+spec:
+ workloads: # required
+ filter: "Service.Meta.version == v1"
+ names: ["api", "admin"]
+ prefixes: ["", ""]
+ bootstrapConfig:
+ dogstatsdUrl:
+ overrideJsonTpl:
+ prometheusBindAddr: <0.0.0.0>
+ readyBindAddr:
+ staticClustersJson:
+ staticListenersJson:
+ statsBindAddr: <0.0.0.0>
+ statsConfigJson:
+ statsFlushInterval: 5000ms
+ statsSinkJson:
+ statsTags:
+ -
+ statsdUrl:
+ telemetryCollectorBindSocketDir:
+ tracingConfigJson:
+ dynamicConfig:
+ accessLogs:
+ enabled: false
+ disableListenerLogs: false
+ jsonFormat:
+ path:
+ textFormat:
+ type:
+ exposeConfig:
+ exposePaths:
+ listenerPort: 42
+ localPathPort: 4242
+ path:
+ protocol:
+ inboundConnections:
+ balanceInboundConnections:
+ maxInboundConnections: 1024
+ listenerTracingJson:
+ localClusterJson:
+ localConnection:
+ connectTimeout: <1s>
+ requestTimeout: <1s>
+ meshGatewayMode:
+ mode:
+ publicListenerJson:
+ transparentProxy:
+ dialedDirectly: false
+ outboundListenerPort: 15001
+```
+
+## Specification
+
+This section provides details about the fields you can configure in the `ProxyConfiguration` custom resource definition (CRD).
+
+### `apiVersion`
+
+Specifies the version of the Consul API for integrating with Kubernetes. The value must be `mesh.consul.hashicorp.com/v2beta1`.
+
+#### Values
+
+- Default: None
+- This field is required.
+- String value that must be set to `mesh.consul.hashicorp.com/v2beta1`.
+
+### `kind`
+
+Specifies the type of CRD to implement. Must be set to `ProxyConfiguration`.
+
+#### Values
+
+- Default: None
+- This field is required.
+- Data type: String value that must be set to `ProxyConfiguration`.
+
+### `metadata`
+
+Map that contains an arbitrary name for the CRD and the namespace it applies to.
+
+#### Values
+
+- Default: None
+- Data type: Map
+
+### `metadata.name`
+
+Specifies a name for the CRD. The name is metadata that you can use to reference the resource when performing Consul operations, such as using the `consul resource` command. Refer to [`consul resource`](/consul/docs/k8s/connect/multiport/reference/resource-command) for more information.
+
+#### Values
+
+- Default: None
+- This field is required.
+- Data type: String
+
+### `metadata.namespace`
+
+Specifies the namespace that the proxy configuration applies to. Refer to [namespaces](/consul/docs/enterprise/namespaces) for more information.
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec`
+
+Map that contains the details about the `ProxyConfiguration` CRD. The `apiVersion`, `kind`, and `metadata` fields are siblings of the spec field. All other configurations are children.
+
+#### Values
+
+- Default: None
+- This field is required.
+- Data type: Map
+
+### `spec.workloads`
+
+Specifies the workloads that the proxy configuration applies to. You can select workloads by name, prefix, or by using a filter expression.
+
+#### Values
+
+- Default: None
+- This field is required.
+- Data type: Map that can contain the following parameters:
+
+ | Parameter | Description | Data type | Default |
+ | :------------ | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------- | ------- |
+ | `filter` | Specifies an expression that filters workloads. For more information about creating and using expressions to filter, refer to [filtering](/consul/api-docs/features/filtering). | String | None |
+ | `names` | Specifies one or more names of workloads the proxy configuration applies to. | Array of strings | None |
+ | `prefixes` | Specifies one or more prefixes. Proxy configurations apply to workloads with one of the prefixes. | Array of strings | None |
+
+### `spec.bootstrapConfig`
+
+Specifies initial bootstrap settings for the Envoy proxy, as well as proxy configuration settings that require the proxy to restart when applied. For more information, refer to [Envoy proxy bootstrap configuration](/consul/docs/connect/proxies/envoy#bootstrap-configuration).
+
+#### Values
+
+- Default: None
+- Data type: Map
+
+### `spec.bootstrapConfig.dogstatsdUrl`
+
+Specifies a URL that identifies a DataDog DogStatsD listener. Envoy sends metrics to this listener.
+
+Format the URL as `udp://ip:port` or `unix://uds/path`. For example, `udp://127.0.0.1:8125` configures a local UDP DogStatsD listener for every host. TCP is not supported.
+
+The UDP URL must use an IP address. DNS names are not supported.
+
+For more information about configuring a UNIX domain socket with DogStatsD, refer to [the DataDog documentation](https://docs.datadoghq.com/developers/dogstatsd/unix_socket?tab=kubernetes#setup).
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec.bootstrapConfig.overrideJsonTpl`
+
+
+This field offers complete control of the proxy's bootstrap. Be aware that major deviations from the default template may break Consul's ability to correctly manage the proxy or enforce its security model.
+
+
+Specifies a template in Go template syntax to use in place of [the default template](https://github.com/hashicorp/consul/blob/71d45a34601423abdfc0a64d44c6a55cf88fa2fc/command/connect/envoy/bootstrap_tpl.go#L129) when generating the bootstrap configuration using the [`consul connect envoy` command](/consul/commands/connect/envoy). For information about the variables Consul can interpolate in the template, refer to the [documentation in `bootstrap_tpl.go`](https://github.com/hashicorp/consul/blob/71d45a34601423abdfc0a64d44c6a55cf88fa2fc/command/connect/envoy/bootstrap_tpl.go#L5).
+
+Refer to [Envoy proxy escape-hatch overrides](/consul/docs/connect/proxies/envoy#escape-hatch-overrides) for more information.
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec.bootstrapConfig.prometheusBindAddr`
+
+Configures the proxy to expose a Prometheus metrics endpoint to the public network. Format the endpoint as `ip:port`. The port and IP and port combination must be free within the network namespace where the proxy runs. The IP `0.0.0.0` binds to all available interfaces or a pod IP address if supported by your existing network settings.
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec.bootstrapConfig.readyBindAddr`
+
+Specifies the location to configure the proxy's readiness probe. Format as `ip:port`.
+
+ By default, the proxy does not have a readiness probe configured on it.
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec.bootstrapConfig.staticClustersJson`
+
+Specifies one or more [Envoy clusters](https://www.envoyproxy.io/docs/envoy/v1.17.2/api-v3/config/cluster/v3/cluster.proto) to append to the array of [static clusters](https://www.envoyproxy.io/docs/envoy/v1.17.2/api-v3/config/bootstrap/v3/bootstrap.proto#envoy-v3-api-field-config-bootstrap-v3-bootstrap-staticresources-clusters) in the bootstrap configuration.
+
+This field enables you to add custom clusters, such as tracing sinks, to the bootstrap configuration. In order to configure a single cluster, specify a single JSON object with the cluster details.
+
+Refer to [Envoy proxy advanced bootstrap options](/consul/docs/connect/proxies/envoy#advanced-bootstrap-options) for more information and examples.
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec.bootstrapConfig.staticListenersJson`
+
+Specifies one or more [Envoy listeners](https://www.envoyproxy.io/docs/envoy/v1.17.2/api-v3/config/listener/v3/listener.proto) to append to the array of [static listeners](https://www.envoyproxy.io/docs/envoy/v1.17.2/api-v3/config/bootstrap/v3/bootstrap.proto#envoy-v3-api-field-config-bootstrap-v3-bootstrap-staticresources-listeners) definitions.
+
+You can use this field to set up limited access that bypasses the service mesh's mTLS or authorization for health checks or metrics.
