SupportConsoleDevelopersStart a trialContact

Chapter 3. Plan policy references for configuration

Understand the detailed references for each component of that you need to configure a Plan Policy.

3.1. PlanPolicy custom resource parameters
Copy link

Understand the configuration parameters available for the PlanPolicy custom resource so that you can use the object effectively.

Table 3.1. PlanPolicy custom resource configuration fields definitions table
ParameterDescription

spec.targetRef

A reference to an existing Gateway API resource. A PlanPolicy object can target a Gateway, HTTPRoute, or GRPCRoute. The target resource must be in the same namespace as the PlanPolicy object.

spec.plans

An ordered list of plan definitions. Plans are evaluated in sequence and the first plan whose predicate evaluates to true is applied. More specific predicates must appear before more general ones.

spec.plans.tier

A unique string identifier for the plan tier, for example gold, silver, or bronze.

spec.plans.predicate

Specifies a Common Expression Language (CEL) expression evaluated against the authenticated request context.

spec.plans.limits

Specifies the rate limiting configuration for the tier.

3.2. Target an HTTPRoute in a PlanPolicy
Copy link

When a PlanPolicy object targets an HTTPRoute custom resource (CR), you can use the following example to enforce the plan-based rate limits on all traffic flowing through that specific route.

Example enforcement of plan-based rate limits on HTTPRoute CR traffic

apiVersion: extensions.kuadrant.io/v1alpha1
kind: PlanPolicy
metadata:
  name: <sample_app>
  namespace: ${KUADRANT_DEVELOPER_NS}
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: <sample_app>
  plans:
    - tier: gold
      predicate: |
        has(auth.identity) && auth.identity.metadata.annotations["secret.kuadrant.io/plan-id"] == "gold"
      limits:
        daily: 1000
        weekly: 5000
    - tier: silver
      predicate: |
        has(auth.identity) && auth.identity.metadata.annotations["secret.kuadrant.io/plan-id"] == "silver"
      limits:
        daily: 500
        weekly: 2000
    - tier: bronze
      predicate: |
        has(auth.identity) && auth.identity.metadata.annotations["secret.kuadrant.io/plan-id"] == "bronze"
      limits:
        daily: 100
        weekly: 500

  • Replace <sample_app> with the name of your application.

  • Replace ${KUADRANT_DEVELOPER_NS} with the namespace for your object.

    Note

    The Common Expression Language (CEL) expressions can be anything that applies to your use case. You can use an expression different from the secret.kuadrant.io/plan-id expression.

3.3. Target a GRPCRoute in a PlanPolicy
Copy link

When a PlanPolicy object targets a GRPCRoute custom resource (CR), you can use the following example to enforce the plan-based rate limits on all traffic flowing through that specific route:

Example enforcement of plan-based rate limits on GRPCRoute CR traffic

apiVersion: extensions.kuadrant.io/v1alpha1
kind: PlanPolicy
metadata:
  name: <sample_app>
  namespace: ${KUADRANT_DEVELOPER_NS}
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: GRPCRoute
    name: <sample_app>
  plans:
    - tier: gold
      predicate: |
        has(auth.identity) && auth.identity.metadata.annotations["secret.kuadrant.io/plan-id"] == "gold"
      limits:
        daily: 1000
        weekly: 5000
    - tier: silver
      predicate: |
        has(auth.identity) && auth.identity.metadata.annotations["secret.kuadrant.io/plan-id"] == "silver"
      limits:
        daily: 500
        weekly: 2000
    - tier: bronze
      predicate: |
        has(auth.identity) && auth.identity.metadata.annotations["secret.kuadrant.io/plan-id"] == "bronze"
      limits:
        daily: 100
        weekly: 500

  • Replace <sample_app> with the name of your application.
  • Replace {KUADRANT_DEVELOPER_NS} with the namespace for your object.
Note

The Common Expression Language (CEL) expressions can be anything that applies to your use case. You can use an expression different from the secret.kuadrant.io/plan-id expression.

3.4. Target a Gateway object in a PlanPolicy
Copy link

When a PlanPolicy object targets a Gateway custom resource (CR), Connectivity Link enforces the plan-based rate limits on all routes attached to that Gateway CR, as shown in the following example.

Example enforcement of plan-based rate limits on a Gateway object

apiVersion: extensions.kuadrant.io/v1alpha1
kind: PlanPolicy
metadata:
  name: <sample_app>
  namespace: ${KUADRANT_GATEWAY_NS}
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: _<sample_app>
  plans:
    # ...

  • Replace <sample_app> with the name of the application.
  • Replace ${KUADRANT_GATEWAY_NS} with the namespace for the Gateway object

3.5. Plan predicates in PlanPolicies
Copy link

Plan predicates are CEL expressions that determine which plan tier applies to a request. Connectivity Link evaluates predicates in the order they appear in spec.plans and selects the first plan whose predicate returns true.

The following patterns are supported:

Plan identified by an annotation on the API key Secret
predicate: |
  has(auth.identity) && auth.identity.metadata.annotations["secret.kuadrant.io/plan-id"] == "gold"
Plan identified by a JWT claim
predicate: |
  has(auth.identity) && auth.identity.sub == "premium-user"
Plan identified by multiple conditions
predicate: |
  has(auth.identity) &&
  auth.identity.metadata.annotations["secret.kuadrant.io/plan-id"] == "gold" &&
  auth.identity.metadata.labels["app"] == "my-app"

The has(auth.identity) check at the start of each predicate confirms that the request is authenticated before evaluating plan-specific conditions.

3.6. Plan limits for Plan Policy objects
Copy link

The limits field in each plan definition sets the maximum number of requests allowed within each time window. All fields are optional. Specify only the windows relevant to your use case.

FieldDescription

daily

Maximum requests per calendar day.

weekly

Maximum requests per calendar week.

monthly

Maximum requests per calendar month.

yearly

Maximum requests per calendar year.

custom

One or more custom windows. Each entry requires a limit (integer) and a window (duration string, for example "1h" or "1m").

The following example shows a plan snippet using all available limit types: 

#...
limits:
  daily: 1000
  weekly: 5000
  monthly: 20000
  yearly: 200000
  custom:
    - limit: 100
      window: "1h"
#...
Red Hat logoGithubRedditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Legal Notice

Theme

© 2026 Red HatBack to top