API Reference

API Reference

Packages:

• twingate.com/v1beta

twingate.com/v1beta

Resource Types:

• TwingateCertificateAuthority

• TwingateConnector

• TwingateGateway

• TwingateGroup

• TwingateResourceAccess

• TwingateResource

TwingateCertificateAuthority

^{↩ Parent}

TwingateCertificateAuthority represents a Certificate Authority in Twingate.

Name	Type	Description	Required
apiVersion	string	twingate.com/v1beta	true
kind	string	TwingateCertificateAuthority	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the `metadata` field.	true
spec	object	TwingateCertificateAuthoritySpec defines the desired state of TwingateCertificateAuthority	true
status	object		false

TwingateCertificateAuthority.spec

^{↩ Parent}

TwingateCertificateAuthoritySpec defines the desired state of TwingateCertificateAuthority

Name	Type	Description	Required
name	string	Name used at creation if the Certificate Authority doesn't exist yet in Twingate. Validations: self == oldSelf: name is immutable	true
secretRef	object	Reference to the kubernetes.io/tls Secret the CA's public certificate (ca.crt) is read from. Validations: self == oldSelf: secretRef is immutable	true
id	string		false
type	enum	Type of the Certificate Authority. Only X509 is currently supported. Enum: X509 Default: X509	false

TwingateCertificateAuthority.spec.secretRef

^{↩ Parent}

Reference to the kubernetes.io/tls Secret the CA's public certificate (ca.crt) is read from.

Name	Type	Description	Required
name	string	Name of the Secret object.	true
namespace	string	Namespace of the Secret object. Defaults to the TwingateCertificateAuthority's own namespace when omitted.	false

TwingateConnector

^{↩ Parent}

TwingateConnector represents a Connector in Twingate.

Name	Type	Description	Required
apiVersion	string	twingate.com/v1beta	true
kind	string	TwingateConnector	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the `metadata` field.	true
spec	object	TwingateConnectorSpec defines the desired state of TwingateConnector Validations: (!has(oldSelf.id) || self.id == oldSelf.id): id is immutable once set (!has(oldSelf.remoteNetworkId) || self.remoteNetworkId == oldSelf.remoteNetworkId): remoteNetworkId is immutable once set (has(self.image) && !has(self.imagePolicy)) || (!has(self.image) && has(self.imagePolicy)) || (!has(self.image) && !has(self.imagePolicy)): Can define either `image` or `imagePolicy`, not both.	true
status	object		false

TwingateConnector.spec

^{↩ Parent}

TwingateConnectorSpec defines the desired state of TwingateConnector

Name	Type	Description	Required
containerExtra	object	Extra container configuration for the Connector Deployment's pod template at `.spec.template.spec.containers`.	false
hasStatusNotificationsEnabled	boolean	Enable status notifications for the Connector. Default: true	false
id	string		false
image	object	Image defines the image to use for the Connector.	false
imagePolicy	object	ImagePolicy defines the image to use for the Connector and a schedule to keep it up to date. Validations: self.provider != "google" || (self.provider == "google" && !has(self.repository)): Google provider requires specifying repository.	false
logAnalytics	boolean	Enable real-time connection logs. Default: true	false
logLevel	integer	Log level for the Connector (-1 to 7: -1 for no logs, 0 - least verbose, 7 - most verbose, default: 3). Default: 3 Minimum: -1 Maximum: 7	false
name	string	Name of the Connector (optional, if not specified Twingate will give a random name)	false
podAnnotations	object	Extra annotations to add to the Connector Deployment's pod template at `.spec.template.metadata.annotations`.	false
podExtra	object	Extra pod configuration to be added to the Connector Deployment's pod template at `.spec.template.spec`	false
podLabels	object	Extra labels to add to the Connector Deployment's pod template at `.spec.template.metadata.labels`.	false
remoteNetworkId	string	ID of the Twingate Remote Network this Connector belongs to. Overrides the operator-wide default (TWINGATE_REMOTE_NETWORK_ID). Immutable once set.	false
sidecarContainers	[]object	SidecarContainers allows injecting additional containers to the Connector Pod.	false

TwingateConnector.spec.image

^{↩ Parent}

Image defines the image to use for the Connector.