+
+Refer to [Envoy proxy advanced bootstrap options](/consul/docs/connect/proxies/envoy#advanced-bootstrap-options) for more information and examples.
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec.bootstrapConfig.statsBindAddr`
+
+Specifies that the proxy should expose the `/stats` prefix to the _public_ network at the `ip:port` provided. The IP and port combination must be free within the network namespace where the proxy runs. The IP `0.0.0.0` binds to all available interfaces or a pod IP address if supported by your existing network settings.
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec.bootstrapConfig.statsConfigJson`
+
+Specifies a complete [stats config](https://www.envoyproxy.io/docs/envoy/v1.17.2/api-v3/config/bootstrap/v3/bootstrap.proto#envoy-v3-api-field-config-bootstrap-v3-bootstrap-stats-config).
+
+When provided, this field overrides [`spec.bootstrapConfig.statsTags`](#spec-bootstrapconfig-statstags) and enables full control over dynamic tag replacements.
+
+Refer to [Envoy proxy advanced bootstrap options](/consul/docs/connect/proxies/envoy#advanced-bootstrap-options) for more information and examples.
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec.bootstrapConfig.statsFlushInterval`
+
+ Configures Envoy's [`stats_flush_interval`](https://www.envoyproxy.io/docs/envoy/v1.17.2/api-v3/config/bootstrap/v3/bootstrap.proto#envoy-v3-api-field-config-bootstrap-v3-bootstrap-stats-flush-interval), which measures the length of the interval between stats sink flushes.
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec.bootstrapConfig.statsSinkJson`
+
+Specifies one or more [stats sinks](https://www.envoyproxy.io/docs/envoy/v1.17.2/api-v3/config/bootstrap/v3/bootstrap.proto#envoy-v3-api-field-config-bootstrap-v3-bootstrap-stats-sinks) to append to sinks defined using [`spec.bootstrapConfig.statsdUrl`](#spec-bootstrapconfig-statsdurl) or [`spec.bootstrapConfig.dogstatsdUrl`](#spec-bootstrapconfig-dogstatsdurl).
+
+Refer to [Envoy proxy advanced bootstrap options](/consul/docs/connect/proxies/envoy#advanced-bootstrap-options) for more information and examples.
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec.bootstrapConfig.statsTags`
+
+Specifies one or more static tags to add to all metrics produced by the proxy.
+
+#### Values
+
+- Default: None
+- Data type: Array of strings
+
+### `spec.bootstrapConfig.statsdUrl`
+
+Specifies a URL that identifies a StatsD listener. Envoy sends metrics to this listener.
+
+Format the URL as `udp://ip:port`. For example, `udp://127.0.0.1:8125` configures a local StatsD listener for every host. TCP is not supported.
+
+The URL must use an IP address. DNS names are not supported.
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec.bootstrapConfig.telemetryCollectorBindSocketDir`
+
+Specifies the directory of the Unix socket Envoy sends metrics to so that the Consul telemetry collector can collect them.
+
+The socket is not configured by default.
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec.bootstrapConfig.tracingConfigJson`
+
+Specifies a configuration for an external tracing provider as described in [the Envoy documentation](https://www.envoyproxy.io/docs/envoy/v1.17.2/api-v3/config/bootstrap/v3/bootstrap.proto#envoy-v3-api-field-config-bootstrap-v3-bootstrap-tracing). Most tracing providers also require adding static clusters to define the endpoints to send tracing data to.
+
+Refer to [Envoy proxy advanced bootstrap options](/consul/docs/connect/proxies/envoy#advanced-bootstrap-options) for more information and examples.
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec.dynamicConfig`
+
+Specifies configuration settings for the Envoy proxy that are applied without restarting the proxy. For more information, refer to [Envoy proxy dynamic configuration](/consul/docs/connect/proxies/envoy#dynamic-configuration).
+
+#### Values
+
+- Default: None
+- Data type: Map
+
+### `spec.dynamicConfig.accessLogs`
+
+Specifies the format and output for the proxy's access logs.
+
+#### Values
+
+- Default: None
+- Data type: Map
+
+### `spec.dynamicConfig.accessLogs.enabled`
+
+When set to `true`, this parameter enables access logs for the proxy.
+
+#### Values
+
+- Default: `false`
+- Data type: Boolean
+
+### `spec.dynamicConfig.accessLogs.usableListenerLogs`
+
+When set to `true`, this parameter disables listener logs for connections that the proxy rejected because they did not have a matching listener filter.
+
+#### Values
+
+- Default: `false`
+- Data type: Boolean
+
+### `spec.dynamicConfig.accessLogs.jsonFormat`
+
+Specifies a JSON format dictionary for the access logs. Refer to [format dictionaries in the Envoy documentation](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#format-dictionaries) for more information.
+
+When this field is specified, you cannot also specify [`spec.dynamicConfig.accessLogs.textFormat`](#spec-dynamicconfig-accesslogs-textformat) in the same configuration.
+
+### `spec.dynamicConfig.accessLogs.path`
+
+Specifies a file output path for the access logs.
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec.dynamicConfig.accessLogs.textFormat`
+
+Specifies a format string for the access logs. Refer to [default format string in the Envoy documentation](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#default-format-string) for more information.
+
+When this field is specified, you cannot also specify [`spec.dynamicConfig.accessLogs.jsonFormat`](#spec-dynamicconfig-accesslogs-jsonformat) in the same configuration.
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec.dynamicConfig.accessLogs.type`
+
+Specifies the output type for the access logs.
+
+#### Values
+
+- Default: None
+- Data type: String containing one of the following values:
+
+ - `LOG_SINK_TYPE_DEFAULT`
+ - `LOG_SINK_TYPE_FILE`
+ - `LOG_SINK_TYPE_STDERR`
+ - `LOG_SINK_TYPE_STDOUT`
+
+### `spec.dynamicConfig.exposeConfig`
+
+Specifies configurations for exposing the proxy.
+
+Refer to [expose paths configuration reference](/consul/docs/connect/proxies/proxy-config-reference#expose-paths-configuration-reference) for more information.
+
+#### Values
+
+- Default: None
+- Data type: Map
+
+### `spec.dynamicConfig.exposeConfig.exposePaths`
+
+Specifies a configuration for exposing an HTTP path through the proxy.
+
+Refer to [expose paths configuration reference](/consul/docs/connect/proxies/proxy-config-reference#expose-paths-configuration-reference) for more information.
+
+#### Values
+
+- Default: None
+- Data type: Map
+
+### `spec.dynamicConfig.exposeConfig.exposePaths.listenerPort`
+
+Specifies the port where the proxy listens for connections. This port must be available for the listener to be set up. If the port is not free, Envoy does not expose a listener for the path but the proxy registration does not fail.
+
+#### Values
+
+- Default: None
+- Data type: Integer
+
+### `spec.dynamicConfig.exposeConfig.exposePaths.localPathPort`
+
+Specifies the port where the local service is listening for connections to the path.
+
+#### Values
+
+- Default: None
+- Data type: Integer
+
+### `spec.dynamicConfig.exposeConfig.exposePaths.path`
+
+The HTTP path to expose. Prefix the path with a slash. For example, `/metrics`.
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec.dynamicConfig.exposeConfig.exposePaths.protocol`
+
+Specifies the protocol of the listener, either HTTP or HTTP/2. For gRPC, use HTTP/2.
+
+#### Values
+
+- Default: None
+- Data type: String containing one of the following values:
+
+ - `EXPOSE_PATH_PROTOCOL_HTTP`
+ - `EXPOSE_PATH_PROTOCOL_HTTP2`
+
+### `spec.dynamicConfig.inboundConnections`
+
+Specifies configurations for how the proxy handles inbound connections.
