_key) + ApisixUpstream + ApisixRoute in route/ai_gateway.yaml. External AI backends generate additional resources in route/ai_gateway_external.yaml.

Attribute	Example	Impact
subdomain REQ	ai	Host match: {subdomain}.{domain}
api_key	secret123	Enables key-auth plugin + generates ApisixConsumer

Common link attributes also apply: apisix_oidc_enable, apisix_oidc_param, apisix_timeout, websocket, rate_limiting, cors, cors_headers, whitelist, ip_whitelist, proxy_rewrite, headers

AI Backend Link Attribute	Example	Impact
path	/v1/*	URL path match on ApisixRoute. Default: /v1/*
deny_patterns	(multiline list)	ai-prompt-guard plugin: blocked prompt patterns
allow_patterns	(multiline list)	ai-prompt-guard plugin: allowed prompt patterns
prompt_decorator	(multiline)	ai-prompt-decorator plugin: system prompt prepend rules
ai_rate_limit	(multiline config)	ai-rate-limiting plugin: AI-specific rate limits

gateway-external_source_code (gateway sub-component → backend)

Each gateway can link to multiple external_source_code backends. All backends are combined into a single ApisixUpstream with weighted load balancing in route/gateway.yaml.

Link Attribute	Default	Impact
weight	50	Load balancing weight in ApisixUpstream nodes list. Multiple backends get weighted distribution.

ai_gateway-vllm (ai_gateway sub-component → vLLM)

Routes to vLLM router service. Upstream: {name}-router-service.{namespace}.svc.cluster.local:80. Generated in route/ai_gateway.yaml.

Link Attribute	Default	Impact
subdomain REQ	-	Host match: {subdomain}.{domain}
path	/v1/*	URL path match on ApisixRoute
deny_patterns	-	ai-prompt-guard: blocked prompt patterns (multiline list)
allow_patterns	-	ai-prompt-guard: allowed prompt patterns (multiline list)
prompt_decorator	-	ai-prompt-decorator: system prompt prepend rules
ai_rate_limit	-	ai-rate-limiting: AI-specific rate limits

ai_gateway-model (ai_gateway sub-component → vLLM model)

Routes to individual vLLM model. Upstream: {model}.{parent_namespace}.svc.cluster.local:80. Same link attributes as ai_gateway-vllm (subdomain, path, deny_patterns, allow_patterns, prompt_decorator, ai_rate_limit).

ai_gateway-external_ai (ai_gateway sub-component → external AI provider)

Routes to external AI providers (OpenAI, Azure, etc.). Upstream: HTTPS on port 443 with scheme: https and passHost: node. Generated in route/ai_gateway_external.yaml.

Link Attribute	Default	Impact
ai_endpoint REQ	-	External AI endpoint (e.g. api.openai.com)
ai_provider	openai	Provider type. Azure (azure_openai): uses api-key header. Others: uses Authorization: Bearer header.
ai_provider_api_key	-	API key for external provider. Injected via proxy-rewrite headers.
subdomain, path	/v1/*	Same as internal backends
deny_patterns, allow_patterns, prompt_decorator, ai_rate_limit	-	Same AI plugins as internal backends

External route: https://{subdomain}.{domain}
Admin API: http://apisix-admin.{namespace}.svc.cluster.local:9180
Upstream pattern: {component}.{namespace}.svc.cluster.local:80
TLS secret: wildcard-tls-secret (cert-manager namespace)