From a78787d40eb42ea8737926c7a952be17ee2e637a Mon Sep 17 00:00:00 2001 From: tpeslalz Date: Wed, 22 Jul 2026 14:43:53 +0000 Subject: [PATCH 1/6] =?UTF-8?q?=F0=9F=94=A7=20infrastructure:=20parameteri?= =?UTF-8?q?ze=20envoyExtAuthzHttp=20extensionProviders=20via=20Helm=20valu?= =?UTF-8?q?es?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Parameterize Istio extensionProviders in base-cloud chart via values-cloud.yaml to decouple commercial auth configuration from open-source release manifests. #### Why Parameterize Istio extensionProviders via Helm values to achieve clean OSS/commercial separation and eliminate fragile post-install ConfigMap patching. #### The code changes include: - Support -f / --values CLI flags in deploy.sh - Add additionalExtensionProviders Go template snippet to ConfigMap/istio in update-istio.sh and istio-generated.yaml - Set default istio.additionalExtensionProviders: [] in values-cloud.yaml TESTED=UNITTESTS (bazel test //src/app_charts/base/... passed) RELNOTES=NONE Created using jj-spr --- deploy.sh | 27 +++++++++++++++++++++----- src/app_charts/base/values-cloud.yaml | 3 +++ third_party/istio/istio-generated.yaml | 5 ++++- third_party/istio/update-istio.sh | 17 +++++++++++++++- 4 files changed, 45 insertions(+), 7 deletions(-) diff --git a/deploy.sh b/deploy.sh index 97998c245..6bf469d15 100755 --- a/deploy.sh +++ b/deploy.sh @@ -305,6 +305,19 @@ function helm_region_shared { --set "use_tv_verbose=${CRC_USE_TV_VERBOSE}" ) + shift 6 + while [[ $# -gt 0 ]]; do + case "$1" in + -f|--values) + values+=(-f "$2") + shift 2 + ;; + *) + shift + ;; + esac + done + ${SYNK_COMMAND} --context "${CLUSTER_CONTEXT}" init echo "synk init done" @@ -334,12 +347,14 @@ function helm_main_region { "${INGRESS_IP}" \ "${GCP_REGION}" \ "${GCP_ZONE}" \ - "${PROJECT_NAME}" + "${PROJECT_NAME}" \ + "$@" } function helm_additional_region { local ar_description ar_description="${1}" + shift local AR_NAME local AR_REGION @@ -361,15 +376,16 @@ function helm_additional_region { "${INGRESS_IP}" \ "${AR_REGION}" \ "${AR_ZONE}" \ - "${CLUSTER_NAME}" + "${CLUSTER_NAME}" \ + "$@" } function helm_charts { - helm_main_region + helm_main_region "$@" local AR for AR in "${ADDITIONAL_REGIONS[@]}"; do - helm_additional_region "${AR}" + helm_additional_region "${AR}" "$@" done } @@ -382,11 +398,12 @@ function set_config { function create { include_config_and_defaults $1 + shift if is_source_install; then prepare_source_install fi terraform_apply - helm_charts + helm_charts "$@" } function delete { diff --git a/src/app_charts/base/values-cloud.yaml b/src/app_charts/base/values-cloud.yaml index 877fcb76f..60db1c1f0 100644 --- a/src/app_charts/base/values-cloud.yaml +++ b/src/app_charts/base/values-cloud.yaml @@ -14,6 +14,9 @@ onprem_federation: "true" use_istio: "false" use_nginx_shield: "false" +istio: + additionalExtensionProviders: [] + oauth2_proxy: cookie_secret: "" client_id: "" diff --git a/third_party/istio/istio-generated.yaml b/third_party/istio/istio-generated.yaml index 1cce114fa..8c54ff37c 100644 --- a/third_party/istio/istio-generated.yaml +++ b/third_party/istio/istio-generated.yaml @@ -18772,7 +18772,10 @@ data: %REQ(x-icon-instance-name)%\", \"x_resource_instance_name\": \"%REQ(x-resource-instance-name)%\"\ }\ndefaultConfig:\n discoveryAddress: istiod.default.svc:15012\n proxyMetadata:\ \ {}\ndefaultProviders:\n metrics:\n - prometheus\nenablePrometheusMerge: true\n\ - extensionProviders:\n- envoyExtAuthzHttp:\n headersToUpstreamOnAllow:\n \ + extensionProviders:\n\ + {{- if .Values.istio.additionalExtensionProviders }}\n\ + {{- toYaml .Values.istio.additionalExtensionProviders | nindent 6 }}\n\ + {{- end }}\n- envoyExtAuthzHttp:\n headersToUpstreamOnAllow:\n \ \ - authorization\n includeRequestHeadersInCheck:\n - authorization\n \ \ - x-forwarded-access-token\n - x-auth-url\n port: \"8080\"\n service:\ \ crc-auth-gateway-istio.default.svc.cluster.local\n name: crc-auth-gateway\n\ diff --git a/third_party/istio/update-istio.sh b/third_party/istio/update-istio.sh index 6c6a3d4a9..38760fbd8 100755 --- a/third_party/istio/update-istio.sh +++ b/third_party/istio/update-istio.sh @@ -106,7 +106,22 @@ dst="${SCRIPT_DIR}/istio-generated.yaml" echo "# ---------------------------------------------------------" echo "# Istio System Manifests" echo "# ---------------------------------------------------------" - cat ${tmpdir}/istio.yaml + python3 -c ' +import sys + +with open(sys.argv[1], "r") as f: + content = f.read() + +snippet = """ + {{- if .Values.istio.additionalExtensionProviders }} + {{- toYaml .Values.istio.additionalExtensionProviders | nindent 6 }} + {{- end }}""" + +if "extensionProviders:" in content and "additionalExtensionProviders" not in content: + content = content.replace("extensionProviders:", "extensionProviders:" + snippet, 1) + +sys.stdout.write(content) +' "${tmpdir}/istio.yaml" echo '{{- end }}' } >${dst} From dea8addbcc98ac66086ca3af5512fe2f6548294f Mon Sep 17 00:00:00 2001 From: tpeslalz Date: Wed, 22 Jul 2026 14:59:56 +0000 Subject: [PATCH 2/6] Fix ConfigMap istio data.mesh YAML scalar formatting Created using jj-spr --- third_party/istio/istio-generated.yaml | 52 +++++++++++++------------- third_party/istio/update-istio.sh | 20 +++++++--- 2 files changed, 42 insertions(+), 30 deletions(-) diff --git a/third_party/istio/istio-generated.yaml b/third_party/istio/istio-generated.yaml index 8c54ff37c..50062f3f3 100644 --- a/third_party/istio/istio-generated.yaml +++ b/third_party/istio/istio-generated.yaml @@ -18755,31 +18755,33 @@ webhooks: --- apiVersion: v1 data: - mesh: "accessLogFile: \"\"\naccessLogFormat: |\n {\"authority\": \"%REQ(:AUTHORITY)%\"\ - , \"start_time\": \"%START_TIME%\", \"bytes_received\": \"%BYTES_RECEIVED%\",\ - \ \"bytes_sent\": \"%BYTES_SENT%\", \"downstream_local_address\": \"%DOWNSTREAM_LOCAL_ADDRESS%\"\ - , \"downstream_remote_address\": \"%DOWNSTREAM_REMOTE_ADDRESS%\", \"duration\"\ - : \"%DURATION%\", \"istio_policy_status\": \"%DYNAMIC_METADATA(istio.mixer:status)%\"\ - , \"method\": \"%REQ(:METHOD)%\", \"path\": \"%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%\"\ - , \"protocol\": \"%PROTOCOL%\", \"request_id\": \"%REQ(X-REQUEST-ID)%\", \"requested_server_name\"\ - : \"%REQUESTED_SERVER_NAME%\", \"response_code\": \"%RESPONSE_CODE%\", \"response_flags\"\ - : \"%RESPONSE_FLAGS%\", \"route_name\": \"%ROUTE_NAME%\", \"start_time\": \"%START_TIME%\"\ - , \"upstream_cluster\": \"%UPSTREAM_CLUSTER%\", \"upstream_host\": \"%UPSTREAM_HOST%\"\ - , \"upstream_local_address\": \"%UPSTREAM_LOCAL_ADDRESS%\", \"upstream_service_time\"\ - : \"%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%\", \"upstream_transport_failure_reason\"\ - : \"%UPSTREAM_TRANSPORT_FAILURE_REASON%\", \"user_agent\": \"%REQ(USER-AGENT)%\"\ - , \"x_forwarded_for\": \"%REQ(X-FORWARDED-FOR)%\", \"x_icon_instance_name\": \"\ - %REQ(x-icon-instance-name)%\", \"x_resource_instance_name\": \"%REQ(x-resource-instance-name)%\"\ - }\ndefaultConfig:\n discoveryAddress: istiod.default.svc:15012\n proxyMetadata:\ - \ {}\ndefaultProviders:\n metrics:\n - prometheus\nenablePrometheusMerge: true\n\ - extensionProviders:\n\ - {{- if .Values.istio.additionalExtensionProviders }}\n\ - {{- toYaml .Values.istio.additionalExtensionProviders | nindent 6 }}\n\ - {{- end }}\n- envoyExtAuthzHttp:\n headersToUpstreamOnAllow:\n \ - \ - authorization\n includeRequestHeadersInCheck:\n - authorization\n \ - \ - x-forwarded-access-token\n - x-auth-url\n port: \"8080\"\n service:\ - \ crc-auth-gateway-istio.default.svc.cluster.local\n name: crc-auth-gateway\n\ - rootNamespace: default\ntrustDomain: cluster.local" + mesh: |- + accessLogFile: "" + accessLogFormat: | + {"authority": "%REQ(:AUTHORITY)%", "start_time": "%START_TIME%", "bytes_received": "%BYTES_RECEIVED%", "bytes_sent": "%BYTES_SENT%", "downstream_local_address": "%DOWNSTREAM_LOCAL_ADDRESS%", "downstream_remote_address": "%DOWNSTREAM_REMOTE_ADDRESS%", "duration": "%DURATION%", "istio_policy_status": "%DYNAMIC_METADATA(istio.mixer:status)%", "method": "%REQ(:METHOD)%", "path": "%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%", "protocol": "%PROTOCOL%", "request_id": "%REQ(X-REQUEST-ID)%", "requested_server_name": "%REQUESTED_SERVER_NAME%", "response_code": "%RESPONSE_CODE%", "response_flags": "%RESPONSE_FLAGS%", "route_name": "%ROUTE_NAME%", "start_time": "%START_TIME%", "upstream_cluster": "%UPSTREAM_CLUSTER%", "upstream_host": "%UPSTREAM_HOST%", "upstream_local_address": "%UPSTREAM_LOCAL_ADDRESS%", "upstream_service_time": "%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%", "upstream_transport_failure_reason": "%UPSTREAM_TRANSPORT_FAILURE_REASON%", "user_agent": "%REQ(USER-AGENT)%", "x_forwarded_for": "%REQ(X-FORWARDED-FOR)%", "x_icon_instance_name": "%REQ(x-icon-instance-name)%", "x_resource_instance_name": "%REQ(x-resource-instance-name)%"} + defaultConfig: + discoveryAddress: istiod.default.svc:15012 + proxyMetadata: {} + defaultProviders: + metrics: + - prometheus + enablePrometheusMerge: true + extensionProviders: + {{- if .Values.istio.additionalExtensionProviders }} + {{- toYaml .Values.istio.additionalExtensionProviders | nindent 6 }} + {{- end }} + - name: crc-auth-gateway + envoyExtAuthzHttp: + service: crc-auth-gateway-istio.default.svc.cluster.local + port: "8080" + includeRequestHeadersInCheck: + - authorization + - x-forwarded-access-token + - x-auth-url + headersToUpstreamOnAllow: + - authorization + rootNamespace: default + trustDomain: cluster.local meshNetworks: 'networks: {}' kind: ConfigMap metadata: diff --git a/third_party/istio/update-istio.sh b/third_party/istio/update-istio.sh index 38760fbd8..7fd464209 100755 --- a/third_party/istio/update-istio.sh +++ b/third_party/istio/update-istio.sh @@ -107,20 +107,30 @@ dst="${SCRIPT_DIR}/istio-generated.yaml" echo "# Istio System Manifests" echo "# ---------------------------------------------------------" python3 -c ' -import sys +import sys, yaml + +class MultilineDumper(yaml.SafeDumper): + def represent_scalar(self, tag, value, style=None): + if "\n" in value and tag == "tag:yaml.org,2002:str": + style = "|" + return super().represent_scalar(tag, value, style) with open(sys.argv[1], "r") as f: - content = f.read() + docs = list(yaml.safe_load_all(f)) snippet = """ {{- if .Values.istio.additionalExtensionProviders }} {{- toYaml .Values.istio.additionalExtensionProviders | nindent 6 }} {{- end }}""" -if "extensionProviders:" in content and "additionalExtensionProviders" not in content: - content = content.replace("extensionProviders:", "extensionProviders:" + snippet, 1) +for doc in docs: + if doc and doc.get("kind") == "ConfigMap" and doc.get("metadata", {}).get("name") == "istio": + mesh_yaml = doc.get("data", {}).get("mesh", "") + if "extensionProviders:" in mesh_yaml and "additionalExtensionProviders" not in mesh_yaml: + mesh_yaml = mesh_yaml.replace("extensionProviders:", "extensionProviders:" + snippet, 1) + doc["data"]["mesh"] = mesh_yaml -sys.stdout.write(content) +yaml.dump_all(docs, sys.stdout, Dumper=MultilineDumper, default_flow_style=False) ' "${tmpdir}/istio.yaml" echo '{{- end }}' } >${dst} From 8498fa5938fb9e53c34fb2f0cc950f367ff00131 Mon Sep 17 00:00:00 2001 From: tpeslalz Date: Wed, 22 Jul 2026 15:08:36 +0000 Subject: [PATCH 3/6] Fix argument forwarding in deploy.sh update function Created using jj-spr --- deploy.sh | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/deploy.sh b/deploy.sh index 6bf469d15..fcee741cc 100755 --- a/deploy.sh +++ b/deploy.sh @@ -416,16 +416,17 @@ function delete { # Alias for create. function update { - create $1 + create "$@" } # This is a shortcut for skipping Terraform config checks if you know the config has not changed. function fast_push { include_config_and_defaults $1 + shift if is_source_install; then prepare_source_install fi - helm_charts + helm_charts "$@" } # This is a shortcut for skipping building and applying Terraform configs if you know the build has not changed. From 29917a47f6dfb285667f6247000ff26b8cae912c Mon Sep 17 00:00:00 2001 From: tpeslalz Date: Wed, 22 Jul 2026 15:19:27 +0000 Subject: [PATCH 4/6] Make update-istio.sh yq-independent via native Python YAML processing Created using jj-spr --- third_party/istio/istio-config.yaml | 2 +- third_party/istio/istio-generated.yaml | 35830 +++++++++++------------ third_party/istio/istio-values.json | 2 +- third_party/istio/update-istio.sh | 64 +- 4 files changed, 17884 insertions(+), 18014 deletions(-) diff --git a/third_party/istio/istio-config.yaml b/third_party/istio/istio-config.yaml index 4eedd472a..6b84fa42c 100644 --- a/third_party/istio/istio-config.yaml +++ b/third_party/istio/istio-config.yaml @@ -2347,4 +2347,4 @@ templates: spec: selector: matchLabels: - gateway.networking.k8s.io/gateway-name: {{.Name|quote}} + gateway.networking.k8s.io/gateway-name: {{.Name|quote}} \ No newline at end of file diff --git a/third_party/istio/istio-generated.yaml b/third_party/istio/istio-generated.yaml index 50062f3f3..7e7e2bad2 100644 --- a/third_party/istio/istio-generated.yaml +++ b/third_party/istio/istio-generated.yaml @@ -19,245 +19,272 @@ spec: group: security.istio.io names: categories: - - istio-io - - security-istio-io + - istio-io + - security-istio-io kind: AuthorizationPolicy listKind: AuthorizationPolicyList plural: authorizationpolicies shortNames: - - ap + - ap singular: authorizationpolicy scope: Namespaced versions: - - additionalPrinterColumns: - - description: The operation to take. - jsonPath: .spec.action - name: Action - type: string - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is - represented in RFC3339 form and is in UTC. Populated by the system. Read-only. - Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration for access control on workloads. See more - details at: https://istio.io/docs/reference/config/security/authorization-policy.html' - oneOf: - - not: - anyOf: - - required: - - provider + - additionalPrinterColumns: + - description: The operation to take. + jsonPath: .spec.action + name: Action + type: string + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration for access control on workloads. See more + details at: https://istio.io/docs/reference/config/security/authorization-policy.html' + oneOf: + - not: + anyOf: - required: - - provider - properties: - action: - description: 'Optional. - - - Valid Options: ALLOW, DENY, AUDIT, CUSTOM' - enum: - - ALLOW - - DENY - - AUDIT - - CUSTOM - type: string - provider: - description: Specifies detailed configuration of the CUSTOM action. + - provider + - required: + - provider + properties: + action: + description: |- + Optional. + + Valid Options: ALLOW, DENY, AUDIT, CUSTOM + enum: + - ALLOW + - DENY + - AUDIT + - CUSTOM + type: string + provider: + description: Specifies detailed configuration of the CUSTOM action. + properties: + name: + description: Specifies the name of the extension provider. + type: string + type: object + rules: + description: Optional. + items: properties: - name: - description: Specifies the name of the extension provider. - type: string - type: object - rules: - description: Optional. - items: - properties: - from: - description: Optional. - items: - properties: - source: - description: Source specifies the source of a request. - properties: - ipBlocks: - description: Optional. - items: - type: string - type: array - namespaces: - description: Optional. - items: - type: string - type: array - notIpBlocks: - description: Optional. - items: - type: string - type: array - notNamespaces: - description: Optional. - items: - type: string - type: array - notPrincipals: - description: Optional. - items: - type: string - type: array - notRemoteIpBlocks: - description: Optional. - items: - type: string - type: array - notRequestPrincipals: - description: Optional. - items: - type: string - type: array - notServiceAccounts: - description: Optional. - items: - maxLength: 320 - type: string - maxItems: 16 - type: array - principals: - description: Optional. - items: - type: string - type: array - remoteIpBlocks: - description: Optional. - items: - type: string - type: array - requestPrincipals: - description: Optional. - items: - type: string - type: array - serviceAccounts: - description: Optional. - items: - maxLength: 320 - type: string - maxItems: 16 - type: array - type: object - x-kubernetes-validations: - - message: Cannot set serviceAccounts with namespaces - or principals - rule: '(has(self.serviceAccounts) || has(self.notServiceAccounts)) - ? (!has(self.principals) && - - !has(self.notPrincipals) && !has(self.namespaces) - && !has(self.notNamespaces)) : true' - type: object - maxItems: 512 - type: array - to: - description: Optional. - items: - properties: - operation: - description: Operation specifies the operation of a - request. - properties: - hosts: - description: Optional. - items: - type: string - type: array - methods: - description: Optional. - items: - type: string - type: array - notHosts: - description: Optional. - items: - type: string - type: array - notMethods: - description: Optional. - items: - type: string - type: array - notPaths: - description: Optional. - items: - type: string - type: array - notPorts: - description: Optional. - items: - type: string - type: array - paths: - description: Optional. - items: - type: string - type: array - ports: - description: Optional. - items: - type: string - type: array - type: object - type: object - type: array - when: - description: Optional. - items: - properties: - key: - description: The name of an Istio attribute. + from: + description: Optional. + items: + properties: + source: + description: Source specifies the source of a request. + properties: + ipBlocks: + description: Optional. + items: + type: string + type: array + namespaces: + description: Optional. + items: + type: string + type: array + notIpBlocks: + description: Optional. + items: + type: string + type: array + notNamespaces: + description: Optional. + items: + type: string + type: array + notPrincipals: + description: Optional. + items: + type: string + type: array + notRemoteIpBlocks: + description: Optional. + items: + type: string + type: array + notRequestPrincipals: + description: Optional. + items: + type: string + type: array + notServiceAccounts: + description: Optional. + items: + maxLength: 320 + type: string + maxItems: 16 + type: array + principals: + description: Optional. + items: + type: string + type: array + remoteIpBlocks: + description: Optional. + items: + type: string + type: array + requestPrincipals: + description: Optional. + items: + type: string + type: array + serviceAccounts: + description: Optional. + items: + maxLength: 320 + type: string + maxItems: 16 + type: array + type: object + x-kubernetes-validations: + - message: Cannot set serviceAccounts with namespaces + or principals + rule: |- + (has(self.serviceAccounts) || has(self.notServiceAccounts)) ? (!has(self.principals) && + !has(self.notPrincipals) && !has(self.namespaces) && !has(self.notNamespaces)) : true + type: object + maxItems: 512 + type: array + to: + description: Optional. + items: + properties: + operation: + description: Operation specifies the operation of a request. + properties: + hosts: + description: Optional. + items: + type: string + type: array + methods: + description: Optional. + items: + type: string + type: array + notHosts: + description: Optional. + items: + type: string + type: array + notMethods: + description: Optional. + items: + type: string + type: array + notPaths: + description: Optional. + items: + type: string + type: array + notPorts: + description: Optional. + items: + type: string + type: array + paths: + description: Optional. + items: + type: string + type: array + ports: + description: Optional. + items: + type: string + type: array + type: object + type: object + type: array + when: + description: Optional. + items: + properties: + key: + description: The name of an Istio attribute. + type: string + notValues: + description: Optional. + items: type: string - notValues: - description: Optional. - items: - type: string - type: array - values: - description: Optional. - items: - type: string - type: array - required: - - key - type: object - type: array - type: object - maxItems: 512 - type: array - selector: - description: Optional. - properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set - of pods/VMs on which a policy should be applied. - maxProperties: 4096 - type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) + type: array + values: + description: Optional. + items: + type: string + type: array + required: + - key + type: object + type: array type: object - targetRef: + maxItems: 512 + type: array + selector: + description: Optional. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + targetRef: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name + type: object + targetRefs: + description: Optional. + items: properties: group: description: group is the group of the target resource. @@ -279,360 +306,355 @@ spec: description: namespace is the namespace of the referent. type: string x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 required: - - kind - - name + - kind + - name type: object - targetRefs: - description: Optional. - items: - properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: name is the name of the target resource. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: namespace is the namespace of the referent. - type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently - supported - rule: self.size() == 0 - required: - - kind - - name - type: object - maxItems: 16 - type: array - type: object - x-kubernetes-validations: - - message: only one of targetRefs or selector can be set - rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : - 0) + (has(self.targetRefs) ? 1 : 0) <= 1' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. - - - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} - - additionalPrinterColumns: - - description: The operation to take. - jsonPath: .spec.action - name: Action - type: string - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is - represented in RFC3339 form and is in UTC. Populated by the system. Read-only. - Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration for access control on workloads. See more - details at: https://istio.io/docs/reference/config/security/authorization-policy.html' - oneOf: - - not: - anyOf: - - required: - - provider - - required: - - provider - properties: - action: - description: 'Optional. - - - Valid Options: ALLOW, DENY, AUDIT, CUSTOM' - enum: - - ALLOW - - DENY - - AUDIT - - CUSTOM - type: string - provider: - description: Specifies detailed configuration of the CUSTOM action. + maxItems: 16 + type: array + type: object + x-kubernetes-validations: + - message: only one of targetRefs or selector can be set + rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + + (has(self.targetRefs) ? 1 : 0) <= 1' + status: + properties: + conditions: + description: Current service state of the resource. + items: properties: - name: - description: Specifies the name of the extension provider. + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. type: string type: object - rules: - description: Optional. - items: - properties: - from: - description: Optional. - items: - properties: - source: - description: Source specifies the source of a request. - properties: - ipBlocks: - description: Optional. - items: - type: string - type: array - namespaces: - description: Optional. - items: - type: string - type: array - notIpBlocks: - description: Optional. - items: - type: string - type: array - notNamespaces: - description: Optional. - items: - type: string - type: array - notPrincipals: - description: Optional. - items: - type: string - type: array - notRemoteIpBlocks: - description: Optional. - items: - type: string - type: array - notRequestPrincipals: - description: Optional. - items: - type: string - type: array - notServiceAccounts: - description: Optional. - items: - maxLength: 320 - type: string - maxItems: 16 - type: array - principals: - description: Optional. - items: - type: string - type: array - remoteIpBlocks: - description: Optional. - items: - type: string - type: array - requestPrincipals: - description: Optional. - items: - type: string - type: array - serviceAccounts: - description: Optional. - items: - maxLength: 320 - type: string - maxItems: 16 - type: array - type: object - x-kubernetes-validations: - - message: Cannot set serviceAccounts with namespaces - or principals - rule: '(has(self.serviceAccounts) || has(self.notServiceAccounts)) - ? (!has(self.principals) && - - !has(self.notPrincipals) && !has(self.namespaces) - && !has(self.notNamespaces)) : true' - type: object - maxItems: 512 - type: array - to: - description: Optional. - items: - properties: - operation: - description: Operation specifies the operation of a - request. - properties: - hosts: - description: Optional. - items: - type: string - type: array - methods: - description: Optional. - items: - type: string - type: array - notHosts: - description: Optional. - items: - type: string - type: array - notMethods: - description: Optional. - items: - type: string - type: array - notPaths: - description: Optional. - items: - type: string - type: array - notPorts: - description: Optional. - items: - type: string - type: array - paths: - description: Optional. - items: - type: string - type: array - ports: - description: Optional. - items: - type: string - type: array - type: object - type: object - type: array - when: - description: Optional. - items: - properties: - key: - description: The name of an Istio attribute. - type: string - notValues: - description: Optional. - items: - type: string - type: array - values: - description: Optional. - items: - type: string - type: array - required: - - key - type: object - type: array - type: object - maxItems: 512 - type: array - selector: - description: Optional. + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set - of pods/VMs on which a policy should be applied. - maxProperties: 4096 + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) type: object - targetRef: + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - description: The operation to take. + jsonPath: .spec.action + name: Action + type: string + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration for access control on workloads. See more + details at: https://istio.io/docs/reference/config/security/authorization-policy.html' + oneOf: + - not: + anyOf: + - required: + - provider + - required: + - provider + properties: + action: + description: |- + Optional. + + Valid Options: ALLOW, DENY, AUDIT, CUSTOM + enum: + - ALLOW + - DENY + - AUDIT + - CUSTOM + type: string + provider: + description: Specifies detailed configuration of the CUSTOM action. + properties: + name: + description: Specifies the name of the extension provider. + type: string + type: object + rules: + description: Optional. + items: + properties: + from: + description: Optional. + items: + properties: + source: + description: Source specifies the source of a request. + properties: + ipBlocks: + description: Optional. + items: + type: string + type: array + namespaces: + description: Optional. + items: + type: string + type: array + notIpBlocks: + description: Optional. + items: + type: string + type: array + notNamespaces: + description: Optional. + items: + type: string + type: array + notPrincipals: + description: Optional. + items: + type: string + type: array + notRemoteIpBlocks: + description: Optional. + items: + type: string + type: array + notRequestPrincipals: + description: Optional. + items: + type: string + type: array + notServiceAccounts: + description: Optional. + items: + maxLength: 320 + type: string + maxItems: 16 + type: array + principals: + description: Optional. + items: + type: string + type: array + remoteIpBlocks: + description: Optional. + items: + type: string + type: array + requestPrincipals: + description: Optional. + items: + type: string + type: array + serviceAccounts: + description: Optional. + items: + maxLength: 320 + type: string + maxItems: 16 + type: array + type: object + x-kubernetes-validations: + - message: Cannot set serviceAccounts with namespaces + or principals + rule: |- + (has(self.serviceAccounts) || has(self.notServiceAccounts)) ? (!has(self.principals) && + !has(self.notPrincipals) && !has(self.namespaces) && !has(self.notNamespaces)) : true + type: object + maxItems: 512 + type: array + to: + description: Optional. + items: + properties: + operation: + description: Operation specifies the operation of a request. + properties: + hosts: + description: Optional. + items: + type: string + type: array + methods: + description: Optional. + items: + type: string + type: array + notHosts: + description: Optional. + items: + type: string + type: array + notMethods: + description: Optional. + items: + type: string + type: array + notPaths: + description: Optional. + items: + type: string + type: array + notPorts: + description: Optional. + items: + type: string + type: array + paths: + description: Optional. + items: + type: string + type: array + ports: + description: Optional. + items: + type: string + type: array + type: object + type: object + type: array + when: + description: Optional. + items: + properties: + key: + description: The name of an Istio attribute. + type: string + notValues: + description: Optional. + items: + type: string + type: array + values: + description: Optional. + items: + type: string + type: array + required: + - key + type: object + type: array + type: object + maxItems: 512 + type: array + selector: + description: Optional. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + targetRef: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name + type: object + targetRefs: + description: Optional. + items: properties: group: description: group is the group of the target resource. @@ -654,131 +676,99 @@ spec: description: namespace is the namespace of the referent. type: string x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 required: - - kind - - name + - kind + - name type: object - targetRefs: - description: Optional. - items: - properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: name is the name of the target resource. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: namespace is the namespace of the referent. - type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently - supported - rule: self.size() == 0 - required: - - kind - - name - type: object - maxItems: 16 - type: array - type: object - x-kubernetes-validations: - - message: only one of targetRefs or selector can be set - rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : - 0) + (has(self.targetRefs) ? 1 : 0) <= 1' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. - + maxItems: 16 + type: array + type: object + x-kubernetes-validations: + - message: only one of targetRefs or selector can be set + rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + + (has(self.targetRefs) ? 1 : 0) <= 1' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -796,6133 +786,7676 @@ spec: group: networking.istio.io names: categories: - - istio-io - - networking-istio-io + - istio-io + - networking-istio-io kind: DestinationRule listKind: DestinationRuleList plural: destinationrules shortNames: - - dr + - dr singular: destinationrule scope: Namespaced versions: - - additionalPrinterColumns: - - description: The name of a service from the service registry - jsonPath: .spec.host - name: Host - type: string - - description: CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is - represented in RFC3339 form and is in UTC. Populated by the system. Read-only. - Null for lists. For more information, see [Kubernetes API Conventions](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata) - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting load balancing, outlier detection, - etc. See more details at: https://istio.io/docs/reference/config/networking/destination-rule.html' - properties: - exportTo: - description: A list of namespaces to which this destination rule - is exported. - items: - type: string - type: array - host: - description: The name of a service from the service registry. + - additionalPrinterColumns: + - description: The name of a service from the service registry + jsonPath: .spec.host + name: Host + type: string + - description: CreationTimestamp is a timestamp representing the server time when + this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. For more information, see [Kubernetes API Conventions](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata) + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting load balancing, outlier detection, + etc. See more details at: https://istio.io/docs/reference/config/networking/destination-rule.html' + properties: + exportTo: + description: A list of namespaces to which this destination rule is + exported. + items: type: string - subsets: - description: One or more named sets that represent individual versions - of a service. - items: - properties: - labels: - additionalProperties: - type: string - description: Labels apply a filter over the endpoints of a - service in the service registry. - type: object - name: - description: Name of the subset. + type: array + host: + description: The name of a service from the service registry. + type: string + subsets: + description: One or more named sets that represent individual versions + of a service. + items: + properties: + labels: + additionalProperties: type: string - trafficPolicy: - description: Traffic policies that apply to this subset. - properties: - connectionPool: - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: 'Specify if http1.1 connection should - be upgraded to http2 for the associated destination. - + description: Labels apply a filter over the endpoints of a service + in the service registry. + type: object + name: + description: Name of the subset. + type: string + trafficPolicy: + description: Traffic policies that apply to this subset. + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE' - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will - be queued while waiting for a ready connection - pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests - to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection - pool connections. - type: string - x-kubernetes-validations: + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will + be queued while waiting for a ready connection + pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to + a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection + pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams + allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection + to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can + be outstanding to all hosts in a cluster at a + given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will + be preserved while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream + connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections + to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the + socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between keep-alive + probes. + type: string + x-kubernetes-validations: - message: must be a valid duration greater than 1ms rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent - streams allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection - to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can - be outstanding to all hosts in a cluster at - a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will - be preserved while initiating connection to - backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP - upstream connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: + probes: + description: Maximum number of keepalive probes + to send without response before deciding the + connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection + needs to be idle before keep-alive probes + start being sent. + type: string + x-kubernetes-validations: - message: must be a valid duration greater than 1ms rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. + type: object + type: object + type: object + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: + - required: + - simple + - required: + - consistentHash + - required: + - simple + - required: + - consistentHash + properties: + consistentHash: + allOf: + - oneOf: + - not: + anyOf: + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - oneOf: + - not: + anyOf: + - required: + - ringHash + - required: + - maglev + - required: + - ringHash + - required: + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. + properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the + cookie attribute. + type: string + required: + - name + type: object + type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name + type: object + httpHeaderName: + description: Hash based on a specific HTTP header. + type: string + httpQueryParameterName: + description: Hash based on a specific HTTP query + parameter. + type: string + maglev: + description: The Maglev load balancer implements + consistent hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev hashing. + minimum: 0 + type: integer + type: object + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer + implements consistent hashing to backend hosts. + properties: + minimumRingSize: + description: The minimum number of virtual nodes + to use for the hash ring. + minimum: 0 + type: integer + type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean + type: object + localityLbSetting: + properties: + distribute: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating locality, '/' separated, + e.g. + type: string + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities to + traffic distribution weights. + type: object + type: object + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. + type: string + to: + description: Destination region the traffic + will fail over to when endpoints in the + 'from' region becomes unhealthy. + type: string + type: object + type: array + failoverPriority: + description: failoverPriority is an ordered list + of labels used to sort endpoints to do priority + based load balancing. + items: type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections - to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the - socket to enable TCP Keepalives. + type: array + type: object + simple: + description: |2- + + + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST + type: string + warmup: + description: Represents the warmup configuration of + Service. + properties: + aggression: + description: This parameter controls the speed of + traffic increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: + properties: + baseEjectionTime: + description: Minimum ejection duration. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected + from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a host + is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated + failures before ejection occurs. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep analysis. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing + pool for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled as long + as the associated load balancing pool has at least + `minHealthPercent` hosts in healthy mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local + origin failures from external errors. + type: boolean + type: object + portLevelSettings: + description: Traffic policies specific to individual ports. + items: + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. properties: - interval: - description: The time duration between keep-alive - probes. + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that + will be queued while waiting for a ready + connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests + to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream + connection pool connections. type: string x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes - to send without response before deciding - the connection is dead. - maximum: 4294967295 - minimum: 0 + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent + streams allowed for a peer on one HTTP/2 + connection. + format: int32 type: integer - time: - description: The time duration a connection - needs to be idle before keep-alive probes - start being sent. + maxRequestsPerConnection: + description: Maximum number of requests per + connection to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that + can be outstanding to all hosts in a cluster + at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol + will be preserved while initiating connection + to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and + TCP upstream connections. + properties: + connectTimeout: + description: TCP connection timeout. type: string x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP + connections to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE + on the socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between + keep-alive probes. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive + probes to send without response before + deciding the connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection + needs to be idle before keep-alive probes + start being sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + type: object type: object type: object - type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: + loadBalancer: + description: Settings controlling the load balancer + algorithms. + oneOf: + - not: + anyOf: - required: - - simple + - simple - required: - - consistentHash - - required: + - consistentHash + - required: - simple - - required: + - required: - consistentHash - properties: - consistentHash: - allOf: - - oneOf: + properties: + consistentHash: + allOf: + - oneOf: - not: anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName - required: - - httpHeaderName + - httpHeaderName - required: - - httpCookie + - httpCookie - required: - - useSourceIp + - useSourceIp - required: - - httpQueryParameterName - - oneOf: + - httpQueryParameterName + - oneOf: - not: anyOf: - - required: - - ringHash - - required: - - maglev + - required: + - ringHash + - required: + - maglev - required: - - ringHash + - ringHash - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. + - maglev properties: - attributes: - description: Additional attributes for the - cookie. - items: - properties: - name: - description: The name of the cookie - attribute. - type: string - value: - description: The optional value of the - cookie attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. + httpCookie: + description: Hash based on HTTP cookie. + properties: + attributes: + description: Additional attributes for + the cookie. + items: + properties: + name: + description: The name of the cookie + attribute. + type: string + value: + description: The optional value + of the cookie attribute. + type: string + required: + - name + type: object + type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name + type: object + httpHeaderName: + description: Hash based on a specific HTTP + header. type: string - ttl: - description: Lifetime of the cookie. + httpQueryParameterName: + description: Hash based on a specific HTTP + query parameter. type: string - required: - - name + maglev: + description: The Maglev load balancer implements + consistent hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev + hashing. + minimum: 0 + type: integer + type: object + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer + implements consistent hashing to backend + hosts. + properties: + minimumRingSize: + description: The minimum number of virtual + nodes to use for the hash ring. + minimum: 0 + type: integer + type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean type: object - httpHeaderName: - description: Hash based on a specific HTTP header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query - parameter. + localityLbSetting: + properties: + distribute: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating locality, '/' + separated, e.g. + type: string + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities + to traffic distribution weights. + type: object + type: object + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. + type: string + to: + description: Destination region the + traffic will fail over to when endpoints + in the 'from' region becomes unhealthy. + type: string + type: object + type: array + failoverPriority: + description: failoverPriority is an ordered + list of labels used to sort endpoints to + do priority based load balancing. + items: + type: string + type: array + type: object + simple: + description: |2- + + + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST type: string - maglev: - description: The Maglev load balancer implements - consistent hashing to backend hosts. + warmup: + description: Represents the warmup configuration + of Service. properties: - tableSize: - description: The table size for Maglev hashing. + aggression: + description: This parameter controls the speed + of traffic increase over the warmup duration. + format: double minimum: 0 - type: integer + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration type: object - minimumRingSize: - description: Deprecated. + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: + properties: + baseEjectionTime: + description: Minimum ejection duration. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host + is ejected from the connection pool. + maximum: 4294967295 minimum: 0 + nullable: true type: integer - ringHash: - description: The ring/modulo hash load balancer - implements consistent hashing to backend hosts. - properties: - minimumRingSize: - description: The minimum number of virtual - nodes to use for the hash ring. - minimum: 0 - type: integer - type: object - useSourceIp: - description: Hash based on the source IP address. + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a + host is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally + originated failures before ejection occurs. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep + analysis. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing + pool for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled + as long as the associated load balancing pool + has at least `minHealthPercent` hosts in healthy + mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish + local origin failures from external errors. type: boolean type: object - localityLbSetting: + port: + description: Specifies the number of a port on the + destination service on which this policy is being + applied. properties: - distribute: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' separated, - e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities - to traffic distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + tls: + description: TLS related settings for connections + to the upstream service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing + certificate authority certificates to use in + verifying a presented server certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing + the certificate revocation list (CRL) to use + in verifying a presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds + the TLS certs for the client including the CA + certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether + the proxy should skip verifying the CA signature + and SAN for the server certificate corresponding + to the host.' nullable: true type: boolean - failover: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the traffic - will fail over to when endpoints in the - 'from' region becomes unhealthy. - type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered list - of labels used to sort endpoints to do priority - based load balancing. + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. + + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server + during TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify + the subject identity in the certificate. items: type: string type: array type: object - simple: - description: ' + type: object + maxItems: 4096 + type: array + proxyProtocol: + description: The upstream PROXY protocol settings. + properties: + version: + description: |- + The PROXY protocol version to use. + Valid Options: V1, V2 + enum: + - V1 + - V2 + type: string + type: object + retryBudget: + description: Specifies a limit on concurrent retries in + relation to the number of active requests. + properties: + minRetryConcurrency: + description: Specifies the minimum retry concurrency + allowed for the retry budget. + maximum: 4294967295 + minimum: 0 + type: integer + percent: + description: Specifies the limit on concurrent retries + as a percentage of the sum of active requests and + active pending requests. + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + type: object + tls: + description: TLS related settings for connections to the + upstream service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing + certificate authority certificates to use in verifying + a presented server certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing + the certificate revocation list (CRL) to use in verifying + a presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds the TLS + certs for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether + the proxy should skip verifying the CA signature and + SAN for the server certificate corresponding to the + host.' + nullable: true + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, - ROUND_ROBIN, LEAST_REQUEST' - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration of - Service. - properties: - aggression: - description: This parameter controls the speed - of traffic increase over the warmup duration. - format: double - minimum: 0 - nullable: true - type: number - duration: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - required: - - duration - type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server during + TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify the + subject identity in the certificate. + items: type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - type: object - outlierDetection: + type: array + type: object + tunnel: + description: Configuration of tunneling TCP over other transport + or application layers for the host configured in the DestinationRule. + properties: + protocol: + description: Specifies which protocol to use for tunneling + the downstream connection. + type: string + targetHost: + description: Specifies a host to which the downstream + connection is tunneled. + type: string + targetPort: + description: Specifies a port to which the downstream + connection is tunneled. + maximum: 4294967295 + minimum: 0 + type: integer + required: + - targetHost + - targetPort + type: object + type: object + required: + - name + type: object + type: array + trafficPolicy: + description: Traffic policies to apply (load balancing policy, connection + pool sizes, outlier detection). + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will be queued + while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection + pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams + allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection + to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding + to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be preserved + while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream + connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections + to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket + to enable TCP Keepalives. properties: - baseEjectionTime: - description: Minimum ejection duration. + interval: + description: The time duration between keep-alive + probes. type: string x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is - ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host - is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated - failures before ejection occurs. + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to + send without response before deciding the connection + is dead. maximum: 4294967295 minimum: 0 - nullable: true type: integer - interval: - description: Time interval between ejection sweep - analysis. + time: + description: The time duration a connection needs + to be idle before keep-alive probes start being + sent. type: string x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing - pool for the upstream service that can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled as - long as the associated load balancing pool has at - least `minHealthPercent` hosts in healthy mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local - origin failures from external errors. - type: boolean + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') type: object - portLevelSettings: - description: Traffic policies specific to individual ports. - items: - properties: - connectionPool: - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: 'Specify if http1.1 connection - should be upgraded to http2 for the associated - destination. - - - Valid Options: DEFAULT, DO_NOT_UPGRADE, - UPGRADE' - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests - that will be queued while waiting for - a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests - to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream - connection pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent - streams allowed for a peer on one HTTP/2 - connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests - per connection to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that - can be outstanding to all hosts in a cluster - at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol - will be preserved while initiating connection - to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and - TCP upstream connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP - connections to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE - on the socket to enable TCP Keepalives. - properties: - interval: - description: The time duration between - keep-alive probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration - greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive - probes to send without response before - deciding the connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection - needs to be idle before keep-alive - probes start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration - greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: object - type: object - loadBalancer: - description: Settings controlling the load balancer - algorithms. - oneOf: - - not: - anyOf: - - required: - - simple - - required: - - consistentHash - - required: - - simple - - required: - - consistentHash - properties: - consistentHash: - allOf: - - oneOf: - - not: - anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - oneOf: - - not: - anyOf: - - required: - - ringHash - - required: - - maglev - - required: - - ringHash - - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. - properties: - attributes: - description: Additional attributes for - the cookie. - items: - properties: - name: - description: The name of the cookie - attribute. - type: string - value: - description: The optional value - of the cookie attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. - type: string - ttl: - description: Lifetime of the cookie. - type: string - required: - - name - type: object - httpHeaderName: - description: Hash based on a specific HTTP - header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP - query parameter. - type: string - maglev: - description: The Maglev load balancer implements - consistent hashing to backend hosts. - properties: - tableSize: - description: The table size for Maglev - hashing. - minimum: 0 - type: integer - type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer - implements consistent hashing to backend - hosts. - properties: - minimumRingSize: - description: The minimum number of virtual - nodes to use for the hash ring. - minimum: 0 - type: integer - type: object - useSourceIp: - description: Hash based on the source IP - address. - type: boolean - type: object - localityLbSetting: - properties: - distribute: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, - '/' separated, e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities - to traffic distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the - traffic will fail over to when endpoints - in the 'from' region becomes unhealthy. - type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered - list of labels used to sort endpoints - to do priority based load balancing. - items: - type: string - type: array - type: object - simple: - description: ' - - - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, - ROUND_ROBIN, LEAST_REQUEST' - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration - of Service. - properties: - aggression: - description: This parameter controls the - speed of traffic increase over the warmup - duration. - format: double - minimum: 0 - nullable: true - type: number - duration: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - required: - - duration - type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - type: object - outlierDetection: - properties: - baseEjectionTime: - description: Minimum ejection duration. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host - is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before - a host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally - originated failures before ejection occurs. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - interval: - description: Time interval between ejection - sweep analysis. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load - balancing pool for the upstream service that - can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled - as long as the associated load balancing pool - has at least `minHealthPercent` hosts in healthy - mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish - local origin failures from external errors. - type: boolean - type: object - port: - description: Specifies the number of a port on the - destination service on which this policy is being - applied. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - tls: - description: TLS related settings for connections - to the upstream service. + type: object + type: object + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: + - required: + - simple + - required: + - consistentHash + - required: + - simple + - required: + - consistentHash + properties: + consistentHash: + allOf: + - oneOf: + - not: + anyOf: + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - oneOf: + - not: + anyOf: + - required: + - ringHash + - required: + - maglev + - required: + - ringHash + - required: + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. + properties: + attributes: + description: Additional attributes for the cookie. + items: properties: - caCertificates: - description: 'OPTIONAL: The path to the file - containing certificate authority certificates - to use in verifying a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file - containing the certificate revocation list - (CRL) to use in verifying a presented server - certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds - the TLS certs for the client including the - CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies - whether the proxy should skip verifying the - CA signature and SAN for the server certificate - corresponding to the host.' - nullable: true - type: boolean - mode: - description: 'Indicates whether connections - to this port should be secured using TLS. - - - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL' - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL + name: + description: The name of the cookie attribute. type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. + value: + description: The optional value of the cookie + attribute. type: string - sni: - description: SNI string to present to the server - during TLS handshake. - type: string - subjectAltNames: - description: A list of alternate names to verify - the subject identity in the certificate. - items: - type: string - type: array + required: + - name type: object - type: object - maxItems: 4096 - type: array - proxyProtocol: - description: The upstream PROXY protocol settings. - properties: - version: - description: 'The PROXY protocol version to use. - - - Valid Options: V1, V2' - enum: - - V1 - - V2 + type: array + name: + description: Name of the cookie. type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name type: object - retryBudget: - description: Specifies a limit on concurrent retries in - relation to the number of active requests. + httpHeaderName: + description: Hash based on a specific HTTP header. + type: string + httpQueryParameterName: + description: Hash based on a specific HTTP query parameter. + type: string + maglev: + description: The Maglev load balancer implements consistent + hashing to backend hosts. properties: - minRetryConcurrency: - description: Specifies the minimum retry concurrency - allowed for the retry budget. - maximum: 4294967295 + tableSize: + description: The table size for Maglev hashing. minimum: 0 type: integer - percent: - description: Specifies the limit on concurrent retries - as a percentage of the sum of active requests and - active pending requests. - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - type: object - tls: - description: TLS related settings for connections to the - upstream service. - properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing - certificate authority certificates to use in verifying - a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing - the certificate revocation list (CRL) to use in - verifying a presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds the - TLS certs for the client including the CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether - the proxy should skip verifying the CA signature - and SAN for the server certificate corresponding - to the host.' - nullable: true - type: boolean - mode: - description: 'Indicates whether connections to this - port should be secured using TLS. - - - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL' - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. - type: string - sni: - description: SNI string to present to the server during - TLS handshake. - type: string - subjectAltNames: - description: A list of alternate names to verify the - subject identity in the certificate. - items: - type: string - type: array type: object - tunnel: - description: Configuration of tunneling TCP over other - transport or application layers for the host configured - in the DestinationRule. + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer implements + consistent hashing to backend hosts. properties: - protocol: - description: Specifies which protocol to use for tunneling - the downstream connection. - type: string - targetHost: - description: Specifies a host to which the downstream - connection is tunneled. - type: string - targetPort: - description: Specifies a port to which the downstream - connection is tunneled. - maximum: 4294967295 + minimumRingSize: + description: The minimum number of virtual nodes to + use for the hash ring. minimum: 0 type: integer - required: - - targetHost - - targetPort type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean type: object - required: - - name + localityLbSetting: + properties: + distribute: + description: 'Optional: only one of distribute, failover + or failoverPriority can be set.' + items: + properties: + from: + description: Originating locality, '/' separated, + e.g. + type: string + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities to traffic + distribution weights. + type: object + type: object + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, failover + or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. + type: string + to: + description: Destination region the traffic will + fail over to when endpoints in the 'from' region + becomes unhealthy. + type: string + type: object + type: array + failoverPriority: + description: failoverPriority is an ordered list of labels + used to sort endpoints to do priority based load balancing. + items: + type: string + type: array + type: object + simple: + description: |2- + + + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST + type: string + warmup: + description: Represents the warmup configuration of Service. + properties: + aggression: + description: This parameter controls the speed of traffic + increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') type: object - type: array - trafficPolicy: - description: Traffic policies to apply (load balancing policy, connection - pool sizes, outlier detection). - properties: - connectionPool: + outlierDetection: + properties: + baseEjectionTime: + description: Minimum ejection duration. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected + from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a host is ejected + from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated + failures before ejection occurs. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep analysis. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing pool + for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled as long as + the associated load balancing pool has at least `minHealthPercent` + hosts in healthy mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local origin + failures from external errors. + type: boolean + type: object + portLevelSettings: + description: Traffic policies specific to individual ports. + items: properties: - http: - description: HTTP connection pool settings. + connectionPool: properties: - h2UpgradePolicy: - description: 'Specify if http1.1 connection should be - upgraded to http2 for the associated destination. - + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE' - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be - queued while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a - destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection - pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams - allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection - to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding - to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be - preserved while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream - connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections - to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket - to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive - probes. + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will + be queued while waiting for a ready connection + pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to + a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection + pool connections. type: string x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes - to send without response before deciding the connection - is dead. - maximum: 4294967295 - minimum: 0 + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams + allowed for a peer on one HTTP/2 connection. + format: int32 type: integer - time: - description: The time duration a connection needs - to be idle before keep-alive probes start being - sent. + maxRequestsPerConnection: + description: Maximum number of requests per connection + to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can + be outstanding to all hosts in a cluster at a + given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will + be preserved while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream + connections. + properties: + connectTimeout: + description: TCP connection timeout. type: string x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections + to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the + socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between keep-alive + probes. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes + to send without response before deciding the + connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection + needs to be idle before keep-alive probes + start being sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + type: object type: object type: object - type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: - required: - - simple + - simple - required: - - consistentHash - - required: + - consistentHash + - required: - simple - - required: + - required: - consistentHash - properties: - consistentHash: - allOf: - - oneOf: + properties: + consistentHash: + allOf: + - oneOf: - not: anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName - required: - - httpHeaderName + - httpHeaderName - required: - - httpCookie + - httpCookie - required: - - useSourceIp + - useSourceIp - required: - - httpQueryParameterName - - oneOf: + - httpQueryParameterName + - oneOf: - not: anyOf: - - required: - - ringHash - - required: - - maglev + - required: + - ringHash + - required: + - maglev - required: - - ringHash + - ringHash - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. + properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the + cookie attribute. + type: string + required: + - name + type: object + type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name + type: object + httpHeaderName: + description: Hash based on a specific HTTP header. + type: string + httpQueryParameterName: + description: Hash based on a specific HTTP query + parameter. + type: string + maglev: + description: The Maglev load balancer implements + consistent hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev hashing. + minimum: 0 + type: integer + type: object + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer + implements consistent hashing to backend hosts. + properties: + minimumRingSize: + description: The minimum number of virtual nodes + to use for the hash ring. + minimum: 0 + type: integer + type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean + type: object + localityLbSetting: properties: - attributes: - description: Additional attributes for the cookie. + distribute: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating locality, '/' separated, + e.g. + type: string + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities to + traffic distribution weights. + type: object + type: object + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' items: properties: - name: - description: The name of the cookie attribute. + from: + description: Originating region. type: string - value: - description: The optional value of the cookie - attribute. + to: + description: Destination region the traffic + will fail over to when endpoints in the + 'from' region becomes unhealthy. type: string - required: - - name type: object type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. - type: string - ttl: - description: Lifetime of the cookie. - type: string - required: - - name + failoverPriority: + description: failoverPriority is an ordered list + of labels used to sort endpoints to do priority + based load balancing. + items: + type: string + type: array type: object - httpHeaderName: - description: Hash based on a specific HTTP header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query parameter. + simple: + description: |2- + + + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST type: string - maglev: - description: The Maglev load balancer implements consistent - hashing to backend hosts. + warmup: + description: Represents the warmup configuration of + Service. properties: - tableSize: - description: The table size for Maglev hashing. + aggression: + description: This parameter controls the speed of + traffic increase over the warmup duration. + format: double minimum: 0 - type: integer - type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer implements - consistent hashing to backend hosts. - properties: - minimumRingSize: - description: The minimum number of virtual nodes - to use for the hash ring. + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 minimum: 0 - type: integer + nullable: true + type: number + required: + - duration type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') type: object - localityLbSetting: + outlierDetection: properties: - distribute: - description: 'Optional: only one of distribute, failover - or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' separated, - e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities to traffic - distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. + baseEjectionTime: + description: Minimum ejection duration. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected + from the connection pool. + maximum: 4294967295 + minimum: 0 nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, failover - or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the traffic will - fail over to when endpoints in the 'from' region - becomes unhealthy. - type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered list of - labels used to sort endpoints to do priority based - load balancing. - items: - type: string - type: array - type: object - simple: - description: ' - - - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, - LEAST_REQUEST' - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration of Service. - properties: - aggression: - description: This parameter controls the speed of traffic - increase over the warmup duration. - format: double + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a host + is ejected from the connection pool. + maximum: 4294967295 minimum: 0 nullable: true - type: number - duration: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated + failures before ejection occurs. + maximum: 4294967295 minimum: 0 nullable: true - type: number - required: - - duration + type: integer + interval: + description: Time interval between ejection sweep analysis. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing + pool for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled as long + as the associated load balancing pool has at least + `minHealthPercent` hosts in healthy mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local + origin failures from external errors. + type: boolean + type: object + port: + description: Specifies the number of a port on the destination + service on which this policy is being applied. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + tls: + description: TLS related settings for connections to the + upstream service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing + certificate authority certificates to use in verifying + a presented server certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing + the certificate revocation list (CRL) to use in verifying + a presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds the TLS + certs for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether + the proxy should skip verifying the CA signature and + SAN for the server certificate corresponding to the + host.' + nullable: true + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. + + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server during + TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify the + subject identity in the certificate. + items: + type: string + type: array type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') type: object - outlierDetection: + maxItems: 4096 + type: array + proxyProtocol: + description: The upstream PROXY protocol settings. + properties: + version: + description: |- + The PROXY protocol version to use. + + Valid Options: V1, V2 + enum: + - V1 + - V2 + type: string + type: object + retryBudget: + description: Specifies a limit on concurrent retries in relation + to the number of active requests. + properties: + minRetryConcurrency: + description: Specifies the minimum retry concurrency allowed + for the retry budget. + maximum: 4294967295 + minimum: 0 + type: integer + percent: + description: Specifies the limit on concurrent retries as + a percentage of the sum of active requests and active pending + requests. + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + type: object + tls: + description: TLS related settings for connections to the upstream + service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing certificate + authority certificates to use in verifying a presented server + certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing the + certificate revocation list (CRL) to use in verifying a + presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds the TLS certs + for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether the proxy + should skip verifying the CA signature and SAN for the server + certificate corresponding to the host.' + nullable: true + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. + + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server during TLS + handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject + identity in the certificate. + items: + type: string + type: array + type: object + tunnel: + description: Configuration of tunneling TCP over other transport + or application layers for the host configured in the DestinationRule. + properties: + protocol: + description: Specifies which protocol to use for tunneling + the downstream connection. + type: string + targetHost: + description: Specifies a host to which the downstream connection + is tunneled. + type: string + targetPort: + description: Specifies a port to which the downstream connection + is tunneled. + maximum: 4294967295 + minimum: 0 + type: integer + required: + - targetHost + - targetPort + type: object + type: object + workloadSelector: + description: Criteria used to select the specific set of pods/VMs + on which this `DestinationRule` configuration should be applied. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + required: + - host + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: properties: - baseEjectionTime: - description: Minimum ejection duration. + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is ejected - from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host is ejected - from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated - failures before ejection occurs. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - interval: - description: Time interval between ejection sweep analysis. + name: + description: A human-readable name for the message type. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing pool - for the upstream service that can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled as long as - the associated load balancing pool has at least `minHealthPercent` - hosts in healthy mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local origin - failures from external errors. - type: boolean type: object - portLevelSettings: - description: Traffic policies specific to individual ports. - items: - properties: - connectionPool: - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: 'Specify if http1.1 connection should - be upgraded to http2 for the associated destination. - + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - description: The name of a service from the service registry + jsonPath: .spec.host + name: Host + type: string + - description: CreationTimestamp is a timestamp representing the server time when + this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. For more information, see [Kubernetes API Conventions](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata) + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha3 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting load balancing, outlier detection, + etc. See more details at: https://istio.io/docs/reference/config/networking/destination-rule.html' + properties: + exportTo: + description: A list of namespaces to which this destination rule is + exported. + items: + type: string + type: array + host: + description: The name of a service from the service registry. + type: string + subsets: + description: One or more named sets that represent individual versions + of a service. + items: + properties: + labels: + additionalProperties: + type: string + description: Labels apply a filter over the endpoints of a service + in the service registry. + type: object + name: + description: Name of the subset. + type: string + trafficPolicy: + description: Traffic policies that apply to this subset. + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE' - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will - be queued while waiting for a ready connection - pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests - to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection - pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent - streams allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection - to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can - be outstanding to all hosts in a cluster at - a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will - be preserved while initiating connection to - backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP - upstream connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will + be queued while waiting for a ready connection + pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to + a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection + pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams + allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection + to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can + be outstanding to all hosts in a cluster at a + given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will + be preserved while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream + connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections + to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the + socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between keep-alive + probes. + type: string + x-kubernetes-validations: - message: must be a valid duration greater than 1ms rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: + probes: + description: Maximum number of keepalive probes + to send without response before deciding the + connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection + needs to be idle before keep-alive probes + start being sent. + type: string + x-kubernetes-validations: - message: must be a valid duration greater than 1ms rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections - to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the - socket to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive - probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes - to send without response before deciding - the connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection - needs to be idle before keep-alive probes - start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: object - type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: - - required: - - simple - - required: - - consistentHash + type: object + type: object + type: object + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: - required: - - simple + - simple - required: - - consistentHash - properties: - consistentHash: - allOf: - - oneOf: - - not: - anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - oneOf: - - not: - anyOf: - - required: - - ringHash - - required: - - maglev - - required: - - ringHash - - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. - properties: - attributes: - description: Additional attributes for the - cookie. - items: - properties: - name: - description: The name of the cookie - attribute. - type: string - value: - description: The optional value of the - cookie attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. - type: string - ttl: - description: Lifetime of the cookie. - type: string - required: - - name - type: object - httpHeaderName: - description: Hash based on a specific HTTP header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query - parameter. - type: string - maglev: - description: The Maglev load balancer implements - consistent hashing to backend hosts. + - consistentHash + - required: + - simple + - required: + - consistentHash + properties: + consistentHash: + allOf: + - oneOf: + - not: + anyOf: + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - oneOf: + - not: + anyOf: + - required: + - ringHash + - required: + - maglev + - required: + - ringHash + - required: + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. + properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the + cookie attribute. + type: string + required: + - name + type: object + type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name + type: object + httpHeaderName: + description: Hash based on a specific HTTP header. + type: string + httpQueryParameterName: + description: Hash based on a specific HTTP query + parameter. + type: string + maglev: + description: The Maglev load balancer implements + consistent hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev hashing. + minimum: 0 + type: integer + type: object + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer + implements consistent hashing to backend hosts. + properties: + minimumRingSize: + description: The minimum number of virtual nodes + to use for the hash ring. + minimum: 0 + type: integer + type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean + type: object + localityLbSetting: + properties: + distribute: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: properties: - tableSize: - description: The table size for Maglev hashing. - minimum: 0 + from: + description: Originating locality, '/' separated, + e.g. + type: string + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities to + traffic distribution weights. + type: object + type: object + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. + type: string + to: + description: Destination region the traffic + will fail over to when endpoints in the + 'from' region becomes unhealthy. + type: string + type: object + type: array + failoverPriority: + description: failoverPriority is an ordered list + of labels used to sort endpoints to do priority + based load balancing. + items: + type: string + type: array + type: object + simple: + description: |2- + + + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST + type: string + warmup: + description: Represents the warmup configuration of + Service. + properties: + aggression: + description: This parameter controls the speed of + traffic increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: + properties: + baseEjectionTime: + description: Minimum ejection duration. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected + from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a host + is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated + failures before ejection occurs. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep analysis. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing + pool for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled as long + as the associated load balancing pool has at least + `minHealthPercent` hosts in healthy mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local + origin failures from external errors. + type: boolean + type: object + portLevelSettings: + description: Traffic policies specific to individual ports. + items: + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that + will be queued while waiting for a ready + connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests + to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream + connection pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent + streams allowed for a peer on one HTTP/2 + connection. + format: int32 type: integer + maxRequestsPerConnection: + description: Maximum number of requests per + connection to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that + can be outstanding to all hosts in a cluster + at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol + will be preserved while initiating connection + to backend. + type: boolean type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer - implements consistent hashing to backend hosts. + tcp: + description: Settings common to both HTTP and + TCP upstream connections. properties: - minimumRingSize: - description: The minimum number of virtual - nodes to use for the hash ring. - minimum: 0 + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP + connections to a destination host. + format: int32 type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE + on the socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between + keep-alive probes. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive + probes to send without response before + deciding the connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection + needs to be idle before keep-alive probes + start being sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + type: object type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean type: object - localityLbSetting: + loadBalancer: + description: Settings controlling the load balancer + algorithms. + oneOf: + - not: + anyOf: + - required: + - simple + - required: + - consistentHash + - required: + - simple + - required: + - consistentHash properties: - distribute: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' separated, - e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 + consistentHash: + allOf: + - oneOf: + - not: + anyOf: + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - oneOf: + - not: + anyOf: + - required: + - ringHash + - required: + - maglev + - required: + - ringHash + - required: + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. + properties: + attributes: + description: Additional attributes for + the cookie. + items: + properties: + name: + description: The name of the cookie + attribute. + type: string + value: + description: The optional value + of the cookie attribute. + type: string + required: + - name + type: object + type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name + type: object + httpHeaderName: + description: Hash based on a specific HTTP + header. + type: string + httpQueryParameterName: + description: Hash based on a specific HTTP + query parameter. + type: string + maglev: + description: The Maglev load balancer implements + consistent hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev + hashing. + minimum: 0 + type: integer + type: object + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer + implements consistent hashing to backend + hosts. + properties: + minimumRingSize: + description: The minimum number of virtual + nodes to use for the hash ring. minimum: 0 type: integer - description: Map of upstream localities - to traffic distribution weights. + type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean + type: object + localityLbSetting: + properties: + distribute: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating locality, '/' + separated, e.g. + type: string + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities + to traffic distribution weights. + type: object type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the traffic - will fail over to when endpoints in the - 'from' region becomes unhealthy. + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. + type: string + to: + description: Destination region the + traffic will fail over to when endpoints + in the 'from' region becomes unhealthy. + type: string + type: object + type: array + failoverPriority: + description: failoverPriority is an ordered + list of labels used to sort endpoints to + do priority based load balancing. + items: type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered list - of labels used to sort endpoints to do priority - based load balancing. - items: - type: string - type: array - type: object - simple: - description: ' + type: array + type: object + simple: + description: |2- - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, - ROUND_ROBIN, LEAST_REQUEST' - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration of - Service. - properties: - aggression: - description: This parameter controls the speed - of traffic increase over the warmup duration. - format: double - minimum: 0 - nullable: true - type: number - duration: + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - required: - - duration - type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - type: object - outlierDetection: - properties: - baseEjectionTime: - description: Minimum ejection duration. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is - ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host - is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated - failures before ejection occurs. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - interval: - description: Time interval between ejection sweep - analysis. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing - pool for the upstream service that can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled as - long as the associated load balancing pool has at - least `minHealthPercent` hosts in healthy mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local - origin failures from external errors. - type: boolean - type: object - port: - description: Specifies the number of a port on the destination - service on which this policy is being applied. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - tls: - description: TLS related settings for connections to the - upstream service. - properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing - certificate authority certificates to use in verifying - a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing - the certificate revocation list (CRL) to use in - verifying a presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds the - TLS certs for the client including the CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether - the proxy should skip verifying the CA signature - and SAN for the server certificate corresponding - to the host.' - nullable: true - type: boolean - mode: - description: 'Indicates whether connections to this - port should be secured using TLS. - - - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL' - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. - type: string - sni: - description: SNI string to present to the server during - TLS handshake. - type: string - subjectAltNames: - description: A list of alternate names to verify the - subject identity in the certificate. - items: - type: string - type: array - type: object - type: object - maxItems: 4096 - type: array - proxyProtocol: - description: The upstream PROXY protocol settings. - properties: - version: - description: 'The PROXY protocol version to use. - - - Valid Options: V1, V2' - enum: - - V1 - - V2 - type: string - type: object - retryBudget: - description: Specifies a limit on concurrent retries in relation - to the number of active requests. - properties: - minRetryConcurrency: - description: Specifies the minimum retry concurrency allowed - for the retry budget. - maximum: 4294967295 - minimum: 0 - type: integer - percent: - description: Specifies the limit on concurrent retries as - a percentage of the sum of active requests and active - pending requests. - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - type: object - tls: - description: TLS related settings for connections to the upstream - service. - properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing - certificate authority certificates to use in verifying - a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing - the certificate revocation list (CRL) to use in verifying - a presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds the TLS certs - for the client including the CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether the - proxy should skip verifying the CA signature and SAN for - the server certificate corresponding to the host.' - nullable: true - type: boolean - mode: - description: 'Indicates whether connections to this port - should be secured using TLS. - - - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL' - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. - type: string - sni: - description: SNI string to present to the server during - TLS handshake. - type: string - subjectAltNames: - description: A list of alternate names to verify the subject - identity in the certificate. - items: - type: string - type: array - type: object - tunnel: - description: Configuration of tunneling TCP over other transport - or application layers for the host configured in the DestinationRule. - properties: - protocol: - description: Specifies which protocol to use for tunneling - the downstream connection. - type: string - targetHost: - description: Specifies a host to which the downstream connection - is tunneled. - type: string - targetPort: - description: Specifies a port to which the downstream connection - is tunneled. - maximum: 4294967295 - minimum: 0 - type: integer - required: - - targetHost - - targetPort - type: object - type: object - workloadSelector: - description: Criteria used to select the specific set of pods/VMs - on which this `DestinationRule` configuration should be applied. - properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set - of pods/VMs on which a policy should be applied. - maxProperties: 4096 - type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) - type: object - required: - - host - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. - - - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} - - additionalPrinterColumns: - - description: The name of a service from the service registry - jsonPath: .spec.host - name: Host - type: string - - description: CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is - represented in RFC3339 form and is in UTC. Populated by the system. Read-only. - Null for lists. For more information, see [Kubernetes API Conventions](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata) - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1alpha3 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting load balancing, outlier detection, - etc. See more details at: https://istio.io/docs/reference/config/networking/destination-rule.html' - properties: - exportTo: - description: A list of namespaces to which this destination rule - is exported. - items: - type: string - type: array - host: - description: The name of a service from the service registry. - type: string - subsets: - description: One or more named sets that represent individual versions - of a service. - items: - properties: - labels: - additionalProperties: - type: string - description: Labels apply a filter over the endpoints of a - service in the service registry. - type: object - name: - description: Name of the subset. - type: string - trafficPolicy: - description: Traffic policies that apply to this subset. - properties: - connectionPool: - properties: - http: - description: HTTP connection pool settings. + warmup: + description: Represents the warmup configuration + of Service. + properties: + aggression: + description: This parameter controls the speed + of traffic increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: properties: - h2UpgradePolicy: - description: 'Specify if http1.1 connection should - be upgraded to http2 for the associated destination. - - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE' - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE + baseEjectionTime: + description: Minimum ejection duration. type: string - http1MaxPendingRequests: - description: Maximum number of requests that will - be queued while waiting for a ready connection - pool connection. - format: int32 + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host + is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true type: integer - http2MaxRequests: - description: Maximum number of active requests - to a destination. + consecutiveErrors: format: int32 type: integer - idleTimeout: - description: The idle timeout for upstream connection - pool connections. + consecutiveGatewayErrors: + description: Number of gateway errors before a + host is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally + originated failures before ejection occurs. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep + analysis. type: string x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent - streams allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection - to a backend. + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing + pool for the upstream service that can be ejected. format: int32 type: integer - maxRetries: - description: Maximum number of retries that can - be outstanding to all hosts in a cluster at - a given time. + minHealthPercent: + description: Outlier detection will be enabled + as long as the associated load balancing pool + has at least `minHealthPercent` hosts in healthy + mode. format: int32 type: integer - useClientProtocol: - description: If set to true, client protocol will - be preserved while initiating connection to - backend. + splitExternalLocalOriginErrors: + description: Determines whether to distinguish + local origin failures from external errors. type: boolean type: object - tcp: - description: Settings common to both HTTP and TCP - upstream connections. + port: + description: Specifies the number of a port on the + destination service on which this policy is being + applied. properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections - to a destination host. - format: int32 + number: + maximum: 4294967295 + minimum: 0 type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the - socket to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive - probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes - to send without response before deciding - the connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection - needs to be idle before keep-alive probes - start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - type: object type: object - type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: - - required: - - simple - - required: - - consistentHash - - required: - - simple - - required: - - consistentHash - properties: - consistentHash: - allOf: - - oneOf: - - not: - anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - oneOf: - - not: - anyOf: - - required: - - ringHash - - required: - - maglev - - required: - - ringHash - - required: - - maglev + tls: + description: TLS related settings for connections + to the upstream service. properties: - httpCookie: - description: Hash based on HTTP cookie. - properties: - attributes: - description: Additional attributes for the - cookie. - items: - properties: - name: - description: The name of the cookie - attribute. - type: string - value: - description: The optional value of the - cookie attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. - type: string - ttl: - description: Lifetime of the cookie. - type: string - required: - - name - type: object - httpHeaderName: - description: Hash based on a specific HTTP header. + caCertificates: + description: 'OPTIONAL: The path to the file containing + certificate authority certificates to use in + verifying a presented server certificate.' type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query - parameter. + caCrl: + description: 'OPTIONAL: The path to the file containing + the certificate revocation list (CRL) to use + in verifying a presented server certificate.' type: string - maglev: - description: The Maglev load balancer implements - consistent hashing to backend hosts. - properties: - tableSize: - description: The table size for Maglev hashing. - minimum: 0 - type: integer - type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer - implements consistent hashing to backend hosts. - properties: - minimumRingSize: - description: The minimum number of virtual - nodes to use for the hash ring. - minimum: 0 - type: integer - type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean - type: object - localityLbSetting: - properties: - distribute: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' separated, - e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities - to traffic distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds + the TLS certs for the client including the CA + certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether + the proxy should skip verifying the CA signature + and SAN for the server certificate corresponding + to the host.' nullable: true type: boolean - failover: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the traffic - will fail over to when endpoints in the - 'from' region becomes unhealthy. - type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered list - of labels used to sort endpoints to do priority - based load balancing. + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. + + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server + during TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify + the subject identity in the certificate. items: type: string type: array type: object - simple: - description: ' + type: object + maxItems: 4096 + type: array + proxyProtocol: + description: The upstream PROXY protocol settings. + properties: + version: + description: |- + The PROXY protocol version to use. + Valid Options: V1, V2 + enum: + - V1 + - V2 + type: string + type: object + retryBudget: + description: Specifies a limit on concurrent retries in + relation to the number of active requests. + properties: + minRetryConcurrency: + description: Specifies the minimum retry concurrency + allowed for the retry budget. + maximum: 4294967295 + minimum: 0 + type: integer + percent: + description: Specifies the limit on concurrent retries + as a percentage of the sum of active requests and + active pending requests. + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + type: object + tls: + description: TLS related settings for connections to the + upstream service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing + certificate authority certificates to use in verifying + a presented server certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing + the certificate revocation list (CRL) to use in verifying + a presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds the TLS + certs for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether + the proxy should skip verifying the CA signature and + SAN for the server certificate corresponding to the + host.' + nullable: true + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, - ROUND_ROBIN, LEAST_REQUEST' - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration of - Service. - properties: - aggression: - description: This parameter controls the speed - of traffic increase over the warmup duration. - format: double - minimum: 0 - nullable: true - type: number - duration: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - required: - - duration - type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server during + TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify the + subject identity in the certificate. + items: type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - type: object - outlierDetection: + type: array + type: object + tunnel: + description: Configuration of tunneling TCP over other transport + or application layers for the host configured in the DestinationRule. + properties: + protocol: + description: Specifies which protocol to use for tunneling + the downstream connection. + type: string + targetHost: + description: Specifies a host to which the downstream + connection is tunneled. + type: string + targetPort: + description: Specifies a port to which the downstream + connection is tunneled. + maximum: 4294967295 + minimum: 0 + type: integer + required: + - targetHost + - targetPort + type: object + type: object + required: + - name + type: object + type: array + trafficPolicy: + description: Traffic policies to apply (load balancing policy, connection + pool sizes, outlier detection). + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will be queued + while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection + pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams + allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection + to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding + to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be preserved + while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream + connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections + to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket + to enable TCP Keepalives. properties: - baseEjectionTime: - description: Minimum ejection duration. + interval: + description: The time duration between keep-alive + probes. type: string x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is - ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host - is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated - failures before ejection occurs. + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to + send without response before deciding the connection + is dead. maximum: 4294967295 minimum: 0 - nullable: true type: integer - interval: - description: Time interval between ejection sweep - analysis. + time: + description: The time duration a connection needs + to be idle before keep-alive probes start being + sent. type: string x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing - pool for the upstream service that can be ejected. - format: int32 + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + type: object + type: object + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: + - required: + - simple + - required: + - consistentHash + - required: + - simple + - required: + - consistentHash + properties: + consistentHash: + allOf: + - oneOf: + - not: + anyOf: + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - oneOf: + - not: + anyOf: + - required: + - ringHash + - required: + - maglev + - required: + - ringHash + - required: + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. + properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the cookie + attribute. + type: string + required: + - name + type: object + type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name + type: object + httpHeaderName: + description: Hash based on a specific HTTP header. + type: string + httpQueryParameterName: + description: Hash based on a specific HTTP query parameter. + type: string + maglev: + description: The Maglev load balancer implements consistent + hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev hashing. + minimum: 0 type: integer - minHealthPercent: - description: Outlier detection will be enabled as - long as the associated load balancing pool has at - least `minHealthPercent` hosts in healthy mode. - format: int32 + type: object + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer implements + consistent hashing to backend hosts. + properties: + minimumRingSize: + description: The minimum number of virtual nodes to + use for the hash ring. + minimum: 0 type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local - origin failures from external errors. - type: boolean type: object - portLevelSettings: - description: Traffic policies specific to individual ports. + useSourceIp: + description: Hash based on the source IP address. + type: boolean + type: object + localityLbSetting: + properties: + distribute: + description: 'Optional: only one of distribute, failover + or failoverPriority can be set.' items: properties: - connectionPool: - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: 'Specify if http1.1 connection - should be upgraded to http2 for the associated - destination. + from: + description: Originating locality, '/' separated, + e.g. + type: string + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities to traffic + distribution weights. + type: object + type: object + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, failover + or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. + type: string + to: + description: Destination region the traffic will + fail over to when endpoints in the 'from' region + becomes unhealthy. + type: string + type: object + type: array + failoverPriority: + description: failoverPriority is an ordered list of labels + used to sort endpoints to do priority based load balancing. + items: + type: string + type: array + type: object + simple: + description: |2- - Valid Options: DEFAULT, DO_NOT_UPGRADE, - UPGRADE' - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests - that will be queued while waiting for - a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests - to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream - connection pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent - streams allowed for a peer on one HTTP/2 - connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests - per connection to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that - can be outstanding to all hosts in a cluster - at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol - will be preserved while initiating connection - to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and - TCP upstream connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP - connections to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE - on the socket to enable TCP Keepalives. - properties: - interval: - description: The time duration between - keep-alive probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration - greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive - probes to send without response before - deciding the connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection - needs to be idle before keep-alive - probes start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration - greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: object - type: object - loadBalancer: - description: Settings controlling the load balancer - algorithms. - oneOf: - - not: - anyOf: - - required: - - simple - - required: - - consistentHash - - required: - - simple - - required: - - consistentHash - properties: - consistentHash: - allOf: - - oneOf: - - not: - anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - oneOf: - - not: - anyOf: - - required: - - ringHash - - required: - - maglev - - required: - - ringHash - - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. - properties: - attributes: - description: Additional attributes for - the cookie. - items: - properties: - name: - description: The name of the cookie - attribute. - type: string - value: - description: The optional value - of the cookie attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. - type: string - ttl: - description: Lifetime of the cookie. - type: string - required: - - name - type: object - httpHeaderName: - description: Hash based on a specific HTTP - header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP - query parameter. - type: string - maglev: - description: The Maglev load balancer implements - consistent hashing to backend hosts. - properties: - tableSize: - description: The table size for Maglev - hashing. - minimum: 0 - type: integer - type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer - implements consistent hashing to backend - hosts. - properties: - minimumRingSize: - description: The minimum number of virtual - nodes to use for the hash ring. - minimum: 0 - type: integer - type: object - useSourceIp: - description: Hash based on the source IP - address. - type: boolean - type: object - localityLbSetting: - properties: - distribute: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, - '/' separated, e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities - to traffic distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the - traffic will fail over to when endpoints - in the 'from' region becomes unhealthy. - type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered - list of labels used to sort endpoints - to do priority based load balancing. - items: - type: string - type: array - type: object - simple: - description: ' - + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST + type: string + warmup: + description: Represents the warmup configuration of Service. + properties: + aggression: + description: This parameter controls the speed of traffic + increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: + properties: + baseEjectionTime: + description: Minimum ejection duration. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected + from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a host is ejected + from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated + failures before ejection occurs. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep analysis. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing pool + for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled as long as + the associated load balancing pool has at least `minHealthPercent` + hosts in healthy mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local origin + failures from external errors. + type: boolean + type: object + portLevelSettings: + description: Traffic policies specific to individual ports. + items: + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, - ROUND_ROBIN, LEAST_REQUEST' - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration - of Service. - properties: - aggression: - description: This parameter controls the - speed of traffic increase over the warmup - duration. - format: double - minimum: 0 - nullable: true - type: number - duration: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - required: - - duration - type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - type: object - outlierDetection: + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will + be queued while waiting for a ready connection + pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to + a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection + pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams + allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection + to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can + be outstanding to all hosts in a cluster at a + given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will + be preserved while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream + connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections + to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the + socket to enable TCP Keepalives. properties: - baseEjectionTime: - description: Minimum ejection duration. + interval: + description: The time duration between keep-alive + probes. type: string x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host - is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before - a host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally - originated failures before ejection occurs. + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes + to send without response before deciding the + connection is dead. maximum: 4294967295 minimum: 0 - nullable: true type: integer - interval: - description: Time interval between ejection - sweep analysis. + time: + description: The time duration a connection + needs to be idle before keep-alive probes + start being sent. type: string x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load - balancing pool for the upstream service that - can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled - as long as the associated load balancing pool - has at least `minHealthPercent` hosts in healthy - mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish - local origin failures from external errors. - type: boolean + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + type: object + type: object + type: object + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: + - required: + - simple + - required: + - consistentHash + - required: + - simple + - required: + - consistentHash + properties: + consistentHash: + allOf: + - oneOf: + - not: + anyOf: + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - oneOf: + - not: + anyOf: + - required: + - ringHash + - required: + - maglev + - required: + - ringHash + - required: + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. + properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the + cookie attribute. + type: string + required: + - name + type: object + type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name type: object - port: - description: Specifies the number of a port on the - destination service on which this policy is being - applied. + httpHeaderName: + description: Hash based on a specific HTTP header. + type: string + httpQueryParameterName: + description: Hash based on a specific HTTP query + parameter. + type: string + maglev: + description: The Maglev load balancer implements + consistent hashing to backend hosts. properties: - number: - maximum: 4294967295 + tableSize: + description: The table size for Maglev hashing. minimum: 0 type: integer type: object - tls: - description: TLS related settings for connections - to the upstream service. + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer + implements consistent hashing to backend hosts. properties: - caCertificates: - description: 'OPTIONAL: The path to the file - containing certificate authority certificates - to use in verifying a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file - containing the certificate revocation list - (CRL) to use in verifying a presented server - certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds - the TLS certs for the client including the - CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies - whether the proxy should skip verifying the - CA signature and SAN for the server certificate - corresponding to the host.' - nullable: true - type: boolean - mode: - description: 'Indicates whether connections - to this port should be secured using TLS. - - - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL' - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. - type: string - sni: - description: SNI string to present to the server - during TLS handshake. - type: string - subjectAltNames: - description: A list of alternate names to verify - the subject identity in the certificate. - items: - type: string - type: array + minimumRingSize: + description: The minimum number of virtual nodes + to use for the hash ring. + minimum: 0 + type: integer type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean type: object - maxItems: 4096 - type: array - proxyProtocol: - description: The upstream PROXY protocol settings. - properties: - version: - description: 'The PROXY protocol version to use. - - - Valid Options: V1, V2' - enum: - - V1 - - V2 - type: string - type: object - retryBudget: - description: Specifies a limit on concurrent retries in - relation to the number of active requests. - properties: - minRetryConcurrency: - description: Specifies the minimum retry concurrency - allowed for the retry budget. - maximum: 4294967295 - minimum: 0 - type: integer - percent: - description: Specifies the limit on concurrent retries - as a percentage of the sum of active requests and - active pending requests. - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - type: object - tls: - description: TLS related settings for connections to the - upstream service. - properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing - certificate authority certificates to use in verifying - a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing - the certificate revocation list (CRL) to use in - verifying a presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds the - TLS certs for the client including the CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether - the proxy should skip verifying the CA signature - and SAN for the server certificate corresponding - to the host.' - nullable: true - type: boolean - mode: - description: 'Indicates whether connections to this - port should be secured using TLS. + localityLbSetting: + properties: + distribute: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating locality, '/' separated, + e.g. + type: string + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities to + traffic distribution weights. + type: object + type: object + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. + type: string + to: + description: Destination region the traffic + will fail over to when endpoints in the + 'from' region becomes unhealthy. + type: string + type: object + type: array + failoverPriority: + description: failoverPriority is an ordered list + of labels used to sort endpoints to do priority + based load balancing. + items: + type: string + type: array + type: object + simple: + description: |2- - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL' - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. - type: string - sni: - description: SNI string to present to the server during - TLS handshake. - type: string - subjectAltNames: - description: A list of alternate names to verify the - subject identity in the certificate. - items: + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST + type: string + warmup: + description: Represents the warmup configuration of + Service. + properties: + aggression: + description: This parameter controls the speed of + traffic increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: type: string - type: array - type: object - tunnel: - description: Configuration of tunneling TCP over other - transport or application layers for the host configured - in the DestinationRule. - properties: - protocol: - description: Specifies which protocol to use for tunneling - the downstream connection. - type: string - targetHost: - description: Specifies a host to which the downstream - connection is tunneled. - type: string - targetPort: - description: Specifies a port to which the downstream - connection is tunneled. - maximum: 4294967295 - minimum: 0 - type: integer - required: - - targetHost - - targetPort - type: object - type: object - required: - - name - type: object - type: array - trafficPolicy: - description: Traffic policies to apply (load balancing policy, connection - pool sizes, outlier detection). - properties: - connectionPool: - properties: - http: - description: HTTP connection pool settings. + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: properties: - h2UpgradePolicy: - description: 'Specify if http1.1 connection should be - upgraded to http2 for the associated destination. - - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE' - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE + baseEjectionTime: + description: Minimum ejection duration. type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be - queued while waiting for a ready connection pool connection. - format: int32 + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected + from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true type: integer - http2MaxRequests: - description: Maximum number of active requests to a - destination. + consecutiveErrors: format: int32 type: integer - idleTimeout: - description: The idle timeout for upstream connection - pool connections. + consecutiveGatewayErrors: + description: Number of gateway errors before a host + is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated + failures before ejection occurs. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep analysis. type: string x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams - allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection - to a backend. + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing + pool for the upstream service that can be ejected. format: int32 type: integer - maxRetries: - description: Maximum number of retries that can be outstanding - to all hosts in a cluster at a given time. + minHealthPercent: + description: Outlier detection will be enabled as long + as the associated load balancing pool has at least + `minHealthPercent` hosts in healthy mode. format: int32 type: integer - useClientProtocol: - description: If set to true, client protocol will be - preserved while initiating connection to backend. + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local + origin failures from external errors. type: boolean type: object - tcp: - description: Settings common to both HTTP and TCP upstream - connections. + port: + description: Specifies the number of a port on the destination + service on which this policy is being applied. properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections - to a destination host. - format: int32 + number: + maximum: 4294967295 + minimum: 0 type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket - to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive - probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes - to send without response before deciding the connection - is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection needs - to be idle before keep-alive probes start being - sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - type: object type: object - type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: - - required: - - simple - - required: - - consistentHash - - required: - - simple - - required: - - consistentHash - properties: - consistentHash: - allOf: - - oneOf: - - not: - anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - oneOf: - - not: - anyOf: - - required: - - ringHash - - required: - - maglev - - required: - - ringHash - - required: - - maglev + tls: + description: TLS related settings for connections to the + upstream service. properties: - httpCookie: - description: Hash based on HTTP cookie. - properties: - attributes: - description: Additional attributes for the cookie. - items: - properties: - name: - description: The name of the cookie attribute. - type: string - value: - description: The optional value of the cookie - attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. - type: string - ttl: - description: Lifetime of the cookie. - type: string - required: - - name - type: object - httpHeaderName: - description: Hash based on a specific HTTP header. + caCertificates: + description: 'OPTIONAL: The path to the file containing + certificate authority certificates to use in verifying + a presented server certificate.' type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query parameter. + caCrl: + description: 'OPTIONAL: The path to the file containing + the certificate revocation list (CRL) to use in verifying + a presented server certificate.' type: string - maglev: - description: The Maglev load balancer implements consistent - hashing to backend hosts. - properties: - tableSize: - description: The table size for Maglev hashing. - minimum: 0 - type: integer - type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer implements - consistent hashing to backend hosts. - properties: - minimumRingSize: - description: The minimum number of virtual nodes - to use for the hash ring. - minimum: 0 - type: integer - type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean - type: object - localityLbSetting: - properties: - distribute: - description: 'Optional: only one of distribute, failover - or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' separated, - e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities to traffic - distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds the TLS + certs for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether + the proxy should skip verifying the CA signature and + SAN for the server certificate corresponding to the + host.' nullable: true type: boolean - failover: - description: 'Optional: only one of distribute, failover - or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the traffic will - fail over to when endpoints in the 'from' region - becomes unhealthy. - type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered list of - labels used to sort endpoints to do priority based - load balancing. + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. + + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server during + TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify the + subject identity in the certificate. items: type: string type: array type: object - simple: - description: ' + type: object + maxItems: 4096 + type: array + proxyProtocol: + description: The upstream PROXY protocol settings. + properties: + version: + description: |- + The PROXY protocol version to use. + Valid Options: V1, V2 + enum: + - V1 + - V2 + type: string + type: object + retryBudget: + description: Specifies a limit on concurrent retries in relation + to the number of active requests. + properties: + minRetryConcurrency: + description: Specifies the minimum retry concurrency allowed + for the retry budget. + maximum: 4294967295 + minimum: 0 + type: integer + percent: + description: Specifies the limit on concurrent retries as + a percentage of the sum of active requests and active pending + requests. + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + type: object + tls: + description: TLS related settings for connections to the upstream + service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing certificate + authority certificates to use in verifying a presented server + certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing the + certificate revocation list (CRL) to use in verifying a + presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds the TLS certs + for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether the proxy + should skip verifying the CA signature and SAN for the server + certificate corresponding to the host.' + nullable: true + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, - LEAST_REQUEST' - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration of Service. - properties: - aggression: - description: This parameter controls the speed of traffic - increase over the warmup duration. - format: double - minimum: 0 - nullable: true - type: number - duration: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - required: - - duration - type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - outlierDetection: - properties: - baseEjectionTime: - description: Minimum ejection duration. + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server during TLS + handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject + identity in the certificate. + items: type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is ejected - from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host is ejected - from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated - failures before ejection occurs. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - interval: - description: Time interval between ejection sweep analysis. + type: array + type: object + tunnel: + description: Configuration of tunneling TCP over other transport + or application layers for the host configured in the DestinationRule. + properties: + protocol: + description: Specifies which protocol to use for tunneling + the downstream connection. + type: string + targetHost: + description: Specifies a host to which the downstream connection + is tunneled. + type: string + targetPort: + description: Specifies a port to which the downstream connection + is tunneled. + maximum: 4294967295 + minimum: 0 + type: integer + required: + - targetHost + - targetPort + type: object + type: object + workloadSelector: + description: Criteria used to select the specific set of pods/VMs + on which this `DestinationRule` configuration should be applied. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + required: + - host + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing pool - for the upstream service that can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled as long as - the associated load balancing pool has at least `minHealthPercent` - hosts in healthy mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local origin - failures from external errors. - type: boolean type: object - portLevelSettings: - description: Traffic policies specific to individual ports. - items: - properties: - connectionPool: - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: 'Specify if http1.1 connection should - be upgraded to http2 for the associated destination. - + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - description: The name of a service from the service registry + jsonPath: .spec.host + name: Host + type: string + - description: CreationTimestamp is a timestamp representing the server time when + this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. For more information, see [Kubernetes API Conventions](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata) + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting load balancing, outlier detection, + etc. See more details at: https://istio.io/docs/reference/config/networking/destination-rule.html' + properties: + exportTo: + description: A list of namespaces to which this destination rule is + exported. + items: + type: string + type: array + host: + description: The name of a service from the service registry. + type: string + subsets: + description: One or more named sets that represent individual versions + of a service. + items: + properties: + labels: + additionalProperties: + type: string + description: Labels apply a filter over the endpoints of a service + in the service registry. + type: object + name: + description: Name of the subset. + type: string + trafficPolicy: + description: Traffic policies that apply to this subset. + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE' - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will - be queued while waiting for a ready connection - pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests - to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection - pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent - streams allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection - to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can - be outstanding to all hosts in a cluster at - a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will - be preserved while initiating connection to - backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP - upstream connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will + be queued while waiting for a ready connection + pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to + a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection + pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams + allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection + to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can + be outstanding to all hosts in a cluster at a + given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will + be preserved while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream + connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections + to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the + socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between keep-alive + probes. + type: string + x-kubernetes-validations: - message: must be a valid duration greater than 1ms rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: + probes: + description: Maximum number of keepalive probes + to send without response before deciding the + connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection + needs to be idle before keep-alive probes + start being sent. + type: string + x-kubernetes-validations: - message: must be a valid duration greater than 1ms rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections - to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the - socket to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive - probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes - to send without response before deciding - the connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection - needs to be idle before keep-alive probes - start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: object - type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: - - required: - - simple - - required: - - consistentHash + type: object + type: object + type: object + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: - required: - - simple + - simple - required: - - consistentHash - properties: - consistentHash: - allOf: - - oneOf: - - not: - anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - oneOf: - - not: - anyOf: - - required: - - ringHash - - required: - - maglev - - required: - - ringHash - - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. + - consistentHash + - required: + - simple + - required: + - consistentHash + properties: + consistentHash: + allOf: + - oneOf: + - not: + anyOf: + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - oneOf: + - not: + anyOf: + - required: + - ringHash + - required: + - maglev + - required: + - ringHash + - required: + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. + properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the + cookie attribute. + type: string + required: + - name + type: object + type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name + type: object + httpHeaderName: + description: Hash based on a specific HTTP header. + type: string + httpQueryParameterName: + description: Hash based on a specific HTTP query + parameter. + type: string + maglev: + description: The Maglev load balancer implements + consistent hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev hashing. + minimum: 0 + type: integer + type: object + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer + implements consistent hashing to backend hosts. + properties: + minimumRingSize: + description: The minimum number of virtual nodes + to use for the hash ring. + minimum: 0 + type: integer + type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean + type: object + localityLbSetting: + properties: + distribute: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: properties: - attributes: - description: Additional attributes for the - cookie. - items: - properties: - name: - description: The name of the cookie - attribute. - type: string - value: - description: The optional value of the - cookie attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. + from: + description: Originating locality, '/' separated, + e.g. type: string - path: - description: Path to set for the cookie. + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities to + traffic distribution weights. + type: object + type: object + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. type: string - ttl: - description: Lifetime of the cookie. + to: + description: Destination region the traffic + will fail over to when endpoints in the + 'from' region becomes unhealthy. type: string - required: - - name type: object - httpHeaderName: - description: Hash based on a specific HTTP header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query - parameter. + type: array + failoverPriority: + description: failoverPriority is an ordered list + of labels used to sort endpoints to do priority + based load balancing. + items: type: string - maglev: - description: The Maglev load balancer implements - consistent hashing to backend hosts. - properties: - tableSize: - description: The table size for Maglev hashing. - minimum: 0 - type: integer - type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer - implements consistent hashing to backend hosts. - properties: - minimumRingSize: - description: The minimum number of virtual - nodes to use for the hash ring. - minimum: 0 - type: integer - type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean - type: object - localityLbSetting: - properties: - distribute: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' separated, - e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 + type: array + type: object + simple: + description: |2- + + + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST + type: string + warmup: + description: Represents the warmup configuration of + Service. + properties: + aggression: + description: This parameter controls the speed of + traffic increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: + properties: + baseEjectionTime: + description: Minimum ejection duration. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected + from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a host + is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated + failures before ejection occurs. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep analysis. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing + pool for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled as long + as the associated load balancing pool has at least + `minHealthPercent` hosts in healthy mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local + origin failures from external errors. + type: boolean + type: object + portLevelSettings: + description: Traffic policies specific to individual ports. + items: + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that + will be queued while waiting for a ready + connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests + to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream + connection pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent + streams allowed for a peer on one HTTP/2 + connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per + connection to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that + can be outstanding to all hosts in a cluster + at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol + will be preserved while initiating connection + to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and + TCP upstream connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP + connections to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE + on the socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between + keep-alive probes. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive + probes to send without response before + deciding the connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection + needs to be idle before keep-alive probes + start being sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + type: object + type: object + type: object + loadBalancer: + description: Settings controlling the load balancer + algorithms. + oneOf: + - not: + anyOf: + - required: + - simple + - required: + - consistentHash + - required: + - simple + - required: + - consistentHash + properties: + consistentHash: + allOf: + - oneOf: + - not: + anyOf: + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - oneOf: + - not: + anyOf: + - required: + - ringHash + - required: + - maglev + - required: + - ringHash + - required: + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. + properties: + attributes: + description: Additional attributes for + the cookie. + items: + properties: + name: + description: The name of the cookie + attribute. + type: string + value: + description: The optional value + of the cookie attribute. + type: string + required: + - name + type: object + type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name + type: object + httpHeaderName: + description: Hash based on a specific HTTP + header. + type: string + httpQueryParameterName: + description: Hash based on a specific HTTP + query parameter. + type: string + maglev: + description: The Maglev load balancer implements + consistent hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev + hashing. + minimum: 0 + type: integer + type: object + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer + implements consistent hashing to backend + hosts. + properties: + minimumRingSize: + description: The minimum number of virtual + nodes to use for the hash ring. minimum: 0 type: integer - description: Map of upstream localities - to traffic distribution weights. + type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean + type: object + localityLbSetting: + properties: + distribute: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating locality, '/' + separated, e.g. + type: string + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities + to traffic distribution weights. + type: object type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the traffic - will fail over to when endpoints in the - 'from' region becomes unhealthy. + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. + type: string + to: + description: Destination region the + traffic will fail over to when endpoints + in the 'from' region becomes unhealthy. + type: string + type: object + type: array + failoverPriority: + description: failoverPriority is an ordered + list of labels used to sort endpoints to + do priority based load balancing. + items: type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered list - of labels used to sort endpoints to do priority - based load balancing. - items: - type: string - type: array - type: object - simple: - description: ' + type: array + type: object + simple: + description: |2- - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, - ROUND_ROBIN, LEAST_REQUEST' - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration of - Service. + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST + type: string + warmup: + description: Represents the warmup configuration + of Service. + properties: + aggression: + description: This parameter controls the speed + of traffic increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: properties: - aggression: - description: This parameter controls the speed - of traffic increase over the warmup duration. - format: double + baseEjectionTime: + description: Minimum ejection duration. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host + is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a + host is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally + originated failures before ejection occurs. + maximum: 4294967295 minimum: 0 nullable: true - type: number - duration: + type: integer + interval: + description: Time interval between ejection sweep + analysis. type: string x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing + pool for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled + as long as the associated load balancing pool + has at least `minHealthPercent` hosts in healthy + mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish + local origin failures from external errors. + type: boolean + type: object + port: + description: Specifies the number of a port on the + destination service on which this policy is being + applied. + properties: + number: + maximum: 4294967295 minimum: 0 + type: integer + type: object + tls: + description: TLS related settings for connections + to the upstream service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing + certificate authority certificates to use in + verifying a presented server certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing + the certificate revocation list (CRL) to use + in verifying a presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds + the TLS certs for the client including the CA + certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether + the proxy should skip verifying the CA signature + and SAN for the server certificate corresponding + to the host.' nullable: true - type: number - required: - - duration + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. + + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server + during TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify + the subject identity in the certificate. + items: + type: string + type: array type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') type: object - outlierDetection: - properties: - baseEjectionTime: - description: Minimum ejection duration. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is - ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host - is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated - failures before ejection occurs. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer + maxItems: 4096 + type: array + proxyProtocol: + description: The upstream PROXY protocol settings. + properties: + version: + description: |- + The PROXY protocol version to use. + + Valid Options: V1, V2 + enum: + - V1 + - V2 + type: string + type: object + retryBudget: + description: Specifies a limit on concurrent retries in + relation to the number of active requests. + properties: + minRetryConcurrency: + description: Specifies the minimum retry concurrency + allowed for the retry budget. + maximum: 4294967295 + minimum: 0 + type: integer + percent: + description: Specifies the limit on concurrent retries + as a percentage of the sum of active requests and + active pending requests. + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + type: object + tls: + description: TLS related settings for connections to the + upstream service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing + certificate authority certificates to use in verifying + a presented server certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing + the certificate revocation list (CRL) to use in verifying + a presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds the TLS + certs for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether + the proxy should skip verifying the CA signature and + SAN for the server certificate corresponding to the + host.' + nullable: true + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. + + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server during + TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify the + subject identity in the certificate. + items: + type: string + type: array + type: object + tunnel: + description: Configuration of tunneling TCP over other transport + or application layers for the host configured in the DestinationRule. + properties: + protocol: + description: Specifies which protocol to use for tunneling + the downstream connection. + type: string + targetHost: + description: Specifies a host to which the downstream + connection is tunneled. + type: string + targetPort: + description: Specifies a port to which the downstream + connection is tunneled. + maximum: 4294967295 + minimum: 0 + type: integer + required: + - targetHost + - targetPort + type: object + type: object + required: + - name + type: object + type: array + trafficPolicy: + description: Traffic policies to apply (load balancing policy, connection + pool sizes, outlier detection). + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will be queued + while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection + pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams + allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection + to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding + to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be preserved + while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream + connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections + to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket + to enable TCP Keepalives. + properties: interval: - description: Time interval between ejection sweep - analysis. + description: The time duration between keep-alive + probes. type: string x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing - pool for the upstream service that can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled as - long as the associated load balancing pool has at - least `minHealthPercent` hosts in healthy mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local - origin failures from external errors. - type: boolean - type: object - port: - description: Specifies the number of a port on the destination - service on which this policy is being applied. - properties: - number: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to + send without response before deciding the connection + is dead. maximum: 4294967295 minimum: 0 type: integer - type: object - tls: - description: TLS related settings for connections to the - upstream service. - properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing - certificate authority certificates to use in verifying - a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing - the certificate revocation list (CRL) to use in - verifying a presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds the - TLS certs for the client including the CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether - the proxy should skip verifying the CA signature - and SAN for the server certificate corresponding - to the host.' - nullable: true - type: boolean - mode: - description: 'Indicates whether connections to this - port should be secured using TLS. - - - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL' - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. - type: string - sni: - description: SNI string to present to the server during - TLS handshake. + time: + description: The time duration a connection needs + to be idle before keep-alive probes start being + sent. type: string - subjectAltNames: - description: A list of alternate names to verify the - subject identity in the certificate. - items: - type: string - type: array + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') type: object type: object - maxItems: 4096 - type: array - proxyProtocol: - description: The upstream PROXY protocol settings. - properties: - version: - description: 'The PROXY protocol version to use. - - - Valid Options: V1, V2' - enum: - - V1 - - V2 - type: string - type: object - retryBudget: - description: Specifies a limit on concurrent retries in relation - to the number of active requests. - properties: - minRetryConcurrency: - description: Specifies the minimum retry concurrency allowed - for the retry budget. - maximum: 4294967295 - minimum: 0 - type: integer - percent: - description: Specifies the limit on concurrent retries as - a percentage of the sum of active requests and active - pending requests. - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - type: object - tls: - description: TLS related settings for connections to the upstream - service. - properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing - certificate authority certificates to use in verifying - a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing - the certificate revocation list (CRL) to use in verifying - a presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds the TLS certs - for the client including the CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether the - proxy should skip verifying the CA signature and SAN for - the server certificate corresponding to the host.' - nullable: true - type: boolean - mode: - description: 'Indicates whether connections to this port - should be secured using TLS. - - - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL' - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. - type: string - sni: - description: SNI string to present to the server during - TLS handshake. - type: string - subjectAltNames: - description: A list of alternate names to verify the subject - identity in the certificate. - items: - type: string - type: array - type: object - tunnel: - description: Configuration of tunneling TCP over other transport - or application layers for the host configured in the DestinationRule. - properties: - protocol: - description: Specifies which protocol to use for tunneling - the downstream connection. - type: string - targetHost: - description: Specifies a host to which the downstream connection - is tunneled. - type: string - targetPort: - description: Specifies a port to which the downstream connection - is tunneled. - maximum: 4294967295 - minimum: 0 - type: integer - required: - - targetHost - - targetPort - type: object - type: object - workloadSelector: - description: Criteria used to select the specific set of pods/VMs - on which this `DestinationRule` configuration should be applied. - properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set - of pods/VMs on which a policy should be applied. - maxProperties: 4096 - type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) - type: object - required: - - host - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: + - required: + - simple + - required: + - consistentHash + - required: + - simple + - required: + - consistentHash properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. - - - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: + consistentHash: + allOf: + - oneOf: + - not: + anyOf: + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - oneOf: + - not: + anyOf: + - required: + - ringHash + - required: + - maglev + - required: + - ringHash + - required: + - maglev properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. + httpCookie: + description: Hash based on HTTP cookie. + properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the cookie + attribute. + type: string + required: + - name + type: object + type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name + type: object + httpHeaderName: + description: Hash based on a specific HTTP header. type: string - name: - description: A human-readable name for the message type. + httpQueryParameterName: + description: Hash based on a specific HTTP query parameter. type: string + maglev: + description: The Maglev load balancer implements consistent + hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev hashing. + minimum: 0 + type: integer + type: object + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer implements + consistent hashing to backend hosts. + properties: + minimumRingSize: + description: The minimum number of virtual nodes to + use for the hash ring. + minimum: 0 + type: integer + type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} - - additionalPrinterColumns: - - description: The name of a service from the service registry - jsonPath: .spec.host - name: Host - type: string - - description: CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is - represented in RFC3339 form and is in UTC. Populated by the system. Read-only. - Null for lists. For more information, see [Kubernetes API Conventions](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata) - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting load balancing, outlier detection, - etc. See more details at: https://istio.io/docs/reference/config/networking/destination-rule.html' - properties: - exportTo: - description: A list of namespaces to which this destination rule - is exported. - items: - type: string - type: array - host: - description: The name of a service from the service registry. - type: string - subsets: - description: One or more named sets that represent individual versions - of a service. - items: - properties: - labels: - additionalProperties: - type: string - description: Labels apply a filter over the endpoints of a - service in the service registry. - type: object - name: - description: Name of the subset. - type: string - trafficPolicy: - description: Traffic policies that apply to this subset. + localityLbSetting: properties: - connectionPool: - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: 'Specify if http1.1 connection should - be upgraded to http2 for the associated destination. - - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE' - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will - be queued while waiting for a ready connection - pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests - to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection - pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent - streams allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection - to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can - be outstanding to all hosts in a cluster at - a given time. - format: int32 + distribute: + description: 'Optional: only one of distribute, failover + or failoverPriority can be set.' + items: + properties: + from: + description: Originating locality, '/' separated, + e.g. + type: string + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 type: integer - useClientProtocol: - description: If set to true, client protocol will - be preserved while initiating connection to - backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP - upstream connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: + description: Map of upstream localities to traffic + distribution weights. + type: object + type: object + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, failover + or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. + type: string + to: + description: Destination region the traffic will + fail over to when endpoints in the 'from' region + becomes unhealthy. + type: string + type: object + type: array + failoverPriority: + description: failoverPriority is an ordered list of labels + used to sort endpoints to do priority based load balancing. + items: + type: string + type: array + type: object + simple: + description: |2- + + + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST + type: string + warmup: + description: Represents the warmup configuration of Service. + properties: + aggression: + description: This parameter controls the speed of traffic + increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: + properties: + baseEjectionTime: + description: Minimum ejection duration. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected + from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a host is ejected + from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated + failures before ejection occurs. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep analysis. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing pool + for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled as long as + the associated load balancing pool has at least `minHealthPercent` + hosts in healthy mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local origin + failures from external errors. + type: boolean + type: object + portLevelSettings: + description: Traffic policies specific to individual ports. + items: + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will + be queued while waiting for a ready connection + pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to + a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection + pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams + allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection + to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can + be outstanding to all hosts in a cluster at a + given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will + be preserved while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream + connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections + to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the + socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between keep-alive + probes. + type: string + x-kubernetes-validations: - message: must be a valid duration greater than 1ms rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: + probes: + description: Maximum number of keepalive probes + to send without response before deciding the + connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection + needs to be idle before keep-alive probes + start being sent. + type: string + x-kubernetes-validations: - message: must be a valid duration greater than 1ms rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections - to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the - socket to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive - probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes - to send without response before deciding - the connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection - needs to be idle before keep-alive probes - start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: object - type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: - - required: - - simple - - required: - - consistentHash + type: object + type: object + type: object + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: - required: - - simple + - simple - required: - - consistentHash - properties: - consistentHash: - allOf: - - oneOf: - - not: - anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - oneOf: - - not: - anyOf: - - required: - - ringHash - - required: - - maglev - - required: - - ringHash - - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. + - consistentHash + - required: + - simple + - required: + - consistentHash + properties: + consistentHash: + allOf: + - oneOf: + - not: + anyOf: + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - oneOf: + - not: + anyOf: + - required: + - ringHash + - required: + - maglev + - required: + - ringHash + - required: + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. + properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the + cookie attribute. + type: string + required: + - name + type: object + type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name + type: object + httpHeaderName: + description: Hash based on a specific HTTP header. + type: string + httpQueryParameterName: + description: Hash based on a specific HTTP query + parameter. + type: string + maglev: + description: The Maglev load balancer implements + consistent hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev hashing. + minimum: 0 + type: integer + type: object + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer + implements consistent hashing to backend hosts. + properties: + minimumRingSize: + description: The minimum number of virtual nodes + to use for the hash ring. + minimum: 0 + type: integer + type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean + type: object + localityLbSetting: + properties: + distribute: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: properties: - attributes: - description: Additional attributes for the - cookie. - items: - properties: - name: - description: The name of the cookie - attribute. - type: string - value: - description: The optional value of the - cookie attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. + from: + description: Originating locality, '/' separated, + e.g. type: string - path: - description: Path to set for the cookie. + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities to + traffic distribution weights. + type: object + type: object + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. type: string - ttl: - description: Lifetime of the cookie. + to: + description: Destination region the traffic + will fail over to when endpoints in the + 'from' region becomes unhealthy. type: string - required: - - name type: object - httpHeaderName: - description: Hash based on a specific HTTP header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query - parameter. + type: array + failoverPriority: + description: failoverPriority is an ordered list + of labels used to sort endpoints to do priority + based load balancing. + items: type: string - maglev: - description: The Maglev load balancer implements - consistent hashing to backend hosts. - properties: - tableSize: - description: The table size for Maglev hashing. - minimum: 0 - type: integer - type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer - implements consistent hashing to backend hosts. - properties: - minimumRingSize: - description: The minimum number of virtual - nodes to use for the hash ring. - minimum: 0 - type: integer - type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean - type: object - localityLbSetting: - properties: - distribute: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' separated, - e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities - to traffic distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the traffic - will fail over to when endpoints in the - 'from' region becomes unhealthy. - type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered list - of labels used to sort endpoints to do priority - based load balancing. - items: - type: string - type: array - type: object - simple: - description: ' + type: array + type: object + simple: + description: |2- - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, - ROUND_ROBIN, LEAST_REQUEST' - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration of - Service. - properties: - aggression: - description: This parameter controls the speed - of traffic increase over the warmup duration. - format: double - minimum: 0 - nullable: true - type: number - duration: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - required: - - duration - type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - type: object - outlierDetection: - properties: - baseEjectionTime: - description: Minimum ejection duration. - type: string - x-kubernetes-validations: + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST + type: string + warmup: + description: Represents the warmup configuration of + Service. + properties: + aggression: + description: This parameter controls the speed of + traffic increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: - message: must be a valid duration greater than 1ms rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is - ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host - is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated - failures before ejection occurs. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - interval: - description: Time interval between ejection sweep - analysis. + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: + properties: + baseEjectionTime: + description: Minimum ejection duration. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected + from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a host + is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated + failures before ejection occurs. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep analysis. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing + pool for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled as long + as the associated load balancing pool has at least + `minHealthPercent` hosts in healthy mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local + origin failures from external errors. + type: boolean + type: object + port: + description: Specifies the number of a port on the destination + service on which this policy is being applied. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + tls: + description: TLS related settings for connections to the + upstream service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing + certificate authority certificates to use in verifying + a presented server certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing + the certificate revocation list (CRL) to use in verifying + a presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds the TLS + certs for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether + the proxy should skip verifying the CA signature and + SAN for the server certificate corresponding to the + host.' + nullable: true + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. + + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server during + TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify the + subject identity in the certificate. + items: type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing - pool for the upstream service that can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled as - long as the associated load balancing pool has at - least `minHealthPercent` hosts in healthy mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local - origin failures from external errors. - type: boolean - type: object - portLevelSettings: - description: Traffic policies specific to individual ports. - items: + type: array + type: object + type: object + maxItems: 4096 + type: array + proxyProtocol: + description: The upstream PROXY protocol settings. + properties: + version: + description: |- + The PROXY protocol version to use. + + Valid Options: V1, V2 + enum: + - V1 + - V2 + type: string + type: object + retryBudget: + description: Specifies a limit on concurrent retries in relation + to the number of active requests. + properties: + minRetryConcurrency: + description: Specifies the minimum retry concurrency allowed + for the retry budget. + maximum: 4294967295 + minimum: 0 + type: integer + percent: + description: Specifies the limit on concurrent retries as + a percentage of the sum of active requests and active pending + requests. + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + type: object + tls: + description: TLS related settings for connections to the upstream + service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing certificate + authority certificates to use in verifying a presented server + certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing the + certificate revocation list (CRL) to use in verifying a + presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds the TLS certs + for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether the proxy + should skip verifying the CA signature and SAN for the server + certificate corresponding to the host.' + nullable: true + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. + + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server during TLS + handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject + identity in the certificate. + items: + type: string + type: array + type: object + tunnel: + description: Configuration of tunneling TCP over other transport + or application layers for the host configured in the DestinationRule. + properties: + protocol: + description: Specifies which protocol to use for tunneling + the downstream connection. + type: string + targetHost: + description: Specifies a host to which the downstream connection + is tunneled. + type: string + targetPort: + description: Specifies a port to which the downstream connection + is tunneled. + maximum: 4294967295 + minimum: 0 + type: integer + required: + - targetHost + - targetPort + type: object + type: object + workloadSelector: + description: Criteria used to select the specific set of pods/VMs + on which this `DestinationRule` configuration should be applied. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + required: + - host + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: istio + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/part-of: istio + app.kubernetes.io/version: 1.29.4 + helm.sh/chart: base-1.29.4 + name: envoyfilters.networking.istio.io +spec: + group: networking.istio.io + names: + categories: + - istio-io + - networking-istio-io + kind: EnvoyFilter + listKind: EnvoyFilterList + plural: envoyfilters + singular: envoyfilter + scope: Namespaced + versions: + - name: v1alpha3 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Customizing Envoy configuration generated by Istio. See + more details at: https://istio.io/docs/reference/config/networking/envoy-filter.html' + properties: + configPatches: + description: One or more patches with match conditions. + items: + properties: + applyTo: + description: |- + Specifies where in the Envoy configuration, the patch should be applied. + + Valid Options: LISTENER, FILTER_CHAIN, NETWORK_FILTER, HTTP_FILTER, ROUTE_CONFIGURATION, VIRTUAL_HOST, HTTP_ROUTE, CLUSTER, EXTENSION_CONFIG, BOOTSTRAP, LISTENER_FILTER + enum: + - INVALID + - LISTENER + - FILTER_CHAIN + - NETWORK_FILTER + - HTTP_FILTER + - ROUTE_CONFIGURATION + - VIRTUAL_HOST + - HTTP_ROUTE + - CLUSTER + - EXTENSION_CONFIG + - BOOTSTRAP + - LISTENER_FILTER + type: string + match: + description: Match on listener/route configuration/cluster. + oneOf: + - not: + anyOf: + - required: + - listener + - required: + - routeConfiguration + - required: + - cluster + - required: + - waypoint + - required: + - listener + - required: + - routeConfiguration + - required: + - cluster + - required: + - waypoint + properties: + cluster: + description: Match on envoy cluster attributes. + properties: + name: + description: The exact name of the cluster to match. + type: string + portNumber: + description: The service port for which this cluster + was generated. + maximum: 4294967295 + minimum: 0 + type: integer + service: + description: The fully qualified service name for this + cluster. + type: string + subset: + description: The subset associated with the service. + type: string + type: object + context: + description: |- + The specific config generation context to match on. + + Valid Options: ANY, SIDECAR_INBOUND, SIDECAR_OUTBOUND, GATEWAY, WAYPOINT + enum: + - ANY + - SIDECAR_INBOUND + - SIDECAR_OUTBOUND + - GATEWAY + - WAYPOINT + type: string + listener: + description: Match on envoy listener attributes. + properties: + filterChain: + description: Match a specific filter chain in a listener. properties: - connectionPool: + applicationProtocols: + description: Applies only to sidecars. + type: string + destinationPort: + description: The destination_port value used by + a filter chain's match condition. + maximum: 4294967295 + minimum: 0 + type: integer + filter: + description: The name of a specific filter to apply + the patch to. properties: - http: - description: HTTP connection pool settings. + name: + description: The filter name to match on. + type: string + subFilter: + description: The next level filter within this + filter to match upon. properties: - h2UpgradePolicy: - description: 'Specify if http1.1 connection - should be upgraded to http2 for the associated - destination. - - - Valid Options: DEFAULT, DO_NOT_UPGRADE, - UPGRADE' - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests - that will be queued while waiting for - a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests - to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream - connection pool connections. + name: + description: The filter name to match on. type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent - streams allowed for a peer on one HTTP/2 - connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests - per connection to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that - can be outstanding to all hosts in a cluster - at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol - will be preserved while initiating connection - to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and - TCP upstream connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP - connections to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE - on the socket to enable TCP Keepalives. - properties: - interval: - description: The time duration between - keep-alive probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration - greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive - probes to send without response before - deciding the connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection - needs to be idle before keep-alive - probes start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration - greater than 1ms - rule: duration(self) >= duration('1ms') - type: object type: object type: object - loadBalancer: - description: Settings controlling the load balancer - algorithms. - oneOf: - - not: - anyOf: - - required: - - simple - - required: - - consistentHash - - required: - - simple - - required: - - consistentHash + name: + description: The name assigned to the filter chain. + type: string + sni: + description: The SNI value used by a filter chain's + match condition. + type: string + transportProtocol: + description: Applies only to `SIDECAR_INBOUND` context. + type: string + type: object + listenerFilter: + description: Match a specific listener filter. + type: string + name: + description: Match a specific listener by its name. + type: string + portName: + type: string + portNumber: + description: The service port/gateway port to which + traffic is being sent/received. + maximum: 4294967295 + minimum: 0 + type: integer + type: object + proxy: + description: Match on properties associated with a proxy. + properties: + metadata: + additionalProperties: + type: string + description: Match on the node metadata supplied by + a proxy when connecting to istiod. + type: object + proxyVersion: + description: A regular expression in golang regex format + (RE2) that can be used to select proxies using a specific + version of istio proxy. + type: string + type: object + routeConfiguration: + description: Match on envoy HTTP route configuration attributes. + properties: + gateway: + description: The Istio gateway config's namespace/name + for which this route configuration was generated. + type: string + name: + description: Route configuration name to match on. + type: string + portName: + description: Applicable only for GATEWAY context. + type: string + portNumber: + description: The service port number or gateway server + port number for which this route configuration was + generated. + maximum: 4294967295 + minimum: 0 + type: integer + vhost: + description: Match a specific virtual host in a route + configuration and apply the patch to the virtual host. + properties: + domainName: + description: Match a domain name in a virtual host. + type: string + name: + description: The VirtualHosts objects generated + by Istio are named as host:port, where the host + typically corresponds to the VirtualService's + host field or the hostname of a service in the + registry. + type: string + route: + description: Match a specific route within the virtual + host. properties: - consistentHash: - allOf: - - oneOf: - - not: - anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - oneOf: - - not: - anyOf: - - required: - - ringHash - - required: - - maglev - - required: - - ringHash - - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. - properties: - attributes: - description: Additional attributes for - the cookie. - items: - properties: - name: - description: The name of the cookie - attribute. - type: string - value: - description: The optional value - of the cookie attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. - type: string - ttl: - description: Lifetime of the cookie. - type: string - required: - - name - type: object - httpHeaderName: - description: Hash based on a specific HTTP - header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP - query parameter. - type: string - maglev: - description: The Maglev load balancer implements - consistent hashing to backend hosts. - properties: - tableSize: - description: The table size for Maglev - hashing. - minimum: 0 - type: integer - type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer - implements consistent hashing to backend - hosts. - properties: - minimumRingSize: - description: The minimum number of virtual - nodes to use for the hash ring. - minimum: 0 - type: integer - type: object - useSourceIp: - description: Hash based on the source IP - address. - type: boolean - type: object - localityLbSetting: - properties: - distribute: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, - '/' separated, e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities - to traffic distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the - traffic will fail over to when endpoints - in the 'from' region becomes unhealthy. - type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered - list of labels used to sort endpoints - to do priority based load balancing. - items: - type: string - type: array - type: object - simple: - description: ' - + action: + description: |- + Match a route with specific action type. - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, - ROUND_ROBIN, LEAST_REQUEST' + Valid Options: ANY, ROUTE, REDIRECT, DIRECT_RESPONSE enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration - of Service. - properties: - aggression: - description: This parameter controls the - speed of traffic increase over the warmup - duration. - format: double - minimum: 0 - nullable: true - type: number - duration: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - required: - - duration - type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - type: object - outlierDetection: - properties: - baseEjectionTime: - description: Minimum ejection duration. + - ANY + - ROUTE + - REDIRECT + - DIRECT_RESPONSE type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host - is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before - a host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally - originated failures before ejection occurs. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - interval: - description: Time interval between ejection - sweep analysis. + name: + description: The Route objects generated by + default are named as default. type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load - balancing pool for the upstream service that - can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled - as long as the associated load balancing pool - has at least `minHealthPercent` hosts in healthy - mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish - local origin failures from external errors. - type: boolean - type: object - port: - description: Specifies the number of a port on the - destination service on which this policy is being - applied. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer type: object - tls: - description: TLS related settings for connections - to the upstream service. + type: object + type: object + waypoint: + properties: + filter: + description: The name of a specific filter to apply + the patch to. + properties: + name: + description: The filter name to match on. + type: string + subFilter: + description: The next level filter within this filter + to match on. properties: - caCertificates: - description: 'OPTIONAL: The path to the file - containing certificate authority certificates - to use in verifying a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file - containing the certificate revocation list - (CRL) to use in verifying a presented server - certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds - the TLS certs for the client including the - CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies - whether the proxy should skip verifying the - CA signature and SAN for the server certificate - corresponding to the host.' - nullable: true - type: boolean - mode: - description: 'Indicates whether connections - to this port should be secured using TLS. - - - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL' - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. + name: + description: The filter name to match on. type: string - sni: - description: SNI string to present to the server - during TLS handshake. - type: string - subjectAltNames: - description: A list of alternate names to verify - the subject identity in the certificate. - items: - type: string - type: array type: object type: object - maxItems: 4096 - type: array - proxyProtocol: - description: The upstream PROXY protocol settings. - properties: - version: - description: 'The PROXY protocol version to use. - - - Valid Options: V1, V2' - enum: - - V1 - - V2 - type: string - type: object - retryBudget: - description: Specifies a limit on concurrent retries in - relation to the number of active requests. - properties: - minRetryConcurrency: - description: Specifies the minimum retry concurrency - allowed for the retry budget. - maximum: 4294967295 - minimum: 0 - type: integer - percent: - description: Specifies the limit on concurrent retries - as a percentage of the sum of active requests and - active pending requests. - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - type: object - tls: - description: TLS related settings for connections to the - upstream service. - properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing - certificate authority certificates to use in verifying - a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing - the certificate revocation list (CRL) to use in - verifying a presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds the - TLS certs for the client including the CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether - the proxy should skip verifying the CA signature - and SAN for the server certificate corresponding - to the host.' - nullable: true - type: boolean - mode: - description: 'Indicates whether connections to this - port should be secured using TLS. - - - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL' - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. - type: string - sni: - description: SNI string to present to the server during - TLS handshake. - type: string - subjectAltNames: - description: A list of alternate names to verify the - subject identity in the certificate. - items: + portNumber: + description: The service port to match on. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + route: + description: Match a specific route. + properties: + name: + description: The Route objects generated by default + are named as default. type: string - type: array - type: object - tunnel: - description: Configuration of tunneling TCP over other - transport or application layers for the host configured - in the DestinationRule. - properties: - protocol: - description: Specifies which protocol to use for tunneling - the downstream connection. - type: string - targetHost: - description: Specifies a host to which the downstream - connection is tunneled. - type: string - targetPort: - description: Specifies a port to which the downstream - connection is tunneled. - maximum: 4294967295 - minimum: 0 - type: integer - required: - - targetHost - - targetPort - type: object - type: object - required: - - name - type: object - type: array - trafficPolicy: - description: Traffic policies to apply (load balancing policy, connection - pool sizes, outlier detection). - properties: - connectionPool: + type: object + type: object + type: object + x-kubernetes-validations: + - message: only support waypointMatch when context is WAYPOINT + rule: 'has(self.context) ? ((self.context == "WAYPOINT") ? + has(self.waypoint) : !has(self.waypoint)) : !has(self.waypoint)' + patch: + description: The patch to apply along with the operation. properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: 'Specify if http1.1 connection should be - upgraded to http2 for the associated destination. + filterClass: + description: |- + Determines the filter insertion order. + Valid Options: AUTHN, AUTHZ, STATS + enum: + - UNSPECIFIED + - AUTHN + - AUTHZ + - STATS + type: string + operation: + description: |- + Determines how the patch should be applied. - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE' - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be - queued while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a - destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection - pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams - allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection - to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding - to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be - preserved while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream - connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections - to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket - to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive - probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes - to send without response before deciding the connection - is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection needs - to be idle before keep-alive probes start being - sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - type: object + Valid Options: MERGE, ADD, REMOVE, INSERT_BEFORE, INSERT_AFTER, INSERT_FIRST, REPLACE + enum: + - INVALID + - MERGE + - ADD + - REMOVE + - INSERT_BEFORE + - INSERT_AFTER + - INSERT_FIRST + - REPLACE + type: string + value: + description: The JSON config of the object being patched. type: object + x-kubernetes-preserve-unknown-fields: true type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: - - required: - - simple - - required: - - consistentHash - - required: - - simple - - required: - - consistentHash - properties: - consistentHash: - allOf: - - oneOf: - - not: - anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - oneOf: - - not: - anyOf: - - required: - - ringHash - - required: - - maglev - - required: - - ringHash - - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. - properties: - attributes: - description: Additional attributes for the cookie. - items: - properties: - name: - description: The name of the cookie attribute. - type: string - value: - description: The optional value of the cookie - attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. - type: string - ttl: - description: Lifetime of the cookie. - type: string - required: - - name - type: object - httpHeaderName: - description: Hash based on a specific HTTP header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query parameter. - type: string - maglev: - description: The Maglev load balancer implements consistent - hashing to backend hosts. - properties: - tableSize: - description: The table size for Maglev hashing. - minimum: 0 - type: integer - type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer implements - consistent hashing to backend hosts. - properties: - minimumRingSize: - description: The minimum number of virtual nodes - to use for the hash ring. - minimum: 0 - type: integer - type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean - type: object - localityLbSetting: - properties: - distribute: - description: 'Optional: only one of distribute, failover - or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' separated, - e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities to traffic - distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, failover - or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the traffic will - fail over to when endpoints in the 'from' region - becomes unhealthy. - type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered list of - labels used to sort endpoints to do priority based - load balancing. - items: - type: string - type: array - type: object - simple: - description: ' - + type: object + type: array + priority: + description: Priority defines the order in which patch sets are applied + within a context. + format: int32 + type: integer + targetRefs: + description: Optional. + items: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name + type: object + maxItems: 16 + type: array + workloadSelector: + description: Criteria used to select the specific set of pods/VMs + on which this patch configuration should be applied. + properties: + labels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard is not supported in selector + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which the configuration should be applied. + maxProperties: 256 + type: object + type: object + type: object + x-kubernetes-validations: + - message: only one of targetRefs or workloadSelector can be set + rule: '(has(self.workloadSelector) ? 1 : 0) + (has(self.targetRefs) + ? 1 : 0) <= 1' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, - LEAST_REQUEST' - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. type: string - warmup: - description: Represents the warmup configuration of Service. - properties: - aggression: - description: This parameter controls the speed of traffic - increase over the warmup duration. - format: double - minimum: 0 - nullable: true - type: number - duration: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - required: - - duration - type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' + name: + description: A human-readable name for the message type. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') type: object - outlierDetection: + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: istio + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/part-of: istio + app.kubernetes.io/version: 1.29.4 + helm.sh/chart: base-1.29.4 + name: gateways.networking.istio.io +spec: + group: networking.istio.io + names: + categories: + - istio-io + - networking-istio-io + kind: Gateway + listKind: GatewayList + plural: gateways + shortNames: + - gw + singular: gateway + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting edge load balancer. See more details + at: https://istio.io/docs/reference/config/networking/gateway.html' + properties: + selector: + additionalProperties: + type: string + description: One or more labels that indicate a specific set of pods/VMs + on which this gateway configuration should be applied. + type: object + servers: + description: A list of server specifications. + items: + properties: + bind: + description: The ip or the Unix domain socket to which the listener + should be bound to. + type: string + defaultEndpoint: + type: string + hosts: + description: One or more hosts exposed by this gateway. + items: + type: string + type: array + name: + description: An optional name of the server, when set must be + unique across all servers. + type: string + port: + description: The Port on which the proxy should listen for incoming + connections. properties: - baseEjectionTime: - description: Minimum ejection duration. + name: + description: Label assigned to the port. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is ejected - from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host is ejected - from the connection pool. + number: + description: A valid non-negative integer port number. maximum: 4294967295 minimum: 0 - nullable: true type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated - failures before ejection occurs. + protocol: + description: The protocol exposed on the port. + type: string + targetPort: maximum: 4294967295 minimum: 0 - nullable: true type: integer - interval: - description: Time interval between ejection sweep analysis. + required: + - number + - protocol + - name + type: object + tls: + description: Set of TLS related options that govern the server's + behavior. + properties: + caCertCredentialName: + description: For mutual TLS, the name of the secret or the + configmap that holds CA certificates. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing pool - for the upstream service that can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled as long as - the associated load balancing pool has at least `minHealthPercent` - hosts in healthy mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local origin - failures from external errors. + caCertificates: + description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing + the certificate revocation list (CRL) to use in verifying + a presented client side certificate.' + type: string + cipherSuites: + description: 'Optional: If specified, only support the specified + cipher list.' + items: + type: string + type: array + credentialName: + description: For gateways running on Kubernetes, the name + of the secret that holds the TLS certs including the CA + certificates. + type: string + credentialNames: + description: Same as CredentialName but for multiple certificates. + items: + type: string + maxItems: 2 + minItems: 1 + type: array + httpsRedirect: + description: If set to true, the load balancer will send + a 301 redirect for all http connections, asking the clients + to use HTTPS. type: boolean - type: object - portLevelSettings: - description: Traffic policies specific to individual ports. - items: - properties: - connectionPool: - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: 'Specify if http1.1 connection should - be upgraded to http2 for the associated destination. + maxProtocolVersion: + description: |- + Optional: Maximum TLS protocol version. + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + minProtocolVersion: + description: |- + Optional: Minimum TLS protocol version. - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE' - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will - be queued while waiting for a ready connection - pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests - to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection - pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent - streams allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection - to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can - be outstanding to all hosts in a cluster at - a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will - be preserved while initiating connection to - backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP - upstream connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections - to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the - socket to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive - probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes - to send without response before deciding - the connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection - needs to be idle before keep-alive probes - start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: object - type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: - - required: - - simple - - required: - - consistentHash - - required: - - simple - - required: - - consistentHash - properties: - consistentHash: - allOf: - - oneOf: - - not: - anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - oneOf: - - not: - anyOf: - - required: - - ringHash - - required: - - maglev - - required: - - ringHash - - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. - properties: - attributes: - description: Additional attributes for the - cookie. - items: - properties: - name: - description: The name of the cookie - attribute. - type: string - value: - description: The optional value of the - cookie attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. - type: string - ttl: - description: Lifetime of the cookie. - type: string - required: - - name - type: object - httpHeaderName: - description: Hash based on a specific HTTP header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query - parameter. - type: string - maglev: - description: The Maglev load balancer implements - consistent hashing to backend hosts. - properties: - tableSize: - description: The table size for Maglev hashing. - minimum: 0 - type: integer - type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer - implements consistent hashing to backend hosts. - properties: - minimumRingSize: - description: The minimum number of virtual - nodes to use for the hash ring. - minimum: 0 - type: integer - type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean - type: object - localityLbSetting: - properties: - distribute: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' separated, - e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities - to traffic distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the traffic - will fail over to when endpoints in the - 'from' region becomes unhealthy. - type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered list - of labels used to sort endpoints to do priority - based load balancing. - items: - type: string - type: array - type: object - simple: - description: ' - + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + mode: + description: |- + Optional: Indicates whether connections to this port should be secured using TLS. - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, - ROUND_ROBIN, LEAST_REQUEST' - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration of - Service. - properties: - aggression: - description: This parameter controls the speed - of traffic increase over the warmup duration. - format: double - minimum: 0 - nullable: true - type: number - duration: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - required: - - duration - type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - type: object - outlierDetection: - properties: - baseEjectionTime: - description: Minimum ejection duration. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is - ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host - is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated - failures before ejection occurs. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - interval: - description: Time interval between ejection sweep - analysis. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing - pool for the upstream service that can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled as - long as the associated load balancing pool has at - least `minHealthPercent` hosts in healthy mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local - origin failures from external errors. - type: boolean - type: object - port: - description: Specifies the number of a port on the destination - service on which this policy is being applied. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - tls: - description: TLS related settings for connections to the - upstream service. + Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL + enum: + - PASSTHROUGH + - SIMPLE + - MUTUAL + - AUTO_PASSTHROUGH + - ISTIO_MUTUAL + - OPTIONAL_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject + identity in the certificate presented by the client. + items: + type: string + type: array + tlsCertificates: + description: Only one of `server_certificate`, `private_key` + or `credential_name` or `credential_names` or `tls_certificates` + should be specified. + items: properties: caCertificates: - description: 'OPTIONAL: The path to the file containing - certificate authority certificates to use in verifying - a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing - the certificate revocation list (CRL) to use in - verifying a presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds the - TLS certs for the client including the CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether - the proxy should skip verifying the CA signature - and SAN for the server certificate corresponding - to the host.' - nullable: true - type: boolean - mode: - description: 'Indicates whether connections to this - port should be secured using TLS. - - - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL' - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL type: string privateKey: - description: REQUIRED if mode is `MUTUAL`. + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. type: string - sni: - description: SNI string to present to the server during - TLS handshake. + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. type: string - subjectAltNames: - description: A list of alternate names to verify the - subject identity in the certificate. - items: - type: string - type: array type: object - type: object - maxItems: 4096 - type: array - proxyProtocol: - description: The upstream PROXY protocol settings. - properties: - version: - description: 'The PROXY protocol version to use. - + maxItems: 2 + minItems: 1 + type: array + verifyCertificateHash: + description: An optional list of hex-encoded SHA-256 hashes + of the authorized client certificates. + items: + type: string + type: array + verifyCertificateSpki: + description: An optional list of base64-encoded SHA-256 + hashes of the SPKIs of authorized client certificates. + items: + type: string + type: array + type: object + x-kubernetes-validations: + - message: only one of credentialNames or tlsCertificates can + be set + rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) + ? 1 : 0) <= 1' + - message: only one of credentialName or credentialNames can + be set + rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) + ? 1 : 0) <= 1' + - message: only one of credentialName or tlsCertificates can + be set + rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) + ? 1 : 0) <= 1' + required: + - port + - hosts + type: object + type: array + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. - Valid Options: V1, V2' - enum: - - V1 - - V2 + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. type: string type: object - retryBudget: - description: Specifies a limit on concurrent retries in relation - to the number of active requests. + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} + - name: v1alpha3 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting edge load balancer. See more details + at: https://istio.io/docs/reference/config/networking/gateway.html' + properties: + selector: + additionalProperties: + type: string + description: One or more labels that indicate a specific set of pods/VMs + on which this gateway configuration should be applied. + type: object + servers: + description: A list of server specifications. + items: + properties: + bind: + description: The ip or the Unix domain socket to which the listener + should be bound to. + type: string + defaultEndpoint: + type: string + hosts: + description: One or more hosts exposed by this gateway. + items: + type: string + type: array + name: + description: An optional name of the server, when set must be + unique across all servers. + type: string + port: + description: The Port on which the proxy should listen for incoming + connections. properties: - minRetryConcurrency: - description: Specifies the minimum retry concurrency allowed - for the retry budget. + name: + description: Label assigned to the port. + type: string + number: + description: A valid non-negative integer port number. maximum: 4294967295 minimum: 0 type: integer - percent: - description: Specifies the limit on concurrent retries as - a percentage of the sum of active requests and active - pending requests. - format: double - maximum: 100 + protocol: + description: The protocol exposed on the port. + type: string + targetPort: + maximum: 4294967295 minimum: 0 - nullable: true - type: number + type: integer + required: + - number + - protocol + - name type: object tls: - description: TLS related settings for connections to the upstream - service. + description: Set of TLS related options that govern the server's + behavior. properties: + caCertCredentialName: + description: For mutual TLS, the name of the secret or the + configmap that holds CA certificates. + type: string caCertificates: - description: 'OPTIONAL: The path to the file containing - certificate authority certificates to use in verifying - a presented server certificate.' + description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. type: string caCrl: description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying - a presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. + a presented client side certificate.' type: string + cipherSuites: + description: 'Optional: If specified, only support the specified + cipher list.' + items: + type: string + type: array credentialName: - description: The name of the secret that holds the TLS certs - for the client including the CA certificates. + description: For gateways running on Kubernetes, the name + of the secret that holds the TLS certs including the CA + certificates. type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether the - proxy should skip verifying the CA signature and SAN for - the server certificate corresponding to the host.' - nullable: true + credentialNames: + description: Same as CredentialName but for multiple certificates. + items: + type: string + maxItems: 2 + minItems: 1 + type: array + httpsRedirect: + description: If set to true, the load balancer will send + a 301 redirect for all http connections, asking the clients + to use HTTPS. type: boolean - mode: - description: 'Indicates whether connections to this port - should be secured using TLS. + maxProtocolVersion: + description: |- + Optional: Maximum TLS protocol version. + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + minProtocolVersion: + description: |- + Optional: Minimum TLS protocol version. + + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + mode: + description: |- + Optional: Indicates whether connections to this port should be secured using TLS. - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL' + Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL + - PASSTHROUGH + - SIMPLE + - MUTUAL + - AUTO_PASSTHROUGH + - ISTIO_MUTUAL + - OPTIONAL_MUTUAL type: string privateKey: - description: REQUIRED if mode is `MUTUAL`. + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. type: string - sni: - description: SNI string to present to the server during - TLS handshake. + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. type: string subjectAltNames: description: A list of alternate names to verify the subject - identity in the certificate. + identity in the certificate presented by the client. + items: + type: string + type: array + tlsCertificates: + description: Only one of `server_certificate`, `private_key` + or `credential_name` or `credential_names` or `tls_certificates` + should be specified. + items: + properties: + caCertificates: + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + type: object + maxItems: 2 + minItems: 1 + type: array + verifyCertificateHash: + description: An optional list of hex-encoded SHA-256 hashes + of the authorized client certificates. + items: + type: string + type: array + verifyCertificateSpki: + description: An optional list of base64-encoded SHA-256 + hashes of the SPKIs of authorized client certificates. items: type: string type: array type: object - tunnel: - description: Configuration of tunneling TCP over other transport - or application layers for the host configured in the DestinationRule. + x-kubernetes-validations: + - message: only one of credentialNames or tlsCertificates can + be set + rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) + ? 1 : 0) <= 1' + - message: only one of credentialName or credentialNames can + be set + rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) + ? 1 : 0) <= 1' + - message: only one of credentialName or tlsCertificates can + be set + rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) + ? 1 : 0) <= 1' + required: + - port + - hosts + type: object + type: array + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} + - name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting edge load balancer. See more details + at: https://istio.io/docs/reference/config/networking/gateway.html' + properties: + selector: + additionalProperties: + type: string + description: One or more labels that indicate a specific set of pods/VMs + on which this gateway configuration should be applied. + type: object + servers: + description: A list of server specifications. + items: + properties: + bind: + description: The ip or the Unix domain socket to which the listener + should be bound to. + type: string + defaultEndpoint: + type: string + hosts: + description: One or more hosts exposed by this gateway. + items: + type: string + type: array + name: + description: An optional name of the server, when set must be + unique across all servers. + type: string + port: + description: The Port on which the proxy should listen for incoming + connections. properties: - protocol: - description: Specifies which protocol to use for tunneling - the downstream connection. + name: + description: Label assigned to the port. type: string - targetHost: - description: Specifies a host to which the downstream connection - is tunneled. + number: + description: A valid non-negative integer port number. + maximum: 4294967295 + minimum: 0 + type: integer + protocol: + description: The protocol exposed on the port. type: string targetPort: - description: Specifies a port to which the downstream connection - is tunneled. maximum: 4294967295 minimum: 0 type: integer required: - - targetHost - - targetPort + - number + - protocol + - name + type: object + tls: + description: Set of TLS related options that govern the server's + behavior. + properties: + caCertCredentialName: + description: For mutual TLS, the name of the secret or the + configmap that holds CA certificates. + type: string + caCertificates: + description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing + the certificate revocation list (CRL) to use in verifying + a presented client side certificate.' + type: string + cipherSuites: + description: 'Optional: If specified, only support the specified + cipher list.' + items: + type: string + type: array + credentialName: + description: For gateways running on Kubernetes, the name + of the secret that holds the TLS certs including the CA + certificates. + type: string + credentialNames: + description: Same as CredentialName but for multiple certificates. + items: + type: string + maxItems: 2 + minItems: 1 + type: array + httpsRedirect: + description: If set to true, the load balancer will send + a 301 redirect for all http connections, asking the clients + to use HTTPS. + type: boolean + maxProtocolVersion: + description: |- + Optional: Maximum TLS protocol version. + + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + minProtocolVersion: + description: |- + Optional: Minimum TLS protocol version. + + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + mode: + description: |- + Optional: Indicates whether connections to this port should be secured using TLS. + + Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL + enum: + - PASSTHROUGH + - SIMPLE + - MUTUAL + - AUTO_PASSTHROUGH + - ISTIO_MUTUAL + - OPTIONAL_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject + identity in the certificate presented by the client. + items: + type: string + type: array + tlsCertificates: + description: Only one of `server_certificate`, `private_key` + or `credential_name` or `credential_names` or `tls_certificates` + should be specified. + items: + properties: + caCertificates: + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + type: object + maxItems: 2 + minItems: 1 + type: array + verifyCertificateHash: + description: An optional list of hex-encoded SHA-256 hashes + of the authorized client certificates. + items: + type: string + type: array + verifyCertificateSpki: + description: An optional list of base64-encoded SHA-256 + hashes of the SPKIs of authorized client certificates. + items: + type: string + type: array type: object + x-kubernetes-validations: + - message: only one of credentialNames or tlsCertificates can + be set + rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) + ? 1 : 0) <= 1' + - message: only one of credentialName or credentialNames can + be set + rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) + ? 1 : 0) <= 1' + - message: only one of credentialName or tlsCertificates can + be set + rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) + ? 1 : 0) <= 1' + required: + - port + - hosts type: object - workloadSelector: - description: Criteria used to select the specific set of pods/VMs - on which this `DestinationRule` configuration should be applied. + type: array + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set - of pods/VMs on which a policy should be applied. - maxProperties: 4096 + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) type: object - required: - - host - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: istio + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/part-of: istio + app.kubernetes.io/version: 1.29.4 + helm.sh/chart: base-1.29.4 + name: peerauthentications.security.istio.io +spec: + group: security.istio.io + names: + categories: + - istio-io + - security-istio-io + kind: PeerAuthentication + listKind: PeerAuthenticationList + plural: peerauthentications + shortNames: + - pa + singular: peerauthentication + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: Defines the mTLS mode used for peer authentication. + jsonPath: .spec.mtls.mode + name: Mode + type: string + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Peer authentication configuration for workloads. See more + details at: https://istio.io/docs/reference/config/security/peer_authentication.html' + properties: + mtls: + description: Mutual TLS settings for workload. + properties: + mode: + description: |- + Defines the mTLS mode used for peer authentication. + + Valid Options: DISABLE, PERMISSIVE, STRICT + enum: + - UNSET + - DISABLE + - PERMISSIVE + - STRICT + type: string + type: object + portLevelMtls: + additionalProperties: + properties: + mode: + description: |- + Defines the mTLS mode used for peer authentication. + + Valid Options: DISABLE, PERMISSIVE, STRICT + enum: + - UNSET + - DISABLE + - PERMISSIVE + - STRICT + type: string + type: object + description: Port specific mutual TLS settings. + minProperties: 1 + type: object + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: self.all(key, 0 < int(key) && int(key) <= 65535) + selector: + description: The selector determines the workloads to apply the PeerAuthentication + on. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which a policy should be applied. + maxProperties: 4096 type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + type: object + x-kubernetes-validations: + - message: portLevelMtls requires selector + rule: 'has(self.portLevelMtls) ? (((has(self.selector) && has(self.selector.matchLabels)) + ? self.selector.matchLabels : {}).size() > 0) : true' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - description: Defines the mTLS mode used for peer authentication. + jsonPath: .spec.mtls.mode + name: Mode + type: string + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Peer authentication configuration for workloads. See more + details at: https://istio.io/docs/reference/config/security/peer_authentication.html' + properties: + mtls: + description: Mutual TLS settings for workload. + properties: + mode: + description: |- + Defines the mTLS mode used for peer authentication. + + Valid Options: DISABLE, PERMISSIVE, STRICT + enum: + - UNSET + - DISABLE + - PERMISSIVE + - STRICT + type: string + type: object + portLevelMtls: + additionalProperties: + properties: + mode: + description: |- + Defines the mTLS mode used for peer authentication. - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object + Valid Options: DISABLE, PERMISSIVE, STRICT + enum: + - UNSET + - DISABLE + - PERMISSIVE + - STRICT + type: string + type: object + description: Port specific mutual TLS settings. + minProperties: 1 + type: object + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: self.all(key, 0 < int(key) && int(key) <= 65535) + selector: + description: The selector determines the workloads to apply the PeerAuthentication + on. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which a policy should be applied. + maxProperties: 4096 type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + type: object + x-kubernetes-validations: + - message: portLevelMtls requires selector + rule: 'has(self.portLevelMtls) ? (((has(self.selector) && has(self.selector.matchLabels)) + ? self.selector.matchLabels : {}).size() > 0) : true' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -6935,459 +8468,147 @@ metadata: app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.29.4 helm.sh/chart: base-1.29.4 - name: envoyfilters.networking.istio.io + name: proxyconfigs.networking.istio.io spec: group: networking.istio.io names: categories: - - istio-io - - networking-istio-io - kind: EnvoyFilter - listKind: EnvoyFilterList - plural: envoyfilters - singular: envoyfilter + - istio-io + - networking-istio-io + kind: ProxyConfig + listKind: ProxyConfigList + plural: proxyconfigs + singular: proxyconfig scope: Namespaced versions: - - name: v1alpha3 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Customizing Envoy configuration generated by Istio. See - more details at: https://istio.io/docs/reference/config/networking/envoy-filter.html' - properties: - configPatches: - description: One or more patches with match conditions. - items: - properties: - applyTo: - description: 'Specifies where in the Envoy configuration, - the patch should be applied. - - - Valid Options: LISTENER, FILTER_CHAIN, NETWORK_FILTER, HTTP_FILTER, - ROUTE_CONFIGURATION, VIRTUAL_HOST, HTTP_ROUTE, CLUSTER, - EXTENSION_CONFIG, BOOTSTRAP, LISTENER_FILTER' - enum: - - INVALID - - LISTENER - - FILTER_CHAIN - - NETWORK_FILTER - - HTTP_FILTER - - ROUTE_CONFIGURATION - - VIRTUAL_HOST - - HTTP_ROUTE - - CLUSTER - - EXTENSION_CONFIG - - BOOTSTRAP - - LISTENER_FILTER - type: string - match: - description: Match on listener/route configuration/cluster. - oneOf: - - not: - anyOf: - - required: - - listener - - required: - - routeConfiguration - - required: - - cluster - - required: - - waypoint - - required: - - listener - - required: - - routeConfiguration - - required: - - cluster - - required: - - waypoint - properties: - cluster: - description: Match on envoy cluster attributes. - properties: - name: - description: The exact name of the cluster to match. - type: string - portNumber: - description: The service port for which this cluster - was generated. - maximum: 4294967295 - minimum: 0 - type: integer - service: - description: The fully qualified service name for - this cluster. - type: string - subset: - description: The subset associated with the service. - type: string - type: object - context: - description: 'The specific config generation context to - match on. - - - Valid Options: ANY, SIDECAR_INBOUND, SIDECAR_OUTBOUND, - GATEWAY, WAYPOINT' - enum: - - ANY - - SIDECAR_INBOUND - - SIDECAR_OUTBOUND - - GATEWAY - - WAYPOINT - type: string - listener: - description: Match on envoy listener attributes. - properties: - filterChain: - description: Match a specific filter chain in a listener. - properties: - applicationProtocols: - description: Applies only to sidecars. - type: string - destinationPort: - description: The destination_port value used by - a filter chain's match condition. - maximum: 4294967295 - minimum: 0 - type: integer - filter: - description: The name of a specific filter to - apply the patch to. - properties: - name: - description: The filter name to match on. - type: string - subFilter: - description: The next level filter within - this filter to match upon. - properties: - name: - description: The filter name to match - on. - type: string - type: object - type: object - name: - description: The name assigned to the filter chain. - type: string - sni: - description: The SNI value used by a filter chain's - match condition. - type: string - transportProtocol: - description: Applies only to `SIDECAR_INBOUND` - context. - type: string - type: object - listenerFilter: - description: Match a specific listener filter. - type: string - name: - description: Match a specific listener by its name. - type: string - portName: - type: string - portNumber: - description: The service port/gateway port to which - traffic is being sent/received. - maximum: 4294967295 - minimum: 0 - type: integer - type: object - proxy: - description: Match on properties associated with a proxy. - properties: - metadata: - additionalProperties: - type: string - description: Match on the node metadata supplied by - a proxy when connecting to istiod. - type: object - proxyVersion: - description: A regular expression in golang regex - format (RE2) that can be used to select proxies - using a specific version of istio proxy. - type: string - type: object - routeConfiguration: - description: Match on envoy HTTP route configuration attributes. - properties: - gateway: - description: The Istio gateway config's namespace/name - for which this route configuration was generated. - type: string - name: - description: Route configuration name to match on. - type: string - portName: - description: Applicable only for GATEWAY context. - type: string - portNumber: - description: The service port number or gateway server - port number for which this route configuration was - generated. - maximum: 4294967295 - minimum: 0 - type: integer - vhost: - description: Match a specific virtual host in a route - configuration and apply the patch to the virtual - host. - properties: - domainName: - description: Match a domain name in a virtual - host. - type: string - name: - description: The VirtualHosts objects generated - by Istio are named as host:port, where the host - typically corresponds to the VirtualService's - host field or the hostname of a service in the - registry. - type: string - route: - description: Match a specific route within the - virtual host. - properties: - action: - description: 'Match a route with specific - action type. - - - Valid Options: ANY, ROUTE, REDIRECT, DIRECT_RESPONSE' - enum: - - ANY - - ROUTE - - REDIRECT - - DIRECT_RESPONSE - type: string - name: - description: The Route objects generated by - default are named as default. - type: string - type: object - type: object - type: object - waypoint: - properties: - filter: - description: The name of a specific filter to apply - the patch to. - properties: - name: - description: The filter name to match on. - type: string - subFilter: - description: The next level filter within this - filter to match on. - properties: - name: - description: The filter name to match on. - type: string - type: object - type: object - portNumber: - description: The service port to match on. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - route: - description: Match a specific route. - properties: - name: - description: The Route objects generated by default - are named as default. - type: string - type: object - type: object - type: object - x-kubernetes-validations: - - message: only support waypointMatch when context is WAYPOINT - rule: 'has(self.context) ? ((self.context == "WAYPOINT") - ? has(self.waypoint) : !has(self.waypoint)) : !has(self.waypoint)' - patch: - description: The patch to apply along with the operation. - properties: - filterClass: - description: 'Determines the filter insertion order. - - - Valid Options: AUTHN, AUTHZ, STATS' - enum: - - UNSPECIFIED - - AUTHN - - AUTHZ - - STATS - type: string - operation: - description: 'Determines how the patch should be applied. - - - Valid Options: MERGE, ADD, REMOVE, INSERT_BEFORE, INSERT_AFTER, - INSERT_FIRST, REPLACE' - enum: - - INVALID - - MERGE - - ADD - - REMOVE - - INSERT_BEFORE - - INSERT_AFTER - - INSERT_FIRST - - REPLACE - type: string - value: - description: The JSON config of the object being patched. - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - type: object - type: array - priority: - description: Priority defines the order in which patch sets are - applied within a context. - format: int32 - type: integer - targetRefs: - description: Optional. - items: - properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: name is the name of the target resource. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: namespace is the namespace of the referent. - type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently - supported - rule: self.size() == 0 - required: - - kind - - name + - name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Provides configuration for individual workloads. See more + details at: https://istio.io/docs/reference/config/networking/proxy-config.html' + properties: + concurrency: + description: The number of worker threads to run. + format: int32 + minimum: 0 + nullable: true + type: integer + environmentVariables: + additionalProperties: + maxLength: 2048 + type: string + description: Additional environment variables for the proxy. + type: object + image: + description: Specifies the details of the proxy image. + properties: + imageType: + description: The image type of the image. + type: string + type: object + selector: + description: Optional. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which a policy should be applied. + maxProperties: 4096 type: object - maxItems: 16 - type: array - workloadSelector: - description: Criteria used to select the specific set of pods/VMs - on which this patch configuration should be applied. + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: properties: - labels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard is not supported in selector - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set - of pods/VMs on which the configuration should be applied. - maxProperties: 256 - type: object + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string type: object - type: object - x-kubernetes-validations: - - message: only one of targetRefs or workloadSelector can be set - rule: '(has(self.workloadSelector) ? 1 : 0) + (has(self.targetRefs) - ? 