+
+#### Values
+
+- Default: None
+- Data type: Map
+
+### `spec.dynamicConfig.inboundConnections.balanceInboundConnections`
+
+Specifies the strategy for balancing inbound connections across Envoy worker threads. Consul's service mesh Envoy integration supports the following values:
+
+| Value | Description |
+| :---- | :---------- |
+| Empty string | Inbound connections are not balanced. |
+| `exact_balance` | Balances inbound connections with [Envoy's Exact Balance Strategy](https://cloudnative.to/envoy/api-v3/config/listener/v3/listener.proto.html#config-listener-v3-listener-connectionbalanceconfig-exactbalance). |
+
+#### Values
+
+- Default: `""`
+- Data type: String
+
+### `spec.dynamicConfig.inboundConnections.maxInboundConnections`
+
+Specifies the maximum number of concurrent inbound connections to the local application instance. If not specified, inherits the Envoy default of `1024`.
+
+#### Values
+
+- Default: `1024`
+- Data type: Integer
+
+### `spec.dynamicConfig.listenerTracingJson`
+
+Specifies a tracing configuration to be inserted in the proxy's public and upstreams listeners. Refer to [the Envoy documentation](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#envoy-v3-api-msg-extensions-filters-network-http-connection-manager-v3-httpconnectionmanager-tracing) for more information.
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec.dynamicConfig.localClusterJson`
+
+Specifies a complete Envoy cluster to be delivered in place of the local application cluster. Use this field to customize timeouts, rate limits, and load balancing strategy.
+
+Refer to [cluster configuration in the Envoy documentation](https://www.envoyproxy.io/docs/envoy/v1.17.2/api-v3/config/cluster/v3/cluster.proto) for more information.
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec.dynamicConfig.localConnection`
+
+Specifies timeout settings for the proxy's connection to the local application. Apply settings separately for each port.
+
+Specify this field as a map containing a key/value. The map keys correspond to port names on the workload. The value contains this parameter's sub-fields.
+
+#### Values
+
+- Default: None
+- Data type: Map
+
+### `spec.dynamicConfig.localConnection.connectTimeout`
+
+Specifies the length of time the proxy is allowed to attempt connections to the local application instance before timing out.
+
+This field accepts a string indicating the number of seconds. For example, indicate five seconds with `5s` and five milliseconds with `0.005s`.
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec.dynamicConfig.localConnection.requestTimeout`
+
+Specifies the length of time the proxy is allowed to attempt HTTP requests to the local application instance. Applies to HTTP-based protocols only.
+
+This field accepts a string indicating the number of seconds. For example, indicate five seconds with `5s` and five milliseconds with `0.005s`.
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec.dynamicConfig.meshGatewayMode`
+
+Specifies the proxy's mode of operation for resolving upstreams in remote datacenter destinations. Refer to [Mesh gateway configuration reference](/consul/docs/connect/proxies/proxy-config-reference#mesh-gateway-configuration-reference) for more information.
+
+#### Values
+
+- Default: None
+- Data type: String containing one of the following values:
+
+ - `MESH_GATEWAY_MODE_UNSPECIFIED`
+ - `MESH_GATEWAY_MODE_NONE`
+ - `MESH_GATEWAY_MODE_LOCAL`
+ - `MESH_GATEWAY_MODE_REMOTE`
+
+### `spec.dynamicConfig.mode`
+
+Configures the proxy to operate in transparent, direct, or default mode. Refer to [proxy modes](/consul/docs/connect/proxies/proxy-config-reference#proxy-modes) for more information.
+
+#### Values
+
+- Default: None
+- Data type: String containing one of the following values:
+
+ - `PROXY_MODE_DEFAULT`
+ - `PROXY_MODE_TRANSPARENT`
+ - `PROXY_MODE_DIRECT`
+
+### `spec.dynamicConfig.publicListenerJson`
+
+Specifies a complete Envoy listener for Consul to deliver in place of the main public listener that the proxy uses to accept inbound connections. Refer to [escape-hatch overrides](/consul/docs/connect/proxies/envoy#escape-hatch-overrides) for more information
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec.dynamicConfig.transparentProxy`
+
+Specifies additional configurations for operating proxies in transparent proxy mode. Refer to [transparent proxy configuration reference](/consul/docs/connect/proxies/proxy-config-reference#transparent-proxy-configuration-reference) for more information.
+
+#### Values
+
+- Default: None
+- Data type: Map
+
+### `spec.dynamicConfig.transparentProxy.dialedDirectly`
+
+Determines whether this proxy instance's IP address can be dialed directly by transparent proxies. Transparent proxies typically dial upstreams using the _virtual_ tagged address, which load balances across instances. A database cluster with a leader is an example where dialing individual instances can be helpful.
+
+#### Values
+
+- Default: `false`
+- Data type: Boolean
+
+### `spec.dynamicConfig.transparentProxy.outboundListenerPort`
+
+Specifies the port the proxy listens on for outbound traffic to capture and redirect.
+
+#### Values
+
+- Default: `15001`
+- Data type: Integer
+
+## Examples
+
+The following examples demonstrate common ProxyConfiguration CRD configuration patterns for specific use cases.
+
+### Set a timeout on a subset of proxies
+
+The following example configures sidecar proxies scheduled with workloads whose names begin with `static-server-`. When these workloads attempt connections with the local `web` application, both requests and responses time out after 123 second.
+
+```yaml
+apiVersion: mesh.consul.hashicorp.com/v2beta1
+kind: ProxyConfiguration
+metadata:
+ name: static-server-override-one
+spec:
+ workloads:
+ prefixes:
+ - "static-server-"
+ bootstrapConfig:
+ statsBindAddr: "127.0.0.1:6666"
+ dynamicConfig:
+ # Only the web port should be enabled using the TPs
+ localConnection:
+ web:
+ connectTimeout: "123s" # This ALWAYS has to end in 's'. If you want ms, you need to use "0.123s"
+ requestTimeout: "123s"
+```
diff --git a/website/content/docs/k8s/multiport/reference/resource-command.mdx b/website/content/docs/k8s/multiport/reference/resource-command.mdx
new file mode 100644
index 000000000000..b7845787e3ab
--- /dev/null
+++ b/website/content/docs/k8s/multiport/reference/resource-command.mdx
@@ -0,0 +1,395 @@
+---
+layout: commands
+page_title: 'Commands: Resource'
+description: >-
+ The `consul resource` command interacts with Consul's v2 catalog of services and its resources. It exposes top-level commands for reading and filtering data from the registry.
+---
+
+# Consul Resource
+
+Command: `consul resource`
+
+Use the `resource` command to apply, list, read, and delete resources when interacting with Consul's v2 catalog through the command line. For more information, refer to [v2 catalog API](/consul/docs/concept/catalog/v2).
+
+The `consul resource` command has usage limitations in Consul v1.17.0. The CLI does not accept partition, namespace, and peer arguments, but the v2 catalog outputs this information when you add the `read` or `list` subcommand. In addition, do not use the `apply` and `delete` commands with Consul on Kubernetes in this release. Use the `kubectl` command to apply or delete resources instead. Refer to [configure multi-port services](/consul/docs/k8s/multiport/configure) for an example of the workflow to apply resources.
+
+## Usage
+
+```text
+Usage: consul resource [options]
+
+ # ...
+
+Subcommands:
+
+ apply Write or update resource information
+ delete Delete resource information
+ list Read all resources by type
+ read Read resource information
+```
+
+On Kubernetes deployments, you must use a `kubectl exec` command to open a shell to the Consul server's container before you can run this Consul CLI command.