Name	Type	Description	Required
repository	string	Repository to use for the Connector. Default: twingate/connector	false
tag	string	Tag to use for the Connector. Default: 1	false

TwingateConnector.spec.imagePolicy

^{↩ Parent}

ImagePolicy defines the image to use for the Connector and a schedule to keep it up to date.

Name	Type	Description	Required
provider	enum	Provider determines how the operator looks for a new connector version. * dockerhub: Check Twingate's official DockerHub repository (`twingate/connector`) for new tags. * google: Check Google Container Registry specified by the `repository` value for new tags. Enum: dockerhub, google Default: dockerhub	true
allowPrerelease	boolean	Allow pre-release versions. Default: false	false
repository	string	Repository to use for pod's image. Default: twingate/connector	false
schedule	string	Cron schedule to check for new versions.	false
version	string	Semver version specifier (ex: '^1.0.0'). Uses NPM spec: https://github.com/npm/node-semver#ranges	false

TwingateGateway

^{↩ Parent}

TwingateGateway represents a Gateway in Twingate.

Name	Type	Description	Required
apiVersion	string	twingate.com/v1beta	true
kind	string	TwingateGateway	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the `metadata` field.	true
spec	object	TwingateGatewaySpec defines the desired state of TwingateGateway Validations: (!has(oldSelf.remoteNetworkId) || self.remoteNetworkId == oldSelf.remoteNetworkId): remoteNetworkId is immutable once set	true
status	object		false

TwingateGateway.spec

^{↩ Parent}

TwingateGatewaySpec defines the desired state of TwingateGateway

Name	Type	Description	Required
serviceRef	object	Reference to the Service fronting the Gateway. The operator resolves the host from the Service and combines it with port into status.address.	true
x509CertificateAuthorityRef	object	Reference to the TwingateCertificateAuthority whose X509 CA signs this Gateway's TLS certificates.	true
id	string		false
remoteNetworkId	string	ID of the Twingate Remote Network this Gateway belongs to. Overrides the operator-wide default (TWINGATE_REMOTE_NETWORK_ID). Immutable once set.	false

TwingateGateway.spec.serviceRef

^{↩ Parent}

Reference to the Service fronting the Gateway. The operator resolves the host from the Service and combines it with port into status.address.

Name	Type	Description	Required
name	string	Name of the Service object.	true
port	integer	Port the Gateway is reachable on. Minimum: 1 Maximum: 65535	true
namespace	string	Namespace of the Service object. Defaults to the TwingateGateway's own namespace when omitted.	false

TwingateGateway.spec.x509CertificateAuthorityRef

^{↩ Parent}

Reference to the TwingateCertificateAuthority whose X509 CA signs this Gateway's TLS certificates.

Name	Type	Description	Required
name	string	Name of the TwingateCertificateAuthority object.	true
namespace	string	Namespace of the TwingateCertificateAuthority object. Defaults to the TwingateGateway's own namespace when omitted.	false

TwingateGroup

^{↩ Parent}

TwingateGroup represents a Group in Twingate.

Name	Type	Description	Required
apiVersion	string	twingate.com/v1beta	true
kind	string	TwingateGroup	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the `metadata` field.	true
spec	object	TwingateGroupSpec defines the desired state of TwingateGroup	true
status	object		false

TwingateGroup.spec

^{↩ Parent}

TwingateGroupSpec defines the desired state of TwingateGroup

Name	Type	Description	Required
name	string	Name of the group.	true
id	string		false

TwingateResourceAccess

^{↩ Parent}

TwingateResourceAccess represents a resource access policy in Twingate. It allows to configure an access between a Resource and a Principal which is either a Group or a ServiceAccount.

Name	Type	Description	Required
apiVersion	string	twingate.com/v1beta	true
kind	string	TwingateResourceAccess	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the `metadata` field.	true
spec	object	TwingateResourceAccessSpec defines the desired state of TwingateResourceAccess	true
status	object		false