1 : 0) <= 1' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. - + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -7400,861 +8621,599 @@ metadata: app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.29.4 helm.sh/chart: base-1.29.4 - name: gateways.networking.istio.io + name: requestauthentications.security.istio.io spec: - group: networking.istio.io + group: security.istio.io names: categories: - - istio-io - - networking-istio-io - kind: Gateway - listKind: GatewayList - plural: gateways + - istio-io + - security-istio-io + kind: RequestAuthentication + listKind: RequestAuthenticationList + plural: requestauthentications shortNames: - - gw - singular: gateway + - ra + singular: requestauthentication scope: Namespaced versions: - - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting edge load balancer. See more details - at: https://istio.io/docs/reference/config/networking/gateway.html' - properties: - selector: - additionalProperties: - type: string - description: One or more labels that indicate a specific set of - pods/VMs on which this gateway configuration should be applied. - type: object - servers: - description: A list of server specifications. - items: - properties: - bind: - description: The ip or the Unix domain socket to which the - listener should be bound to. - type: string - defaultEndpoint: + - name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Request authentication configuration for workloads. See + more details at: https://istio.io/docs/reference/config/security/request_authentication.html' + properties: + jwtRules: + description: Define the list of JWTs that can be validated at the + selected workloads' proxy. + items: + properties: + audiences: + description: The list of JWT [audiences](https://tools.ietf.org/html/rfc7519#section-4.1.3) + that are allowed to access. + items: + minLength: 1 type: string - hosts: - description: One or more hosts exposed by this gateway. - items: - type: string - type: array - name: - description: An optional name of the server, when set must - be unique across all servers. + type: array + forwardOriginalToken: + description: If set to true, the original token will be kept + for the upstream request. + type: boolean + fromCookies: + description: List of cookie names from which JWT is expected. + items: + minLength: 1 type: string - port: - description: The Port on which the proxy should listen for - incoming connections. + type: array + fromHeaders: + description: List of header locations from which JWT is expected. + items: properties: name: - description: Label assigned to the port. + description: The HTTP header name. + minLength: 1 type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - protocol: - description: The protocol exposed on the port. + prefix: + description: The prefix that should be stripped before + decoding the token. type: string - targetPort: - maximum: 4294967295 - minimum: 0 - type: integer required: - - number - - protocol - - name + - name type: object - tls: - description: Set of TLS related options that govern the server's - behavior. + type: array + fromParams: + description: List of query parameters from which JWT is expected. + items: + minLength: 1 + type: string + type: array + issuer: + description: Identifies the issuer that issued the JWT. + minLength: 1 + type: string + jwks: + description: JSON Web Key Set of public keys to validate signature + of the JWT. + type: string + jwksUri: + description: URL of the provider's public key set to validate + signature of the JWT. + maxLength: 2048 + minLength: 1 + type: string + x-kubernetes-validations: + - message: url must have scheme http:// or https:// + rule: url(self).getScheme() in ["http", "https"] + jwks_uri: + description: URL of the provider's public key set to validate + signature of the JWT. + maxLength: 2048 + minLength: 1 + type: string + x-kubernetes-validations: + - message: url must have scheme http:// or https:// + rule: url(self).getScheme() in ["http", "https"] + outputClaimToHeaders: + description: This field specifies a list of operations to copy + the claim to HTTP headers on a successfully verified token. + items: properties: - caCertCredentialName: - description: For mutual TLS, the name of the secret or - the configmap that holds CA certificates. - type: string - caCertificates: - description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing - the certificate revocation list (CRL) to use in verifying - a presented client side certificate.' - type: string - cipherSuites: - description: 'Optional: If specified, only support the - specified cipher list.' - items: - type: string - type: array - credentialName: - description: For gateways running on Kubernetes, the name - of the secret that holds the TLS certs including the - CA certificates. - type: string - credentialNames: - description: Same as CredentialName but for multiple certificates. - items: - type: string - maxItems: 2 - minItems: 1 - type: array - httpsRedirect: - description: If set to true, the load balancer will send - a 301 redirect for all http connections, asking the - clients to use HTTPS. - type: boolean - maxProtocolVersion: - description: 'Optional: Maximum TLS protocol version. - - - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, - TLSV1_3' - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - minProtocolVersion: - description: 'Optional: Minimum TLS protocol version. - - - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, - TLSV1_3' - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - mode: - description: 'Optional: Indicates whether connections - to this port should be secured using TLS. - - - Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, - ISTIO_MUTUAL, OPTIONAL_MUTUAL' - enum: - - PASSTHROUGH - - SIMPLE - - MUTUAL - - AUTO_PASSTHROUGH - - ISTIO_MUTUAL - - OPTIONAL_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + claim: + description: The name of the claim to be copied from. + minLength: 1 type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + header: + description: The name of the header to be created. + minLength: 1 + pattern: ^[-_A-Za-z0-9]+$ type: string - subjectAltNames: - description: A list of alternate names to verify the subject - identity in the certificate presented by the client. - items: - type: string - type: array - tlsCertificates: - description: Only one of `server_certificate`, `private_key` - or `credential_name` or `credential_names` or `tls_certificates` - should be specified. - items: - properties: - caCertificates: - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - type: object - maxItems: 2 - minItems: 1 - type: array - verifyCertificateHash: - description: An optional list of hex-encoded SHA-256 hashes - of the authorized client certificates. - items: - type: string - type: array - verifyCertificateSpki: - description: An optional list of base64-encoded SHA-256 - hashes of the SPKIs of authorized client certificates. - items: - type: string - type: array + required: + - header + - claim type: object - x-kubernetes-validations: - - message: only one of credentialNames or tlsCertificates - can be set - rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) - ? 1 : 0) <= 1' - - message: only one of credentialName or credentialNames - can be set - rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) - ? 1 : 0) <= 1' - - message: only one of credentialName or tlsCertificates - can be set - rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) - ? 1 : 0) <= 1' - required: - - port - - hosts - type: object - type: array - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. - - - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO + type: array + outputPayloadToHeader: + description: This field specifies the header name to output + a successfully verified JWT payload to the backend. + type: string + spaceDelimitedClaims: + description: List of JWT claim names that should be treated + as space-delimited strings. + items: + minLength: 1 type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object + maxItems: 64 + type: array + timeout: + description: The maximum amount of time that the resolver, determined + by the PILOT_JWT_ENABLE_REMOTE_JWKS environment variable, + will spend waiting for the JWKS to be fetched. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + x-kubernetes-validations: + - message: only one of jwks or jwksUri can be set + rule: '(has(self.jwksUri) ? 1 : 0) + (has(self.jwks_uri) ? 1 : + 0) + (has(self.jwks) ? 1 : 0) <= 1' + maxItems: 4096 + type: array + selector: + description: Optional. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which a policy should be applied. + maxProperties: 4096 type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} - - name: v1alpha3 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting edge load balancer. See more details - at: https://istio.io/docs/reference/config/networking/gateway.html' - properties: - selector: - additionalProperties: + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + targetRef: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 type: string - description: One or more labels that indicate a specific set of - pods/VMs on which this gateway configuration should be applied. + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name + type: object + targetRefs: + description: Optional. + items: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name type: object - servers: - description: A list of server specifications. - items: - properties: - bind: - description: The ip or the Unix domain socket to which the - listener should be bound to. - type: string - defaultEndpoint: - type: string - hosts: - description: One or more hosts exposed by this gateway. - items: + maxItems: 16 + type: array + type: object + x-kubernetes-validations: + - message: only one of targetRefs or selector can be set + rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + + (has(self.targetRefs) ? 1 : 0) <= 1' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. type: string - type: array - name: - description: An optional name of the server, when set must - be unique across all servers. + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} + - name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Request authentication configuration for workloads. See + more details at: https://istio.io/docs/reference/config/security/request_authentication.html' + properties: + jwtRules: + description: Define the list of JWTs that can be validated at the + selected workloads' proxy. + items: + properties: + audiences: + description: The list of JWT [audiences](https://tools.ietf.org/html/rfc7519#section-4.1.3) + that are allowed to access. + items: + minLength: 1 type: string - port: - description: The Port on which the proxy should listen for - incoming connections. + type: array + forwardOriginalToken: + description: If set to true, the original token will be kept + for the upstream request. + type: boolean + fromCookies: + description: List of cookie names from which JWT is expected. + items: + minLength: 1 + type: string + type: array + fromHeaders: + description: List of header locations from which JWT is expected. + items: properties: name: - description: Label assigned to the port. + description: The HTTP header name. + minLength: 1 type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - protocol: - description: The protocol exposed on the port. + prefix: + description: The prefix that should be stripped before + decoding the token. type: string - targetPort: - maximum: 4294967295 - minimum: 0 - type: integer required: - - number - - protocol - - name - type: object - tls: - description: Set of TLS related options that govern the server's - behavior. - properties: - caCertCredentialName: - description: For mutual TLS, the name of the secret or - the configmap that holds CA certificates. - type: string - caCertificates: - description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing - the certificate revocation list (CRL) to use in verifying - a presented client side certificate.' - type: string - cipherSuites: - description: 'Optional: If specified, only support the - specified cipher list.' - items: - type: string - type: array - credentialName: - description: For gateways running on Kubernetes, the name - of the secret that holds the TLS certs including the - CA certificates. - type: string - credentialNames: - description: Same as CredentialName but for multiple certificates. - items: - type: string - maxItems: 2 - minItems: 1 - type: array - httpsRedirect: - description: If set to true, the load balancer will send - a 301 redirect for all http connections, asking the - clients to use HTTPS. - type: boolean - maxProtocolVersion: - description: 'Optional: Maximum TLS protocol version. - - - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, - TLSV1_3' - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - minProtocolVersion: - description: 'Optional: Minimum TLS protocol version. - - - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, - TLSV1_3' - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - mode: - description: 'Optional: Indicates whether connections - to this port should be secured using TLS. - - - Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, - ISTIO_MUTUAL, OPTIONAL_MUTUAL' - enum: - - PASSTHROUGH - - SIMPLE - - MUTUAL - - AUTO_PASSTHROUGH - - ISTIO_MUTUAL - - OPTIONAL_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - subjectAltNames: - description: A list of alternate names to verify the subject - identity in the certificate presented by the client. - items: - type: string - type: array - tlsCertificates: - description: Only one of `server_certificate`, `private_key` - or `credential_name` or `credential_names` or `tls_certificates` - should be specified. - items: - properties: - caCertificates: - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - type: object - maxItems: 2 - minItems: 1 - type: array - verifyCertificateHash: - description: An optional list of hex-encoded SHA-256 hashes - of the authorized client certificates. - items: - type: string - type: array - verifyCertificateSpki: - description: An optional list of base64-encoded SHA-256 - hashes of the SPKIs of authorized client certificates. - items: - type: string - type: array + - name type: object - x-kubernetes-validations: - - message: only one of credentialNames or tlsCertificates - can be set - rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) - ? 1 : 0) <= 1' - - message: only one of credentialName or credentialNames - can be set - rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) - ? 1 : 0) <= 1' - - message: only one of credentialName or tlsCertificates - can be set - rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) - ? 1 : 0) <= 1' - required: - - port - - hosts - type: object - type: array - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. - - - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO + type: array + fromParams: + description: List of query parameters from which JWT is expected. + items: + minLength: 1 type: string - type: + type: array + issuer: + description: Identifies the issuer that issued the JWT. + minLength: 1 + type: string + jwks: + description: JSON Web Key Set of public keys to validate signature + of the JWT. + type: string + jwksUri: + description: URL of the provider's public key set to validate + signature of the JWT. + maxLength: 2048 + minLength: 1 + type: string + x-kubernetes-validations: + - message: url must have scheme http:// or https:// + rule: url(self).getScheme() in ["http", "https"] + jwks_uri: + description: URL of the provider's public key set to validate + signature of the JWT. + maxLength: 2048 + minLength: 1 + type: string + x-kubernetes-validations: + - message: url must have scheme http:// or https:// + rule: url(self).getScheme() in ["http", "https"] + outputClaimToHeaders: + description: This field specifies a list of operations to copy + the claim to HTTP headers on a successfully verified token. + items: properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. + claim: + description: The name of the claim to be copied from. + minLength: 1 type: string - name: - description: A human-readable name for the message type. + header: + description: The name of the header to be created. + minLength: 1 + pattern: ^[-_A-Za-z0-9]+$ type: string + required: + - header + - claim type: object + type: array + outputPayloadToHeader: + description: This field specifies the header name to output + a successfully verified JWT payload to the backend. + type: string + spaceDelimitedClaims: + description: List of JWT claim names that should be treated + as space-delimited strings. + items: + minLength: 1 + type: string + maxItems: 64 + type: array + timeout: + description: The maximum amount of time that the resolver, determined + by the PILOT_JWT_ENABLE_REMOTE_JWKS environment variable, + will spend waiting for the JWKS to be fetched. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + x-kubernetes-validations: + - message: only one of jwks or jwksUri can be set + rule: '(has(self.jwksUri) ? 1 : 0) + (has(self.jwks_uri) ? 1 : + 0) + (has(self.jwks) ? 1 : 0) <= 1' + maxItems: 4096 + type: array + selector: + description: Optional. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which a policy should be applied. + maxProperties: 4096 type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} - - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting edge load balancer. See more details - at: https://istio.io/docs/reference/config/networking/gateway.html' - properties: - selector: - additionalProperties: + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + targetRef: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string - description: One or more labels that indicate a specific set of - pods/VMs on which this gateway configuration should be applied. + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name + type: object + targetRefs: + description: Optional. + items: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name type: object - servers: - description: A list of server specifications. - items: - properties: - bind: - description: The ip or the Unix domain socket to which the - listener should be bound to. - type: string - defaultEndpoint: - type: string - hosts: - description: One or more hosts exposed by this gateway. - items: + maxItems: 16 + type: array + type: object + x-kubernetes-validations: + - message: only one of targetRefs or selector can be set + rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + + (has(self.targetRefs) ? 1 : 0) <= 1' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. type: string - type: array - name: - description: An optional name of the server, when set must - be unique across all servers. - type: string - port: - description: The Port on which the proxy should listen for - incoming connections. - properties: - name: - description: Label assigned to the port. - type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - protocol: - description: The protocol exposed on the port. - type: string - targetPort: - maximum: 4294967295 - minimum: 0 - type: integer - required: - - number - - protocol - - name - type: object - tls: - description: Set of TLS related options that govern the server's - behavior. - properties: - caCertCredentialName: - description: For mutual TLS, the name of the secret or - the configmap that holds CA certificates. - type: string - caCertificates: - description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing - the certificate revocation list (CRL) to use in verifying - a presented client side certificate.' - type: string - cipherSuites: - description: 'Optional: If specified, only support the - specified cipher list.' - items: - type: string - type: array - credentialName: - description: For gateways running on Kubernetes, the name - of the secret that holds the TLS certs including the - CA certificates. - type: string - credentialNames: - description: Same as CredentialName but for multiple certificates. - items: - type: string - maxItems: 2 - minItems: 1 - type: array - httpsRedirect: - description: If set to true, the load balancer will send - a 301 redirect for all http connections, asking the - clients to use HTTPS. - type: boolean - maxProtocolVersion: - description: 'Optional: Maximum TLS protocol version. - - - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, - TLSV1_3' - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - minProtocolVersion: - description: 'Optional: Minimum TLS protocol version. - - - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, - TLSV1_3' - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - mode: - description: 'Optional: Indicates whether connections - to this port should be secured using TLS. - - - Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, - ISTIO_MUTUAL, OPTIONAL_MUTUAL' - enum: - - PASSTHROUGH - - SIMPLE - - MUTUAL - - AUTO_PASSTHROUGH - - ISTIO_MUTUAL - - OPTIONAL_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - subjectAltNames: - description: A list of alternate names to verify the subject - identity in the certificate presented by the client. - items: - type: string - type: array - tlsCertificates: - description: Only one of `server_certificate`, `private_key` - or `credential_name` or `credential_names` or `tls_certificates` - should be specified. - items: - properties: - caCertificates: - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - type: object - maxItems: 2 - minItems: 1 - type: array - verifyCertificateHash: - description: An optional list of hex-encoded SHA-256 hashes - of the authorized client certificates. - items: - type: string - type: array - verifyCertificateSpki: - description: An optional list of base64-encoded SHA-256 - hashes of the SPKIs of authorized client certificates. - items: - type: string - type: array - type: object - x-kubernetes-validations: - - message: only one of credentialNames or tlsCertificates - can be set - rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) - ? 1 : 0) <= 1' - - message: only one of credentialName or credentialNames - can be set - rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) - ? 1 : 0) <= 1' - - message: only one of credentialName or tlsCertificates - can be set - rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) - ? 1 : 0) <= 1' - required: - - port - - hosts - type: object - type: array - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. - - - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -8267,503 +9226,918 @@ metadata: app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.29.4 helm.sh/chart: base-1.29.4 - name: peerauthentications.security.istio.io + name: serviceentries.networking.istio.io spec: - group: security.istio.io + group: networking.istio.io names: categories: - - istio-io - - security-istio-io - kind: PeerAuthentication - listKind: PeerAuthenticationList - plural: peerauthentications + - istio-io + - networking-istio-io + kind: ServiceEntry + listKind: ServiceEntryList + plural: serviceentries shortNames: - - pa - singular: peerauthentication + - se + singular: serviceentry scope: Namespaced versions: - - additionalPrinterColumns: - - description: Defines the mTLS mode used for peer authentication. - jsonPath: .spec.mtls.mode - name: Mode - type: string - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is - represented in RFC3339 form and is in UTC. Populated by the system. Read-only. - Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Peer authentication configuration for workloads. See more - details at: https://istio.io/docs/reference/config/security/peer_authentication.html' - properties: - mtls: - description: Mutual TLS settings for workload. + - additionalPrinterColumns: + - description: The hosts associated with the ServiceEntry + jsonPath: .spec.hosts + name: Hosts + type: string + - description: Whether the service is external to the mesh or part of the mesh + (MESH_EXTERNAL or MESH_INTERNAL) + jsonPath: .spec.location + name: Location + type: string + - description: Service resolution mode for the hosts (NONE, STATIC, or DNS) + jsonPath: .spec.resolution + name: Resolution + type: string + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting service registry. See more details + at: https://istio.io/docs/reference/config/networking/service-entry.html' + properties: + addresses: + description: The virtual IP addresses associated with the service. + items: + maxLength: 64 + type: string + maxItems: 256 + type: array + endpoints: + description: One or more endpoints associated with the service. + items: properties: - mode: - description: 'Defines the mTLS mode used for peer authentication. - - - Valid Options: DISABLE, PERMISSIVE, STRICT' - enum: - - UNSET - - DISABLE - - PERMISSIVE - - STRICT + address: + description: Address associated with the network endpoint without + the port. + maxLength: 256 type: string - type: object - portLevelMtls: - additionalProperties: - properties: - mode: - description: 'Defines the mTLS mode used for peer authentication. - - - Valid Options: DISABLE, PERMISSIVE, STRICT' - enum: - - UNSET - - DISABLE - - PERMISSIVE - - STRICT - type: string - type: object - description: Port specific mutual TLS settings. - minProperties: 1 - type: object - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: self.all(key, 0 < int(key) && int(key) <= 65535) - selector: - description: The selector determines the workloads to apply the - PeerAuthentication on. - properties: - matchLabels: + x-kubernetes-validations: + - message: UDS must be an absolute path or abstract socket + rule: 'self.startsWith("unix://") ? (self.substring(7, 8) + == "/" || self.substring(7, 8) == "@") : true' + - message: UDS may not be a dir + rule: 'self.startsWith("unix://") ? !self.endsWith("/") : + true' + labels: additionalProperties: - maxLength: 63 type: string + description: One or more labels associated with the endpoint. + maxProperties: 256 + type: object + locality: + description: The locality associated with the endpoint. + maxLength: 2048 + type: string + network: + description: Network enables Istio to group endpoints resident + in the same L3 domain/network. + maxLength: 2048 + type: string + ports: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set - of pods/VMs on which a policy should be applied. - maxProperties: 4096 + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + description: Set of ports associated with the endpoint. + maxProperties: 128 type: object x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) + - message: port name must be valid + rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) + serviceAccount: + description: The service account associated with the workload + if a sidecar is present in the workload. + maxLength: 253 + type: string + weight: + description: The load balancing weight associated with the endpoint. + maximum: 4294967295 + minimum: 0 + type: integer type: object - type: object - x-kubernetes-validations: - - message: portLevelMtls requires selector - rule: 'has(self.portLevelMtls) ? (((has(self.selector) && has(self.selector.matchLabels)) - ? self.selector.matchLabels : {}).size() > 0) : true' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. - - - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object + x-kubernetes-validations: + - message: Address is required + rule: has(self.address) || has(self.network) + - message: UDS may not include ports + rule: '(has(self.address) ? self.address : "").startsWith("unix://") + ? !has(self.ports) : true' + maxItems: 4096 + type: array + exportTo: + description: A list of namespaces to which this service is exported. + items: + type: string + type: array + hosts: + description: The hosts associated with the ServiceEntry. + items: + type: string + x-kubernetes-validations: + - message: hostname cannot be wildcard + rule: self != "*" + maxItems: 256 + minItems: 1 + type: array + location: + description: |- + Specify whether the service should be considered external to the mesh or part of the mesh. + + Valid Options: MESH_EXTERNAL, MESH_INTERNAL + enum: + - MESH_EXTERNAL + - MESH_INTERNAL + type: string + ports: + description: The ports associated with the external service. + items: + properties: + name: + description: Label assigned to the port. + maxLength: 256 + type: string + number: + description: A valid non-negative integer port number. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + protocol: + description: The protocol exposed on the port. + maxLength: 256 + type: string + targetPort: + description: The port number on the endpoint where the traffic + will be received. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + required: + - number + - name + type: object + maxItems: 256 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + x-kubernetes-validations: + - message: port number cannot be duplicated + rule: self.all(l1, self.exists_one(l2, l1.number == l2.number)) + resolution: + description: |- + Service resolution mode for the hosts. + + Valid Options: NONE, STATIC, DNS, DNS_ROUND_ROBIN, DYNAMIC_DNS + enum: + - NONE + - STATIC + - DNS + - DNS_ROUND_ROBIN + - DYNAMIC_DNS + type: string + subjectAltNames: + description: If specified, the proxy will verify that the server certificate's + subject alternate name matches one of the specified values. + items: + type: string + type: array + workloadSelector: + description: Applicable only for MESH_INTERNAL services. + properties: + labels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard is not supported in selector + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which the configuration should be applied. + maxProperties: 256 type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} - - additionalPrinterColumns: - - description: Defines the mTLS mode used for peer authentication. - jsonPath: .spec.mtls.mode - name: Mode - type: string - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is - represented in RFC3339 form and is in UTC. Populated by the system. Read-only. - Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Peer authentication configuration for workloads. See more - details at: https://istio.io/docs/reference/config/security/peer_authentication.html' - properties: - mtls: - description: Mutual TLS settings for workload. + type: object + required: + - hosts + type: object + x-kubernetes-validations: + - message: only one of WorkloadSelector or Endpoints can be set + rule: '(has(self.workloadSelector) ? 1 : 0) + (has(self.endpoints) ? + 1 : 0) <= 1' + - message: CIDR addresses are allowed only for NONE/STATIC resolution + types + rule: '!((has(self.addresses) ? self.addresses : []).exists(k, k.contains("/")) + && !((has(self.resolution) ? self.resolution : "NONE") in ["STATIC", + "NONE"]))' + - message: NONE mode cannot set endpoints + rule: '((has(self.resolution) ? self.resolution : "NONE") == "NONE") + ? !has(self.endpoints) : true' + - message: DNS_ROUND_ROBIN mode cannot have multiple endpoints + rule: '((has(self.resolution) ? self.resolution : "") == "DNS_ROUND_ROBIN") + ? ((has(self.endpoints) ? self.endpoints : []).size() <= 1) : true' + status: + properties: + conditions: + description: Current service state of the resource. + items: properties: - mode: - description: 'Defines the mTLS mode used for peer authentication. - - - Valid Options: DISABLE, PERMISSIVE, STRICT' - enum: - - UNSET - - DISABLE - - PERMISSIVE - - STRICT + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. type: string type: object - portLevelMtls: - additionalProperties: - properties: - mode: - description: 'Defines the mTLS mode used for peer authentication. - + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. - Valid Options: DISABLE, PERMISSIVE, STRICT' - enum: - - UNSET - - DISABLE - - PERMISSIVE - - STRICT - type: string - type: object - description: Port specific mutual TLS settings. - minProperties: 1 + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object type: object - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: self.all(key, 0 < int(key) && int(key) <= 65535) - selector: - description: The selector determines the workloads to apply the - PeerAuthentication on. + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - description: The hosts associated with the ServiceEntry + jsonPath: .spec.hosts + name: Hosts + type: string + - description: Whether the service is external to the mesh or part of the mesh + (MESH_EXTERNAL or MESH_INTERNAL) + jsonPath: .spec.location + name: Location + type: string + - description: Service resolution mode for the hosts (NONE, STATIC, or DNS) + jsonPath: .spec.resolution + name: Resolution + type: string + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha3 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting service registry. See more details + at: https://istio.io/docs/reference/config/networking/service-entry.html' + properties: + addresses: + description: The virtual IP addresses associated with the service. + items: + maxLength: 64 + type: string + maxItems: 256 + type: array + endpoints: + description: One or more endpoints associated with the service. + items: properties: - matchLabels: + address: + description: Address associated with the network endpoint without + the port. + maxLength: 256 + type: string + x-kubernetes-validations: + - message: UDS must be an absolute path or abstract socket + rule: 'self.startsWith("unix://") ? (self.substring(7, 8) + == "/" || self.substring(7, 8) == "@") : true' + - message: UDS may not be a dir + rule: 'self.startsWith("unix://") ? !self.endsWith("/") : + true' + labels: additionalProperties: - maxLength: 63 type: string + description: One or more labels associated with the endpoint. + maxProperties: 256 + type: object + locality: + description: The locality associated with the endpoint. + maxLength: 2048 + type: string + network: + description: Network enables Istio to group endpoints resident + in the same L3 domain/network. + maxLength: 2048 + type: string + ports: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set - of pods/VMs on which a policy should be applied. - maxProperties: 4096 + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + description: Set of ports associated with the endpoint. + maxProperties: 128 type: object x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) + - message: port name must be valid + rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) + serviceAccount: + description: The service account associated with the workload + if a sidecar is present in the workload. + maxLength: 253 + type: string + weight: + description: The load balancing weight associated with the endpoint. + maximum: 4294967295 + minimum: 0 + type: integer type: object - type: object - x-kubernetes-validations: - - message: portLevelMtls requires selector - rule: 'has(self.portLevelMtls) ? (((has(self.selector) && has(self.selector.matchLabels)) - ? self.selector.matchLabels : {}).size() > 0) : true' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. - - - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object + x-kubernetes-validations: + - message: Address is required + rule: has(self.address) || has(self.network) + - message: UDS may not include ports + rule: '(has(self.address) ? self.address : "").startsWith("unix://") + ? !has(self.ports) : true' + maxItems: 4096 + type: array + exportTo: + description: A list of namespaces to which this service is exported. + items: + type: string + type: array + hosts: + description: The hosts associated with the ServiceEntry. + items: + type: string + x-kubernetes-validations: + - message: hostname cannot be wildcard + rule: self != "*" + maxItems: 256 + minItems: 1 + type: array + location: + description: |- + Specify whether the service should be considered external to the mesh or part of the mesh. + + Valid Options: MESH_EXTERNAL, MESH_INTERNAL + enum: + - MESH_EXTERNAL + - MESH_INTERNAL + type: string + ports: + description: The ports associated with the external service. + items: + properties: + name: + description: Label assigned to the port. + maxLength: 256 + type: string + number: + description: A valid non-negative integer port number. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + protocol: + description: The protocol exposed on the port. + maxLength: 256 + type: string + targetPort: + description: The port number on the endpoint where the traffic + will be received. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + required: + - number + - name + type: object + maxItems: 256 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + x-kubernetes-validations: + - message: port number cannot be duplicated + rule: self.all(l1, self.exists_one(l2, l1.number == l2.number)) + resolution: + description: |- + Service resolution mode for the hosts. + + Valid Options: NONE, STATIC, DNS, DNS_ROUND_ROBIN, DYNAMIC_DNS + enum: + - NONE + - STATIC + - DNS + - DNS_ROUND_ROBIN + - DYNAMIC_DNS + type: string + subjectAltNames: + description: If specified, the proxy will verify that the server certificate's + subject alternate name matches one of the specified values. + items: + type: string + type: array + workloadSelector: + description: Applicable only for MESH_INTERNAL services. + properties: + labels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard is not supported in selector + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which the configuration should be applied. + maxProperties: 256 type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - helm.sh/resource-policy: keep - labels: - app.kubernetes.io/instance: istio - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.4 - helm.sh/chart: base-1.29.4 - name: proxyconfigs.networking.istio.io -spec: - group: networking.istio.io - names: - categories: - - istio-io - - networking-istio-io - kind: ProxyConfig - listKind: ProxyConfigList - plural: proxyconfigs - singular: proxyconfig - scope: Namespaced - versions: - - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Provides configuration for individual workloads. See more - details at: https://istio.io/docs/reference/config/networking/proxy-config.html' - properties: - concurrency: - description: The number of worker threads to run. - format: int32 - minimum: 0 - nullable: true - type: integer - environmentVariables: - additionalProperties: - maxLength: 2048 - type: string - description: Additional environment variables for the proxy. + type: object + required: + - hosts + type: object + x-kubernetes-validations: + - message: only one of WorkloadSelector or Endpoints can be set + rule: '(has(self.workloadSelector) ? 1 : 0) + (has(self.endpoints) ? + 1 : 0) <= 1' + - message: CIDR addresses are allowed only for NONE/STATIC resolution + types + rule: '!((has(self.addresses) ? self.addresses : []).exists(k, k.contains("/")) + && !((has(self.resolution) ? self.resolution : "NONE") in ["STATIC", + "NONE"]))' + - message: NONE mode cannot set endpoints + rule: '((has(self.resolution) ? self.resolution : "NONE") == "NONE") + ? !has(self.endpoints) : true' + - message: DNS_ROUND_ROBIN mode cannot have multiple endpoints + rule: '((has(self.resolution) ? self.resolution : "") == "DNS_ROUND_ROBIN") + ? ((has(self.endpoints) ? self.endpoints : []).size() <= 1) : true' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string type: object - image: - description: Specifies the details of the proxy image. + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: properties: - imageType: - description: The image type of the image. + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object type: object - selector: - description: Optional. + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - description: The hosts associated with the ServiceEntry + jsonPath: .spec.hosts + name: Hosts + type: string + - description: Whether the service is external to the mesh or part of the mesh + (MESH_EXTERNAL or MESH_INTERNAL) + jsonPath: .spec.location + name: Location + type: string + - description: Service resolution mode for the hosts (NONE, STATIC, or DNS) + jsonPath: .spec.resolution + name: Resolution + type: string + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting service registry. See more details + at: https://istio.io/docs/reference/config/networking/service-entry.html' + properties: + addresses: + description: The virtual IP addresses associated with the service. + items: + maxLength: 64 + type: string + maxItems: 256 + type: array + endpoints: + description: One or more endpoints associated with the service. + items: properties: - matchLabels: + address: + description: Address associated with the network endpoint without + the port. + maxLength: 256 + type: string + x-kubernetes-validations: + - message: UDS must be an absolute path or abstract socket + rule: 'self.startsWith("unix://") ? (self.substring(7, 8) + == "/" || self.substring(7, 8) == "@") : true' + - message: UDS may not be a dir + rule: 'self.startsWith("unix://") ? !self.endsWith("/") : + true' + labels: additionalProperties: - maxLength: 63 type: string + description: One or more labels associated with the endpoint. + maxProperties: 256 + type: object + locality: + description: The locality associated with the endpoint. + maxLength: 2048 + type: string + network: + description: Network enables Istio to group endpoints resident + in the same L3 domain/network. + maxLength: 2048 + type: string + ports: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set - of pods/VMs on which a policy should be applied. - maxProperties: 4096 + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + description: Set of ports associated with the endpoint. + maxProperties: 128 type: object x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) + - message: port name must be valid + rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) + serviceAccount: + description: The service account associated with the workload + if a sidecar is present in the workload. + maxLength: 253 + type: string + weight: + description: The load balancing weight associated with the endpoint. + maximum: 4294967295 + minimum: 0 + type: integer type: object - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string + x-kubernetes-validations: + - message: Address is required + rule: has(self.address) || has(self.network) + - message: UDS may not include ports + rule: '(has(self.address) ? self.address : "").startsWith("unix://") + ? !has(self.ports) : true' + maxItems: 4096 + type: array + exportTo: + description: A list of namespaces to which this service is exported. + items: + type: string + type: array + hosts: + description: The hosts associated with the ServiceEntry. + items: + type: string + x-kubernetes-validations: + - message: hostname cannot be wildcard + rule: self != "*" + maxItems: 256 + minItems: 1 + type: array + location: + description: |- + Specify whether the service should be considered external to the mesh or part of the mesh. + + Valid Options: MESH_EXTERNAL, MESH_INTERNAL + enum: + - MESH_EXTERNAL + - MESH_INTERNAL + type: string + ports: + description: The ports associated with the external service. + items: + properties: + name: + description: Label assigned to the port. + maxLength: 256 + type: string + number: + description: A valid non-negative integer port number. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + protocol: + description: The protocol exposed on the port. + maxLength: 256 + type: string + targetPort: + description: The port number on the endpoint where the traffic + will be received. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + required: + - number + - name + type: object + maxItems: 256 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + x-kubernetes-validations: + - message: port number cannot be duplicated + rule: self.all(l1, self.exists_one(l2, l1.number == l2.number)) + resolution: + description: |- + Service resolution mode for the hosts. + + Valid Options: NONE, STATIC, DNS, DNS_ROUND_ROBIN, DYNAMIC_DNS + enum: + - NONE + - STATIC + - DNS + - DNS_ROUND_ROBIN + - DYNAMIC_DNS + type: string + subjectAltNames: + description: If specified, the proxy will verify that the server certificate's + subject alternate name matches one of the specified values. + items: + type: string + type: array + workloadSelector: + description: Applicable only for MESH_INTERNAL services. + properties: + labels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard is not supported in selector + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which the configuration should be applied. + maxProperties: 256 type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. - + type: object + required: + - hosts + type: object + x-kubernetes-validations: + - message: only one of WorkloadSelector or Endpoints can be set + rule: '(has(self.workloadSelector) ? 1 : 0) + (has(self.endpoints) ? + 1 : 0) <= 1' + - message: CIDR addresses are allowed only for NONE/STATIC resolution + types + rule: '!((has(self.addresses) ? self.addresses : []).exists(k, k.contains("/")) + && !((has(self.resolution) ? self.resolution : "NONE") in ["STATIC", + "NONE"]))' + - message: NONE mode cannot set endpoints + rule: '((has(self.resolution) ? self.resolution : "NONE") == "NONE") + ? !has(self.endpoints) : true' + - message: DNS_ROUND_ROBIN mode cannot have multiple endpoints + rule: '((has(self.resolution) ? self.resolution : "") == "DNS_ROUND_ROBIN") + ? ((has(self.endpoints) ? self.endpoints : []).size() <= 1) : true' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -8776,6586 +10150,3250 @@ metadata: app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.29.4 helm.sh/chart: base-1.29.4 - name: requestauthentications.security.istio.io + name: sidecars.networking.istio.io spec: - group: security.istio.io + group: networking.istio.io names: categories: - - istio-io - - security-istio-io - kind: RequestAuthentication - listKind: RequestAuthenticationList - plural: requestauthentications - shortNames: - - ra - singular: requestauthentication + - istio-io + - networking-istio-io + kind: Sidecar + listKind: SidecarList + plural: sidecars + singular: sidecar scope: Namespaced versions: - - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Request authentication configuration for workloads. See - more details at: https://istio.io/docs/reference/config/security/request_authentication.html' - properties: - jwtRules: - description: Define the list of JWTs that can be validated at the - selected workloads' proxy. - items: - properties: - audiences: - description: The list of JWT [audiences](https://tools.ietf.org/html/rfc7519#section-4.1.3) - that are allowed to access. - items: - minLength: 1 - type: string - type: array - forwardOriginalToken: - description: If set to true, the original token will be kept - for the upstream request. - type: boolean - fromCookies: - description: List of cookie names from which JWT is expected. - items: - minLength: 1 + - name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting network reachability of a sidecar. + See more details at: https://istio.io/docs/reference/config/networking/sidecar.html' + properties: + egress: + description: Egress specifies the configuration of the sidecar for + processing outbound traffic from the attached workload instance + to other services in the mesh. + items: + properties: + bind: + description: The IP(IPv4 or IPv6) or the Unix domain socket + to which the listener should be bound to. + type: string + captureMode: + description: |- + When the bind address is an IP, the captureMode option dictates how traffic to the listener is expected to be captured (or not). + + Valid Options: DEFAULT, IPTABLES, NONE + enum: + - DEFAULT + - IPTABLES + - NONE + type: string + hosts: + description: One or more service hosts exposed by the listener + in `namespace/dnsName` format. + items: + type: string + type: array + port: + description: The port associated with the listener. + properties: + name: + description: Label assigned to the port. type: string - type: array - fromHeaders: - description: List of header locations from which JWT is expected. - items: - properties: - name: - description: The HTTP header name. - minLength: 1 - type: string - prefix: - description: The prefix that should be stripped before - decoding the token. - type: string - required: - - name - type: object - type: array - fromParams: - description: List of query parameters from which JWT is expected. - items: - minLength: 1 + number: + description: A valid non-negative integer port number. + maximum: 4294967295 + minimum: 0 + type: integer + protocol: + description: The protocol exposed on the port. type: string - type: array - issuer: - description: Identifies the issuer that issued the JWT. - minLength: 1 - type: string - jwks: - description: JSON Web Key Set of public keys to validate signature - of the JWT. + targetPort: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + required: + - hosts + type: object + type: array + inboundConnectionPool: + description: Settings controlling the volume of connections Envoy + will accept from the network. + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will be queued + while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection pool + connections. type: string - jwks_uri: - description: URL of the provider's public key set to validate - signature of the JWT. - maxLength: 2048 - minLength: 1 + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams allowed + for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection to + a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding + to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be preserved + while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream connections. + properties: + connectTimeout: + description: TCP connection timeout. type: string x-kubernetes-validations: - - message: url must have scheme http:// or https:// - rule: url(self).getScheme() in ["http", "https"] - jwksUri: - description: URL of the provider's public key set to validate - signature of the JWT. - maxLength: 2048 - minLength: 1 + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. type: string x-kubernetes-validations: - - message: url must have scheme http:// or https:// - rule: url(self).getScheme() in ["http", "https"] - outputClaimToHeaders: - description: This field specifies a list of operations to - copy the claim to HTTP headers on a successfully verified - token. - items: - properties: - claim: - description: The name of the claim to be copied from. - minLength: 1 - type: string - header: - description: The name of the header to be created. - minLength: 1 - pattern: ^[-_A-Za-z0-9]+$ - type: string - required: - - header - - claim - type: object - type: array - outputPayloadToHeader: - description: This field specifies the header name to output - a successfully verified JWT payload to the backend. - type: string - spaceDelimitedClaims: - description: List of JWT claim names that should be treated - as space-delimited strings. - items: - minLength: 1 - type: string - maxItems: 64 - type: array - timeout: - description: The maximum amount of time that the resolver, - determined by the PILOT_JWT_ENABLE_REMOTE_JWKS environment - variable, will spend waiting for the JWKS to be fetched. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - x-kubernetes-validations: - - message: only one of jwks or jwksUri can be set - rule: '(has(self.jwksUri) ? 1 : 0) + (has(self.jwks_uri) ? - 1 : 0) + (has(self.jwks) ? 1 : 0) <= 1' - maxItems: 4096 - type: array - selector: - description: Optional. - properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set - of pods/VMs on which a policy should be applied. - maxProperties: 4096 - type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) - type: object - targetRef: - properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: name is the name of the target resource. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: namespace is the namespace of the referent. - type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 - required: - - kind - - name - type: object - targetRefs: - description: Optional. - items: - properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: name is the name of the target resource. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: namespace is the namespace of the referent. - type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently - supported - rule: self.size() == 0 - required: - - kind - - name - type: object - maxItems: 16 - type: array - type: object - x-kubernetes-validations: - - message: only one of targetRefs or selector can be set - rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : - 0) + (has(self.targetRefs) ? 1 : 0) <= 1' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. - - - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections to a + destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket to + enable TCP Keepalives. properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. + interval: + description: The time duration between keep-alive probes. type: string - name: - description: A human-readable name for the message type. + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to send + without response before deciding the connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection needs to be + idle before keep-alive probes start being sent. type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') type: object type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} - - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Request authentication configuration for workloads. See - more details at: https://istio.io/docs/reference/config/security/request_authentication.html' - properties: - jwtRules: - description: Define the list of JWTs that can be validated at the - selected workloads' proxy. - items: - properties: - audiences: - description: The list of JWT [audiences](https://tools.ietf.org/html/rfc7519#section-4.1.3) - that are allowed to access. - items: - minLength: 1 - type: string - type: array - forwardOriginalToken: - description: If set to true, the original token will be kept - for the upstream request. - type: boolean - fromCookies: - description: List of cookie names from which JWT is expected. - items: - minLength: 1 - type: string - type: array - fromHeaders: - description: List of header locations from which JWT is expected. - items: + type: object + ingress: + description: Ingress specifies the configuration of the sidecar for + processing inbound traffic to the attached workload instance. + items: + properties: + bind: + description: The IP(IPv4 or IPv6) to which the listener should + be bound. + type: string + captureMode: + description: |- + The captureMode option dictates how traffic to the listener is expected to be captured (or not). + + Valid Options: DEFAULT, IPTABLES, NONE + enum: + - DEFAULT + - IPTABLES + - NONE + type: string + connectionPool: + description: Settings controlling the volume of connections + Envoy will accept from the network. + properties: + http: + description: HTTP connection pool settings. properties: - name: - description: The HTTP header name. - minLength: 1 + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE type: string - prefix: - description: The prefix that should be stripped before - decoding the token. + http1MaxPendingRequests: + description: Maximum number of requests that will be + queued while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a + destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection + pool connections. type: string - required: - - name + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams + allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection + to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding + to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be + preserved while initiating connection to backend. + type: boolean type: object - type: array - fromParams: - description: List of query parameters from which JWT is expected. - items: - minLength: 1 - type: string - type: array - issuer: - description: Identifies the issuer that issued the JWT. - minLength: 1 - type: string - jwks: - description: JSON Web Key Set of public keys to validate signature - of the JWT. - type: string - jwks_uri: - description: URL of the provider's public key set to validate - signature of the JWT. - maxLength: 2048 - minLength: 1 - type: string - x-kubernetes-validations: - - message: url must have scheme http:// or https:// - rule: url(self).getScheme() in ["http", "https"] - jwksUri: - description: URL of the provider's public key set to validate - signature of the JWT. - maxLength: 2048 - minLength: 1 - type: string - x-kubernetes-validations: - - message: url must have scheme http:// or https:// - rule: url(self).getScheme() in ["http", "https"] - outputClaimToHeaders: - description: This field specifies a list of operations to - copy the claim to HTTP headers on a successfully verified - token. - items: + tcp: + description: Settings common to both HTTP and TCP upstream + connections. properties: - claim: - description: The name of the claim to be copied from. - minLength: 1 + connectTimeout: + description: TCP connection timeout. type: string - header: - description: The name of the header to be created. - minLength: 1 - pattern: ^[-_A-Za-z0-9]+$ + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. type: string - required: - - header - - claim - type: object - type: array - outputPayloadToHeader: - description: This field specifies the header name to output - a successfully verified JWT payload to the backend. - type: string - spaceDelimitedClaims: - description: List of JWT claim names that should be treated - as space-delimited strings. - items: - minLength: 1 - type: string - maxItems: 64 - type: array - timeout: - description: The maximum amount of time that the resolver, - determined by the PILOT_JWT_ENABLE_REMOTE_JWKS environment - variable, will spend waiting for the JWKS to be fetched. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - x-kubernetes-validations: - - message: only one of jwks or jwksUri can be set - rule: '(has(self.jwksUri) ? 1 : 0) + (has(self.jwks_uri) ? - 1 : 0) + (has(self.jwks) ? 1 : 0) <= 1' - maxItems: 4096 - type: array - selector: - description: Optional. - properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set - of pods/VMs on which a policy should be applied. - maxProperties: 4096 - type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) - type: object - targetRef: - properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: name is the name of the target resource. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: namespace is the namespace of the referent. - type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 - required: - - kind - - name - type: object - targetRefs: - description: Optional. - items: - properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: name is the name of the target resource. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: namespace is the namespace of the referent. - type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently - supported - rule: self.size() == 0 - required: - - kind - - name - type: object - maxItems: 16 - type: array - type: object - x-kubernetes-validations: - - message: only one of targetRefs or selector can be set - rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : - 0) + (has(self.targetRefs) ? 1 : 0) <= 1' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. - - - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - helm.sh/resource-policy: keep - labels: - app.kubernetes.io/instance: istio - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.4 - helm.sh/chart: base-1.29.4 - name: serviceentries.networking.istio.io -spec: - group: networking.istio.io - names: - categories: - - istio-io - - networking-istio-io - kind: ServiceEntry - listKind: ServiceEntryList - plural: serviceentries - shortNames: - - se - singular: serviceentry - scope: Namespaced - versions: - - additionalPrinterColumns: - - description: The hosts associated with the ServiceEntry - jsonPath: .spec.hosts - name: Hosts - type: string - - description: Whether the service is external to the mesh or part of the - mesh (MESH_EXTERNAL or MESH_INTERNAL) - jsonPath: .spec.location - name: Location - type: string - - description: Service resolution mode for the hosts (NONE, STATIC, or DNS) - jsonPath: .spec.resolution - name: Resolution - type: string - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is - represented in RFC3339 form and is in UTC. Populated by the system. Read-only. - Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting service registry. See more details - at: https://istio.io/docs/reference/config/networking/service-entry.html' - properties: - addresses: - description: The virtual IP addresses associated with the service. - items: - maxLength: 64 - type: string - maxItems: 256 - type: array - endpoints: - description: One or more endpoints associated with the service. - items: - properties: - address: - description: Address associated with the network endpoint - without the port. - maxLength: 256 - type: string - x-kubernetes-validations: - - message: UDS must be an absolute path or abstract socket - rule: 'self.startsWith("unix://") ? (self.substring(7, - 8) == "/" || self.substring(7, 8) == "@") : true' - - message: UDS may not be a dir - rule: 'self.startsWith("unix://") ? !self.endsWith("/") - : true' - labels: - additionalProperties: - type: string - description: One or more labels associated with the endpoint. - maxProperties: 256 - type: object - locality: - description: The locality associated with the endpoint. - maxLength: 2048 - type: string - network: - description: Network enables Istio to group endpoints resident - in the same L3 domain/network. - maxLength: 2048 - type: string - ports: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - description: Set of ports associated with the endpoint. - maxProperties: 128 - type: object - x-kubernetes-validations: - - message: port name must be valid - rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) - serviceAccount: - description: The service account associated with the workload - if a sidecar is present in the workload. - maxLength: 253 - type: string - weight: - description: The load balancing weight associated with the - endpoint. - maximum: 4294967295 - minimum: 0 - type: integer - type: object - x-kubernetes-validations: - - message: Address is required - rule: has(self.address) || has(self.network) - - message: UDS may not include ports - rule: '(has(self.address) ? self.address : "").startsWith("unix://") - ? !has(self.ports) : true' - maxItems: 4096 - type: array - exportTo: - description: A list of namespaces to which this service is exported. - items: - type: string - type: array - hosts: - description: The hosts associated with the ServiceEntry. - items: - type: string - x-kubernetes-validations: - - message: hostname cannot be wildcard - rule: self != "*" - maxItems: 256 - minItems: 1 - type: array - location: - description: 'Specify whether the service should be considered external - to the mesh or part of the mesh. - - - Valid Options: MESH_EXTERNAL, MESH_INTERNAL' - enum: - - MESH_EXTERNAL - - MESH_INTERNAL - type: string - ports: - description: The ports associated with the external service. - items: - properties: - name: - description: Label assigned to the port. - maxLength: 256 - type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - protocol: - description: The protocol exposed on the port. - maxLength: 256 - type: string - targetPort: - description: The port number on the endpoint where the traffic - will be received. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - required: - - number - - name - type: object - maxItems: 256 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - x-kubernetes-validations: - - message: port number cannot be duplicated - rule: self.all(l1, self.exists_one(l2, l1.number == l2.number)) - resolution: - description: 'Service resolution mode for the hosts. - - - Valid Options: NONE, STATIC, DNS, DNS_ROUND_ROBIN, DYNAMIC_DNS' - enum: - - NONE - - STATIC - - DNS - - DNS_ROUND_ROBIN - - DYNAMIC_DNS - type: string - subjectAltNames: - description: If specified, the proxy will verify that the server - certificate's subject alternate name matches one of the specified - values. - items: - type: string - type: array - workloadSelector: - description: Applicable only for MESH_INTERNAL services. - properties: - labels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard is not supported in selector - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set - of pods/VMs on which the configuration should be applied. - maxProperties: 256 - type: object - type: object - required: - - hosts - type: object - x-kubernetes-validations: - - message: only one of WorkloadSelector or Endpoints can be set - rule: '(has(self.workloadSelector) ? 1 : 0) + (has(self.endpoints) - ? 1 : 0) <= 1' - - message: CIDR addresses are allowed only for NONE/STATIC resolution - types - rule: '!((has(self.addresses) ? self.addresses : []).exists(k, k.contains("/")) - && !((has(self.resolution) ? self.resolution : "NONE") in ["STATIC", - "NONE"]))' - - message: NONE mode cannot set endpoints - rule: '((has(self.resolution) ? self.resolution : "NONE") == "NONE") - ? !has(self.endpoints) : true' - - message: DNS_ROUND_ROBIN mode cannot have multiple endpoints - rule: '((has(self.resolution) ? self.resolution : "") == "DNS_ROUND_ROBIN") - ? ((has(self.endpoints) ? self.endpoints : []).size() <= 1) : - true' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. - - - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} - - additionalPrinterColumns: - - description: The hosts associated with the ServiceEntry - jsonPath: .spec.hosts - name: Hosts - type: string - - description: Whether the service is external to the mesh or part of the - mesh (MESH_EXTERNAL or MESH_INTERNAL) - jsonPath: .spec.location - name: Location - type: string - - description: Service resolution mode for the hosts (NONE, STATIC, or DNS) - jsonPath: .spec.resolution - name: Resolution - type: string - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is - represented in RFC3339 form and is in UTC. Populated by the system. Read-only. - Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1alpha3 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting service registry. See more details - at: https://istio.io/docs/reference/config/networking/service-entry.html' - properties: - addresses: - description: The virtual IP addresses associated with the service. - items: - maxLength: 64 - type: string - maxItems: 256 - type: array - endpoints: - description: One or more endpoints associated with the service. - items: - properties: - address: - description: Address associated with the network endpoint - without the port. - maxLength: 256 - type: string - x-kubernetes-validations: - - message: UDS must be an absolute path or abstract socket - rule: 'self.startsWith("unix://") ? (self.substring(7, - 8) == "/" || self.substring(7, 8) == "@") : true' - - message: UDS may not be a dir - rule: 'self.startsWith("unix://") ? !self.endsWith("/") - : true' - labels: - additionalProperties: - type: string - description: One or more labels associated with the endpoint. - maxProperties: 256 - type: object - locality: - description: The locality associated with the endpoint. - maxLength: 2048 - type: string - network: - description: Network enables Istio to group endpoints resident - in the same L3 domain/network. - maxLength: 2048 - type: string - ports: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - description: Set of ports associated with the endpoint. - maxProperties: 128 - type: object - x-kubernetes-validations: - - message: port name must be valid - rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) - serviceAccount: - description: The service account associated with the workload - if a sidecar is present in the workload. - maxLength: 253 - type: string - weight: - description: The load balancing weight associated with the - endpoint. - maximum: 4294967295 - minimum: 0 - type: integer - type: object - x-kubernetes-validations: - - message: Address is required - rule: has(self.address) || has(self.network) - - message: UDS may not include ports - rule: '(has(self.address) ? self.address : "").startsWith("unix://") - ? !has(self.ports) : true' - maxItems: 4096 - type: array - exportTo: - description: A list of namespaces to which this service is exported. - items: - type: string - type: array - hosts: - description: The hosts associated with the ServiceEntry. - items: - type: string - x-kubernetes-validations: - - message: hostname cannot be wildcard - rule: self != "*" - maxItems: 256 - minItems: 1 - type: array - location: - description: 'Specify whether the service should be considered external - to the mesh or part of the mesh. - - - Valid Options: MESH_EXTERNAL, MESH_INTERNAL' - enum: - - MESH_EXTERNAL - - MESH_INTERNAL - type: string - ports: - description: The ports associated with the external service. - items: - properties: - name: - description: Label assigned to the port. - maxLength: 256 - type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - protocol: - description: The protocol exposed on the port. - maxLength: 256 - type: string - targetPort: - description: The port number on the endpoint where the traffic - will be received. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - required: - - number - - name - type: object - maxItems: 256 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - x-kubernetes-validations: - - message: port number cannot be duplicated - rule: self.all(l1, self.exists_one(l2, l1.number == l2.number)) - resolution: - description: 'Service resolution mode for the hosts. - - - Valid Options: NONE, STATIC, DNS, DNS_ROUND_ROBIN, DYNAMIC_DNS' - enum: - - NONE - - STATIC - - DNS - - DNS_ROUND_ROBIN - - DYNAMIC_DNS - type: string - subjectAltNames: - description: If specified, the proxy will verify that the server - certificate's subject alternate name matches one of the specified - values. - items: - type: string - type: array - workloadSelector: - description: Applicable only for MESH_INTERNAL services. - properties: - labels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard is not supported in selector - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set - of pods/VMs on which the configuration should be applied. - maxProperties: 256 - type: object - type: object - required: - - hosts - type: object - x-kubernetes-validations: - - message: only one of WorkloadSelector or Endpoints can be set - rule: '(has(self.workloadSelector) ? 1 : 0) + (has(self.endpoints) - ? 1 : 0) <= 1' - - message: CIDR addresses are allowed only for NONE/STATIC resolution - types - rule: '!((has(self.addresses) ? self.addresses : []).exists(k, k.contains("/")) - && !((has(self.resolution) ? self.resolution : "NONE") in ["STATIC", - "NONE"]))' - - message: NONE mode cannot set endpoints - rule: '((has(self.resolution) ? self.resolution : "NONE") == "NONE") - ? !has(self.endpoints) : true' - - message: DNS_ROUND_ROBIN mode cannot have multiple endpoints - rule: '((has(self.resolution) ? self.resolution : "") == "DNS_ROUND_ROBIN") - ? ((has(self.endpoints) ? self.endpoints : []).size() <= 1) : - true' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. - - - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: false - subresources: - status: {} - - additionalPrinterColumns: - - description: The hosts associated with the ServiceEntry - jsonPath: .spec.hosts - name: Hosts - type: string - - description: Whether the service is external to the mesh or part of the - mesh (MESH_EXTERNAL or MESH_INTERNAL) - jsonPath: .spec.location - name: Location - type: string - - description: Service resolution mode for the hosts (NONE, STATIC, or DNS) - jsonPath: .spec.resolution - name: Resolution - type: string - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is - represented in RFC3339 form and is in UTC. Populated by the system. Read-only. - Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting service registry. See more details - at: https://istio.io/docs/reference/config/networking/service-entry.html' - properties: - addresses: - description: The virtual IP addresses associated with the service. - items: - maxLength: 64 - type: string - maxItems: 256 - type: array - endpoints: - description: One or more endpoints associated with the service. - items: - properties: - address: - description: Address associated with the network endpoint - without the port. - maxLength: 256 - type: string - x-kubernetes-validations: - - message: UDS must be an absolute path or abstract socket - rule: 'self.startsWith("unix://") ? (self.substring(7, - 8) == "/" || self.substring(7, 8) == "@") : true' - - message: UDS may not be a dir - rule: 'self.startsWith("unix://") ? !self.endsWith("/") - : true' - labels: - additionalProperties: - type: string - description: One or more labels associated with the endpoint. - maxProperties: 256 - type: object - locality: - description: The locality associated with the endpoint. - maxLength: 2048 - type: string - network: - description: Network enables Istio to group endpoints resident - in the same L3 domain/network. - maxLength: 2048 - type: string - ports: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - description: Set of ports associated with the endpoint. - maxProperties: 128 - type: object - x-kubernetes-validations: - - message: port name must be valid - rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) - serviceAccount: - description: The service account associated with the workload - if a sidecar is present in the workload. - maxLength: 253 - type: string - weight: - description: The load balancing weight associated with the - endpoint. - maximum: 4294967295 - minimum: 0 - type: integer - type: object - x-kubernetes-validations: - - message: Address is required - rule: has(self.address) || has(self.network) - - message: UDS may not include ports - rule: '(has(self.address) ? self.address : "").startsWith("unix://") - ? !has(self.ports) : true' - maxItems: 4096 - type: array - exportTo: - description: A list of namespaces to which this service is exported. - items: - type: string - type: array - hosts: - description: The hosts associated with the ServiceEntry. - items: - type: string - x-kubernetes-validations: - - message: hostname cannot be wildcard - rule: self != "*" - maxItems: 256 - minItems: 1 - type: array - location: - description: 'Specify whether the service should be considered external - to the mesh or part of the mesh. - - - Valid Options: MESH_EXTERNAL, MESH_INTERNAL' - enum: - - MESH_EXTERNAL - - MESH_INTERNAL - type: string - ports: - description: The ports associated with the external service. - items: - properties: - name: - description: Label assigned to the port. - maxLength: 256 - type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - protocol: - description: The protocol exposed on the port. - maxLength: 256 - type: string - targetPort: - description: The port number on the endpoint where the traffic - will be received. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - required: - - number - - name - type: object - maxItems: 256 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - x-kubernetes-validations: - - message: port number cannot be duplicated - rule: self.all(l1, self.exists_one(l2, l1.number == l2.number)) - resolution: - description: 'Service resolution mode for the hosts. - - - Valid Options: NONE, STATIC, DNS, DNS_ROUND_ROBIN, DYNAMIC_DNS' - enum: - - NONE - - STATIC - - DNS - - DNS_ROUND_ROBIN - - DYNAMIC_DNS - type: string - subjectAltNames: - description: If specified, the proxy will verify that the server - certificate's subject alternate name matches one of the specified - values. - items: - type: string - type: array - workloadSelector: - description: Applicable only for MESH_INTERNAL services. - properties: - labels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard is not supported in selector - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set - of pods/VMs on which the configuration should be applied. - maxProperties: 256 - type: object - type: object - required: - - hosts - type: object - x-kubernetes-validations: - - message: only one of WorkloadSelector or Endpoints can be set - rule: '(has(self.workloadSelector) ? 1 : 0) + (has(self.endpoints) - ? 1 : 0) <= 1' - - message: CIDR addresses are allowed only for NONE/STATIC resolution - types - rule: '!((has(self.addresses) ? self.addresses : []).exists(k, k.contains("/")) - && !((has(self.resolution) ? self.resolution : "NONE") in ["STATIC", - "NONE"]))' - - message: NONE mode cannot set endpoints - rule: '((has(self.resolution) ? self.resolution : "NONE") == "NONE") - ? !has(self.endpoints) : true' - - message: DNS_ROUND_ROBIN mode cannot have multiple endpoints - rule: '((has(self.resolution) ? self.resolution : "") == "DNS_ROUND_ROBIN") - ? ((has(self.endpoints) ? self.endpoints : []).size() <= 1) : - true' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. - - - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: false - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - helm.sh/resource-policy: keep - labels: - app.kubernetes.io/instance: istio - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.4 - helm.sh/chart: base-1.29.4 - name: sidecars.networking.istio.io -spec: - group: networking.istio.io - names: - categories: - - istio-io - - networking-istio-io - kind: Sidecar - listKind: SidecarList - plural: sidecars - singular: sidecar - scope: Namespaced - versions: - - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting network reachability of a sidecar. - See more details at: https://istio.io/docs/reference/config/networking/sidecar.html' - properties: - egress: - description: Egress specifies the configuration of the sidecar for - processing outbound traffic from the attached workload instance - to other services in the mesh. - items: - properties: - bind: - description: The IP(IPv4 or IPv6) or the Unix domain socket - to which the listener should be bound to. - type: string - captureMode: - description: 'When the bind address is an IP, the captureMode - option dictates how traffic to the listener is expected - to be captured (or not). - - - Valid Options: DEFAULT, IPTABLES, NONE' - enum: - - DEFAULT - - IPTABLES - - NONE - type: string - hosts: - description: One or more service hosts exposed by the listener - in `namespace/dnsName` format. - items: - type: string - type: array - port: - description: The port associated with the listener. - properties: - name: - description: Label assigned to the port. - type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - protocol: - description: The protocol exposed on the port. - type: string - targetPort: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - required: - - hosts - type: object - type: array - inboundConnectionPool: - description: Settings controlling the volume of connections Envoy - will accept from the network. - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: 'Specify if http1.1 connection should be upgraded - to http2 for the associated destination. - - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE' - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be queued - while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection pool - connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams allowed - for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection to - a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding - to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be preserved - while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections to - a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket - to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes to send - without response before deciding the connection is - dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection needs to - be idle before keep-alive probes start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: object - type: object - ingress: - description: Ingress specifies the configuration of the sidecar - for processing inbound traffic to the attached workload instance. - items: - properties: - bind: - description: The IP(IPv4 or IPv6) to which the listener should - be bound. - type: string - captureMode: - description: 'The captureMode option dictates how traffic - to the listener is expected to be captured (or not). - - - Valid Options: DEFAULT, IPTABLES, NONE' - enum: - - DEFAULT - - IPTABLES - - NONE - type: string - connectionPool: - description: Settings controlling the volume of connections - Envoy will accept from the network. - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: 'Specify if http1.1 connection should - be upgraded to http2 for the associated destination. - - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE' - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will - be queued while waiting for a ready connection pool - connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to - a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection - pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams - allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection - to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be - outstanding to all hosts in a cluster at a given - time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will - be preserved while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream - connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections - to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket - to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive - probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes - to send without response before deciding the - connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection needs - to be idle before keep-alive probes start being - sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: object - type: object - defaultEndpoint: - description: The IP endpoint or Unix domain socket to which - traffic should be forwarded to. - type: string - port: - description: The port associated with the listener. - properties: - name: - description: Label assigned to the port. - type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - protocol: - description: The protocol exposed on the port. - type: string - targetPort: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - tls: - description: Set of TLS related options that will enable TLS - termination on the sidecar for requests originating from - outside the mesh. - properties: - caCertCredentialName: - description: For mutual TLS, the name of the secret or - the configmap that holds CA certificates. - type: string - caCertificates: - description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing - the certificate revocation list (CRL) to use in verifying - a presented client side certificate.' - type: string - cipherSuites: - description: 'Optional: If specified, only support the - specified cipher list.' - items: - type: string - type: array - credentialName: - description: For gateways running on Kubernetes, the name - of the secret that holds the TLS certs including the - CA certificates. - type: string - credentialNames: - description: Same as CredentialName but for multiple certificates. - items: - type: string - maxItems: 2 - minItems: 1 - type: array - httpsRedirect: - description: If set to true, the load balancer will send - a 301 redirect for all http connections, asking the - clients to use HTTPS. - type: boolean - maxProtocolVersion: - description: 'Optional: Maximum TLS protocol version. - - - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, - TLSV1_3' - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - minProtocolVersion: - description: 'Optional: Minimum TLS protocol version. - - - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, - TLSV1_3' - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - mode: - description: 'Optional: Indicates whether connections - to this port should be secured using TLS. - - - Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, - ISTIO_MUTUAL, OPTIONAL_MUTUAL' - enum: - - PASSTHROUGH - - SIMPLE - - MUTUAL - - AUTO_PASSTHROUGH - - ISTIO_MUTUAL - - OPTIONAL_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - subjectAltNames: - description: A list of alternate names to verify the subject - identity in the certificate presented by the client. - items: - type: string - type: array - tlsCertificates: - description: Only one of `server_certificate`, `private_key` - or `credential_name` or `credential_names` or `tls_certificates` - should be specified. - items: - properties: - caCertificates: - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - type: object - maxItems: 2 - minItems: 1 - type: array - verifyCertificateHash: - description: An optional list of hex-encoded SHA-256 hashes - of the authorized client certificates. - items: - type: string - type: array - verifyCertificateSpki: - description: An optional list of base64-encoded SHA-256 - hashes of the SPKIs of authorized client certificates. - items: - type: string - type: array - type: object - x-kubernetes-validations: - - message: only one of credentialNames or tlsCertificates - can be set - rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) - ? 1 : 0) <= 1' - - message: only one of credentialName or credentialNames - can be set - rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) - ? 1 : 0) <= 1' - - message: only one of credentialName or tlsCertificates - can be set - rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) - ? 1 : 0) <= 1' - required: - - port - type: object - type: array - outboundTrafficPolicy: - description: Set the default behavior of the sidecar for handling - outbound traffic from the application. - properties: - egressProxy: - properties: - host: - description: The name of a service from the service registry. - type: string - port: - description: Specifies the port on the host that is being - addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - mode: - description: ' - - - Valid Options: REGISTRY_ONLY, ALLOW_ANY' - enum: - - REGISTRY_ONLY - - ALLOW_ANY - type: string - type: object - workloadSelector: - description: Criteria used to select the specific set of pods/VMs - on which this `Sidecar` configuration should be applied. - properties: - labels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard is not supported in selector - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set - of pods/VMs on which the configuration should be applied. - maxProperties: 256 - type: object - type: object - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. - - - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} - - name: v1alpha3 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting network reachability of a sidecar. - See more details at: https://istio.io/docs/reference/config/networking/sidecar.html' - properties: - egress: - description: Egress specifies the configuration of the sidecar for - processing outbound traffic from the attached workload instance - to other services in the mesh. - items: - properties: - bind: - description: The IP(IPv4 or IPv6) or the Unix domain socket - to which the listener should be bound to. - type: string - captureMode: - description: 'When the bind address is an IP, the captureMode - option dictates how traffic to the listener is expected - to be captured (or not). - - - Valid Options: DEFAULT, IPTABLES, NONE' - enum: - - DEFAULT - - IPTABLES - - NONE - type: string - hosts: - description: One or more service hosts exposed by the listener - in `namespace/dnsName` format. - items: - type: string - type: array - port: - description: The port associated with the listener. - properties: - name: - description: Label assigned to the port. - type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - protocol: - description: The protocol exposed on the port. - type: string - targetPort: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - required: - - hosts - type: object - type: array - inboundConnectionPool: - description: Settings controlling the volume of connections Envoy - will accept from the network. - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: 'Specify if http1.1 connection should be upgraded - to http2 for the associated destination. - - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE' - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be queued - while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection pool - connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams allowed - for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection to - a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding - to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be preserved - while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections to - a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket - to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes to send - without response before deciding the connection is - dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection needs to - be idle before keep-alive probes start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: object - type: object - ingress: - description: Ingress specifies the configuration of the sidecar - for processing inbound traffic to the attached workload instance. - items: - properties: - bind: - description: The IP(IPv4 or IPv6) to which the listener should - be bound. - type: string - captureMode: - description: 'The captureMode option dictates how traffic - to the listener is expected to be captured (or not). - - - Valid Options: DEFAULT, IPTABLES, NONE' - enum: - - DEFAULT - - IPTABLES - - NONE - type: string - connectionPool: - description: Settings controlling the volume of connections - Envoy will accept from the network. - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: 'Specify if http1.1 connection should - be upgraded to http2 for the associated destination. - - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE' - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will - be queued while waiting for a ready connection pool - connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to - a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection - pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams - allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection - to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be - outstanding to all hosts in a cluster at a given - time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will - be preserved while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream - connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections - to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket - to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive - probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes - to send without response before deciding the - connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection needs - to be idle before keep-alive probes start being - sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: object - type: object - defaultEndpoint: - description: The IP endpoint or Unix domain socket to which - traffic should be forwarded to. - type: string - port: - description: The port associated with the listener. - properties: - name: - description: Label assigned to the port. - type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - protocol: - description: The protocol exposed on the port. - type: string - targetPort: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - tls: - description: Set of TLS related options that will enable TLS - termination on the sidecar for requests originating from - outside the mesh. - properties: - caCertCredentialName: - description: For mutual TLS, the name of the secret or - the configmap that holds CA certificates. - type: string - caCertificates: - description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing - the certificate revocation list (CRL) to use in verifying - a presented client side certificate.' - type: string - cipherSuites: - description: 'Optional: If specified, only support the - specified cipher list.' - items: - type: string - type: array - credentialName: - description: For gateways running on Kubernetes, the name - of the secret that holds the TLS certs including the - CA certificates. - type: string - credentialNames: - description: Same as CredentialName but for multiple certificates. - items: - type: string - maxItems: 2 - minItems: 1 - type: array - httpsRedirect: - description: If set to true, the load balancer will send - a 301 redirect for all http connections, asking the - clients to use HTTPS. - type: boolean - maxProtocolVersion: - description: 'Optional: Maximum TLS protocol version. - - - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, - TLSV1_3' - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - minProtocolVersion: - description: 'Optional: Minimum TLS protocol version. - - - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, - TLSV1_3' - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - mode: - description: 'Optional: Indicates whether connections - to this port should be secured using TLS. - - - Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, - ISTIO_MUTUAL, OPTIONAL_MUTUAL' - enum: - - PASSTHROUGH - - SIMPLE - - MUTUAL - - AUTO_PASSTHROUGH - - ISTIO_MUTUAL - - OPTIONAL_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - subjectAltNames: - description: A list of alternate names to verify the subject - identity in the certificate presented by the client. - items: - type: string - type: array - tlsCertificates: - description: Only one of `server_certificate`, `private_key` - or `credential_name` or `credential_names` or `tls_certificates` - should be specified. - items: - properties: - caCertificates: - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - type: object - maxItems: 2 - minItems: 1 - type: array - verifyCertificateHash: - description: An optional list of hex-encoded SHA-256 hashes - of the authorized client certificates. - items: - type: string - type: array - verifyCertificateSpki: - description: An optional list of base64-encoded SHA-256 - hashes of the SPKIs of authorized client certificates. - items: - type: string - type: array - type: object - x-kubernetes-validations: - - message: only one of credentialNames or tlsCertificates - can be set - rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) - ? 1 : 0) <= 1' - - message: only one of credentialName or credentialNames - can be set - rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) - ? 1 : 0) <= 1' - - message: only one of credentialName or tlsCertificates - can be set - rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) - ? 1 : 0) <= 1' - required: - - port - type: object - type: array - outboundTrafficPolicy: - description: Set the default behavior of the sidecar for handling - outbound traffic from the application. - properties: - egressProxy: - properties: - host: - description: The name of a service from the service registry. - type: string - port: - description: Specifies the port on the host that is being - addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - mode: - description: ' - - - Valid Options: REGISTRY_ONLY, ALLOW_ANY' - enum: - - REGISTRY_ONLY - - ALLOW_ANY - type: string - type: object - workloadSelector: - description: Criteria used to select the specific set of pods/VMs - on which this `Sidecar` configuration should be applied. - properties: - labels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard is not supported in selector - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set - of pods/VMs on which the configuration should be applied. - maxProperties: 256 - type: object - type: object - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. - - - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} - - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting network reachability of a sidecar. - See more details at: https://istio.io/docs/reference/config/networking/sidecar.html' - properties: - egress: - description: Egress specifies the configuration of the sidecar for - processing outbound traffic from the attached workload instance - to other services in the mesh. - items: - properties: - bind: - description: The IP(IPv4 or IPv6) or the Unix domain socket - to which the listener should be bound to. - type: string - captureMode: - description: 'When the bind address is an IP, the captureMode - option dictates how traffic to the listener is expected - to be captured (or not). - - - Valid Options: DEFAULT, IPTABLES, NONE' - enum: - - DEFAULT - - IPTABLES - - NONE - type: string - hosts: - description: One or more service hosts exposed by the listener - in `namespace/dnsName` format. - items: - type: string - type: array - port: - description: The port associated with the listener. - properties: - name: - description: Label assigned to the port. - type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - protocol: - description: The protocol exposed on the port. - type: string - targetPort: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - required: - - hosts - type: object - type: array - inboundConnectionPool: - description: Settings controlling the volume of connections Envoy - will accept from the network. - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: 'Specify if http1.1 connection should be upgraded - to http2 for the associated destination. - - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE' - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be queued - while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection pool - connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams allowed - for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection to - a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding - to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be preserved - while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections to - a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket - to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes to send - without response before deciding the connection is - dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection needs to - be idle before keep-alive probes start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: object - type: object - ingress: - description: Ingress specifies the configuration of the sidecar - for processing inbound traffic to the attached workload instance. - items: - properties: - bind: - description: The IP(IPv4 or IPv6) to which the listener should - be bound. - type: string - captureMode: - description: 'The captureMode option dictates how traffic - to the listener is expected to be captured (or not). - - - Valid Options: DEFAULT, IPTABLES, NONE' - enum: - - DEFAULT - - IPTABLES - - NONE - type: string - connectionPool: - description: Settings controlling the volume of connections - Envoy will accept from the network. - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: 'Specify if http1.1 connection should - be upgraded to http2 for the associated destination. - - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE' - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will - be queued while waiting for a ready connection pool - connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to - a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection - pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams - allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection - to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be - outstanding to all hosts in a cluster at a given - time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will - be preserved while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream - connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections - to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket - to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive - probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes - to send without response before deciding the - connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection needs - to be idle before keep-alive probes start being - sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: object - type: object - defaultEndpoint: - description: The IP endpoint or Unix domain socket to which - traffic should be forwarded to. - type: string - port: - description: The port associated with the listener. - properties: - name: - description: Label assigned to the port. - type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - protocol: - description: The protocol exposed on the port. - type: string - targetPort: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - tls: - description: Set of TLS related options that will enable TLS - termination on the sidecar for requests originating from - outside the mesh. - properties: - caCertCredentialName: - description: For mutual TLS, the name of the secret or - the configmap that holds CA certificates. - type: string - caCertificates: - description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing - the certificate revocation list (CRL) to use in verifying - a presented client side certificate.' - type: string - cipherSuites: - description: 'Optional: If specified, only support the - specified cipher list.' - items: - type: string - type: array - credentialName: - description: For gateways running on Kubernetes, the name - of the secret that holds the TLS certs including the - CA certificates. - type: string - credentialNames: - description: Same as CredentialName but for multiple certificates. - items: - type: string - maxItems: 2 - minItems: 1 - type: array - httpsRedirect: - description: If set to true, the load balancer will send - a 301 redirect for all http connections, asking the - clients to use HTTPS. - type: boolean - maxProtocolVersion: - description: 'Optional: Maximum TLS protocol version. - - - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, - TLSV1_3' - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - minProtocolVersion: - description: 'Optional: Minimum TLS protocol version. - - - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, - TLSV1_3' - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - mode: - description: 'Optional: Indicates whether connections - to this port should be secured using TLS. - - - Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, - ISTIO_MUTUAL, OPTIONAL_MUTUAL' - enum: - - PASSTHROUGH - - SIMPLE - - MUTUAL - - AUTO_PASSTHROUGH - - ISTIO_MUTUAL - - OPTIONAL_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - subjectAltNames: - description: A list of alternate names to verify the subject - identity in the certificate presented by the client. - items: - type: string - type: array - tlsCertificates: - description: Only one of `server_certificate`, `private_key` - or `credential_name` or `credential_names` or `tls_certificates` - should be specified. - items: - properties: - caCertificates: - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - type: object - maxItems: 2 - minItems: 1 - type: array - verifyCertificateHash: - description: An optional list of hex-encoded SHA-256 hashes - of the authorized client certificates. - items: - type: string - type: array - verifyCertificateSpki: - description: An optional list of base64-encoded SHA-256 - hashes of the SPKIs of authorized client certificates. - items: - type: string - type: array - type: object - x-kubernetes-validations: - - message: only one of credentialNames or tlsCertificates - can be set - rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) - ? 1 : 0) <= 1' - - message: only one of credentialName or credentialNames - can be set - rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) - ? 1 : 0) <= 1' - - message: only one of credentialName or tlsCertificates - can be set - rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) - ? 1 : 0) <= 1' - required: - - port - type: object - type: array - outboundTrafficPolicy: - description: Set the default behavior of the sidecar for handling - outbound traffic from the application. - properties: - egressProxy: - properties: - host: - description: The name of a service from the service registry. - type: string - port: - description: Specifies the port on the host that is being - addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - mode: - description: ' - - - Valid Options: REGISTRY_ONLY, ALLOW_ANY' - enum: - - REGISTRY_ONLY - - ALLOW_ANY - type: string - type: object - workloadSelector: - description: Criteria used to select the specific set of pods/VMs - on which this `Sidecar` configuration should be applied. - properties: - labels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard is not supported in selector - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set - of pods/VMs on which the configuration should be applied. - maxProperties: 256 - type: object - type: object - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. - - - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - helm.sh/resource-policy: keep - labels: - app.kubernetes.io/instance: istio - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.4 - helm.sh/chart: base-1.29.4 - name: telemetries.telemetry.istio.io -spec: - group: telemetry.istio.io - names: - categories: - - istio-io - - telemetry-istio-io - kind: Telemetry - listKind: TelemetryList - plural: telemetries - shortNames: - - telemetry - singular: telemetry - scope: Namespaced - versions: - - additionalPrinterColumns: - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is - represented in RFC3339 form and is in UTC. Populated by the system. Read-only. - Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Telemetry configuration for workloads. See more details - at: https://istio.io/docs/reference/config/telemetry.html' - properties: - accessLogging: - description: Optional. - items: - properties: - disabled: - description: Controls logging. - nullable: true - type: boolean - filter: - description: Optional. - properties: - expression: - description: CEL expression for selecting when requests/connections - should be logged. - type: string - type: object - match: - description: Allows tailoring of logging behavior to specific - conditions. - properties: - mode: - description: 'This determines whether or not to apply - the access logging configuration based on the direction - of traffic relative to the proxied workload. - - - Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER' - enum: - - CLIENT_AND_SERVER - - CLIENT - - SERVER - type: string - type: object - providers: - description: Optional. - items: - properties: - name: - description: Required. - minLength: 1 - type: string - required: - - name - type: object - type: array - type: object - type: array - metrics: - description: Optional. - items: - properties: - overrides: - description: Optional. - items: - properties: - disabled: - description: Optional. - nullable: true - type: boolean - match: - description: Match allows providing the scope of the - override. - oneOf: - - not: - anyOf: - - required: - - metric - - required: - - customMetric - - required: - - metric - - required: - - customMetric - properties: - customMetric: - description: Allows free-form specification of a - metric. - minLength: 1 - type: string - metric: - description: 'One of the well-known [Istio Standard - Metrics](https://istio.io/latest/docs/reference/config/metrics/). - - - Valid Options: ALL_METRICS, REQUEST_COUNT, REQUEST_DURATION, - REQUEST_SIZE, RESPONSE_SIZE, TCP_OPENED_CONNECTIONS, - TCP_CLOSED_CONNECTIONS, TCP_SENT_BYTES, TCP_RECEIVED_BYTES, - GRPC_REQUEST_MESSAGES, GRPC_RESPONSE_MESSAGES' - enum: - - ALL_METRICS - - REQUEST_COUNT - - REQUEST_DURATION - - REQUEST_SIZE - - RESPONSE_SIZE - - TCP_OPENED_CONNECTIONS - - TCP_CLOSED_CONNECTIONS - - TCP_SENT_BYTES - - TCP_RECEIVED_BYTES - - GRPC_REQUEST_MESSAGES - - GRPC_RESPONSE_MESSAGES - type: string - mode: - description: 'Controls which mode of metrics generation - is selected: `CLIENT`, `SERVER`, or `CLIENT_AND_SERVER`. - - - Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER' - enum: - - CLIENT_AND_SERVER - - CLIENT - - SERVER - type: string - type: object - tagOverrides: - additionalProperties: - properties: - operation: - description: 'Operation controls whether or not - to update/add a tag, or to remove it. - - - Valid Options: UPSERT, REMOVE' - enum: - - UPSERT - - REMOVE - type: string - value: - description: Value is only considered if the operation - is `UPSERT`. - type: string - type: object - x-kubernetes-validations: - - message: value must be set when operation is UPSERT - rule: '((has(self.operation) ? self.operation - : "") == "UPSERT") ? (self.value != "") : true' - - message: value must not be set when operation - is REMOVE - rule: '((has(self.operation) ? self.operation - : "") == "REMOVE") ? !has(self.value) : true' - description: Optional. - type: object - type: object - type: array - providers: - description: Optional. - items: - properties: - name: - description: Required. - minLength: 1 - type: string - required: - - name - type: object - type: array - reportingInterval: - description: Optional. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: array - selector: - description: Optional. - properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set - of pods/VMs on which a policy should be applied. - maxProperties: 4096 - type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) - type: object - targetRef: - properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: name is the name of the target resource. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: namespace is the namespace of the referent. - type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 - required: - - kind - - name - type: object - targetRefs: - description: Optional. - items: - properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: name is the name of the target resource. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: namespace is the namespace of the referent. - type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently - supported - rule: self.size() == 0 - required: - - kind - - name - type: object - maxItems: 16 - type: array - tracing: - description: Optional. - items: - properties: - customTags: - additionalProperties: - oneOf: - - not: - anyOf: - - required: - - literal - - required: - - environment - - required: - - header - - required: - - formatter - - required: - - literal - - required: - - environment - - required: - - header - - required: - - formatter - properties: - environment: - description: Environment adds the value of an environment - variable to each span. - properties: - defaultValue: - description: Optional. - type: string - name: - description: Name of the environment variable from - which to extract the tag value. - minLength: 1 - type: string - required: - - name - type: object - formatter: - description: Formatter adds the value of access logging - substitution formatter. - properties: - value: - description: The formatter tag value to use, same - formatter as HTTP access logging (e.g. - minLength: 1 - type: string - required: - - value - type: object - header: - description: RequestHeader adds the value of an header - from the request to each span. - properties: - defaultValue: - description: Optional. - type: string - name: - description: Name of the header from which to extract - the tag value. - minLength: 1 - type: string - required: - - name - type: object - literal: - description: Literal adds the same, hard-coded value - to each span. - properties: - value: - description: The tag value to use. - minLength: 1 - type: string - required: - - value - type: object - type: object - description: Optional. - type: object - disableSpanReporting: - description: Controls span reporting. - nullable: true - type: boolean - enableIstioTags: - description: Determines whether or not trace spans generated - by Envoy will include Istio specific tags. - nullable: true - type: boolean - match: - description: Allows tailoring of behavior to specific conditions. - properties: - mode: - description: 'This determines whether or not to apply - the tracing configuration based on the direction of - traffic relative to the proxied workload. - - - Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER' - enum: - - CLIENT_AND_SERVER - - CLIENT - - SERVER - type: string - type: object - providers: - description: Optional. - items: - properties: - name: - description: Required. - minLength: 1 - type: string - required: - - name - type: object - type: array - randomSamplingPercentage: - description: Controls the rate at which traffic will be selected - for tracing if no prior sampling decision has been made. - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - useRequestIdForTraceSampling: - nullable: true - type: boolean - type: object - type: array - type: object - x-kubernetes-validations: - - message: only one of targetRefs or selector can be set - rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : - 0) + (has(self.targetRefs) ? 1 : 0) <= 1' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. - - - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} - - additionalPrinterColumns: - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is - represented in RFC3339 form and is in UTC. Populated by the system. Read-only. - Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1alpha1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Telemetry configuration for workloads. See more details - at: https://istio.io/docs/reference/config/telemetry.html' - properties: - accessLogging: - description: Optional. - items: - properties: - disabled: - description: Controls logging. - nullable: true - type: boolean - filter: - description: Optional. - properties: - expression: - description: CEL expression for selecting when requests/connections - should be logged. - type: string - type: object - match: - description: Allows tailoring of logging behavior to specific - conditions. - properties: - mode: - description: 'This determines whether or not to apply - the access logging configuration based on the direction - of traffic relative to the proxied workload. - - - Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER' - enum: - - CLIENT_AND_SERVER - - CLIENT - - SERVER - type: string - type: object - providers: - description: Optional. - items: - properties: - name: - description: Required. - minLength: 1 - type: string - required: - - name - type: object - type: array - type: object - type: array - metrics: - description: Optional. - items: - properties: - overrides: - description: Optional. - items: - properties: - disabled: - description: Optional. - nullable: true - type: boolean - match: - description: Match allows providing the scope of the - override. - oneOf: - - not: - anyOf: - - required: - - metric - - required: - - customMetric - - required: - - metric - - required: - - customMetric - properties: - customMetric: - description: Allows free-form specification of a - metric. - minLength: 1 - type: string - metric: - description: 'One of the well-known [Istio Standard - Metrics](https://istio.io/latest/docs/reference/config/metrics/). - - - Valid Options: ALL_METRICS, REQUEST_COUNT, REQUEST_DURATION, - REQUEST_SIZE, RESPONSE_SIZE, TCP_OPENED_CONNECTIONS, - TCP_CLOSED_CONNECTIONS, TCP_SENT_BYTES, TCP_RECEIVED_BYTES, - GRPC_REQUEST_MESSAGES, GRPC_RESPONSE_MESSAGES' - enum: - - ALL_METRICS - - REQUEST_COUNT - - REQUEST_DURATION - - REQUEST_SIZE - - RESPONSE_SIZE - - TCP_OPENED_CONNECTIONS - - TCP_CLOSED_CONNECTIONS - - TCP_SENT_BYTES - - TCP_RECEIVED_BYTES - - GRPC_REQUEST_MESSAGES - - GRPC_RESPONSE_MESSAGES - type: string - mode: - description: 'Controls which mode of metrics generation - is selected: `CLIENT`, `SERVER`, or `CLIENT_AND_SERVER`. - - - Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER' - enum: - - CLIENT_AND_SERVER - - CLIENT - - SERVER - type: string - type: object - tagOverrides: - additionalProperties: - properties: - operation: - description: 'Operation controls whether or not - to update/add a tag, or to remove it. - - - Valid Options: UPSERT, REMOVE' - enum: - - UPSERT - - REMOVE - type: string - value: - description: Value is only considered if the operation - is `UPSERT`. - type: string - type: object - x-kubernetes-validations: - - message: value must be set when operation is UPSERT - rule: '((has(self.operation) ? self.operation - : "") == "UPSERT") ? (self.value != "") : true' - - message: value must not be set when operation - is REMOVE - rule: '((has(self.operation) ? self.operation - : "") == "REMOVE") ? !has(self.value) : true' - description: Optional. - type: object - type: object - type: array - providers: - description: Optional. - items: - properties: - name: - description: Required. - minLength: 1 - type: string - required: - - name - type: object - type: array - reportingInterval: - description: Optional. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: array - selector: - description: Optional. - properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set - of pods/VMs on which a policy should be applied. - maxProperties: 4096 - type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) - type: object - targetRef: - properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: name is the name of the target resource. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: namespace is the namespace of the referent. - type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 - required: - - kind - - name - type: object - targetRefs: - description: Optional. - items: - properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: name is the name of the target resource. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: namespace is the namespace of the referent. - type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently - supported - rule: self.size() == 0 - required: - - kind - - name - type: object - maxItems: 16 - type: array - tracing: - description: Optional. - items: - properties: - customTags: - additionalProperties: - oneOf: - - not: - anyOf: - - required: - - literal - - required: - - environment - - required: - - header - - required: - - formatter - - required: - - literal - - required: - - environment - - required: - - header - - required: - - formatter - properties: - environment: - description: Environment adds the value of an environment - variable to each span. - properties: - defaultValue: - description: Optional. - type: string - name: - description: Name of the environment variable from - which to extract the tag value. - minLength: 1 - type: string - required: - - name - type: object - formatter: - description: Formatter adds the value of access logging - substitution formatter. - properties: - value: - description: The formatter tag value to use, same - formatter as HTTP access logging (e.g. - minLength: 1 - type: string - required: - - value - type: object - header: - description: RequestHeader adds the value of an header - from the request to each span. - properties: - defaultValue: - description: Optional. - type: string - name: - description: Name of the header from which to extract - the tag value. - minLength: 1 - type: string - required: - - name - type: object - literal: - description: Literal adds the same, hard-coded value - to each span. - properties: - value: - description: The tag value to use. - minLength: 1 - type: string - required: - - value - type: object - type: object - description: Optional. - type: object - disableSpanReporting: - description: Controls span reporting. - nullable: true - type: boolean - enableIstioTags: - description: Determines whether or not trace spans generated - by Envoy will include Istio specific tags. - nullable: true - type: boolean - match: - description: Allows tailoring of behavior to specific conditions. - properties: - mode: - description: 'This determines whether or not to apply - the tracing configuration based on the direction of - traffic relative to the proxied workload. - - - Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER' - enum: - - CLIENT_AND_SERVER - - CLIENT - - SERVER - type: string - type: object - providers: - description: Optional. - items: - properties: - name: - description: Required. - minLength: 1 - type: string - required: - - name - type: object - type: array - randomSamplingPercentage: - description: Controls the rate at which traffic will be selected - for tracing if no prior sampling decision has been made. - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - useRequestIdForTraceSampling: - nullable: true - type: boolean - type: object - type: array - type: object - x-kubernetes-validations: - - message: only one of targetRefs or selector can be set - rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : - 0) + (has(self.targetRefs) ? 