+
+## Subcommands
+
+You can issue the following subcommands with the `consul resource` command.
+
+### `apply`
+
+`consul resource apply` writes or updates a resource at a given file path.
+
+The following table shows the required [ACLs permission](/consul/api-docs/api-structure#authentication) to run the `apply` command:
+
+| ACL Required |
+| ------------ |
+| `operator:write` |
+
+#### Command Options
+
+- `-f=` - (Required) The path to the file that defines the Consul resource. When the file that defines the resource is in the current working directory, you may optionally omit this flag and pass the resource filename only.
+
+#### Example usage
+
+The following command applies a traffic permissions resource to Consul that restricts service-to-service communication to authorized services only.
+
+```shell-session hideClipboard
+$ consul resource apply -f=trafficpermissions.hcl
+```
+
+### `delete`
+
+`consul resource delete` removes a Consul resource at a given file path.
+
+The following table shows the required [ACL permissions](/consul/api-docs/api-structure#authentication) to run the `delete` command:
+
+| ACL Required |
+| ------------ |
+| `operator:write` |
+
+#### Command Options
+
+- `-f=` - (Required) The path to the file that defines the Consul resource. When the file that defines the resource is in the current working directory, you may optionally omit this flag and pass the resource filename only.
+
+#### Example usage
+
+The following command removes a traffic permissions resource from Consul that restricts service-to-service communication to authorized services only.
+
+```shell-session hideClipboard
+$ consul resource delete -f=trafficpermissions.hcl
+```
+
+### `list`
+
+`consul resource list` outputs information about resources according to the type of resource and the location where the resource is applied.
+
+This command must be issued with a resource type. By formatting the type on the command line as `group.groupVersion.kind`, you can return all matching resources. For example, you can list information about services with `catalog.v2beta1.Service` and TCP routes with `mesh.v2beta1.TCPRoute`. Refer to [v2 catalog](/consul/docs/architecture/catalog/v2#catalog-structure) for more information.
+
+Do not include a resource name when listing resources.
+
+The following table shows the required [ACL permissions](/consul/api-docs/api-structure#authentication) to run the `list` command:
+
+| ACL Required |
+| ------------ |
+| `operator:read` |
+
+#### Command Options
+
+The following flags enable you to filter results.
+
+- `-partition=` - The partition where the resources apply.
+- `-namespace=` - The namespace where the resources apply.
+- `-peer=` - The clusters with established cluster peering connections where the resources apply.
+
+#### Example usage
+
+The following command lists resources that apply to services registered with the v2 catalog API, and includes a sample output for the `api` and `web` services registered in [configure multi-port services](/consul/docs/k8s/multiport/configure):
+
+```shell-session hideClipboard
+$ consul resource list catalog.v2beta1.Service
+
+{
+ "resources": [
+ {
+ "data": {
+ "ports": [
+ {
+ "protocol": "PROTOCOL_TCP",
+ "targetPort": "api",
+ "virtualPort": 80
+ },
+ {
+ "protocol": "PROTOCOL_MESH",
+ "targetPort": "mesh"
+ }
+ ],
+ "virtualIps": [
+ "10.96.216.242"
+ ],
+ "workloads": {
+ "prefixes": [
+ "api-7c86cd8cb9"
+ ]
+ }
+ },
+ "generation": "01HE8QWYFCTNEC2Q5JXKNXH6QW",
+ "id": {
+ "name": "api",
+ "tenancy": {
+ "namespace": "default",
+ "partition": "default",
+ "peerName": "local"
+ },
+ "type": {
+ "group": "catalog",
+ "groupVersion": "v2beta1",
+ "kind": "Service"
+ },
+ "uid": "01HE8QWYFCTNEC2Q5JXJ97M429"
+ },
+ "metadata": {
+ "k8s-namespace": "default",
+ "managed-by": "consul-k8s-endpoints-controller-v2"
+ },
+ "status": {
+ "consul.io/endpoint-manager": {
+ "conditions": [
+ {
+ "message": "A valid workload selector is present within the service.",
+ "reason": "SelectorFound",
+ "state": "STATE_TRUE",
+ "type": "EndpointsManaged"
+ },
+ {
+ "message": "Found workload identities associated with this service: \"api\".",
+ "reason": "WorkloadIdentitiesFound",
+ "state": "STATE_TRUE",
+ "type": "BoundIdentities"
+ }
+ ],
+ "observedGeneration": "01HE8QWYFCTNEC2Q5JXKNXH6QW",
+ "updatedAt": "2023-11-02T19:24:27.295564638Z"
+ }
+ },
+ "version": "118"
+ },
+ {
+ "data": {
+ "ports": [
+ {
+ "protocol": "PROTOCOL_TCP",
+ "targetPort": "admin",
+ "virtualPort": 90
+ },
+ {
+ "protocol": "PROTOCOL_MESH",
+ "targetPort": "mesh"
+ }
+ ],
+ "virtualIps": [
+ "10.96.231.41"
+ ],
+ "workloads": {
+ "prefixes": [
+ "api-7c86cd8cb9"
+ ]
+ }
+ },
+ "generation": "01HE8QWYFJCXYXT2F4SBZE95Q4",
+ "id": {
+ "name": "api-admin",
+ "tenancy": {
+ "namespace": "default",
+ "partition": "default",
+ "peerName": "local"
+ },
+ "type": {
+ "group": "catalog",
+ "groupVersion": "v2beta1",
+ "kind": "Service"
+ },
+ "uid": "01HE8QWYFJCXYXT2F4SAHV7KG8"
+ },
+ "metadata": {
+ "k8s-namespace": "default",
+ "managed-by": "consul-k8s-endpoints-controller-v2"
+ },
+ "status": {
+ "consul.io/endpoint-manager": {
+ "conditions": [
+ {
+ "message": "A valid workload selector is present within the service.",
+ "reason": "SelectorFound",
+ "state": "STATE_TRUE",
+ "type": "EndpointsManaged"
+ },
+ {
+ "message": "Found workload identities associated with this service: \"api\".",
+ "reason": "WorkloadIdentitiesFound",
+ "state": "STATE_TRUE",
+ "type": "BoundIdentities"
+ }
+ ],
+ "observedGeneration": "01HE8QWYFJCXYXT2F4SBZE95Q4",
+ "updatedAt": "2023-11-02T19:24:27.589881680Z"
+ }
+ },
+ "version": "122"
+ },
+ {
+ "data": {
+ "ports": [
+ {
+ "protocol": "PROTOCOL_TCP",
+ "targetPort": "80",
+ "virtualPort": 80
+ },
+ {
+ "protocol": "PROTOCOL_MESH",
+ "targetPort": "mesh"
+ }
+ ],
+ "virtualIps": [
+ "10.96.157.170"
+ ],
+ "workloads": {
+ "prefixes": [
+ "web-6fd5c8bf57"
+ ]
+ }
+ },
+ "generation": "01HE8QWYA9RSW2RS8GS5P538ZB",
+ "id": {
+ "name": "web",
+ "tenancy": {
+ "namespace": "default",
+ "partition": "default",
+ "peerName": "local"
+ },
+ "type": {
+ "group": "catalog",
+ "groupVersion": "v2beta1",
+ "kind": "Service"
+ },
+ "uid": "01HE8QWYA9RSW2RS8GS3922SK0"
+ },
+ "metadata": {
+ "k8s-namespace": "default",
+ "managed-by": "consul-k8s-endpoints-controller-v2"
+ },
+ "status": {
+ "consul.io/endpoint-manager": {
+ "conditions": [
+ {
+ "message": "A valid workload selector is present within the service.",
+ "reason": "SelectorFound",
+ "state": "STATE_TRUE",
+ "type": "EndpointsManaged"
+ },
+ {
+ "message": "Found workload identities associated with this service: \"web\".",
+ "reason": "WorkloadIdentitiesFound",
+ "state": "STATE_TRUE",
+ "type": "BoundIdentities"
+ }
+ ],
+ "observedGeneration": "01HE8QWYA9RSW2RS8GS5P538ZB",
+ "updatedAt": "2023-11-02T19:24:27.190972222Z"
+ }
+ },
+ "version": "115"
+ }
+ ]
+}
+```
+
+### `read`
+
+`consul resource read` outputs information about resources according to the type and name of the resource.