TwingateResourceAccess.spec

^{↩ Parent}

TwingateResourceAccessSpec defines the desired state of TwingateResourceAccess

Name	Type	Description	Required
accessPolicy	object	Access policy applied to this access edge. Omitting the field or setting it to null clears any existing policy. Must be null when the principal is a ServiceAccount. Validations: self.mode != 'AUTO_LOCK' || has(self.durationSeconds): durationSeconds is required when mode is AUTO_LOCK self.mode != 'MANUAL' || !has(self.durationSeconds): durationSeconds must not be set when mode is MANUAL	false
approvalMode	enum	Approval mode for the access edge. Omitting the field or setting it to null clears any existing value. Must be null when the principal is a ServiceAccount. Enum: MANUAL, AUTOMATIC	false
expiresAt	string	RFC3339 datetime when this access expires. Omitting the field or setting it to null clears any existing expiration. Must be null when the principal is a ServiceAccount. Format: date-time	false
groupRef	object	groupRef specifies the TwingateGroup kubernetes object reference to provide access to. Validations: self == oldSelf: groupRef is immutable.	false
principalExternalRef	object	principalExternalRef allows referencing a Principal (Group/ServiceAccount) by name.	false
principalId	string	principalId is the ID of the principal (Group/ServiceAccount) to provide access to the resource. Validations: self == oldSelf: principalId is immutable	false
resourceRef	object	resourceRef specifies the TwingateResource reference to provide access to. Validations: self == oldSelf: resourceRef is immutable.	false
securityPolicyId	string		false

TwingateResourceAccess.spec.accessPolicy

^{↩ Parent}

Access policy applied to this access edge. Omitting the field or setting it to null clears any existing policy. Must be null when the principal is a ServiceAccount.

Name	Type	Description	Required
mode	enum	Access mode. Enum: MANUAL, AUTO_LOCK, ACCESS_REQUEST	true
durationSeconds	integer	Duration of the access policy in seconds. Used with AUTO_LOCK and ACCESS_REQUEST mode. Minimum: 3600 Maximum: 3.1536e+07	false

TwingateResourceAccess.spec.groupRef

^{↩ Parent}

groupRef specifies the TwingateGroup kubernetes object reference to provide access to.

Name	Type	Description	Required
name	string	Name of the TwingateGroup object.	false
namespace	string	Namespace of the TwingateGroup object. Defaults to the TwingateResourceAccess's own namespace when omitted.	false

TwingateResourceAccess.spec.principalExternalRef

^{↩ Parent}

principalExternalRef allows referencing a Principal (Group/ServiceAccount) by name.

Name	Type	Description	Required
name	string	Name of the external reference to match. (Note: name uniqueness is not enforce, if 2 entities match the same name, the first will be used) Validations: self == oldSelf: principalExternalRef.name is immutable	true
type	enum	Type of the external reference. Validations: self == oldSelf: principalExternalRef.type is immutable Enum: group, serviceAccount	true

TwingateResourceAccess.spec.resourceRef

^{↩ Parent}

resourceRef specifies the TwingateResource reference to provide access to.

Name	Type	Description	Required
name	string	Name of the resource.	false
namespace	string	Namespace of the TwingateResource object. Defaults to the TwingateResourceAccess's own namespace when omitted.	false

TwingateResource

^{↩ Parent}

TwingateResource represents a resource in Twingate.

Name	Type	Description	Required
apiVersion	string	twingate.com/v1beta	true
kind	string	TwingateResource	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the `metadata` field.	true
spec	object	TwingateResourceSpec defines the desired state of TwingateResource Validations: (self.isBrowserShortcutEnabled && !(self.address.contains('*') || self.address.contains('?'))) || (self.isBrowserShortcutEnabled == false): if isBrowserShortcutEnabled is set to true, then address can't be wildcard (self.type == "Network" && !has(self.gatewayRef)) || ((self.type == "Kubernetes" || self.type == "WebApp") && has(self.gatewayRef)): Kubernetes and WebApp Resources require gatewayRef; Network Resources do not allow it (self.type == "WebApp" && has(self.downstream) && has(self.upstream)) || (self.type != "WebApp" && !has(self.downstream) && !has(self.upstream)): WebApp Resource requires downstream and upstream; other Resource types allow neither !has(self.requestHeaderRewrites) || self.type == "WebApp": requestHeaderRewrites can only be set for WebApp Resources (self.isBrowserShortcutEnabled && self.type == "Network") || (self.isBrowserShortcutEnabled == false): isBrowserShortcutEnabled can only be set to true for Network Resources (!has(oldSelf.remoteNetworkId) || self.remoteNetworkId == oldSelf.remoteNetworkId): remoteNetworkId is immutable once set	true
status	object		false