1 : 0) <= 1' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. - - - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - helm.sh/resource-policy: keep - labels: - app.kubernetes.io/instance: istio - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.4 - helm.sh/chart: base-1.29.4 - name: virtualservices.networking.istio.io -spec: - group: networking.istio.io - names: - categories: - - istio-io - - networking-istio-io - kind: VirtualService - listKind: VirtualServiceList - plural: virtualservices - shortNames: - - vs - singular: virtualservice - scope: Namespaced - versions: - - additionalPrinterColumns: - - description: The names of gateways and sidecars that should apply these - routes - jsonPath: .spec.gateways - name: Gateways - type: string - - description: The destination hosts to which traffic is being sent - jsonPath: .spec.hosts - name: Hosts - type: string - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is - represented in RFC3339 form and is in UTC. Populated by the system. Read-only. - Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting label/content routing, sni routing, - etc. See more details at: https://istio.io/docs/reference/config/networking/virtual-service.html' - properties: - exportTo: - description: A list of namespaces to which this virtual service - is exported. - items: - type: string - type: array - gateways: - description: The names of gateways and sidecars that should apply - these routes. - items: - type: string - type: array - hosts: - description: The destination hosts to which traffic is being sent. - items: - type: string - type: array - http: - description: An ordered list of route rules for HTTP traffic. - items: - properties: - corsPolicy: - description: Cross-Origin Resource Sharing policy (CORS). - properties: - allowCredentials: - description: Indicates whether the caller is allowed to - send the actual request (not the preflight) using credentials. - nullable: true - type: boolean - allowHeaders: - description: List of HTTP headers that can be used when - requesting the resource. - items: - type: string - type: array - allowMethods: - description: List of HTTP methods allowed to access the - resource. - items: - type: string - type: array - allowOrigin: - items: - type: string - type: array - allowOrigins: - description: String patterns that match allowed origins. - items: - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - type: array - exposeHeaders: - description: A list of HTTP headers that the browsers - are allowed to access. - items: + maxConnectionDuration: + description: The maximum duration of a connection. type: string - type: array - maxAge: - description: Specifies how long the results of a preflight - request can be cached. - type: string - x-kubernetes-validations: + x-kubernetes-validations: - message: must be a valid duration greater than 1ms rule: duration(self) >= duration('1ms') - unmatchedPreflights: - description: 'Indicates whether preflight requests not - matching the configured allowed origin shouldn''t be - forwarded to the upstream. - - - Valid Options: FORWARD, IGNORE' - enum: - - UNSPECIFIED - - FORWARD - - IGNORE - type: string - type: object - delegate: - description: Delegate is used to specify the particular VirtualService - which can be used to define delegate HTTPRoute. - properties: - name: - description: Name specifies the name of the delegate VirtualService. - type: string - namespace: - description: Namespace specifies the namespace where the - delegate VirtualService resides. - type: string - type: object - directResponse: - description: A HTTP rule can either return a direct_response, - redirect or forward (default) traffic. - properties: - body: - description: Specifies the content of the response body. - oneOf: - - not: - anyOf: - - required: - - string - - required: - - bytes - - required: - - string - - required: - - bytes - properties: - bytes: - description: response body as base64 encoded bytes. - format: byte - type: string - string: - type: string - type: object - status: - description: Specifies the HTTP response status to be - returned. - maximum: 4294967295 - minimum: 0 - type: integer - required: - - status - type: object - fault: - description: Fault injection policy to apply on HTTP traffic - at the client side. - properties: - abort: - description: Abort Http request attempts and return error - codes back to downstream service, giving the impression - that the upstream service is faulty. - oneOf: - - not: - anyOf: - - required: - - httpStatus - - required: - - grpcStatus - - required: - - http2Error - - required: - - httpStatus - - required: - - grpcStatus - - required: - - http2Error - properties: - grpcStatus: - description: GRPC status code to use to abort the - request. - type: string - http2Error: - type: string - httpStatus: - description: HTTP status code to use to abort the - Http request. - format: int32 - type: integer - percentage: - description: Percentage of requests to be aborted - with the error code provided. - properties: - value: - format: double - type: number - type: object - type: object - delay: - description: Delay requests before forwarding, emulating - various failures such as network issues, overloaded - upstream service, etc. - oneOf: - - not: - anyOf: - - required: - - fixedDelay - - required: - - exponentialDelay - - required: - - fixedDelay - - required: - - exponentialDelay - properties: - exponentialDelay: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - fixedDelay: - description: Add a fixed delay before forwarding the - request. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - percent: - description: Percentage of requests on which the delay - will be injected (0-100). - format: int32 - type: integer - percentage: - description: Percentage of requests on which the delay - will be injected. - properties: - value: - format: double - type: number - type: object - type: object - type: object - headers: - properties: - request: - properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object - type: object - response: - properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object - type: object - type: object - match: - description: Match conditions to be satisfied for the rule - to be activated. - items: - properties: - authority: - description: 'HTTP Authority values are case-sensitive - and formatted as follows: - `exact: "value"` for exact - string match - `prefix: "value"` for prefix-based - match - `regex: "value"` for [RE2 style regex-based - match](https://github.com/google/re2/wiki/Syntax).' - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - gateways: - description: Names of gateways where the rule should - be applied. - items: - type: string - type: array - headers: - additionalProperties: - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - description: The header keys must be lowercase and use - hyphen as the separator, e.g. - type: object - ignoreUriCase: - description: Flag to specify whether the URI matching - should be case-insensitive. - type: boolean - method: - description: 'HTTP Method values are case-sensitive - and formatted as follows: - `exact: "value"` for exact - string match - `prefix: "value"` for prefix-based - match - `regex: "value"` for [RE2 style regex-based - match](https://github.com/google/re2/wiki/Syntax).' - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - name: - description: The name assigned to a match. - type: string - port: - description: Specifies the ports on the host that is - being addressed. - maximum: 4294967295 - minimum: 0 + maxConnections: + description: Maximum number of HTTP1 /TCP connections + to a destination host. + format: int32 type: integer - queryParams: - additionalProperties: - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - description: Query parameters for matching. - type: object - scheme: - description: 'URI Scheme values are case-sensitive and - formatted as follows: - `exact: "value"` for exact - string match - `prefix: "value"` for prefix-based - match - `regex: "value"` for [RE2 style regex-based - match](https://github.com/google/re2/wiki/Syntax).' - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - sourceLabels: - additionalProperties: - type: string - description: One or more labels that constrain the applicability - of a rule to source (client) workloads with the given - labels. - type: object - sourceNamespace: - description: Source namespace constraining the applicability - of a rule to workloads in that namespace. - type: string - statPrefix: - description: The human readable prefix to use when emitting - statistics for this route. - type: string - uri: - description: 'URI to match values are case-sensitive - and formatted as follows: - `exact: "value"` for exact - string match - `prefix: "value"` for prefix-based - match - `regex: "value"` for [RE2 style regex-based - match](https://github.com/google/re2/wiki/Syntax).' - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket + to enable TCP Keepalives. properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + interval: + description: The time duration between keep-alive + probes. type: string - type: object - withoutHeaders: - additionalProperties: - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - description: withoutHeader has the same syntax with - the header, but has opposite meaning. + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes + to send without response before deciding the connection + is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection needs + to be idle before keep-alive probes start being + sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') type: object type: object - type: array - mirror: - description: Mirror HTTP traffic to a another destination - in addition to forwarding the requests to the intended destination. - properties: - host: - description: The name of a service from the service registry. + type: object + defaultEndpoint: + description: The IP endpoint or Unix domain socket to which + traffic should be forwarded to. + type: string + port: + description: The port associated with the listener. + properties: + name: + description: Label assigned to the port. + type: string + number: + description: A valid non-negative integer port number. + maximum: 4294967295 + minimum: 0 + type: integer + protocol: + description: The protocol exposed on the port. + type: string + targetPort: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + tls: + description: Set of TLS related options that will enable TLS + termination on the sidecar for requests originating from outside + the mesh. + properties: + caCertCredentialName: + description: For mutual TLS, the name of the secret or the + configmap that holds CA certificates. + type: string + caCertificates: + description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing + the certificate revocation list (CRL) to use in verifying + a presented client side certificate.' + type: string + cipherSuites: + description: 'Optional: If specified, only support the specified + cipher list.' + items: type: string - port: - description: Specifies the port on the host that is being - addressed. + type: array + credentialName: + description: For gateways running on Kubernetes, the name + of the secret that holds the TLS certs including the CA + certificates. + type: string + credentialNames: + description: Same as CredentialName but for multiple certificates. + items: + type: string + maxItems: 2 + minItems: 1 + type: array + httpsRedirect: + description: If set to true, the load balancer will send + a 301 redirect for all http connections, asking the clients + to use HTTPS. + type: boolean + maxProtocolVersion: + description: |- + Optional: Maximum TLS protocol version. + + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + minProtocolVersion: + description: |- + Optional: Minimum TLS protocol version. + + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + mode: + description: |- + Optional: Indicates whether connections to this port should be secured using TLS. + + Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL + enum: + - PASSTHROUGH + - SIMPLE + - MUTUAL + - AUTO_PASSTHROUGH + - ISTIO_MUTUAL + - OPTIONAL_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject + identity in the certificate presented by the client. + items: + type: string + type: array + tlsCertificates: + description: Only one of `server_certificate`, `private_key` + or `credential_name` or `credential_names` or `tls_certificates` + should be specified. + items: properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer + caCertificates: + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string type: object - subset: - description: The name of a subset within the service. + maxItems: 2 + minItems: 1 + type: array + verifyCertificateHash: + description: An optional list of hex-encoded SHA-256 hashes + of the authorized client certificates. + items: type: string - required: - - host + type: array + verifyCertificateSpki: + description: An optional list of base64-encoded SHA-256 + hashes of the SPKIs of authorized client certificates. + items: + type: string + type: array + type: object + x-kubernetes-validations: + - message: only one of credentialNames or tlsCertificates can + be set + rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) + ? 1 : 0) <= 1' + - message: only one of credentialName or credentialNames can + be set + rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) + ? 1 : 0) <= 1' + - message: only one of credentialName or tlsCertificates can + be set + rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) + ? 1 : 0) <= 1' + required: + - port + type: object + type: array + outboundTrafficPolicy: + description: Set the default behavior of the sidecar for handling + outbound traffic from the application. + properties: + egressProxy: + properties: + host: + description: The name of a service from the service registry. + type: string + port: + description: Specifies the port on the host that is being + addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer type: object - mirror_percent: - maximum: 4294967295 - minimum: 0 - nullable: true + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + mode: + description: |2- + + + Valid Options: REGISTRY_ONLY, ALLOW_ANY + enum: + - REGISTRY_ONLY + - ALLOW_ANY + type: string + type: object + workloadSelector: + description: Criteria used to select the specific set of pods/VMs + on which this `Sidecar` configuration should be applied. + properties: + labels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard is not supported in selector + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which the configuration should be applied. + maxProperties: 256 + type: object + type: object + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} + - name: v1alpha3 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting network reachability of a sidecar. + See more details at: https://istio.io/docs/reference/config/networking/sidecar.html' + properties: + egress: + description: Egress specifies the configuration of the sidecar for + processing outbound traffic from the attached workload instance + to other services in the mesh. + items: + properties: + bind: + description: The IP(IPv4 or IPv6) or the Unix domain socket + to which the listener should be bound to. + type: string + captureMode: + description: |- + When the bind address is an IP, the captureMode option dictates how traffic to the listener is expected to be captured (or not). + + Valid Options: DEFAULT, IPTABLES, NONE + enum: + - DEFAULT + - IPTABLES + - NONE + type: string + hosts: + description: One or more service hosts exposed by the listener + in `namespace/dnsName` format. + items: + type: string + type: array + port: + description: The port associated with the listener. + properties: + name: + description: Label assigned to the port. + type: string + number: + description: A valid non-negative integer port number. + maximum: 4294967295 + minimum: 0 + type: integer + protocol: + description: The protocol exposed on the port. + type: string + targetPort: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + required: + - hosts + type: object + type: array + inboundConnectionPool: + description: Settings controlling the volume of connections Envoy + will accept from the network. + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will be queued + while waiting for a ready connection pool connection. + format: int32 type: integer - mirrorPercent: - maximum: 4294967295 - minimum: 0 - nullable: true + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection pool + connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams allowed + for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection to + a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding + to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be preserved + while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections to a + destination host. + format: int32 type: integer - mirrorPercentage: - description: Percentage of the traffic to be mirrored by the - `mirror` field. + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket to + enable TCP Keepalives. properties: - value: - format: double - type: number + interval: + description: The time duration between keep-alive probes. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to send + without response before deciding the connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection needs to be + idle before keep-alive probes start being sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') type: object - mirrors: - description: Specifies the destinations to mirror HTTP traffic - in addition to the original destination. - items: + type: object + type: object + ingress: + description: Ingress specifies the configuration of the sidecar for + processing inbound traffic to the attached workload instance. + items: + properties: + bind: + description: The IP(IPv4 or IPv6) to which the listener should + be bound. + type: string + captureMode: + description: |- + The captureMode option dictates how traffic to the listener is expected to be captured (or not). + + Valid Options: DEFAULT, IPTABLES, NONE + enum: + - DEFAULT + - IPTABLES + - NONE + type: string + connectionPool: + description: Settings controlling the volume of connections + Envoy will accept from the network. + properties: + http: + description: HTTP connection pool settings. properties: - destination: - description: Destination specifies the target of the - mirror operation. + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will be + queued while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a + destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection + pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams + allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection + to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding + to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be + preserved while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream + connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections + to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket + to enable TCP Keepalives. properties: - host: - description: The name of a service from the service - registry. + interval: + description: The time duration between keep-alive + probes. type: string - port: - description: Specifies the port on the host that - is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes + to send without response before deciding the connection + is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection needs + to be idle before keep-alive probes start being + sent. type: string - required: - - host - type: object - percentage: - description: Percentage of the traffic to be mirrored - by the `destination` field. - properties: - value: - format: double - type: number + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') type: object - required: - - destination type: object - type: array - name: - description: The name assigned to the route for debugging - purposes. - type: string - redirect: - description: A HTTP rule can either return a direct_response, - redirect or forward (default) traffic. - oneOf: - - not: - anyOf: - - required: - - port - - required: - - derivePort - - required: - - port - - required: - - derivePort - properties: - authority: - description: On a redirect, overwrite the Authority/Host - portion of the URL with this value. + type: object + defaultEndpoint: + description: The IP endpoint or Unix domain socket to which + traffic should be forwarded to. + type: string + port: + description: The port associated with the listener. + properties: + name: + description: Label assigned to the port. + type: string + number: + description: A valid non-negative integer port number. + maximum: 4294967295 + minimum: 0 + type: integer + protocol: + description: The protocol exposed on the port. + type: string + targetPort: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + tls: + description: Set of TLS related options that will enable TLS + termination on the sidecar for requests originating from outside + the mesh. + properties: + caCertCredentialName: + description: For mutual TLS, the name of the secret or the + configmap that holds CA certificates. + type: string + caCertificates: + description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing + the certificate revocation list (CRL) to use in verifying + a presented client side certificate.' + type: string + cipherSuites: + description: 'Optional: If specified, only support the specified + cipher list.' + items: + type: string + type: array + credentialName: + description: For gateways running on Kubernetes, the name + of the secret that holds the TLS certs including the CA + certificates. + type: string + credentialNames: + description: Same as CredentialName but for multiple certificates. + items: type: string - derivePort: - description: 'On a redirect, dynamically set the port: - * FROM_PROTOCOL_DEFAULT: automatically set to 80 for - HTTP and 443 for HTTPS. + maxItems: 2 + minItems: 1 + type: array + httpsRedirect: + description: If set to true, the load balancer will send + a 301 redirect for all http connections, asking the clients + to use HTTPS. + type: boolean + maxProtocolVersion: + description: |- + Optional: Maximum TLS protocol version. + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + minProtocolVersion: + description: |- + Optional: Minimum TLS protocol version. - Valid Options: FROM_PROTOCOL_DEFAULT, FROM_REQUEST_PORT' - enum: - - FROM_PROTOCOL_DEFAULT - - FROM_REQUEST_PORT - type: string - port: - description: On a redirect, overwrite the port portion - of the URL with this value. - maximum: 4294967295 - minimum: 0 - type: integer - redirectCode: - description: On a redirect, Specifies the HTTP status - code to use in the redirect response. - maximum: 4294967295 - minimum: 0 - type: integer - scheme: - description: On a redirect, overwrite the scheme portion - of the URL with this value. - type: string - uri: - description: On a redirect, overwrite the Path portion - of the URL with this value. - type: string - type: object - retries: - description: Retry policy for HTTP requests. - properties: - attempts: - description: Number of retries to be allowed for a given - request. - format: int32 - type: integer - backoff: - description: Specifies the minimum duration between retry - attempts. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - perTryTimeout: - description: Timeout per attempt for a given request, - including the initial call and any retries. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - retryIgnorePreviousHosts: - description: Flag to specify whether the retries should - ignore previously tried hosts during retry. - nullable: true - type: boolean - retryOn: - description: Specifies the conditions under which retry - takes place. - type: string - retryRemoteLocalities: - description: Flag to specify whether the retries should - retry to other localities. - nullable: true - type: boolean - type: object - rewrite: - description: Rewrite HTTP URIs and Authority headers. - properties: - authority: - description: rewrite the Authority/Host header with this - value. - type: string - uri: - description: rewrite the path (or the prefix) portion - of the URI with this value. + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + mode: + description: |- + Optional: Indicates whether connections to this port should be secured using TLS. + + Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL + enum: + - PASSTHROUGH + - SIMPLE + - MUTUAL + - AUTO_PASSTHROUGH + - ISTIO_MUTUAL + - OPTIONAL_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject + identity in the certificate presented by the client. + items: type: string - uriRegexRewrite: - description: rewrite the path portion of the URI with - the specified regex. + type: array + tlsCertificates: + description: Only one of `server_certificate`, `private_key` + or `credential_name` or `credential_names` or `tls_certificates` + should be specified. + items: properties: - match: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + caCertificates: + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. type: string - rewrite: - description: The string that should replace into matching - portions of original URI. + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. type: string type: object + maxItems: 2 + minItems: 1 + type: array + verifyCertificateHash: + description: An optional list of hex-encoded SHA-256 hashes + of the authorized client certificates. + items: + type: string + type: array + verifyCertificateSpki: + description: An optional list of base64-encoded SHA-256 + hashes of the SPKIs of authorized client certificates. + items: + type: string + type: array + type: object + x-kubernetes-validations: + - message: only one of credentialNames or tlsCertificates can + be set + rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) + ? 1 : 0) <= 1' + - message: only one of credentialName or credentialNames can + be set + rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) + ? 1 : 0) <= 1' + - message: only one of credentialName or tlsCertificates can + be set + rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) + ? 1 : 0) <= 1' + required: + - port + type: object + type: array + outboundTrafficPolicy: + description: Set the default behavior of the sidecar for handling + outbound traffic from the application. + properties: + egressProxy: + properties: + host: + description: The name of a service from the service registry. + type: string + port: + description: Specifies the port on the host that is being + addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer type: object - route: - description: A HTTP rule can either return a direct_response, - redirect or forward (default) traffic. - items: - properties: - destination: - description: Destination uniquely identifies the instances - of a service to which the request/connection should - be forwarded to. - properties: - host: - description: The name of a service from the service - registry. - type: string - port: - description: Specifies the port on the host that - is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - headers: - properties: - request: - properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object - type: object - response: - properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object - type: object - type: object - weight: - description: Weight specifies the relative proportion - of traffic to be forwarded to the destination. - format: int32 - type: integer - required: - - destination - type: object - type: array - timeout: - description: Timeout for HTTP requests, default is disabled. + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + mode: + description: |2- + + + Valid Options: REGISTRY_ONLY, ALLOW_ANY + enum: + - REGISTRY_ONLY + - ALLOW_ANY + type: string + type: object + workloadSelector: + description: Criteria used to select the specific set of pods/VMs + on which this `Sidecar` configuration should be applied. + properties: + labels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard is not supported in selector + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which the configuration should be applied. + maxProperties: 256 + type: object + type: object + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} + - name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting network reachability of a sidecar. + See more details at: https://istio.io/docs/reference/config/networking/sidecar.html' + properties: + egress: + description: Egress specifies the configuration of the sidecar for + processing outbound traffic from the attached workload instance + to other services in the mesh. + items: + properties: + bind: + description: The IP(IPv4 or IPv6) or the Unix domain socket + to which the listener should be bound to. + type: string + captureMode: + description: |- + When the bind address is an IP, the captureMode option dictates how traffic to the listener is expected to be captured (or not). + + Valid Options: DEFAULT, IPTABLES, NONE + enum: + - DEFAULT + - IPTABLES + - NONE + type: string + hosts: + description: One or more service hosts exposed by the listener + in `namespace/dnsName` format. + items: + type: string + type: array + port: + description: The port associated with the listener. + properties: + name: + description: Label assigned to the port. + type: string + number: + description: A valid non-negative integer port number. + maximum: 4294967295 + minimum: 0 + type: integer + protocol: + description: The protocol exposed on the port. + type: string + targetPort: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + required: + - hosts + type: object + type: array + inboundConnectionPool: + description: Settings controlling the volume of connections Envoy + will accept from the network. + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will be queued + while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection pool + connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams allowed + for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection to + a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding + to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be preserved + while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream connections. + properties: + connectTimeout: + description: TCP connection timeout. type: string x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections to a + destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket to + enable TCP Keepalives. + properties: + interval: + description: The time duration between keep-alive probes. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to send + without response before deciding the connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection needs to be + idle before keep-alive probes start being sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object type: object - type: array - tcp: - description: An ordered list of route rules for opaque TCP traffic. - items: - properties: - match: - description: Match conditions to be satisfied for the rule - to be activated. - items: + type: object + ingress: + description: Ingress specifies the configuration of the sidecar for + processing inbound traffic to the attached workload instance. + items: + properties: + bind: + description: The IP(IPv4 or IPv6) to which the listener should + be bound. + type: string + captureMode: + description: |- + The captureMode option dictates how traffic to the listener is expected to be captured (or not). + + Valid Options: DEFAULT, IPTABLES, NONE + enum: + - DEFAULT + - IPTABLES + - NONE + type: string + connectionPool: + description: Settings controlling the volume of connections + Envoy will accept from the network. + properties: + http: + description: HTTP connection pool settings. properties: - destinationSubnets: - description: IPv4 or IPv6 ip addresses of destination - with optional subnet. - items: - type: string - type: array - gateways: - description: Names of gateways where the rule should - be applied. - items: - type: string - type: array - port: - description: Specifies the port on the host that is - being addressed. - maximum: 4294967295 - minimum: 0 - type: integer - sourceLabels: - additionalProperties: - type: string - description: One or more labels that constrain the applicability - of a rule to workloads with the given labels. - type: object - sourceNamespace: - description: Source namespace constraining the applicability - of a rule to workloads in that namespace. - type: string - sourceSubnet: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE type: string - type: object - type: array - route: - description: The destination to which the connection should - be forwarded to. - items: - properties: - destination: - description: Destination uniquely identifies the instances - of a service to which the request/connection should - be forwarded to. - properties: - host: - description: The name of a service from the service - registry. - type: string - port: - description: Specifies the port on the host that - is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - weight: - description: Weight specifies the relative proportion - of traffic to be forwarded to the destination. + http1MaxPendingRequests: + description: Maximum number of requests that will be + queued while waiting for a ready connection pool connection. format: int32 type: integer - required: - - destination - type: object - type: array - type: object - type: array - tls: - description: An ordered list of route rule for non-terminated TLS - & HTTPS traffic. - items: - properties: - match: - description: Match conditions to be satisfied for the rule - to be activated. - items: - properties: - destinationSubnets: - description: IPv4 or IPv6 ip addresses of destination - with optional subnet. - items: - type: string - type: array - gateways: - description: Names of gateways where the rule should - be applied. - items: - type: string - type: array - port: - description: Specifies the port on the host that is - being addressed. - maximum: 4294967295 - minimum: 0 + http2MaxRequests: + description: Maximum number of active requests to a + destination. + format: int32 type: integer - sniHosts: - description: SNI (server name indicator) to match on. - items: - type: string - type: array - sourceLabels: - additionalProperties: - type: string - description: One or more labels that constrain the applicability - of a rule to workloads with the given labels. - type: object - sourceNamespace: - description: Source namespace constraining the applicability - of a rule to workloads in that namespace. + idleTimeout: + description: The idle timeout for upstream connection + pool connections. type: string - required: - - sniHosts + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams + allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection + to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding + to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be + preserved while initiating connection to backend. + type: boolean type: object - type: array - route: - description: The destination to which the connection should - be forwarded to. - items: + tcp: + description: Settings common to both HTTP and TCP upstream + connections. properties: - destination: - description: Destination uniquely identifies the instances - of a service to which the request/connection should - be forwarded to. + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections + to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket + to enable TCP Keepalives. properties: - host: - description: The name of a service from the service - registry. + interval: + description: The time duration between keep-alive + probes. type: string - port: - description: Specifies the port on the host that - is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes + to send without response before deciding the connection + is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection needs + to be idle before keep-alive probes start being + sent. type: string - required: - - host + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') type: object - weight: - description: Weight specifies the relative proportion - of traffic to be forwarded to the destination. - format: int32 - type: integer - required: - - destination type: object - type: array + type: object + defaultEndpoint: + description: The IP endpoint or Unix domain socket to which + traffic should be forwarded to. + type: string + port: + description: The port associated with the listener. + properties: + name: + description: Label assigned to the port. + type: string + number: + description: A valid non-negative integer port number. + maximum: 4294967295 + minimum: 0 + type: integer + protocol: + description: The protocol exposed on the port. + type: string + targetPort: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + tls: + description: Set of TLS related options that will enable TLS + termination on the sidecar for requests originating from outside + the mesh. + properties: + caCertCredentialName: + description: For mutual TLS, the name of the secret or the + configmap that holds CA certificates. + type: string + caCertificates: + description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing + the certificate revocation list (CRL) to use in verifying + a presented client side certificate.' + type: string + cipherSuites: + description: 'Optional: If specified, only support the specified + cipher list.' + items: + type: string + type: array + credentialName: + description: For gateways running on Kubernetes, the name + of the secret that holds the TLS certs including the CA + certificates. + type: string + credentialNames: + description: Same as CredentialName but for multiple certificates. + items: + type: string + maxItems: 2 + minItems: 1 + type: array + httpsRedirect: + description: If set to true, the load balancer will send + a 301 redirect for all http connections, asking the clients + to use HTTPS. + type: boolean + maxProtocolVersion: + description: |- + Optional: Maximum TLS protocol version. + + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + minProtocolVersion: + description: |- + Optional: Minimum TLS protocol version. + + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + mode: + description: |- + Optional: Indicates whether connections to this port should be secured using TLS. + + Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL + enum: + - PASSTHROUGH + - SIMPLE + - MUTUAL + - AUTO_PASSTHROUGH + - ISTIO_MUTUAL + - OPTIONAL_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject + identity in the certificate presented by the client. + items: + type: string + type: array + tlsCertificates: + description: Only one of `server_certificate`, `private_key` + or `credential_name` or `credential_names` or `tls_certificates` + should be specified. + items: + properties: + caCertificates: + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + type: object + maxItems: 2 + minItems: 1 + type: array + verifyCertificateHash: + description: An optional list of hex-encoded SHA-256 hashes + of the authorized client certificates. + items: + type: string + type: array + verifyCertificateSpki: + description: An optional list of base64-encoded SHA-256 + hashes of the SPKIs of authorized client certificates. + items: + type: string + type: array + type: object + x-kubernetes-validations: + - message: only one of credentialNames or tlsCertificates can + be set + rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) + ? 1 : 0) <= 1' + - message: only one of credentialName or credentialNames can + be set + rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) + ? 1 : 0) <= 1' + - message: only one of credentialName or tlsCertificates can + be set + rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) + ? 1 : 0) <= 1' + required: + - port + type: object + type: array + outboundTrafficPolicy: + description: Set the default behavior of the sidecar for handling + outbound traffic from the application. + properties: + egressProxy: + properties: + host: + description: The name of a service from the service registry. + type: string + port: + description: Specifies the port on the host that is being + addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string required: - - match + - host type: object - type: array - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string + mode: + description: |2- + + + Valid Options: REGISTRY_ONLY, ALLOW_ANY + enum: + - REGISTRY_ONLY + - ALLOW_ANY + type: string + type: object + workloadSelector: + description: Criteria used to select the specific set of pods/VMs + on which this `Sidecar` configuration should be applied. + properties: + labels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard is not supported in selector + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which the configuration should be applied. + maxProperties: 256 type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. + type: object + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: istio + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/part-of: istio + app.kubernetes.io/version: 1.29.4 + helm.sh/chart: base-1.29.4 + name: telemetries.telemetry.istio.io +spec: + group: telemetry.istio.io + names: + categories: + - istio-io + - telemetry-istio-io + kind: Telemetry + listKind: TelemetryList + plural: telemetries + shortNames: + - telemetry + singular: telemetry + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Telemetry configuration for workloads. See more details + at: https://istio.io/docs/reference/config/telemetry.html' + properties: + accessLogging: + description: Optional. + items: + properties: + disabled: + description: Controls logging. + nullable: true + type: boolean + filter: + description: Optional. + properties: + expression: + description: CEL expression for selecting when requests/connections + should be logged. + type: string + type: object + match: + description: Allows tailoring of logging behavior to specific + conditions. + properties: + mode: + description: |- + This determines whether or not to apply the access logging configuration based on the direction of traffic relative to the proxied workload. - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: + Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER + enum: + - CLIENT_AND_SERVER + - CLIENT + - SERVER + type: string + type: object + providers: + description: Optional. + items: properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string name: - description: A human-readable name for the message type. + description: Required. + minLength: 1 type: string + required: + - name type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} - - additionalPrinterColumns: - - description: The names of gateways and sidecars that should apply these - routes - jsonPath: .spec.gateways - name: Gateways - type: string - - description: The destination hosts to which traffic is being sent - jsonPath: .spec.hosts - name: Hosts - type: string - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is - represented in RFC3339 form and is in UTC. Populated by the system. Read-only. - Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1alpha3 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting label/content routing, sni routing, - etc. See more details at: https://istio.io/docs/reference/config/networking/virtual-service.html' - properties: - exportTo: - description: A list of namespaces to which this virtual service - is exported. - items: - type: string - type: array - gateways: - description: The names of gateways and sidecars that should apply - these routes. - items: - type: string - type: array - hosts: - description: The destination hosts to which traffic is being sent. - items: - type: string - type: array - http: - description: An ordered list of route rules for HTTP traffic. - items: - properties: - corsPolicy: - description: Cross-Origin Resource Sharing policy (CORS). + type: array + type: object + type: array + metrics: + description: Optional. + items: + properties: + overrides: + description: Optional. + items: properties: - allowCredentials: - description: Indicates whether the caller is allowed to - send the actual request (not the preflight) using credentials. + disabled: + description: Optional. nullable: true type: boolean - allowHeaders: - description: List of HTTP headers that can be used when - requesting the resource. - items: - type: string - type: array - allowMethods: - description: List of HTTP methods allowed to access the - resource. - items: - type: string - type: array - allowOrigin: - items: - type: string - type: array - allowOrigins: - description: String patterns that match allowed origins. - items: - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact + match: + description: Match allows providing the scope of the override. + oneOf: + - not: + anyOf: - required: - - prefix + - metric - required: - - regex + - customMetric + - required: + - metric + - required: + - customMetric + properties: + customMetric: + description: Allows free-form specification of a metric. + minLength: 1 + type: string + metric: + description: |- + One of the well-known [Istio Standard Metrics](https://istio.io/latest/docs/reference/config/metrics/). + + Valid Options: ALL_METRICS, REQUEST_COUNT, REQUEST_DURATION, REQUEST_SIZE, RESPONSE_SIZE, TCP_OPENED_CONNECTIONS, TCP_CLOSED_CONNECTIONS, TCP_SENT_BYTES, TCP_RECEIVED_BYTES, GRPC_REQUEST_MESSAGES, GRPC_RESPONSE_MESSAGES + enum: + - ALL_METRICS + - REQUEST_COUNT + - REQUEST_DURATION + - REQUEST_SIZE + - RESPONSE_SIZE + - TCP_OPENED_CONNECTIONS + - TCP_CLOSED_CONNECTIONS + - TCP_SENT_BYTES + - TCP_RECEIVED_BYTES + - GRPC_REQUEST_MESSAGES + - GRPC_RESPONSE_MESSAGES + type: string + mode: + description: |- + Controls which mode of metrics generation is selected: `CLIENT`, `SERVER`, or `CLIENT_AND_SERVER`. + + Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER + enum: + - CLIENT_AND_SERVER + - CLIENT + - SERVER + type: string + type: object + tagOverrides: + additionalProperties: properties: - exact: - type: string - prefix: + operation: + description: |- + Operation controls whether or not to update/add a tag, or to remove it. + + Valid Options: UPSERT, REMOVE + enum: + - UPSERT + - REMOVE type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + value: + description: Value is only considered if the operation + is `UPSERT`. type: string type: object - type: array - exposeHeaders: - description: A list of HTTP headers that the browsers - are allowed to access. - items: - type: string - type: array - maxAge: - description: Specifies how long the results of a preflight - request can be cached. + x-kubernetes-validations: + - message: value must be set when operation is UPSERT + rule: '((has(self.operation) ? self.operation : "") + == "UPSERT") ? (self.value != "") : true' + - message: value must not be set when operation is REMOVE + rule: '((has(self.operation) ? self.operation : "") + == "REMOVE") ? !has(self.value) : true' + description: Optional. + type: object + type: object + type: array + providers: + description: Optional. + items: + properties: + name: + description: Required. + minLength: 1 type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - unmatchedPreflights: - description: 'Indicates whether preflight requests not - matching the configured allowed origin shouldn''t be - forwarded to the upstream. + required: + - name + type: object + type: array + reportingInterval: + description: Optional. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + type: array + selector: + description: Optional. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + targetRef: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name + type: object + targetRefs: + description: Optional. + items: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name + type: object + maxItems: 16 + type: array + tracing: + description: Optional. + items: + properties: + customTags: + additionalProperties: + oneOf: + - not: + anyOf: + - required: + - literal + - required: + - environment + - required: + - header + - required: + - formatter + - required: + - literal + - required: + - environment + - required: + - header + - required: + - formatter + properties: + environment: + description: Environment adds the value of an environment + variable to each span. + properties: + defaultValue: + description: Optional. + type: string + name: + description: Name of the environment variable from + which to extract the tag value. + minLength: 1 + type: string + required: + - name + type: object + formatter: + description: Formatter adds the value of access logging + substitution formatter. + properties: + value: + description: The formatter tag value to use, same + formatter as HTTP access logging (e.g. + minLength: 1 + type: string + required: + - value + type: object + header: + description: RequestHeader adds the value of an header + from the request to each span. + properties: + defaultValue: + description: Optional. + type: string + name: + description: Name of the header from which to extract + the tag value. + minLength: 1 + type: string + required: + - name + type: object + literal: + description: Literal adds the same, hard-coded value to + each span. + properties: + value: + description: The tag value to use. + minLength: 1 + type: string + required: + - value + type: object + type: object + description: Optional. + type: object + disableSpanReporting: + description: Controls span reporting. + nullable: true + type: boolean + enableIstioTags: + description: Determines whether or not trace spans generated + by Envoy will include Istio specific tags. + nullable: true + type: boolean + match: + description: Allows tailoring of behavior to specific conditions. + properties: + mode: + description: |- + This determines whether or not to apply the tracing configuration based on the direction of traffic relative to the proxied workload. + + Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER + enum: + - CLIENT_AND_SERVER + - CLIENT + - SERVER + type: string + type: object + providers: + description: Optional. + items: + properties: + name: + description: Required. + minLength: 1 + type: string + required: + - name + type: object + type: array + randomSamplingPercentage: + description: Controls the rate at which traffic will be selected + for tracing if no prior sampling decision has been made. + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + useRequestIdForTraceSampling: + nullable: true + type: boolean + type: object + type: array + type: object + x-kubernetes-validations: + - message: only one of targetRefs or selector can be set + rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + + (has(self.targetRefs) ? 1 : 0) <= 1' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Telemetry configuration for workloads. See more details + at: https://istio.io/docs/reference/config/telemetry.html' + properties: + accessLogging: + description: Optional. + items: + properties: + disabled: + description: Controls logging. + nullable: true + type: boolean + filter: + description: Optional. + properties: + expression: + description: CEL expression for selecting when requests/connections + should be logged. + type: string + type: object + match: + description: Allows tailoring of logging behavior to specific + conditions. + properties: + mode: + description: |- + This determines whether or not to apply the access logging configuration based on the direction of traffic relative to the proxied workload. - Valid Options: FORWARD, IGNORE' - enum: - - UNSPECIFIED - - FORWARD - - IGNORE - type: string - type: object - delegate: - description: Delegate is used to specify the particular VirtualService - which can be used to define delegate HTTPRoute. + Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER + enum: + - CLIENT_AND_SERVER + - CLIENT + - SERVER + type: string + type: object + providers: + description: Optional. + items: properties: name: - description: Name specifies the name of the delegate VirtualService. - type: string - namespace: - description: Namespace specifies the namespace where the - delegate VirtualService resides. + description: Required. + minLength: 1 type: string + required: + - name type: object - directResponse: - description: A HTTP rule can either return a direct_response, - redirect or forward (default) traffic. + type: array + type: object + type: array + metrics: + description: Optional. + items: + properties: + overrides: + description: Optional. + items: properties: - body: - description: Specifies the content of the response body. + disabled: + description: Optional. + nullable: true + type: boolean + match: + description: Match allows providing the scope of the override. oneOf: - - not: - anyOf: - - required: - - string - - required: - - bytes - - required: - - string - - required: - - bytes + - not: + anyOf: + - required: + - metric + - required: + - customMetric + - required: + - metric + - required: + - customMetric properties: - bytes: - description: response body as base64 encoded bytes. - format: byte + customMetric: + description: Allows free-form specification of a metric. + minLength: 1 + type: string + metric: + description: |- + One of the well-known [Istio Standard Metrics](https://istio.io/latest/docs/reference/config/metrics/). + + Valid Options: ALL_METRICS, REQUEST_COUNT, REQUEST_DURATION, REQUEST_SIZE, RESPONSE_SIZE, TCP_OPENED_CONNECTIONS, TCP_CLOSED_CONNECTIONS, TCP_SENT_BYTES, TCP_RECEIVED_BYTES, GRPC_REQUEST_MESSAGES, GRPC_RESPONSE_MESSAGES + enum: + - ALL_METRICS + - REQUEST_COUNT + - REQUEST_DURATION + - REQUEST_SIZE + - RESPONSE_SIZE + - TCP_OPENED_CONNECTIONS + - TCP_CLOSED_CONNECTIONS + - TCP_SENT_BYTES + - TCP_RECEIVED_BYTES + - GRPC_REQUEST_MESSAGES + - GRPC_RESPONSE_MESSAGES type: string - string: + mode: + description: |- + Controls which mode of metrics generation is selected: `CLIENT`, `SERVER`, or `CLIENT_AND_SERVER`. + + Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER + enum: + - CLIENT_AND_SERVER + - CLIENT + - SERVER type: string type: object - status: - description: Specifies the HTTP response status to be - returned. - maximum: 4294967295 - minimum: 0 - type: integer + tagOverrides: + additionalProperties: + properties: + operation: + description: |- + Operation controls whether or not to update/add a tag, or to remove it. + + Valid Options: UPSERT, REMOVE + enum: + - UPSERT + - REMOVE + type: string + value: + description: Value is only considered if the operation + is `UPSERT`. + type: string + type: object + x-kubernetes-validations: + - message: value must be set when operation is UPSERT + rule: '((has(self.operation) ? self.operation : "") + == "UPSERT") ? (self.value != "") : true' + - message: value must not be set when operation is REMOVE + rule: '((has(self.operation) ? self.operation : "") + == "REMOVE") ? !has(self.value) : true' + description: Optional. + type: object + type: object + type: array + providers: + description: Optional. + items: + properties: + name: + description: Required. + minLength: 1 + type: string required: - - status + - name type: object - fault: - description: Fault injection policy to apply on HTTP traffic - at the client side. + type: array + reportingInterval: + description: Optional. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + type: array + selector: + description: Optional. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + targetRef: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name + type: object + targetRefs: + description: Optional. + items: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name + type: object + maxItems: 16 + type: array + tracing: + description: Optional. + items: + properties: + customTags: + additionalProperties: + oneOf: + - not: + anyOf: + - required: + - literal + - required: + - environment + - required: + - header + - required: + - formatter + - required: + - literal + - required: + - environment + - required: + - header + - required: + - formatter properties: - abort: - description: Abort Http request attempts and return error - codes back to downstream service, giving the impression - that the upstream service is faulty. - oneOf: - - not: - anyOf: - - required: - - httpStatus - - required: - - grpcStatus - - required: - - http2Error - - required: - - httpStatus - - required: - - grpcStatus - - required: - - http2Error + environment: + description: Environment adds the value of an environment + variable to each span. properties: - grpcStatus: - description: GRPC status code to use to abort the - request. + defaultValue: + description: Optional. type: string - http2Error: + name: + description: Name of the environment variable from + which to extract the tag value. + minLength: 1 type: string - httpStatus: - description: HTTP status code to use to abort the - Http request. - format: int32 - type: integer - percentage: - description: Percentage of requests to be aborted - with the error code provided. - properties: - value: - format: double - type: number - type: object + required: + - name type: object - delay: - description: Delay requests before forwarding, emulating - various failures such as network issues, overloaded - upstream service, etc. - oneOf: - - not: - anyOf: - - required: - - fixedDelay - - required: - - exponentialDelay - - required: - - fixedDelay - - required: - - exponentialDelay + formatter: + description: Formatter adds the value of access logging + substitution formatter. properties: - exponentialDelay: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - fixedDelay: - description: Add a fixed delay before forwarding the - request. + value: + description: The formatter tag value to use, same + formatter as HTTP access logging (e.g. + minLength: 1 type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - percent: - description: Percentage of requests on which the delay - will be injected (0-100). - format: int32 - type: integer - percentage: - description: Percentage of requests on which the delay - will be injected. - properties: - value: - format: double - type: number - type: object + required: + - value type: object - type: object - headers: - properties: - request: + header: + description: RequestHeader adds the value of an header + from the request to each span. properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object + defaultValue: + description: Optional. + type: string + name: + description: Name of the header from which to extract + the tag value. + minLength: 1 + type: string + required: + - name type: object - response: + literal: + description: Literal adds the same, hard-coded value to + each span. properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object + value: + description: The tag value to use. + minLength: 1 + type: string + required: + - value type: object type: object - match: - description: Match conditions to be satisfied for the rule - to be activated. - items: - properties: - authority: - description: 'HTTP Authority values are case-sensitive - and formatted as follows: - `exact: "value"` for exact - string match - `prefix: "value"` for prefix-based - match - `regex: "value"` for [RE2 style regex-based - match](https://github.com/google/re2/wiki/Syntax).' - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex + description: Optional. + type: object + disableSpanReporting: + description: Controls span reporting. + nullable: true + type: boolean + enableIstioTags: + description: Determines whether or not trace spans generated + by Envoy will include Istio specific tags. + nullable: true + type: boolean + match: + description: Allows tailoring of behavior to specific conditions. + properties: + mode: + description: |- + This determines whether or not to apply the tracing configuration based on the direction of traffic relative to the proxied workload. + + Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER + enum: + - CLIENT_AND_SERVER + - CLIENT + - SERVER + type: string + type: object + providers: + description: Optional. + items: + properties: + name: + description: Required. + minLength: 1 + type: string + required: + - name + type: object + type: array + randomSamplingPercentage: + description: Controls the rate at which traffic will be selected + for tracing if no prior sampling decision has been made. + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + useRequestIdForTraceSampling: + nullable: true + type: boolean + type: object + type: array + type: object + x-kubernetes-validations: + - message: only one of targetRefs or selector can be set + rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + + (has(self.targetRefs) ? 1 : 0) <= 1' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: istio + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/part-of: istio + app.kubernetes.io/version: 1.29.4 + helm.sh/chart: base-1.29.4 + name: virtualservices.networking.istio.io +spec: + group: networking.istio.io + names: + categories: + - istio-io + - networking-istio-io + kind: VirtualService + listKind: VirtualServiceList + plural: virtualservices + shortNames: + - vs + singular: virtualservice + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: The names of gateways and sidecars that should apply these routes + jsonPath: .spec.gateways + name: Gateways + type: string + - description: The destination hosts to which traffic is being sent + jsonPath: .spec.hosts + name: Hosts + type: string + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting label/content routing, sni routing, + etc. See more details at: https://istio.io/docs/reference/config/networking/virtual-service.html' + properties: + exportTo: + description: A list of namespaces to which this virtual service is + exported. + items: + type: string + type: array + gateways: + description: The names of gateways and sidecars that should apply + these routes. + items: + type: string + type: array + hosts: + description: The destination hosts to which traffic is being sent. + items: + type: string + type: array + http: + description: An ordered list of route rules for HTTP traffic. + items: + properties: + corsPolicy: + description: Cross-Origin Resource Sharing policy (CORS). + properties: + allowCredentials: + description: Indicates whether the caller is allowed to + send the actual request (not the preflight) using credentials. + nullable: true + type: boolean + allowHeaders: + description: List of HTTP headers that can be used when + requesting the resource. + items: + type: string + type: array + allowMethods: + description: List of HTTP methods allowed to access the + resource. + items: + type: string + type: array + allowOrigin: + items: + type: string + type: array + allowOrigins: + description: String patterns that match allowed origins. + items: + oneOf: + - not: + anyOf: - required: - - exact + - exact - required: - - prefix + - prefix - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - gateways: - description: Names of gateways where the rule should - be applied. - items: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: type: string - type: array - headers: - additionalProperties: - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - description: The header keys must be lowercase and use - hyphen as the separator, e.g. - type: object - ignoreUriCase: - description: Flag to specify whether the URI matching - should be case-insensitive. - type: boolean - method: - description: 'HTTP Method values are case-sensitive - and formatted as follows: - `exact: "value"` for exact - string match - `prefix: "value"` for prefix-based - match - `regex: "value"` for [RE2 style regex-based - match](https://github.com/google/re2/wiki/Syntax).' - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - name: - description: The name assigned to a match. - type: string - port: - description: Specifies the ports on the host that is - being addressed. - maximum: 4294967295 - minimum: 0 - type: integer - queryParams: - additionalProperties: - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - description: Query parameters for matching. - type: object - scheme: - description: 'URI Scheme values are case-sensitive and - formatted as follows: - `exact: "value"` for exact - string match - `prefix: "value"` for prefix-based - match - `regex: "value"` for [RE2 style regex-based - match](https://github.com/google/re2/wiki/Syntax).' - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - sourceLabels: - additionalProperties: + prefix: type: string - description: One or more labels that constrain the applicability - of a rule to source (client) workloads with the given - labels. - type: object - sourceNamespace: - description: Source namespace constraining the applicability - of a rule to workloads in that namespace. + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + type: array + exposeHeaders: + description: A list of HTTP headers that the browsers are + allowed to access. + items: + type: string + type: array + maxAge: + description: Specifies how long the results of a preflight + request can be cached. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + unmatchedPreflights: + description: |- + Indicates whether preflight requests not matching the configured allowed origin shouldn't be forwarded to the upstream. + + Valid Options: FORWARD, IGNORE + enum: + - UNSPECIFIED + - FORWARD + - IGNORE + type: string + type: object + delegate: + description: Delegate is used to specify the particular VirtualService + which can be used to define delegate HTTPRoute. + properties: + name: + description: Name specifies the name of the delegate VirtualService. + type: string + namespace: + description: Namespace specifies the namespace where the + delegate VirtualService resides. + type: string + type: object + directResponse: + description: A HTTP rule can either return a direct_response, + redirect or forward (default) traffic. + properties: + body: + description: Specifies the content of the response body. + oneOf: + - not: + anyOf: + - required: + - string + - required: + - bytes + - required: + - string + - required: + - bytes + properties: + bytes: + description: response body as base64 encoded bytes. + format: byte type: string - statPrefix: - description: The human readable prefix to use when emitting - statistics for this route. + string: type: string - uri: - description: 'URI to match values are case-sensitive - and formatted as follows: - `exact: "value"` for exact - string match - `prefix: "value"` for prefix-based - match - `regex: "value"` for [RE2 style regex-based - match](https://github.com/google/re2/wiki/Syntax).' - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - withoutHeaders: - additionalProperties: - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - description: withoutHeader has the same syntax with - the header, but has opposite meaning. - type: object type: object - type: array - mirror: - description: Mirror HTTP traffic to a another destination - in addition to forwarding the requests to the intended destination. - properties: - host: - description: The name of a service from the service registry. - type: string - port: - description: Specifies the port on the host that is being - addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - mirror_percent: - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - mirrorPercent: - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - mirrorPercentage: - description: Percentage of the traffic to be mirrored by the - `mirror` field. - properties: - value: - format: double - type: number - type: object - mirrors: - description: Specifies the destinations to mirror HTTP traffic - in addition to the original destination. - items: + status: + description: Specifies the HTTP response status to be returned. + maximum: 4294967295 + minimum: 0 + type: integer + required: + - status + type: object + fault: + description: Fault injection policy to apply on HTTP traffic + at the client side. + properties: + abort: + description: Abort Http request attempts and return error + codes back to downstream service, giving the impression + that the upstream service is faulty. + oneOf: + - not: + anyOf: + - required: + - httpStatus + - required: + - grpcStatus + - required: + - http2Error + - required: + - httpStatus + - required: + - grpcStatus + - required: + - http2Error properties: - destination: - description: Destination specifies the target of the - mirror operation. - properties: - host: - description: The name of a service from the service - registry. - type: string - port: - description: Specifies the port on the host that - is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object + grpcStatus: + description: GRPC status code to use to abort the request. + type: string + http2Error: + type: string + httpStatus: + description: HTTP status code to use to abort the Http + request. + format: int32 + type: integer percentage: - description: Percentage of the traffic to be mirrored - by the `destination` field. + description: Percentage of requests to be aborted with + the error code provided. properties: value: format: double type: number type: object - required: - - destination type: object - type: array - name: - description: The name assigned to the route for debugging - purposes. - type: string - redirect: - description: A HTTP rule can either return a direct_response, - redirect or forward (default) traffic. - oneOf: + delay: + description: Delay requests before forwarding, emulating + various failures such as network issues, overloaded upstream + service, etc. + oneOf: - not: anyOf: - - required: - - port - - required: - - derivePort - - required: - - port + - required: + - fixedDelay + - required: + - exponentialDelay - required: - - derivePort - properties: - authority: - description: On a redirect, overwrite the Authority/Host - portion of the URL with this value. - type: string - derivePort: - description: 'On a redirect, dynamically set the port: - * FROM_PROTOCOL_DEFAULT: automatically set to 80 for - HTTP and 443 for HTTPS. - - - Valid Options: FROM_PROTOCOL_DEFAULT, FROM_REQUEST_PORT' - enum: - - FROM_PROTOCOL_DEFAULT - - FROM_REQUEST_PORT - type: string - port: - description: On a redirect, overwrite the port portion - of the URL with this value. - maximum: 4294967295 - minimum: 0 - type: integer - redirectCode: - description: On a redirect, Specifies the HTTP status - code to use in the redirect response. - maximum: 4294967295 - minimum: 0 - type: integer - scheme: - description: On a redirect, overwrite the scheme portion - of the URL with this value. - type: string - uri: - description: On a redirect, overwrite the Path portion - of the URL with this value. - type: string - type: object - retries: - description: Retry policy for HTTP requests. - properties: - attempts: - description: Number of retries to be allowed for a given - request. - format: int32 - type: integer - backoff: - description: Specifies the minimum duration between retry - attempts. - type: string - x-kubernetes-validations: + - fixedDelay + - required: + - exponentialDelay + properties: + exponentialDelay: + type: string + x-kubernetes-validations: - message: must be a valid duration greater than 1ms rule: duration(self) >= duration('1ms') - perTryTimeout: - description: Timeout per attempt for a given request, - including the initial call and any retries. - type: string - x-kubernetes-validations: + fixedDelay: + description: Add a fixed delay before forwarding the + request. + type: string + x-kubernetes-validations: - message: must be a valid duration greater than 1ms rule: duration(self) >= duration('1ms') - retryIgnorePreviousHosts: - description: Flag to specify whether the retries should - ignore previously tried hosts during retry. - nullable: true - type: boolean - retryOn: - description: Specifies the conditions under which retry - takes place. - type: string - retryRemoteLocalities: - description: Flag to specify whether the retries should - retry to other localities. - nullable: true - type: boolean - type: object - rewrite: - description: Rewrite HTTP URIs and Authority headers. - properties: - authority: - description: rewrite the Authority/Host header with this - value. - type: string - uri: - description: rewrite the path (or the prefix) portion - of the URI with this value. - type: string - uriRegexRewrite: - description: rewrite the path portion of the URI with - the specified regex. - properties: - match: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - rewrite: - description: The string that should replace into matching - portions of original URI. - type: string - type: object - type: object - route: - description: A HTTP rule can either return a direct_response, - redirect or forward (default) traffic. - items: - properties: - destination: - description: Destination uniquely identifies the instances - of a service to which the request/connection should - be forwarded to. - properties: - host: - description: The name of a service from the service - registry. - type: string - port: - description: Specifies the port on the host that - is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - headers: - properties: - request: - properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object - type: object - response: - properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object - type: object - type: object - weight: - description: Weight specifies the relative proportion - of traffic to be forwarded to the destination. + percent: + description: Percentage of requests on which the delay + will be injected (0-100). format: int32 type: integer - required: - - destination + percentage: + description: Percentage of requests on which the delay + will be injected. + properties: + value: + format: double + type: number + type: object type: object - type: array - timeout: - description: Timeout for HTTP requests, default is disabled. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: array - tcp: - description: An ordered list of route rules for opaque TCP traffic. - items: - properties: - match: - description: Match conditions to be satisfied for the rule - to be activated. - items: + type: object + headers: + properties: + request: properties: - destinationSubnets: - description: IPv4 or IPv6 ip addresses of destination - with optional subnet. - items: + add: + additionalProperties: type: string - type: array - gateways: - description: Names of gateways where the rule should - be applied. + type: object + remove: items: type: string type: array - port: - description: Specifies the port on the host that is - being addressed. - maximum: 4294967295 - minimum: 0 - type: integer - sourceLabels: + set: additionalProperties: type: string - description: One or more labels that constrain the applicability - of a rule to workloads with the given labels. - type: object - sourceNamespace: - description: Source namespace constraining the applicability - of a rule to workloads in that namespace. - type: string - sourceSubnet: - type: string - type: object - type: array - route: - description: The destination to which the connection should - be forwarded to. - items: - properties: - destination: - description: Destination uniquely identifies the instances - of a service to which the request/connection should - be forwarded to. - properties: - host: - description: The name of a service from the service - registry. - type: string - port: - description: Specifies the port on the host that - is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host type: object - weight: - description: Weight specifies the relative proportion - of traffic to be forwarded to the destination. - format: int32 - type: integer - required: - - destination type: object - type: array - type: object - type: array - tls: - description: An ordered list of route rule for non-terminated TLS - & HTTPS traffic. - items: - properties: - match: - description: Match conditions to be satisfied for the rule - to be activated. - items: + response: properties: - destinationSubnets: - description: IPv4 or IPv6 ip addresses of destination - with optional subnet. - items: - type: string - type: array - gateways: - description: Names of gateways where the rule should - be applied. - items: + add: + additionalProperties: type: string - type: array - port: - description: Specifies the port on the host that is - being addressed. - maximum: 4294967295 - minimum: 0 - type: integer - sniHosts: - description: SNI (server name indicator) to match on. + type: object + remove: items: type: string type: array - sourceLabels: + set: additionalProperties: type: string - description: One or more labels that constrain the applicability - of a rule to workloads with the given labels. type: object - sourceNamespace: - description: Source namespace constraining the applicability - of a rule to workloads in that namespace. - type: string - required: - - sniHosts type: object - type: array - route: - description: The destination to which the connection should - be forwarded to. - items: - properties: - destination: - description: Destination uniquely identifies the instances - of a service to which the request/connection should - be forwarded to. + type: object + match: + description: Match conditions to be satisfied for the rule to + be activated. + items: + properties: + authority: + description: 'HTTP Authority values are case-sensitive + and formatted as follows: - `exact: "value"` for exact + string match - `prefix: "value"` for prefix-based match + - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + gateways: + description: Names of gateways where the rule should be + applied. + items: + type: string + type: array + headers: + additionalProperties: + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex properties: - host: - description: The name of a service from the service - registry. + exact: type: string - port: - description: Specifies the port on the host that - is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string - required: - - host type: object - weight: - description: Weight specifies the relative proportion - of traffic to be forwarded to the destination. - format: int32 - type: integer - required: - - destination - type: object - type: array - required: - - match - type: object - type: array - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. - - - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string + description: The header keys must be lowercase and use + hyphen as the separator, e.g. + type: object + ignoreUriCase: + description: Flag to specify whether the URI matching + should be case-insensitive. + type: boolean + method: + description: 'HTTP Method values are case-sensitive and + formatted as follows: - `exact: "value"` for exact string + match - `prefix: "value"` for prefix-based match - `regex: + "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object name: - description: A human-readable name for the message type. + description: The name assigned to a match. type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} - - additionalPrinterColumns: - - description: The names of gateways and sidecars that should apply these - routes - jsonPath: .spec.gateways - name: Gateways - type: string - - description: The destination hosts to which traffic is being sent - jsonPath: .spec.hosts - name: Hosts - type: string - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is - represented in RFC3339 form and is in UTC. Populated by the system. Read-only. - Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting label/content routing, sni routing, - etc. See more details at: https://istio.io/docs/reference/config/networking/virtual-service.html' - properties: - exportTo: - description: A list of namespaces to which this virtual service - is exported. - items: - type: string - type: array - gateways: - description: The names of gateways and sidecars that should apply - these routes. - items: - type: string - type: array - hosts: - description: The destination hosts to which traffic is being sent. - items: - type: string - type: array - http: - description: An ordered list of route rules for HTTP traffic. - items: - properties: - corsPolicy: - description: Cross-Origin Resource Sharing policy (CORS). - properties: - allowCredentials: - description: Indicates whether the caller is allowed to - send the actual request (not the preflight) using credentials. - nullable: true - type: boolean - allowHeaders: - description: List of HTTP headers that can be used when - requesting the resource. - items: - type: string - type: array - allowMethods: - description: List of HTTP methods allowed to access the - resource. - items: - type: string - type: array - allowOrigin: - items: + port: + description: Specifies the ports on the host that is being + addressed. + maximum: 4294967295 + minimum: 0 + type: integer + queryParams: + additionalProperties: + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + description: Query parameters for matching. + type: object + scheme: + description: 'URI Scheme values are case-sensitive and + formatted as follows: - `exact: "value"` for exact string + match - `prefix: "value"` for prefix-based match - `regex: + "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + sourceLabels: + additionalProperties: type: string - type: array - allowOrigins: - description: String patterns that match allowed origins. - items: - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex + description: One or more labels that constrain the applicability + of a rule to source (client) workloads with the given + labels. + type: object + sourceNamespace: + description: Source namespace constraining the applicability + of a rule to workloads in that namespace. + type: string + statPrefix: + description: The human readable prefix to use when emitting + statistics for this route. + type: string + uri: + description: 'URI to match values are case-sensitive and + formatted as follows: - `exact: "value"` for exact string + match - `prefix: "value"` for prefix-based match - `regex: + "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: - required: - - exact + - exact - required: - - prefix + - prefix - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + withoutHeaders: + additionalProperties: + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: - regex + - required: + - exact + - required: + - prefix + - required: + - regex properties: exact: type: string @@ -15365,296 +13403,877 @@ spec: description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string type: object + description: withoutHeader has the same syntax with the + header, but has opposite meaning. + type: object + type: object + type: array + mirror: + description: Mirror HTTP traffic to a another destination in + addition to forwarding the requests to the intended destination. + properties: + host: + description: The name of a service from the service registry. + type: string + port: + description: Specifies the port on the host that is being + addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + mirrorPercent: + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + mirrorPercentage: + description: Percentage of the traffic to be mirrored by the + `mirror` field. + properties: + value: + format: double + type: number + type: object + mirror_percent: + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + mirrors: + description: Specifies the destinations to mirror HTTP traffic + in addition to the original destination. + items: + properties: + destination: + description: Destination specifies the target of the mirror + operation. + properties: + host: + description: The name of a service from the service + registry. + type: string + port: + description: Specifies the port on the host that is + being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + percentage: + description: Percentage of the traffic to be mirrored + by the `destination` field. + properties: + value: + format: double + type: number + type: object + required: + - destination + type: object + type: array + name: + description: The name assigned to the route for debugging purposes. + type: string + redirect: + description: A HTTP rule can either return a direct_response, + redirect or forward (default) traffic. + oneOf: + - not: + anyOf: + - required: + - port + - required: + - derivePort + - required: + - port + - required: + - derivePort + properties: + authority: + description: On a redirect, overwrite the Authority/Host + portion of the URL with this value. + type: string + derivePort: + description: |- + On a redirect, dynamically set the port: * FROM_PROTOCOL_DEFAULT: automatically set to 80 for HTTP and 443 for HTTPS. + + Valid Options: FROM_PROTOCOL_DEFAULT, FROM_REQUEST_PORT + enum: + - FROM_PROTOCOL_DEFAULT + - FROM_REQUEST_PORT + type: string + port: + description: On a redirect, overwrite the port portion of + the URL with this value. + maximum: 4294967295 + minimum: 0 + type: integer + redirectCode: + description: On a redirect, Specifies the HTTP status code + to use in the redirect response. + maximum: 4294967295 + minimum: 0 + type: integer + scheme: + description: On a redirect, overwrite the scheme portion + of the URL with this value. + type: string + uri: + description: On a redirect, overwrite the Path portion of + the URL with this value. + type: string + type: object + retries: + description: Retry policy for HTTP requests. + properties: + attempts: + description: Number of retries to be allowed for a given + request. + format: int32 + type: integer + backoff: + description: Specifies the minimum duration between retry + attempts. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + perTryTimeout: + description: Timeout per attempt for a given request, including + the initial call and any retries. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + retryIgnorePreviousHosts: + description: Flag to specify whether the retries should + ignore previously tried hosts during retry. + nullable: true + type: boolean + retryOn: + description: Specifies the conditions under which retry + takes place. + type: string + retryRemoteLocalities: + description: Flag to specify whether the retries should + retry to other localities. + nullable: true + type: boolean + type: object + rewrite: + description: Rewrite HTTP URIs and Authority headers. + properties: + authority: + description: rewrite the Authority/Host header with this + value. + type: string + uri: + description: rewrite the path (or the prefix) portion of + the URI with this value. + type: string + uriRegexRewrite: + description: rewrite the path portion of the URI with the + specified regex. + properties: + match: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + rewrite: + description: The string that should replace into matching + portions of original URI. + type: string + type: object + type: object + route: + description: A HTTP rule can either return a direct_response, + redirect or forward (default) traffic. + items: + properties: + destination: + description: Destination uniquely identifies the instances + of a service to which the request/connection should + be forwarded to. + properties: + host: + description: The name of a service from the service + registry. + type: string + port: + description: Specifies the port on the host that is + being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + headers: + properties: + request: + properties: + add: + additionalProperties: + type: string + type: object + remove: + items: + type: string + type: array + set: + additionalProperties: + type: string + type: object + type: object + response: + properties: + add: + additionalProperties: + type: string + type: object + remove: + items: + type: string + type: array + set: + additionalProperties: + type: string + type: object + type: object + type: object + weight: + description: Weight specifies the relative proportion + of traffic to be forwarded to the destination. + format: int32 + type: integer + required: + - destination + type: object + type: array + timeout: + description: Timeout for HTTP requests, default is disabled. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + type: array + tcp: + description: An ordered list of route rules for opaque TCP traffic. + items: + properties: + match: + description: Match conditions to be satisfied for the rule to + be activated. + items: + properties: + destinationSubnets: + description: IPv4 or IPv6 ip addresses of destination + with optional subnet. + items: + type: string type: array - exposeHeaders: - description: A list of HTTP headers that the browsers - are allowed to access. + gateways: + description: Names of gateways where the rule should be + applied. items: type: string type: array - maxAge: - description: Specifies how long the results of a preflight - request can be cached. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - unmatchedPreflights: - description: 'Indicates whether preflight requests not - matching the configured allowed origin shouldn''t be - forwarded to the upstream. - - - Valid Options: FORWARD, IGNORE' - enum: - - UNSPECIFIED - - FORWARD - - IGNORE - type: string - type: object - delegate: - description: Delegate is used to specify the particular VirtualService - which can be used to define delegate HTTPRoute. - properties: - name: - description: Name specifies the name of the delegate VirtualService. + port: + description: Specifies the port on the host that is being + addressed. + maximum: 4294967295 + minimum: 0 + type: integer + sourceLabels: + additionalProperties: + type: string + description: One or more labels that constrain the applicability + of a rule to workloads with the given labels. + type: object + sourceNamespace: + description: Source namespace constraining the applicability + of a rule to workloads in that namespace. type: string - namespace: - description: Namespace specifies the namespace where the - delegate VirtualService resides. + sourceSubnet: type: string type: object - directResponse: - description: A HTTP rule can either return a direct_response, - redirect or forward (default) traffic. + type: array + route: + description: The destination to which the connection should + be forwarded to. + items: properties: - body: - description: Specifies the content of the response body. - oneOf: - - not: - anyOf: - - required: - - string - - required: - - bytes - - required: - - string - - required: - - bytes + destination: + description: Destination uniquely identifies the instances + of a service to which the request/connection should + be forwarded to. properties: - bytes: - description: response body as base64 encoded bytes. - format: byte + host: + description: The name of a service from the service + registry. type: string - string: + port: + description: Specifies the port on the host that is + being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. type: string + required: + - host type: object - status: - description: Specifies the HTTP response status to be - returned. + weight: + description: Weight specifies the relative proportion + of traffic to be forwarded to the destination. + format: int32 + type: integer + required: + - destination + type: object + type: array + type: object + type: array + tls: + description: An ordered list of route rule for non-terminated TLS + & HTTPS traffic. + items: + properties: + match: + description: Match conditions to be satisfied for the rule to + be activated. + items: + properties: + destinationSubnets: + description: IPv4 or IPv6 ip addresses of destination + with optional subnet. + items: + type: string + type: array + gateways: + description: Names of gateways where the rule should be + applied. + items: + type: string + type: array + port: + description: Specifies the port on the host that is being + addressed. maximum: 4294967295 minimum: 0 type: integer + sniHosts: + description: SNI (server name indicator) to match on. + items: + type: string + type: array + sourceLabels: + additionalProperties: + type: string + description: One or more labels that constrain the applicability + of a rule to workloads with the given labels. + type: object + sourceNamespace: + description: Source namespace constraining the applicability + of a rule to workloads in that namespace. + type: string required: - - status + - sniHosts type: object - fault: - description: Fault injection policy to apply on HTTP traffic - at the client side. + type: array + route: + description: The destination to which the connection should + be forwarded to. + items: properties: - abort: - description: Abort Http request attempts and return error - codes back to downstream service, giving the impression - that the upstream service is faulty. - oneOf: - - not: - anyOf: - - required: - - httpStatus - - required: - - grpcStatus - - required: - - http2Error - - required: - - httpStatus - - required: - - grpcStatus - - required: - - http2Error + destination: + description: Destination uniquely identifies the instances + of a service to which the request/connection should + be forwarded to. properties: - grpcStatus: - description: GRPC status code to use to abort the - request. - type: string - http2Error: + host: + description: The name of a service from the service + registry. type: string - httpStatus: - description: HTTP status code to use to abort the - Http request. - format: int32 - type: integer - percentage: - description: Percentage of requests to be aborted - with the error code provided. + port: + description: Specifies the port on the host that is + being addressed. properties: - value: - format: double - type: number + number: + maximum: 4294967295 + minimum: 0 + type: integer type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host type: object - delay: - description: Delay requests before forwarding, emulating - various failures such as network issues, overloaded - upstream service, etc. + weight: + description: Weight specifies the relative proportion + of traffic to be forwarded to the destination. + format: int32 + type: integer + required: + - destination + type: object + type: array + required: + - match + type: object + type: array + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - description: The names of gateways and sidecars that should apply these routes + jsonPath: .spec.gateways + name: Gateways + type: string + - description: The destination hosts to which traffic is being sent + jsonPath: .spec.hosts + name: Hosts + type: string + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha3 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting label/content routing, sni routing, + etc. See more details at: https://istio.io/docs/reference/config/networking/virtual-service.html' + properties: + exportTo: + description: A list of namespaces to which this virtual service is + exported. + items: + type: string + type: array + gateways: + description: The names of gateways and sidecars that should apply + these routes. + items: + type: string + type: array + hosts: + description: The destination hosts to which traffic is being sent. + items: + type: string + type: array + http: + description: An ordered list of route rules for HTTP traffic. + items: + properties: + corsPolicy: + description: Cross-Origin Resource Sharing policy (CORS). + properties: + allowCredentials: + description: Indicates whether the caller is allowed to + send the actual request (not the preflight) using credentials. + nullable: true + type: boolean + allowHeaders: + description: List of HTTP headers that can be used when + requesting the resource. + items: + type: string + type: array + allowMethods: + description: List of HTTP methods allowed to access the + resource. + items: + type: string + type: array + allowOrigin: + items: + type: string + type: array + allowOrigins: + description: String patterns that match allowed origins. + items: oneOf: - - not: - anyOf: - - required: - - fixedDelay - - required: - - exponentialDelay - - required: - - fixedDelay - - required: - - exponentialDelay + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex properties: - exponentialDelay: + exact: type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - fixedDelay: - description: Add a fixed delay before forwarding the - request. + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - percent: - description: Percentage of requests on which the delay - will be injected (0-100). - format: int32 - type: integer - percentage: - description: Percentage of requests on which the delay - will be injected. - properties: - value: - format: double - type: number - type: object - type: object - type: object - headers: - properties: - request: - properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object - type: object - response: - properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object type: object - type: object - match: - description: Match conditions to be satisfied for the rule - to be activated. - items: + type: array + exposeHeaders: + description: A list of HTTP headers that the browsers are + allowed to access. + items: + type: string + type: array + maxAge: + description: Specifies how long the results of a preflight + request can be cached. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + unmatchedPreflights: + description: |- + Indicates whether preflight requests not matching the configured allowed origin shouldn't be forwarded to the upstream. + + Valid Options: FORWARD, IGNORE + enum: + - UNSPECIFIED + - FORWARD + - IGNORE + type: string + type: object + delegate: + description: Delegate is used to specify the particular VirtualService + which can be used to define delegate HTTPRoute. + properties: + name: + description: Name specifies the name of the delegate VirtualService. + type: string + namespace: + description: Namespace specifies the namespace where the + delegate VirtualService resides. + type: string + type: object + directResponse: + description: A HTTP rule can either return a direct_response, + redirect or forward (default) traffic. + properties: + body: + description: Specifies the content of the response body. + oneOf: + - not: + anyOf: + - required: + - string + - required: + - bytes + - required: + - string + - required: + - bytes properties: - authority: - description: 'HTTP Authority values are case-sensitive - and formatted as follows: - `exact: "value"` for exact - string match - `prefix: "value"` for prefix-based - match - `regex: "value"` for [RE2 style regex-based - match](https://github.com/google/re2/wiki/Syntax).' - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex + bytes: + description: response body as base64 encoded bytes. + format: byte + type: string + string: + type: string + type: object + status: + description: Specifies the HTTP response status to be returned. + maximum: 4294967295 + minimum: 0 + type: integer + required: + - status + type: object + fault: + description: Fault injection policy to apply on HTTP traffic + at the client side. + properties: + abort: + description: Abort Http request attempts and return error + codes back to downstream service, giving the impression + that the upstream service is faulty. + oneOf: + - not: + anyOf: + - required: + - httpStatus + - required: + - grpcStatus + - required: + - http2Error + - required: + - httpStatus + - required: + - grpcStatus + - required: + - http2Error + properties: + grpcStatus: + description: GRPC status code to use to abort the request. + type: string + http2Error: + type: string + httpStatus: + description: HTTP status code to use to abort the Http + request. + format: int32 + type: integer + percentage: + description: Percentage of requests to be aborted with + the error code provided. properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string + value: + format: double + type: number + type: object + type: object + delay: + description: Delay requests before forwarding, emulating + various failures such as network issues, overloaded upstream + service, etc. + oneOf: + - not: + anyOf: + - required: + - fixedDelay + - required: + - exponentialDelay + - required: + - fixedDelay + - required: + - exponentialDelay + properties: + exponentialDelay: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + fixedDelay: + description: Add a fixed delay before forwarding the + request. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + percent: + description: Percentage of requests on which the delay + will be injected (0-100). + format: int32 + type: integer + percentage: + description: Percentage of requests on which the delay + will be injected. + properties: + value: + format: double + type: number + type: object + type: object + type: object + headers: + properties: + request: + properties: + add: + additionalProperties: + type: string type: object - gateways: - description: Names of gateways where the rule should - be applied. + remove: items: type: string type: array - headers: + set: additionalProperties: - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - description: The header keys must be lowercase and use - hyphen as the separator, e.g. + type: string type: object - ignoreUriCase: - description: Flag to specify whether the URI matching - should be case-insensitive. - type: boolean - method: - description: 'HTTP Method values are case-sensitive - and formatted as follows: - `exact: "value"` for exact - string match - `prefix: "value"` for prefix-based - match - `regex: "value"` for [RE2 style regex-based - match](https://github.com/google/re2/wiki/Syntax).' - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex + type: object + response: + properties: + add: + additionalProperties: + type: string + type: object + remove: + items: + type: string + type: array + set: + additionalProperties: + type: string + type: object + type: object + type: object + match: + description: Match conditions to be satisfied for the rule to + be activated. + items: + properties: + authority: + description: 'HTTP Authority values are case-sensitive + and formatted as follows: - `exact: "value"` for exact + string match - `prefix: "value"` for prefix-based match + - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: - required: - - exact + - exact - required: - - prefix + - prefix - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + gateways: + description: Names of gateways where the rule should be + applied. + items: + type: string + type: array + headers: + additionalProperties: + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: - regex + - required: + - exact + - required: + - prefix + - required: + - regex properties: exact: type: string @@ -15664,64 +14283,68 @@ spec: description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string type: object - name: - description: The name assigned to a match. - type: string - port: - description: Specifies the ports on the host that is - being addressed. - maximum: 4294967295 - minimum: 0 - type: integer - queryParams: - additionalProperties: - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - description: Query parameters for matching. - type: object - scheme: - description: 'URI Scheme values are case-sensitive and - formatted as follows: - `exact: "value"` for exact - string match - `prefix: "value"` for prefix-based - match - `regex: "value"` for [RE2 style regex-based - match](https://github.com/google/re2/wiki/Syntax).' - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex + description: The header keys must be lowercase and use + hyphen as the separator, e.g. + type: object + ignoreUriCase: + description: Flag to specify whether the URI matching + should be case-insensitive. + type: boolean + method: + description: 'HTTP Method values are case-sensitive and + formatted as follows: - `exact: "value"` for exact string + match - `prefix: "value"` for prefix-based match - `regex: + "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: - required: - - exact + - exact - required: - - prefix + - prefix - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + name: + description: The name assigned to a match. + type: string + port: + description: Specifies the ports on the host that is being + addressed. + maximum: 4294967295 + minimum: 0 + type: integer + queryParams: + additionalProperties: + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: - regex + - required: + - exact + - required: + - prefix + - required: + - regex properties: exact: type: string @@ -15731,42 +14354,98 @@ spec: description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string type: object - sourceLabels: - additionalProperties: + description: Query parameters for matching. + type: object + scheme: + description: 'URI Scheme values are case-sensitive and + formatted as follows: - `exact: "value"` for exact string + match - `prefix: "value"` for prefix-based match - `regex: + "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: type: string - description: One or more labels that constrain the applicability - of a rule to source (client) workloads with the given - labels. - type: object - sourceNamespace: - description: Source namespace constraining the applicability - of a rule to workloads in that namespace. - type: string - statPrefix: - description: The human readable prefix to use when emitting - statistics for this route. + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + sourceLabels: + additionalProperties: type: string - uri: - description: 'URI to match values are case-sensitive - and formatted as follows: - `exact: "value"` for exact - string match - `prefix: "value"` for prefix-based - match - `regex: "value"` for [RE2 style regex-based - match](https://github.com/google/re2/wiki/Syntax).' - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex + description: One or more labels that constrain the applicability + of a rule to source (client) workloads with the given + labels. + type: object + sourceNamespace: + description: Source namespace constraining the applicability + of a rule to workloads in that namespace. + type: string + statPrefix: + description: The human readable prefix to use when emitting + statistics for this route. + type: string + uri: + description: 'URI to match values are case-sensitive and + formatted as follows: - `exact: "value"` for exact string + match - `prefix: "value"` for prefix-based match - `regex: + "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: - required: - - exact + - exact - required: - - prefix + - prefix - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + withoutHeaders: + additionalProperties: + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: - regex + - required: + - exact + - required: + - prefix + - required: + - regex properties: exact: type: string @@ -15776,1443 +14455,1948 @@ spec: description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string type: object - withoutHeaders: - additionalProperties: - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex + description: withoutHeader has the same syntax with the + header, but has opposite meaning. + type: object + type: object + type: array + mirror: + description: Mirror HTTP traffic to a another destination in + addition to forwarding the requests to the intended destination. + properties: + host: + description: The name of a service from the service registry. + type: string + port: + description: Specifies the port on the host that is being + addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + mirrorPercent: + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + mirrorPercentage: + description: Percentage of the traffic to be mirrored by the + `mirror` field. + properties: + value: + format: double + type: number + type: object + mirror_percent: + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + mirrors: + description: Specifies the destinations to mirror HTTP traffic + in addition to the original destination. + items: + properties: + destination: + description: Destination specifies the target of the mirror + operation. + properties: + host: + description: The name of a service from the service + registry. + type: string + port: + description: Specifies the port on the host that is + being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + percentage: + description: Percentage of the traffic to be mirrored + by the `destination` field. + properties: + value: + format: double + type: number + type: object + required: + - destination + type: object + type: array + name: + description: The name assigned to the route for debugging purposes. + type: string + redirect: + description: A HTTP rule can either return a direct_response, + redirect or forward (default) traffic. + oneOf: + - not: + anyOf: + - required: + - port + - required: + - derivePort + - required: + - port + - required: + - derivePort + properties: + authority: + description: On a redirect, overwrite the Authority/Host + portion of the URL with this value. + type: string + derivePort: + description: |- + On a redirect, dynamically set the port: * FROM_PROTOCOL_DEFAULT: automatically set to 80 for HTTP and 443 for HTTPS. + + Valid Options: FROM_PROTOCOL_DEFAULT, FROM_REQUEST_PORT + enum: + - FROM_PROTOCOL_DEFAULT + - FROM_REQUEST_PORT + type: string + port: + description: On a redirect, overwrite the port portion of + the URL with this value. + maximum: 4294967295 + minimum: 0 + type: integer + redirectCode: + description: On a redirect, Specifies the HTTP status code + to use in the redirect response. + maximum: 4294967295 + minimum: 0 + type: integer + scheme: + description: On a redirect, overwrite the scheme portion + of the URL with this value. + type: string + uri: + description: On a redirect, overwrite the Path portion of + the URL with this value. + type: string + type: object + retries: + description: Retry policy for HTTP requests. + properties: + attempts: + description: Number of retries to be allowed for a given + request. + format: int32 + type: integer + backoff: + description: Specifies the minimum duration between retry + attempts. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + perTryTimeout: + description: Timeout per attempt for a given request, including + the initial call and any retries. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + retryIgnorePreviousHosts: + description: Flag to specify whether the retries should + ignore previously tried hosts during retry. + nullable: true + type: boolean + retryOn: + description: Specifies the conditions under which retry + takes place. + type: string + retryRemoteLocalities: + description: Flag to specify whether the retries should + retry to other localities. + nullable: true + type: boolean + type: object + rewrite: + description: Rewrite HTTP URIs and Authority headers. + properties: + authority: + description: rewrite the Authority/Host header with this + value. + type: string + uri: + description: rewrite the path (or the prefix) portion of + the URI with this value. + type: string + uriRegexRewrite: + description: rewrite the path portion of the URI with the + specified regex. + properties: + match: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + rewrite: + description: The string that should replace into matching + portions of original URI. + type: string + type: object + type: object + route: + description: A HTTP rule can either return a direct_response, + redirect or forward (default) traffic. + items: + properties: + destination: + description: Destination uniquely identifies the instances + of a service to which the request/connection should + be forwarded to. + properties: + host: + description: The name of a service from the service + registry. + type: string + port: + description: Specifies the port on the host that is + being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + headers: + properties: + request: properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string + add: + additionalProperties: + type: string + type: object + remove: + items: + type: string + type: array + set: + additionalProperties: + type: string + type: object type: object - description: withoutHeader has the same syntax with - the header, but has opposite meaning. - type: object - type: object - type: array - mirror: - description: Mirror HTTP traffic to a another destination - in addition to forwarding the requests to the intended destination. + response: + properties: + add: + additionalProperties: + type: string + type: object + remove: + items: + type: string + type: array + set: + additionalProperties: + type: string + type: object + type: object + type: object + weight: + description: Weight specifies the relative proportion + of traffic to be forwarded to the destination. + format: int32 + type: integer + required: + - destination + type: object + type: array + timeout: + description: Timeout for HTTP requests, default is disabled. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + type: array + tcp: + description: An ordered list of route rules for opaque TCP traffic. + items: + properties: + match: + description: Match conditions to be satisfied for the rule to + be activated. + items: properties: - host: - description: The name of a service from the service registry. - type: string + destinationSubnets: + description: IPv4 or IPv6 ip addresses of destination + with optional subnet. + items: + type: string + type: array + gateways: + description: Names of gateways where the rule should be + applied. + items: + type: string + type: array port: description: Specifies the port on the host that is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer + maximum: 4294967295 + minimum: 0 + type: integer + sourceLabels: + additionalProperties: + type: string + description: One or more labels that constrain the applicability + of a rule to workloads with the given labels. type: object - subset: - description: The name of a subset within the service. + sourceNamespace: + description: Source namespace constraining the applicability + of a rule to workloads in that namespace. + type: string + sourceSubnet: type: string - required: - - host type: object - mirror_percent: - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - mirrorPercent: - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - mirrorPercentage: - description: Percentage of the traffic to be mirrored by the - `mirror` field. + type: array + route: + description: The destination to which the connection should + be forwarded to. + items: properties: - value: - format: double - type: number + destination: + description: Destination uniquely identifies the instances + of a service to which the request/connection should + be forwarded to. + properties: + host: + description: The name of a service from the service + registry. + type: string + port: + description: Specifies the port on the host that is + being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + weight: + description: Weight specifies the relative proportion + of traffic to be forwarded to the destination. + format: int32 + type: integer + required: + - destination type: object - mirrors: - description: Specifies the destinations to mirror HTTP traffic - in addition to the original destination. - items: - properties: - destination: - description: Destination specifies the target of the - mirror operation. - properties: - host: - description: The name of a service from the service - registry. - type: string - port: - description: Specifies the port on the host that - is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - percentage: - description: Percentage of the traffic to be mirrored - by the `destination` field. - properties: - value: - format: double - type: number - type: object - required: - - destination - type: object - type: array - name: - description: The name assigned to the route for debugging - purposes. - type: string - redirect: - description: A HTTP rule can either return a direct_response, - redirect or forward (default) traffic. - oneOf: - - not: - anyOf: - - required: - - port - - required: - - derivePort - - required: - - port - - required: - - derivePort + type: array + type: object + type: array + tls: + description: An ordered list of route rule for non-terminated TLS + & HTTPS traffic. + items: + properties: + match: + description: Match conditions to be satisfied for the rule to + be activated. + items: properties: - authority: - description: On a redirect, overwrite the Authority/Host - portion of the URL with this value. - type: string - derivePort: - description: 'On a redirect, dynamically set the port: - * FROM_PROTOCOL_DEFAULT: automatically set to 80 for - HTTP and 443 for HTTPS. - - - Valid Options: FROM_PROTOCOL_DEFAULT, FROM_REQUEST_PORT' - enum: - - FROM_PROTOCOL_DEFAULT - - FROM_REQUEST_PORT - type: string + destinationSubnets: + description: IPv4 or IPv6 ip addresses of destination + with optional subnet. + items: + type: string + type: array + gateways: + description: Names of gateways where the rule should be + applied. + items: + type: string + type: array port: - description: On a redirect, overwrite the port portion - of the URL with this value. - maximum: 4294967295 - minimum: 0 - type: integer - redirectCode: - description: On a redirect, Specifies the HTTP status - code to use in the redirect response. + description: Specifies the port on the host that is being + addressed. maximum: 4294967295 minimum: 0 type: integer - scheme: - description: On a redirect, overwrite the scheme portion - of the URL with this value. - type: string - uri: - description: On a redirect, overwrite the Path portion - of the URL with this value. + sniHosts: + description: SNI (server name indicator) to match on. + items: + type: string + type: array + sourceLabels: + additionalProperties: + type: string + description: One or more labels that constrain the applicability + of a rule to workloads with the given labels. + type: object + sourceNamespace: + description: Source namespace constraining the applicability + of a rule to workloads in that namespace. type: string + required: + - sniHosts type: object - retries: - description: Retry policy for HTTP requests. + type: array + route: + description: The destination to which the connection should + be forwarded to. + items: properties: - attempts: - description: Number of retries to be allowed for a given - request. + destination: + description: Destination uniquely identifies the instances + of a service to which the request/connection should + be forwarded to. + properties: + host: + description: The name of a service from the service + registry. + type: string + port: + description: Specifies the port on the host that is + being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + weight: + description: Weight specifies the relative proportion + of traffic to be forwarded to the destination. format: int32 type: integer - backoff: - description: Specifies the minimum duration between retry - attempts. + required: + - destination + type: object + type: array + required: + - match + type: object + type: array + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - description: The names of gateways and sidecars that should apply these routes + jsonPath: .spec.gateways + name: Gateways + type: string + - description: The destination hosts to which traffic is being sent + jsonPath: .spec.hosts + name: Hosts + type: string + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting label/content routing, sni routing, + etc. See more details at: https://istio.io/docs/reference/config/networking/virtual-service.html' + properties: + exportTo: + description: A list of namespaces to which this virtual service is + exported. + items: + type: string + type: array + gateways: + description: The names of gateways and sidecars that should apply + these routes. + items: + type: string + type: array + hosts: + description: The destination hosts to which traffic is being sent. + items: + type: string + type: array + http: + description: An ordered list of route rules for HTTP traffic. + items: + properties: + corsPolicy: + description: Cross-Origin Resource Sharing policy (CORS). + properties: + allowCredentials: + description: Indicates whether the caller is allowed to + send the actual request (not the preflight) using credentials. + nullable: true + type: boolean + allowHeaders: + description: List of HTTP headers that can be used when + requesting the resource. + items: type: string - x-kubernetes-validations: + type: array + allowMethods: + description: List of HTTP methods allowed to access the + resource. + items: + type: string + type: array + allowOrigin: + items: + type: string + type: array + allowOrigins: + description: String patterns that match allowed origins. + items: + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + type: array + exposeHeaders: + description: A list of HTTP headers that the browsers are + allowed to access. + items: + type: string + type: array + maxAge: + description: Specifies how long the results of a preflight + request can be cached. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + unmatchedPreflights: + description: |- + Indicates whether preflight requests not matching the configured allowed origin shouldn't be forwarded to the upstream. + + Valid Options: FORWARD, IGNORE + enum: + - UNSPECIFIED + - FORWARD + - IGNORE + type: string + type: object + delegate: + description: Delegate is used to specify the particular VirtualService + which can be used to define delegate HTTPRoute. + properties: + name: + description: Name specifies the name of the delegate VirtualService. + type: string + namespace: + description: Namespace specifies the namespace where the + delegate VirtualService resides. + type: string + type: object + directResponse: + description: A HTTP rule can either return a direct_response, + redirect or forward (default) traffic. + properties: + body: + description: Specifies the content of the response body. + oneOf: + - not: + anyOf: + - required: + - string + - required: + - bytes + - required: + - string + - required: + - bytes + properties: + bytes: + description: response body as base64 encoded bytes. + format: byte + type: string + string: + type: string + type: object + status: + description: Specifies the HTTP response status to be returned. + maximum: 4294967295 + minimum: 0 + type: integer + required: + - status + type: object + fault: + description: Fault injection policy to apply on HTTP traffic + at the client side. + properties: + abort: + description: Abort Http request attempts and return error + codes back to downstream service, giving the impression + that the upstream service is faulty. + oneOf: + - not: + anyOf: + - required: + - httpStatus + - required: + - grpcStatus + - required: + - http2Error + - required: + - httpStatus + - required: + - grpcStatus + - required: + - http2Error + properties: + grpcStatus: + description: GRPC status code to use to abort the request. + type: string + http2Error: + type: string + httpStatus: + description: HTTP status code to use to abort the Http + request. + format: int32 + type: integer + percentage: + description: Percentage of requests to be aborted with + the error code provided. + properties: + value: + format: double + type: number + type: object + type: object + delay: + description: Delay requests before forwarding, emulating + various failures such as network issues, overloaded upstream + service, etc. + oneOf: + - not: + anyOf: + - required: + - fixedDelay + - required: + - exponentialDelay + - required: + - fixedDelay + - required: + - exponentialDelay + properties: + exponentialDelay: + type: string + x-kubernetes-validations: - message: must be a valid duration greater than 1ms rule: duration(self) >= duration('1ms') - perTryTimeout: - description: Timeout per attempt for a given request, - including the initial call and any retries. - type: string - x-kubernetes-validations: + fixedDelay: + description: Add a fixed delay before forwarding the + request. + type: string + x-kubernetes-validations: - message: must be a valid duration greater than 1ms rule: duration(self) >= duration('1ms') - retryIgnorePreviousHosts: - description: Flag to specify whether the retries should - ignore previously tried hosts during retry. - nullable: true - type: boolean - retryOn: - description: Specifies the conditions under which retry - takes place. - type: string - retryRemoteLocalities: - description: Flag to specify whether the retries should - retry to other localities. - nullable: true - type: boolean - type: object - rewrite: - description: Rewrite HTTP URIs and Authority headers. - properties: - authority: - description: rewrite the Authority/Host header with this - value. - type: string - uri: - description: rewrite the path (or the prefix) portion - of the URI with this value. - type: string - uriRegexRewrite: - description: rewrite the path portion of the URI with - the specified regex. - properties: - match: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - rewrite: - description: The string that should replace into matching - portions of original URI. - type: string - type: object - type: object - route: - description: A HTTP rule can either return a direct_response, - redirect or forward (default) traffic. - items: - properties: - destination: - description: Destination uniquely identifies the instances - of a service to which the request/connection should - be forwarded to. - properties: - host: - description: The name of a service from the service - registry. - type: string - port: - description: Specifies the port on the host that - is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - headers: - properties: - request: - properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object - type: object - response: - properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object - type: object - type: object - weight: - description: Weight specifies the relative proportion - of traffic to be forwarded to the destination. + percent: + description: Percentage of requests on which the delay + will be injected (0-100). format: int32 type: integer - required: - - destination + percentage: + description: Percentage of requests on which the delay + will be injected. + properties: + value: + format: double + type: number + type: object type: object - type: array - timeout: - description: Timeout for HTTP requests, default is disabled. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: array - tcp: - description: An ordered list of route rules for opaque TCP traffic. - items: - properties: - match: - description: Match conditions to be satisfied for the rule - to be activated. - items: + type: object + headers: + properties: + request: properties: - destinationSubnets: - description: IPv4 or IPv6 ip addresses of destination - with optional subnet. + add: + additionalProperties: + type: string + type: object + remove: items: type: string type: array - gateways: - description: Names of gateways where the rule should - be applied. + set: + additionalProperties: + type: string + type: object + type: object + response: + properties: + add: + additionalProperties: + type: string + type: object + remove: items: type: string type: array - port: - description: Specifies the port on the host that is - being addressed. - maximum: 4294967295 - minimum: 0 - type: integer - sourceLabels: + set: additionalProperties: type: string - description: One or more labels that constrain the applicability - of a rule to workloads with the given labels. type: object - sourceNamespace: - description: Source namespace constraining the applicability - of a rule to workloads in that namespace. - type: string - sourceSubnet: - type: string type: object - type: array - route: - description: The destination to which the connection should - be forwarded to. - items: - properties: - destination: - description: Destination uniquely identifies the instances - of a service to which the request/connection should - be forwarded to. + type: object + match: + description: Match conditions to be satisfied for the rule to + be activated. + items: + properties: + authority: + description: 'HTTP Authority values are case-sensitive + and formatted as follows: - `exact: "value"` for exact + string match - `prefix: "value"` for prefix-based match + - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + gateways: + description: Names of gateways where the rule should be + applied. + items: + type: string + type: array + headers: + additionalProperties: + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex properties: - host: - description: The name of a service from the service - registry. + exact: type: string - port: - description: Specifies the port on the host that - is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string - required: - - host type: object - weight: - description: Weight specifies the relative proportion - of traffic to be forwarded to the destination. - format: int32 - type: integer - required: - - destination - type: object - type: array - type: object - type: array - tls: - description: An ordered list of route rule for non-terminated TLS - & HTTPS traffic. - items: - properties: - match: - description: Match conditions to be satisfied for the rule - to be activated. - items: - properties: - destinationSubnets: - description: IPv4 or IPv6 ip addresses of destination - with optional subnet. - items: - type: string - type: array - gateways: - description: Names of gateways where the rule should - be applied. - items: + description: The header keys must be lowercase and use + hyphen as the separator, e.g. + type: object + ignoreUriCase: + description: Flag to specify whether the URI matching + should be case-insensitive. + type: boolean + method: + description: 'HTTP Method values are case-sensitive and + formatted as follows: - `exact: "value"` for exact string + match - `prefix: "value"` for prefix-based match - `regex: + "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: type: string - type: array - port: - description: Specifies the port on the host that is - being addressed. - maximum: 4294967295 - minimum: 0 - type: integer - sniHosts: - description: SNI (server name indicator) to match on. - items: + prefix: type: string - type: array - sourceLabels: - additionalProperties: + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string - description: One or more labels that constrain the applicability - of a rule to workloads with the given labels. + type: object + name: + description: The name assigned to a match. + type: string + port: + description: Specifies the ports on the host that is being + addressed. + maximum: 4294967295 + minimum: 0 + type: integer + queryParams: + additionalProperties: + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string type: object - sourceNamespace: - description: Source namespace constraining the applicability - of a rule to workloads in that namespace. + description: Query parameters for matching. + type: object + scheme: + description: 'URI Scheme values are case-sensitive and + formatted as follows: - `exact: "value"` for exact string + match - `prefix: "value"` for prefix-based match - `regex: + "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + sourceLabels: + additionalProperties: type: string - required: - - sniHosts - type: object - type: array - route: - description: The destination to which the connection should - be forwarded to. - items: - properties: - destination: - description: Destination uniquely identifies the instances - of a service to which the request/connection should - be forwarded to. + description: One or more labels that constrain the applicability + of a rule to source (client) workloads with the given + labels. + type: object + sourceNamespace: + description: Source namespace constraining the applicability + of a rule to workloads in that namespace. + type: string + statPrefix: + description: The human readable prefix to use when emitting + statistics for this route. + type: string + uri: + description: 'URI to match values are case-sensitive and + formatted as follows: - `exact: "value"` for exact string + match - `prefix: "value"` for prefix-based match - `regex: + "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + withoutHeaders: + additionalProperties: + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex properties: - host: - description: The name of a service from the service - registry. + exact: type: string - port: - description: Specifies the port on the host that - is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string - required: - - host type: object - weight: - description: Weight specifies the relative proportion - of traffic to be forwarded to the destination. - format: int32 - type: integer - required: - - destination - type: object - type: array - required: - - match - type: object - type: array - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. - - - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string + description: withoutHeader has the same syntax with the + header, but has opposite meaning. + type: object type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - helm.sh/resource-policy: keep - labels: - app.kubernetes.io/instance: istio - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.4 - helm.sh/chart: base-1.29.4 - name: wasmplugins.extensions.istio.io -spec: - group: extensions.istio.io - names: - categories: - - istio-io - - extensions-istio-io - kind: WasmPlugin - listKind: WasmPluginList - plural: wasmplugins - singular: wasmplugin - scope: Namespaced - versions: - - additionalPrinterColumns: - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is - represented in RFC3339 form and is in UTC. Populated by the system. Read-only. - Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1alpha1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Extend the functionality provided by the Istio proxy through - WebAssembly filters. See more details at: https://istio.io/docs/reference/config/proxy_extensions/wasm-plugin.html' - properties: - failStrategy: - description: 'Specifies the failure behavior for the plugin due - to fatal errors. - - - Valid Options: FAIL_CLOSE, FAIL_OPEN, FAIL_RELOAD' - enum: - - FAIL_CLOSE - - FAIL_OPEN - - FAIL_RELOAD - type: string - imagePullPolicy: - description: 'The pull behaviour to be applied when fetching Wasm - module by either OCI image or `http/https`. - - - Valid Options: IfNotPresent, Always' - enum: - - UNSPECIFIED_POLICY - - IfNotPresent - - Always - type: string - imagePullSecret: - description: Credentials to use for OCI image pulling. - maxLength: 253 - minLength: 1 - type: string - match: - description: Specifies the criteria to determine which traffic is - passed to WasmPlugin. - items: - properties: - mode: - description: 'Criteria for selecting traffic by their direction. - - - Valid Options: CLIENT, SERVER, CLIENT_AND_SERVER' - enum: - - UNDEFINED - - CLIENT - - SERVER - - CLIENT_AND_SERVER - type: string - ports: - description: Criteria for selecting traffic by their destination - port. - items: + type: array + mirror: + description: Mirror HTTP traffic to a another destination in + addition to forwarding the requests to the intended destination. + properties: + host: + description: The name of a service from the service registry. + type: string + port: + description: Specifies the port on the host that is being + addressed. properties: number: - maximum: 65535 - minimum: 1 + maximum: 4294967295 + minimum: 0 type: integer - required: - - number type: object - type: array - x-kubernetes-list-map-keys: - - number - x-kubernetes-list-type: map - type: object - type: array - phase: - description: 'Determines where in the filter chain this `WasmPlugin` - is to be injected. - - - Valid Options: AUTHN, AUTHZ, STATS' - enum: - - UNSPECIFIED_PHASE - - AUTHN - - AUTHZ - - STATS - type: string - pluginConfig: - description: The configuration that will be passed on to the plugin. - type: object - x-kubernetes-preserve-unknown-fields: true - pluginName: - description: The plugin name to be used in the Envoy configuration - (used to be called `rootID`). - maxLength: 256 - minLength: 1 - type: string - priority: - description: Determines ordering of `WasmPlugins` in the same `phase`. - format: int32 - nullable: true - type: integer - selector: - description: Criteria used to select the specific set of pods/VMs - on which this plugin configuration should be applied. - properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set - of pods/VMs on which a policy should be applied. - maxProperties: 4096 + subset: + description: The name of a subset within the service. + type: string + required: + - host type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) - type: object - sha256: - description: SHA256 checksum that will be used to verify Wasm module - or OCI container. - pattern: (^$|^[a-f0-9]{64}$) - type: string - targetRef: - properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string + mirrorPercent: + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + mirrorPercentage: + description: Percentage of the traffic to be mirrored by the + `mirror` field. + properties: + value: + format: double + type: number + type: object + mirror_percent: + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + mirrors: + description: Specifies the destinations to mirror HTTP traffic + in addition to the original destination. + items: + properties: + destination: + description: Destination specifies the target of the mirror + operation. + properties: + host: + description: The name of a service from the service + registry. + type: string + port: + description: Specifies the port on the host that is + being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + percentage: + description: Percentage of the traffic to be mirrored + by the `destination` field. + properties: + value: + format: double + type: number + type: object + required: + - destination + type: object + type: array name: - description: name is the name of the target resource. - maxLength: 253 - minLength: 1 + description: The name assigned to the route for debugging purposes. type: string - namespace: - description: namespace is the namespace of the referent. + redirect: + description: A HTTP rule can either return a direct_response, + redirect or forward (default) traffic. + oneOf: + - not: + anyOf: + - required: + - port + - required: + - derivePort + - required: + - port + - required: + - derivePort + properties: + authority: + description: On a redirect, overwrite the Authority/Host + portion of the URL with this value. + type: string + derivePort: + description: |- + On a redirect, dynamically set the port: * FROM_PROTOCOL_DEFAULT: automatically set to 80 for HTTP and 443 for HTTPS. + + Valid Options: FROM_PROTOCOL_DEFAULT, FROM_REQUEST_PORT + enum: + - FROM_PROTOCOL_DEFAULT + - FROM_REQUEST_PORT + type: string + port: + description: On a redirect, overwrite the port portion of + the URL with this value. + maximum: 4294967295 + minimum: 0 + type: integer + redirectCode: + description: On a redirect, Specifies the HTTP status code + to use in the redirect response. + maximum: 4294967295 + minimum: 0 + type: integer + scheme: + description: On a redirect, overwrite the scheme portion + of the URL with this value. + type: string + uri: + description: On a redirect, overwrite the Path portion of + the URL with this value. + type: string + type: object + retries: + description: Retry policy for HTTP requests. + properties: + attempts: + description: Number of retries to be allowed for a given + request. + format: int32 + type: integer + backoff: + description: Specifies the minimum duration between retry + attempts. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + perTryTimeout: + description: Timeout per attempt for a given request, including + the initial call and any retries. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + retryIgnorePreviousHosts: + description: Flag to specify whether the retries should + ignore previously tried hosts during retry. + nullable: true + type: boolean + retryOn: + description: Specifies the conditions under which retry + takes place. + type: string + retryRemoteLocalities: + description: Flag to specify whether the retries should + retry to other localities. + nullable: true + type: boolean + type: object + rewrite: + description: Rewrite HTTP URIs and Authority headers. + properties: + authority: + description: rewrite the Authority/Host header with this + value. + type: string + uri: + description: rewrite the path (or the prefix) portion of + the URI with this value. + type: string + uriRegexRewrite: + description: rewrite the path portion of the URI with the + specified regex. + properties: + match: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + rewrite: + description: The string that should replace into matching + portions of original URI. + type: string + type: object + type: object + route: + description: A HTTP rule can either return a direct_response, + redirect or forward (default) traffic. + items: + properties: + destination: + description: Destination uniquely identifies the instances + of a service to which the request/connection should + be forwarded to. + properties: + host: + description: The name of a service from the service + registry. + type: string + port: + description: Specifies the port on the host that is + being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + headers: + properties: + request: + properties: + add: + additionalProperties: + type: string + type: object + remove: + items: + type: string + type: array + set: + additionalProperties: + type: string + type: object + type: object + response: + properties: + add: + additionalProperties: + type: string + type: object + remove: + items: + type: string + type: array + set: + additionalProperties: + type: string + type: object + type: object + type: object + weight: + description: Weight specifies the relative proportion + of traffic to be forwarded to the destination. + format: int32 + type: integer + required: + - destination + type: object + type: array + timeout: + description: Timeout for HTTP requests, default is disabled. type: string x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 - required: - - kind - - name + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') type: object - targetRefs: - description: Optional. - items: - properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: name is the name of the target resource. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: namespace is the namespace of the referent. - type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently - supported - rule: self.size() == 0 - required: - - kind - - name - type: object - maxItems: 16 - type: array - type: - description: 'Specifies the type of Wasm Extension to be used. - - - Valid Options: HTTP, NETWORK' - enum: - - UNSPECIFIED_PLUGIN_TYPE - - HTTP - - NETWORK - type: string - url: - description: URL of a Wasm module or OCI container. - minLength: 1 - type: string - x-kubernetes-validations: - - message: url must have schema one of [http, https, file, oci] - rule: 'isURL(self) ? (url(self).getScheme() in ["", "http", - "https", "oci", "file"]) : (isURL("http://" + self) && - - url("http://" + self).getScheme() in ["", "http", "https", - "oci", "file"])' - verificationKey: - type: string - vmConfig: - description: Configuration for a Wasm VM. + type: array + tcp: + description: An ordered list of route rules for opaque TCP traffic. + items: properties: - env: - description: Specifies environment variables to be injected - to this VM. + match: + description: Match conditions to be satisfied for the rule to + be activated. items: properties: - name: - description: Name of the environment variable. - maxLength: 256 - minLength: 1 - type: string - value: - description: Value for the environment variable. - maxLength: 2048 + destinationSubnets: + description: IPv4 or IPv6 ip addresses of destination + with optional subnet. + items: + type: string + type: array + gateways: + description: Names of gateways where the rule should be + applied. + items: + type: string + type: array + port: + description: Specifies the port on the host that is being + addressed. + maximum: 4294967295 + minimum: 0 + type: integer + sourceLabels: + additionalProperties: + type: string + description: One or more labels that constrain the applicability + of a rule to workloads with the given labels. + type: object + sourceNamespace: + description: Source namespace constraining the applicability + of a rule to workloads in that namespace. type: string - valueFrom: - description: 'Source for the environment variable''s value. - - - Valid Options: INLINE, HOST' - enum: - - INLINE - - HOST + sourceSubnet: type: string + type: object + type: array + route: + description: The destination to which the connection should + be forwarded to. + items: + properties: + destination: + description: Destination uniquely identifies the instances + of a service to which the request/connection should + be forwarded to. + properties: + host: + description: The name of a service from the service + registry. + type: string + port: + description: Specifies the port on the host that is + being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + weight: + description: Weight specifies the relative proportion + of traffic to be forwarded to the destination. + format: int32 + type: integer required: - - name + - destination type: object - x-kubernetes-validations: - - message: value may only be set when valueFrom is INLINE - rule: '(has(self.valueFrom) ? self.valueFrom : "") != - "HOST" || !has(self.value)' - maxItems: 256 type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map type: object - required: - - url - type: object - x-kubernetes-validations: - - message: only one of targetRefs or selector can be set - rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : - 0) + (has(self.targetRefs) ? 1 : 0) <= 1' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. - - - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: + type: array + tls: + description: An ordered list of route rule for non-terminated TLS + & HTTPS traffic. + items: + properties: + match: + description: Match conditions to be satisfied for the rule to + be activated. + items: properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. + destinationSubnets: + description: IPv4 or IPv6 ip addresses of destination + with optional subnet. + items: + type: string + type: array + gateways: + description: Names of gateways where the rule should be + applied. + items: + type: string + type: array + port: + description: Specifies the port on the host that is being + addressed. + maximum: 4294967295 + minimum: 0 + type: integer + sniHosts: + description: SNI (server name indicator) to match on. + items: + type: string + type: array + sourceLabels: + additionalProperties: + type: string + description: One or more labels that constrain the applicability + of a rule to workloads with the given labels. + type: object + sourceNamespace: + description: Source namespace constraining the applicability + of a rule to workloads in that namespace. type: string + required: + - sniHosts type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - helm.sh/resource-policy: keep - labels: - app.kubernetes.io/instance: istio - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.4 - helm.sh/chart: base-1.29.4 - name: workloadentries.networking.istio.io -spec: - group: networking.istio.io - names: - categories: - - istio-io - - networking-istio-io - kind: WorkloadEntry - listKind: WorkloadEntryList - plural: workloadentries - shortNames: - - we - singular: workloadentry - scope: Namespaced - versions: - - additionalPrinterColumns: - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is - represented in RFC3339 form and is in UTC. Populated by the system. Read-only. - Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - - description: Address associated with the network endpoint. - jsonPath: .spec.address - name: Address - type: string - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting VMs onboarded into the mesh. See - more details at: https://istio.io/docs/reference/config/networking/workload-entry.html' - properties: - address: - description: Address associated with the network endpoint without - the port. - maxLength: 256 - type: string - x-kubernetes-validations: - - message: UDS must be an absolute path or abstract socket - rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == - "/" || self.substring(7, 8) == "@") : true' - - message: UDS may not be a dir - rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' - labels: - additionalProperties: - type: string - description: One or more labels associated with the endpoint. - maxProperties: 256 - type: object - locality: - description: The locality associated with the endpoint. - maxLength: 2048 - type: string - network: - description: Network enables Istio to group endpoints resident in - the same L3 domain/network. - maxLength: 2048 - type: string - ports: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - description: Set of ports associated with the endpoint. - maxProperties: 128 - type: object - x-kubernetes-validations: - - message: port name must be valid - rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) - serviceAccount: - description: The service account associated with the workload if - a sidecar is present in the workload. - maxLength: 253 - type: string - weight: - description: The load balancing weight associated with the endpoint. - maximum: 4294967295 - minimum: 0 - type: integer - type: object - x-kubernetes-validations: - - message: Address is required - rule: has(self.address) || has(self.network) - - message: UDS may not include ports - rule: '(has(self.address) ? self.address : "").startsWith("unix://") - ? !has(self.ports) : true' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. - - - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: + type: array + route: + description: The destination to which the connection should + be forwarded to. + items: properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string + destination: + description: Destination uniquely identifies the instances + of a service to which the request/connection should + be forwarded to. + properties: + host: + description: The name of a service from the service + registry. + type: string + port: + description: Specifies the port on the host that is + being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + weight: + description: Weight specifies the relative proportion + of traffic to be forwarded to the destination. + format: int32 + type: integer + required: + - destination type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} - - additionalPrinterColumns: - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is - represented in RFC3339 form and is in UTC. Populated by the system. Read-only. - Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - - description: Address associated with the network endpoint. - jsonPath: .spec.address - name: Address - type: string - name: v1alpha3 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting VMs onboarded into the mesh. See - more details at: https://istio.io/docs/reference/config/networking/workload-entry.html' - properties: - address: - description: Address associated with the network endpoint without - the port. - maxLength: 256 - type: string - x-kubernetes-validations: - - message: UDS must be an absolute path or abstract socket - rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == - "/" || self.substring(7, 8) == "@") : true' - - message: UDS may not be a dir - rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' - labels: - additionalProperties: - type: string - description: One or more labels associated with the endpoint. - maxProperties: 256 + type: array + required: + - match type: object - locality: - description: The locality associated with the endpoint. - maxLength: 2048 - type: string - network: - description: Network enables Istio to group endpoints resident in - the same L3 domain/network. - maxLength: 2048 - type: string - ports: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - description: Set of ports associated with the endpoint. - maxProperties: 128 + type: array + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string type: object - x-kubernetes-validations: - - message: port name must be valid - rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) - serviceAccount: - description: The service account associated with the workload if - a sidecar is present in the workload. - maxLength: 253 - type: string - weight: - description: The load balancing weight associated with the endpoint. - maximum: 4294967295 - minimum: 0 - type: integer - type: object - x-kubernetes-validations: - - message: Address is required - rule: has(self.address) || has(self.network) - - message: UDS may not include ports - rule: '(has(self.address) ? self.address : "").startsWith("unix://") - ? !has(self.ports) : true' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: istio + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/part-of: istio + app.kubernetes.io/version: 1.29.4 + helm.sh/chart: base-1.29.4 + name: wasmplugins.extensions.istio.io +spec: + group: extensions.istio.io + names: + categories: + - istio-io + - extensions-istio-io + kind: WasmPlugin + listKind: WasmPluginList + plural: wasmplugins + singular: wasmplugin + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Extend the functionality provided by the Istio proxy through + WebAssembly filters. See more details at: https://istio.io/docs/reference/config/proxy_extensions/wasm-plugin.html' + properties: + failStrategy: + description: |- + Specifies the failure behavior for the plugin due to fatal errors. + + Valid Options: FAIL_CLOSE, FAIL_OPEN, FAIL_RELOAD + enum: + - FAIL_CLOSE + - FAIL_OPEN + - FAIL_RELOAD + type: string + imagePullPolicy: + description: |- + The pull behaviour to be applied when fetching Wasm module by either OCI image or `http/https`. + + Valid Options: IfNotPresent, Always + enum: + - UNSPECIFIED_POLICY + - IfNotPresent + - Always + type: string + imagePullSecret: + description: Credentials to use for OCI image pulling. + maxLength: 253 + minLength: 1 + type: string + match: + description: Specifies the criteria to determine which traffic is + passed to WasmPlugin. + items: + properties: + mode: + description: |- + Criteria for selecting traffic by their direction. - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: + Valid Options: CLIENT, SERVER, CLIENT_AND_SERVER + enum: + - UNDEFINED + - CLIENT + - SERVER + - CLIENT_AND_SERVER + type: string + ports: + description: Criteria for selecting traffic by their destination + port. + items: properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string + number: + maximum: 65535 + minimum: 1 + type: integer + required: + - number type: object + type: array + x-kubernetes-list-map-keys: + - number + x-kubernetes-list-type: map + type: object + type: array + phase: + description: |- + Determines where in the filter chain this `WasmPlugin` is to be injected. + + Valid Options: AUTHN, AUTHZ, STATS + enum: + - UNSPECIFIED_PHASE + - AUTHN + - AUTHZ + - STATS + type: string + pluginConfig: + description: The configuration that will be passed on to the plugin. + type: object + x-kubernetes-preserve-unknown-fields: true + pluginName: + description: The plugin name to be used in the Envoy configuration + (used to be called `rootID`). + maxLength: 256 + minLength: 1 + type: string + priority: + description: Determines ordering of `WasmPlugins` in the same `phase`. + format: int32 + nullable: true + type: integer + selector: + description: Criteria used to select the specific set of pods/VMs + on which this plugin configuration should be applied. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which a policy should be applied. + maxProperties: 4096 type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: false - subresources: - status: {} - - additionalPrinterColumns: - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is - represented in RFC3339 form and is in UTC. Populated by the system. Read-only. - Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - - description: Address associated with the network endpoint. - jsonPath: .spec.address - name: Address - type: string - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting VMs onboarded into the mesh. See - more details at: https://istio.io/docs/reference/config/networking/workload-entry.html' - properties: - address: - description: Address associated with the network endpoint without - the port. - maxLength: 256 - type: string - x-kubernetes-validations: - - message: UDS must be an absolute path or abstract socket - rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == - "/" || self.substring(7, 8) == "@") : true' - - message: UDS may not be a dir - rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' - labels: - additionalProperties: + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + sha256: + description: SHA256 checksum that will be used to verify Wasm module + or OCI container. + pattern: (^$|^[a-f0-9]{64}$) + type: string + targetRef: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. type: string - description: One or more labels associated with the endpoint. - maxProperties: 256 - type: object - locality: - description: The locality associated with the endpoint. - maxLength: 2048 - type: string - network: - description: Network enables Istio to group endpoints resident in - the same L3 domain/network. - maxLength: 2048 - type: string - ports: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - description: Set of ports associated with the endpoint. - maxProperties: 128 + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name + type: object + targetRefs: + description: Optional. + items: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name type: object - x-kubernetes-validations: - - message: port name must be valid - rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) - serviceAccount: - description: The service account associated with the workload if - a sidecar is present in the workload. - maxLength: 253 - type: string - weight: - description: The load balancing weight associated with the endpoint. - maximum: 4294967295 - minimum: 0 - type: integer - type: object - x-kubernetes-validations: - - message: Address is required - rule: has(self.address) || has(self.network) - - message: UDS may not include ports - rule: '(has(self.address) ? self.address : "").startsWith("unix://") - ? !has(self.ports) : true' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. + maxItems: 16 + type: array + type: + description: |- + Specifies the type of Wasm Extension to be used. + + Valid Options: HTTP, NETWORK + enum: + - UNSPECIFIED_PLUGIN_TYPE + - HTTP + - NETWORK + type: string + url: + description: URL of a Wasm module or OCI container. + minLength: 1 + type: string + x-kubernetes-validations: + - message: url must have schema one of [http, https, file, oci] + rule: |- + isURL(self) ? (url(self).getScheme() in ["", "http", "https", "oci", "file"]) : (isURL("http://" + self) && + url("http://" + self).getScheme() in ["", "http", "https", "oci", "file"]) + verificationKey: + type: string + vmConfig: + description: Configuration for a Wasm VM. + properties: + env: + description: Specifies environment variables to be injected to + this VM. + items: + properties: + name: + description: Name of the environment variable. + maxLength: 256 + minLength: 1 + type: string + value: + description: Value for the environment variable. + maxLength: 2048 + type: string + valueFrom: + description: |- + Source for the environment variable's value. + Valid Options: INLINE, HOST + enum: + - INLINE + - HOST + type: string + required: + - name + type: object + x-kubernetes-validations: + - message: value may only be set when valueFrom is INLINE + rule: '(has(self.valueFrom) ? self.valueFrom : "") != "HOST" + || !has(self.value)' + maxItems: 256 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + required: + - url + type: object + x-kubernetes-validations: + - message: only one of targetRefs or selector can be set + rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + + (has(self.targetRefs) ? 1 : 0) <= 1' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: false - subresources: - status: {} + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -17225,957 +16409,1452 @@ metadata: app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.29.4 helm.sh/chart: base-1.29.4 - name: workloadgroups.networking.istio.io + name: workloadentries.networking.istio.io spec: group: networking.istio.io names: categories: - - istio-io - - networking-istio-io - kind: WorkloadGroup - listKind: WorkloadGroupList - plural: workloadgroups + - istio-io + - networking-istio-io + kind: WorkloadEntry + listKind: WorkloadEntryList + plural: workloadentries shortNames: - - wg - singular: workloadgroup + - we + singular: workloadentry scope: Namespaced versions: - - additionalPrinterColumns: - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is - represented in RFC3339 form and is in UTC. Populated by the system. Read-only. - Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Describes a collection of workload instances. See more - details at: https://istio.io/docs/reference/config/networking/workload-group.html' - properties: - metadata: - description: Metadata that will be used for all corresponding `WorkloadEntries`. + - additionalPrinterColumns: + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + - description: Address associated with the network endpoint. + jsonPath: .spec.address + name: Address + type: string + name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting VMs onboarded into the mesh. See + more details at: https://istio.io/docs/reference/config/networking/workload-entry.html' + properties: + address: + description: Address associated with the network endpoint without + the port. + maxLength: 256 + type: string + x-kubernetes-validations: + - message: UDS must be an absolute path or abstract socket + rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" + || self.substring(7, 8) == "@") : true' + - message: UDS may not be a dir + rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' + labels: + additionalProperties: + type: string + description: One or more labels associated with the endpoint. + maxProperties: 256 + type: object + locality: + description: The locality associated with the endpoint. + maxLength: 2048 + type: string + network: + description: Network enables Istio to group endpoints resident in + the same L3 domain/network. + maxLength: 2048 + type: string + ports: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + description: Set of ports associated with the endpoint. + maxProperties: 128 + type: object + x-kubernetes-validations: + - message: port name must be valid + rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) + serviceAccount: + description: The service account associated with the workload if a + sidecar is present in the workload. + maxLength: 253 + type: string + weight: + description: The load balancing weight associated with the endpoint. + maximum: 4294967295 + minimum: 0 + type: integer + type: object + x-kubernetes-validations: + - message: Address is required + rule: has(self.address) || has(self.network) + - message: UDS may not include ports + rule: '(has(self.address) ? self.address : "").startsWith("unix://") + ? !has(self.ports) : true' + status: + properties: + conditions: + description: Current service state of the resource. + items: properties: - annotations: - additionalProperties: - type: string - maxProperties: 256 - type: object - labels: - additionalProperties: - type: string - maxProperties: 256 - type: object + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string type: object - probe: - description: '`ReadinessProbe` describes the configuration the user - must provide for healthchecking on their workload.' - oneOf: - - not: - anyOf: - - required: - - httpGet - - required: - - tcpSocket - - required: - - exec - - required: - - grpc - - required: - - httpGet - - required: - - tcpSocket - - required: - - exec - - required: - - grpc + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: properties: - exec: - description: Health is determined by how the command that is - executed exited. - properties: - command: - description: Command to run. - items: - minLength: 1 - type: string - type: array - required: - - command - type: object - failureThreshold: - description: Minimum consecutive failures for the probe to be - considered failed after having succeeded. - format: int32 - minimum: 0 - type: integer - grpc: - description: GRPC call is made and response/error is used to - determine health. - properties: - port: - description: Port on which the endpoint lives. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - service: - type: string - type: object - httpGet: - description: '`httpGet` is performed to a given endpoint and - the status/able to connect determines health.' + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: properties: - host: - description: Host name to connect to, defaults to the pod - IP. - type: string - httpHeaders: - description: Headers the proxy will pass on to make the - request. - items: - properties: - name: - pattern: ^[-_A-Za-z0-9]+$ - type: string - value: - type: string - type: object - type: array - path: - description: Path to access on the HTTP server. + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. type: string - port: - description: Port on which the endpoint lives. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - scheme: + name: + description: A human-readable name for the message type. type: string - x-kubernetes-validations: - - message: scheme must be one of [HTTP, HTTPS] - rule: self in ["", "HTTP", "HTTPS"] - required: - - port type: object - initialDelaySeconds: - description: Number of seconds after the container has started - before readiness probes are initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: How often (in seconds) to perform the probe. - format: int32 - minimum: 0 - type: integer - successThreshold: - description: Minimum consecutive successes for the probe to - be considered successful after having failed. - format: int32 - minimum: 0 - type: integer - tcpSocket: - description: Health is determined by if the proxy is able to - connect. - properties: - host: - type: string - port: - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - required: - - port + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + - description: Address associated with the network endpoint. + jsonPath: .spec.address + name: Address + type: string + name: v1alpha3 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting VMs onboarded into the mesh. See + more details at: https://istio.io/docs/reference/config/networking/workload-entry.html' + properties: + address: + description: Address associated with the network endpoint without + the port. + maxLength: 256 + type: string + x-kubernetes-validations: + - message: UDS must be an absolute path or abstract socket + rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" + || self.substring(7, 8) == "@") : true' + - message: UDS may not be a dir + rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' + labels: + additionalProperties: + type: string + description: One or more labels associated with the endpoint. + maxProperties: 256 + type: object + locality: + description: The locality associated with the endpoint. + maxLength: 2048 + type: string + network: + description: Network enables Istio to group endpoints resident in + the same L3 domain/network. + maxLength: 2048 + type: string + ports: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + description: Set of ports associated with the endpoint. + maxProperties: 128 + type: object + x-kubernetes-validations: + - message: port name must be valid + rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) + serviceAccount: + description: The service account associated with the workload if a + sidecar is present in the workload. + maxLength: 253 + type: string + weight: + description: The load balancing weight associated with the endpoint. + maximum: 4294967295 + minimum: 0 + type: integer + type: object + x-kubernetes-validations: + - message: Address is required + rule: has(self.address) || has(self.network) + - message: UDS may not include ports + rule: '(has(self.address) ? self.address : "").startsWith("unix://") + ? !has(self.ports) : true' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string type: object - timeoutSeconds: - description: Number of seconds after which the probe times out. - format: int32 - minimum: 0 - type: integer type: object - template: - description: Template to be used for the generation of `WorkloadEntry` - resources that belong to this `WorkloadGroup`. + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + - description: Address associated with the network endpoint. + jsonPath: .spec.address + name: Address + type: string + name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting VMs onboarded into the mesh. See + more details at: https://istio.io/docs/reference/config/networking/workload-entry.html' + properties: + address: + description: Address associated with the network endpoint without + the port. + maxLength: 256 + type: string + x-kubernetes-validations: + - message: UDS must be an absolute path or abstract socket + rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" + || self.substring(7, 8) == "@") : true' + - message: UDS may not be a dir + rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' + labels: + additionalProperties: + type: string + description: One or more labels associated with the endpoint. + maxProperties: 256 + type: object + locality: + description: The locality associated with the endpoint. + maxLength: 2048 + type: string + network: + description: Network enables Istio to group endpoints resident in + the same L3 domain/network. + maxLength: 2048 + type: string + ports: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + description: Set of ports associated with the endpoint. + maxProperties: 128 + type: object + x-kubernetes-validations: + - message: port name must be valid + rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) + serviceAccount: + description: The service account associated with the workload if a + sidecar is present in the workload. + maxLength: 253 + type: string + weight: + description: The load balancing weight associated with the endpoint. + maximum: 4294967295 + minimum: 0 + type: integer + type: object + x-kubernetes-validations: + - message: Address is required + rule: has(self.address) || has(self.network) + - message: UDS may not include ports + rule: '(has(self.address) ? self.address : "").startsWith("unix://") + ? !has(self.ports) : true' + status: + properties: + conditions: + description: Current service state of the resource. + items: properties: - address: - description: Address associated with the network endpoint without - the port. - maxLength: 256 + lastProbeTime: + description: Last time we probed the condition. + format: date-time type: string - x-kubernetes-validations: - - message: UDS must be an absolute path or abstract socket - rule: 'self.startsWith("unix://") ? (self.substring(7, 8) - == "/" || self.substring(7, 8) == "@") : true' - - message: UDS may not be a dir - rule: 'self.startsWith("unix://") ? !self.endsWith("/") - : true' - labels: - additionalProperties: - type: string - description: One or more labels associated with the endpoint. - maxProperties: 256 + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string type: object - locality: - description: The locality associated with the endpoint. - maxLength: 2048 + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: istio + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/part-of: istio + app.kubernetes.io/version: 1.29.4 + helm.sh/chart: base-1.29.4 + name: workloadgroups.networking.istio.io +spec: + group: networking.istio.io + names: + categories: + - istio-io + - networking-istio-io + kind: WorkloadGroup + listKind: WorkloadGroupList + plural: workloadgroups + shortNames: + - wg + singular: workloadgroup + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Describes a collection of workload instances. See more details + at: https://istio.io/docs/reference/config/networking/workload-group.html' + properties: + metadata: + description: Metadata that will be used for all corresponding `WorkloadEntries`. + properties: + annotations: + additionalProperties: type: string - network: - description: Network enables Istio to group endpoints resident - in the same L3 domain/network. - maxLength: 2048 + maxProperties: 256 + type: object + labels: + additionalProperties: type: string - ports: - additionalProperties: + maxProperties: 256 + type: object + type: object + probe: + description: '`ReadinessProbe` describes the configuration the user + must provide for healthchecking on their workload.' + oneOf: + - not: + anyOf: + - required: + - httpGet + - required: + - tcpSocket + - required: + - exec + - required: + - grpc + - required: + - httpGet + - required: + - tcpSocket + - required: + - exec + - required: + - grpc + properties: + exec: + description: Health is determined by how the command that is executed + exited. + properties: + command: + description: Command to run. + items: + minLength: 1 + type: string + type: array + required: + - command + type: object + failureThreshold: + description: Minimum consecutive failures for the probe to be + considered failed after having succeeded. + format: int32 + minimum: 0 + type: integer + grpc: + description: GRPC call is made and response/error is used to determine + health. + properties: + port: + description: Port on which the endpoint lives. maximum: 4294967295 minimum: 0 type: integer x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - description: Set of ports associated with the endpoint. - maxProperties: 128 - type: object - x-kubernetes-validations: - - message: port name must be valid - rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) - serviceAccount: - description: The service account associated with the workload - if a sidecar is present in the workload. - maxLength: 253 - type: string - weight: - description: The load balancing weight associated with the endpoint. - maximum: 4294967295 - minimum: 0 - type: integer - type: object - x-kubernetes-validations: - - message: UDS may not include ports - rule: '(has(self.address) ? self.address : "").startsWith("unix://") - ? !has(self.ports) : true' - required: - - template - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + service: type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. + type: object + httpGet: + description: '`httpGet` is performed to a given endpoint and the + status/able to connect determines health.' + properties: + host: + description: Host name to connect to, defaults to the pod + IP. type: string - status: - description: Status is the status of the condition. + httpHeaders: + description: Headers the proxy will pass on to make the request. + items: + properties: + name: + pattern: ^[-_A-Za-z0-9]+$ + type: string + value: + type: string + type: object + type: array + path: + description: Path to access on the HTTP server. type: string - type: - description: Type is the type of the condition. + port: + description: Port on which the endpoint lives. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + scheme: type: string + x-kubernetes-validations: + - message: scheme must be one of [HTTP, HTTPS] + rule: self in ["", "HTTP", "HTTPS"] + required: + - port type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: + initialDelaySeconds: + description: Number of seconds after the container has started + before readiness probes are initiated. + format: int32 + minimum: 0 + type: integer + periodSeconds: + description: How often (in seconds) to perform the probe. + format: int32 + minimum: 0 + type: integer + successThreshold: + description: Minimum consecutive successes for the probe to be + considered successful after having failed. + format: int32 + minimum: 0 + type: integer + tcpSocket: + description: Health is determined by if the proxy is able to connect. properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. - - - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO + host: type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object + port: + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + required: + - port type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} - - additionalPrinterColumns: - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is - represented in RFC3339 form and is in UTC. Populated by the system. Read-only. - Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1alpha3 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Describes a collection of workload instances. See more - details at: https://istio.io/docs/reference/config/networking/workload-group.html' - properties: - metadata: - description: Metadata that will be used for all corresponding `WorkloadEntries`. - properties: - annotations: - additionalProperties: - type: string - maxProperties: 256 - type: object - labels: - additionalProperties: - type: string - maxProperties: 256 - type: object - type: object - probe: - description: '`ReadinessProbe` describes the configuration the user - must provide for healthchecking on their workload.' - oneOf: - - not: - anyOf: - - required: - - httpGet - - required: - - tcpSocket - - required: - - exec - - required: - - grpc - - required: - - httpGet - - required: - - tcpSocket - - required: - - exec - - required: - - grpc - properties: - exec: - description: Health is determined by how the command that is - executed exited. - properties: - command: - description: Command to run. - items: - minLength: 1 - type: string - type: array - required: - - command - type: object - failureThreshold: - description: Minimum consecutive failures for the probe to be - considered failed after having succeeded. - format: int32 - minimum: 0 - type: integer - grpc: - description: GRPC call is made and response/error is used to - determine health. - properties: - port: - description: Port on which the endpoint lives. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - service: - type: string - type: object - httpGet: - description: '`httpGet` is performed to a given endpoint and - the status/able to connect determines health.' - properties: - host: - description: Host name to connect to, defaults to the pod - IP. - type: string - httpHeaders: - description: Headers the proxy will pass on to make the - request. - items: - properties: - name: - pattern: ^[-_A-Za-z0-9]+$ - type: string - value: - type: string - type: object - type: array - path: - description: Path to access on the HTTP server. - type: string - port: - description: Port on which the endpoint lives. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - scheme: - type: string - x-kubernetes-validations: - - message: scheme must be one of [HTTP, HTTPS] - rule: self in ["", "HTTP", "HTTPS"] - required: - - port - type: object - initialDelaySeconds: - description: Number of seconds after the container has started - before readiness probes are initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: How often (in seconds) to perform the probe. - format: int32 - minimum: 0 - type: integer - successThreshold: - description: Minimum consecutive successes for the probe to - be considered successful after having failed. - format: int32 - minimum: 0 - type: integer - tcpSocket: - description: Health is determined by if the proxy is able to - connect. - properties: - host: - type: string - port: - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - required: - - port - type: object - timeoutSeconds: - description: Number of seconds after which the probe times out. - format: int32 + timeoutSeconds: + description: Number of seconds after which the probe times out. + format: int32 + minimum: 0 + type: integer + type: object + template: + description: Template to be used for the generation of `WorkloadEntry` + resources that belong to this `WorkloadGroup`. + properties: + address: + description: Address associated with the network endpoint without + the port. + maxLength: 256 + type: string + x-kubernetes-validations: + - message: UDS must be an absolute path or abstract socket + rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == + "/" || self.substring(7, 8) == "@") : true' + - message: UDS may not be a dir + rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' + labels: + additionalProperties: + type: string + description: One or more labels associated with the endpoint. + maxProperties: 256 + type: object + locality: + description: The locality associated with the endpoint. + maxLength: 2048 + type: string + network: + description: Network enables Istio to group endpoints resident + in the same L3 domain/network. + maxLength: 2048 + type: string + ports: + additionalProperties: + maximum: 4294967295 minimum: 0 type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + description: Set of ports associated with the endpoint. + maxProperties: 128 + type: object + x-kubernetes-validations: + - message: port name must be valid + rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) + serviceAccount: + description: The service account associated with the workload + if a sidecar is present in the workload. + maxLength: 253 + type: string + weight: + description: The load balancing weight associated with the endpoint. + maximum: 4294967295 + minimum: 0 + type: integer + type: object + x-kubernetes-validations: + - message: UDS may not include ports + rule: '(has(self.address) ? self.address : "").startsWith("unix://") + ? !has(self.ports) : true' + required: + - template + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string type: object - template: - description: Template to be used for the generation of `WorkloadEntry` - resources that belong to this `WorkloadGroup`. + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: properties: - address: - description: Address associated with the network endpoint without - the port. - maxLength: 256 + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. type: string - x-kubernetes-validations: - - message: UDS must be an absolute path or abstract socket - rule: 'self.startsWith("unix://") ? (self.substring(7, 8) - == "/" || self.substring(7, 8) == "@") : true' - - message: UDS may not be a dir - rule: 'self.startsWith("unix://") ? !self.endsWith("/") - : true' - labels: - additionalProperties: - type: string - description: One or more labels associated with the endpoint. - maxProperties: 256 + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string type: object - locality: - description: The locality associated with the endpoint. - maxLength: 2048 + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha3 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Describes a collection of workload instances. See more details + at: https://istio.io/docs/reference/config/networking/workload-group.html' + properties: + metadata: + description: Metadata that will be used for all corresponding `WorkloadEntries`. + properties: + annotations: + additionalProperties: type: string - network: - description: Network enables Istio to group endpoints resident - in the same L3 domain/network. - maxLength: 2048 + maxProperties: 256 + type: object + labels: + additionalProperties: type: string - ports: - additionalProperties: + maxProperties: 256 + type: object + type: object + probe: + description: '`ReadinessProbe` describes the configuration the user + must provide for healthchecking on their workload.' + oneOf: + - not: + anyOf: + - required: + - httpGet + - required: + - tcpSocket + - required: + - exec + - required: + - grpc + - required: + - httpGet + - required: + - tcpSocket + - required: + - exec + - required: + - grpc + properties: + exec: + description: Health is determined by how the command that is executed + exited. + properties: + command: + description: Command to run. + items: + minLength: 1 + type: string + type: array + required: + - command + type: object + failureThreshold: + description: Minimum consecutive failures for the probe to be + considered failed after having succeeded. + format: int32 + minimum: 0 + type: integer + grpc: + description: GRPC call is made and response/error is used to determine + health. + properties: + port: + description: Port on which the endpoint lives. maximum: 4294967295 minimum: 0 type: integer x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - description: Set of ports associated with the endpoint. - maxProperties: 128 - type: object - x-kubernetes-validations: - - message: port name must be valid - rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) - serviceAccount: - description: The service account associated with the workload - if a sidecar is present in the workload. - maxLength: 253 - type: string - weight: - description: The load balancing weight associated with the endpoint. - maximum: 4294967295 - minimum: 0 - type: integer - type: object - x-kubernetes-validations: - - message: UDS may not include ports - rule: '(has(self.address) ? self.address : "").startsWith("unix://") - ? !has(self.ports) : true' - required: - - template - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + service: type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. + type: object + httpGet: + description: '`httpGet` is performed to a given endpoint and the + status/able to connect determines health.' + properties: + host: + description: Host name to connect to, defaults to the pod + IP. type: string - status: - description: Status is the status of the condition. + httpHeaders: + description: Headers the proxy will pass on to make the request. + items: + properties: + name: + pattern: ^[-_A-Za-z0-9]+$ + type: string + value: + type: string + type: object + type: array + path: + description: Path to access on the HTTP server. type: string - type: - description: Type is the type of the condition. + port: + description: Port on which the endpoint lives. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + scheme: type: string + x-kubernetes-validations: + - message: scheme must be one of [HTTP, HTTPS] + rule: self in ["", "HTTP", "HTTPS"] + required: + - port type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: + initialDelaySeconds: + description: Number of seconds after the container has started + before readiness probes are initiated. + format: int32 + minimum: 0 + type: integer + periodSeconds: + description: How often (in seconds) to perform the probe. + format: int32 + minimum: 0 + type: integer + successThreshold: + description: Minimum consecutive successes for the probe to be + considered successful after having failed. + format: int32 + minimum: 0 + type: integer + tcpSocket: + description: Health is determined by if the proxy is able to connect. properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. - - - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO + host: type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object + port: + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + required: + - port + type: object + timeoutSeconds: + description: Number of seconds after which the probe times out. + format: int32 + minimum: 0 + type: integer + type: object + template: + description: Template to be used for the generation of `WorkloadEntry` + resources that belong to this `WorkloadGroup`. + properties: + address: + description: Address associated with the network endpoint without + the port. + maxLength: 256 + type: string + x-kubernetes-validations: + - message: UDS must be an absolute path or abstract socket + rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == + "/" || self.substring(7, 8) == "@") : true' + - message: UDS may not be a dir + rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' + labels: + additionalProperties: + type: string + description: One or more labels associated with the endpoint. + maxProperties: 256 + type: object + locality: + description: The locality associated with the endpoint. + maxLength: 2048 + type: string + network: + description: Network enables Istio to group endpoints resident + in the same L3 domain/network. + maxLength: 2048 + type: string + ports: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + description: Set of ports associated with the endpoint. + maxProperties: 128 type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: false - subresources: - status: {} - - additionalPrinterColumns: - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is - represented in RFC3339 form and is in UTC. Populated by the system. Read-only. - Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Describes a collection of workload instances. See more - details at: https://istio.io/docs/reference/config/networking/workload-group.html' - properties: - metadata: - description: Metadata that will be used for all corresponding `WorkloadEntries`. + x-kubernetes-validations: + - message: port name must be valid + rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) + serviceAccount: + description: The service account associated with the workload + if a sidecar is present in the workload. + maxLength: 253 + type: string + weight: + description: The load balancing weight associated with the endpoint. + maximum: 4294967295 + minimum: 0 + type: integer + type: object + x-kubernetes-validations: + - message: UDS may not include ports + rule: '(has(self.address) ? self.address : "").startsWith("unix://") + ? !has(self.ports) : true' + required: + - template + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: properties: - annotations: - additionalProperties: - type: string - maxProperties: 256 - type: object - labels: - additionalProperties: - type: string - maxProperties: 256 - type: object + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string type: object - probe: - description: '`ReadinessProbe` describes the configuration the user - must provide for healthchecking on their workload.' - oneOf: - - not: - anyOf: - - required: - - httpGet - - required: - - tcpSocket - - required: - - exec - - required: - - grpc - - required: - - httpGet - - required: - - tcpSocket - - required: - - exec - - required: - - grpc + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: properties: - exec: - description: Health is determined by how the command that is - executed exited. - properties: - command: - description: Command to run. - items: - minLength: 1 - type: string - type: array - required: - - command - type: object - failureThreshold: - description: Minimum consecutive failures for the probe to be - considered failed after having succeeded. - format: int32 - minimum: 0 - type: integer - grpc: - description: GRPC call is made and response/error is used to - determine health. - properties: - port: - description: Port on which the endpoint lives. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - service: - type: string - type: object - httpGet: - description: '`httpGet` is performed to a given endpoint and - the status/able to connect determines health.' + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: properties: - host: - description: Host name to connect to, defaults to the pod - IP. - type: string - httpHeaders: - description: Headers the proxy will pass on to make the - request. - items: - properties: - name: - pattern: ^[-_A-Za-z0-9]+$ - type: string - value: - type: string - type: object - type: array - path: - description: Path to access on the HTTP server. - type: string - port: - description: Port on which the endpoint lives. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - scheme: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. type: string - x-kubernetes-validations: - - message: scheme must be one of [HTTP, HTTPS] - rule: self in ["", "HTTP", "HTTPS"] - required: - - port - type: object - initialDelaySeconds: - description: Number of seconds after the container has started - before readiness probes are initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: How often (in seconds) to perform the probe. - format: int32 - minimum: 0 - type: integer - successThreshold: - description: Minimum consecutive successes for the probe to - be considered successful after having failed. - format: int32 - minimum: 0 - type: integer - tcpSocket: - description: Health is determined by if the proxy is able to - connect. - properties: - host: + name: + description: A human-readable name for the message type. type: string - port: - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - required: - - port type: object - timeoutSeconds: - description: Number of seconds after which the probe times out. - format: int32 - minimum: 0 - type: integer type: object - template: - description: Template to be used for the generation of `WorkloadEntry` - resources that belong to this `WorkloadGroup`. - properties: - address: - description: Address associated with the network endpoint without - the port. - maxLength: 256 + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Describes a collection of workload instances. See more details + at: https://istio.io/docs/reference/config/networking/workload-group.html' + properties: + metadata: + description: Metadata that will be used for all corresponding `WorkloadEntries`. + properties: + annotations: + additionalProperties: type: string - x-kubernetes-validations: - - message: UDS must be an absolute path or abstract socket - rule: 'self.startsWith("unix://") ? (self.substring(7, 8) - == "/" || self.substring(7, 8) == "@") : true' - - message: UDS may not be a dir - rule: 'self.startsWith("unix://") ? !self.endsWith("/") - : true' - labels: - additionalProperties: - type: string - description: One or more labels associated with the endpoint. - maxProperties: 256 - type: object - locality: - description: The locality associated with the endpoint. - maxLength: 2048 - type: string - network: - description: Network enables Istio to group endpoints resident - in the same L3 domain/network. - maxLength: 2048 + maxProperties: 256 + type: object + labels: + additionalProperties: type: string - ports: - additionalProperties: + maxProperties: 256 + type: object + type: object + probe: + description: '`ReadinessProbe` describes the configuration the user + must provide for healthchecking on their workload.' + oneOf: + - not: + anyOf: + - required: + - httpGet + - required: + - tcpSocket + - required: + - exec + - required: + - grpc + - required: + - httpGet + - required: + - tcpSocket + - required: + - exec + - required: + - grpc + properties: + exec: + description: Health is determined by how the command that is executed + exited. + properties: + command: + description: Command to run. + items: + minLength: 1 + type: string + type: array + required: + - command + type: object + failureThreshold: + description: Minimum consecutive failures for the probe to be + considered failed after having succeeded. + format: int32 + minimum: 0 + type: integer + grpc: + description: GRPC call is made and response/error is used to determine + health. + properties: + port: + description: Port on which the endpoint lives. maximum: 4294967295 minimum: 0 type: integer x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - description: Set of ports associated with the endpoint. - maxProperties: 128 - type: object - x-kubernetes-validations: - - message: port name must be valid - rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) - serviceAccount: - description: The service account associated with the workload - if a sidecar is present in the workload. - maxLength: 253 - type: string - weight: - description: The load balancing weight associated with the endpoint. - maximum: 4294967295 - minimum: 0 - type: integer - type: object - x-kubernetes-validations: - - message: UDS may not include ports - rule: '(has(self.address) ? self.address : "").startsWith("unix://") - ? !has(self.ports) : true' - required: - - template - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one - status to another. - format: date-time + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + service: type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. + type: object + httpGet: + description: '`httpGet` is performed to a given endpoint and the + status/able to connect determines health.' + properties: + host: + description: Host name to connect to, defaults to the pod + IP. type: string - status: - description: Status is the status of the condition. + httpHeaders: + description: Headers the proxy will pass on to make the request. + items: + properties: + name: + pattern: ^[-_A-Za-z0-9]+$ + type: string + value: + type: string + type: object + type: array + path: + description: Path to access on the HTTP server. type: string - type: - description: Type is the type of the condition. + port: + description: Port on which the endpoint lives. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + scheme: type: string + x-kubernetes-validations: + - message: scheme must be one of [HTTP, HTTPS] + rule: self in ["", "HTTP", "HTTPS"] + required: + - port type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's - analyzers. - items: + initialDelaySeconds: + description: Number of seconds after the container has started + before readiness probes are initiated. + format: int32 + minimum: 0 + type: integer + periodSeconds: + description: How often (in seconds) to perform the probe. + format: int32 + minimum: 0 + type: integer + successThreshold: + description: Minimum consecutive successes for the probe to be + considered successful after having failed. + format: int32 + minimum: 0 + type: integer + tcpSocket: + description: Health is determined by if the proxy is able to connect. properties: - documentationUrl: - description: A url pointing to the Istio documentation for - this specific error type. - type: string - level: - description: 'Represents how severe a message is. - - - Valid Options: UNKNOWN, ERROR, WARNING, INFO' - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO + host: type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object + port: + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + required: + - port + type: object + timeoutSeconds: + description: Number of seconds after which the probe times out. + format: int32 + minimum: 0 + type: integer + type: object + template: + description: Template to be used for the generation of `WorkloadEntry` + resources that belong to this `WorkloadGroup`. + properties: + address: + description: Address associated with the network endpoint without + the port. + maxLength: 256 + type: string + x-kubernetes-validations: + - message: UDS must be an absolute path or abstract socket + rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == + "/" || self.substring(7, 8) == "@") : true' + - message: UDS may not be a dir + rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' + labels: + additionalProperties: + type: string + description: One or more labels associated with the endpoint. + maxProperties: 256 + type: object + locality: + description: The locality associated with the endpoint. + maxLength: 2048 + type: string + network: + description: Network enables Istio to group endpoints resident + in the same L3 domain/network. + maxLength: 2048 + type: string + ports: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + description: Set of ports associated with the endpoint. + maxProperties: 128 type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: false - subresources: - status: {} + x-kubernetes-validations: + - message: port name must be valid + rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) + serviceAccount: + description: The service account associated with the workload + if a sidecar is present in the workload. + maxLength: 253 + type: string + weight: + description: The load balancing weight associated with the endpoint. + maximum: 4294967295 + minimum: 0 + type: integer + type: object + x-kubernetes-validations: + - message: UDS may not include ports + rule: '(has(self.address) ? self.address : "").startsWith("unix://") + ? !has(self.ports) : true' + required: + - template + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} --- apiVersion: v1 kind: ServiceAccount @@ -18221,106 +17900,106 @@ metadata: release: istio name: istio-reader-clusterrole-default rules: - - apiGroups: - - config.istio.io - - security.istio.io - - networking.istio.io - - authentication.istio.io - - rbac.istio.io - - telemetry.istio.io - - extensions.istio.io - resources: - - '*' - verbs: - - get - - list - - watch - - apiGroups: - - '' - resources: - - endpoints - - pods - - services - - nodes - - replicationcontrollers - - namespaces - - secrets - - configmaps - verbs: - - get - - list - - watch - - apiGroups: - - networking.istio.io - resources: - - workloadentries - verbs: - - get - - watch - - list - - apiGroups: - - networking.x-k8s.io - - gateway.networking.k8s.io - resources: - - gateways - verbs: - - get - - watch - - list - - apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - get - - list - - watch - - apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - - watch - - apiGroups: - - multicluster.x-k8s.io - resources: - - serviceexports - verbs: - - get - - list - - watch - - create - - delete - - apiGroups: - - multicluster.x-k8s.io - resources: - - serviceimports - verbs: - - get - - list - - watch - - apiGroups: - - apps - resources: - - replicasets - verbs: - - get - - list - - watch - - apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create - - apiGroups: - - authorization.k8s.io - resources: - - subjectaccessreviews - verbs: - - create +- apiGroups: + - config.istio.io + - security.istio.io + - networking.istio.io + - authentication.istio.io + - rbac.istio.io + - telemetry.istio.io + - extensions.istio.io + resources: + - '*' + verbs: + - get + - list + - watch +- apiGroups: + - '' + resources: + - endpoints + - pods + - services + - nodes + - replicationcontrollers + - namespaces + - secrets + - configmaps + verbs: + - get + - list + - watch +- apiGroups: + - networking.istio.io + resources: + - workloadentries + verbs: + - get + - watch + - list +- apiGroups: + - networking.x-k8s.io + - gateway.networking.k8s.io + resources: + - gateways + verbs: + - get + - watch + - list +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch +- apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - get + - list + - watch +- apiGroups: + - multicluster.x-k8s.io + resources: + - serviceexports + verbs: + - get + - list + - watch + - create + - delete +- apiGroups: + - multicluster.x-k8s.io + resources: + - serviceimports + verbs: + - get + - list + - watch +- apiGroups: + - apps + resources: + - replicasets + verbs: + - get + - list + - watch +- apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create +- apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -18336,235 +18015,235 @@ metadata: release: istio name: istiod-clusterrole-default rules: - - apiGroups: - - admissionregistration.k8s.io - resources: - - mutatingwebhookconfigurations - verbs: - - get - - list - - watch - - update - - patch - - apiGroups: - - admissionregistration.k8s.io - resources: - - validatingwebhookconfigurations - verbs: - - get - - list - - watch - - update - - apiGroups: - - config.istio.io - - security.istio.io - - networking.istio.io - - authentication.istio.io - - rbac.istio.io - - telemetry.istio.io - - extensions.istio.io - resources: - - '*' - verbs: - - get - - watch - - list - - apiGroups: - - networking.istio.io - resources: - - workloadentries - verbs: - - get - - watch - - list - - update - - patch - - create - - delete - - apiGroups: - - networking.istio.io - resources: - - workloadentries/status - - serviceentries/status - verbs: - - get - - watch - - list - - update - - patch - - create - - delete - - apiGroups: - - security.istio.io - resources: - - authorizationpolicies/status - verbs: - - get - - watch - - list - - update - - patch - - create - - delete - - apiGroups: - - '' - resources: - - services/status - verbs: - - get - - watch - - list - - update - - patch - - create - - delete - - apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - get - - list - - watch - - apiGroups: - - '' - resources: - - pods - - nodes - - services - - namespaces - - endpoints - verbs: - - get - - list - - watch - - apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - - watch - - apiGroups: - - networking.k8s.io - resources: - - ingresses - - ingressclasses - verbs: - - get - - list - - watch - - apiGroups: - - networking.k8s.io - resources: - - ingresses/status - verbs: - - '*' - - apiGroups: - - '' - resources: - - configmaps - verbs: - - create - - get - - list - - watch - - update - - apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create - - apiGroups: - - authorization.k8s.io - resources: - - subjectaccessreviews - verbs: - - create - - apiGroups: - - gateway.networking.k8s.io - - gateway.networking.x-k8s.io - resources: - - '*' - verbs: - - get - - watch - - list - - apiGroups: - - gateway.networking.x-k8s.io - resources: - - xbackendtrafficpolicies/status - - xlistenersets/status - verbs: - - update - - patch - - apiGroups: - - gateway.networking.k8s.io - resources: - - backendtlspolicies/status - - gatewayclasses/status - - gateways/status - - grpcroutes/status - - httproutes/status - - referencegrants/status - - tcproutes/status - - tlsroutes/status - - udproutes/status - verbs: - - update - - patch - - apiGroups: - - gateway.networking.k8s.io - resources: - - gatewayclasses - verbs: - - create - - update - - patch - - delete - - apiGroups: - - inference.networking.k8s.io - resources: - - inferencepools - verbs: - - get - - watch - - list - - apiGroups: - - inference.networking.k8s.io - resources: - - inferencepools/status - verbs: - - update - - patch - - apiGroups: - - '' - resources: - - secrets - verbs: - - get - - watch - - list - - apiGroups: - - multicluster.x-k8s.io - resources: - - serviceexports - verbs: - - get - - watch - - list - - create - - delete - - apiGroups: - - multicluster.x-k8s.io - resources: - - serviceimports - verbs: - - get - - watch - - list +- apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + verbs: + - get + - list + - watch + - update + - patch +- apiGroups: + - admissionregistration.k8s.io + resources: + - validatingwebhookconfigurations + verbs: + - get + - list + - watch + - update +- apiGroups: + - config.istio.io + - security.istio.io + - networking.istio.io + - authentication.istio.io + - rbac.istio.io + - telemetry.istio.io + - extensions.istio.io + resources: + - '*' + verbs: + - get + - watch + - list +- apiGroups: + - networking.istio.io + resources: + - workloadentries + verbs: + - get + - watch + - list + - update + - patch + - create + - delete +- apiGroups: + - networking.istio.io + resources: + - workloadentries/status + - serviceentries/status + verbs: + - get + - watch + - list + - update + - patch + - create + - delete +- apiGroups: + - security.istio.io + resources: + - authorizationpolicies/status + verbs: + - get + - watch + - list + - update + - patch + - create + - delete +- apiGroups: + - '' + resources: + - services/status + verbs: + - get + - watch + - list + - update + - patch + - create + - delete +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch +- apiGroups: + - '' + resources: + - pods + - nodes + - services + - namespaces + - endpoints + verbs: + - get + - list + - watch +- apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - get + - list + - watch +- apiGroups: + - networking.k8s.io + resources: + - ingresses + - ingressclasses + verbs: + - get + - list + - watch +- apiGroups: + - networking.k8s.io + resources: + - ingresses/status + verbs: + - '*' +- apiGroups: + - '' + resources: + - configmaps + verbs: + - create + - get + - list + - watch + - update +- apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create +- apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create +- apiGroups: + - gateway.networking.k8s.io + - gateway.networking.x-k8s.io + resources: + - '*' + verbs: + - get + - watch + - list +- apiGroups: + - gateway.networking.x-k8s.io + resources: + - xbackendtrafficpolicies/status + - xlistenersets/status + verbs: + - update + - patch +- apiGroups: + - gateway.networking.k8s.io + resources: + - backendtlspolicies/status + - gatewayclasses/status + - gateways/status + - grpcroutes/status + - httproutes/status + - referencegrants/status + - tcproutes/status + - tlsroutes/status + - udproutes/status + verbs: + - update + - patch +- apiGroups: + - gateway.networking.k8s.io + resources: + - gatewayclasses + verbs: + - create + - update + - patch + - delete +- apiGroups: + - inference.networking.k8s.io + resources: + - inferencepools + verbs: + - get + - watch + - list +- apiGroups: + - inference.networking.k8s.io + resources: + - inferencepools/status + verbs: + - update + - patch +- apiGroups: + - '' + resources: + - secrets + verbs: + - get + - watch + - list +- apiGroups: + - multicluster.x-k8s.io + resources: + - serviceexports + verbs: + - get + - watch + - list + - create + - delete +- apiGroups: + - multicluster.x-k8s.io + resources: + - serviceimports + verbs: + - get + - watch + - list --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -18580,66 +18259,66 @@ metadata: release: istio name: istiod-gateway-controller-default rules: - - apiGroups: - - apps - resources: - - deployments - verbs: - - get - - watch - - list - - update - - patch - - create - - delete - - apiGroups: - - autoscaling - resources: - - horizontalpodautoscalers - verbs: - - get - - watch - - list - - update - - patch - - create - - delete - - apiGroups: - - policy - resources: - - poddisruptionbudgets - verbs: - - get - - watch - - list - - update - - patch - - create - - delete - - apiGroups: - - '' - resources: - - services - verbs: - - get - - watch - - list - - update - - patch - - create - - delete - - apiGroups: - - '' - resources: - - serviceaccounts - verbs: - - get - - watch - - list - - update - - patch - - create - - delete +- apiGroups: + - apps + resources: + - deployments + verbs: + - get + - watch + - list + - update + - patch + - create + - delete +- apiGroups: + - autoscaling + resources: + - horizontalpodautoscalers + verbs: + - get + - watch + - list + - update + - patch + - create + - delete +- apiGroups: + - policy + resources: + - poddisruptionbudgets + verbs: + - get + - watch + - list + - update + - patch + - create + - delete +- apiGroups: + - '' + resources: + - services + verbs: + - get + - watch + - list + - update + - patch + - create + - delete +- apiGroups: + - '' + resources: + - serviceaccounts + verbs: + - get + - watch + - list + - update + - patch + - create + - delete --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -18659,9 +18338,9 @@ roleRef: kind: ClusterRole name: istio-reader-clusterrole-default subjects: - - kind: ServiceAccount - name: istio-reader-service-account - namespace: default +- kind: ServiceAccount + name: istio-reader-service-account + namespace: default --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -18681,9 +18360,9 @@ roleRef: kind: ClusterRole name: istiod-clusterrole-default subjects: - - kind: ServiceAccount - name: istiod - namespace: default +- kind: ServiceAccount + name: istiod + namespace: default --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -18703,9 +18382,9 @@ roleRef: kind: ClusterRole name: istiod-gateway-controller-default subjects: - - kind: ServiceAccount - name: istiod - namespace: default +- kind: ServiceAccount + name: istiod + namespace: default --- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration @@ -18723,35 +18402,35 @@ metadata: release: istio name: istio-validator-default webhooks: - - admissionReviewVersions: - - v1 - clientConfig: - service: - name: istiod - namespace: default - path: /validate - failurePolicy: Ignore - name: rev.validation.istio.io - objectSelector: - matchExpressions: - - key: istio.io/rev - operator: In - values: - - default - rules: - - apiGroups: - - security.istio.io - - networking.istio.io - - telemetry.istio.io - - extensions.istio.io - apiVersions: - - '*' - operations: - - CREATE - - UPDATE - resources: - - '*' - sideEffects: None +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: istiod + namespace: default + path: /validate + failurePolicy: Ignore + name: rev.validation.istio.io + objectSelector: + matchExpressions: + - key: istio.io/rev + operator: In + values: + - default + rules: + - apiGroups: + - security.istio.io + - networking.istio.io + - telemetry.istio.io + - extensions.istio.io + apiVersions: + - '*' + operations: + - CREATE + - UPDATE + resources: + - '*' + sideEffects: None --- apiVersion: v1 data: @@ -18767,19 +18446,19 @@ data: - prometheus enablePrometheusMerge: true extensionProviders: - {{- if .Values.istio.additionalExtensionProviders }} - {{- toYaml .Values.istio.additionalExtensionProviders | nindent 6 }} - {{- end }} - - name: crc-auth-gateway - envoyExtAuthzHttp: - service: crc-auth-gateway-istio.default.svc.cluster.local - port: "8080" - includeRequestHeadersInCheck: - - authorization - - x-forwarded-access-token - - x-auth-url - headersToUpstreamOnAllow: - - authorization + {{- if .Values.istio.additionalExtensionProviders }} + {{- toYaml .Values.istio.additionalExtensionProviders | nindent 6 }} + {{- end }} + - envoyExtAuthzHttp: + headersToUpstreamOnAllow: + - authorization + includeRequestHeadersInCheck: + - authorization + - x-forwarded-access-token + - x-auth-url + port: "8080" + service: crc-auth-gateway-istio.default.svc.cluster.local + name: crc-auth-gateway rootNamespace: default trustDomain: cluster.local meshNetworks: 'networks: {}' @@ -18801,10 +18480,8 @@ metadata: --- apiVersion: v1 data: - config: |- -{{ .Files.Get "files/istio-config.yaml" | nindent 4 }} - values: |- -{{ .Files.Get "files/istio-values.json" | nindent 4 }} + config: '{{ .Files.Get "files/istio-config.yaml" }}' + values: '{{ .Files.Get "files/istio-values.json" }}' kind: ConfigMap metadata: labels: @@ -18823,138 +18500,323 @@ metadata: --- apiVersion: v1 data: - merged-values: "{\n \"affinity\": {},\n \"autoscaleBehavior\": {},\n \"autoscaleEnabled\"\ - : true,\n \"autoscaleMax\": 5,\n \"autoscaleMin\": 1,\n \"base\": {\n \"\ - enableIstioConfigCRDs\": true\n },\n \"cni\": {\n \"cniBinDir\": \"\",\n\ - \ \"enabled\": false,\n \"provider\": \"default\",\n \"resourceQuotas\"\ - : {\n \"enabled\": false\n }\n },\n \"configMap\": true,\n \"cpu\"\ - : {\n \"targetAverageUtilization\": 80\n },\n \"defaultRevision\": \"\",\n\ - \ \"deploymentAnnotations\": {},\n \"deploymentLabels\": {},\n \"enabled\"\ - : true,\n \"env\": {},\n \"envVarFrom\": [],\n \"experimental\": {\n \"\ - stableValidationPolicy\": false\n },\n \"extraContainerArgs\": [],\n \"gatewayClasses\"\ - : {},\n \"gateways\": {\n \"istio-egressgateway\": {},\n \"istio-ingressgateway\"\ - : {},\n \"seccompProfile\": {},\n \"securityContext\": {}\n },\n \"global\"\ - : {\n \"caAddress\": \"\",\n \"caName\": \"\",\n \"certSigners\": [],\n\ - \ \"configCluster\": false,\n \"configValidation\": true,\n \"defaultPodDisruptionBudget\"\ - : {\n \"enabled\": true\n },\n \"defaultResources\": {\n \"requests\"\ - : {\n \"cpu\": \"10m\"\n }\n },\n \"externalIstiod\": false,\n\ - \ \"hub\": \"docker.io/istio\",\n \"imagePullPolicy\": \"\",\n \"imagePullSecrets\"\ - : [],\n \"istioNamespace\": \"default\",\n \"istiod\": {\n \"enableAnalysis\"\ - : false\n },\n \"logAsJson\": false,\n \"logging\": {\n \"level\"\ - : \"all:warn\"\n },\n \"meshID\": \"\",\n \"meshNetworks\": {},\n \ - \ \"mountMtlsCerts\": false,\n \"multiCluster\": {\n \"clusterName\":\ - \ \"\"\n },\n \"nativeNftables\": false,\n \"network\": \"\",\n \"\ - networkPolicy\": {\n \"enabled\": false\n },\n \"omitSidecarInjectorConfigMap\"\ - : false,\n \"operatorManageWebhooks\": false,\n \"pilotCertProvider\": \"\ - istiod\",\n \"platform\": \"gke\",\n \"priorityClassName\": \"\",\n \"\ - proxy\": {\n \"autoInject\": \"enabled\",\n \"clusterDomain\": \"cluster.local\"\ - ,\n \"componentLogLevel\": \"misc:error\",\n \"excludeIPRanges\": \"\ - \",\n \"excludeInboundPorts\": \"\",\n \"excludeOutboundPorts\": \"\"\ - ,\n \"image\": \"proxyv2\",\n \"includeIPRanges\": \"*\",\n \"\ - includeInboundPorts\": \"*\",\n \"includeOutboundPorts\": \"\",\n \"\ - logLevel\": \"warning\",\n \"outlierLogPath\": \"\",\n \"privileged\"\ - : false,\n \"readinessFailureThreshold\": 4,\n \"readinessInitialDelaySeconds\"\ - : 0,\n \"readinessPeriodSeconds\": 15,\n \"resources\": {\n \"\ - limits\": {\n \"cpu\": \"2000m\",\n \"memory\": \"1024Mi\"\n\ - \ },\n \"requests\": {\n \"cpu\": \"100m\",\n \ - \ \"memory\": \"128Mi\"\n }\n },\n \"seccompProfile\": {},\n\ - \ \"startupProbe\": {\n \"enabled\": true,\n \"failureThreshold\"\ - : 600\n },\n \"statusPort\": 15020,\n \"tracer\": \"none\"\n \ - \ },\n \"proxy_init\": {\n \"forceApplyIptables\": false,\n \"image\"\ - : \"proxyv2\"\n },\n \"remotePilotAddress\": \"\",\n \"resourceScope\"\ - : \"all\",\n \"sds\": {\n \"token\": {\n \"aud\": \"istio-ca\"\n\ - \ }\n },\n \"sts\": {\n \"servicePort\": 0\n },\n \"tag\"\ - : \"1.29.4\",\n \"variant\": \"\",\n \"waypoint\": {\n \"affinity\"\ - : {},\n \"nodeSelector\": {},\n \"resources\": {\n \"limits\"\ - : {\n \"cpu\": \"2\",\n \"memory\": \"1Gi\"\n },\n \ - \ \"requests\": {\n \"cpu\": \"100m\",\n \"memory\": \"\ - 128Mi\"\n }\n },\n \"tolerations\": [],\n \"topologySpreadConstraints\"\ - : []\n }\n },\n \"hub\": \"\",\n \"image\": \"pilot\",\n \"initContainers\"\ - : [],\n \"ipFamilies\": [],\n \"ipFamilyPolicy\": \"\",\n \"istiodRemote\"\ - : {\n \"enabled\": false,\n \"enabledLocalInjectorIstiod\": false,\n \ - \ \"injectionCABundle\": \"\",\n \"injectionPath\": \"/inject\",\n \"injectionURL\"\ - : \"\"\n },\n \"jwksResolverExtraRootCA\": \"\",\n \"keepaliveMaxServerConnectionAge\"\ - : \"30m\",\n \"memory\": {},\n \"meshConfig\": {\n \"accessLogFile\": \"\"\ - ,\n \"accessLogFormat\": \"{\\\"authority\\\": \\\"%REQ(:AUTHORITY)%\\\", \\\ - \"start_time\\\": \\\"%START_TIME%\\\", \\\"bytes_received\\\": \\\"%BYTES_RECEIVED%\\\ - \", \\\"bytes_sent\\\": \\\"%BYTES_SENT%\\\", \\\"downstream_local_address\\\"\ - : \\\"%DOWNSTREAM_LOCAL_ADDRESS%\\\", \\\"downstream_remote_address\\\": \\\"\ - %DOWNSTREAM_REMOTE_ADDRESS%\\\", \\\"duration\\\": \\\"%DURATION%\\\", \\\"istio_policy_status\\\ - \": \\\"%DYNAMIC_METADATA(istio.mixer:status)%\\\", \\\"method\\\": \\\"%REQ(:METHOD)%\\\ - \", \\\"path\\\": \\\"%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%\\\", \\\"protocol\\\"\ - : \\\"%PROTOCOL%\\\", \\\"request_id\\\": \\\"%REQ(X-REQUEST-ID)%\\\", \\\"requested_server_name\\\ - \": \\\"%REQUESTED_SERVER_NAME%\\\", \\\"response_code\\\": \\\"%RESPONSE_CODE%\\\ - \", \\\"response_flags\\\": \\\"%RESPONSE_FLAGS%\\\", \\\"route_name\\\": \\\"\ - %ROUTE_NAME%\\\", \\\"start_time\\\": \\\"%START_TIME%\\\", \\\"upstream_cluster\\\ - \": \\\"%UPSTREAM_CLUSTER%\\\", \\\"upstream_host\\\": \\\"%UPSTREAM_HOST%\\\"\ - , \\\"upstream_local_address\\\": \\\"%UPSTREAM_LOCAL_ADDRESS%\\\", \\\"upstream_service_time\\\ - \": \\\"%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%\\\", \\\"upstream_transport_failure_reason\\\ - \": \\\"%UPSTREAM_TRANSPORT_FAILURE_REASON%\\\", \\\"user_agent\\\": \\\"%REQ(USER-AGENT)%\\\ - \", \\\"x_forwarded_for\\\": \\\"%REQ(X-FORWARDED-FOR)%\\\", \\\"x_icon_instance_name\\\ - \": \\\"%REQ(x-icon-instance-name)%\\\", \\\"x_resource_instance_name\\\": \\\"\ - %REQ(x-resource-instance-name)%\\\"}\\n\",\n \"defaultConfig\": {\n \"\ - proxyMetadata\": {}\n },\n \"enablePrometheusMerge\": true,\n \"extensionProviders\"\ - : [\n {\n \"envoyExtAuthzHttp\": {\n \"headersToUpstreamOnAllow\"\ - : [\n \"authorization\"\n ],\n \"includeRequestHeadersInCheck\"\ - : [\n \"authorization\",\n \"x-forwarded-access-token\"\ - ,\n \"x-auth-url\"\n ],\n \"port\": \"8080\",\n \ - \ \"service\": \"crc-auth-gateway-istio.default.svc.cluster.local\"\n\ - \ },\n \"name\": \"crc-auth-gateway\"\n }\n ]\n },\n \"\ - nodeSelector\": {},\n \"ownerName\": \"\",\n \"pdb\": {\n \"minAvailable\"\ - : 1,\n \"unhealthyPodEvictionPolicy\": \"\"\n },\n \"pilot\": {\n \"cni\"\ - : {\n \"enabled\": false\n },\n \"enabled\": true\n },\n \"podAnnotations\"\ - : {},\n \"podLabels\": {},\n \"replicaCount\": 1,\n \"resourceQuotas\": {\n\ - \ \"enabled\": true\n },\n \"resources\": {\n \"requests\": {\n \"\ - cpu\": \"500m\",\n \"memory\": \"2048Mi\"\n }\n },\n \"revision\": \"\ - \",\n \"revisionTags\": [],\n \"rollingMaxSurge\": \"100%\",\n \"rollingMaxUnavailable\"\ - : \"25%\",\n \"seccompProfile\": {},\n \"serviceAccountAnnotations\": {},\n\ - \ \"serviceAnnotations\": {},\n \"sidecarInjectorWebhook\": {\n \"alwaysInjectSelector\"\ - : [],\n \"defaultTemplates\": [],\n \"enableNamespacesByDefault\": false,\n\ - \ \"injectedAnnotations\": {},\n \"neverInjectSelector\": [],\n \"reinvocationPolicy\"\ - : \"Never\",\n \"rewriteAppHTTPProbe\": true,\n \"templates\": {}\n },\n\ - \ \"sidecarInjectorWebhookAnnotations\": {},\n \"tag\": \"\",\n \"taint\":\ - \ {\n \"enabled\": false,\n \"namespace\": \"\"\n },\n \"telemetry\":\ - \ {\n \"enabled\": true,\n \"v2\": {\n \"enabled\": true,\n \"\ - prometheus\": {\n \"enabled\": true\n },\n \"stackdriver\": {\n\ - \ \"enabled\": false\n }\n }\n },\n \"tolerations\": [],\n \"\ - topologySpreadConstraints\": [],\n \"traceSampling\": 1,\n \"trustedZtunnelName\"\ - : \"\",\n \"trustedZtunnelNamespace\": \"\",\n \"variant\": \"\",\n \"volumeMounts\"\ - : [],\n \"volumes\": [],\n \"ztunnel\": {\n \"resourceName\": \"ztunnel\"\ - \n }\n}" - original-values: "{\n \"cni\": {\n \"resourceQuotas\": {\n \"enabled\"\ - : false\n }\n },\n \"defaultRevision\": \"\",\n \"gateways\": {\n \"\ - istio-egressgateway\": {},\n \"istio-ingressgateway\": {}\n },\n \"global\"\ - : {\n \"configValidation\": true,\n \"hub\": \"docker.io/istio\",\n \"\ - istioNamespace\": \"default\",\n \"logging\": {\n \"level\": \"all:warn\"\ - \n },\n \"platform\": \"gke\",\n \"tag\": \"1.29.4\"\n },\n \"meshConfig\"\ - : {\n \"accessLogFile\": \"\",\n \"accessLogFormat\": \"{\\\"authority\\\ - \": \\\"%REQ(:AUTHORITY)%\\\", \\\"start_time\\\": \\\"%START_TIME%\\\", \\\"\ - bytes_received\\\": \\\"%BYTES_RECEIVED%\\\", \\\"bytes_sent\\\": \\\"%BYTES_SENT%\\\ - \", \\\"downstream_local_address\\\": \\\"%DOWNSTREAM_LOCAL_ADDRESS%\\\", \\\"\ - downstream_remote_address\\\": \\\"%DOWNSTREAM_REMOTE_ADDRESS%\\\", \\\"duration\\\ - \": \\\"%DURATION%\\\", \\\"istio_policy_status\\\": \\\"%DYNAMIC_METADATA(istio.mixer:status)%\\\ - \", \\\"method\\\": \\\"%REQ(:METHOD)%\\\", \\\"path\\\": \\\"%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%\\\ - \", \\\"protocol\\\": \\\"%PROTOCOL%\\\", \\\"request_id\\\": \\\"%REQ(X-REQUEST-ID)%\\\ - \", \\\"requested_server_name\\\": \\\"%REQUESTED_SERVER_NAME%\\\", \\\"response_code\\\ - \": \\\"%RESPONSE_CODE%\\\", \\\"response_flags\\\": \\\"%RESPONSE_FLAGS%\\\"\ - , \\\"route_name\\\": \\\"%ROUTE_NAME%\\\", \\\"start_time\\\": \\\"%START_TIME%\\\ - \", \\\"upstream_cluster\\\": \\\"%UPSTREAM_CLUSTER%\\\", \\\"upstream_host\\\"\ - : \\\"%UPSTREAM_HOST%\\\", \\\"upstream_local_address\\\": \\\"%UPSTREAM_LOCAL_ADDRESS%\\\ - \", \\\"upstream_service_time\\\": \\\"%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%\\\ - \", \\\"upstream_transport_failure_reason\\\": \\\"%UPSTREAM_TRANSPORT_FAILURE_REASON%\\\ - \", \\\"user_agent\\\": \\\"%REQ(USER-AGENT)%\\\", \\\"x_forwarded_for\\\": \\\ - \"%REQ(X-FORWARDED-FOR)%\\\", \\\"x_icon_instance_name\\\": \\\"%REQ(x-icon-instance-name)%\\\ - \", \\\"x_resource_instance_name\\\": \\\"%REQ(x-resource-instance-name)%\\\"\ - }\\n\",\n \"defaultConfig\": {\n \"proxyMetadata\": {}\n },\n \"\ - enablePrometheusMerge\": true,\n \"extensionProviders\": [\n {\n \ - \ \"envoyExtAuthzHttp\": {\n \"headersToUpstreamOnAllow\": [\n \ - \ \"authorization\"\n ],\n \"includeRequestHeadersInCheck\"\ - : [\n \"authorization\",\n \"x-forwarded-access-token\"\ - ,\n \"x-auth-url\"\n ],\n \"port\": \"8080\",\n \ - \ \"service\": \"crc-auth-gateway-istio.default.svc.cluster.local\"\n\ - \ },\n \"name\": \"crc-auth-gateway\"\n }\n ]\n },\n \"\ - pilot\": {\n \"cni\": {\n \"enabled\": false\n },\n \"enabled\"\ - : true\n },\n \"ztunnel\": {\n \"resourceName\": \"ztunnel\"\n }\n}" + merged-values: |- + { + "affinity": {}, + "autoscaleBehavior": {}, + "autoscaleEnabled": true, + "autoscaleMax": 5, + "autoscaleMin": 1, + "base": { + "enableIstioConfigCRDs": true + }, + "cni": { + "cniBinDir": "", + "enabled": false, + "provider": "default", + "resourceQuotas": { + "enabled": false + } + }, + "configMap": true, + "cpu": { + "targetAverageUtilization": 80 + }, + "defaultRevision": "", + "deploymentAnnotations": {}, + "deploymentLabels": {}, + "enabled": true, + "env": {}, + "envVarFrom": [], + "experimental": { + "stableValidationPolicy": false + }, + "extraContainerArgs": [], + "gatewayClasses": {}, + "gateways": { + "istio-egressgateway": {}, + "istio-ingressgateway": {}, + "seccompProfile": {}, + "securityContext": {} + }, + "global": { + "caAddress": "", + "caName": "", + "certSigners": [], + "configCluster": false, + "configValidation": true, + "defaultPodDisruptionBudget": { + "enabled": true + }, + "defaultResources": { + "requests": { + "cpu": "10m" + } + }, + "externalIstiod": false, + "hub": "docker.io/istio", + "imagePullPolicy": "", + "imagePullSecrets": [], + "istioNamespace": "default", + "istiod": { + "enableAnalysis": false + }, + "logAsJson": false, + "logging": { + "level": "all:warn" + }, + "meshID": "", + "meshNetworks": {}, + "mountMtlsCerts": false, + "multiCluster": { + "clusterName": "" + }, + "nativeNftables": false, + "network": "", + "networkPolicy": { + "enabled": false + }, + "omitSidecarInjectorConfigMap": false, + "operatorManageWebhooks": false, + "pilotCertProvider": "istiod", + "platform": "gke", + "priorityClassName": "", + "proxy": { + "autoInject": "enabled", + "clusterDomain": "cluster.local", + "componentLogLevel": "misc:error", + "excludeIPRanges": "", + "excludeInboundPorts": "", + "excludeOutboundPorts": "", + "image": "proxyv2", + "includeIPRanges": "*", + "includeInboundPorts": "*", + "includeOutboundPorts": "", + "logLevel": "warning", + "outlierLogPath": "", + "privileged": false, + "readinessFailureThreshold": 4, + "readinessInitialDelaySeconds": 0, + "readinessPeriodSeconds": 15, + "resources": { + "limits": { + "cpu": "2000m", + "memory": "1024Mi" + }, + "requests": { + "cpu": "100m", + "memory": "128Mi" + } + }, + "seccompProfile": {}, + "startupProbe": { + "enabled": true, + "failureThreshold": 600 + }, + "statusPort": 15020, + "tracer": "none" + }, + "proxy_init": { + "forceApplyIptables": false, + "image": "proxyv2" + }, + "remotePilotAddress": "", + "resourceScope": "all", + "sds": { + "token": { + "aud": "istio-ca" + } + }, + "sts": { + "servicePort": 0 + }, + "tag": "1.29.4", + "variant": "", + "waypoint": { + "affinity": {}, + "nodeSelector": {}, + "resources": { + "limits": { + "cpu": "2", + "memory": "1Gi" + }, + "requests": { + "cpu": "100m", + "memory": "128Mi" + } + }, + "tolerations": [], + "topologySpreadConstraints": [] + } + }, + "hub": "", + "image": "pilot", + "initContainers": [], + "ipFamilies": [], + "ipFamilyPolicy": "", + "istiodRemote": { + "enabled": false, + "enabledLocalInjectorIstiod": false, + "injectionCABundle": "", + "injectionPath": "/inject", + "injectionURL": "" + }, + "jwksResolverExtraRootCA": "", + "keepaliveMaxServerConnectionAge": "30m", + "memory": {}, + "meshConfig": { + "accessLogFile": "", + "accessLogFormat": "{\"authority\": \"%REQ(:AUTHORITY)%\", \"start_time\": \"%START_TIME%\", \"bytes_received\": \"%BYTES_RECEIVED%\", \"bytes_sent\": \"%BYTES_SENT%\", \"downstream_local_address\": \"%DOWNSTREAM_LOCAL_ADDRESS%\", \"downstream_remote_address\": \"%DOWNSTREAM_REMOTE_ADDRESS%\", \"duration\": \"%DURATION%\", \"istio_policy_status\": \"%DYNAMIC_METADATA(istio.mixer:status)%\", \"method\": \"%REQ(:METHOD)%\", \"path\": \"%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%\", \"protocol\": \"%PROTOCOL%\", \"request_id\": \"%REQ(X-REQUEST-ID)%\", \"requested_server_name\": \"%REQUESTED_SERVER_NAME%\", \"response_code\": \"%RESPONSE_CODE%\", \"response_flags\": \"%RESPONSE_FLAGS%\", \"route_name\": \"%ROUTE_NAME%\", \"start_time\": \"%START_TIME%\", \"upstream_cluster\": \"%UPSTREAM_CLUSTER%\", \"upstream_host\": \"%UPSTREAM_HOST%\", \"upstream_local_address\": \"%UPSTREAM_LOCAL_ADDRESS%\", \"upstream_service_time\": \"%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%\", \"upstream_transport_failure_reason\": \"%UPSTREAM_TRANSPORT_FAILURE_REASON%\", \"user_agent\": \"%REQ(USER-AGENT)%\", \"x_forwarded_for\": \"%REQ(X-FORWARDED-FOR)%\", \"x_icon_instance_name\": \"%REQ(x-icon-instance-name)%\", \"x_resource_instance_name\": \"%REQ(x-resource-instance-name)%\"}\n", + "defaultConfig": { + "proxyMetadata": {} + }, + "enablePrometheusMerge": true, + "extensionProviders": [ + { + "envoyExtAuthzHttp": { + "headersToUpstreamOnAllow": [ + "authorization" + ], + "includeRequestHeadersInCheck": [ + "authorization", + "x-forwarded-access-token", + "x-auth-url" + ], + "port": "8080", + "service": "crc-auth-gateway-istio.default.svc.cluster.local" + }, + "name": "crc-auth-gateway" + } + ] + }, + "nodeSelector": {}, + "ownerName": "", + "pdb": { + "minAvailable": 1, + "unhealthyPodEvictionPolicy": "" + }, + "pilot": { + "cni": { + "enabled": false + }, + "enabled": true + }, + "podAnnotations": {}, + "podLabels": {}, + "replicaCount": 1, + "resourceQuotas": { + "enabled": true + }, + "resources": { + "requests": { + "cpu": "500m", + "memory": "2048Mi" + } + }, + "revision": "", + "revisionTags": [], + "rollingMaxSurge": "100%", + "rollingMaxUnavailable": "25%", + "seccompProfile": {}, + "serviceAccountAnnotations": {}, + "serviceAnnotations": {}, + "sidecarInjectorWebhook": { + "alwaysInjectSelector": [], + "defaultTemplates": [], + "enableNamespacesByDefault": false, + "injectedAnnotations": {}, + "neverInjectSelector": [], + "reinvocationPolicy": "Never", + "rewriteAppHTTPProbe": true, + "templates": {} + }, + "sidecarInjectorWebhookAnnotations": {}, + "tag": "", + "taint": { + "enabled": false, + "namespace": "" + }, + "telemetry": { + "enabled": true, + "v2": { + "enabled": true, + "prometheus": { + "enabled": true + }, + "stackdriver": { + "enabled": false + } + } + }, + "tolerations": [], + "topologySpreadConstraints": [], + "traceSampling": 1, + "trustedZtunnelName": "", + "trustedZtunnelNamespace": "", + "variant": "", + "volumeMounts": [], + "volumes": [], + "ztunnel": { + "resourceName": "ztunnel" + } + } + original-values: |- + { + "cni": { + "resourceQuotas": { + "enabled": false + } + }, + "defaultRevision": "", + "gateways": { + "istio-egressgateway": {}, + "istio-ingressgateway": {} + }, + "global": { + "configValidation": true, + "hub": "docker.io/istio", + "istioNamespace": "default", + "logging": { + "level": "all:warn" + }, + "platform": "gke", + "tag": "1.29.4" + }, + "meshConfig": { + "accessLogFile": "", + "accessLogFormat": "{\"authority\": \"%REQ(:AUTHORITY)%\", \"start_time\": \"%START_TIME%\", \"bytes_received\": \"%BYTES_RECEIVED%\", \"bytes_sent\": \"%BYTES_SENT%\", \"downstream_local_address\": \"%DOWNSTREAM_LOCAL_ADDRESS%\", \"downstream_remote_address\": \"%DOWNSTREAM_REMOTE_ADDRESS%\", \"duration\": \"%DURATION%\", \"istio_policy_status\": \"%DYNAMIC_METADATA(istio.mixer:status)%\", \"method\": \"%REQ(:METHOD)%\", \"path\": \"%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%\", \"protocol\": \"%PROTOCOL%\", \"request_id\": \"%REQ(X-REQUEST-ID)%\", \"requested_server_name\": \"%REQUESTED_SERVER_NAME%\", \"response_code\": \"%RESPONSE_CODE%\", \"response_flags\": \"%RESPONSE_FLAGS%\", \"route_name\": \"%ROUTE_NAME%\", \"start_time\": \"%START_TIME%\", \"upstream_cluster\": \"%UPSTREAM_CLUSTER%\", \"upstream_host\": \"%UPSTREAM_HOST%\", \"upstream_local_address\": \"%UPSTREAM_LOCAL_ADDRESS%\", \"upstream_service_time\": \"%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%\", \"upstream_transport_failure_reason\": \"%UPSTREAM_TRANSPORT_FAILURE_REASON%\", \"user_agent\": \"%REQ(USER-AGENT)%\", \"x_forwarded_for\": \"%REQ(X-FORWARDED-FOR)%\", \"x_icon_instance_name\": \"%REQ(x-icon-instance-name)%\", \"x_resource_instance_name\": \"%REQ(x-resource-instance-name)%\"}\n", + "defaultConfig": { + "proxyMetadata": {} + }, + "enablePrometheusMerge": true, + "extensionProviders": [ + { + "envoyExtAuthzHttp": { + "headersToUpstreamOnAllow": [ + "authorization" + ], + "includeRequestHeadersInCheck": [ + "authorization", + "x-forwarded-access-token", + "x-auth-url" + ], + "port": "8080", + "service": "crc-auth-gateway-istio.default.svc.cluster.local" + }, + "name": "crc-auth-gateway" + } + ] + }, + "pilot": { + "cni": { + "enabled": false + }, + "enabled": true + }, + "ztunnel": { + "resourceName": "ztunnel" + } + } kind: ConfigMap metadata: annotations: @@ -18992,146 +18854,146 @@ metadata: release: istio name: istio-sidecar-injector-default webhooks: - - admissionReviewVersions: - - v1 - clientConfig: - service: - name: istiod - namespace: default - path: /inject - port: 443 - failurePolicy: Fail - name: rev.namespace.sidecar-injector.istio.io - namespaceSelector: - matchExpressions: - - key: istio.io/rev - operator: In - values: - - default - - key: istio-injection - operator: DoesNotExist - objectSelector: - matchExpressions: - - key: sidecar.istio.io/inject - operator: NotIn - values: - - 'false' - reinvocationPolicy: Never - rules: - - apiGroups: - - '' - apiVersions: - - v1 - operations: - - CREATE - resources: - - pods - sideEffects: None - - admissionReviewVersions: - - v1 - clientConfig: - service: - name: istiod - namespace: default - path: /inject - port: 443 - failurePolicy: Fail - name: rev.object.sidecar-injector.istio.io - namespaceSelector: - matchExpressions: - - key: istio.io/rev - operator: DoesNotExist - - key: istio-injection - operator: DoesNotExist - objectSelector: - matchExpressions: - - key: sidecar.istio.io/inject - operator: NotIn - values: - - 'false' - - key: istio.io/rev - operator: In - values: - - default - reinvocationPolicy: Never - rules: - - apiGroups: - - '' - apiVersions: - - v1 - operations: - - CREATE - resources: - - pods - sideEffects: None - - admissionReviewVersions: - - v1 - clientConfig: - service: - name: istiod - namespace: default - path: /inject - port: 443 - failurePolicy: Fail - name: namespace.sidecar-injector.istio.io - namespaceSelector: - matchExpressions: - - key: istio-injection - operator: In - values: - - enabled - objectSelector: - matchExpressions: - - key: sidecar.istio.io/inject - operator: NotIn - values: - - 'false' - reinvocationPolicy: Never - rules: - - apiGroups: - - '' - apiVersions: - - v1 - operations: - - CREATE - resources: - - pods - sideEffects: None - - admissionReviewVersions: - - v1 - clientConfig: - service: - name: istiod - namespace: default - path: /inject - port: 443 - failurePolicy: Fail - name: object.sidecar-injector.istio.io - namespaceSelector: - matchExpressions: - - key: istio-injection - operator: DoesNotExist - - key: istio.io/rev - operator: DoesNotExist - objectSelector: - matchExpressions: - - key: sidecar.istio.io/inject - operator: In - values: - - 'true' - - key: istio.io/rev - operator: DoesNotExist - reinvocationPolicy: Never - rules: - - apiGroups: - - '' - apiVersions: - - v1 - operations: - - CREATE - resources: - - pods - sideEffects: None +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: istiod + namespace: default + path: /inject + port: 443 + failurePolicy: Fail + name: rev.namespace.sidecar-injector.istio.io + namespaceSelector: + matchExpressions: + - key: istio.io/rev + operator: In + values: + - default + - key: istio-injection + operator: DoesNotExist + objectSelector: + matchExpressions: + - key: sidecar.istio.io/inject + operator: NotIn + values: + - 'false' + reinvocationPolicy: Never + rules: + - apiGroups: + - '' + apiVersions: + - v1 + operations: + - CREATE + resources: + - pods + sideEffects: None +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: istiod + namespace: default + path: /inject + port: 443 + failurePolicy: Fail + name: rev.object.sidecar-injector.istio.io + namespaceSelector: + matchExpressions: + - key: istio.io/rev + operator: DoesNotExist + - key: istio-injection + operator: DoesNotExist + objectSelector: + matchExpressions: + - key: sidecar.istio.io/inject + operator: NotIn + values: + - 'false' + - key: istio.io/rev + operator: In + values: + - default + reinvocationPolicy: Never + rules: + - apiGroups: + - '' + apiVersions: + - v1 + operations: + - CREATE + resources: + - pods + sideEffects: None +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: istiod + namespace: default + path: /inject + port: 443 + failurePolicy: Fail + name: namespace.sidecar-injector.istio.io + namespaceSelector: + matchExpressions: + - key: istio-injection + operator: In + values: + - enabled + objectSelector: + matchExpressions: + - key: sidecar.istio.io/inject + operator: NotIn + values: + - 'false' + reinvocationPolicy: Never + rules: + - apiGroups: + - '' + apiVersions: + - v1 + operations: + - CREATE + resources: + - pods + sideEffects: None +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: istiod + namespace: default + path: /inject + port: 443 + failurePolicy: Fail + name: object.sidecar-injector.istio.io + namespaceSelector: + matchExpressions: + - key: istio-injection + operator: DoesNotExist + - key: istio.io/rev + operator: DoesNotExist + objectSelector: + matchExpressions: + - key: sidecar.istio.io/inject + operator: In + values: + - 'true' + - key: istio.io/rev + operator: DoesNotExist + reinvocationPolicy: Never + rules: + - apiGroups: + - '' + apiVersions: + - v1 + operations: + - CREATE + resources: + - pods + sideEffects: None --- apiVersion: apps/v1 kind: Deployment @@ -19181,137 +19043,137 @@ spec: sidecar.istio.io/inject: 'false' spec: containers: - - args: - - discovery - - --monitoringAddr=:15014 - - --log_output_level=all:warn - - --domain - - cluster.local - - --keepaliveMaxServerConnectionAge - - 30m - env: - - name: REVISION - value: default - - name: PILOT_CERT_PROVIDER - value: istiod - - name: POD_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.name - - name: POD_NAMESPACE - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.namespace - - name: SERVICE_ACCOUNT - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: spec.serviceAccountName - - name: KUBECONFIG - value: /var/run/secrets/remote/config - - name: CA_TRUSTED_NODE_ACCOUNTS - value: default/ztunnel - - name: PILOT_TRACE_SAMPLING - value: '1' - - name: PILOT_ENABLE_ANALYSIS - value: 'false' - - name: CLUSTER_ID - value: Kubernetes - - name: GOMAXPROCS - valueFrom: - resourceFieldRef: - divisor: '1' - resource: limits.cpu - - name: PLATFORM - value: gke - image: docker.io/istio/pilot:1.29.4 - name: discovery - ports: - - containerPort: 8080 - name: http-debug - protocol: TCP - - containerPort: 15010 - name: grpc-xds - protocol: TCP - - containerPort: 15012 - name: tls-xds - protocol: TCP - - containerPort: 15017 - name: https-webhooks - protocol: TCP - - containerPort: 15014 - name: http-monitoring - protocol: TCP - readinessProbe: - httpGet: - path: /ready - port: 8080 - initialDelaySeconds: 1 - periodSeconds: 3 - timeoutSeconds: 5 - resources: - requests: - cpu: 500m - memory: 2048Mi - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - volumeMounts: - - mountPath: /var/run/secrets/tokens - name: istio-token - readOnly: true - - mountPath: /var/run/secrets/istio-dns - name: local-certs - - mountPath: /etc/cacerts - name: cacerts - readOnly: true - - mountPath: /var/run/secrets/remote - name: istio-kubeconfig - readOnly: true - - mountPath: /var/run/secrets/istiod/tls - name: istio-csr-dns-cert - readOnly: true - - mountPath: /var/run/secrets/istiod/ca - name: istio-csr-ca-configmap - readOnly: true + - args: + - discovery + - --monitoringAddr=:15014 + - --log_output_level=all:warn + - --domain + - cluster.local + - --keepaliveMaxServerConnectionAge + - 30m + env: + - name: REVISION + value: default + - name: PILOT_CERT_PROVIDER + value: istiod + - name: POD_NAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + - name: SERVICE_ACCOUNT + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: spec.serviceAccountName + - name: KUBECONFIG + value: /var/run/secrets/remote/config + - name: CA_TRUSTED_NODE_ACCOUNTS + value: default/ztunnel + - name: PILOT_TRACE_SAMPLING + value: '1' + - name: PILOT_ENABLE_ANALYSIS + value: 'false' + - name: CLUSTER_ID + value: Kubernetes + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + divisor: '1' + resource: limits.cpu + - name: PLATFORM + value: gke + image: docker.io/istio/pilot:1.29.4 + name: discovery + ports: + - containerPort: 8080 + name: http-debug + protocol: TCP + - containerPort: 15010 + name: grpc-xds + protocol: TCP + - containerPort: 15012 + name: tls-xds + protocol: TCP + - containerPort: 15017 + name: https-webhooks + protocol: TCP + - containerPort: 15014 + name: http-monitoring + protocol: TCP + readinessProbe: + httpGet: + path: /ready + port: 8080 + initialDelaySeconds: 1 + periodSeconds: 3 + timeoutSeconds: 5 + resources: + requests: + cpu: 500m + memory: 2048Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + volumeMounts: + - mountPath: /var/run/secrets/tokens + name: istio-token + readOnly: true + - mountPath: /var/run/secrets/istio-dns + name: local-certs + - mountPath: /etc/cacerts + name: cacerts + readOnly: true + - mountPath: /var/run/secrets/remote + name: istio-kubeconfig + readOnly: true + - mountPath: /var/run/secrets/istiod/tls + name: istio-csr-dns-cert + readOnly: true + - mountPath: /var/run/secrets/istiod/ca + name: istio-csr-ca-configmap + readOnly: true serviceAccountName: istiod tolerations: - - key: cni.istio.io/not-ready - operator: Exists + - key: cni.istio.io/not-ready + operator: Exists volumes: - - emptyDir: - medium: Memory - name: local-certs - - name: istio-token - projected: - sources: - - serviceAccountToken: - audience: istio-ca - expirationSeconds: 43200 - path: istio-token - - name: cacerts - secret: - optional: true - secretName: cacerts - - name: istio-kubeconfig - secret: - optional: true - secretName: istio-kubeconfig - - name: istio-csr-dns-cert - secret: - optional: true - secretName: istiod-tls - - configMap: - defaultMode: 420 - name: istio-ca-root-cert - optional: true - name: istio-csr-ca-configmap + - emptyDir: + medium: Memory + name: local-certs + - name: istio-token + projected: + sources: + - serviceAccountToken: + audience: istio-ca + expirationSeconds: 43200 + path: istio-token + - name: cacerts + secret: + optional: true + secretName: cacerts + - name: istio-kubeconfig + secret: + optional: true + secretName: istio-kubeconfig + - name: istio-csr-dns-cert + secret: + optional: true + secretName: istiod-tls + - configMap: + defaultMode: 420 + name: istio-ca-root-cert + optional: true + name: istio-csr-ca-configmap --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role @@ -19328,38 +19190,38 @@ metadata: name: istiod namespace: default rules: - - apiGroups: - - networking.istio.io - resources: - - gateways - verbs: - - create - - apiGroups: - - '' - resources: - - secrets - verbs: - - create - - get - - watch - - list - - update - - delete - - apiGroups: - - '' - resources: - - configmaps - verbs: - - delete - - apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - get - - update - - patch - - create +- apiGroups: + - networking.istio.io + resources: + - gateways + verbs: + - create +- apiGroups: + - '' + resources: + - secrets + verbs: + - create + - get + - watch + - list + - update + - delete +- apiGroups: + - '' + resources: + - configmaps + verbs: + - delete +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - update + - patch + - create --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -19380,9 +19242,9 @@ roleRef: kind: Role name: istiod subjects: - - kind: ServiceAccount - name: istiod - namespace: default +- kind: ServiceAccount + name: istiod + namespace: default --- apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler @@ -19404,12 +19266,12 @@ metadata: spec: maxReplicas: 5 metrics: - - resource: - name: cpu - target: - averageUtilization: 80 - type: Utilization - type: Resource + - resource: + name: cpu + target: + averageUtilization: 80 + type: Utilization + type: Resource minReplicas: 1 scaleTargetRef: apiVersion: apps/v1 @@ -19436,19 +19298,19 @@ metadata: namespace: default spec: ports: - - name: grpc-xds - port: 15010 - protocol: TCP - - name: https-dns - port: 15012 - protocol: TCP - - name: https-webhook - port: 443 - protocol: TCP - targetPort: 15017 - - name: http-monitoring - port: 15014 - protocol: TCP + - name: grpc-xds + port: 15010 + protocol: TCP + - name: https-dns + port: 15012 + protocol: TCP + - name: https-webhook + port: 443 + protocol: TCP + targetPort: 15017 + - name: http-monitoring + port: 15014 + protocol: TCP selector: app: istiod istio: pilot diff --git a/third_party/istio/istio-values.json b/third_party/istio/istio-values.json index bfe247bc8..b5827c969 100644 --- a/third_party/istio/istio-values.json +++ b/third_party/istio/istio-values.json @@ -135,4 +135,4 @@ "rewriteAppHTTPProbe": true, "templates": {} } -} +} \ No newline at end of file diff --git a/third_party/istio/update-istio.sh b/third_party/istio/update-istio.sh index 7fd464209..17f461206 100755 --- a/third_party/istio/update-istio.sh +++ b/third_party/istio/update-istio.sh @@ -5,26 +5,12 @@ VERSION=1.29.4 SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) -YQ="${YQ:-yq}" -# Ensure we are using python-yq (v2 or v3), or fall back to 'python3 -m yq' -if ! "${YQ}" --version 2>&1 | grep -q -E "^yq [23]\."; then - if python3 -m yq --version 2>&1 | grep -q -E "^yq [23]\."; then - YQ="python3 -m yq" - else - echo "Error: python-yq (v2 or v3) is required for update-istio.sh, but '${YQ}' is not python-yq." >&2 - echo "Please specify python-yq via the YQ environment variable, e.g.: YQ='python3 -m yq' $0" >&2 - exit 1 - fi -fi - tmpdir="$(mktemp -d)" trap "rm -rf '${tmpdir}'" EXIT -echo "Downloading istioctl ${PV}..." +echo "Downloading istioctl ${VERSION}..." curl -fsSl "https://storage.googleapis.com/istio-release/releases/${VERSION}/istioctl-${VERSION}-linux-amd64.tar.gz" \ | tar -C "${tmpdir}" -zx istioctl istioctl="${tmpdir}/istioctl" -# for faster testing -#istioctl="${HOME}/bin/istioctl" if [[ ! -x "${istioctl}" ]] ; then echo "Failed to extract istioctl from tarball." >&2 @@ -51,19 +37,41 @@ echo "Updating to istio $("${istioctl}" version --remote=false)..." --cluster-specific \ "$@" > ${tmpdir}/istio_full.yaml -# Step 2: Extract golang template (need python yq) -${YQ} -r 'select(.kind == "ConfigMap" and .metadata.name == "istio-sidecar-injector") | .data.config' \ - "${tmpdir}/istio_full.yaml" > "${SCRIPT_DIR}/istio-config.yaml" -${YQ} -r 'select(.kind == "ConfigMap" and .metadata.name == "istio-sidecar-injector") | .data.values' \ - "${tmpdir}/istio_full.yaml" > "${SCRIPT_DIR}/istio-values.json" -# the grep remove empty documents -# the sed replaces `config: '{{ ... }}'` with `config: |-\n {{ ... }}`) -cat ${tmpdir}/istio_full.yaml \ - | ${YQ} -y '(. | select(.kind == "ConfigMap" and .metadata.name == "istio-sidecar-injector").data.config) = "{{ .Files.Get \"files/istio-config.yaml\" }}"' - \ - | ${YQ} -y '(. | select(.kind == "ConfigMap" and .metadata.name == "istio-sidecar-injector").data.values) = "{{ .Files.Get \"files/istio-values.json\" }}"' - \ - | grep -Ev "^(null|--- null|\.