+
+This command must be issued with a resource type and a resource name. By formatting the type on the command line as `group.groupVersion.kind`, you can return all matching resources. For example, you can read information about services with `catalog.v2beta1.Service`, TCP routes with `mesh.v2beta1.TCPRoute`, and traffic permissions with `auth.v2beta1.TrafficPermissions`. Refer to [v2 catalog](/consul/docs/architecture/catalog/v2#catalog-structure) for more information.
+
+The following table shows the required [ACL permissions](/consul/api-docs/api-structure#authentication) to run the `read` command:
+
+| ACL Required |
+| ------------ |
+| `operator:read` |
+
+#### Command Options
+
+- `-partition=` - The partition where the resource applies.
+- `-namespace=` - The namespace where the resource applies.
+- `-peer=` - The clusters with established cluster peering connections where the resource applies.
+- `-stale` - Permits any Consul server to respond to the request. This flag enables for lower latency and higher throughput, but may result in stale data. This option has no effect on non-read operations.
+- `-token` - A Consul ACL token to include with the request.
+
+#### Example usage
+
+The following example demonstrates a command to read the `web` service and includes an example output that includes information such as ports, virtual IPs, and status.
+
+```shell-session hideClipboard
+$ consul resource read catalog.v2beta1.Service web
+
+{
+ "data": {
+ "ports": [
+ {
+ "protocol": "PROTOCOL_TCP",
+ "targetPort": "80",
+ "virtualPort": 80
+ },
+ {
+ "protocol": "PROTOCOL_MESH",
+ "targetPort": "mesh"
+ }
+ ],
+ "virtualIps": [
+ "10.96.98.157"
+ ],
+ "workloads": {
+ "prefixes": [
+ "web-6fd5c8bf57"
+ ]
+ }
+ },
+ "generation": "01HE6MPDXC1J6ZMEMPN1460Z6K",
+ "id": {
+ "name": "web",
+ "tenancy": {
+ "namespace": "default",
+ "partition": "default",
+ "peerName": "local"
+ },
+ "type": {
+ "group": "catalog",
+ "groupVersion": "v2beta1",
+ "kind": "Service"
+ },
+ "uid": "01HE6MPDXC1J6ZMEMPN0648FVB"
+ },
+ "metadata": {
+ "k8s-namespace": "default",
+ "managed-by": "consul-k8s-endpoints-controller-v2"
+ },
+ "status": {
+ "consul.io/endpoint-manager": {
+ "conditions": [
+ {
+ "message": "A valid workload selector is present within the service.",
+ "reason": "SelectorFound",
+ "state": "STATE_TRUE",
+ "type": "EndpointsManaged"
+ },
+ {
+ "message": "Found workload identities associated with this service: \"web\".",
+ "reason": "WorkloadIdentitiesFound",
+ "state": "STATE_TRUE",
+ "type": "BoundIdentities"
+ }
+ ],
+ "observedGeneration": "01HE6MPDXC1J6ZMEMPN1460Z6K",
+ "updatedAt": "2023-11-01T23:49:59.172604219Z"
+ }
+ },
+ "version": "137"
+}
+```
diff --git a/website/content/docs/k8s/multiport/reference/tcproute.mdx b/website/content/docs/k8s/multiport/reference/tcproute.mdx
new file mode 100644
index 000000000000..9dd8a4ca1bed
--- /dev/null
+++ b/website/content/docs/k8s/multiport/reference/tcproute.mdx
@@ -0,0 +1,341 @@
+---
+layout: docs
+page_title: TCPRoute resource configuration reference
+description: The TCPRoute resource CRD configures L4 TCP behavior within the service mesh. TCPRoute is a GAMMA resource that requires the v2 catalog API. Learn how to configure the TCPRoute CRD with specifications and example configurations.
+---
+
+# TCPRoute resource configuration reference
+
+This page provides reference information for the `TCPRoute` resource, which defines Transport Layer (L4) TCP traffic within the service mesh.
+
+This custom resource definition (CRD) describes a resource related to the [Kubernetes GAMMA initiative](https://gateway-api.sigs.k8s.io/concepts/gamma/) that requires the [v2 catalog API](/consul/docs/architecture/catalog/v2). It is not compatible with the [v1 catalog API](/consul/docs/architecture/catalog/v1). For more information about GAMMA resources, refer to the [Kubernetes Gateway API documentation](https://gateway-api.sigs.k8s.io/concepts/gamma/).
+
+## Configuration model
+
+The following list outlines field hierarchy, language-specific data types, and requirements in an TCP route CRD. Click on a property name to view additional details, including default values.
+
+
+
+
+
+- [`apiVersion`](#apiversion): string | required | must be set to `mesh.consul.hashicorp.com/v2beta1`
+- [`kind`](#kind): string | required | must be set to `TCPRoute`
+- [`metadata`](#metadata): map | required
+ - [`name`](#metadata-name): string | required
+ - [`namespace`](#metadata-namespace): string | optional
+- [`spec`](#spec): map | required
+ - [`parentRefs`](#spec-parentrefs): map | required
+ - [`port`](#spec-parentrefs-port): string
+ - [`ref`](#spec-parentrefs-ref): string | required
+ - [`name`](#spec-parentrefs-ref-name): string
+ - [`type`](#spec-parentrefs-ref-type): map
+ - [`group`](#spec-parentrefs-ref-type): string
+ - [`groupVersion`](#spec-parentrefs-ref-type): string
+ - [`kind`](#spec-parentrefs-ref-type): string
+ - [`rules`](#spec-rules): map | required
+ - [`backendRefs`](#spec-rules-backendrefs): map
+ - [`backendRef`](#spec-rules-backendrefs-backendref): map
+ - [`datacenter`](#spec-rules-backendrefs-backendref-datacenter): string
+ - [`port`](#spec-rules-backendrefs-backendref-port): string
+ - [`ref`](#spec-rules-backendrefs-backendref-ref): map
+ - [`name`](#spec-rules-backendrefs-backendref-ref-name): string
+ - [`type`](#spec-rules-backendrefs-backendref-ref-type): map
+ - [`group`](#spec-rules-backendrefs-backendref-ref-type): string
+ - [`groupVersion`](#spec-rules-backendrefs-backendref-ref-type): string
+ - [`kind`](#spec-rules-backendrefs-backendref-ref-type): string
+ - [`weight`](#spec-rules-backendrefs-weight): number
+
+
+
+
+## Complete configuration
+
+When every field is defined, a TCP route CRD has the following form:
+
+```yaml
+apiVersion: mesh.consul.hashicorp.com/v2beta1 # required
+kind: TCPRoute # required
+metadata:
+ name:
+ namespace:
+spec:
+ parentRefs:
+ port:
+ - ref:
+ name:
+ type:
+ group:
+ groupVersion:
+ kind:
+ rules:
+ - backendRefs:
+ - backendRef:
+ datacenter:
+ port:
+ ref:
+ name:
+ type:
+ group:
+ groupVersion:
+ kind:
+ weight: 1
+```
+
+## Specification
+
+This section provides details about the fields you can configure in the `TCPRoute` custom resource definition (CRD).