TwingateResource.spec

^{↩ Parent}

TwingateResourceSpec defines the desired state of TwingateResource

Name	Type	Description	Required
address	string	Address of the resource.	true
name	string	Name of the resource.	true
alias	string	Alias of the resource.	false
downstream	object	Downstream (client-facing) configuration for a WebApp Resource.	false
gatewayRef	object	Reference to the TwingateGateway this Kubernetes or WebApp Resource is served by.	false
id	string		false
isBrowserShortcutEnabled	boolean	isBrowserShortcutEnabled specifies whether the resource will display a browser shortcut in the Twingate client. Default: false	false
isVisible	boolean	isVisible specifies whether the resource will display in the main resources list in the Twingate client. Default: true	false
protocols	object	protocols specifies the resource's protocol policies.	false
remoteNetworkId	string	ID of the Twingate Remote Network this Resource belongs to. Overrides the operator-wide default (TWINGATE_REMOTE_NETWORK_ID). Immutable once set.	false
requestHeaderRewrites	[]object	HTTP headers to rewrite on requests to the upstream of a WebApp Resource.	false
securityPolicyId	string		false
syncLabels	boolean	syncLabels specifies whether the resource should sync the metadata labels as resource tags in the Twingate client. Default: true	false
type	enum	The resource type Validations: self == oldSelf: Resource type is immutable Enum: Network, Kubernetes, WebApp Default: Network	false
upstream	object	Upstream (target) configuration for a WebApp Resource.	false

TwingateResource.spec.downstream

^{↩ Parent}

Downstream (client-facing) configuration for a WebApp Resource.

Name	Type	Description	Required
port	integer	The downstream port. Minimum: 1 Maximum: 65535	true

TwingateResource.spec.gatewayRef

^{↩ Parent}

Reference to the TwingateGateway this Kubernetes or WebApp Resource is served by.

Name	Type	Description	Required
name	string	Name of the TwingateGateway object.	true
namespace	string	Namespace of the TwingateGateway object. Defaults to the TwingateResource's own namespace when omitted.	false

TwingateResource.spec.protocols

^{↩ Parent}

protocols specifies the resource's protocol policies.

Name	Type	Description	Required
allowIcmp	boolean	allowIcmp specifies whether the resource will allow ICMP traffic.	false
tcp	object	tcp specifies the resource's TCP protocol policy. Validations: (self.policy == "ALLOW_ALL" && size(self.ports) == 0) || (self.policy == "RESTRICTED"): Can't specify port ranges for ALLOW_ALL policy.	false
udp	object	udp specifies the resource's UDP protocol policy. Validations: (self.policy == "ALLOW_ALL" && size(self.ports) == 0) || (self.policy == "RESTRICTED"): Can't specify port ranges for ALLOW_ALL policy.	false

TwingateResource.spec.protocols.tcp

^{↩ Parent}

tcp specifies the resource's TCP protocol policy.

Name	Type	Description	Required
policy	enum	Enum: ALLOW_ALL, RESTRICTED	false
ports	[]object	Default: []	false

TwingateResource.spec.protocols.tcp.ports[index]

^{↩ Parent}

Name	Type	Description	Required
end	integer	Minimum: 1 Maximum: 65535	false
start	integer	Minimum: 1 Maximum: 65535	false

TwingateResource.spec.protocols.udp

^{↩ Parent}

udp specifies the resource's UDP protocol policy.

Name	Type	Description	Required
policy	enum	Enum: ALLOW_ALL, RESTRICTED	false
ports	[]object	Default: []	false

TwingateResource.spec.protocols.udp.ports[index]

^{↩ Parent}

Name	Type	Description	Required
end	integer	Minimum: 1 Maximum: 65535	false
start	integer	Minimum: 1 Maximum: 65535	false

TwingateResource.spec.requestHeaderRewrites[index]

^{↩ Parent}

Name	Type	Description	Required
name	string	The header name.	true
value	string	The header value.	true

TwingateResource.spec.upstream

^{↩ Parent}

Upstream (target) configuration for a WebApp Resource.

Name	Type	Description	Required
port	integer	The upstream port. Minimum: 1 Maximum: 65535	true