+
+### `apiVersion`
+
+Specifies the version of the Consul API for integrating with Kubernetes. The value must be `mesh.consul.hashicorp.com/v2beta1`.
+
+#### Values
+
+- Default: None
+- This field is required.
+- String value that must be set to `mesh.consul.hashicorp.com/v2beta1`.
+
+### `kind`
+
+Specifies the type of CRD to implement. Must be set to `TCPRoute`.
+
+#### Values
+
+- Default: None
+- This field is required.
+- Data type: String value that must be set to `TCPRoute`.
+
+### `metadata`
+
+Map that contains an arbitrary name for the CRD and the namespace it applies to.
+
+#### Values
+
+- Default: None
+- Data type: Map
+
+### `metadata.name`
+
+Specifies a name for the CRD. The name is metadata that you can use to reference the resource when performing Consul operations, such as using the `consul resource` command. Refer to [`consul resource`](/consul/docs/k8s/connect/multiport/reference/resource-command) for more information.
+
+#### Values
+
+- Default: None
+- This field is required.
+- Data type: String
+
+### `metadata.namespace`
+
+Specifies the namespace that the service resolver applies to. Refer to [namespaces](/consul/docs/enterprise/namespaces) for more information.
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec`
+
+Map that contains the details about the `TCPRoute` CRD. The `apiVersion`, `kind`, and `metadata` fields are siblings of the spec field. All other configurations are children.
+
+When using this CRD, the `spec` field closely resembles the `TCPRoute` GAMMA resource. Refer to [TCPRoute in the Kubernetes documentation](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1alpha2.TCPRoute).
+
+#### Values
+
+- Default: None
+- This field is required.
+- Data type: Map
+
+### `spec.parentRefs`
+
+Specifies the services and other resources to attach the route to. You can only define one `parentsRefs` configuration for each route. To attach the route to multiple resources, specify additional [`spec.parentRefs.ref`](#spec-parentrefs-ref) configurations in the `parentsRefs` block. You can only specify the name of one port for the route. Any resources that send traffic through the route use the same port.
+
+#### Values
+
+- Default: None
+- This field is required.
+- Data type: Map
+
+### `spec.parentRefs.port`
+
+Specifies the name of the port that the configuration applies to.
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec.parentRefs.ref`
+
+Specifies the resource that the route attaches to.
+
+#### Values
+
+- Default: None
+- Data type: Map
+
+### `spec.parentRefs.ref.name`
+
+Specifies the user-defined name of the resource that the configuration applies to.
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec.parentRefs.ref.type`
+
+Specifies the type of resource that the configuration applies to. To reference a service in the Consul catalog, configure the resource type as `catalog.v2beta1.Service`.
+
+#### Values
+
+- Default: None
+- Data type: Map containing the following parameters:
+
+ | Parameter | Description | Data type | Default |
+ | :------------ | :------------------------------------------------------------------- | :-------- | :------- |
+ | `group` | Specifies a group for the resource type within the Kubernetes cluster. To reference a service in the Consul catalog, set this parameter to `catalog`. | String | None |
+ | `groupVersion` | Specifies a groupVersion for the resource type within the Kubenretes cluster. To reference a service in the Consul catalog, set this parameter to `v2beta1`. | String | None |
+ | `kind` | Specifies the kind of the Kubernetes object the resource applies to. To reference a service in the Consul catalog, set this parameter to `Service`. | String | None |
+
+### `spec.rules`
+
+Specifies rules for sidecar proxies to direct a service's TCP traffic within the service mesh.
+
+#### Values
+
+- Default: None
+- Data type: Map
+
+### `spec.rules.backendRefs`
+
+Specifies the Kubernetes Service backend to direct TCP traffic to when a request matches the service described in [`spec.parentRefs`](#spec-parentrefs). The Service backend is the collection of endpoint IPs for the service. Refer to [the Kubernetes Gateway API specification](https://gateway-api.sigs.k8s.io/concepts/gamma/#an-overview-of-the-gateway-api-for-service-mesh) for more information about Service backends.
+
+When a valid Service backend cannot be reached and no additional filters apply, traffic that matches the rule returns a 500 status code.
+
+When different Service backends are specified in [`spec.rules.backendRefs.weight`](#spec-rules-backendrefs-weight) and one of the backends is invalid, Consul continues to apply the specified weights instead of adjusting the relative weights to exclude traffic to the invalid backend. For example, when traffic is configured in a 50-50 split between `api` and `admin` and no valid endpoints for `admin` can be reached, the 50% of traffic intended for `admin` returns with a 500 status code.
+
+#### Values
+
+- Default: None
+- Data type: Map
+
+### `spec.rules.backendRefs.backendRef`
+
+Specifies an individual Service backend where matching requests should be sent.
+
+#### Values
+
+- Default: None
+- Data type: Map
+
+### `spec.rules.backendRefs.backendRef.datacenter`
+
+Specifies the name of the Consul datacenter that registered the Service backend that the configuration routes traffic to.
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec.rules.backendRefs.backendRef.port`
+
+Specifies the name of the port for the Consul service that the configuration routes traffic to.
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec.rules.backendRefs.backendRef.ref`
+
+The Consul service that the configuration routes traffic to.
+
+#### Values
+
+- Default: None
+- Data type: Map
+
+### `spec.rules.backendRefs.backendRef.ref.name`
+
+Specifies the user-defined name of the resource that the configuration routes traffic to.
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec.rules.backendRefs.backendRef.ref.type`
+
+Specifies the type of resource that the configuration routes traffic to. To reference a service in the Consul catalog, configure the resource type as `catalog.v2beta1.Service`.
+
+#### Values
+
+- Default: None
+- Data type: Map containing the following parameters:
+
+ | Parameter | Description | Data type | Default |
+ | :------------ | :------------------------------------------------------------------- | :-------- | :------- |
+ | `group` | Specifies a group for the resource type within the Kubernetes cluster. To reference a service in the Consul catalog, set this parameter to `catalog`. | String | None |
+ | `groupVersion` | Specifies a groupVersion for the resource type within the Kubenretes cluster. To reference a service in the Consul catalog, set this parameter to `v2beta1`. | String | None |
+ | `kind` | Specifies the kind of the Kubernetes object for the resource. To reference a service in the Consul catalog, set this parameter to `Service`. | String | None |
+
+### `spec.rules.backendRefs.weight`
+
+Specifies the proportion of requests routed to the specified service.
+
+This proportion is relative to the sum of all weights in the [`spec.rules.backendRefs`](#spec-rules-backendrefs) block. As a result, weights do not need to add up to 100. When only one backend is specified and the weight is greater then 0, Consul forwards 100% of traffic to the backend.
+
+When this parameter is not specified, Consul defaults to `1`.
+
+#### Values
+
+- Default: `1`
+- Data type: Integer
+
+## Examples
+
+The following examples demonstrate common TCPRoute CRD configuration patterns for specific use cases.
+
+### Split TCP traffic between two ports
+
+The following example splits traffic for the `api` service. TCP traffic for services registered to the Consul catalog that are available at the `api` port is split so that 50% of the traffic routes to the service at the `api` port and 50% routes to the service at the `admin` port.
+
+```yaml
+apiVersion: mesh.consul.hashicorp.com/v2beta1
+kind: TCPRoute
+metadata:
+ name: api-split
+ namespace: default
+spec:
+ parentRefs:
+ - ref:
+ type:
+ group: catalog
+ groupVersion: v2beta1
+ kind: Service
+ name: api
+ # The configuration targets the workload port, not the service port.
+ port: "api"
+ rules:
+ - backendRefs:
+ - backendRef:
+ ref:
+ type:
+ group: catalog
+ groupVersion: v2beta1
+ kind: Service
+ name: api
+ # The configuration targets the workload port, not the service port.
+ port: "api"
+ weight: 50
+ - backendRef:
+ ref:
+ type:
+ group: catalog
+ groupVersion: v2beta1
+ kind: Service
+ name: api
+ # The configuration targets the workload port, not the service port.
+ port: "admin"
+ weight: 50
+```
\ No newline at end of file
diff --git a/website/content/docs/k8s/multiport/reference/trafficpermissions.mdx b/website/content/docs/k8s/multiport/reference/trafficpermissions.mdx
new file mode 100644
index 000000000000..0eae49e88b47
--- /dev/null
+++ b/website/content/docs/k8s/multiport/reference/trafficpermissions.mdx
@@ -0,0 +1,242 @@
+---
+layout: docs
+page_title: TrafficPermissions resource configuration reference
+description: The TrafficPermissions CRD defines rules for allowing and denying traffic between services within the service mesh. Learn how to configure traffic permissions for the v2 catalog to authorize service-to-service communication in a network with zero-trust security.
+---
+
+# TrafficPermissions configuration reference
+
+This page provides reference information for the `TrafficPermissions` resource, which authorizes east-west traffic between services within the service mesh. The traffic permissions CRD replaces the service intentions CRD when using the v2 catalog API. Refer to [changes to Consul's existing architecture](/consul/docs/architecture/catalog/v2#changes-to-consul-s-existing-architecture) for more information.
+
+This custom resource definition (CRD) describes a resource related to the [Kubernetes GAMMA initiative](https://gateway-api.sigs.k8s.io/concepts/gamma/) that requires the [v2 catalog API](/consul/docs/architecture/catalog/v2). It is not compatible with the [v1 catalog API](/consul/docs/architecture/catalog/v1). For more information about GAMMA resources, refer to the [Kubernetes Gateway API documentation](https://gateway-api.sigs.k8s.io/concepts/gamma/).
+
+## Configuration model
+
+The following list outlines field hierarchy, language-specific data types, and requirements in a traffic permissions CRD. Click on a property name to view additional details, including default values.
+
+- [`apiVersion`](#apiversion): string | required | must be set to `auth.consul.hashicorp.com/v2beta1`
+- [`kind`](#kind): string | required | must be set to `TrafficPermissions`
+- [`metadata`](#metadata): map | required
+ - [`name`](#metadata-name): string | required
+ - [`namespace`](#metadata-namespace): string | optional
+- [`spec`](#spec): map | required
+ - [`destination`](#spec-destination): map
+ - [`identityName`](#spec-destination-identityname): string
+ - [`action`](#spec-action): string
+ - [`permissions`](#spec-permissions): list of maps
+ - [`sources`](#spec-permissions-sources): map
+ - [`identityName`](#spec-permissions-sources-identityname): string
+ - [`destinationRules`](#spec-permissions-destinationrules):
+ - [`portNames`](#spec-permissions-destinationrules-portNames): array of strings
+
+## Complete configuration
+
+When every field is defined, a traffic permissions CRD has the following form:
+
+```yaml
+apiVersion: auth.consul.hashicorp.com/v2beta1 # required
+kind: TrafficPermissions # required
+metadata:
+ name:
+ namespace:
+spec:
+ destination:
+ identityName:
+ action: allow
+ permissions:
+ - sources:
+ identityName:
+ destinationRules:
+ portNames:
+ -
+```
+
+## Specification
+
+This section provides details about the fields you can configure in the `TrafficPermissions` custom resource definition (CRD).
+
+### `apiVersion`
+
+Specifies the version of the Consul API for integrating with Kubernetes. The value must be `auth.consul.hashicorp.com/v2beta1`.
+
+#### Values
+
+- Default: None
+- This field is required.
+- String value that must be set to `auth.consul.hashicorp.com/v2beta1`.
+
+### `kind`
+
+Specifies the type of CRD to implement. Must be set to `TrafficPermissions`.
+
+#### Values
+
+- Default: None
+- This field is required.
+- Data type: String value that must be set to `TrafficPermissions`.
+
+### `metadata`
+
+Map that contains an arbitrary name for the CRD and the namespace it applies to.
+
+#### Values
+
+- Default: None
+- Data type: Map
+
+### `metadata.name`
+
+Specifies a name for the CRD. The name is metadata that you can use to reference the resource when performing Consul operations, such as using the `consul resource` command. Refer to [`consul resource`](/consul/docs/k8s/connect/multiport/reference/resource-command) for more information.
+
+#### Values
+
+- Default: None
+- This field is required.
+- Data type: String
+
+### `metadata.namespace`
+
+Specifies the namespace that the service resolver applies to. Refer to [namespaces](/consul/docs/enterprise/namespaces) for more information.
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec`
+
+Map that contains the details about the `TrafficPermissions` CRD. The `apiVersion`, `kind`, and `metadata` fields are siblings of the spec field. All other configurations are children.
+
+#### Values
+
+- Default: None
+- This field is required.
+- Data type: Map
+
+### `spec.destination`
+
+Specifies the proxies of the services where these traffic permissions apply.
+
+#### Values
+
+- Default: None
+- Data type: Map
+
+### `spec.destination.identityName`
+
+Specifies the Workload identity for a service. The permissions you configure in this `TrafficPermissions` CRD apply to sidecar proxies when a request has this identity as their destination.
+
+#### Values
+
+- Default: None
+- Data type: String
+
+### `spec.action`
+
+Specifies whether the proxy should _allow traffic_ or _deny traffic_ between the destination in [`spec.destination`](#spec-destination) and the sources in [`spec.permissions.sources`](#spec-permissions-sources).
+
+By default, Consul allows traffic between all services. When the Helm value `global.acls.manageSystemACLs` is set to `true`, then Consul operates in "default-deny" mode. In this mode, `TrafficPermissions` CRDs that allow traffic between services are required for service-to-service traffic.
+
+#### Values
+
+- Default: None
+- Data type: String that must contain one of the following values:
+
+ - `ACTION_ALLOW`
+ - `ACTION_DENY`
+
+### `spec.permissions`
+
+Permissions is a list of the traffic permissions Consul evaluates requests against. When the list contains more than one permission, Consul follows OR semantics to select the permission.
+
+#### Values
+
+- Default: None
+- Data type: List of maps
+
+### `spec.permissions.sources`
+
+Lists sources for traffic in the permission. This block contains information Consul uses to evaluate the service that originated the request when the sidecar proxy authorizes incoming traffic.
+
+To specify wildcard references in this block using `*`, omit all other fields. For example, you can apply traffic permissions to all namespaces using the wildcard, but you cannot specify an identity name, partition, peer, or sameness group in the same source.
+
+#### Values
+
+- Default: None
+- Data type: Map
+
+### `spec.permissions.sources.identityName`
+
+Specifies the Workload identity for the service that originates the request.
+
+#### Values
+
+- Default: None
+- Data type: Map
+
+### `spec.permissions.destinationRules`
+
+Specifies L7 properties to match against when Consul enforces traffic permissions.
+
+When [`spec.action`](#spec-action) _allows traffic_, Consul authorizes requests to the destination service when the request matches one or more rules defined in this block. Requests that do not match any rules are denied.
+
+When [`spec.action`](#spec-action) _denies traffic_, Consul denies authorization to requests that match one or more rules defined in this block. Requests that do not match any rules are allowed.
+
+#### Values
+
+- Default: None
+- Data type: Map
+
+### `spec.permissions.destinationRules.portNames`
+
+Specifies a port name that the Kubernetes Service exposes at the destination.
+
+#### Values
+
+- Default: None
+- Data type: String
+
+## Examples
+
+The following examples demonstrate common `TrafficPermissions` CRD configuration patterns for specific use cases.
+
+### Allow traffic to multiple ports
+
+The following example configures traffic permissions to allow traffic when the `web` service makes a request to the `api` service on the `api` port or `admin` port.
+
+```yaml
+apiVersion: auth.consul.hashicorp.com/v2beta1
+kind: TrafficPermissions
+metadata:
+ name: api-allow-web-all
+spec:
+ destination:
+ identityName: "api"
+ action: ACTION_ALLOW
+ permissions:
+ - sources:
+ - identityName: "web"
+ destinationRules:
+ - portNames: ["api", "admin"]
+
+```
+
+### Deny traffic between a service and a specific port
+
+The following example configures traffic permissions to deny traffic when the `web` service makes a request to the `api` service on the `admin` port.
+
+```yaml
+apiVersion: auth.consul.hashicorp.com/v2beta1
+kind: TrafficPermissions
+metadata:
+ name: web-to-admin-port-deny
+spec:
+ destination:
+ identityName: api
+ action: ACTION_DENY
+ permissions:
+ - sources:
+ - identityName: web
+ destinationRules:
+ - portNames: ["admin"]
+```
diff --git a/website/content/docs/k8s/multiport/traffic-split.mdx b/website/content/docs/k8s/multiport/traffic-split.mdx
new file mode 100644
index 000000000000..23a714f12466
--- /dev/null
+++ b/website/content/docs/k8s/multiport/traffic-split.mdx
@@ -0,0 +1,164 @@
+---
+layout: docs
+page_title: Split traffic between multi-port services
+description: Learn how to configure Consul to split TCP traffic between two ports of a multi-port service using the TCPRoute resource and the v2 catalog API
+---
+
+# Split TCP traffic between multi-port services
+
+
+
+Multi-port services are part of a beta release. This documentation supports testing and development scenarios. Do not use multi-port services or the v2 catalog API in secure production environments.
+
+
+
+This page describes the process for splitting TCP, HTTP, and gRPC traffic between two ports of a multi-port service. It includes an example TCPRoute resource configuration to demonstrate Consul's multi-port features.
+
+## Prerequisites
+
+Splitting traffic between two ports of a multi-port service requires the [v2 catalog API](/consul/docs/architecture/catalog/v2).
+
+In addition, how you define a multi-port service affects how Services are addressed in Kubernetes. The instructions on this page offer examples for two configuration methods:
+
+- **Method 1**: Define a single Kubernetes Service that exposes multiple ports
+- **Method 2**: Define multiple Kubernetes Services that expose individual ports
+
+For guidance on enabling the v2 catalog, deploying multi-port services using these methods, and applying traffic permissions to the services, refer to [configure multi-port services](/consul/docs/k8s/multiport/configure).
+
+## Overview
+
+Complete the following steps to implement a split in TCP traffic between two services:
+
+1. Define the resource's behavior in a custom resource definition (CRD).
+1. Apply the resource to your cluster.
+
+## Define route resource
+
+The following example splits traffic for the services in the `api` Pod.
+
+
+
+
+
+TCP traffic for services registered to the Consul catalog that are available at the `admin` port is split so that 50% of the traffic routes to the service at the `api` port and 50% routes to the service at the `admin` port.
+
+
+
+```yaml
+apiVersion: mesh.consul.hashicorp.com/v2beta1
+kind: TCPRoute
+metadata:
+ name: api-split
+spec:
+ parentRefs:
+ - ref:
+ type:
+ group: catalog
+ groupVersion: v2beta1
+ kind: Service
+ name: api
+ port: "admin"
+ rules:
+ - backendRefs:
+ - backendRef:
+ ref:
+ type:
+ group: catalog
+ groupVersion: v2beta1
+ kind: Service
+ name: api
+ port: "api"
+ weight: 50
+ - backendRef:
+ ref:
+ type:
+ group: catalog
+ groupVersion: v2beta1
+ kind: Service
+ name: api
+ port: "admin"
+ weight: 50
+```
+
+
+
+
+
+
+TCP traffic for services registered to the Consul catalog that are available at the `api-admin` port is split so that 50% of the traffic routes to the service at the `api` port and 50% routes to the service at the `api-admin` port.
+
+
+
+```yaml
+apiVersion: mesh.consul.hashicorp.com/v2beta1
+kind: TCPRoute
+metadata:
+ name: api-split
+spec:
+ parentRefs:
+ - ref:
+ type:
+ group: catalog
+ groupVersion: v2beta1
+ kind: Service
+ name: api-admin
+ port: "admin"
+ rules:
+ - backendRefs:
+ - backendRef:
+ ref:
+ type:
+ group: catalog
+ groupVersion: v2beta1
+ kind: Service
+ name: api
+ port: "api"
+ weight: 50
+ - backendRef:
+ ref:
+ type:
+ group: catalog
+ groupVersion: v2beta1
+ kind: Service
+ name: api-admin
+ port: "admin"
+ weight: 50
+```
+
+
+
+
+
+
+## Apply the resource
+
+Use the `kubectl` command to apply the resource to your Consul cluster.
+
+```shell-session
+$ kubectl apply -f api-split.yaml
+```
+
+
+
+
+
+Then, open a shell session in the `web` container and test the `api` service on port 90.
+
+```shell-session
+$ kubectl exec -it ${WEB_POD} -c web -- curl api:90
+```
+
+
+
+
+
+Then, open a shell session in the `web` container and test the `api-admin` service on port 90.
+
+```shell-session
+$ kubectl exec -it ${WEB_POD} -c web -- curl api-admin:90
+```
+
+
+
+
+Half of the traffic should respond with the `hello world` response from port 80, instead of port 90's response of `hello world from 9090 admin`. Repeat the command several times to verify that you receive both responses.
\ No newline at end of file
diff --git a/website/data/docs-nav-data.json b/website/data/docs-nav-data.json
index 90b167036c68..6864013e8dcf 100644
--- a/website/data/docs-nav-data.json
+++ b/website/data/docs-nav-data.json
@@ -102,6 +102,19 @@
"title": "Overview",
"path": "architecture"
},
+ {
+ "title": "Catalog",
+ "routes": [
+ {
+ "title": "v1 API",
+ "path": "architecture/catalog/v1"
+ },
+ {
+ "title": "v2 API",
+ "path": "architecture/catalog/v2"
+ }
+ ]
+ },
{
"title": "Improving Consul Resilience",
"path": "architecture/improving-consul-resilience"
@@ -1532,6 +1545,39 @@
{
"title": "Configure multi-port services",
"path": "k8s/multiport/configure"
+ },
+ {
+ "title": "Split TCP traffic between multi-port services",
+ "path": "k8s/multiport/traffic-split"
+ },
+ {
+ "title": "Reference",
+ "routes": [
+ {
+ "title": "Consul resource command",
+ "path": "k8s/multiport/reference/resource-command"
+ },
+ {
+ "title": "GRPCRoute resource",
+ "path": "k8s/multiport/reference/grpcroute"
+ },
+ {
+ "title": "HTTPRoute resource",
+ "path": "k8s/multiport/reference/httproute"
+ },
+ {
+ "title": "ProxyConfiguration resource",
+ "path": "k8s/multiport/reference/proxyconfiguration"
+ },
+ {
+ "title": "TCPRoute resource",
+ "path": "k8s/multiport/reference/tcproute"
+ },
+ {
+ "title": "TrafficPermissions resource",
+ "path": "k8s/multiport/reference/trafficpermissions"
+ }
+ ]
}
]
},