\.\.)$" \ - | sed "s/: '{{ .Files.Get \"\(.*\)\" }}'/: |-\n{{ .Files.Get \"\1\" | nindent 4 }}/g" \ - > ${tmpdir}/istio.yaml +# Step 2: Extract golang template +python3 -c ' +import sys, yaml + +full_file = sys.argv[1] +config_file = sys.argv[2] +values_file = sys.argv[3] +out_file = sys.argv[4] + +with open(full_file, "r") as f: + docs = list(yaml.safe_load_all(f)) + +docs = [d for d in docs if d is not None] + +for doc in docs: + if doc.get("kind") == "ConfigMap" and doc.get("metadata", {}).get("name") == "istio-sidecar-injector": + data = doc.setdefault("data", {}) + if "config" in data: + with open(config_file, "w") as f: + f.write(data["config"]) + data["config"] = "{{ .Files.Get \"files/istio-config.yaml\" }}" + if "values" in data: + with open(values_file, "w") as f: + f.write(data["values"]) + data["values"] = "{{ .Files.Get \"files/istio-values.json\" }}" + +class MultilineDumper(yaml.SafeDumper): + def represent_scalar(self, tag, value, style=None): + if "\n" in value and tag == "tag:yaml.org,2002:str": + style = "|" + return super().represent_scalar(tag, value, style) + +with open(out_file, "w") as f: + yaml.dump_all(docs, f, Dumper=MultilineDumper, default_flow_style=False) +' "${tmpdir}/istio_full.yaml" "${SCRIPT_DIR}/istio-config.yaml" "${SCRIPT_DIR}/istio-values.json" "${tmpdir}/istio.yaml" # Step 3: Download and save Istio Grafana dashboards echo "Downloading Istio Grafana dashboards..." From 52453a02bef24fb17bef60c43ec8989585d583f1 Mon Sep 17 00:00:00 2001 From: tpeslalz Date: Wed, 22 Jul 2026 15:20:32 +0000 Subject: [PATCH 5/6] Update update-istio.sh to use yq v4 Created using jj-spr --- third_party/istio/istio-config.yaml | 2 +- third_party/istio/istio-generated.yaml | 32157 +++++++++++------------ third_party/istio/istio-values.json | 2 +- third_party/istio/update-istio.sh | 84 +- 4 files changed, 15211 insertions(+), 17034 deletions(-) diff --git a/third_party/istio/istio-config.yaml b/third_party/istio/istio-config.yaml index 6b84fa42c..4eedd472a 100644 --- a/third_party/istio/istio-config.yaml +++ b/third_party/istio/istio-config.yaml @@ -2347,4 +2347,4 @@ templates: spec: selector: matchLabels: - gateway.networking.k8s.io/gateway-name: {{.Name|quote}} \ No newline at end of file + gateway.networking.k8s.io/gateway-name: {{.Name|quote}} diff --git a/third_party/istio/istio-generated.yaml b/third_party/istio/istio-generated.yaml index 7e7e2bad2..473b276a6 100644 --- a/third_party/istio/istio-generated.yaml +++ b/third_party/istio/istio-generated.yaml @@ -19,272 +19,235 @@ spec: group: security.istio.io names: categories: - - istio-io - - security-istio-io + - istio-io + - security-istio-io kind: AuthorizationPolicy listKind: AuthorizationPolicyList plural: authorizationpolicies shortNames: - - ap + - ap singular: authorizationpolicy scope: Namespaced versions: - - additionalPrinterColumns: - - description: The operation to take. - jsonPath: .spec.action - name: Action - type: string - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is represented - in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for - lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration for access control on workloads. See more - details at: https://istio.io/docs/reference/config/security/authorization-policy.html' - oneOf: - - not: - anyOf: + - additionalPrinterColumns: + - description: The operation to take. + jsonPath: .spec.action + name: Action + type: string + - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration for access control on workloads. See more details at: https://istio.io/docs/reference/config/security/authorization-policy.html' + oneOf: + - not: + anyOf: + - required: + - provider - required: - - provider - - required: - - provider - properties: - action: - description: |- - Optional. + - provider + properties: + action: + description: |- + Optional. - Valid Options: ALLOW, DENY, AUDIT, CUSTOM - enum: - - ALLOW - - DENY - - AUDIT - - CUSTOM - type: string - provider: - description: Specifies detailed configuration of the CUSTOM action. - properties: - name: - description: Specifies the name of the extension provider. - type: string - type: object - rules: - description: Optional. - items: + Valid Options: ALLOW, DENY, AUDIT, CUSTOM + enum: + - ALLOW + - DENY + - AUDIT + - CUSTOM + type: string + provider: + description: Specifies detailed configuration of the CUSTOM action. properties: - from: - description: Optional. - items: - properties: - source: - description: Source specifies the source of a request. - properties: - ipBlocks: - description: Optional. - items: - type: string - type: array - namespaces: - description: Optional. - items: - type: string - type: array - notIpBlocks: - description: Optional. - items: - type: string - type: array - notNamespaces: - description: Optional. - items: - type: string - type: array - notPrincipals: - description: Optional. - items: - type: string - type: array - notRemoteIpBlocks: - description: Optional. - items: - type: string - type: array - notRequestPrincipals: - description: Optional. - items: - type: string - type: array - notServiceAccounts: - description: Optional. - items: - maxLength: 320 - type: string - maxItems: 16 - type: array - principals: - description: Optional. - items: - type: string - type: array - remoteIpBlocks: - description: Optional. - items: - type: string - type: array - requestPrincipals: - description: Optional. - items: - type: string - type: array - serviceAccounts: - description: Optional. - items: - maxLength: 320 - type: string - maxItems: 16 - type: array - type: object - x-kubernetes-validations: - - message: Cannot set serviceAccounts with namespaces - or principals - rule: |- - (has(self.serviceAccounts) || has(self.notServiceAccounts)) ? (!has(self.principals) && - !has(self.notPrincipals) && !has(self.namespaces) && !has(self.notNamespaces)) : true - type: object - maxItems: 512 - type: array - to: - description: Optional. - items: - properties: - operation: - description: Operation specifies the operation of a request. - properties: - hosts: - description: Optional. - items: - type: string - type: array - methods: - description: Optional. - items: - type: string - type: array - notHosts: - description: Optional. - items: - type: string - type: array - notMethods: - description: Optional. - items: - type: string - type: array - notPaths: - description: Optional. - items: - type: string - type: array - notPorts: - description: Optional. - items: - type: string - type: array - paths: - description: Optional. - items: - type: string - type: array - ports: - description: Optional. - items: - type: string - type: array - type: object - type: object - type: array - when: - description: Optional. - items: - properties: - key: - description: The name of an Istio attribute. - type: string - notValues: - description: Optional. - items: - type: string - type: array - values: - description: Optional. - items: - type: string - type: array - required: - - key - type: object - type: array - type: object - maxItems: 512 - type: array - selector: - description: Optional. - properties: - matchLabels: - additionalProperties: - maxLength: 63 + name: + description: Specifies the name of the extension provider. type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of - pods/VMs on which a policy should be applied. - maxProperties: 4096 + type: object + rules: + description: Optional. + items: + properties: + from: + description: Optional. + items: + properties: + source: + description: Source specifies the source of a request. + properties: + ipBlocks: + description: Optional. + items: + type: string + type: array + namespaces: + description: Optional. + items: + type: string + type: array + notIpBlocks: + description: Optional. + items: + type: string + type: array + notNamespaces: + description: Optional. + items: + type: string + type: array + notPrincipals: + description: Optional. + items: + type: string + type: array + notRemoteIpBlocks: + description: Optional. + items: + type: string + type: array + notRequestPrincipals: + description: Optional. + items: + type: string + type: array + notServiceAccounts: + description: Optional. + items: + maxLength: 320 + type: string + maxItems: 16 + type: array + principals: + description: Optional. + items: + type: string + type: array + remoteIpBlocks: + description: Optional. + items: + type: string + type: array + requestPrincipals: + description: Optional. + items: + type: string + type: array + serviceAccounts: + description: Optional. + items: + maxLength: 320 + type: string + maxItems: 16 + type: array + type: object + x-kubernetes-validations: + - message: Cannot set serviceAccounts with namespaces or principals + rule: |- + (has(self.serviceAccounts) || has(self.notServiceAccounts)) ? (!has(self.principals) && + !has(self.notPrincipals) && !has(self.namespaces) && !has(self.notNamespaces)) : true + type: object + maxItems: 512 + type: array + to: + description: Optional. + items: + properties: + operation: + description: Operation specifies the operation of a request. + properties: + hosts: + description: Optional. + items: + type: string + type: array + methods: + description: Optional. + items: + type: string + type: array + notHosts: + description: Optional. + items: + type: string + type: array + notMethods: + description: Optional. + items: + type: string + type: array + notPaths: + description: Optional. + items: + type: string + type: array + notPorts: + description: Optional. + items: + type: string + type: array + paths: + description: Optional. + items: + type: string + type: array + ports: + description: Optional. + items: + type: string + type: array + type: object + type: object + type: array + when: + description: Optional. + items: + properties: + key: + description: The name of an Istio attribute. + type: string + notValues: + description: Optional. + items: + type: string + type: array + values: + description: Optional. + items: + type: string + type: array + required: + - key + type: object + type: array type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) - type: object - targetRef: - properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: name is the name of the target resource. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: namespace is the namespace of the referent. - type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 - required: - - kind - - name - type: object - targetRefs: - description: Optional. - items: + maxItems: 512 + type: array + selector: + description: Optional. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + targetRef: properties: group: description: group is the group of the target resource. @@ -306,355 +269,342 @@ spec: description: namespace is the namespace of the referent. type: string x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 required: - - kind - - name - type: object - maxItems: 16 - type: array - type: object - x-kubernetes-validations: - - message: only one of targetRefs or selector can be set - rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) - + (has(self.targetRefs) ? 1 : 0) <= 1' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string + - kind + - name type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. + targetRefs: + description: Optional. + items: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name + type: object + maxItems: 16 + type: array + type: object + x-kubernetes-validations: + - message: only one of targetRefs or selector can be set + rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + (has(self.targetRefs) ? 1 : 0) <= 1' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. + type: string + level: + description: |- + Represents how severe a message is. - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} - - additionalPrinterColumns: - - description: The operation to take. - jsonPath: .spec.action - name: Action - type: string - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is represented - in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for - lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration for access control on workloads. See more - details at: https://istio.io/docs/reference/config/security/authorization-policy.html' - oneOf: - - not: - anyOf: + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - description: The operation to take. + jsonPath: .spec.action + name: Action + type: string + - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration for access control on workloads. See more details at: https://istio.io/docs/reference/config/security/authorization-policy.html' + oneOf: + - not: + anyOf: + - required: + - provider - required: - - provider - - required: - - provider - properties: - action: - description: |- - Optional. + - provider + properties: + action: + description: |- + Optional. - Valid Options: ALLOW, DENY, AUDIT, CUSTOM - enum: - - ALLOW - - DENY - - AUDIT - - CUSTOM - type: string - provider: - description: Specifies detailed configuration of the CUSTOM action. - properties: - name: - description: Specifies the name of the extension provider. - type: string - type: object - rules: - description: Optional. - items: + Valid Options: ALLOW, DENY, AUDIT, CUSTOM + enum: + - ALLOW + - DENY + - AUDIT + - CUSTOM + type: string + provider: + description: Specifies detailed configuration of the CUSTOM action. properties: - from: - description: Optional. - items: - properties: - source: - description: Source specifies the source of a request. - properties: - ipBlocks: - description: Optional. - items: - type: string - type: array - namespaces: - description: Optional. - items: - type: string - type: array - notIpBlocks: - description: Optional. - items: - type: string - type: array - notNamespaces: - description: Optional. - items: - type: string - type: array - notPrincipals: - description: Optional. - items: - type: string - type: array - notRemoteIpBlocks: - description: Optional. - items: - type: string - type: array - notRequestPrincipals: - description: Optional. - items: - type: string - type: array - notServiceAccounts: - description: Optional. - items: - maxLength: 320 - type: string - maxItems: 16 - type: array - principals: - description: Optional. - items: - type: string - type: array - remoteIpBlocks: - description: Optional. - items: - type: string - type: array - requestPrincipals: - description: Optional. - items: - type: string - type: array - serviceAccounts: - description: Optional. - items: - maxLength: 320 - type: string - maxItems: 16 - type: array - type: object - x-kubernetes-validations: - - message: Cannot set serviceAccounts with namespaces - or principals - rule: |- - (has(self.serviceAccounts) || has(self.notServiceAccounts)) ? (!has(self.principals) && - !has(self.notPrincipals) && !has(self.namespaces) && !has(self.notNamespaces)) : true - type: object - maxItems: 512 - type: array - to: - description: Optional. - items: - properties: - operation: - description: Operation specifies the operation of a request. - properties: - hosts: - description: Optional. - items: - type: string - type: array - methods: - description: Optional. - items: - type: string - type: array - notHosts: - description: Optional. - items: - type: string - type: array - notMethods: - description: Optional. - items: - type: string - type: array - notPaths: - description: Optional. - items: - type: string - type: array - notPorts: - description: Optional. - items: - type: string - type: array - paths: - description: Optional. - items: - type: string - type: array - ports: - description: Optional. - items: - type: string - type: array - type: object - type: object - type: array - when: - description: Optional. - items: - properties: - key: - description: The name of an Istio attribute. - type: string - notValues: - description: Optional. - items: - type: string - type: array - values: - description: Optional. - items: - type: string - type: array - required: - - key - type: object - type: array - type: object - maxItems: 512 - type: array - selector: - description: Optional. - properties: - matchLabels: - additionalProperties: - maxLength: 63 + name: + description: Specifies the name of the extension provider. type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of - pods/VMs on which a policy should be applied. - maxProperties: 4096 + type: object + rules: + description: Optional. + items: + properties: + from: + description: Optional. + items: + properties: + source: + description: Source specifies the source of a request. + properties: + ipBlocks: + description: Optional. + items: + type: string + type: array + namespaces: + description: Optional. + items: + type: string + type: array + notIpBlocks: + description: Optional. + items: + type: string + type: array + notNamespaces: + description: Optional. + items: + type: string + type: array + notPrincipals: + description: Optional. + items: + type: string + type: array + notRemoteIpBlocks: + description: Optional. + items: + type: string + type: array + notRequestPrincipals: + description: Optional. + items: + type: string + type: array + notServiceAccounts: + description: Optional. + items: + maxLength: 320 + type: string + maxItems: 16 + type: array + principals: + description: Optional. + items: + type: string + type: array + remoteIpBlocks: + description: Optional. + items: + type: string + type: array + requestPrincipals: + description: Optional. + items: + type: string + type: array + serviceAccounts: + description: Optional. + items: + maxLength: 320 + type: string + maxItems: 16 + type: array + type: object + x-kubernetes-validations: + - message: Cannot set serviceAccounts with namespaces or principals + rule: |- + (has(self.serviceAccounts) || has(self.notServiceAccounts)) ? (!has(self.principals) && + !has(self.notPrincipals) && !has(self.namespaces) && !has(self.notNamespaces)) : true + type: object + maxItems: 512 + type: array + to: + description: Optional. + items: + properties: + operation: + description: Operation specifies the operation of a request. + properties: + hosts: + description: Optional. + items: + type: string + type: array + methods: + description: Optional. + items: + type: string + type: array + notHosts: + description: Optional. + items: + type: string + type: array + notMethods: + description: Optional. + items: + type: string + type: array + notPaths: + description: Optional. + items: + type: string + type: array + notPorts: + description: Optional. + items: + type: string + type: array + paths: + description: Optional. + items: + type: string + type: array + ports: + description: Optional. + items: + type: string + type: array + type: object + type: object + type: array + when: + description: Optional. + items: + properties: + key: + description: The name of an Istio attribute. + type: string + notValues: + description: Optional. + items: + type: string + type: array + values: + description: Optional. + items: + type: string + type: array + required: + - key + type: object + type: array type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) - type: object - targetRef: - properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: name is the name of the target resource. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: namespace is the namespace of the referent. - type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 - required: - - kind - - name - type: object - targetRefs: - description: Optional. - items: + maxItems: 512 + type: array + selector: + description: Optional. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + targetRef: properties: group: description: group is the group of the target resource. @@ -676,99 +626,123 @@ spec: description: namespace is the namespace of the referent. type: string x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 required: - - kind - - name - type: object - maxItems: 16 - type: array - type: object - x-kubernetes-validations: - - message: only one of targetRefs or selector can be set - rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) - + (has(self.targetRefs) ? 1 : 0) <= 1' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string + - kind + - name type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. + targetRefs: + description: Optional. + items: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name + type: object + maxItems: 16 + type: array + type: object + x-kubernetes-validations: + - message: only one of targetRefs or selector can be set + rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + (has(self.targetRefs) ? 1 : 0) <= 1' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. + type: string + level: + description: |- + Represents how severe a message is. - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -786,6019 +760,5239 @@ spec: group: networking.istio.io names: categories: - - istio-io - - networking-istio-io + - istio-io + - networking-istio-io kind: DestinationRule listKind: DestinationRuleList plural: destinationrules shortNames: - - dr + - dr singular: destinationrule scope: Namespaced versions: - - additionalPrinterColumns: - - description: The name of a service from the service registry - jsonPath: .spec.host - name: Host - type: string - - description: CreationTimestamp is a timestamp representing the server time when - this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is represented - in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for - lists. For more information, see [Kubernetes API Conventions](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata) - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting load balancing, outlier detection, - etc. See more details at: https://istio.io/docs/reference/config/networking/destination-rule.html' - properties: - exportTo: - description: A list of namespaces to which this destination rule is - exported. - items: + - additionalPrinterColumns: + - description: The name of a service from the service registry + jsonPath: .spec.host + name: Host + type: string + - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. For more information, see [Kubernetes API Conventions](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata) + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting load balancing, outlier detection, etc. See more details at: https://istio.io/docs/reference/config/networking/destination-rule.html' + properties: + exportTo: + description: A list of namespaces to which this destination rule is exported. + items: + type: string + type: array + host: + description: The name of a service from the service registry. type: string - type: array - host: - description: The name of a service from the service registry. - type: string - subsets: - description: One or more named sets that represent individual versions - of a service. - items: - properties: - labels: - additionalProperties: + subsets: + description: One or more named sets that represent individual versions of a service. + items: + properties: + labels: + additionalProperties: + type: string + description: Labels apply a filter over the endpoints of a service in the service registry. + type: object + name: + description: Name of the subset. type: string - description: Labels apply a filter over the endpoints of a service - in the service registry. - type: object - name: - description: Name of the subset. - type: string - trafficPolicy: - description: Traffic policies that apply to this subset. - properties: - connectionPool: - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. + trafficPolicy: + description: Traffic policies that apply to this subset. + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will - be queued while waiting for a ready connection - pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to - a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection - pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams - allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection - to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can - be outstanding to all hosts in a cluster at a - given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will - be preserved while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream - connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections - to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the - socket to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive - probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes - to send without response before deciding the - connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection - needs to be idle before keep-alive probes - start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms + maxConcurrentStreams: + description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be preserved while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms rule: duration(self) >= duration('1ms') - type: object - type: object - type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: - - required: - - simple - - required: - - consistentHash - - required: - - simple - - required: - - consistentHash - properties: - consistentHash: - allOf: - - oneOf: - - not: - anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - oneOf: - - not: - anyOf: - - required: - - ringHash - - required: - - maglev - - required: - - ringHash - - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. - properties: - attributes: - description: Additional attributes for the cookie. - items: - properties: - name: - description: The name of the cookie attribute. - type: string - value: - description: The optional value of the - cookie attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. - type: string - ttl: - description: Lifetime of the cookie. - type: string - required: - - name - type: object - httpHeaderName: - description: Hash based on a specific HTTP header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query - parameter. - type: string - maglev: - description: The Maglev load balancer implements - consistent hashing to backend hosts. - properties: - tableSize: - description: The table size for Maglev hashing. - minimum: 0 - type: integer - type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer - implements consistent hashing to backend hosts. - properties: - minimumRingSize: - description: The minimum number of virtual nodes - to use for the hash ring. - minimum: 0 - type: integer - type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean - type: object - localityLbSetting: - properties: - distribute: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' separated, - e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities to - traffic distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the traffic - will fail over to when endpoints in the - 'from' region becomes unhealthy. - type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered list - of labels used to sort endpoints to do priority - based load balancing. - items: + idleTimeout: + description: The idle timeout for TCP connections. type: string - type: array - type: object - simple: - description: |2- - - - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration of - Service. - properties: - aggression: - description: This parameter controls the speed of - traffic increase over the warmup duration. - format: double - minimum: 0 - nullable: true - type: number - duration: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - required: - - duration - type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - outlierDetection: - properties: - baseEjectionTime: - description: Minimum ejection duration. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is ejected - from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host - is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated - failures before ejection occurs. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - interval: - description: Time interval between ejection sweep analysis. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing - pool for the upstream service that can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled as long - as the associated load balancing pool has at least - `minHealthPercent` hosts in healthy mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local - origin failures from external errors. - type: boolean - type: object - portLevelSettings: - description: Traffic policies specific to individual ports. - items: - properties: - connectionPool: - properties: - http: - description: HTTP connection pool settings. + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that - will be queued while waiting for a ready - connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests - to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream - connection pool connections. + interval: + description: The time duration between keep-alive probes. type: string x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent - streams allowed for a peer on one HTTP/2 - connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per - connection to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that - can be outstanding to all hosts in a cluster - at a given time. - format: int32 + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to send without response before deciding the connection is dead. + maximum: 4294967295 + minimum: 0 type: integer - useClientProtocol: - description: If set to true, client protocol - will be preserved while initiating connection - to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and - TCP upstream connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. + time: + description: The time duration a connection needs to be idle before keep-alive probes start being sent. type: string x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP - connections to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE - on the socket to enable TCP Keepalives. - properties: - interval: - description: The time duration between - keep-alive probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive - probes to send without response before - deciding the connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection - needs to be idle before keep-alive probes - start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - type: object + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') type: object type: object - loadBalancer: - description: Settings controlling the load balancer - algorithms. - oneOf: - - not: - anyOf: + type: object + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: - required: - - simple + - simple - required: - - consistentHash - - required: + - consistentHash + - required: - simple - - required: + - required: - consistentHash - properties: - consistentHash: - allOf: - - oneOf: + properties: + consistentHash: + allOf: + - oneOf: - not: anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName - required: - - httpHeaderName + - httpHeaderName - required: - - httpCookie + - httpCookie - required: - - useSourceIp + - useSourceIp - required: - - httpQueryParameterName - - oneOf: + - httpQueryParameterName + - oneOf: - not: anyOf: - - required: - - ringHash - - required: - - maglev + - required: + - ringHash + - required: + - maglev - required: - - ringHash + - ringHash - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. - properties: - attributes: - description: Additional attributes for - the cookie. - items: - properties: - name: - description: The name of the cookie - attribute. - type: string - value: - description: The optional value - of the cookie attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. - type: string - ttl: - description: Lifetime of the cookie. - type: string - required: - - name - type: object - httpHeaderName: - description: Hash based on a specific HTTP - header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP - query parameter. - type: string - maglev: - description: The Maglev load balancer implements - consistent hashing to backend hosts. - properties: - tableSize: - description: The table size for Maglev - hashing. - minimum: 0 - type: integer - type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer - implements consistent hashing to backend - hosts. - properties: - minimumRingSize: - description: The minimum number of virtual - nodes to use for the hash ring. - minimum: 0 - type: integer - type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean - type: object - localityLbSetting: + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. properties: - distribute: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' - separated, e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities - to traffic distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' + attributes: + description: Additional attributes for the cookie. items: properties: - from: - description: Originating region. + name: + description: The name of the cookie attribute. type: string - to: - description: Destination region the - traffic will fail over to when endpoints - in the 'from' region becomes unhealthy. + value: + description: The optional value of the cookie attribute. type: string + required: + - name type: object type: array - failoverPriority: - description: failoverPriority is an ordered - list of labels used to sort endpoints to - do priority based load balancing. - items: - type: string - type: array - type: object - simple: - description: |2- - - - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration - of Service. - properties: - aggression: - description: This parameter controls the speed - of traffic increase over the warmup duration. - format: double - minimum: 0 - nullable: true - type: number - duration: + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number required: - - duration + - name type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' + httpHeaderName: + description: Hash based on a specific HTTP header. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - type: object - outlierDetection: - properties: - baseEjectionTime: - description: Minimum ejection duration. + httpQueryParameterName: + description: Hash based on a specific HTTP query parameter. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host - is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a - host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally - originated failures before ejection occurs. - maximum: 4294967295 + maglev: + description: The Maglev load balancer implements consistent hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev hashing. + minimum: 0 + type: integer + type: object + minimumRingSize: + description: Deprecated. minimum: 0 - nullable: true - type: integer - interval: - description: Time interval between ejection sweep - analysis. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing - pool for the upstream service that can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled - as long as the associated load balancing pool - has at least `minHealthPercent` hosts in healthy - mode. - format: int32 type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish - local origin failures from external errors. + ringHash: + description: The ring/modulo hash load balancer implements consistent hashing to backend hosts. + properties: + minimumRingSize: + description: The minimum number of virtual nodes to use for the hash ring. + minimum: 0 + type: integer + type: object + useSourceIp: + description: Hash based on the source IP address. type: boolean type: object - port: - description: Specifies the number of a port on the - destination service on which this policy is being - applied. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - tls: - description: TLS related settings for connections - to the upstream service. + localityLbSetting: properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing - certificate authority certificates to use in - verifying a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing - the certificate revocation list (CRL) to use - in verifying a presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds - the TLS certs for the client including the CA - certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether - the proxy should skip verifying the CA signature - and SAN for the server certificate corresponding - to the host.' + distribute: + description: 'Optional: only one of distribute, failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating locality, '/' separated, e.g. + type: string + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities to traffic distribution weights. + type: object + type: object + type: array + enabled: + description: Enable locality load balancing. nullable: true type: boolean - mode: - description: |- - Indicates whether connections to this port should be secured using TLS. - - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. - type: string - sni: - description: SNI string to present to the server - during TLS handshake. - type: string - subjectAltNames: - description: A list of alternate names to verify - the subject identity in the certificate. + failover: + description: 'Optional: only one of distribute, failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. + type: string + to: + description: Destination region the traffic will fail over to when endpoints in the 'from' region becomes unhealthy. + type: string + type: object + type: array + failoverPriority: + description: failoverPriority is an ordered list of labels used to sort endpoints to do priority based load balancing. items: type: string type: array type: object - type: object - maxItems: 4096 - type: array - proxyProtocol: - description: The upstream PROXY protocol settings. - properties: - version: - description: |- - The PROXY protocol version to use. + simple: + description: |- - Valid Options: V1, V2 - enum: - - V1 - - V2 - type: string - type: object - retryBudget: - description: Specifies a limit on concurrent retries in - relation to the number of active requests. - properties: - minRetryConcurrency: - description: Specifies the minimum retry concurrency - allowed for the retry budget. - maximum: 4294967295 - minimum: 0 - type: integer - percent: - description: Specifies the limit on concurrent retries - as a percentage of the sum of active requests and - active pending requests. - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - type: object - tls: - description: TLS related settings for connections to the - upstream service. - properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing - certificate authority certificates to use in verifying - a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing - the certificate revocation list (CRL) to use in verifying - a presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds the TLS - certs for the client including the CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether - the proxy should skip verifying the CA signature and - SAN for the server certificate corresponding to the - host.' - nullable: true - type: boolean - mode: - description: |- - Indicates whether connections to this port should be secured using TLS. - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. - type: string - sni: - description: SNI string to present to the server during - TLS handshake. - type: string - subjectAltNames: - description: A list of alternate names to verify the - subject identity in the certificate. - items: + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST type: string - type: array - type: object - tunnel: - description: Configuration of tunneling TCP over other transport - or application layers for the host configured in the DestinationRule. - properties: - protocol: - description: Specifies which protocol to use for tunneling - the downstream connection. - type: string - targetHost: - description: Specifies a host to which the downstream - connection is tunneled. - type: string - targetPort: - description: Specifies a port to which the downstream - connection is tunneled. - maximum: 4294967295 - minimum: 0 - type: integer - required: - - targetHost - - targetPort - type: object - type: object - required: - - name - type: object - type: array - trafficPolicy: - description: Traffic policies to apply (load balancing policy, connection - pool sizes, outlier detection). - properties: - connectionPool: - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be queued - while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection - pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams - allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection - to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding - to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be preserved - while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream - connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections - to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket - to enable TCP Keepalives. + warmup: + description: Represents the warmup configuration of Service. + properties: + aggression: + description: This parameter controls the speed of traffic increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: properties: - interval: - description: The time duration between keep-alive - probes. + baseEjectionTime: + description: Minimum ejection duration. type: string x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes to - send without response before deciding the connection - is dead. + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected from the connection pool. maximum: 4294967295 minimum: 0 + nullable: true type: integer - time: - description: The time duration a connection needs - to be idle before keep-alive probes start being - sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: object - type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: - - required: - - simple - - required: - - consistentHash - - required: - - simple - - required: - - consistentHash - properties: - consistentHash: - allOf: - - oneOf: - - not: - anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - oneOf: - - not: - anyOf: - - required: - - ringHash - - required: - - maglev - - required: - - ringHash - - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. - properties: - attributes: - description: Additional attributes for the cookie. - items: - properties: - name: - description: The name of the cookie attribute. - type: string - value: - description: The optional value of the cookie - attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. - type: string - ttl: - description: Lifetime of the cookie. - type: string - required: - - name - type: object - httpHeaderName: - description: Hash based on a specific HTTP header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query parameter. - type: string - maglev: - description: The Maglev load balancer implements consistent - hashing to backend hosts. - properties: - tableSize: - description: The table size for Maglev hashing. + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a host is ejected from the connection pool. + maximum: 4294967295 minimum: 0 + nullable: true type: integer - type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer implements - consistent hashing to backend hosts. - properties: - minimumRingSize: - description: The minimum number of virtual nodes to - use for the hash ring. + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated failures before ejection occurs. + maximum: 4294967295 minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep analysis. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected. + format: int32 type: integer + minHealthPercent: + description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local origin failures from external errors. + type: boolean type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean - type: object - localityLbSetting: - properties: - distribute: - description: 'Optional: only one of distribute, failover - or failoverPriority can be set.' + portLevelSettings: + description: Traffic policies specific to individual ports. items: properties: - from: - description: Originating locality, '/' separated, - e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities to traffic - distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, failover - or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the traffic will - fail over to when endpoints in the 'from' region - becomes unhealthy. - type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered list of labels - used to sort endpoints to do priority based load balancing. - items: - type: string - type: array - type: object - simple: - description: |2- - - - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration of Service. - properties: - aggression: - description: This parameter controls the speed of traffic - increase over the warmup duration. - format: double - minimum: 0 - nullable: true - type: number - duration: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - required: - - duration - type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - outlierDetection: - properties: - baseEjectionTime: - description: Minimum ejection duration. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is ejected - from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host is ejected - from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated - failures before ejection occurs. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - interval: - description: Time interval between ejection sweep analysis. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing pool - for the upstream service that can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled as long as - the associated load balancing pool has at least `minHealthPercent` - hosts in healthy mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local origin - failures from external errors. - type: boolean - type: object - portLevelSettings: - description: Traffic policies specific to individual ports. - items: - properties: - connectionPool: - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will - be queued while waiting for a ready connection - pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to - a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection - pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams - allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection - to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can - be outstanding to all hosts in a cluster at a - given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will - be preserved while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream - connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections - to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the - socket to enable TCP Keepalives. + connectionPool: properties: - interval: - description: The time duration between keep-alive - probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes - to send without response before deciding the - connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection - needs to be idle before keep-alive probes - start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be preserved while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between keep-alive probes. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to send without response before deciding the connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection needs to be idle before keep-alive probes start being sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + type: object type: object - type: object - type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: - - required: - - simple - - required: - - consistentHash - - required: - - simple - - required: - - consistentHash - properties: - consistentHash: - allOf: - - oneOf: - - not: - anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - oneOf: - - not: - anyOf: + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: + - required: + - simple + - required: + - consistentHash - required: - - ringHash + - simple - required: - - maglev - - required: - - ringHash - - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. + - consistentHash properties: - attributes: - description: Additional attributes for the cookie. - items: - properties: - name: - description: The name of the cookie attribute. - type: string - value: - description: The optional value of the - cookie attribute. + consistentHash: + allOf: + - oneOf: + - not: + anyOf: + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - oneOf: + - not: + anyOf: + - required: + - ringHash + - required: + - maglev + - required: + - ringHash + - required: + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. + properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the cookie attribute. + type: string + required: + - name + type: object + type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name + type: object + httpHeaderName: + description: Hash based on a specific HTTP header. + type: string + httpQueryParameterName: + description: Hash based on a specific HTTP query parameter. + type: string + maglev: + description: The Maglev load balancer implements consistent hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev hashing. + minimum: 0 + type: integer + type: object + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer implements consistent hashing to backend hosts. + properties: + minimumRingSize: + description: The minimum number of virtual nodes to use for the hash ring. + minimum: 0 + type: integer + type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean + type: object + localityLbSetting: + properties: + distribute: + description: 'Optional: only one of distribute, failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating locality, '/' separated, e.g. + type: string + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities to traffic distribution weights. + type: object + type: object + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. + type: string + to: + description: Destination region the traffic will fail over to when endpoints in the 'from' region becomes unhealthy. + type: string + type: object + type: array + failoverPriority: + description: failoverPriority is an ordered list of labels used to sort endpoints to do priority based load balancing. + items: type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. + type: array + type: object + simple: + description: |- + + + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST type: string - ttl: - description: Lifetime of the cookie. + warmup: + description: Represents the warmup configuration of Service. + properties: + aggression: + description: This parameter controls the speed of traffic increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' type: string - required: - - name + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') type: object - httpHeaderName: - description: Hash based on a specific HTTP header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query - parameter. - type: string - maglev: - description: The Maglev load balancer implements - consistent hashing to backend hosts. + outlierDetection: properties: - tableSize: - description: The table size for Maglev hashing. + baseEjectionTime: + description: Minimum ejection duration. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected from the connection pool. + maximum: 4294967295 minimum: 0 + nullable: true + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a host is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated failures before ejection occurs. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep analysis. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected. + format: int32 type: integer + minHealthPercent: + description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local origin failures from external errors. + type: boolean type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer - implements consistent hashing to backend hosts. + port: + description: Specifies the number of a port on the destination service on which this policy is being applied. properties: - minimumRingSize: - description: The minimum number of virtual nodes - to use for the hash ring. + number: + maximum: 4294967295 minimum: 0 type: integer type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean - type: object - localityLbSetting: - properties: - distribute: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' separated, - e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities to - traffic distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the traffic - will fail over to when endpoints in the - 'from' region becomes unhealthy. + tls: + description: TLS related settings for connections to the upstream service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds the TLS certs for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.' + nullable: true + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. + + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server during TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject identity in the certificate. + items: type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered list - of labels used to sort endpoints to do priority - based load balancing. - items: - type: string - type: array + type: array + type: object type: object - simple: - description: |2- + maxItems: 4096 + type: array + proxyProtocol: + description: The upstream PROXY protocol settings. + properties: + version: + description: |- + The PROXY protocol version to use. + Valid Options: V1, V2 + enum: + - V1 + - V2 + type: string + type: object + retryBudget: + description: Specifies a limit on concurrent retries in relation to the number of active requests. + properties: + minRetryConcurrency: + description: Specifies the minimum retry concurrency allowed for the retry budget. + maximum: 4294967295 + minimum: 0 + type: integer + percent: + description: Specifies the limit on concurrent retries as a percentage of the sum of active requests and active pending requests. + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + type: object + tls: + description: TLS related settings for connections to the upstream service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds the TLS certs for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.' + nullable: true + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration of - Service. - properties: - aggression: - description: This parameter controls the speed of - traffic increase over the warmup duration. - format: double - minimum: 0 - nullable: true - type: number - duration: + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server during TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject identity in the certificate. + items: type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - required: - - duration - type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - outlierDetection: + type: array + type: object + tunnel: + description: Configuration of tunneling TCP over other transport or application layers for the host configured in the DestinationRule. + properties: + protocol: + description: Specifies which protocol to use for tunneling the downstream connection. + type: string + targetHost: + description: Specifies a host to which the downstream connection is tunneled. + type: string + targetPort: + description: Specifies a port to which the downstream connection is tunneled. + maximum: 4294967295 + minimum: 0 + type: integer + required: + - targetHost + - targetPort + type: object + type: object + required: + - name + type: object + type: array + trafficPolicy: + description: Traffic policies to apply (load balancing policy, connection pool sizes, outlier detection). + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. properties: - baseEjectionTime: - description: Minimum ejection duration. + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is ejected - from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: + http1MaxPendingRequests: + description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. format: int32 type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host - is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated - failures before ejection occurs. - maximum: 4294967295 - minimum: 0 - nullable: true + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 type: integer - interval: - description: Time interval between ejection sweep analysis. + idleTimeout: + description: The idle timeout for upstream connection pool connections. type: string x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing - pool for the upstream service that can be ejected. + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. format: int32 type: integer - minHealthPercent: - description: Outlier detection will be enabled as long - as the associated load balancing pool has at least - `minHealthPercent` hosts in healthy mode. + maxRequestsPerConnection: + description: Maximum number of requests per connection to a backend. format: int32 type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local - origin failures from external errors. - type: boolean - type: object - port: - description: Specifies the number of a port on the destination - service on which this policy is being applied. - properties: - number: - maximum: 4294967295 - minimum: 0 + maxRetries: + description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. + format: int32 type: integer + useClientProtocol: + description: If set to true, client protocol will be preserved while initiating connection to backend. + type: boolean type: object - tls: - description: TLS related settings for connections to the - upstream service. + tcp: + description: Settings common to both HTTP and TCP upstream connections. properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing - certificate authority certificates to use in verifying - a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing - the certificate revocation list (CRL) to use in verifying - a presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds the TLS - certs for the client including the CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether - the proxy should skip verifying the CA signature and - SAN for the server certificate corresponding to the - host.' - nullable: true - type: boolean - mode: - description: |- - Indicates whether connections to this port should be secured using TLS. - - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL + connectTimeout: + description: TCP connection timeout. type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. type: string - sni: - description: SNI string to present to the server during - TLS handshake. + maxConnectionDuration: + description: The maximum duration of a connection. type: string - subjectAltNames: - description: A list of alternate names to verify the - subject identity in the certificate. - items: - type: string - type: array - type: object - type: object - maxItems: 4096 - type: array - proxyProtocol: - description: The upstream PROXY protocol settings. - properties: - version: - description: |- - The PROXY protocol version to use. - - Valid Options: V1, V2 - enum: - - V1 - - V2 - type: string - type: object - retryBudget: - description: Specifies a limit on concurrent retries in relation - to the number of active requests. - properties: - minRetryConcurrency: - description: Specifies the minimum retry concurrency allowed - for the retry budget. - maximum: 4294967295 - minimum: 0 - type: integer - percent: - description: Specifies the limit on concurrent retries as - a percentage of the sum of active requests and active pending - requests. - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - type: object - tls: - description: TLS related settings for connections to the upstream - service. - properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing certificate - authority certificates to use in verifying a presented server - certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing the - certificate revocation list (CRL) to use in verifying a - presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds the TLS certs - for the client including the CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether the proxy - should skip verifying the CA signature and SAN for the server - certificate corresponding to the host.' - nullable: true - type: boolean - mode: - description: |- - Indicates whether connections to this port should be secured using TLS. - - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. - type: string - sni: - description: SNI string to present to the server during TLS - handshake. - type: string - subjectAltNames: - description: A list of alternate names to verify the subject - identity in the certificate. - items: - type: string - type: array - type: object - tunnel: - description: Configuration of tunneling TCP over other transport - or application layers for the host configured in the DestinationRule. - properties: - protocol: - description: Specifies which protocol to use for tunneling - the downstream connection. - type: string - targetHost: - description: Specifies a host to which the downstream connection - is tunneled. - type: string - targetPort: - description: Specifies a port to which the downstream connection - is tunneled. - maximum: 4294967295 - minimum: 0 - type: integer - required: - - targetHost - - targetPort - type: object - type: object - workloadSelector: - description: Criteria used to select the specific set of pods/VMs - on which this `DestinationRule` configuration should be applied. - properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of - pods/VMs on which a policy should be applied. - maxProperties: 4096 - type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) - type: object - required: - - host - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. - - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} - - additionalPrinterColumns: - - description: The name of a service from the service registry - jsonPath: .spec.host - name: Host - type: string - - description: CreationTimestamp is a timestamp representing the server time when - this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is represented - in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for - lists. For more information, see [Kubernetes API Conventions](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata) - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1alpha3 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting load balancing, outlier detection, - etc. See more details at: https://istio.io/docs/reference/config/networking/destination-rule.html' - properties: - exportTo: - description: A list of namespaces to which this destination rule is - exported. - items: - type: string - type: array - host: - description: The name of a service from the service registry. - type: string - subsets: - description: One or more named sets that represent individual versions - of a service. - items: - properties: - labels: - additionalProperties: - type: string - description: Labels apply a filter over the endpoints of a service - in the service registry. - type: object - name: - description: Name of the subset. - type: string - trafficPolicy: - description: Traffic policies that apply to this subset. - properties: - connectionPool: - properties: - http: - description: HTTP connection pool settings. + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will - be queued while waiting for a ready connection - pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to - a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection - pool connections. + interval: + description: The time duration between keep-alive probes. type: string x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams - allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection - to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can - be outstanding to all hosts in a cluster at a - given time. - format: int32 + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to send without response before deciding the connection is dead. + maximum: 4294967295 + minimum: 0 type: integer - useClientProtocol: - description: If set to true, client protocol will - be preserved while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream - connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. + time: + description: The time duration a connection needs to be idle before keep-alive probes start being sent. type: string x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections - to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the - socket to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive - probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes - to send without response before deciding the - connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection - needs to be idle before keep-alive probes - start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - type: object + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') type: object type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: + type: object + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: - required: - - simple + - simple - required: - - consistentHash - - required: + - consistentHash + - required: - simple - - required: + - required: - consistentHash - properties: - consistentHash: - allOf: - - oneOf: + properties: + consistentHash: + allOf: + - oneOf: - not: anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName - required: - - httpQueryParameterName - - oneOf: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - oneOf: - not: anyOf: - - required: - - ringHash - - required: - - maglev + - required: + - ringHash + - required: + - maglev - required: - - ringHash + - ringHash - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. - properties: - attributes: - description: Additional attributes for the cookie. - items: - properties: - name: - description: The name of the cookie attribute. - type: string - value: - description: The optional value of the - cookie attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. - type: string - ttl: - description: Lifetime of the cookie. - type: string - required: - - name - type: object - httpHeaderName: - description: Hash based on a specific HTTP header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query - parameter. - type: string - maglev: - description: The Maglev load balancer implements - consistent hashing to backend hosts. - properties: - tableSize: - description: The table size for Maglev hashing. - minimum: 0 - type: integer - type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer - implements consistent hashing to backend hosts. - properties: - minimumRingSize: - description: The minimum number of virtual nodes - to use for the hash ring. - minimum: 0 - type: integer - type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean - type: object - localityLbSetting: + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. properties: - distribute: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' separated, - e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities to - traffic distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' + attributes: + description: Additional attributes for the cookie. items: properties: - from: - description: Originating region. + name: + description: The name of the cookie attribute. type: string - to: - description: Destination region the traffic - will fail over to when endpoints in the - 'from' region becomes unhealthy. + value: + description: The optional value of the cookie attribute. type: string + required: + - name type: object type: array - failoverPriority: - description: failoverPriority is an ordered list - of labels used to sort endpoints to do priority - based load balancing. - items: - type: string - type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name type: object - simple: - description: |2- - - - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST + httpHeaderName: + description: Hash based on a specific HTTP header. + type: string + httpQueryParameterName: + description: Hash based on a specific HTTP query parameter. type: string - warmup: - description: Represents the warmup configuration of - Service. + maglev: + description: The Maglev load balancer implements consistent hashing to backend hosts. properties: - aggression: - description: This parameter controls the speed of - traffic increase over the warmup duration. - format: double + tableSize: + description: The table size for Maglev hashing. minimum: 0 - nullable: true - type: number - duration: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 + type: integer + type: object + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer implements consistent hashing to backend hosts. + properties: + minimumRingSize: + description: The minimum number of virtual nodes to use for the hash ring. minimum: 0 - nullable: true - type: number - required: - - duration + type: integer type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') + useSourceIp: + description: Hash based on the source IP address. + type: boolean type: object - outlierDetection: + localityLbSetting: properties: - baseEjectionTime: - description: Minimum ejection duration. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is ejected - from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host - is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 + distribute: + description: 'Optional: only one of distribute, failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating locality, '/' separated, e.g. + type: string + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities to traffic distribution weights. + type: object + type: object + type: array + enabled: + description: Enable locality load balancing. nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated - failures before ejection occurs. - maximum: 4294967295 + type: boolean + failover: + description: 'Optional: only one of distribute, failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. + type: string + to: + description: Destination region the traffic will fail over to when endpoints in the 'from' region becomes unhealthy. + type: string + type: object + type: array + failoverPriority: + description: failoverPriority is an ordered list of labels used to sort endpoints to do priority based load balancing. + items: + type: string + type: array + type: object + simple: + description: |- + + + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST + type: string + warmup: + description: Represents the warmup configuration of Service. + properties: + aggression: + description: This parameter controls the speed of traffic increase over the warmup duration. + format: double minimum: 0 nullable: true - type: integer - interval: - description: Time interval between ejection sweep analysis. + type: number + duration: type: string x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing - pool for the upstream service that can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled as long - as the associated load balancing pool has at least - `minHealthPercent` hosts in healthy mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local - origin failures from external errors. - type: boolean + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration type: object - portLevelSettings: - description: Traffic policies specific to individual ports. - items: + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: + properties: + baseEjectionTime: + description: Minimum ejection duration. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a host is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated failures before ejection occurs. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep analysis. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local origin failures from external errors. + type: boolean + type: object + portLevelSettings: + description: Traffic policies specific to individual ports. + items: + properties: + connectionPool: properties: - connectionPool: + http: + description: HTTP connection pool settings. properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that - will be queued while waiting for a ready - connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests - to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream - connection pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent - streams allowed for a peer on one HTTP/2 - connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per - connection to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that - can be outstanding to all hosts in a cluster - at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol - will be preserved while initiating connection - to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and - TCP upstream connections. + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be preserved while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. properties: - connectTimeout: - description: TCP connection timeout. + interval: + description: The time duration between keep-alive probes. type: string x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to send without response before deciding the connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection needs to be idle before keep-alive probes start being sent. type: string x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP - connections to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE - on the socket to enable TCP Keepalives. - properties: - interval: - description: The time duration between - keep-alive probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive - probes to send without response before - deciding the connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection - needs to be idle before keep-alive probes - start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - type: object + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') type: object type: object - loadBalancer: - description: Settings controlling the load balancer - algorithms. - oneOf: - - not: - anyOf: + type: object + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: - required: - - simple + - simple - required: - - consistentHash - - required: + - consistentHash + - required: - simple - - required: + - required: - consistentHash - properties: - consistentHash: - allOf: - - oneOf: + properties: + consistentHash: + allOf: + - oneOf: - not: anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName - required: - - httpHeaderName + - httpHeaderName - required: - - httpCookie + - httpCookie - required: - - useSourceIp + - useSourceIp - required: - - httpQueryParameterName - - oneOf: + - httpQueryParameterName + - oneOf: - not: anyOf: - - required: - - ringHash - - required: - - maglev + - required: + - ringHash + - required: + - maglev - required: - - ringHash + - ringHash - required: - - maglev + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. properties: - httpCookie: - description: Hash based on HTTP cookie. - properties: - attributes: - description: Additional attributes for - the cookie. - items: - properties: - name: - description: The name of the cookie - attribute. - type: string - value: - description: The optional value - of the cookie attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. - type: string - ttl: - description: Lifetime of the cookie. - type: string - required: - - name - type: object - httpHeaderName: - description: Hash based on a specific HTTP - header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP - query parameter. - type: string - maglev: - description: The Maglev load balancer implements - consistent hashing to backend hosts. - properties: - tableSize: - description: The table size for Maglev - hashing. - minimum: 0 - type: integer - type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer - implements consistent hashing to backend - hosts. - properties: - minimumRingSize: - description: The minimum number of virtual - nodes to use for the hash ring. - minimum: 0 - type: integer - type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean - type: object - localityLbSetting: - properties: - distribute: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' - separated, e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities - to traffic distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' + attributes: + description: Additional attributes for the cookie. items: properties: - from: - description: Originating region. + name: + description: The name of the cookie attribute. type: string - to: - description: Destination region the - traffic will fail over to when endpoints - in the 'from' region becomes unhealthy. + value: + description: The optional value of the cookie attribute. type: string + required: + - name type: object type: array - failoverPriority: - description: failoverPriority is an ordered - list of labels used to sort endpoints to - do priority based load balancing. - items: - type: string - type: array - type: object - simple: - description: |2- - - - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration - of Service. - properties: - aggression: - description: This parameter controls the speed - of traffic increase over the warmup duration. - format: double - minimum: 0 - nullable: true - type: number - duration: + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number required: - - duration + - name type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' + httpHeaderName: + description: Hash based on a specific HTTP header. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - type: object - outlierDetection: - properties: - baseEjectionTime: - description: Minimum ejection duration. + httpQueryParameterName: + description: Hash based on a specific HTTP query parameter. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host - is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a - host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally - originated failures before ejection occurs. - maximum: 4294967295 + maglev: + description: The Maglev load balancer implements consistent hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev hashing. + minimum: 0 + type: integer + type: object + minimumRingSize: + description: Deprecated. minimum: 0 - nullable: true - type: integer - interval: - description: Time interval between ejection sweep - analysis. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing - pool for the upstream service that can be ejected. - format: int32 type: integer - minHealthPercent: - description: Outlier detection will be enabled - as long as the associated load balancing pool - has at least `minHealthPercent` hosts in healthy - mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish - local origin failures from external errors. + ringHash: + description: The ring/modulo hash load balancer implements consistent hashing to backend hosts. + properties: + minimumRingSize: + description: The minimum number of virtual nodes to use for the hash ring. + minimum: 0 + type: integer + type: object + useSourceIp: + description: Hash based on the source IP address. type: boolean type: object - port: - description: Specifies the number of a port on the - destination service on which this policy is being - applied. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - tls: - description: TLS related settings for connections - to the upstream service. + localityLbSetting: properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing - certificate authority certificates to use in - verifying a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing - the certificate revocation list (CRL) to use - in verifying a presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds - the TLS certs for the client including the CA - certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether - the proxy should skip verifying the CA signature - and SAN for the server certificate corresponding - to the host.' + distribute: + description: 'Optional: only one of distribute, failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating locality, '/' separated, e.g. + type: string + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities to traffic distribution weights. + type: object + type: object + type: array + enabled: + description: Enable locality load balancing. nullable: true type: boolean - mode: - description: |- - Indicates whether connections to this port should be secured using TLS. - - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. - type: string - sni: - description: SNI string to present to the server - during TLS handshake. - type: string - subjectAltNames: - description: A list of alternate names to verify - the subject identity in the certificate. + failover: + description: 'Optional: only one of distribute, failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. + type: string + to: + description: Destination region the traffic will fail over to when endpoints in the 'from' region becomes unhealthy. + type: string + type: object + type: array + failoverPriority: + description: failoverPriority is an ordered list of labels used to sort endpoints to do priority based load balancing. items: type: string type: array type: object - type: object - maxItems: 4096 - type: array - proxyProtocol: - description: The upstream PROXY protocol settings. - properties: - version: - description: |- - The PROXY protocol version to use. + simple: + description: |- - Valid Options: V1, V2 - enum: - - V1 - - V2 - type: string - type: object - retryBudget: - description: Specifies a limit on concurrent retries in - relation to the number of active requests. - properties: - minRetryConcurrency: - description: Specifies the minimum retry concurrency - allowed for the retry budget. - maximum: 4294967295 - minimum: 0 - type: integer - percent: - description: Specifies the limit on concurrent retries - as a percentage of the sum of active requests and - active pending requests. - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - type: object - tls: - description: TLS related settings for connections to the - upstream service. - properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing - certificate authority certificates to use in verifying - a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing - the certificate revocation list (CRL) to use in verifying - a presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds the TLS - certs for the client including the CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether - the proxy should skip verifying the CA signature and - SAN for the server certificate corresponding to the - host.' - nullable: true - type: boolean - mode: - description: |- - Indicates whether connections to this port should be secured using TLS. - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. - type: string - sni: - description: SNI string to present to the server during - TLS handshake. - type: string - subjectAltNames: - description: A list of alternate names to verify the - subject identity in the certificate. - items: + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST type: string - type: array - type: object - tunnel: - description: Configuration of tunneling TCP over other transport - or application layers for the host configured in the DestinationRule. - properties: - protocol: - description: Specifies which protocol to use for tunneling - the downstream connection. - type: string - targetHost: - description: Specifies a host to which the downstream - connection is tunneled. - type: string - targetPort: - description: Specifies a port to which the downstream - connection is tunneled. - maximum: 4294967295 - minimum: 0 - type: integer - required: - - targetHost - - targetPort - type: object - type: object - required: - - name - type: object - type: array - trafficPolicy: - description: Traffic policies to apply (load balancing policy, connection - pool sizes, outlier detection). - properties: - connectionPool: - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be queued - while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection - pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams - allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection - to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding - to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be preserved - while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream - connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections - to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket - to enable TCP Keepalives. + warmup: + description: Represents the warmup configuration of Service. + properties: + aggression: + description: This parameter controls the speed of traffic increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: properties: - interval: - description: The time duration between keep-alive - probes. + baseEjectionTime: + description: Minimum ejection duration. type: string x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes to - send without response before deciding the connection - is dead. + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected from the connection pool. maximum: 4294967295 minimum: 0 + nullable: true type: integer - time: - description: The time duration a connection needs - to be idle before keep-alive probes start being - sent. + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a host is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated failures before ejection occurs. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep analysis. type: string x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local origin failures from external errors. + type: boolean type: object - type: object - type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: - - required: - - simple - - required: - - consistentHash - - required: - - simple - - required: - - consistentHash - properties: - consistentHash: - allOf: - - oneOf: - - not: - anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - oneOf: - - not: - anyOf: - - required: - - ringHash - - required: - - maglev - - required: - - ringHash - - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. + port: + description: Specifies the number of a port on the destination service on which this policy is being applied. properties: - attributes: - description: Additional attributes for the cookie. - items: - properties: - name: - description: The name of the cookie attribute. - type: string - value: - description: The optional value of the cookie - attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. - type: string - ttl: - description: Lifetime of the cookie. - type: string - required: - - name - type: object - httpHeaderName: - description: Hash based on a specific HTTP header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query parameter. - type: string - maglev: - description: The Maglev load balancer implements consistent - hashing to backend hosts. - properties: - tableSize: - description: The table size for Maglev hashing. + number: + maximum: 4294967295 minimum: 0 type: integer type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer implements - consistent hashing to backend hosts. + tls: + description: TLS related settings for connections to the upstream service. properties: - minimumRingSize: - description: The minimum number of virtual nodes to - use for the hash ring. - minimum: 0 - type: integer - type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean - type: object - localityLbSetting: - properties: - distribute: - description: 'Optional: only one of distribute, failover - or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' separated, - e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities to traffic - distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, failover - or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the traffic will - fail over to when endpoints in the 'from' region - becomes unhealthy. + caCertificates: + description: 'OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds the TLS certs for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.' + nullable: true + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. + + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server during TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject identity in the certificate. + items: type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered list of labels - used to sort endpoints to do priority based load balancing. - items: - type: string - type: array + type: array + type: object type: object - simple: - description: |2- + maxItems: 4096 + type: array + proxyProtocol: + description: The upstream PROXY protocol settings. + properties: + version: + description: |- + The PROXY protocol version to use. + Valid Options: V1, V2 + enum: + - V1 + - V2 + type: string + type: object + retryBudget: + description: Specifies a limit on concurrent retries in relation to the number of active requests. + properties: + minRetryConcurrency: + description: Specifies the minimum retry concurrency allowed for the retry budget. + maximum: 4294967295 + minimum: 0 + type: integer + percent: + description: Specifies the limit on concurrent retries as a percentage of the sum of active requests and active pending requests. + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + type: object + tls: + description: TLS related settings for connections to the upstream service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds the TLS certs for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.' + nullable: true + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration of Service. - properties: - aggression: - description: This parameter controls the speed of traffic - increase over the warmup duration. - format: double - minimum: 0 - nullable: true - type: number - duration: + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server during TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject identity in the certificate. + items: type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - required: - - duration - type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' + type: array + type: object + tunnel: + description: Configuration of tunneling TCP over other transport or application layers for the host configured in the DestinationRule. + properties: + protocol: + description: Specifies which protocol to use for tunneling the downstream connection. + type: string + targetHost: + description: Specifies a host to which the downstream connection is tunneled. + type: string + targetPort: + description: Specifies a port to which the downstream connection is tunneled. + maximum: 4294967295 + minimum: 0 + type: integer + required: + - targetHost + - targetPort + type: object + type: object + workloadSelector: + description: Criteria used to select the specific set of pods/VMs on which this `DestinationRule` configuration should be applied. + properties: + matchLabels: + additionalProperties: + maxLength: 63 type: string x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + required: + - host + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string type: object - outlierDetection: + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: properties: - baseEjectionTime: - description: Minimum ejection duration. + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is ejected - from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host is ejected - from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated - failures before ejection occurs. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - interval: - description: Time interval between ejection sweep analysis. + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing pool - for the upstream service that can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled as long as - the associated load balancing pool has at least `minHealthPercent` - hosts in healthy mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local origin - failures from external errors. - type: boolean + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object type: object - portLevelSettings: - description: Traffic policies specific to individual ports. - items: - properties: - connectionPool: - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - description: The name of a service from the service registry + jsonPath: .spec.host + name: Host + type: string + - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. For more information, see [Kubernetes API Conventions](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata) + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha3 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting load balancing, outlier detection, etc. See more details at: https://istio.io/docs/reference/config/networking/destination-rule.html' + properties: + exportTo: + description: A list of namespaces to which this destination rule is exported. + items: + type: string + type: array + host: + description: The name of a service from the service registry. + type: string + subsets: + description: One or more named sets that represent individual versions of a service. + items: + properties: + labels: + additionalProperties: + type: string + description: Labels apply a filter over the endpoints of a service in the service registry. + type: object + name: + description: Name of the subset. + type: string + trafficPolicy: + description: Traffic policies that apply to this subset. + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will - be queued while waiting for a ready connection - pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to - a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection - pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams - allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection - to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can - be outstanding to all hosts in a cluster at a - given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will - be preserved while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream - connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections - to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the - socket to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive - probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes - to send without response before deciding the - connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection - needs to be idle before keep-alive probes - start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms + maxConcurrentStreams: + description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be preserved while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms rule: duration(self) >= duration('1ms') - type: object - type: object - type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: - - required: - - simple - - required: - - consistentHash - - required: - - simple - - required: - - consistentHash - properties: - consistentHash: - allOf: - - oneOf: - - not: - anyOf: - - required: - - httpHeaderName - - required: - - httpCookie + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between keep-alive probes. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to send without response before deciding the connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection needs to be idle before keep-alive probes start being sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + type: object + type: object + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: - required: - - useSourceIp + - simple - required: - - httpQueryParameterName - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - oneOf: - - not: - anyOf: + - consistentHash + - required: + - simple + - required: + - consistentHash + properties: + consistentHash: + allOf: + - oneOf: + - not: + anyOf: + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - oneOf: + - not: + anyOf: + - required: + - ringHash + - required: + - maglev + - required: + - ringHash + - required: + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. + properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the cookie attribute. + type: string + required: + - name + type: object + type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name + type: object + httpHeaderName: + description: Hash based on a specific HTTP header. + type: string + httpQueryParameterName: + description: Hash based on a specific HTTP query parameter. + type: string + maglev: + description: The Maglev load balancer implements consistent hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev hashing. + minimum: 0 + type: integer + type: object + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer implements consistent hashing to backend hosts. + properties: + minimumRingSize: + description: The minimum number of virtual nodes to use for the hash ring. + minimum: 0 + type: integer + type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean + type: object + localityLbSetting: + properties: + distribute: + description: 'Optional: only one of distribute, failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating locality, '/' separated, e.g. + type: string + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities to traffic distribution weights. + type: object + type: object + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. + type: string + to: + description: Destination region the traffic will fail over to when endpoints in the 'from' region becomes unhealthy. + type: string + type: object + type: array + failoverPriority: + description: failoverPriority is an ordered list of labels used to sort endpoints to do priority based load balancing. + items: + type: string + type: array + type: object + simple: + description: |- + + + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST + type: string + warmup: + description: Represents the warmup configuration of Service. + properties: + aggression: + description: This parameter controls the speed of traffic increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: + properties: + baseEjectionTime: + description: Minimum ejection duration. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a host is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated failures before ejection occurs. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep analysis. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local origin failures from external errors. + type: boolean + type: object + portLevelSettings: + description: Traffic policies specific to individual ports. + items: + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be preserved while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between keep-alive probes. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to send without response before deciding the connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection needs to be idle before keep-alive probes start being sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + type: object + type: object + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: + - required: + - simple + - required: + - consistentHash - required: - - ringHash + - simple - required: - - maglev - - required: - - ringHash - - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. + - consistentHash properties: - attributes: - description: Additional attributes for the cookie. - items: - properties: - name: - description: The name of the cookie attribute. - type: string - value: - description: The optional value of the - cookie attribute. + consistentHash: + allOf: + - oneOf: + - not: + anyOf: + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - oneOf: + - not: + anyOf: + - required: + - ringHash + - required: + - maglev + - required: + - ringHash + - required: + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. + properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the cookie attribute. + type: string + required: + - name + type: object + type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name + type: object + httpHeaderName: + description: Hash based on a specific HTTP header. + type: string + httpQueryParameterName: + description: Hash based on a specific HTTP query parameter. + type: string + maglev: + description: The Maglev load balancer implements consistent hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev hashing. + minimum: 0 + type: integer + type: object + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer implements consistent hashing to backend hosts. + properties: + minimumRingSize: + description: The minimum number of virtual nodes to use for the hash ring. + minimum: 0 + type: integer + type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean + type: object + localityLbSetting: + properties: + distribute: + description: 'Optional: only one of distribute, failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating locality, '/' separated, e.g. + type: string + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities to traffic distribution weights. + type: object + type: object + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. + type: string + to: + description: Destination region the traffic will fail over to when endpoints in the 'from' region becomes unhealthy. + type: string + type: object + type: array + failoverPriority: + description: failoverPriority is an ordered list of labels used to sort endpoints to do priority based load balancing. + items: type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. + type: array + type: object + simple: + description: |- + + + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST type: string - ttl: - description: Lifetime of the cookie. + warmup: + description: Represents the warmup configuration of Service. + properties: + aggression: + description: This parameter controls the speed of traffic increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' type: string - required: - - name + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') type: object - httpHeaderName: - description: Hash based on a specific HTTP header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query - parameter. - type: string - maglev: - description: The Maglev load balancer implements - consistent hashing to backend hosts. + outlierDetection: properties: - tableSize: - description: The table size for Maglev hashing. + baseEjectionTime: + description: Minimum ejection duration. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a host is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated failures before ejection occurs. + maximum: 4294967295 minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep analysis. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode. + format: int32 type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local origin failures from external errors. + type: boolean type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer - implements consistent hashing to backend hosts. + port: + description: Specifies the number of a port on the destination service on which this policy is being applied. properties: - minimumRingSize: - description: The minimum number of virtual nodes - to use for the hash ring. + number: + maximum: 4294967295 minimum: 0 type: integer type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean - type: object - localityLbSetting: - properties: - distribute: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' separated, - e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities to - traffic distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the traffic - will fail over to when endpoints in the - 'from' region becomes unhealthy. + tls: + description: TLS related settings for connections to the upstream service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds the TLS certs for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.' + nullable: true + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. + + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server during TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject identity in the certificate. + items: type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered list - of labels used to sort endpoints to do priority - based load balancing. - items: - type: string - type: array + type: array + type: object type: object - simple: - description: |2- + maxItems: 4096 + type: array + proxyProtocol: + description: The upstream PROXY protocol settings. + properties: + version: + description: |- + The PROXY protocol version to use. + Valid Options: V1, V2 + enum: + - V1 + - V2 + type: string + type: object + retryBudget: + description: Specifies a limit on concurrent retries in relation to the number of active requests. + properties: + minRetryConcurrency: + description: Specifies the minimum retry concurrency allowed for the retry budget. + maximum: 4294967295 + minimum: 0 + type: integer + percent: + description: Specifies the limit on concurrent retries as a percentage of the sum of active requests and active pending requests. + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + type: object + tls: + description: TLS related settings for connections to the upstream service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds the TLS certs for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.' + nullable: true + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration of - Service. - properties: - aggression: - description: This parameter controls the speed of - traffic increase over the warmup duration. - format: double - minimum: 0 - nullable: true - type: number - duration: + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server during TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject identity in the certificate. + items: type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - required: - - duration - type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - outlierDetection: + type: array + type: object + tunnel: + description: Configuration of tunneling TCP over other transport or application layers for the host configured in the DestinationRule. + properties: + protocol: + description: Specifies which protocol to use for tunneling the downstream connection. + type: string + targetHost: + description: Specifies a host to which the downstream connection is tunneled. + type: string + targetPort: + description: Specifies a port to which the downstream connection is tunneled. + maximum: 4294967295 + minimum: 0 + type: integer + required: + - targetHost + - targetPort + type: object + type: object + required: + - name + type: object + type: array + trafficPolicy: + description: Traffic policies to apply (load balancing policy, connection pool sizes, outlier detection). + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. properties: - baseEjectionTime: - description: Minimum ejection duration. + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is ejected - from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: + http1MaxPendingRequests: + description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. format: int32 type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host - is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated - failures before ejection occurs. - maximum: 4294967295 - minimum: 0 - nullable: true + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 type: integer - interval: - description: Time interval between ejection sweep analysis. + idleTimeout: + description: The idle timeout for upstream connection pool connections. type: string x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing - pool for the upstream service that can be ejected. + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. format: int32 type: integer - minHealthPercent: - description: Outlier detection will be enabled as long - as the associated load balancing pool has at least - `minHealthPercent` hosts in healthy mode. + maxRequestsPerConnection: + description: Maximum number of requests per connection to a backend. format: int32 type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local - origin failures from external errors. - type: boolean - type: object - port: - description: Specifies the number of a port on the destination - service on which this policy is being applied. - properties: - number: - maximum: 4294967295 - minimum: 0 + maxRetries: + description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. + format: int32 type: integer + useClientProtocol: + description: If set to true, client protocol will be preserved while initiating connection to backend. + type: boolean type: object - tls: - description: TLS related settings for connections to the - upstream service. + tcp: + description: Settings common to both HTTP and TCP upstream connections. properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing - certificate authority certificates to use in verifying - a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing - the certificate revocation list (CRL) to use in verifying - a presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds the TLS - certs for the client including the CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether - the proxy should skip verifying the CA signature and - SAN for the server certificate corresponding to the - host.' - nullable: true - type: boolean - mode: - description: |- - Indicates whether connections to this port should be secured using TLS. - - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL + connectTimeout: + description: TCP connection timeout. type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. type: string - sni: - description: SNI string to present to the server during - TLS handshake. + maxConnectionDuration: + description: The maximum duration of a connection. type: string - subjectAltNames: - description: A list of alternate names to verify the - subject identity in the certificate. - items: - type: string - type: array - type: object - type: object - maxItems: 4096 - type: array - proxyProtocol: - description: The upstream PROXY protocol settings. - properties: - version: - description: |- - The PROXY protocol version to use. - - Valid Options: V1, V2 - enum: - - V1 - - V2 - type: string - type: object - retryBudget: - description: Specifies a limit on concurrent retries in relation - to the number of active requests. - properties: - minRetryConcurrency: - description: Specifies the minimum retry concurrency allowed - for the retry budget. - maximum: 4294967295 - minimum: 0 - type: integer - percent: - description: Specifies the limit on concurrent retries as - a percentage of the sum of active requests and active pending - requests. - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - type: object - tls: - description: TLS related settings for connections to the upstream - service. - properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing certificate - authority certificates to use in verifying a presented server - certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing the - certificate revocation list (CRL) to use in verifying a - presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds the TLS certs - for the client including the CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether the proxy - should skip verifying the CA signature and SAN for the server - certificate corresponding to the host.' - nullable: true - type: boolean - mode: - description: |- - Indicates whether connections to this port should be secured using TLS. - - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. - type: string - sni: - description: SNI string to present to the server during TLS - handshake. - type: string - subjectAltNames: - description: A list of alternate names to verify the subject - identity in the certificate. - items: - type: string - type: array - type: object - tunnel: - description: Configuration of tunneling TCP over other transport - or application layers for the host configured in the DestinationRule. - properties: - protocol: - description: Specifies which protocol to use for tunneling - the downstream connection. - type: string - targetHost: - description: Specifies a host to which the downstream connection - is tunneled. - type: string - targetPort: - description: Specifies a port to which the downstream connection - is tunneled. - maximum: 4294967295 - minimum: 0 - type: integer - required: - - targetHost - - targetPort - type: object - type: object - workloadSelector: - description: Criteria used to select the specific set of pods/VMs - on which this `DestinationRule` configuration should be applied. - properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of - pods/VMs on which a policy should be applied. - maxProperties: 4096 - type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) - type: object - required: - - host - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. - - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} - - additionalPrinterColumns: - - description: The name of a service from the service registry - jsonPath: .spec.host - name: Host - type: string - - description: CreationTimestamp is a timestamp representing the server time when - this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is represented - in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for - lists. For more information, see [Kubernetes API Conventions](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata) - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting load balancing, outlier detection, - etc. See more details at: https://istio.io/docs/reference/config/networking/destination-rule.html' - properties: - exportTo: - description: A list of namespaces to which this destination rule is - exported. - items: - type: string - type: array - host: - description: The name of a service from the service registry. - type: string - subsets: - description: One or more named sets that represent individual versions - of a service. - items: - properties: - labels: - additionalProperties: - type: string - description: Labels apply a filter over the endpoints of a service - in the service registry. - type: object - name: - description: Name of the subset. - type: string - trafficPolicy: - description: Traffic policies that apply to this subset. - properties: - connectionPool: - properties: - http: - description: HTTP connection pool settings. + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will - be queued while waiting for a ready connection - pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to - a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection - pool connections. + interval: + description: The time duration between keep-alive probes. type: string x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams - allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection - to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can - be outstanding to all hosts in a cluster at a - given time. - format: int32 + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to send without response before deciding the connection is dead. + maximum: 4294967295 + minimum: 0 type: integer - useClientProtocol: - description: If set to true, client protocol will - be preserved while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream - connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. + time: + description: The time duration a connection needs to be idle before keep-alive probes start being sent. type: string x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections - to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the - socket to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive - probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes - to send without response before deciding the - connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection - needs to be idle before keep-alive probes - start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - type: object + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') type: object type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: + type: object + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: - required: - - simple + - simple - required: - - consistentHash - - required: + - consistentHash + - required: - simple - - required: + - required: - consistentHash - properties: - consistentHash: - allOf: - - oneOf: + properties: + consistentHash: + allOf: + - oneOf: - not: anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName - required: - - httpHeaderName + - httpHeaderName - required: - - httpCookie + - httpCookie - required: - - useSourceIp + - useSourceIp - required: - - httpQueryParameterName - - oneOf: + - httpQueryParameterName + - oneOf: - not: anyOf: - - required: - - ringHash - - required: - - maglev + - required: + - ringHash + - required: + - maglev - required: - - ringHash + - ringHash - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. - properties: - attributes: - description: Additional attributes for the cookie. - items: - properties: - name: - description: The name of the cookie attribute. - type: string - value: - description: The optional value of the - cookie attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. - type: string - ttl: - description: Lifetime of the cookie. - type: string - required: - - name - type: object - httpHeaderName: - description: Hash based on a specific HTTP header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query - parameter. - type: string - maglev: - description: The Maglev load balancer implements - consistent hashing to backend hosts. - properties: - tableSize: - description: The table size for Maglev hashing. - minimum: 0 - type: integer - type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer - implements consistent hashing to backend hosts. - properties: - minimumRingSize: - description: The minimum number of virtual nodes - to use for the hash ring. - minimum: 0 - type: integer - type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean - type: object - localityLbSetting: + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. properties: - distribute: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' + attributes: + description: Additional attributes for the cookie. items: properties: - from: - description: Originating locality, '/' separated, - e.g. + name: + description: The name of the cookie attribute. type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities to - traffic distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the traffic - will fail over to when endpoints in the - 'from' region becomes unhealthy. + value: + description: The optional value of the cookie attribute. type: string + required: + - name type: object type: array - failoverPriority: - description: failoverPriority is an ordered list - of labels used to sort endpoints to do priority - based load balancing. - items: - type: string - type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name type: object - simple: - description: |2- - - - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST + httpHeaderName: + description: Hash based on a specific HTTP header. type: string - warmup: - description: Represents the warmup configuration of - Service. + httpQueryParameterName: + description: Hash based on a specific HTTP query parameter. + type: string + maglev: + description: The Maglev load balancer implements consistent hashing to backend hosts. properties: - aggression: - description: This parameter controls the speed of - traffic increase over the warmup duration. - format: double + tableSize: + description: The table size for Maglev hashing. minimum: 0 - nullable: true - type: number - duration: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 + type: integer + type: object + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer implements consistent hashing to backend hosts. + properties: + minimumRingSize: + description: The minimum number of virtual nodes to use for the hash ring. minimum: 0 - nullable: true - type: number - required: - - duration + type: integer type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') + useSourceIp: + description: Hash based on the source IP address. + type: boolean type: object - outlierDetection: + localityLbSetting: properties: - baseEjectionTime: - description: Minimum ejection duration. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is ejected - from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host - is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 + distribute: + description: 'Optional: only one of distribute, failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating locality, '/' separated, e.g. + type: string + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities to traffic distribution weights. + type: object + type: object + type: array + enabled: + description: Enable locality load balancing. nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated - failures before ejection occurs. - maximum: 4294967295 + type: boolean + failover: + description: 'Optional: only one of distribute, failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. + type: string + to: + description: Destination region the traffic will fail over to when endpoints in the 'from' region becomes unhealthy. + type: string + type: object + type: array + failoverPriority: + description: failoverPriority is an ordered list of labels used to sort endpoints to do priority based load balancing. + items: + type: string + type: array + type: object + simple: + description: |- + + + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST + type: string + warmup: + description: Represents the warmup configuration of Service. + properties: + aggression: + description: This parameter controls the speed of traffic increase over the warmup duration. + format: double minimum: 0 nullable: true - type: integer - interval: - description: Time interval between ejection sweep analysis. + type: number + duration: type: string x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing - pool for the upstream service that can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled as long - as the associated load balancing pool has at least - `minHealthPercent` hosts in healthy mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local - origin failures from external errors. - type: boolean + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration type: object - portLevelSettings: - description: Traffic policies specific to individual ports. - items: + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: + properties: + baseEjectionTime: + description: Minimum ejection duration. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a host is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated failures before ejection occurs. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep analysis. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local origin failures from external errors. + type: boolean + type: object + portLevelSettings: + description: Traffic policies specific to individual ports. + items: + properties: + connectionPool: properties: - connectionPool: + http: + description: HTTP connection pool settings. properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that - will be queued while waiting for a ready - connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests - to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream - connection pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent - streams allowed for a peer on one HTTP/2 - connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per - connection to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that - can be outstanding to all hosts in a cluster - at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol - will be preserved while initiating connection - to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and - TCP upstream connections. + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be preserved while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. properties: - connectTimeout: - description: TCP connection timeout. + interval: + description: The time duration between keep-alive probes. type: string x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to send without response before deciding the connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection needs to be idle before keep-alive probes start being sent. type: string x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP - connections to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE - on the socket to enable TCP Keepalives. - properties: - interval: - description: The time duration between - keep-alive probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive - probes to send without response before - deciding the connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection - needs to be idle before keep-alive probes - start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - type: object + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') type: object type: object - loadBalancer: - description: Settings controlling the load balancer - algorithms. - oneOf: - - not: - anyOf: + type: object + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: - required: - - simple + - simple - required: - - consistentHash - - required: + - consistentHash + - required: - simple - - required: + - required: - consistentHash - properties: - consistentHash: - allOf: - - oneOf: + properties: + consistentHash: + allOf: + - oneOf: - not: anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName - required: - - httpHeaderName + - httpHeaderName - required: - - httpCookie + - httpCookie - required: - - useSourceIp + - useSourceIp - required: - - httpQueryParameterName - - oneOf: + - httpQueryParameterName + - oneOf: - not: anyOf: - - required: - - ringHash - - required: - - maglev + - required: + - ringHash + - required: + - maglev - required: - - ringHash + - ringHash - required: - - maglev + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. properties: - httpCookie: - description: Hash based on HTTP cookie. - properties: - attributes: - description: Additional attributes for - the cookie. - items: - properties: - name: - description: The name of the cookie - attribute. - type: string - value: - description: The optional value - of the cookie attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. - type: string - ttl: - description: Lifetime of the cookie. - type: string - required: - - name - type: object - httpHeaderName: - description: Hash based on a specific HTTP - header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP - query parameter. - type: string - maglev: - description: The Maglev load balancer implements - consistent hashing to backend hosts. - properties: - tableSize: - description: The table size for Maglev - hashing. - minimum: 0 - type: integer - type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer - implements consistent hashing to backend - hosts. - properties: - minimumRingSize: - description: The minimum number of virtual - nodes to use for the hash ring. - minimum: 0 - type: integer - type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean - type: object - localityLbSetting: - properties: - distribute: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' - separated, e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities - to traffic distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' + attributes: + description: Additional attributes for the cookie. items: properties: - from: - description: Originating region. + name: + description: The name of the cookie attribute. type: string - to: - description: Destination region the - traffic will fail over to when endpoints - in the 'from' region becomes unhealthy. + value: + description: The optional value of the cookie attribute. type: string + required: + - name type: object type: array - failoverPriority: - description: failoverPriority is an ordered - list of labels used to sort endpoints to - do priority based load balancing. - items: - type: string - type: array - type: object - simple: - description: |2- - - - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration - of Service. - properties: - aggression: - description: This parameter controls the speed - of traffic increase over the warmup duration. - format: double - minimum: 0 - nullable: true - type: number - duration: + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number required: - - duration + - name type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' + httpHeaderName: + description: Hash based on a specific HTTP header. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - type: object - outlierDetection: - properties: - baseEjectionTime: - description: Minimum ejection duration. + httpQueryParameterName: + description: Hash based on a specific HTTP query parameter. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host - is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a - host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally - originated failures before ejection occurs. - maximum: 4294967295 + maglev: + description: The Maglev load balancer implements consistent hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev hashing. + minimum: 0 + type: integer + type: object + minimumRingSize: + description: Deprecated. minimum: 0 - nullable: true - type: integer - interval: - description: Time interval between ejection sweep - analysis. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing - pool for the upstream service that can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled - as long as the associated load balancing pool - has at least `minHealthPercent` hosts in healthy - mode. - format: int32 type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish - local origin failures from external errors. + ringHash: + description: The ring/modulo hash load balancer implements consistent hashing to backend hosts. + properties: + minimumRingSize: + description: The minimum number of virtual nodes to use for the hash ring. + minimum: 0 + type: integer + type: object + useSourceIp: + description: Hash based on the source IP address. type: boolean type: object - port: - description: Specifies the number of a port on the - destination service on which this policy is being - applied. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - tls: - description: TLS related settings for connections - to the upstream service. + localityLbSetting: properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing - certificate authority certificates to use in - verifying a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing - the certificate revocation list (CRL) to use - in verifying a presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds - the TLS certs for the client including the CA - certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether - the proxy should skip verifying the CA signature - and SAN for the server certificate corresponding - to the host.' + distribute: + description: 'Optional: only one of distribute, failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating locality, '/' separated, e.g. + type: string + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities to traffic distribution weights. + type: object + type: object + type: array + enabled: + description: Enable locality load balancing. nullable: true type: boolean - mode: - description: |- - Indicates whether connections to this port should be secured using TLS. - - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. - type: string - sni: - description: SNI string to present to the server - during TLS handshake. - type: string - subjectAltNames: - description: A list of alternate names to verify - the subject identity in the certificate. + failover: + description: 'Optional: only one of distribute, failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. + type: string + to: + description: Destination region the traffic will fail over to when endpoints in the 'from' region becomes unhealthy. + type: string + type: object + type: array + failoverPriority: + description: failoverPriority is an ordered list of labels used to sort endpoints to do priority based load balancing. items: type: string type: array type: object - type: object - maxItems: 4096 - type: array - proxyProtocol: - description: The upstream PROXY protocol settings. - properties: - version: - description: |- - The PROXY protocol version to use. + simple: + description: |- - Valid Options: V1, V2 - enum: - - V1 - - V2 - type: string - type: object - retryBudget: - description: Specifies a limit on concurrent retries in - relation to the number of active requests. - properties: - minRetryConcurrency: - description: Specifies the minimum retry concurrency - allowed for the retry budget. - maximum: 4294967295 - minimum: 0 - type: integer - percent: - description: Specifies the limit on concurrent retries - as a percentage of the sum of active requests and - active pending requests. - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - type: object - tls: - description: TLS related settings for connections to the - upstream service. - properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing - certificate authority certificates to use in verifying - a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing - the certificate revocation list (CRL) to use in verifying - a presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds the TLS - certs for the client including the CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether - the proxy should skip verifying the CA signature and - SAN for the server certificate corresponding to the - host.' - nullable: true - type: boolean - mode: - description: |- - Indicates whether connections to this port should be secured using TLS. - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. - type: string - sni: - description: SNI string to present to the server during - TLS handshake. - type: string - subjectAltNames: - description: A list of alternate names to verify the - subject identity in the certificate. - items: + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST type: string - type: array - type: object - tunnel: - description: Configuration of tunneling TCP over other transport - or application layers for the host configured in the DestinationRule. - properties: - protocol: - description: Specifies which protocol to use for tunneling - the downstream connection. - type: string - targetHost: - description: Specifies a host to which the downstream - connection is tunneled. - type: string - targetPort: - description: Specifies a port to which the downstream - connection is tunneled. - maximum: 4294967295 - minimum: 0 - type: integer - required: - - targetHost - - targetPort - type: object - type: object - required: - - name - type: object - type: array - trafficPolicy: - description: Traffic policies to apply (load balancing policy, connection - pool sizes, outlier detection). - properties: - connectionPool: - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be queued - while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection - pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams - allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection - to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding - to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be preserved - while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream - connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections - to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket - to enable TCP Keepalives. + warmup: + description: Represents the warmup configuration of Service. + properties: + aggression: + description: This parameter controls the speed of traffic increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: properties: - interval: - description: The time duration between keep-alive - probes. + baseEjectionTime: + description: Minimum ejection duration. type: string x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes to - send without response before deciding the connection - is dead. + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a host is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated failures before ejection occurs. maximum: 4294967295 minimum: 0 + nullable: true type: integer - time: - description: The time duration a connection needs - to be idle before keep-alive probes start being - sent. + interval: + description: Time interval between ejection sweep analysis. type: string x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local origin failures from external errors. + type: boolean type: object - type: object - type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: - - required: - - simple - - required: - - consistentHash - - required: - - simple - - required: - - consistentHash - properties: - consistentHash: - allOf: - - oneOf: - - not: - anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - oneOf: - - not: - anyOf: - - required: - - ringHash - - required: - - maglev - - required: - - ringHash - - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. + port: + description: Specifies the number of a port on the destination service on which this policy is being applied. properties: - attributes: - description: Additional attributes for the cookie. - items: - properties: - name: - description: The name of the cookie attribute. - type: string - value: - description: The optional value of the cookie - attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + tls: + description: TLS related settings for connections to the upstream service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.' type: string - path: - description: Path to set for the cookie. + caCrl: + description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.' type: string - ttl: - description: Lifetime of the cookie. + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. type: string - required: - - name - type: object - httpHeaderName: - description: Hash based on a specific HTTP header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query parameter. - type: string - maglev: - description: The Maglev load balancer implements consistent - hashing to backend hosts. - properties: - tableSize: - description: The table size for Maglev hashing. - minimum: 0 - type: integer - type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer implements - consistent hashing to backend hosts. - properties: - minimumRingSize: - description: The minimum number of virtual nodes to - use for the hash ring. - minimum: 0 - type: integer - type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean - type: object - localityLbSetting: - properties: - distribute: - description: 'Optional: only one of distribute, failover - or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' separated, - e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities to traffic - distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, failover - or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the traffic will - fail over to when endpoints in the 'from' region - becomes unhealthy. + credentialName: + description: The name of the secret that holds the TLS certs for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.' + nullable: true + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. + + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server during TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject identity in the certificate. + items: type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered list of labels - used to sort endpoints to do priority based load balancing. - items: - type: string - type: array + type: array + type: object type: object - simple: - description: |2- + maxItems: 4096 + type: array + proxyProtocol: + description: The upstream PROXY protocol settings. + properties: + version: + description: |- + The PROXY protocol version to use. + Valid Options: V1, V2 + enum: + - V1 + - V2 + type: string + type: object + retryBudget: + description: Specifies a limit on concurrent retries in relation to the number of active requests. + properties: + minRetryConcurrency: + description: Specifies the minimum retry concurrency allowed for the retry budget. + maximum: 4294967295 + minimum: 0 + type: integer + percent: + description: Specifies the limit on concurrent retries as a percentage of the sum of active requests and active pending requests. + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + type: object + tls: + description: TLS related settings for connections to the upstream service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds the TLS certs for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.' + nullable: true + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration of Service. - properties: - aggression: - description: This parameter controls the speed of traffic - increase over the warmup duration. - format: double - minimum: 0 - nullable: true - type: number - duration: + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server during TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject identity in the certificate. + items: type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - required: - - duration - type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' + type: array + type: object + tunnel: + description: Configuration of tunneling TCP over other transport or application layers for the host configured in the DestinationRule. + properties: + protocol: + description: Specifies which protocol to use for tunneling the downstream connection. + type: string + targetHost: + description: Specifies a host to which the downstream connection is tunneled. + type: string + targetPort: + description: Specifies a port to which the downstream connection is tunneled. + maximum: 4294967295 + minimum: 0 + type: integer + required: + - targetHost + - targetPort + type: object + type: object + workloadSelector: + description: Criteria used to select the specific set of pods/VMs on which this `DestinationRule` configuration should be applied. + properties: + matchLabels: + additionalProperties: + maxLength: 63 type: string x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + required: + - host + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string type: object - outlierDetection: + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: properties: - baseEjectionTime: - description: Minimum ejection duration. + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is ejected - from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host is ejected - from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated - failures before ejection occurs. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - interval: - description: Time interval between ejection sweep analysis. + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing pool - for the upstream service that can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled as long as - the associated load balancing pool has at least `minHealthPercent` - hosts in healthy mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local origin - failures from external errors. - type: boolean + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object type: object - portLevelSettings: - description: Traffic policies specific to individual ports. - items: - properties: - connectionPool: - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - description: The name of a service from the service registry + jsonPath: .spec.host + name: Host + type: string + - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. For more information, see [Kubernetes API Conventions](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata) + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting load balancing, outlier detection, etc. See more details at: https://istio.io/docs/reference/config/networking/destination-rule.html' + properties: + exportTo: + description: A list of namespaces to which this destination rule is exported. + items: + type: string + type: array + host: + description: The name of a service from the service registry. + type: string + subsets: + description: One or more named sets that represent individual versions of a service. + items: + properties: + labels: + additionalProperties: + type: string + description: Labels apply a filter over the endpoints of a service in the service registry. + type: object + name: + description: Name of the subset. + type: string + trafficPolicy: + description: Traffic policies that apply to this subset. + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will - be queued while waiting for a ready connection - pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to - a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection - pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams - allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection - to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can - be outstanding to all hosts in a cluster at a - given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will - be preserved while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream - connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections - to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the - socket to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive - probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes - to send without response before deciding the - connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection - needs to be idle before keep-alive probes - start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater - than 1ms + maxConcurrentStreams: + description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be preserved while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms rule: duration(self) >= duration('1ms') - type: object - type: object - type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: - - required: - - simple - - required: - - consistentHash - - required: - - simple - - required: - - consistentHash - properties: - consistentHash: - allOf: - - oneOf: - - not: - anyOf: - - required: - - httpHeaderName - - required: - - httpCookie + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between keep-alive probes. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to send without response before deciding the connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection needs to be idle before keep-alive probes start being sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + type: object + type: object + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: - required: - - useSourceIp + - simple - required: - - httpQueryParameterName - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - oneOf: - - not: - anyOf: + - consistentHash + - required: + - simple + - required: + - consistentHash + properties: + consistentHash: + allOf: + - oneOf: + - not: + anyOf: + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - oneOf: + - not: + anyOf: + - required: + - ringHash + - required: + - maglev + - required: + - ringHash + - required: + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. + properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the cookie attribute. + type: string + required: + - name + type: object + type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name + type: object + httpHeaderName: + description: Hash based on a specific HTTP header. + type: string + httpQueryParameterName: + description: Hash based on a specific HTTP query parameter. + type: string + maglev: + description: The Maglev load balancer implements consistent hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev hashing. + minimum: 0 + type: integer + type: object + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer implements consistent hashing to backend hosts. + properties: + minimumRingSize: + description: The minimum number of virtual nodes to use for the hash ring. + minimum: 0 + type: integer + type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean + type: object + localityLbSetting: + properties: + distribute: + description: 'Optional: only one of distribute, failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating locality, '/' separated, e.g. + type: string + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities to traffic distribution weights. + type: object + type: object + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. + type: string + to: + description: Destination region the traffic will fail over to when endpoints in the 'from' region becomes unhealthy. + type: string + type: object + type: array + failoverPriority: + description: failoverPriority is an ordered list of labels used to sort endpoints to do priority based load balancing. + items: + type: string + type: array + type: object + simple: + description: |- + + + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST + type: string + warmup: + description: Represents the warmup configuration of Service. + properties: + aggression: + description: This parameter controls the speed of traffic increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: + properties: + baseEjectionTime: + description: Minimum ejection duration. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a host is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated failures before ejection occurs. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep analysis. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local origin failures from external errors. + type: boolean + type: object + portLevelSettings: + description: Traffic policies specific to individual ports. + items: + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be preserved while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between keep-alive probes. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to send without response before deciding the connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection needs to be idle before keep-alive probes start being sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + type: object + type: object + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: + - required: + - simple + - required: + - consistentHash - required: - - ringHash + - simple - required: - - maglev - - required: - - ringHash - - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. + - consistentHash properties: - attributes: - description: Additional attributes for the cookie. - items: - properties: - name: - description: The name of the cookie attribute. - type: string - value: - description: The optional value of the - cookie attribute. + consistentHash: + allOf: + - oneOf: + - not: + anyOf: + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - oneOf: + - not: + anyOf: + - required: + - ringHash + - required: + - maglev + - required: + - ringHash + - required: + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. + properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the cookie attribute. + type: string + required: + - name + type: object + type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name + type: object + httpHeaderName: + description: Hash based on a specific HTTP header. + type: string + httpQueryParameterName: + description: Hash based on a specific HTTP query parameter. + type: string + maglev: + description: The Maglev load balancer implements consistent hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev hashing. + minimum: 0 + type: integer + type: object + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer implements consistent hashing to backend hosts. + properties: + minimumRingSize: + description: The minimum number of virtual nodes to use for the hash ring. + minimum: 0 + type: integer + type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean + type: object + localityLbSetting: + properties: + distribute: + description: 'Optional: only one of distribute, failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating locality, '/' separated, e.g. + type: string + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities to traffic distribution weights. + type: object + type: object + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. + type: string + to: + description: Destination region the traffic will fail over to when endpoints in the 'from' region becomes unhealthy. + type: string + type: object + type: array + failoverPriority: + description: failoverPriority is an ordered list of labels used to sort endpoints to do priority based load balancing. + items: type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. + type: array + type: object + simple: + description: |- + + + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST type: string - ttl: - description: Lifetime of the cookie. + warmup: + description: Represents the warmup configuration of Service. + properties: + aggression: + description: This parameter controls the speed of traffic increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' type: string - required: - - name + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') type: object - httpHeaderName: - description: Hash based on a specific HTTP header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query - parameter. - type: string - maglev: - description: The Maglev load balancer implements - consistent hashing to backend hosts. + outlierDetection: properties: - tableSize: - description: The table size for Maglev hashing. + baseEjectionTime: + description: Minimum ejection duration. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a host is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated failures before ejection occurs. + maximum: 4294967295 minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep analysis. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected. + format: int32 type: integer + minHealthPercent: + description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local origin failures from external errors. + type: boolean type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer - implements consistent hashing to backend hosts. + port: + description: Specifies the number of a port on the destination service on which this policy is being applied. properties: - minimumRingSize: - description: The minimum number of virtual nodes - to use for the hash ring. + number: + maximum: 4294967295 minimum: 0 type: integer type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean - type: object - localityLbSetting: - properties: - distribute: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' separated, - e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities to - traffic distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, - failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the traffic - will fail over to when endpoints in the - 'from' region becomes unhealthy. + tls: + description: TLS related settings for connections to the upstream service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds the TLS certs for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.' + nullable: true + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. + + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server during TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject identity in the certificate. + items: type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered list - of labels used to sort endpoints to do priority - based load balancing. - items: - type: string - type: array + type: array + type: object type: object - simple: - description: |2- + maxItems: 4096 + type: array + proxyProtocol: + description: The upstream PROXY protocol settings. + properties: + version: + description: |- + The PROXY protocol version to use. + Valid Options: V1, V2 + enum: + - V1 + - V2 + type: string + type: object + retryBudget: + description: Specifies a limit on concurrent retries in relation to the number of active requests. + properties: + minRetryConcurrency: + description: Specifies the minimum retry concurrency allowed for the retry budget. + maximum: 4294967295 + minimum: 0 + type: integer + percent: + description: Specifies the limit on concurrent retries as a percentage of the sum of active requests and active pending requests. + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + type: object + tls: + description: TLS related settings for connections to the upstream service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds the TLS certs for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.' + nullable: true + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration of - Service. - properties: - aggression: - description: This parameter controls the speed of - traffic increase over the warmup duration. - format: double - minimum: 0 - nullable: true - type: number - duration: + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server during TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject identity in the certificate. + items: type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - required: - - duration - type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - outlierDetection: + type: array + type: object + tunnel: + description: Configuration of tunneling TCP over other transport or application layers for the host configured in the DestinationRule. + properties: + protocol: + description: Specifies which protocol to use for tunneling the downstream connection. + type: string + targetHost: + description: Specifies a host to which the downstream connection is tunneled. + type: string + targetPort: + description: Specifies a port to which the downstream connection is tunneled. + maximum: 4294967295 + minimum: 0 + type: integer + required: + - targetHost + - targetPort + type: object + type: object + required: + - name + type: object + type: array + trafficPolicy: + description: Traffic policies to apply (load balancing policy, connection pool sizes, outlier detection). + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. properties: - baseEjectionTime: - description: Minimum ejection duration. + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is ejected - from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: + http1MaxPendingRequests: + description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. format: int32 type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host - is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated - failures before ejection occurs. - maximum: 4294967295 - minimum: 0 - nullable: true + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 type: integer - interval: - description: Time interval between ejection sweep analysis. + idleTimeout: + description: The idle timeout for upstream connection pool connections. type: string x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing - pool for the upstream service that can be ejected. + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. format: int32 type: integer - minHealthPercent: - description: Outlier detection will be enabled as long - as the associated load balancing pool has at least - `minHealthPercent` hosts in healthy mode. + maxRequestsPerConnection: + description: Maximum number of requests per connection to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. format: int32 type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local - origin failures from external errors. + useClientProtocol: + description: If set to true, client protocol will be preserved while initiating connection to backend. type: boolean type: object - port: - description: Specifies the number of a port on the destination - service on which this policy is being applied. + tcp: + description: Settings common to both HTTP and TCP upstream connections. properties: - number: - maximum: 4294967295 - minimum: 0 + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections to a destination host. + format: int32 type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between keep-alive probes. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to send without response before deciding the connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection needs to be idle before keep-alive probes start being sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object type: object - tls: - description: TLS related settings for connections to the - upstream service. + type: object + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: + - required: + - simple + - required: + - consistentHash + - required: + - simple + - required: + - consistentHash + properties: + consistentHash: + allOf: + - oneOf: + - not: + anyOf: + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - oneOf: + - not: + anyOf: + - required: + - ringHash + - required: + - maglev + - required: + - ringHash + - required: + - maglev properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing - certificate authority certificates to use in verifying - a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing - the certificate revocation list (CRL) to use in verifying - a presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. + httpCookie: + description: Hash based on HTTP cookie. + properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the cookie attribute. + type: string + required: + - name + type: object + type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name + type: object + httpHeaderName: + description: Hash based on a specific HTTP header. type: string - credentialName: - description: The name of the secret that holds the TLS - certs for the client including the CA certificates. + httpQueryParameterName: + description: Hash based on a specific HTTP query parameter. type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether - the proxy should skip verifying the CA signature and - SAN for the server certificate corresponding to the - host.' + maglev: + description: The Maglev load balancer implements consistent hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev hashing. + minimum: 0 + type: integer + type: object + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer implements consistent hashing to backend hosts. + properties: + minimumRingSize: + description: The minimum number of virtual nodes to use for the hash ring. + minimum: 0 + type: integer + type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean + type: object + localityLbSetting: + properties: + distribute: + description: 'Optional: only one of distribute, failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating locality, '/' separated, e.g. + type: string + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities to traffic distribution weights. + type: object + type: object + type: array + enabled: + description: Enable locality load balancing. nullable: true type: boolean - mode: - description: |- - Indicates whether connections to this port should be secured using TLS. - - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. - type: string - sni: - description: SNI string to present to the server during - TLS handshake. - type: string - subjectAltNames: - description: A list of alternate names to verify the - subject identity in the certificate. + failover: + description: 'Optional: only one of distribute, failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. + type: string + to: + description: Destination region the traffic will fail over to when endpoints in the 'from' region becomes unhealthy. + type: string + type: object + type: array + failoverPriority: + description: failoverPriority is an ordered list of labels used to sort endpoints to do priority based load balancing. items: type: string type: array type: object - type: object - maxItems: 4096 - type: array - proxyProtocol: - description: The upstream PROXY protocol settings. - properties: - version: - description: |- - The PROXY protocol version to use. - - Valid Options: V1, V2 - enum: - - V1 - - V2 - type: string - type: object - retryBudget: - description: Specifies a limit on concurrent retries in relation - to the number of active requests. - properties: - minRetryConcurrency: - description: Specifies the minimum retry concurrency allowed - for the retry budget. - maximum: 4294967295 - minimum: 0 - type: integer - percent: - description: Specifies the limit on concurrent retries as - a percentage of the sum of active requests and active pending - requests. - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - type: object - tls: - description: TLS related settings for connections to the upstream - service. - properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing certificate - authority certificates to use in verifying a presented server - certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing the - certificate revocation list (CRL) to use in verifying a - presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds the TLS certs - for the client including the CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether the proxy - should skip verifying the CA signature and SAN for the server - certificate corresponding to the host.' - nullable: true - type: boolean - mode: - description: |- - Indicates whether connections to this port should be secured using TLS. + simple: + description: |- - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. - type: string - sni: - description: SNI string to present to the server during TLS - handshake. - type: string - subjectAltNames: - description: A list of alternate names to verify the subject - identity in the certificate. - items: - type: string - type: array - type: object - tunnel: - description: Configuration of tunneling TCP over other transport - or application layers for the host configured in the DestinationRule. - properties: - protocol: - description: Specifies which protocol to use for tunneling - the downstream connection. - type: string - targetHost: - description: Specifies a host to which the downstream connection - is tunneled. - type: string - targetPort: - description: Specifies a port to which the downstream connection - is tunneled. - maximum: 4294967295 - minimum: 0 - type: integer - required: - - targetHost - - targetPort - type: object - type: object - workloadSelector: - description: Criteria used to select the specific set of pods/VMs - on which this `DestinationRule` configuration should be applied. - properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of - pods/VMs on which a policy should be applied. - maxProperties: 4096 - type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) - type: object - required: - - host - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST type: string - name: - description: A human-readable name for the message type. + warmup: + description: Represents the warmup configuration of Service. + properties: + aggression: + description: This parameter controls the speed of traffic increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: + properties: + baseEjectionTime: + description: Minimum ejection duration. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a host is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated failures before ejection occurs. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep analysis. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local origin failures from external errors. + type: boolean + type: object + portLevelSettings: + description: Traffic policies specific to individual ports. + items: + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be preserved while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between keep-alive probes. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to send without response before deciding the connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection needs to be idle before keep-alive probes start being sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + type: object + type: object + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: + - required: + - simple + - required: + - consistentHash + - required: + - simple + - required: + - consistentHash + properties: + consistentHash: + allOf: + - oneOf: + - not: + anyOf: + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - oneOf: + - not: + anyOf: + - required: + - ringHash + - required: + - maglev + - required: + - ringHash + - required: + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. + properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the cookie attribute. + type: string + required: + - name + type: object + type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name + type: object + httpHeaderName: + description: Hash based on a specific HTTP header. + type: string + httpQueryParameterName: + description: Hash based on a specific HTTP query parameter. + type: string + maglev: + description: The Maglev load balancer implements consistent hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev hashing. + minimum: 0 + type: integer + type: object + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer implements consistent hashing to backend hosts. + properties: + minimumRingSize: + description: The minimum number of virtual nodes to use for the hash ring. + minimum: 0 + type: integer + type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean + type: object + localityLbSetting: + properties: + distribute: + description: 'Optional: only one of distribute, failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating locality, '/' separated, e.g. + type: string + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities to traffic distribution weights. + type: object + type: object + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. + type: string + to: + description: Destination region the traffic will fail over to when endpoints in the 'from' region becomes unhealthy. + type: string + type: object + type: array + failoverPriority: + description: failoverPriority is an ordered list of labels used to sort endpoints to do priority based load balancing. + items: + type: string + type: array + type: object + simple: + description: |- + + + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST + type: string + warmup: + description: Represents the warmup configuration of Service. + properties: + aggression: + description: This parameter controls the speed of traffic increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: + properties: + baseEjectionTime: + description: Minimum ejection duration. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a host is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated failures before ejection occurs. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep analysis. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local origin failures from external errors. + type: boolean + type: object + port: + description: Specifies the number of a port on the destination service on which this policy is being applied. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + tls: + description: TLS related settings for connections to the upstream service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds the TLS certs for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.' + nullable: true + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. + + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server during TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject identity in the certificate. + items: + type: string + type: array + type: object + type: object + maxItems: 4096 + type: array + proxyProtocol: + description: The upstream PROXY protocol settings. + properties: + version: + description: |- + The PROXY protocol version to use. + + Valid Options: V1, V2 + enum: + - V1 + - V2 type: string type: object + retryBudget: + description: Specifies a limit on concurrent retries in relation to the number of active requests. + properties: + minRetryConcurrency: + description: Specifies the minimum retry concurrency allowed for the retry budget. + maximum: 4294967295 + minimum: 0 + type: integer + percent: + description: Specifies the limit on concurrent retries as a percentage of the sum of active requests and active pending requests. + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + type: object + tls: + description: TLS related settings for connections to the upstream service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds the TLS certs for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.' + nullable: true + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. + + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server during TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject identity in the certificate. + items: + type: string + type: array + type: object + tunnel: + description: Configuration of tunneling TCP over other transport or application layers for the host configured in the DestinationRule. + properties: + protocol: + description: Specifies which protocol to use for tunneling the downstream connection. + type: string + targetHost: + description: Specifies a host to which the downstream connection is tunneled. + type: string + targetPort: + description: Specifies a port to which the downstream connection is tunneled. + maximum: 4294967295 + minimum: 0 + type: integer + required: + - targetHost + - targetPort + type: object type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} + workloadSelector: + description: Criteria used to select the specific set of pods/VMs on which this `DestinationRule` configuration should be applied. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + required: + - host + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -6816,441 +6010,407 @@ spec: group: networking.istio.io names: categories: - - istio-io - - networking-istio-io + - istio-io + - networking-istio-io kind: EnvoyFilter listKind: EnvoyFilterList plural: envoyfilters singular: envoyfilter scope: Namespaced versions: - - name: v1alpha3 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Customizing Envoy configuration generated by Istio. See - more details at: https://istio.io/docs/reference/config/networking/envoy-filter.html' - properties: - configPatches: - description: One or more patches with match conditions. - items: - properties: - applyTo: - description: |- - Specifies where in the Envoy configuration, the patch should be applied. + - name: v1alpha3 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Customizing Envoy configuration generated by Istio. See more details at: https://istio.io/docs/reference/config/networking/envoy-filter.html' + properties: + configPatches: + description: One or more patches with match conditions. + items: + properties: + applyTo: + description: |- + Specifies where in the Envoy configuration, the patch should be applied. - Valid Options: LISTENER, FILTER_CHAIN, NETWORK_FILTER, HTTP_FILTER, ROUTE_CONFIGURATION, VIRTUAL_HOST, HTTP_ROUTE, CLUSTER, EXTENSION_CONFIG, BOOTSTRAP, LISTENER_FILTER - enum: - - INVALID - - LISTENER - - FILTER_CHAIN - - NETWORK_FILTER - - HTTP_FILTER - - ROUTE_CONFIGURATION - - VIRTUAL_HOST - - HTTP_ROUTE - - CLUSTER - - EXTENSION_CONFIG - - BOOTSTRAP - - LISTENER_FILTER - type: string - match: - description: Match on listener/route configuration/cluster. - oneOf: - - not: - anyOf: + Valid Options: LISTENER, FILTER_CHAIN, NETWORK_FILTER, HTTP_FILTER, ROUTE_CONFIGURATION, VIRTUAL_HOST, HTTP_ROUTE, CLUSTER, EXTENSION_CONFIG, BOOTSTRAP, LISTENER_FILTER + enum: + - INVALID + - LISTENER + - FILTER_CHAIN + - NETWORK_FILTER + - HTTP_FILTER + - ROUTE_CONFIGURATION + - VIRTUAL_HOST + - HTTP_ROUTE + - CLUSTER + - EXTENSION_CONFIG + - BOOTSTRAP + - LISTENER_FILTER + type: string + match: + description: Match on listener/route configuration/cluster. + oneOf: + - not: + anyOf: + - required: + - listener + - required: + - routeConfiguration + - required: + - cluster + - required: + - waypoint - required: - - listener + - listener - required: - - routeConfiguration + - routeConfiguration - required: - - cluster + - cluster - required: - - waypoint - - required: - - listener - - required: - - routeConfiguration - - required: - - cluster - - required: - - waypoint - properties: - cluster: - description: Match on envoy cluster attributes. - properties: - name: - description: The exact name of the cluster to match. - type: string - portNumber: - description: The service port for which this cluster - was generated. - maximum: 4294967295 - minimum: 0 - type: integer - service: - description: The fully qualified service name for this - cluster. - type: string - subset: - description: The subset associated with the service. - type: string - type: object - context: - description: |- - The specific config generation context to match on. + - waypoint + properties: + cluster: + description: Match on envoy cluster attributes. + properties: + name: + description: The exact name of the cluster to match. + type: string + portNumber: + description: The service port for which this cluster was generated. + maximum: 4294967295 + minimum: 0 + type: integer + service: + description: The fully qualified service name for this cluster. + type: string + subset: + description: The subset associated with the service. + type: string + type: object + context: + description: |- + The specific config generation context to match on. - Valid Options: ANY, SIDECAR_INBOUND, SIDECAR_OUTBOUND, GATEWAY, WAYPOINT - enum: - - ANY - - SIDECAR_INBOUND - - SIDECAR_OUTBOUND - - GATEWAY - - WAYPOINT - type: string - listener: - description: Match on envoy listener attributes. - properties: - filterChain: - description: Match a specific filter chain in a listener. - properties: - applicationProtocols: - description: Applies only to sidecars. - type: string - destinationPort: - description: The destination_port value used by - a filter chain's match condition. - maximum: 4294967295 - minimum: 0 - type: integer - filter: - description: The name of a specific filter to apply - the patch to. - properties: - name: - description: The filter name to match on. - type: string - subFilter: - description: The next level filter within this - filter to match upon. - properties: - name: - description: The filter name to match on. - type: string - type: object - type: object - name: - description: The name assigned to the filter chain. - type: string - sni: - description: The SNI value used by a filter chain's - match condition. - type: string - transportProtocol: - description: Applies only to `SIDECAR_INBOUND` context. - type: string - type: object - listenerFilter: - description: Match a specific listener filter. - type: string - name: - description: Match a specific listener by its name. - type: string - portName: - type: string - portNumber: - description: The service port/gateway port to which - traffic is being sent/received. - maximum: 4294967295 - minimum: 0 - type: integer - type: object - proxy: - description: Match on properties associated with a proxy. - properties: - metadata: - additionalProperties: + Valid Options: ANY, SIDECAR_INBOUND, SIDECAR_OUTBOUND, GATEWAY, WAYPOINT + enum: + - ANY + - SIDECAR_INBOUND + - SIDECAR_OUTBOUND + - GATEWAY + - WAYPOINT + type: string + listener: + description: Match on envoy listener attributes. + properties: + filterChain: + description: Match a specific filter chain in a listener. + properties: + applicationProtocols: + description: Applies only to sidecars. + type: string + destinationPort: + description: The destination_port value used by a filter chain's match condition. + maximum: 4294967295 + minimum: 0 + type: integer + filter: + description: The name of a specific filter to apply the patch to. + properties: + name: + description: The filter name to match on. + type: string + subFilter: + description: The next level filter within this filter to match upon. + properties: + name: + description: The filter name to match on. + type: string + type: object + type: object + name: + description: The name assigned to the filter chain. + type: string + sni: + description: The SNI value used by a filter chain's match condition. + type: string + transportProtocol: + description: Applies only to `SIDECAR_INBOUND` context. + type: string + type: object + listenerFilter: + description: Match a specific listener filter. type: string - description: Match on the node metadata supplied by - a proxy when connecting to istiod. - type: object - proxyVersion: - description: A regular expression in golang regex format - (RE2) that can be used to select proxies using a specific - version of istio proxy. - type: string - type: object - routeConfiguration: - description: Match on envoy HTTP route configuration attributes. - properties: - gateway: - description: The Istio gateway config's namespace/name - for which this route configuration was generated. - type: string - name: - description: Route configuration name to match on. - type: string - portName: - description: Applicable only for GATEWAY context. - type: string - portNumber: - description: The service port number or gateway server - port number for which this route configuration was - generated. - maximum: 4294967295 - minimum: 0 - type: integer - vhost: - description: Match a specific virtual host in a route - configuration and apply the patch to the virtual host. - properties: - domainName: - description: Match a domain name in a virtual host. - type: string - name: - description: The VirtualHosts objects generated - by Istio are named as host:port, where the host - typically corresponds to the VirtualService's - host field or the hostname of a service in the - registry. + name: + description: Match a specific listener by its name. + type: string + portName: + type: string + portNumber: + description: The service port/gateway port to which traffic is being sent/received. + maximum: 4294967295 + minimum: 0 + type: integer + type: object + proxy: + description: Match on properties associated with a proxy. + properties: + metadata: + additionalProperties: type: string - route: - description: Match a specific route within the virtual - host. - properties: - action: - description: |- - Match a route with specific action type. + description: Match on the node metadata supplied by a proxy when connecting to istiod. + type: object + proxyVersion: + description: A regular expression in golang regex format (RE2) that can be used to select proxies using a specific version of istio proxy. + type: string + type: object + routeConfiguration: + description: Match on envoy HTTP route configuration attributes. + properties: + gateway: + description: The Istio gateway config's namespace/name for which this route configuration was generated. + type: string + name: + description: Route configuration name to match on. + type: string + portName: + description: Applicable only for GATEWAY context. + type: string + portNumber: + description: The service port number or gateway server port number for which this route configuration was generated. + maximum: 4294967295 + minimum: 0 + type: integer + vhost: + description: Match a specific virtual host in a route configuration and apply the patch to the virtual host. + properties: + domainName: + description: Match a domain name in a virtual host. + type: string + name: + description: The VirtualHosts objects generated by Istio are named as host:port, where the host typically corresponds to the VirtualService's host field or the hostname of a service in the registry. + type: string + route: + description: Match a specific route within the virtual host. + properties: + action: + description: |- + Match a route with specific action type. - Valid Options: ANY, ROUTE, REDIRECT, DIRECT_RESPONSE - enum: - - ANY - - ROUTE - - REDIRECT - - DIRECT_RESPONSE - type: string - name: - description: The Route objects generated by - default are named as default. - type: string - type: object - type: object - type: object - waypoint: - properties: - filter: - description: The name of a specific filter to apply - the patch to. - properties: - name: - description: The filter name to match on. - type: string - subFilter: - description: The next level filter within this filter - to match on. - properties: - name: - description: The filter name to match on. - type: string - type: object - type: object - portNumber: - description: The service port to match on. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - route: - description: Match a specific route. - properties: - name: - description: The Route objects generated by default - are named as default. - type: string - type: object - type: object - type: object - x-kubernetes-validations: - - message: only support waypointMatch when context is WAYPOINT - rule: 'has(self.context) ? ((self.context == "WAYPOINT") ? - has(self.waypoint) : !has(self.waypoint)) : !has(self.waypoint)' - patch: - description: The patch to apply along with the operation. - properties: - filterClass: - description: |- - Determines the filter insertion order. + Valid Options: ANY, ROUTE, REDIRECT, DIRECT_RESPONSE + enum: + - ANY + - ROUTE + - REDIRECT + - DIRECT_RESPONSE + type: string + name: + description: The Route objects generated by default are named as default. + type: string + type: object + type: object + type: object + waypoint: + properties: + filter: + description: The name of a specific filter to apply the patch to. + properties: + name: + description: The filter name to match on. + type: string + subFilter: + description: The next level filter within this filter to match on. + properties: + name: + description: The filter name to match on. + type: string + type: object + type: object + portNumber: + description: The service port to match on. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + route: + description: Match a specific route. + properties: + name: + description: The Route objects generated by default are named as default. + type: string + type: object + type: object + type: object + x-kubernetes-validations: + - message: only support waypointMatch when context is WAYPOINT + rule: 'has(self.context) ? ((self.context == "WAYPOINT") ? has(self.waypoint) : !has(self.waypoint)) : !has(self.waypoint)' + patch: + description: The patch to apply along with the operation. + properties: + filterClass: + description: |- + Determines the filter insertion order. - Valid Options: AUTHN, AUTHZ, STATS - enum: - - UNSPECIFIED - - AUTHN - - AUTHZ - - STATS - type: string - operation: - description: |- - Determines how the patch should be applied. + Valid Options: AUTHN, AUTHZ, STATS + enum: + - UNSPECIFIED + - AUTHN + - AUTHZ + - STATS + type: string + operation: + description: |- + Determines how the patch should be applied. - Valid Options: MERGE, ADD, REMOVE, INSERT_BEFORE, INSERT_AFTER, INSERT_FIRST, REPLACE - enum: - - INVALID - - MERGE - - ADD - - REMOVE - - INSERT_BEFORE - - INSERT_AFTER - - INSERT_FIRST - - REPLACE - type: string - value: - description: The JSON config of the object being patched. - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - type: object - type: array - priority: - description: Priority defines the order in which patch sets are applied - within a context. - format: int32 - type: integer - targetRefs: - description: Optional. - items: - properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: name is the name of the target resource. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: namespace is the namespace of the referent. - type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 - required: - - kind - - name - type: object - maxItems: 16 - type: array - workloadSelector: - description: Criteria used to select the specific set of pods/VMs - on which this patch configuration should be applied. - properties: - labels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard is not supported in selector - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of - pods/VMs on which the configuration should be applied. - maxProperties: 256 + Valid Options: MERGE, ADD, REMOVE, INSERT_BEFORE, INSERT_AFTER, INSERT_FIRST, REPLACE + enum: + - INVALID + - MERGE + - ADD + - REMOVE + - INSERT_BEFORE + - INSERT_AFTER + - INSERT_FIRST + - REPLACE + type: string + value: + description: The JSON config of the object being patched. + type: object + x-kubernetes-preserve-unknown-fields: true + type: object type: object - type: object - type: object - x-kubernetes-validations: - - message: only one of targetRefs or workloadSelector can be set - rule: '(has(self.workloadSelector) ? 1 : 0) + (has(self.targetRefs) - ? 1 : 0) <= 1' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: + type: array + priority: + description: Priority defines the order in which patch sets are applied within a context. + format: int32 + type: integer + targetRefs: + description: Optional. + items: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name + type: object + maxItems: 16 + type: array + workloadSelector: + description: Criteria used to select the specific set of pods/VMs on which this patch configuration should be applied. properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. - - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string + labels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard is not supported in selector + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of pods/VMs on which the configuration should be applied. + maxProperties: 256 type: object type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} + type: object + x-kubernetes-validations: + - message: only one of targetRefs or workloadSelector can be set + rule: '(has(self.workloadSelector) ? 1 : 0) + (has(self.targetRefs) ? 1 : 0) <= 1' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -7268,841 +6428,751 @@ spec: group: networking.istio.io names: categories: - - istio-io - - networking-istio-io + - istio-io + - networking-istio-io kind: Gateway listKind: GatewayList plural: gateways shortNames: - - gw + - gw singular: gateway scope: Namespaced versions: - - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting edge load balancer. See more details - at: https://istio.io/docs/reference/config/networking/gateway.html' - properties: - selector: - additionalProperties: - type: string - description: One or more labels that indicate a specific set of pods/VMs - on which this gateway configuration should be applied. - type: object - servers: - description: A list of server specifications. - items: - properties: - bind: - description: The ip or the Unix domain socket to which the listener - should be bound to. - type: string - defaultEndpoint: - type: string - hosts: - description: One or more hosts exposed by this gateway. - items: + - name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting edge load balancer. See more details at: https://istio.io/docs/reference/config/networking/gateway.html' + properties: + selector: + additionalProperties: + type: string + description: One or more labels that indicate a specific set of pods/VMs on which this gateway configuration should be applied. + type: object + servers: + description: A list of server specifications. + items: + properties: + bind: + description: The ip or the Unix domain socket to which the listener should be bound to. type: string - type: array - name: - description: An optional name of the server, when set must be - unique across all servers. - type: string - port: - description: The Port on which the proxy should listen for incoming - connections. - properties: - name: - description: Label assigned to the port. - type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - protocol: - description: The protocol exposed on the port. - type: string - targetPort: - maximum: 4294967295 - minimum: 0 - type: integer - required: - - number - - protocol - - name - type: object - tls: - description: Set of TLS related options that govern the server's - behavior. - properties: - caCertCredentialName: - description: For mutual TLS, the name of the secret or the - configmap that holds CA certificates. - type: string - caCertificates: - description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing - the certificate revocation list (CRL) to use in verifying - a presented client side certificate.' + defaultEndpoint: + type: string + hosts: + description: One or more hosts exposed by this gateway. + items: type: string - cipherSuites: - description: 'Optional: If specified, only support the specified - cipher list.' - items: + type: array + name: + description: An optional name of the server, when set must be unique across all servers. + type: string + port: + description: The Port on which the proxy should listen for incoming connections. + properties: + name: + description: Label assigned to the port. type: string - type: array - credentialName: - description: For gateways running on Kubernetes, the name - of the secret that holds the TLS certs including the CA - certificates. - type: string - credentialNames: - description: Same as CredentialName but for multiple certificates. - items: + number: + description: A valid non-negative integer port number. + maximum: 4294967295 + minimum: 0 + type: integer + protocol: + description: The protocol exposed on the port. type: string - maxItems: 2 - minItems: 1 - type: array - httpsRedirect: - description: If set to true, the load balancer will send - a 301 redirect for all http connections, asking the clients - to use HTTPS. - type: boolean - maxProtocolVersion: - description: |- - Optional: Maximum TLS protocol version. - - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - minProtocolVersion: - description: |- - Optional: Minimum TLS protocol version. + targetPort: + maximum: 4294967295 + minimum: 0 + type: integer + required: + - number + - protocol + - name + type: object + tls: + description: Set of TLS related options that govern the server's behavior. + properties: + caCertCredentialName: + description: For mutual TLS, the name of the secret or the configmap that holds CA certificates. + type: string + caCertificates: + description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented client side certificate.' + type: string + cipherSuites: + description: 'Optional: If specified, only support the specified cipher list.' + items: + type: string + type: array + credentialName: + description: For gateways running on Kubernetes, the name of the secret that holds the TLS certs including the CA certificates. + type: string + credentialNames: + description: Same as CredentialName but for multiple certificates. + items: + type: string + maxItems: 2 + minItems: 1 + type: array + httpsRedirect: + description: If set to true, the load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS. + type: boolean + maxProtocolVersion: + description: |- + Optional: Maximum TLS protocol version. - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - mode: - description: |- - Optional: Indicates whether connections to this port should be secured using TLS. + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + minProtocolVersion: + description: |- + Optional: Minimum TLS protocol version. - Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL - enum: - - PASSTHROUGH - - SIMPLE - - MUTUAL - - AUTO_PASSTHROUGH - - ISTIO_MUTUAL - - OPTIONAL_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - subjectAltNames: - description: A list of alternate names to verify the subject - identity in the certificate presented by the client. - items: + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 type: string - type: array - tlsCertificates: - description: Only one of `server_certificate`, `private_key` - or `credential_name` or `credential_names` or `tls_certificates` - should be specified. - items: - properties: - caCertificates: - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - type: object - maxItems: 2 - minItems: 1 - type: array - verifyCertificateHash: - description: An optional list of hex-encoded SHA-256 hashes - of the authorized client certificates. - items: + mode: + description: |- + Optional: Indicates whether connections to this port should be secured using TLS. + + Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL + enum: + - PASSTHROUGH + - SIMPLE + - MUTUAL + - AUTO_PASSTHROUGH + - ISTIO_MUTUAL + - OPTIONAL_MUTUAL type: string - type: array - verifyCertificateSpki: - description: An optional list of base64-encoded SHA-256 - hashes of the SPKIs of authorized client certificates. - items: + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. type: string - type: array - type: object - x-kubernetes-validations: - - message: only one of credentialNames or tlsCertificates can - be set - rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) - ? 1 : 0) <= 1' - - message: only one of credentialName or credentialNames can - be set - rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) - ? 1 : 0) <= 1' - - message: only one of credentialName or tlsCertificates can - be set - rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) - ? 1 : 0) <= 1' - required: - - port - - hosts - type: object - type: array - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject identity in the certificate presented by the client. + items: + type: string + type: array + tlsCertificates: + description: Only one of `server_certificate`, `private_key` or `credential_name` or `credential_names` or `tls_certificates` should be specified. + items: + properties: + caCertificates: + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + type: object + maxItems: 2 + minItems: 1 + type: array + verifyCertificateHash: + description: An optional list of hex-encoded SHA-256 hashes of the authorized client certificates. + items: + type: string + type: array + verifyCertificateSpki: + description: An optional list of base64-encoded SHA-256 hashes of the SPKIs of authorized client certificates. + items: + type: string + type: array + type: object + x-kubernetes-validations: + - message: only one of credentialNames or tlsCertificates can be set + rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) ? 1 : 0) <= 1' + - message: only one of credentialName or credentialNames can be set + rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) ? 1 : 0) <= 1' + - message: only one of credentialName or tlsCertificates can be set + rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) ? 1 : 0) <= 1' + required: + - port + - hosts + type: object + type: array + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. + type: string + level: + description: |- + Represents how severe a message is. - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} + - name: v1alpha3 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting edge load balancer. See more details at: https://istio.io/docs/reference/config/networking/gateway.html' + properties: + selector: + additionalProperties: + type: string + description: One or more labels that indicate a specific set of pods/VMs on which this gateway configuration should be applied. type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} - - name: v1alpha3 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting edge load balancer. See more details - at: https://istio.io/docs/reference/config/networking/gateway.html' - properties: - selector: - additionalProperties: - type: string - description: One or more labels that indicate a specific set of pods/VMs - on which this gateway configuration should be applied. - type: object - servers: - description: A list of server specifications. - items: - properties: - bind: - description: The ip or the Unix domain socket to which the listener - should be bound to. - type: string - defaultEndpoint: - type: string - hosts: - description: One or more hosts exposed by this gateway. - items: + servers: + description: A list of server specifications. + items: + properties: + bind: + description: The ip or the Unix domain socket to which the listener should be bound to. type: string - type: array - name: - description: An optional name of the server, when set must be - unique across all servers. - type: string - port: - description: The Port on which the proxy should listen for incoming - connections. - properties: - name: - description: Label assigned to the port. - type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - protocol: - description: The protocol exposed on the port. - type: string - targetPort: - maximum: 4294967295 - minimum: 0 - type: integer - required: - - number - - protocol - - name - type: object - tls: - description: Set of TLS related options that govern the server's - behavior. - properties: - caCertCredentialName: - description: For mutual TLS, the name of the secret or the - configmap that holds CA certificates. - type: string - caCertificates: - description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing - the certificate revocation list (CRL) to use in verifying - a presented client side certificate.' + defaultEndpoint: + type: string + hosts: + description: One or more hosts exposed by this gateway. + items: type: string - cipherSuites: - description: 'Optional: If specified, only support the specified - cipher list.' - items: + type: array + name: + description: An optional name of the server, when set must be unique across all servers. + type: string + port: + description: The Port on which the proxy should listen for incoming connections. + properties: + name: + description: Label assigned to the port. type: string - type: array - credentialName: - description: For gateways running on Kubernetes, the name - of the secret that holds the TLS certs including the CA - certificates. - type: string - credentialNames: - description: Same as CredentialName but for multiple certificates. - items: + number: + description: A valid non-negative integer port number. + maximum: 4294967295 + minimum: 0 + type: integer + protocol: + description: The protocol exposed on the port. type: string - maxItems: 2 - minItems: 1 - type: array - httpsRedirect: - description: If set to true, the load balancer will send - a 301 redirect for all http connections, asking the clients - to use HTTPS. - type: boolean - maxProtocolVersion: - description: |- - Optional: Maximum TLS protocol version. + targetPort: + maximum: 4294967295 + minimum: 0 + type: integer + required: + - number + - protocol + - name + type: object + tls: + description: Set of TLS related options that govern the server's behavior. + properties: + caCertCredentialName: + description: For mutual TLS, the name of the secret or the configmap that holds CA certificates. + type: string + caCertificates: + description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented client side certificate.' + type: string + cipherSuites: + description: 'Optional: If specified, only support the specified cipher list.' + items: + type: string + type: array + credentialName: + description: For gateways running on Kubernetes, the name of the secret that holds the TLS certs including the CA certificates. + type: string + credentialNames: + description: Same as CredentialName but for multiple certificates. + items: + type: string + maxItems: 2 + minItems: 1 + type: array + httpsRedirect: + description: If set to true, the load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS. + type: boolean + maxProtocolVersion: + description: |- + Optional: Maximum TLS protocol version. - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - minProtocolVersion: - description: |- - Optional: Minimum TLS protocol version. + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + minProtocolVersion: + description: |- + Optional: Minimum TLS protocol version. - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - mode: - description: |- - Optional: Indicates whether connections to this port should be secured using TLS. + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + mode: + description: |- + Optional: Indicates whether connections to this port should be secured using TLS. - Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL - enum: - - PASSTHROUGH - - SIMPLE - - MUTUAL - - AUTO_PASSTHROUGH - - ISTIO_MUTUAL - - OPTIONAL_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - subjectAltNames: - description: A list of alternate names to verify the subject - identity in the certificate presented by the client. - items: + Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL + enum: + - PASSTHROUGH + - SIMPLE + - MUTUAL + - AUTO_PASSTHROUGH + - ISTIO_MUTUAL + - OPTIONAL_MUTUAL type: string - type: array - tlsCertificates: - description: Only one of `server_certificate`, `private_key` - or `credential_name` or `credential_names` or `tls_certificates` - should be specified. - items: - properties: - caCertificates: - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - type: object - maxItems: 2 - minItems: 1 - type: array - verifyCertificateHash: - description: An optional list of hex-encoded SHA-256 hashes - of the authorized client certificates. - items: + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. type: string - type: array - verifyCertificateSpki: - description: An optional list of base64-encoded SHA-256 - hashes of the SPKIs of authorized client certificates. - items: + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. type: string - type: array - type: object - x-kubernetes-validations: - - message: only one of credentialNames or tlsCertificates can - be set - rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) - ? 1 : 0) <= 1' - - message: only one of credentialName or credentialNames can - be set - rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) - ? 1 : 0) <= 1' - - message: only one of credentialName or tlsCertificates can - be set - rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) - ? 1 : 0) <= 1' - required: - - port - - hosts - type: object - type: array - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. + subjectAltNames: + description: A list of alternate names to verify the subject identity in the certificate presented by the client. + items: + type: string + type: array + tlsCertificates: + description: Only one of `server_certificate`, `private_key` or `credential_name` or `credential_names` or `tls_certificates` should be specified. + items: + properties: + caCertificates: + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + type: object + maxItems: 2 + minItems: 1 + type: array + verifyCertificateHash: + description: An optional list of hex-encoded SHA-256 hashes of the authorized client certificates. + items: + type: string + type: array + verifyCertificateSpki: + description: An optional list of base64-encoded SHA-256 hashes of the SPKIs of authorized client certificates. + items: + type: string + type: array + type: object + x-kubernetes-validations: + - message: only one of credentialNames or tlsCertificates can be set + rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) ? 1 : 0) <= 1' + - message: only one of credentialName or credentialNames can be set + rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) ? 1 : 0) <= 1' + - message: only one of credentialName or tlsCertificates can be set + rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) ? 1 : 0) <= 1' + required: + - port + - hosts + type: object + type: array + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. + type: string + level: + description: |- + Represents how severe a message is. - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} - - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting edge load balancer. See more details - at: https://istio.io/docs/reference/config/networking/gateway.html' - properties: - selector: - additionalProperties: - type: string - description: One or more labels that indicate a specific set of pods/VMs - on which this gateway configuration should be applied. - type: object - servers: - description: A list of server specifications. - items: - properties: - bind: - description: The ip or the Unix domain socket to which the listener - should be bound to. - type: string - defaultEndpoint: - type: string - hosts: - description: One or more hosts exposed by this gateway. - items: + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} + - name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting edge load balancer. See more details at: https://istio.io/docs/reference/config/networking/gateway.html' + properties: + selector: + additionalProperties: + type: string + description: One or more labels that indicate a specific set of pods/VMs on which this gateway configuration should be applied. + type: object + servers: + description: A list of server specifications. + items: + properties: + bind: + description: The ip or the Unix domain socket to which the listener should be bound to. type: string - type: array - name: - description: An optional name of the server, when set must be - unique across all servers. - type: string - port: - description: The Port on which the proxy should listen for incoming - connections. - properties: - name: - description: Label assigned to the port. - type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - protocol: - description: The protocol exposed on the port. - type: string - targetPort: - maximum: 4294967295 - minimum: 0 - type: integer - required: - - number - - protocol - - name - type: object - tls: - description: Set of TLS related options that govern the server's - behavior. - properties: - caCertCredentialName: - description: For mutual TLS, the name of the secret or the - configmap that holds CA certificates. - type: string - caCertificates: - description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing - the certificate revocation list (CRL) to use in verifying - a presented client side certificate.' + defaultEndpoint: + type: string + hosts: + description: One or more hosts exposed by this gateway. + items: type: string - cipherSuites: - description: 'Optional: If specified, only support the specified - cipher list.' - items: + type: array + name: + description: An optional name of the server, when set must be unique across all servers. + type: string + port: + description: The Port on which the proxy should listen for incoming connections. + properties: + name: + description: Label assigned to the port. type: string - type: array - credentialName: - description: For gateways running on Kubernetes, the name - of the secret that holds the TLS certs including the CA - certificates. - type: string - credentialNames: - description: Same as CredentialName but for multiple certificates. - items: + number: + description: A valid non-negative integer port number. + maximum: 4294967295 + minimum: 0 + type: integer + protocol: + description: The protocol exposed on the port. type: string - maxItems: 2 - minItems: 1 - type: array - httpsRedirect: - description: If set to true, the load balancer will send - a 301 redirect for all http connections, asking the clients - to use HTTPS. - type: boolean - maxProtocolVersion: - description: |- - Optional: Maximum TLS protocol version. + targetPort: + maximum: 4294967295 + minimum: 0 + type: integer + required: + - number + - protocol + - name + type: object + tls: + description: Set of TLS related options that govern the server's behavior. + properties: + caCertCredentialName: + description: For mutual TLS, the name of the secret or the configmap that holds CA certificates. + type: string + caCertificates: + description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented client side certificate.' + type: string + cipherSuites: + description: 'Optional: If specified, only support the specified cipher list.' + items: + type: string + type: array + credentialName: + description: For gateways running on Kubernetes, the name of the secret that holds the TLS certs including the CA certificates. + type: string + credentialNames: + description: Same as CredentialName but for multiple certificates. + items: + type: string + maxItems: 2 + minItems: 1 + type: array + httpsRedirect: + description: If set to true, the load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS. + type: boolean + maxProtocolVersion: + description: |- + Optional: Maximum TLS protocol version. - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - minProtocolVersion: - description: |- - Optional: Minimum TLS protocol version. + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + minProtocolVersion: + description: |- + Optional: Minimum TLS protocol version. - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - mode: - description: |- - Optional: Indicates whether connections to this port should be secured using TLS. + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + mode: + description: |- + Optional: Indicates whether connections to this port should be secured using TLS. - Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL - enum: - - PASSTHROUGH - - SIMPLE - - MUTUAL - - AUTO_PASSTHROUGH - - ISTIO_MUTUAL - - OPTIONAL_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - subjectAltNames: - description: A list of alternate names to verify the subject - identity in the certificate presented by the client. - items: + Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL + enum: + - PASSTHROUGH + - SIMPLE + - MUTUAL + - AUTO_PASSTHROUGH + - ISTIO_MUTUAL + - OPTIONAL_MUTUAL type: string - type: array - tlsCertificates: - description: Only one of `server_certificate`, `private_key` - or `credential_name` or `credential_names` or `tls_certificates` - should be specified. - items: - properties: - caCertificates: - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - type: object - maxItems: 2 - minItems: 1 - type: array - verifyCertificateHash: - description: An optional list of hex-encoded SHA-256 hashes - of the authorized client certificates. - items: + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. type: string - type: array - verifyCertificateSpki: - description: An optional list of base64-encoded SHA-256 - hashes of the SPKIs of authorized client certificates. - items: + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. type: string - type: array - type: object - x-kubernetes-validations: - - message: only one of credentialNames or tlsCertificates can - be set - rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) - ? 1 : 0) <= 1' - - message: only one of credentialName or credentialNames can - be set - rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) - ? 1 : 0) <= 1' - - message: only one of credentialName or tlsCertificates can - be set - rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) - ? 1 : 0) <= 1' - required: - - port - - hosts - type: object - type: array - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. + subjectAltNames: + description: A list of alternate names to verify the subject identity in the certificate presented by the client. + items: + type: string + type: array + tlsCertificates: + description: Only one of `server_certificate`, `private_key` or `credential_name` or `credential_names` or `tls_certificates` should be specified. + items: + properties: + caCertificates: + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + type: object + maxItems: 2 + minItems: 1 + type: array + verifyCertificateHash: + description: An optional list of hex-encoded SHA-256 hashes of the authorized client certificates. + items: + type: string + type: array + verifyCertificateSpki: + description: An optional list of base64-encoded SHA-256 hashes of the SPKIs of authorized client certificates. + items: + type: string + type: array + type: object + x-kubernetes-validations: + - message: only one of credentialNames or tlsCertificates can be set + rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) ? 1 : 0) <= 1' + - message: only one of credentialName or credentialNames can be set + rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) ? 1 : 0) <= 1' + - message: only one of credentialName or tlsCertificates can be set + rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) ? 1 : 0) <= 1' + required: + - port + - hosts + type: object + type: array + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. + type: string + level: + description: |- + Represents how severe a message is. - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -8120,54 +7190,34 @@ spec: group: security.istio.io names: categories: - - istio-io - - security-istio-io + - istio-io + - security-istio-io kind: PeerAuthentication listKind: PeerAuthenticationList plural: peerauthentications shortNames: - - pa + - pa singular: peerauthentication scope: Namespaced versions: - - additionalPrinterColumns: - - description: Defines the mTLS mode used for peer authentication. - jsonPath: .spec.mtls.mode - name: Mode - type: string - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is represented - in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for - lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Peer authentication configuration for workloads. See more - details at: https://istio.io/docs/reference/config/security/peer_authentication.html' - properties: - mtls: - description: Mutual TLS settings for workload. - properties: - mode: - description: |- - Defines the mTLS mode used for peer authentication. - - Valid Options: DISABLE, PERMISSIVE, STRICT - enum: - - UNSET - - DISABLE - - PERMISSIVE - - STRICT - type: string - type: object - portLevelMtls: - additionalProperties: + - additionalPrinterColumns: + - description: Defines the mTLS mode used for peer authentication. + jsonPath: .spec.mtls.mode + name: Mode + type: string + - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Peer authentication configuration for workloads. See more details at: https://istio.io/docs/reference/config/security/peer_authentication.html' + properties: + mtls: + description: Mutual TLS settings for workload. properties: mode: description: |- @@ -8175,162 +7225,149 @@ spec: Valid Options: DISABLE, PERMISSIVE, STRICT enum: - - UNSET - - DISABLE - - PERMISSIVE - - STRICT + - UNSET + - DISABLE + - PERMISSIVE + - STRICT type: string type: object - description: Port specific mutual TLS settings. - minProperties: 1 - type: object - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: self.all(key, 0 < int(key) && int(key) <= 65535) - selector: - description: The selector determines the workloads to apply the PeerAuthentication - on. - properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of - pods/VMs on which a policy should be applied. - maxProperties: 4096 + portLevelMtls: + additionalProperties: + properties: + mode: + description: |- + Defines the mTLS mode used for peer authentication. + + Valid Options: DISABLE, PERMISSIVE, STRICT + enum: + - UNSET + - DISABLE + - PERMISSIVE + - STRICT + type: string type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) - type: object - type: object - x-kubernetes-validations: - - message: portLevelMtls requires selector - rule: 'has(self.portLevelMtls) ? (((has(self.selector) && has(self.selector.matchLabels)) - ? self.selector.matchLabels : {}).size() > 0) : true' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string + description: Port specific mutual TLS settings. + minProperties: 1 type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: self.all(key, 0 < int(key) && int(key) <= 65535) + selector: + description: The selector determines the workloads to apply the PeerAuthentication on. properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. - - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied. + maxProperties: 4096 type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} - - additionalPrinterColumns: - - description: Defines the mTLS mode used for peer authentication. - jsonPath: .spec.mtls.mode - name: Mode - type: string - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is represented - in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for - lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Peer authentication configuration for workloads. See more - details at: https://istio.io/docs/reference/config/security/peer_authentication.html' - properties: - mtls: - description: Mutual TLS settings for workload. - properties: - mode: - description: |- - Defines the mTLS mode used for peer authentication. + type: object + x-kubernetes-validations: + - message: portLevelMtls requires selector + rule: 'has(self.portLevelMtls) ? (((has(self.selector) && has(self.selector.matchLabels)) ? self.selector.matchLabels : {}).size() > 0) : true' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. + type: string + level: + description: |- + Represents how severe a message is. - Valid Options: DISABLE, PERMISSIVE, STRICT - enum: - - UNSET - - DISABLE - - PERMISSIVE - - STRICT - type: string - type: object - portLevelMtls: - additionalProperties: + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - description: Defines the mTLS mode used for peer authentication. + jsonPath: .spec.mtls.mode + name: Mode + type: string + - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Peer authentication configuration for workloads. See more details at: https://istio.io/docs/reference/config/security/peer_authentication.html' + properties: + mtls: + description: Mutual TLS settings for workload. properties: mode: description: |- @@ -8338,124 +7375,131 @@ spec: Valid Options: DISABLE, PERMISSIVE, STRICT enum: - - UNSET - - DISABLE - - PERMISSIVE - - STRICT + - UNSET + - DISABLE + - PERMISSIVE + - STRICT type: string type: object - description: Port specific mutual TLS settings. - minProperties: 1 - type: object - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: self.all(key, 0 < int(key) && int(key) <= 65535) - selector: - description: The selector determines the workloads to apply the PeerAuthentication - on. - properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of - pods/VMs on which a policy should be applied. - maxProperties: 4096 + portLevelMtls: + additionalProperties: + properties: + mode: + description: |- + Defines the mTLS mode used for peer authentication. + + Valid Options: DISABLE, PERMISSIVE, STRICT + enum: + - UNSET + - DISABLE + - PERMISSIVE + - STRICT + type: string type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) - type: object - type: object - x-kubernetes-validations: - - message: portLevelMtls requires selector - rule: 'has(self.portLevelMtls) ? (((has(self.selector) && has(self.selector.matchLabels)) - ? self.selector.matchLabels : {}).size() > 0) : true' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string + description: Port specific mutual TLS settings. + minProperties: 1 type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: self.all(key, 0 < int(key) && int(key) <= 65535) + selector: + description: The selector determines the workloads to apply the PeerAuthentication on. properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + type: object + x-kubernetes-validations: + - message: portLevelMtls requires selector + rule: 'has(self.portLevelMtls) ? (((has(self.selector) && has(self.selector.matchLabels)) ? self.selector.matchLabels : {}).size() > 0) : true' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. + type: string + level: + description: |- + Represents how severe a message is. - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -8473,142 +7517,135 @@ spec: group: networking.istio.io names: categories: - - istio-io - - networking-istio-io + - istio-io + - networking-istio-io kind: ProxyConfig listKind: ProxyConfigList plural: proxyconfigs singular: proxyconfig scope: Namespaced versions: - - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Provides configuration for individual workloads. See more - details at: https://istio.io/docs/reference/config/networking/proxy-config.html' - properties: - concurrency: - description: The number of worker threads to run. - format: int32 - minimum: 0 - nullable: true - type: integer - environmentVariables: - additionalProperties: - maxLength: 2048 - type: string - description: Additional environment variables for the proxy. - type: object - image: - description: Specifies the details of the proxy image. - properties: - imageType: - description: The image type of the image. + - name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Provides configuration for individual workloads. See more details at: https://istio.io/docs/reference/config/networking/proxy-config.html' + properties: + concurrency: + description: The number of worker threads to run. + format: int32 + minimum: 0 + nullable: true + type: integer + environmentVariables: + additionalProperties: + maxLength: 2048 type: string - type: object - selector: - description: Optional. - properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of - pods/VMs on which a policy should be applied. - maxProperties: 4096 - type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) - type: object - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: + description: Additional environment variables for the proxy. + type: object + image: + description: Specifies the details of the proxy image. properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. + imageType: + description: The image type of the image. type: string type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: + selector: + description: Optional. properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. - - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied. + maxProperties: 4096 type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -8626,191 +7663,146 @@ spec: group: security.istio.io names: categories: - - istio-io - - security-istio-io + - istio-io + - security-istio-io kind: RequestAuthentication listKind: RequestAuthenticationList plural: requestauthentications shortNames: - - ra + - ra singular: requestauthentication scope: Namespaced versions: - - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Request authentication configuration for workloads. See - more details at: https://istio.io/docs/reference/config/security/request_authentication.html' - properties: - jwtRules: - description: Define the list of JWTs that can be validated at the - selected workloads' proxy. - items: - properties: - audiences: - description: The list of JWT [audiences](https://tools.ietf.org/html/rfc7519#section-4.1.3) - that are allowed to access. - items: + - name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Request authentication configuration for workloads. See more details at: https://istio.io/docs/reference/config/security/request_authentication.html' + properties: + jwtRules: + description: Define the list of JWTs that can be validated at the selected workloads' proxy. + items: + properties: + audiences: + description: The list of JWT [audiences](https://tools.ietf.org/html/rfc7519#section-4.1.3) that are allowed to access. + items: + minLength: 1 + type: string + type: array + forwardOriginalToken: + description: If set to true, the original token will be kept for the upstream request. + type: boolean + fromCookies: + description: List of cookie names from which JWT is expected. + items: + minLength: 1 + type: string + type: array + fromHeaders: + description: List of header locations from which JWT is expected. + items: + properties: + name: + description: The HTTP header name. + minLength: 1 + type: string + prefix: + description: The prefix that should be stripped before decoding the token. + type: string + required: + - name + type: object + type: array + fromParams: + description: List of query parameters from which JWT is expected. + items: + minLength: 1 + type: string + type: array + issuer: + description: Identifies the issuer that issued the JWT. minLength: 1 type: string - type: array - forwardOriginalToken: - description: If set to true, the original token will be kept - for the upstream request. - type: boolean - fromCookies: - description: List of cookie names from which JWT is expected. - items: - minLength: 1 + jwks: + description: JSON Web Key Set of public keys to validate signature of the JWT. type: string - type: array - fromHeaders: - description: List of header locations from which JWT is expected. - items: - properties: - name: - description: The HTTP header name. - minLength: 1 - type: string - prefix: - description: The prefix that should be stripped before - decoding the token. - type: string - required: - - name - type: object - type: array - fromParams: - description: List of query parameters from which JWT is expected. - items: + jwks_uri: + description: URL of the provider's public key set to validate signature of the JWT. + maxLength: 2048 minLength: 1 type: string - type: array - issuer: - description: Identifies the issuer that issued the JWT. - minLength: 1 - type: string - jwks: - description: JSON Web Key Set of public keys to validate signature - of the JWT. - type: string - jwksUri: - description: URL of the provider's public key set to validate - signature of the JWT. - maxLength: 2048 - minLength: 1 - type: string - x-kubernetes-validations: - - message: url must have scheme http:// or https:// - rule: url(self).getScheme() in ["http", "https"] - jwks_uri: - description: URL of the provider's public key set to validate - signature of the JWT. - maxLength: 2048 - minLength: 1 - type: string - x-kubernetes-validations: - - message: url must have scheme http:// or https:// - rule: url(self).getScheme() in ["http", "https"] - outputClaimToHeaders: - description: This field specifies a list of operations to copy - the claim to HTTP headers on a successfully verified token. - items: - properties: - claim: - description: The name of the claim to be copied from. - minLength: 1 - type: string - header: - description: The name of the header to be created. - minLength: 1 - pattern: ^[-_A-Za-z0-9]+$ - type: string - required: - - header - - claim - type: object - type: array - outputPayloadToHeader: - description: This field specifies the header name to output - a successfully verified JWT payload to the backend. - type: string - spaceDelimitedClaims: - description: List of JWT claim names that should be treated - as space-delimited strings. - items: + x-kubernetes-validations: + - message: url must have scheme http:// or https:// + rule: url(self).getScheme() in ["http", "https"] + jwksUri: + description: URL of the provider's public key set to validate signature of the JWT. + maxLength: 2048 minLength: 1 type: string - maxItems: 64 - type: array - timeout: - description: The maximum amount of time that the resolver, determined - by the PILOT_JWT_ENABLE_REMOTE_JWKS environment variable, - will spend waiting for the JWKS to be fetched. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - x-kubernetes-validations: - - message: only one of jwks or jwksUri can be set - rule: '(has(self.jwksUri) ? 1 : 0) + (has(self.jwks_uri) ? 1 : - 0) + (has(self.jwks) ? 1 : 0) <= 1' - maxItems: 4096 - type: array - selector: - description: Optional. - properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of - pods/VMs on which a policy should be applied. - maxProperties: 4096 + x-kubernetes-validations: + - message: url must have scheme http:// or https:// + rule: url(self).getScheme() in ["http", "https"] + outputClaimToHeaders: + description: This field specifies a list of operations to copy the claim to HTTP headers on a successfully verified token. + items: + properties: + claim: + description: The name of the claim to be copied from. + minLength: 1 + type: string + header: + description: The name of the header to be created. + minLength: 1 + pattern: ^[-_A-Za-z0-9]+$ + type: string + required: + - header + - claim + type: object + type: array + outputPayloadToHeader: + description: This field specifies the header name to output a successfully verified JWT payload to the backend. + type: string + spaceDelimitedClaims: + description: List of JWT claim names that should be treated as space-delimited strings. + items: + minLength: 1 + type: string + maxItems: 64 + type: array + timeout: + description: The maximum amount of time that the resolver, determined by the PILOT_JWT_ENABLE_REMOTE_JWKS environment variable, will spend waiting for the JWKS to be fetched. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') type: object x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) - type: object - targetRef: - properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: name is the name of the target resource. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: namespace is the namespace of the referent. - type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 - required: - - kind - - name - type: object - targetRefs: - description: Optional. - items: + - message: only one of jwks or jwksUri can be set + rule: '(has(self.jwksUri) ? 1 : 0) + (has(self.jwks_uri) ? 1 : 0) + (has(self.jwks) ? 1 : 0) <= 1' + maxItems: 4096 + type: array + selector: + description: Optional. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + targetRef: properties: group: description: group is the group of the target resource. @@ -8832,274 +7824,253 @@ spec: description: namespace is the namespace of the referent. type: string x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 required: - - kind - - name - type: object - maxItems: 16 - type: array - type: object - x-kubernetes-validations: - - message: only one of targetRefs or selector can be set - rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) - + (has(self.targetRefs) ? 1 : 0) <= 1' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. - - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object + - kind + - name type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} - - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Request authentication configuration for workloads. See - more details at: https://istio.io/docs/reference/config/security/request_authentication.html' - properties: - jwtRules: - description: Define the list of JWTs that can be validated at the - selected workloads' proxy. - items: - properties: - audiences: - description: The list of JWT [audiences](https://tools.ietf.org/html/rfc7519#section-4.1.3) - that are allowed to access. - items: - minLength: 1 + targetRefs: + description: Optional. + items: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string - type: array - forwardOriginalToken: - description: If set to true, the original token will be kept - for the upstream request. - type: boolean - fromCookies: - description: List of cookie names from which JWT is expected. - items: + kind: + description: kind is kind of the target resource. + maxLength: 63 minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string - type: array - fromHeaders: - description: List of header locations from which JWT is expected. - items: - properties: - name: - description: The HTTP header name. - minLength: 1 - type: string - prefix: - description: The prefix that should be stripped before - decoding the token. - type: string - required: - - name - type: object - type: array - fromParams: - description: List of query parameters from which JWT is expected. - items: + name: + description: name is the name of the target resource. + maxLength: 253 minLength: 1 type: string - type: array - issuer: - description: Identifies the issuer that issued the JWT. - minLength: 1 - type: string - jwks: - description: JSON Web Key Set of public keys to validate signature - of the JWT. - type: string - jwksUri: - description: URL of the provider's public key set to validate - signature of the JWT. - maxLength: 2048 - minLength: 1 - type: string - x-kubernetes-validations: - - message: url must have scheme http:// or https:// - rule: url(self).getScheme() in ["http", "https"] - jwks_uri: - description: URL of the provider's public key set to validate - signature of the JWT. - maxLength: 2048 - minLength: 1 - type: string - x-kubernetes-validations: - - message: url must have scheme http:// or https:// - rule: url(self).getScheme() in ["http", "https"] - outputClaimToHeaders: - description: This field specifies a list of operations to copy - the claim to HTTP headers on a successfully verified token. - items: + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name + type: object + maxItems: 16 + type: array + type: object + x-kubernetes-validations: + - message: only one of targetRefs or selector can be set + rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + (has(self.targetRefs) ? 1 : 0) <= 1' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: properties: - claim: - description: The name of the claim to be copied from. - minLength: 1 + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. type: string - header: - description: The name of the header to be created. - minLength: 1 - pattern: ^[-_A-Za-z0-9]+$ + name: + description: A human-readable name for the message type. type: string - required: - - header - - claim type: object - type: array - outputPayloadToHeader: - description: This field specifies the header name to output - a successfully verified JWT payload to the backend. - type: string - spaceDelimitedClaims: - description: List of JWT claim names that should be treated - as space-delimited strings. - items: + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} + - name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Request authentication configuration for workloads. See more details at: https://istio.io/docs/reference/config/security/request_authentication.html' + properties: + jwtRules: + description: Define the list of JWTs that can be validated at the selected workloads' proxy. + items: + properties: + audiences: + description: The list of JWT [audiences](https://tools.ietf.org/html/rfc7519#section-4.1.3) that are allowed to access. + items: + minLength: 1 + type: string + type: array + forwardOriginalToken: + description: If set to true, the original token will be kept for the upstream request. + type: boolean + fromCookies: + description: List of cookie names from which JWT is expected. + items: + minLength: 1 + type: string + type: array + fromHeaders: + description: List of header locations from which JWT is expected. + items: + properties: + name: + description: The HTTP header name. + minLength: 1 + type: string + prefix: + description: The prefix that should be stripped before decoding the token. + type: string + required: + - name + type: object + type: array + fromParams: + description: List of query parameters from which JWT is expected. + items: + minLength: 1 + type: string + type: array + issuer: + description: Identifies the issuer that issued the JWT. minLength: 1 type: string - maxItems: 64 - type: array - timeout: - description: The maximum amount of time that the resolver, determined - by the PILOT_JWT_ENABLE_REMOTE_JWKS environment variable, - will spend waiting for the JWKS to be fetched. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - x-kubernetes-validations: - - message: only one of jwks or jwksUri can be set - rule: '(has(self.jwksUri) ? 1 : 0) + (has(self.jwks_uri) ? 1 : - 0) + (has(self.jwks) ? 1 : 0) <= 1' - maxItems: 4096 - type: array - selector: - description: Optional. - properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of - pods/VMs on which a policy should be applied. - maxProperties: 4096 + jwks: + description: JSON Web Key Set of public keys to validate signature of the JWT. + type: string + jwks_uri: + description: URL of the provider's public key set to validate signature of the JWT. + maxLength: 2048 + minLength: 1 + type: string + x-kubernetes-validations: + - message: url must have scheme http:// or https:// + rule: url(self).getScheme() in ["http", "https"] + jwksUri: + description: URL of the provider's public key set to validate signature of the JWT. + maxLength: 2048 + minLength: 1 + type: string + x-kubernetes-validations: + - message: url must have scheme http:// or https:// + rule: url(self).getScheme() in ["http", "https"] + outputClaimToHeaders: + description: This field specifies a list of operations to copy the claim to HTTP headers on a successfully verified token. + items: + properties: + claim: + description: The name of the claim to be copied from. + minLength: 1 + type: string + header: + description: The name of the header to be created. + minLength: 1 + pattern: ^[-_A-Za-z0-9]+$ + type: string + required: + - header + - claim + type: object + type: array + outputPayloadToHeader: + description: This field specifies the header name to output a successfully verified JWT payload to the backend. + type: string + spaceDelimitedClaims: + description: List of JWT claim names that should be treated as space-delimited strings. + items: + minLength: 1 + type: string + maxItems: 64 + type: array + timeout: + description: The maximum amount of time that the resolver, determined by the PILOT_JWT_ENABLE_REMOTE_JWKS environment variable, will spend waiting for the JWKS to be fetched. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') type: object x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) - type: object - targetRef: - properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: name is the name of the target resource. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: namespace is the namespace of the referent. - type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 - required: - - kind - - name - type: object - targetRefs: - description: Optional. - items: + - message: only one of jwks or jwksUri can be set + rule: '(has(self.jwksUri) ? 1 : 0) + (has(self.jwks_uri) ? 1 : 0) + (has(self.jwks) ? 1 : 0) <= 1' + maxItems: 4096 + type: array + selector: + description: Optional. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + targetRef: properties: group: description: group is the group of the target resource. @@ -9121,99 +8092,123 @@ spec: description: namespace is the namespace of the referent. type: string x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 required: - - kind - - name - type: object - maxItems: 16 - type: array - type: object - x-kubernetes-validations: - - message: only one of targetRefs or selector can be set - rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) - + (has(self.targetRefs) ? 1 : 0) <= 1' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string + - kind + - name type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. + targetRefs: + description: Optional. + items: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name + type: object + maxItems: 16 + type: array + type: object + x-kubernetes-validations: + - message: only one of targetRefs or selector can be set + rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + (has(self.targetRefs) ? 1 : 0) <= 1' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. + type: string + level: + description: |- + Represents how severe a message is. - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -9231,913 +8226,835 @@ spec: group: networking.istio.io names: categories: - - istio-io - - networking-istio-io + - istio-io + - networking-istio-io kind: ServiceEntry listKind: ServiceEntryList plural: serviceentries shortNames: - - se + - se singular: serviceentry scope: Namespaced versions: - - additionalPrinterColumns: - - description: The hosts associated with the ServiceEntry - jsonPath: .spec.hosts - name: Hosts - type: string - - description: Whether the service is external to the mesh or part of the mesh - (MESH_EXTERNAL or MESH_INTERNAL) - jsonPath: .spec.location - name: Location - type: string - - description: Service resolution mode for the hosts (NONE, STATIC, or DNS) - jsonPath: .spec.resolution - name: Resolution - type: string - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is represented - in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for - lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting service registry. See more details - at: https://istio.io/docs/reference/config/networking/service-entry.html' - properties: - addresses: - description: The virtual IP addresses associated with the service. - items: - maxLength: 64 + - additionalPrinterColumns: + - description: The hosts associated with the ServiceEntry + jsonPath: .spec.hosts + name: Hosts + type: string + - description: Whether the service is external to the mesh or part of the mesh (MESH_EXTERNAL or MESH_INTERNAL) + jsonPath: .spec.location + name: Location + type: string + - description: Service resolution mode for the hosts (NONE, STATIC, or DNS) + jsonPath: .spec.resolution + name: Resolution + type: string + - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting service registry. See more details at: https://istio.io/docs/reference/config/networking/service-entry.html' + properties: + addresses: + description: The virtual IP addresses associated with the service. + items: + maxLength: 64 + type: string + maxItems: 256 + type: array + endpoints: + description: One or more endpoints associated with the service. + items: + properties: + address: + description: Address associated with the network endpoint without the port. + maxLength: 256 + type: string + x-kubernetes-validations: + - message: UDS must be an absolute path or abstract socket + rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" || self.substring(7, 8) == "@") : true' + - message: UDS may not be a dir + rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' + labels: + additionalProperties: + type: string + description: One or more labels associated with the endpoint. + maxProperties: 256 + type: object + locality: + description: The locality associated with the endpoint. + maxLength: 2048 + type: string + network: + description: Network enables Istio to group endpoints resident in the same L3 domain/network. + maxLength: 2048 + type: string + ports: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + description: Set of ports associated with the endpoint. + maxProperties: 128 + type: object + x-kubernetes-validations: + - message: port name must be valid + rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) + serviceAccount: + description: The service account associated with the workload if a sidecar is present in the workload. + maxLength: 253 + type: string + weight: + description: The load balancing weight associated with the endpoint. + maximum: 4294967295 + minimum: 0 + type: integer + type: object + x-kubernetes-validations: + - message: Address is required + rule: has(self.address) || has(self.network) + - message: UDS may not include ports + rule: '(has(self.address) ? self.address : "").startsWith("unix://") ? !has(self.ports) : true' + maxItems: 4096 + type: array + exportTo: + description: A list of namespaces to which this service is exported. + items: + type: string + type: array + hosts: + description: The hosts associated with the ServiceEntry. + items: + type: string + x-kubernetes-validations: + - message: hostname cannot be wildcard + rule: self != "*" + maxItems: 256 + minItems: 1 + type: array + location: + description: |- + Specify whether the service should be considered external to the mesh or part of the mesh. + + Valid Options: MESH_EXTERNAL, MESH_INTERNAL + enum: + - MESH_EXTERNAL + - MESH_INTERNAL type: string - maxItems: 256 - type: array - endpoints: - description: One or more endpoints associated with the service. - items: - properties: - address: - description: Address associated with the network endpoint without - the port. - maxLength: 256 - type: string - x-kubernetes-validations: - - message: UDS must be an absolute path or abstract socket - rule: 'self.startsWith("unix://") ? (self.substring(7, 8) - == "/" || self.substring(7, 8) == "@") : true' - - message: UDS may not be a dir - rule: 'self.startsWith("unix://") ? !self.endsWith("/") : - true' - labels: - additionalProperties: + ports: + description: The ports associated with the external service. + items: + properties: + name: + description: Label assigned to the port. + maxLength: 256 type: string - description: One or more labels associated with the endpoint. - maxProperties: 256 - type: object - locality: - description: The locality associated with the endpoint. - maxLength: 2048 - type: string - network: - description: Network enables Istio to group endpoints resident - in the same L3 domain/network. - maxLength: 2048 - type: string - ports: - additionalProperties: + number: + description: A valid non-negative integer port number. maximum: 4294967295 minimum: 0 type: integer x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - description: Set of ports associated with the endpoint. - maxProperties: 128 - type: object - x-kubernetes-validations: - - message: port name must be valid - rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) - serviceAccount: - description: The service account associated with the workload - if a sidecar is present in the workload. - maxLength: 253 - type: string - weight: - description: The load balancing weight associated with the endpoint. - maximum: 4294967295 - minimum: 0 - type: integer - type: object - x-kubernetes-validations: - - message: Address is required - rule: has(self.address) || has(self.network) - - message: UDS may not include ports - rule: '(has(self.address) ? self.address : "").startsWith("unix://") - ? !has(self.ports) : true' - maxItems: 4096 - type: array - exportTo: - description: A list of namespaces to which this service is exported. - items: - type: string - type: array - hosts: - description: The hosts associated with the ServiceEntry. - items: - type: string + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + protocol: + description: The protocol exposed on the port. + maxLength: 256 + type: string + targetPort: + description: The port number on the endpoint where the traffic will be received. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + required: + - number + - name + type: object + maxItems: 256 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map x-kubernetes-validations: - - message: hostname cannot be wildcard - rule: self != "*" - maxItems: 256 - minItems: 1 - type: array - location: - description: |- - Specify whether the service should be considered external to the mesh or part of the mesh. + - message: port number cannot be duplicated + rule: self.all(l1, self.exists_one(l2, l1.number == l2.number)) + resolution: + description: |- + Service resolution mode for the hosts. - Valid Options: MESH_EXTERNAL, MESH_INTERNAL - enum: - - MESH_EXTERNAL - - MESH_INTERNAL - type: string - ports: - description: The ports associated with the external service. - items: + Valid Options: NONE, STATIC, DNS, DNS_ROUND_ROBIN, DYNAMIC_DNS + enum: + - NONE + - STATIC + - DNS + - DNS_ROUND_ROBIN + - DYNAMIC_DNS + type: string + subjectAltNames: + description: If specified, the proxy will verify that the server certificate's subject alternate name matches one of the specified values. + items: + type: string + type: array + workloadSelector: + description: Applicable only for MESH_INTERNAL services. properties: - name: - description: Label assigned to the port. - maxLength: 256 - type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - protocol: - description: The protocol exposed on the port. - maxLength: 256 - type: string - targetPort: - description: The port number on the endpoint where the traffic - will be received. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - required: - - number - - name + labels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard is not supported in selector + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of pods/VMs on which the configuration should be applied. + maxProperties: 256 + type: object type: object - maxItems: 256 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - x-kubernetes-validations: - - message: port number cannot be duplicated - rule: self.all(l1, self.exists_one(l2, l1.number == l2.number)) - resolution: - description: |- - Service resolution mode for the hosts. + required: + - hosts + type: object + x-kubernetes-validations: + - message: only one of WorkloadSelector or Endpoints can be set + rule: '(has(self.workloadSelector) ? 1 : 0) + (has(self.endpoints) ? 1 : 0) <= 1' + - message: CIDR addresses are allowed only for NONE/STATIC resolution types + rule: '!((has(self.addresses) ? self.addresses : []).exists(k, k.contains("/")) && !((has(self.resolution) ? self.resolution : "NONE") in ["STATIC", "NONE"]))' + - message: NONE mode cannot set endpoints + rule: '((has(self.resolution) ? self.resolution : "NONE") == "NONE") ? !has(self.endpoints) : true' + - message: DNS_ROUND_ROBIN mode cannot have multiple endpoints + rule: '((has(self.resolution) ? self.resolution : "") == "DNS_ROUND_ROBIN") ? ((has(self.endpoints) ? self.endpoints : []).size() <= 1) : true' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. + type: string + level: + description: |- + Represents how severe a message is. - Valid Options: NONE, STATIC, DNS, DNS_ROUND_ROBIN, DYNAMIC_DNS - enum: - - NONE - - STATIC - - DNS - - DNS_ROUND_ROBIN - - DYNAMIC_DNS - type: string - subjectAltNames: - description: If specified, the proxy will verify that the server certificate's - subject alternate name matches one of the specified values. - items: - type: string - type: array - workloadSelector: - description: Applicable only for MESH_INTERNAL services. - properties: - labels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard is not supported in selector - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of - pods/VMs on which the configuration should be applied. - maxProperties: 256 + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object type: object - type: object - required: - - hosts - type: object - x-kubernetes-validations: - - message: only one of WorkloadSelector or Endpoints can be set - rule: '(has(self.workloadSelector) ? 1 : 0) + (has(self.endpoints) ? - 1 : 0) <= 1' - - message: CIDR addresses are allowed only for NONE/STATIC resolution - types - rule: '!((has(self.addresses) ? self.addresses : []).exists(k, k.contains("/")) - && !((has(self.resolution) ? self.resolution : "NONE") in ["STATIC", - "NONE"]))' - - message: NONE mode cannot set endpoints - rule: '((has(self.resolution) ? self.resolution : "NONE") == "NONE") - ? !has(self.endpoints) : true' - - message: DNS_ROUND_ROBIN mode cannot have multiple endpoints - rule: '((has(self.resolution) ? self.resolution : "") == "DNS_ROUND_ROBIN") - ? ((has(self.endpoints) ? self.endpoints : []).size() <= 1) : true' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - description: The hosts associated with the ServiceEntry + jsonPath: .spec.hosts + name: Hosts + type: string + - description: Whether the service is external to the mesh or part of the mesh (MESH_EXTERNAL or MESH_INTERNAL) + jsonPath: .spec.location + name: Location + type: string + - description: Service resolution mode for the hosts (NONE, STATIC, or DNS) + jsonPath: .spec.resolution + name: Resolution + type: string + - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha3 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting service registry. See more details at: https://istio.io/docs/reference/config/networking/service-entry.html' + properties: + addresses: + description: The virtual IP addresses associated with the service. + items: + maxLength: 64 + type: string + maxItems: 256 + type: array + endpoints: + description: One or more endpoints associated with the service. + items: + properties: + address: + description: Address associated with the network endpoint without the port. + maxLength: 256 + type: string + x-kubernetes-validations: + - message: UDS must be an absolute path or abstract socket + rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" || self.substring(7, 8) == "@") : true' + - message: UDS may not be a dir + rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' + labels: + additionalProperties: + type: string + description: One or more labels associated with the endpoint. + maxProperties: 256 + type: object + locality: + description: The locality associated with the endpoint. + maxLength: 2048 + type: string + network: + description: Network enables Istio to group endpoints resident in the same L3 domain/network. + maxLength: 2048 + type: string + ports: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + description: Set of ports associated with the endpoint. + maxProperties: 128 + type: object + x-kubernetes-validations: + - message: port name must be valid + rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) + serviceAccount: + description: The service account associated with the workload if a sidecar is present in the workload. + maxLength: 253 + type: string + weight: + description: The load balancing weight associated with the endpoint. + maximum: 4294967295 + minimum: 0 + type: integer + type: object + x-kubernetes-validations: + - message: Address is required + rule: has(self.address) || has(self.network) + - message: UDS may not include ports + rule: '(has(self.address) ? self.address : "").startsWith("unix://") ? !has(self.ports) : true' + maxItems: 4096 + type: array + exportTo: + description: A list of namespaces to which this service is exported. + items: + type: string + type: array + hosts: + description: The hosts associated with the ServiceEntry. + items: + type: string + x-kubernetes-validations: + - message: hostname cannot be wildcard + rule: self != "*" + maxItems: 256 + minItems: 1 + type: array + location: + description: |- + Specify whether the service should be considered external to the mesh or part of the mesh. - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} - - additionalPrinterColumns: - - description: The hosts associated with the ServiceEntry - jsonPath: .spec.hosts - name: Hosts - type: string - - description: Whether the service is external to the mesh or part of the mesh - (MESH_EXTERNAL or MESH_INTERNAL) - jsonPath: .spec.location - name: Location - type: string - - description: Service resolution mode for the hosts (NONE, STATIC, or DNS) - jsonPath: .spec.resolution - name: Resolution - type: string - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is represented - in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for - lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1alpha3 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting service registry. See more details - at: https://istio.io/docs/reference/config/networking/service-entry.html' - properties: - addresses: - description: The virtual IP addresses associated with the service. - items: - maxLength: 64 + Valid Options: MESH_EXTERNAL, MESH_INTERNAL + enum: + - MESH_EXTERNAL + - MESH_INTERNAL type: string - maxItems: 256 - type: array - endpoints: - description: One or more endpoints associated with the service. - items: - properties: - address: - description: Address associated with the network endpoint without - the port. - maxLength: 256 - type: string - x-kubernetes-validations: - - message: UDS must be an absolute path or abstract socket - rule: 'self.startsWith("unix://") ? (self.substring(7, 8) - == "/" || self.substring(7, 8) == "@") : true' - - message: UDS may not be a dir - rule: 'self.startsWith("unix://") ? !self.endsWith("/") : - true' - labels: - additionalProperties: + ports: + description: The ports associated with the external service. + items: + properties: + name: + description: Label assigned to the port. + maxLength: 256 type: string - description: One or more labels associated with the endpoint. - maxProperties: 256 - type: object - locality: - description: The locality associated with the endpoint. - maxLength: 2048 - type: string - network: - description: Network enables Istio to group endpoints resident - in the same L3 domain/network. - maxLength: 2048 - type: string - ports: - additionalProperties: + number: + description: A valid non-negative integer port number. maximum: 4294967295 minimum: 0 type: integer x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - description: Set of ports associated with the endpoint. - maxProperties: 128 - type: object - x-kubernetes-validations: - - message: port name must be valid - rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) - serviceAccount: - description: The service account associated with the workload - if a sidecar is present in the workload. - maxLength: 253 - type: string - weight: - description: The load balancing weight associated with the endpoint. - maximum: 4294967295 - minimum: 0 - type: integer - type: object - x-kubernetes-validations: - - message: Address is required - rule: has(self.address) || has(self.network) - - message: UDS may not include ports - rule: '(has(self.address) ? self.address : "").startsWith("unix://") - ? !has(self.ports) : true' - maxItems: 4096 - type: array - exportTo: - description: A list of namespaces to which this service is exported. - items: - type: string - type: array - hosts: - description: The hosts associated with the ServiceEntry. - items: - type: string - x-kubernetes-validations: - - message: hostname cannot be wildcard - rule: self != "*" - maxItems: 256 - minItems: 1 - type: array - location: - description: |- - Specify whether the service should be considered external to the mesh or part of the mesh. - - Valid Options: MESH_EXTERNAL, MESH_INTERNAL - enum: - - MESH_EXTERNAL - - MESH_INTERNAL - type: string - ports: - description: The ports associated with the external service. - items: - properties: - name: - description: Label assigned to the port. - maxLength: 256 - type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - protocol: - description: The protocol exposed on the port. - maxLength: 256 - type: string - targetPort: - description: The port number on the endpoint where the traffic - will be received. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - required: - - number - - name - type: object - maxItems: 256 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - x-kubernetes-validations: - - message: port number cannot be duplicated - rule: self.all(l1, self.exists_one(l2, l1.number == l2.number)) - resolution: - description: |- - Service resolution mode for the hosts. - - Valid Options: NONE, STATIC, DNS, DNS_ROUND_ROBIN, DYNAMIC_DNS - enum: - - NONE - - STATIC - - DNS - - DNS_ROUND_ROBIN - - DYNAMIC_DNS - type: string - subjectAltNames: - description: If specified, the proxy will verify that the server certificate's - subject alternate name matches one of the specified values. - items: - type: string - type: array - workloadSelector: - description: Applicable only for MESH_INTERNAL services. - properties: - labels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard is not supported in selector - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of - pods/VMs on which the configuration should be applied. - maxProperties: 256 + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + protocol: + description: The protocol exposed on the port. + maxLength: 256 + type: string + targetPort: + description: The port number on the endpoint where the traffic will be received. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + required: + - number + - name type: object - type: object - required: - - hosts - type: object - x-kubernetes-validations: - - message: only one of WorkloadSelector or Endpoints can be set - rule: '(has(self.workloadSelector) ? 1 : 0) + (has(self.endpoints) ? - 1 : 0) <= 1' - - message: CIDR addresses are allowed only for NONE/STATIC resolution - types - rule: '!((has(self.addresses) ? self.addresses : []).exists(k, k.contains("/")) - && !((has(self.resolution) ? self.resolution : "NONE") in ["STATIC", - "NONE"]))' - - message: NONE mode cannot set endpoints - rule: '((has(self.resolution) ? self.resolution : "NONE") == "NONE") - ? !has(self.endpoints) : true' - - message: DNS_ROUND_ROBIN mode cannot have multiple endpoints - rule: '((has(self.resolution) ? self.resolution : "") == "DNS_ROUND_ROBIN") - ? ((has(self.endpoints) ? self.endpoints : []).size() <= 1) : true' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. + maxItems: 256 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + x-kubernetes-validations: + - message: port number cannot be duplicated + rule: self.all(l1, self.exists_one(l2, l1.number == l2.number)) + resolution: + description: |- + Service resolution mode for the hosts. - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: false - subresources: - status: {} - - additionalPrinterColumns: - - description: The hosts associated with the ServiceEntry - jsonPath: .spec.hosts - name: Hosts - type: string - - description: Whether the service is external to the mesh or part of the mesh - (MESH_EXTERNAL or MESH_INTERNAL) - jsonPath: .spec.location - name: Location - type: string - - description: Service resolution mode for the hosts (NONE, STATIC, or DNS) - jsonPath: .spec.resolution - name: Resolution - type: string - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is represented - in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for - lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting service registry. See more details - at: https://istio.io/docs/reference/config/networking/service-entry.html' - properties: - addresses: - description: The virtual IP addresses associated with the service. - items: - maxLength: 64 + Valid Options: NONE, STATIC, DNS, DNS_ROUND_ROBIN, DYNAMIC_DNS + enum: + - NONE + - STATIC + - DNS + - DNS_ROUND_ROBIN + - DYNAMIC_DNS type: string - maxItems: 256 - type: array - endpoints: - description: One or more endpoints associated with the service. - items: + subjectAltNames: + description: If specified, the proxy will verify that the server certificate's subject alternate name matches one of the specified values. + items: + type: string + type: array + workloadSelector: + description: Applicable only for MESH_INTERNAL services. properties: - address: - description: Address associated with the network endpoint without - the port. - maxLength: 256 - type: string - x-kubernetes-validations: - - message: UDS must be an absolute path or abstract socket - rule: 'self.startsWith("unix://") ? (self.substring(7, 8) - == "/" || self.substring(7, 8) == "@") : true' - - message: UDS may not be a dir - rule: 'self.startsWith("unix://") ? !self.endsWith("/") : - true' labels: additionalProperties: + maxLength: 63 type: string - description: One or more labels associated with the endpoint. + x-kubernetes-validations: + - message: wildcard is not supported in selector + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of pods/VMs on which the configuration should be applied. maxProperties: 256 type: object - locality: - description: The locality associated with the endpoint. - maxLength: 2048 - type: string - network: - description: Network enables Istio to group endpoints resident - in the same L3 domain/network. - maxLength: 2048 - type: string - ports: - additionalProperties: + type: object + required: + - hosts + type: object + x-kubernetes-validations: + - message: only one of WorkloadSelector or Endpoints can be set + rule: '(has(self.workloadSelector) ? 1 : 0) + (has(self.endpoints) ? 1 : 0) <= 1' + - message: CIDR addresses are allowed only for NONE/STATIC resolution types + rule: '!((has(self.addresses) ? self.addresses : []).exists(k, k.contains("/")) && !((has(self.resolution) ? self.resolution : "NONE") in ["STATIC", "NONE"]))' + - message: NONE mode cannot set endpoints + rule: '((has(self.resolution) ? self.resolution : "NONE") == "NONE") ? !has(self.endpoints) : true' + - message: DNS_ROUND_ROBIN mode cannot have multiple endpoints + rule: '((has(self.resolution) ? self.resolution : "") == "DNS_ROUND_ROBIN") ? ((has(self.endpoints) ? self.endpoints : []).size() <= 1) : true' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - description: The hosts associated with the ServiceEntry + jsonPath: .spec.hosts + name: Hosts + type: string + - description: Whether the service is external to the mesh or part of the mesh (MESH_EXTERNAL or MESH_INTERNAL) + jsonPath: .spec.location + name: Location + type: string + - description: Service resolution mode for the hosts (NONE, STATIC, or DNS) + jsonPath: .spec.resolution + name: Resolution + type: string + - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting service registry. See more details at: https://istio.io/docs/reference/config/networking/service-entry.html' + properties: + addresses: + description: The virtual IP addresses associated with the service. + items: + maxLength: 64 + type: string + maxItems: 256 + type: array + endpoints: + description: One or more endpoints associated with the service. + items: + properties: + address: + description: Address associated with the network endpoint without the port. + maxLength: 256 + type: string + x-kubernetes-validations: + - message: UDS must be an absolute path or abstract socket + rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" || self.substring(7, 8) == "@") : true' + - message: UDS may not be a dir + rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' + labels: + additionalProperties: + type: string + description: One or more labels associated with the endpoint. + maxProperties: 256 + type: object + locality: + description: The locality associated with the endpoint. + maxLength: 2048 + type: string + network: + description: Network enables Istio to group endpoints resident in the same L3 domain/network. + maxLength: 2048 + type: string + ports: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + description: Set of ports associated with the endpoint. + maxProperties: 128 + type: object + x-kubernetes-validations: + - message: port name must be valid + rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) + serviceAccount: + description: The service account associated with the workload if a sidecar is present in the workload. + maxLength: 253 + type: string + weight: + description: The load balancing weight associated with the endpoint. maximum: 4294967295 minimum: 0 type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - description: Set of ports associated with the endpoint. - maxProperties: 128 - type: object - x-kubernetes-validations: - - message: port name must be valid - rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) - serviceAccount: - description: The service account associated with the workload - if a sidecar is present in the workload. - maxLength: 253 - type: string - weight: - description: The load balancing weight associated with the endpoint. - maximum: 4294967295 - minimum: 0 - type: integer - type: object - x-kubernetes-validations: - - message: Address is required - rule: has(self.address) || has(self.network) - - message: UDS may not include ports - rule: '(has(self.address) ? self.address : "").startsWith("unix://") - ? !has(self.ports) : true' - maxItems: 4096 - type: array - exportTo: - description: A list of namespaces to which this service is exported. - items: - type: string - type: array - hosts: - description: The hosts associated with the ServiceEntry. - items: + type: object + x-kubernetes-validations: + - message: Address is required + rule: has(self.address) || has(self.network) + - message: UDS may not include ports + rule: '(has(self.address) ? self.address : "").startsWith("unix://") ? !has(self.ports) : true' + maxItems: 4096 + type: array + exportTo: + description: A list of namespaces to which this service is exported. + items: + type: string + type: array + hosts: + description: The hosts associated with the ServiceEntry. + items: + type: string + x-kubernetes-validations: + - message: hostname cannot be wildcard + rule: self != "*" + maxItems: 256 + minItems: 1 + type: array + location: + description: |- + Specify whether the service should be considered external to the mesh or part of the mesh. + + Valid Options: MESH_EXTERNAL, MESH_INTERNAL + enum: + - MESH_EXTERNAL + - MESH_INTERNAL type: string + ports: + description: The ports associated with the external service. + items: + properties: + name: + description: Label assigned to the port. + maxLength: 256 + type: string + number: + description: A valid non-negative integer port number. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + protocol: + description: The protocol exposed on the port. + maxLength: 256 + type: string + targetPort: + description: The port number on the endpoint where the traffic will be received. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + required: + - number + - name + type: object + maxItems: 256 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map x-kubernetes-validations: - - message: hostname cannot be wildcard - rule: self != "*" - maxItems: 256 - minItems: 1 - type: array - location: - description: |- - Specify whether the service should be considered external to the mesh or part of the mesh. - - Valid Options: MESH_EXTERNAL, MESH_INTERNAL - enum: - - MESH_EXTERNAL - - MESH_INTERNAL - type: string - ports: - description: The ports associated with the external service. - items: - properties: - name: - description: Label assigned to the port. - maxLength: 256 - type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - protocol: - description: The protocol exposed on the port. - maxLength: 256 - type: string - targetPort: - description: The port number on the endpoint where the traffic - will be received. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - required: - - number - - name - type: object - maxItems: 256 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - x-kubernetes-validations: - - message: port number cannot be duplicated - rule: self.all(l1, self.exists_one(l2, l1.number == l2.number)) - resolution: - description: |- - Service resolution mode for the hosts. + - message: port number cannot be duplicated + rule: self.all(l1, self.exists_one(l2, l1.number == l2.number)) + resolution: + description: |- + Service resolution mode for the hosts. - Valid Options: NONE, STATIC, DNS, DNS_ROUND_ROBIN, DYNAMIC_DNS - enum: - - NONE - - STATIC - - DNS - - DNS_ROUND_ROBIN - - DYNAMIC_DNS - type: string - subjectAltNames: - description: If specified, the proxy will verify that the server certificate's - subject alternate name matches one of the specified values. - items: + Valid Options: NONE, STATIC, DNS, DNS_ROUND_ROBIN, DYNAMIC_DNS + enum: + - NONE + - STATIC + - DNS + - DNS_ROUND_ROBIN + - DYNAMIC_DNS type: string - type: array - workloadSelector: - description: Applicable only for MESH_INTERNAL services. - properties: - labels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard is not supported in selector - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of - pods/VMs on which the configuration should be applied. - maxProperties: 256 - type: object - type: object - required: - - hosts - type: object - x-kubernetes-validations: - - message: only one of WorkloadSelector or Endpoints can be set - rule: '(has(self.workloadSelector) ? 1 : 0) + (has(self.endpoints) ? - 1 : 0) <= 1' - - message: CIDR addresses are allowed only for NONE/STATIC resolution - types - rule: '!((has(self.addresses) ? self.addresses : []).exists(k, k.contains("/")) - && !((has(self.resolution) ? self.resolution : "NONE") in ["STATIC", - "NONE"]))' - - message: NONE mode cannot set endpoints - rule: '((has(self.resolution) ? self.resolution : "NONE") == "NONE") - ? !has(self.endpoints) : true' - - message: DNS_ROUND_ROBIN mode cannot have multiple endpoints - rule: '((has(self.resolution) ? self.resolution : "") == "DNS_ROUND_ROBIN") - ? ((has(self.endpoints) ? self.endpoints : []).size() <= 1) : true' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: + subjectAltNames: + description: If specified, the proxy will verify that the server certificate's subject alternate name matches one of the specified values. + items: + type: string + type: array + workloadSelector: + description: Applicable only for MESH_INTERNAL services. properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. - - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string + labels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard is not supported in selector + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of pods/VMs on which the configuration should be applied. + maxProperties: 256 type: object type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: false - subresources: - status: {} + required: + - hosts + type: object + x-kubernetes-validations: + - message: only one of WorkloadSelector or Endpoints can be set + rule: '(has(self.workloadSelector) ? 1 : 0) + (has(self.endpoints) ? 1 : 0) <= 1' + - message: CIDR addresses are allowed only for NONE/STATIC resolution types + rule: '!((has(self.addresses) ? self.addresses : []).exists(k, k.contains("/")) && !((has(self.resolution) ? self.resolution : "NONE") in ["STATIC", "NONE"]))' + - message: NONE mode cannot set endpoints + rule: '((has(self.resolution) ? self.resolution : "NONE") == "NONE") ? !has(self.endpoints) : true' + - message: DNS_ROUND_ROBIN mode cannot have multiple endpoints + rule: '((has(self.resolution) ? self.resolution : "") == "DNS_ROUND_ROBIN") ? ((has(self.endpoints) ? self.endpoints : []).size() <= 1) : true' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -10155,1748 +9072,1547 @@ spec: group: networking.istio.io names: categories: - - istio-io - - networking-istio-io + - istio-io + - networking-istio-io kind: Sidecar listKind: SidecarList plural: sidecars singular: sidecar scope: Namespaced versions: - - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting network reachability of a sidecar. - See more details at: https://istio.io/docs/reference/config/networking/sidecar.html' - properties: - egress: - description: Egress specifies the configuration of the sidecar for - processing outbound traffic from the attached workload instance - to other services in the mesh. - items: - properties: - bind: - description: The IP(IPv4 or IPv6) or the Unix domain socket - to which the listener should be bound to. - type: string - captureMode: - description: |- - When the bind address is an IP, the captureMode option dictates how traffic to the listener is expected to be captured (or not). - - Valid Options: DEFAULT, IPTABLES, NONE - enum: - - DEFAULT - - IPTABLES - - NONE - type: string - hosts: - description: One or more service hosts exposed by the listener - in `namespace/dnsName` format. - items: - type: string - type: array - port: - description: The port associated with the listener. - properties: - name: - description: Label assigned to the port. - type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - protocol: - description: The protocol exposed on the port. - type: string - targetPort: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - required: - - hosts - type: object - type: array - inboundConnectionPool: - description: Settings controlling the volume of connections Envoy - will accept from the network. - properties: - http: - description: HTTP connection pool settings. + - name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting network reachability of a sidecar. See more details at: https://istio.io/docs/reference/config/networking/sidecar.html' + properties: + egress: + description: Egress specifies the configuration of the sidecar for processing outbound traffic from the attached workload instance to other services in the mesh. + items: properties: - h2UpgradePolicy: + bind: + description: The IP(IPv4 or IPv6) or the Unix domain socket to which the listener should be bound to. + type: string + captureMode: description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. + When the bind address is an IP, the captureMode option dictates how traffic to the listener is expected to be captured (or not). - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + Valid Options: DEFAULT, IPTABLES, NONE enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be queued - while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection pool - connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams allowed - for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection to - a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding - to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be preserved - while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. + - DEFAULT + - IPTABLES + - NONE type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections to a - destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket to - enable TCP Keepalives. + hosts: + description: One or more service hosts exposed by the listener in `namespace/dnsName` format. + items: + type: string + type: array + port: + description: The port associated with the listener. properties: - interval: - description: The time duration between keep-alive probes. + name: + description: Label assigned to the port. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes to send - without response before deciding the connection is dead. + number: + description: A valid non-negative integer port number. maximum: 4294967295 minimum: 0 type: integer - time: - description: The time duration a connection needs to be - idle before keep-alive probes start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: object - type: object - ingress: - description: Ingress specifies the configuration of the sidecar for - processing inbound traffic to the attached workload instance. - items: - properties: - bind: - description: The IP(IPv4 or IPv6) to which the listener should - be bound. - type: string - captureMode: - description: |- - The captureMode option dictates how traffic to the listener is expected to be captured (or not). - - Valid Options: DEFAULT, IPTABLES, NONE - enum: - - DEFAULT - - IPTABLES - - NONE - type: string - connectionPool: - description: Settings controlling the volume of connections - Envoy will accept from the network. - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be - queued while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a - destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection - pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams - allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection - to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding - to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be - preserved while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream - connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections - to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket - to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive - probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes - to send without response before deciding the connection - is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection needs - to be idle before keep-alive probes start being - sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - type: object - type: object - type: object - defaultEndpoint: - description: The IP endpoint or Unix domain socket to which - traffic should be forwarded to. - type: string - port: - description: The port associated with the listener. - properties: - name: - description: Label assigned to the port. - type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - protocol: - description: The protocol exposed on the port. - type: string - targetPort: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - tls: - description: Set of TLS related options that will enable TLS - termination on the sidecar for requests originating from outside - the mesh. - properties: - caCertCredentialName: - description: For mutual TLS, the name of the secret or the - configmap that holds CA certificates. - type: string - caCertificates: - description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing - the certificate revocation list (CRL) to use in verifying - a presented client side certificate.' - type: string - cipherSuites: - description: 'Optional: If specified, only support the specified - cipher list.' - items: - type: string - type: array - credentialName: - description: For gateways running on Kubernetes, the name - of the secret that holds the TLS certs including the CA - certificates. - type: string - credentialNames: - description: Same as CredentialName but for multiple certificates. - items: - type: string - maxItems: 2 - minItems: 1 - type: array - httpsRedirect: - description: If set to true, the load balancer will send - a 301 redirect for all http connections, asking the clients - to use HTTPS. - type: boolean - maxProtocolVersion: - description: |- - Optional: Maximum TLS protocol version. - - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - minProtocolVersion: - description: |- - Optional: Minimum TLS protocol version. - - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - mode: - description: |- - Optional: Indicates whether connections to this port should be secured using TLS. - - Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL - enum: - - PASSTHROUGH - - SIMPLE - - MUTUAL - - AUTO_PASSTHROUGH - - ISTIO_MUTUAL - - OPTIONAL_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - subjectAltNames: - description: A list of alternate names to verify the subject - identity in the certificate presented by the client. - items: + protocol: + description: The protocol exposed on the port. type: string - type: array - tlsCertificates: - description: Only one of `server_certificate`, `private_key` - or `credential_name` or `credential_names` or `tls_certificates` - should be specified. - items: - properties: - caCertificates: - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - type: object - maxItems: 2 - minItems: 1 - type: array - verifyCertificateHash: - description: An optional list of hex-encoded SHA-256 hashes - of the authorized client certificates. - items: - type: string - type: array - verifyCertificateSpki: - description: An optional list of base64-encoded SHA-256 - hashes of the SPKIs of authorized client certificates. - items: - type: string - type: array - type: object - x-kubernetes-validations: - - message: only one of credentialNames or tlsCertificates can - be set - rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) - ? 1 : 0) <= 1' - - message: only one of credentialName or credentialNames can - be set - rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) - ? 1 : 0) <= 1' - - message: only one of credentialName or tlsCertificates can - be set - rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) - ? 1 : 0) <= 1' - required: - - port - type: object - type: array - outboundTrafficPolicy: - description: Set the default behavior of the sidecar for handling - outbound traffic from the application. - properties: - egressProxy: - properties: - host: - description: The name of a service from the service registry. - type: string - port: - description: Specifies the port on the host that is being - addressed. - properties: - number: + targetPort: maximum: 4294967295 minimum: 0 type: integer type: object - subset: - description: The name of a subset within the service. - type: string required: - - host - type: object - mode: - description: |2- - - - Valid Options: REGISTRY_ONLY, ALLOW_ANY - enum: - - REGISTRY_ONLY - - ALLOW_ANY - type: string - type: object - workloadSelector: - description: Criteria used to select the specific set of pods/VMs - on which this `Sidecar` configuration should be applied. - properties: - labels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard is not supported in selector - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of - pods/VMs on which the configuration should be applied. - maxProperties: 256 + - hosts type: object - type: object - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: + type: array + inboundConnectionPool: + description: Settings controlling the volume of connections Envoy will accept from the network. properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. - - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: + http: + description: HTTP connection pool settings. properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE type: string - name: - description: A human-readable name for the message type. + http1MaxPendingRequests: + description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection pool connections. type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be preserved while initiating connection to backend. + type: boolean type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} - - name: v1alpha3 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting network reachability of a sidecar. - See more details at: https://istio.io/docs/reference/config/networking/sidecar.html' - properties: - egress: - description: Egress specifies the configuration of the sidecar for - processing outbound traffic from the attached workload instance - to other services in the mesh. - items: - properties: - bind: - description: The IP(IPv4 or IPv6) or the Unix domain socket - to which the listener should be bound to. - type: string - captureMode: - description: |- - When the bind address is an IP, the captureMode option dictates how traffic to the listener is expected to be captured (or not). - - Valid Options: DEFAULT, IPTABLES, NONE - enum: - - DEFAULT - - IPTABLES - - NONE - type: string - hosts: - description: One or more service hosts exposed by the listener - in `namespace/dnsName` format. - items: - type: string - type: array - port: - description: The port associated with the listener. + tcp: + description: Settings common to both HTTP and TCP upstream connections. properties: - name: - description: Label assigned to the port. + connectTimeout: + description: TCP connection timeout. type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - protocol: - description: The protocol exposed on the port. + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. type: string - targetPort: - maximum: 4294967295 - minimum: 0 + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections to a destination host. + format: int32 type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between keep-alive probes. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to send without response before deciding the connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection needs to be idle before keep-alive probes start being sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object type: object - required: - - hosts type: object - type: array - inboundConnectionPool: - description: Settings controlling the volume of connections Envoy - will accept from the network. - properties: - http: - description: HTTP connection pool settings. + ingress: + description: Ingress specifies the configuration of the sidecar for processing inbound traffic to the attached workload instance. + items: properties: - h2UpgradePolicy: + bind: + description: The IP(IPv4 or IPv6) to which the listener should be bound. + type: string + captureMode: description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. + The captureMode option dictates how traffic to the listener is expected to be captured (or not). - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + Valid Options: DEFAULT, IPTABLES, NONE enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be queued - while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection pool - connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams allowed - for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection to - a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding - to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be preserved - while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. + - DEFAULT + - IPTABLES + - NONE type: string - maxConnectionDuration: - description: The maximum duration of a connection. + connectionPool: + description: Settings controlling the volume of connections Envoy will accept from the network. + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be preserved while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between keep-alive probes. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to send without response before deciding the connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection needs to be idle before keep-alive probes start being sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + type: object + type: object + defaultEndpoint: + description: The IP endpoint or Unix domain socket to which traffic should be forwarded to. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections to a - destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket to - enable TCP Keepalives. + port: + description: The port associated with the listener. properties: - interval: - description: The time duration between keep-alive probes. + name: + description: Label assigned to the port. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes to send - without response before deciding the connection is dead. + number: + description: A valid non-negative integer port number. maximum: 4294967295 minimum: 0 type: integer - time: - description: The time duration a connection needs to be - idle before keep-alive probes start being sent. + protocol: + description: The protocol exposed on the port. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') + targetPort: + maximum: 4294967295 + minimum: 0 + type: integer type: object - type: object - type: object - ingress: - description: Ingress specifies the configuration of the sidecar for - processing inbound traffic to the attached workload instance. - items: - properties: - bind: - description: The IP(IPv4 or IPv6) to which the listener should - be bound. - type: string - captureMode: - description: |- - The captureMode option dictates how traffic to the listener is expected to be captured (or not). - - Valid Options: DEFAULT, IPTABLES, NONE - enum: - - DEFAULT - - IPTABLES - - NONE - type: string - connectionPool: - description: Settings controlling the volume of connections - Envoy will accept from the network. - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be - queued while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a - destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection - pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams - allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection - to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding - to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be - preserved while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream - connections. - properties: - connectTimeout: - description: TCP connection timeout. + tls: + description: Set of TLS related options that will enable TLS termination on the sidecar for requests originating from outside the mesh. + properties: + caCertCredentialName: + description: For mutual TLS, the name of the secret or the configmap that holds CA certificates. + type: string + caCertificates: + description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented client side certificate.' + type: string + cipherSuites: + description: 'Optional: If specified, only support the specified cipher list.' + items: type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. + type: array + credentialName: + description: For gateways running on Kubernetes, the name of the secret that holds the TLS certs including the CA certificates. + type: string + credentialNames: + description: Same as CredentialName but for multiple certificates. + items: type: string - maxConnectionDuration: - description: The maximum duration of a connection. + maxItems: 2 + minItems: 1 + type: array + httpsRedirect: + description: If set to true, the load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS. + type: boolean + maxProtocolVersion: + description: |- + Optional: Maximum TLS protocol version. + + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + minProtocolVersion: + description: |- + Optional: Minimum TLS protocol version. + + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + mode: + description: |- + Optional: Indicates whether connections to this port should be secured using TLS. + + Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL + enum: + - PASSTHROUGH + - SIMPLE + - MUTUAL + - AUTO_PASSTHROUGH + - ISTIO_MUTUAL + - OPTIONAL_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject identity in the certificate presented by the client. + items: type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections - to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket - to enable TCP Keepalives. + type: array + tlsCertificates: + description: Only one of `server_certificate`, `private_key` or `credential_name` or `credential_names` or `tls_certificates` should be specified. + items: properties: - interval: - description: The time duration between keep-alive - probes. + caCertificates: type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes - to send without response before deciding the connection - is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection needs - to be idle before keep-alive probes start being - sent. + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') type: object - type: object - type: object - defaultEndpoint: - description: The IP endpoint or Unix domain socket to which - traffic should be forwarded to. - type: string - port: - description: The port associated with the listener. + maxItems: 2 + minItems: 1 + type: array + verifyCertificateHash: + description: An optional list of hex-encoded SHA-256 hashes of the authorized client certificates. + items: + type: string + type: array + verifyCertificateSpki: + description: An optional list of base64-encoded SHA-256 hashes of the SPKIs of authorized client certificates. + items: + type: string + type: array + type: object + x-kubernetes-validations: + - message: only one of credentialNames or tlsCertificates can be set + rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) ? 1 : 0) <= 1' + - message: only one of credentialName or credentialNames can be set + rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) ? 1 : 0) <= 1' + - message: only one of credentialName or tlsCertificates can be set + rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) ? 1 : 0) <= 1' + required: + - port + type: object + type: array + outboundTrafficPolicy: + description: Set the default behavior of the sidecar for handling outbound traffic from the application. + properties: + egressProxy: properties: - name: - description: Label assigned to the port. + host: + description: The name of a service from the service registry. type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - protocol: - description: The protocol exposed on the port. + port: + description: Specifies the port on the host that is being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. type: string - targetPort: - maximum: 4294967295 - minimum: 0 - type: integer + required: + - host + type: object + mode: + description: |- + + + Valid Options: REGISTRY_ONLY, ALLOW_ANY + enum: + - REGISTRY_ONLY + - ALLOW_ANY + type: string + type: object + workloadSelector: + description: Criteria used to select the specific set of pods/VMs on which this `Sidecar` configuration should be applied. + properties: + labels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard is not supported in selector + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of pods/VMs on which the configuration should be applied. + maxProperties: 256 type: object - tls: - description: Set of TLS related options that will enable TLS - termination on the sidecar for requests originating from outside - the mesh. - properties: - caCertCredentialName: - description: For mutual TLS, the name of the secret or the - configmap that holds CA certificates. - type: string - caCertificates: - description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing - the certificate revocation list (CRL) to use in verifying - a presented client side certificate.' - type: string - cipherSuites: - description: 'Optional: If specified, only support the specified - cipher list.' - items: + type: object + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. type: string - type: array - credentialName: - description: For gateways running on Kubernetes, the name - of the secret that holds the TLS certs including the CA - certificates. - type: string - credentialNames: - description: Same as CredentialName but for multiple certificates. - items: + name: + description: A human-readable name for the message type. type: string - maxItems: 2 - minItems: 1 - type: array - httpsRedirect: - description: If set to true, the load balancer will send - a 301 redirect for all http connections, asking the clients - to use HTTPS. - type: boolean - maxProtocolVersion: - description: |- - Optional: Maximum TLS protocol version. + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} + - name: v1alpha3 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting network reachability of a sidecar. See more details at: https://istio.io/docs/reference/config/networking/sidecar.html' + properties: + egress: + description: Egress specifies the configuration of the sidecar for processing outbound traffic from the attached workload instance to other services in the mesh. + items: + properties: + bind: + description: The IP(IPv4 or IPv6) or the Unix domain socket to which the listener should be bound to. + type: string + captureMode: + description: |- + When the bind address is an IP, the captureMode option dictates how traffic to the listener is expected to be captured (or not). - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 + Valid Options: DEFAULT, IPTABLES, NONE + enum: + - DEFAULT + - IPTABLES + - NONE + type: string + hosts: + description: One or more service hosts exposed by the listener in `namespace/dnsName` format. + items: type: string - minProtocolVersion: + type: array + port: + description: The port associated with the listener. + properties: + name: + description: Label assigned to the port. + type: string + number: + description: A valid non-negative integer port number. + maximum: 4294967295 + minimum: 0 + type: integer + protocol: + description: The protocol exposed on the port. + type: string + targetPort: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + required: + - hosts + type: object + type: array + inboundConnectionPool: + description: Settings controlling the volume of connections Envoy will accept from the network. + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: description: |- - Optional: Minimum TLS protocol version. + Specify if http1.1 connection should be upgraded to http2 for the associated destination. - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE type: string - mode: - description: |- - Optional: Indicates whether connections to this port should be secured using TLS. - - Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL - enum: - - PASSTHROUGH - - SIMPLE - - MUTUAL - - AUTO_PASSTHROUGH - - ISTIO_MUTUAL - - OPTIONAL_MUTUAL + http1MaxPendingRequests: + description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection pool connections. type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be preserved while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream connections. + properties: + connectTimeout: + description: TCP connection timeout. type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. type: string - subjectAltNames: - description: A list of alternate names to verify the subject - identity in the certificate presented by the client. - items: - type: string - type: array - tlsCertificates: - description: Only one of `server_certificate`, `private_key` - or `credential_name` or `credential_names` or `tls_certificates` - should be specified. - items: + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between keep-alive probes. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to send without response before deciding the connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection needs to be idle before keep-alive probes start being sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + type: object + type: object + ingress: + description: Ingress specifies the configuration of the sidecar for processing inbound traffic to the attached workload instance. + items: + properties: + bind: + description: The IP(IPv4 or IPv6) to which the listener should be bound. + type: string + captureMode: + description: |- + The captureMode option dictates how traffic to the listener is expected to be captured (or not). + + Valid Options: DEFAULT, IPTABLES, NONE + enum: + - DEFAULT + - IPTABLES + - NONE + type: string + connectionPool: + description: Settings controlling the volume of connections Envoy will accept from the network. + properties: + http: + description: HTTP connection pool settings. properties: - caCertificates: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + http1MaxPendingRequests: + description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be preserved while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream connections. + properties: + connectTimeout: + description: TCP connection timeout. type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between keep-alive probes. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to send without response before deciding the connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection needs to be idle before keep-alive probes start being sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object type: object - maxItems: 2 - minItems: 1 - type: array - verifyCertificateHash: - description: An optional list of hex-encoded SHA-256 hashes - of the authorized client certificates. - items: - type: string - type: array - verifyCertificateSpki: - description: An optional list of base64-encoded SHA-256 - hashes of the SPKIs of authorized client certificates. - items: - type: string - type: array - type: object - x-kubernetes-validations: - - message: only one of credentialNames or tlsCertificates can - be set - rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) - ? 1 : 0) <= 1' - - message: only one of credentialName or credentialNames can - be set - rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) - ? 1 : 0) <= 1' - - message: only one of credentialName or tlsCertificates can - be set - rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) - ? 1 : 0) <= 1' - required: - - port - type: object - type: array - outboundTrafficPolicy: - description: Set the default behavior of the sidecar for handling - outbound traffic from the application. - properties: - egressProxy: - properties: - host: - description: The name of a service from the service registry. + type: object + defaultEndpoint: + description: The IP endpoint or Unix domain socket to which traffic should be forwarded to. type: string port: - description: Specifies the port on the host that is being - addressed. + description: The port associated with the listener. properties: + name: + description: Label assigned to the port. + type: string number: + description: A valid non-negative integer port number. + maximum: 4294967295 + minimum: 0 + type: integer + protocol: + description: The protocol exposed on the port. + type: string + targetPort: maximum: 4294967295 minimum: 0 type: integer type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - mode: - description: |2- + tls: + description: Set of TLS related options that will enable TLS termination on the sidecar for requests originating from outside the mesh. + properties: + caCertCredentialName: + description: For mutual TLS, the name of the secret or the configmap that holds CA certificates. + type: string + caCertificates: + description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented client side certificate.' + type: string + cipherSuites: + description: 'Optional: If specified, only support the specified cipher list.' + items: + type: string + type: array + credentialName: + description: For gateways running on Kubernetes, the name of the secret that holds the TLS certs including the CA certificates. + type: string + credentialNames: + description: Same as CredentialName but for multiple certificates. + items: + type: string + maxItems: 2 + minItems: 1 + type: array + httpsRedirect: + description: If set to true, the load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS. + type: boolean + maxProtocolVersion: + description: |- + Optional: Maximum TLS protocol version. + + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + minProtocolVersion: + description: |- + Optional: Minimum TLS protocol version. + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + mode: + description: |- + Optional: Indicates whether connections to this port should be secured using TLS. - Valid Options: REGISTRY_ONLY, ALLOW_ANY - enum: - - REGISTRY_ONLY - - ALLOW_ANY - type: string - type: object - workloadSelector: - description: Criteria used to select the specific set of pods/VMs - on which this `Sidecar` configuration should be applied. - properties: - labels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard is not supported in selector - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of - pods/VMs on which the configuration should be applied. - maxProperties: 256 + Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL + enum: + - PASSTHROUGH + - SIMPLE + - MUTUAL + - AUTO_PASSTHROUGH + - ISTIO_MUTUAL + - OPTIONAL_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject identity in the certificate presented by the client. + items: + type: string + type: array + tlsCertificates: + description: Only one of `server_certificate`, `private_key` or `credential_name` or `credential_names` or `tls_certificates` should be specified. + items: + properties: + caCertificates: + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + type: object + maxItems: 2 + minItems: 1 + type: array + verifyCertificateHash: + description: An optional list of hex-encoded SHA-256 hashes of the authorized client certificates. + items: + type: string + type: array + verifyCertificateSpki: + description: An optional list of base64-encoded SHA-256 hashes of the SPKIs of authorized client certificates. + items: + type: string + type: array + type: object + x-kubernetes-validations: + - message: only one of credentialNames or tlsCertificates can be set + rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) ? 1 : 0) <= 1' + - message: only one of credentialName or credentialNames can be set + rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) ? 1 : 0) <= 1' + - message: only one of credentialName or tlsCertificates can be set + rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) ? 1 : 0) <= 1' + required: + - port type: object - type: object - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: + type: array + outboundTrafficPolicy: + description: Set the default behavior of the sidecar for handling outbound traffic from the application. properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. - - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: + egressProxy: properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. + host: + description: The name of a service from the service registry. type: string - name: - description: A human-readable name for the message type. + port: + description: Specifies the port on the host that is being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. type: string + required: + - host type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} - - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting network reachability of a sidecar. - See more details at: https://istio.io/docs/reference/config/networking/sidecar.html' - properties: - egress: - description: Egress specifies the configuration of the sidecar for - processing outbound traffic from the attached workload instance - to other services in the mesh. - items: - properties: - bind: - description: The IP(IPv4 or IPv6) or the Unix domain socket - to which the listener should be bound to. - type: string - captureMode: + mode: description: |- - When the bind address is an IP, the captureMode option dictates how traffic to the listener is expected to be captured (or not). - Valid Options: DEFAULT, IPTABLES, NONE + + Valid Options: REGISTRY_ONLY, ALLOW_ANY enum: - - DEFAULT - - IPTABLES - - NONE + - REGISTRY_ONLY + - ALLOW_ANY type: string - hosts: - description: One or more service hosts exposed by the listener - in `namespace/dnsName` format. - items: + type: object + workloadSelector: + description: Criteria used to select the specific set of pods/VMs on which this `Sidecar` configuration should be applied. + properties: + labels: + additionalProperties: + maxLength: 63 type: string - type: array - port: - description: The port associated with the listener. - properties: - name: - description: Label assigned to the port. - type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - protocol: - description: The protocol exposed on the port. - type: string - targetPort: - maximum: 4294967295 - minimum: 0 - type: integer + x-kubernetes-validations: + - message: wildcard is not supported in selector + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of pods/VMs on which the configuration should be applied. + maxProperties: 256 type: object - required: - - hosts type: object - type: array - inboundConnectionPool: - description: Settings controlling the volume of connections Envoy - will accept from the network. - properties: - http: - description: HTTP connection pool settings. + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: properties: - h2UpgradePolicy: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. + type: string + level: description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. + Represents how severe a message is. - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + Valid Options: UNKNOWN, ERROR, WARNING, INFO enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be queued - while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection pool - connections. + - UNKNOWN + - ERROR + - WARNING + - INFO type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams allowed - for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection to - a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding - to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be preserved - while initiating connection to backend. - type: boolean + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object type: object - tcp: - description: Settings common to both HTTP and TCP upstream connections. + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} + - name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting network reachability of a sidecar. See more details at: https://istio.io/docs/reference/config/networking/sidecar.html' + properties: + egress: + description: Egress specifies the configuration of the sidecar for processing outbound traffic from the attached workload instance to other services in the mesh. + items: properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. + bind: + description: The IP(IPv4 or IPv6) or the Unix domain socket to which the listener should be bound to. type: string - maxConnectionDuration: - description: The maximum duration of a connection. + captureMode: + description: |- + When the bind address is an IP, the captureMode option dictates how traffic to the listener is expected to be captured (or not). + + Valid Options: DEFAULT, IPTABLES, NONE + enum: + - DEFAULT + - IPTABLES + - NONE type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections to a - destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket to - enable TCP Keepalives. + hosts: + description: One or more service hosts exposed by the listener in `namespace/dnsName` format. + items: + type: string + type: array + port: + description: The port associated with the listener. properties: - interval: - description: The time duration between keep-alive probes. + name: + description: Label assigned to the port. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes to send - without response before deciding the connection is dead. + number: + description: A valid non-negative integer port number. maximum: 4294967295 minimum: 0 type: integer - time: - description: The time duration a connection needs to be - idle before keep-alive probes start being sent. + protocol: + description: The protocol exposed on the port. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') + targetPort: + maximum: 4294967295 + minimum: 0 + type: integer type: object + required: + - hosts type: object - type: object - ingress: - description: Ingress specifies the configuration of the sidecar for - processing inbound traffic to the attached workload instance. - items: + type: array + inboundConnectionPool: + description: Settings controlling the volume of connections Envoy will accept from the network. properties: - bind: - description: The IP(IPv4 or IPv6) to which the listener should - be bound. - type: string - captureMode: - description: |- - The captureMode option dictates how traffic to the listener is expected to be captured (or not). - - Valid Options: DEFAULT, IPTABLES, NONE - enum: - - DEFAULT - - IPTABLES - - NONE - type: string - connectionPool: - description: Settings controlling the volume of connections - Envoy will accept from the network. + http: + description: HTTP connection pool settings. properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be - queued while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a - destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection - pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams - allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection - to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding - to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be - preserved while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream - connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections - to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket - to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive - probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes - to send without response before deciding the connection - is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection needs - to be idle before keep-alive probes start being - sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than - 1ms - rule: duration(self) >= duration('1ms') - type: object - type: object - type: object - defaultEndpoint: - description: The IP endpoint or Unix domain socket to which - traffic should be forwarded to. - type: string - port: - description: The port associated with the listener. - properties: - name: - description: Label assigned to the port. + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 + http1MaxPendingRequests: + description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. + format: int32 type: integer - protocol: - description: The protocol exposed on the port. + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection pool connections. type: string - targetPort: - maximum: 4294967295 - minimum: 0 + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. + format: int32 type: integer + useClientProtocol: + description: If set to true, client protocol will be preserved while initiating connection to backend. + type: boolean type: object - tls: - description: Set of TLS related options that will enable TLS - termination on the sidecar for requests originating from outside - the mesh. + tcp: + description: Settings common to both HTTP and TCP upstream connections. properties: - caCertCredentialName: - description: For mutual TLS, the name of the secret or the - configmap that holds CA certificates. - type: string - caCertificates: - description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing - the certificate revocation list (CRL) to use in verifying - a presented client side certificate.' + connectTimeout: + description: TCP connection timeout. type: string - cipherSuites: - description: 'Optional: If specified, only support the specified - cipher list.' - items: - type: string - type: array - credentialName: - description: For gateways running on Kubernetes, the name - of the secret that holds the TLS certs including the CA - certificates. + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. type: string - credentialNames: - description: Same as CredentialName but for multiple certificates. - items: - type: string - maxItems: 2 - minItems: 1 - type: array - httpsRedirect: - description: If set to true, the load balancer will send - a 301 redirect for all http connections, asking the clients - to use HTTPS. - type: boolean - maxProtocolVersion: - description: |- - Optional: Maximum TLS protocol version. - - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 + maxConnectionDuration: + description: The maximum duration of a connection. type: string - minProtocolVersion: - description: |- - Optional: Minimum TLS protocol version. + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between keep-alive probes. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to send without response before deciding the connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection needs to be idle before keep-alive probes start being sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + type: object + type: object + ingress: + description: Ingress specifies the configuration of the sidecar for processing inbound traffic to the attached workload instance. + items: + properties: + bind: + description: The IP(IPv4 or IPv6) to which the listener should be bound. + type: string + captureMode: + description: |- + The captureMode option dictates how traffic to the listener is expected to be captured (or not). - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - mode: - description: |- - Optional: Indicates whether connections to this port should be secured using TLS. + Valid Options: DEFAULT, IPTABLES, NONE + enum: + - DEFAULT + - IPTABLES + - NONE + type: string + connectionPool: + description: Settings controlling the volume of connections Envoy will accept from the network. + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. - Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL - enum: - - PASSTHROUGH - - SIMPLE - - MUTUAL - - AUTO_PASSTHROUGH - - ISTIO_MUTUAL - - OPTIONAL_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - subjectAltNames: - description: A list of alternate names to verify the subject - identity in the certificate presented by the client. - items: - type: string - type: array - tlsCertificates: - description: Only one of `server_certificate`, `private_key` - or `credential_name` or `credential_names` or `tls_certificates` - should be specified. - items: + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be preserved while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream connections. properties: - caCertificates: + connectTimeout: + description: TCP connection timeout. type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + maxConnectionDuration: + description: The maximum duration of a connection. type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between keep-alive probes. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to send without response before deciding the connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection needs to be idle before keep-alive probes start being sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object type: object - maxItems: 2 - minItems: 1 - type: array - verifyCertificateHash: - description: An optional list of hex-encoded SHA-256 hashes - of the authorized client certificates. - items: - type: string - type: array - verifyCertificateSpki: - description: An optional list of base64-encoded SHA-256 - hashes of the SPKIs of authorized client certificates. - items: - type: string - type: array - type: object - x-kubernetes-validations: - - message: only one of credentialNames or tlsCertificates can - be set - rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) - ? 1 : 0) <= 1' - - message: only one of credentialName or credentialNames can - be set - rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) - ? 1 : 0) <= 1' - - message: only one of credentialName or tlsCertificates can - be set - rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) - ? 1 : 0) <= 1' - required: - - port - type: object - type: array - outboundTrafficPolicy: - description: Set the default behavior of the sidecar for handling - outbound traffic from the application. - properties: - egressProxy: - properties: - host: - description: The name of a service from the service registry. + type: object + defaultEndpoint: + description: The IP endpoint or Unix domain socket to which traffic should be forwarded to. type: string port: - description: Specifies the port on the host that is being - addressed. + description: The port associated with the listener. properties: + name: + description: Label assigned to the port. + type: string number: + description: A valid non-negative integer port number. + maximum: 4294967295 + minimum: 0 + type: integer + protocol: + description: The protocol exposed on the port. + type: string + targetPort: maximum: 4294967295 minimum: 0 type: integer type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - mode: - description: |2- + tls: + description: Set of TLS related options that will enable TLS termination on the sidecar for requests originating from outside the mesh. + properties: + caCertCredentialName: + description: For mutual TLS, the name of the secret or the configmap that holds CA certificates. + type: string + caCertificates: + description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented client side certificate.' + type: string + cipherSuites: + description: 'Optional: If specified, only support the specified cipher list.' + items: + type: string + type: array + credentialName: + description: For gateways running on Kubernetes, the name of the secret that holds the TLS certs including the CA certificates. + type: string + credentialNames: + description: Same as CredentialName but for multiple certificates. + items: + type: string + maxItems: 2 + minItems: 1 + type: array + httpsRedirect: + description: If set to true, the load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS. + type: boolean + maxProtocolVersion: + description: |- + Optional: Maximum TLS protocol version. + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + minProtocolVersion: + description: |- + Optional: Minimum TLS protocol version. - Valid Options: REGISTRY_ONLY, ALLOW_ANY - enum: - - REGISTRY_ONLY - - ALLOW_ANY - type: string - type: object - workloadSelector: - description: Criteria used to select the specific set of pods/VMs - on which this `Sidecar` configuration should be applied. - properties: - labels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard is not supported in selector - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of - pods/VMs on which the configuration should be applied. - maxProperties: 256 + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + mode: + description: |- + Optional: Indicates whether connections to this port should be secured using TLS. + + Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL + enum: + - PASSTHROUGH + - SIMPLE + - MUTUAL + - AUTO_PASSTHROUGH + - ISTIO_MUTUAL + - OPTIONAL_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject identity in the certificate presented by the client. + items: + type: string + type: array + tlsCertificates: + description: Only one of `server_certificate`, `private_key` or `credential_name` or `credential_names` or `tls_certificates` should be specified. + items: + properties: + caCertificates: + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + type: object + maxItems: 2 + minItems: 1 + type: array + verifyCertificateHash: + description: An optional list of hex-encoded SHA-256 hashes of the authorized client certificates. + items: + type: string + type: array + verifyCertificateSpki: + description: An optional list of base64-encoded SHA-256 hashes of the SPKIs of authorized client certificates. + items: + type: string + type: array + type: object + x-kubernetes-validations: + - message: only one of credentialNames or tlsCertificates can be set + rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) ? 1 : 0) <= 1' + - message: only one of credentialName or credentialNames can be set + rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) ? 1 : 0) <= 1' + - message: only one of credentialName or tlsCertificates can be set + rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) ? 1 : 0) <= 1' + required: + - port type: object - type: object - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: + type: array + outboundTrafficPolicy: + description: Set the default behavior of the sidecar for handling outbound traffic from the application. properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: + egressProxy: + properties: + host: + description: The name of a service from the service registry. + type: string + port: + description: Specifies the port on the host that is being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + mode: description: |- - Represents how severe a message is. - Valid Options: UNKNOWN, ERROR, WARNING, INFO + + Valid Options: REGISTRY_ONLY, ALLOW_ANY enum: - - UNKNOWN - - ERROR - - WARNING - - INFO + - REGISTRY_ONLY + - ALLOW_ANY type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string + type: object + workloadSelector: + description: Criteria used to select the specific set of pods/VMs on which this `Sidecar` configuration should be applied. + properties: + labels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard is not supported in selector + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of pods/VMs on which the configuration should be applied. + maxProperties: 256 type: object type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -11914,236 +10630,195 @@ spec: group: telemetry.istio.io names: categories: - - istio-io - - telemetry-istio-io + - istio-io + - telemetry-istio-io kind: Telemetry listKind: TelemetryList plural: telemetries shortNames: - - telemetry + - telemetry singular: telemetry scope: Namespaced versions: - - additionalPrinterColumns: - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is represented - in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for - lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Telemetry configuration for workloads. See more details - at: https://istio.io/docs/reference/config/telemetry.html' - properties: - accessLogging: - description: Optional. - items: - properties: - disabled: - description: Controls logging. - nullable: true - type: boolean - filter: - description: Optional. - properties: - expression: - description: CEL expression for selecting when requests/connections - should be logged. - type: string - type: object - match: - description: Allows tailoring of logging behavior to specific - conditions. - properties: - mode: - description: |- - This determines whether or not to apply the access logging configuration based on the direction of traffic relative to the proxied workload. - - Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER - enum: - - CLIENT_AND_SERVER - - CLIENT - - SERVER - type: string - type: object - providers: - description: Optional. - items: + - additionalPrinterColumns: + - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Telemetry configuration for workloads. See more details at: https://istio.io/docs/reference/config/telemetry.html' + properties: + accessLogging: + description: Optional. + items: + properties: + disabled: + description: Controls logging. + nullable: true + type: boolean + filter: + description: Optional. properties: - name: - description: Required. - minLength: 1 + expression: + description: CEL expression for selecting when requests/connections should be logged. type: string - required: - - name type: object - type: array - type: object - type: array - metrics: - description: Optional. - items: - properties: - overrides: - description: Optional. - items: + match: + description: Allows tailoring of logging behavior to specific conditions. properties: - disabled: - description: Optional. - nullable: true - type: boolean - match: - description: Match allows providing the scope of the override. - oneOf: - - not: - anyOf: + mode: + description: |- + This determines whether or not to apply the access logging configuration based on the direction of traffic relative to the proxied workload. + + Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER + enum: + - CLIENT_AND_SERVER + - CLIENT + - SERVER + type: string + type: object + providers: + description: Optional. + items: + properties: + name: + description: Required. + minLength: 1 + type: string + required: + - name + type: object + type: array + type: object + type: array + metrics: + description: Optional. + items: + properties: + overrides: + description: Optional. + items: + properties: + disabled: + description: Optional. + nullable: true + type: boolean + match: + description: Match allows providing the scope of the override. + oneOf: + - not: + anyOf: + - required: + - metric + - required: + - customMetric - required: - - metric + - metric - required: - - customMetric - - required: - - metric - - required: - - customMetric - properties: - customMetric: - description: Allows free-form specification of a metric. - minLength: 1 - type: string - metric: - description: |- - One of the well-known [Istio Standard Metrics](https://istio.io/latest/docs/reference/config/metrics/). - - Valid Options: ALL_METRICS, REQUEST_COUNT, REQUEST_DURATION, REQUEST_SIZE, RESPONSE_SIZE, TCP_OPENED_CONNECTIONS, TCP_CLOSED_CONNECTIONS, TCP_SENT_BYTES, TCP_RECEIVED_BYTES, GRPC_REQUEST_MESSAGES, GRPC_RESPONSE_MESSAGES - enum: - - ALL_METRICS - - REQUEST_COUNT - - REQUEST_DURATION - - REQUEST_SIZE - - RESPONSE_SIZE - - TCP_OPENED_CONNECTIONS - - TCP_CLOSED_CONNECTIONS - - TCP_SENT_BYTES - - TCP_RECEIVED_BYTES - - GRPC_REQUEST_MESSAGES - - GRPC_RESPONSE_MESSAGES - type: string - mode: - description: |- - Controls which mode of metrics generation is selected: `CLIENT`, `SERVER`, or `CLIENT_AND_SERVER`. - - Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER - enum: - - CLIENT_AND_SERVER - - CLIENT - - SERVER - type: string - type: object - tagOverrides: - additionalProperties: + - customMetric properties: - operation: + customMetric: + description: Allows free-form specification of a metric. + minLength: 1 + type: string + metric: description: |- - Operation controls whether or not to update/add a tag, or to remove it. + One of the well-known [Istio Standard Metrics](https://istio.io/latest/docs/reference/config/metrics/). - Valid Options: UPSERT, REMOVE + Valid Options: ALL_METRICS, REQUEST_COUNT, REQUEST_DURATION, REQUEST_SIZE, RESPONSE_SIZE, TCP_OPENED_CONNECTIONS, TCP_CLOSED_CONNECTIONS, TCP_SENT_BYTES, TCP_RECEIVED_BYTES, GRPC_REQUEST_MESSAGES, GRPC_RESPONSE_MESSAGES enum: - - UPSERT - - REMOVE + - ALL_METRICS + - REQUEST_COUNT + - REQUEST_DURATION + - REQUEST_SIZE + - RESPONSE_SIZE + - TCP_OPENED_CONNECTIONS + - TCP_CLOSED_CONNECTIONS + - TCP_SENT_BYTES + - TCP_RECEIVED_BYTES + - GRPC_REQUEST_MESSAGES + - GRPC_RESPONSE_MESSAGES type: string - value: - description: Value is only considered if the operation - is `UPSERT`. + mode: + description: |- + Controls which mode of metrics generation is selected: `CLIENT`, `SERVER`, or `CLIENT_AND_SERVER`. + + Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER + enum: + - CLIENT_AND_SERVER + - CLIENT + - SERVER type: string type: object - x-kubernetes-validations: - - message: value must be set when operation is UPSERT - rule: '((has(self.operation) ? self.operation : "") - == "UPSERT") ? (self.value != "") : true' - - message: value must not be set when operation is REMOVE - rule: '((has(self.operation) ? self.operation : "") - == "REMOVE") ? !has(self.value) : true' - description: Optional. - type: object - type: object - type: array - providers: - description: Optional. - items: - properties: - name: - description: Required. - minLength: 1 - type: string - required: - - name - type: object - type: array - reportingInterval: - description: Optional. - type: string + tagOverrides: + additionalProperties: + properties: + operation: + description: |- + Operation controls whether or not to update/add a tag, or to remove it. + + Valid Options: UPSERT, REMOVE + enum: + - UPSERT + - REMOVE + type: string + value: + description: Value is only considered if the operation is `UPSERT`. + type: string + type: object + x-kubernetes-validations: + - message: value must be set when operation is UPSERT + rule: '((has(self.operation) ? self.operation : "") == "UPSERT") ? (self.value != "") : true' + - message: value must not be set when operation is REMOVE + rule: '((has(self.operation) ? self.operation : "") == "REMOVE") ? !has(self.value) : true' + description: Optional. + type: object + type: object + type: array + providers: + description: Optional. + items: + properties: + name: + description: Required. + minLength: 1 + type: string + required: + - name + type: object + type: array + reportingInterval: + description: Optional. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + type: array + selector: + description: Optional. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) type: object - type: array - selector: - description: Optional. - properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of - pods/VMs on which a policy should be applied. - maxProperties: 4096 - type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) - type: object - targetRef: - properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: name is the name of the target resource. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: namespace is the namespace of the referent. - type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 - required: - - kind - - name - type: object - targetRefs: - description: Optional. - items: + targetRef: properties: group: description: group is the group of the target resource. @@ -12165,449 +10840,423 @@ spec: description: namespace is the namespace of the referent. type: string x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 required: - - kind - - name + - kind + - name type: object - maxItems: 16 - type: array - tracing: - description: Optional. - items: - properties: - customTags: - additionalProperties: - oneOf: - - not: - anyOf: + targetRefs: + description: Optional. + items: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name + type: object + maxItems: 16 + type: array + tracing: + description: Optional. + items: + properties: + customTags: + additionalProperties: + oneOf: + - not: + anyOf: + - required: + - literal + - required: + - environment + - required: + - header + - required: + - formatter - required: - - literal + - literal - required: - - environment + - environment - required: - - header + - header - required: - - formatter - - required: - - literal - - required: - - environment - - required: - - header - - required: - - formatter + - formatter + properties: + environment: + description: Environment adds the value of an environment variable to each span. + properties: + defaultValue: + description: Optional. + type: string + name: + description: Name of the environment variable from which to extract the tag value. + minLength: 1 + type: string + required: + - name + type: object + formatter: + description: Formatter adds the value of access logging substitution formatter. + properties: + value: + description: The formatter tag value to use, same formatter as HTTP access logging (e.g. + minLength: 1 + type: string + required: + - value + type: object + header: + description: RequestHeader adds the value of an header from the request to each span. + properties: + defaultValue: + description: Optional. + type: string + name: + description: Name of the header from which to extract the tag value. + minLength: 1 + type: string + required: + - name + type: object + literal: + description: Literal adds the same, hard-coded value to each span. + properties: + value: + description: The tag value to use. + minLength: 1 + type: string + required: + - value + type: object + type: object + description: Optional. + type: object + disableSpanReporting: + description: Controls span reporting. + nullable: true + type: boolean + enableIstioTags: + description: Determines whether or not trace spans generated by Envoy will include Istio specific tags. + nullable: true + type: boolean + match: + description: Allows tailoring of behavior to specific conditions. properties: - environment: - description: Environment adds the value of an environment - variable to each span. - properties: - defaultValue: - description: Optional. - type: string - name: - description: Name of the environment variable from - which to extract the tag value. - minLength: 1 - type: string - required: - - name - type: object - formatter: - description: Formatter adds the value of access logging - substitution formatter. - properties: - value: - description: The formatter tag value to use, same - formatter as HTTP access logging (e.g. - minLength: 1 - type: string - required: - - value - type: object - header: - description: RequestHeader adds the value of an header - from the request to each span. - properties: - defaultValue: - description: Optional. - type: string - name: - description: Name of the header from which to extract - the tag value. - minLength: 1 - type: string - required: - - name - type: object - literal: - description: Literal adds the same, hard-coded value to - each span. - properties: - value: - description: The tag value to use. - minLength: 1 - type: string - required: - - value - type: object + mode: + description: |- + This determines whether or not to apply the tracing configuration based on the direction of traffic relative to the proxied workload. + + Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER + enum: + - CLIENT_AND_SERVER + - CLIENT + - SERVER + type: string type: object - description: Optional. - type: object - disableSpanReporting: - description: Controls span reporting. - nullable: true - type: boolean - enableIstioTags: - description: Determines whether or not trace spans generated - by Envoy will include Istio specific tags. - nullable: true - type: boolean - match: - description: Allows tailoring of behavior to specific conditions. - properties: - mode: - description: |- - This determines whether or not to apply the tracing configuration based on the direction of traffic relative to the proxied workload. + providers: + description: Optional. + items: + properties: + name: + description: Required. + minLength: 1 + type: string + required: + - name + type: object + type: array + randomSamplingPercentage: + description: Controls the rate at which traffic will be selected for tracing if no prior sampling decision has been made. + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + useRequestIdForTraceSampling: + nullable: true + type: boolean + type: object + type: array + type: object + x-kubernetes-validations: + - message: only one of targetRefs or selector can be set + rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + (has(self.targetRefs) ? 1 : 0) <= 1' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. + type: string + level: + description: |- + Represents how severe a message is. - Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER - enum: - - CLIENT_AND_SERVER - - CLIENT - - SERVER - type: string - type: object - providers: - description: Optional. - items: + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string name: - description: Required. - minLength: 1 + description: A human-readable name for the message type. type: string - required: - - name type: object - type: array - randomSamplingPercentage: - description: Controls the rate at which traffic will be selected - for tracing if no prior sampling decision has been made. - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - useRequestIdForTraceSampling: - nullable: true - type: boolean - type: object - type: array - type: object - x-kubernetes-validations: - - message: only one of targetRefs or selector can be set - rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) - + (has(self.targetRefs) ? 1 : 0) <= 1' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. - - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} - - additionalPrinterColumns: - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is represented - in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for - lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1alpha1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Telemetry configuration for workloads. See more details - at: https://istio.io/docs/reference/config/telemetry.html' - properties: - accessLogging: - description: Optional. - items: - properties: - disabled: - description: Controls logging. - nullable: true - type: boolean - filter: - description: Optional. - properties: - expression: - description: CEL expression for selecting when requests/connections - should be logged. - type: string - type: object - match: - description: Allows tailoring of logging behavior to specific - conditions. - properties: - mode: - description: |- - This determines whether or not to apply the access logging configuration based on the direction of traffic relative to the proxied workload. - - Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER - enum: - - CLIENT_AND_SERVER - - CLIENT - - SERVER - type: string - type: object - providers: - description: Optional. - items: + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Telemetry configuration for workloads. See more details at: https://istio.io/docs/reference/config/telemetry.html' + properties: + accessLogging: + description: Optional. + items: + properties: + disabled: + description: Controls logging. + nullable: true + type: boolean + filter: + description: Optional. properties: - name: - description: Required. - minLength: 1 + expression: + description: CEL expression for selecting when requests/connections should be logged. type: string - required: - - name type: object - type: array - type: object - type: array - metrics: - description: Optional. - items: - properties: - overrides: - description: Optional. - items: + match: + description: Allows tailoring of logging behavior to specific conditions. properties: - disabled: - description: Optional. - nullable: true - type: boolean - match: - description: Match allows providing the scope of the override. - oneOf: - - not: - anyOf: + mode: + description: |- + This determines whether or not to apply the access logging configuration based on the direction of traffic relative to the proxied workload. + + Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER + enum: + - CLIENT_AND_SERVER + - CLIENT + - SERVER + type: string + type: object + providers: + description: Optional. + items: + properties: + name: + description: Required. + minLength: 1 + type: string + required: + - name + type: object + type: array + type: object + type: array + metrics: + description: Optional. + items: + properties: + overrides: + description: Optional. + items: + properties: + disabled: + description: Optional. + nullable: true + type: boolean + match: + description: Match allows providing the scope of the override. + oneOf: + - not: + anyOf: + - required: + - metric + - required: + - customMetric - required: - - metric + - metric - required: - - customMetric - - required: - - metric - - required: - - customMetric - properties: - customMetric: - description: Allows free-form specification of a metric. - minLength: 1 - type: string - metric: - description: |- - One of the well-known [Istio Standard Metrics](https://istio.io/latest/docs/reference/config/metrics/). - - Valid Options: ALL_METRICS, REQUEST_COUNT, REQUEST_DURATION, REQUEST_SIZE, RESPONSE_SIZE, TCP_OPENED_CONNECTIONS, TCP_CLOSED_CONNECTIONS, TCP_SENT_BYTES, TCP_RECEIVED_BYTES, GRPC_REQUEST_MESSAGES, GRPC_RESPONSE_MESSAGES - enum: - - ALL_METRICS - - REQUEST_COUNT - - REQUEST_DURATION - - REQUEST_SIZE - - RESPONSE_SIZE - - TCP_OPENED_CONNECTIONS - - TCP_CLOSED_CONNECTIONS - - TCP_SENT_BYTES - - TCP_RECEIVED_BYTES - - GRPC_REQUEST_MESSAGES - - GRPC_RESPONSE_MESSAGES - type: string - mode: - description: |- - Controls which mode of metrics generation is selected: `CLIENT`, `SERVER`, or `CLIENT_AND_SERVER`. - - Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER - enum: - - CLIENT_AND_SERVER - - CLIENT - - SERVER - type: string - type: object - tagOverrides: - additionalProperties: + - customMetric properties: - operation: + customMetric: + description: Allows free-form specification of a metric. + minLength: 1 + type: string + metric: description: |- - Operation controls whether or not to update/add a tag, or to remove it. + One of the well-known [Istio Standard Metrics](https://istio.io/latest/docs/reference/config/metrics/). - Valid Options: UPSERT, REMOVE + Valid Options: ALL_METRICS, REQUEST_COUNT, REQUEST_DURATION, REQUEST_SIZE, RESPONSE_SIZE, TCP_OPENED_CONNECTIONS, TCP_CLOSED_CONNECTIONS, TCP_SENT_BYTES, TCP_RECEIVED_BYTES, GRPC_REQUEST_MESSAGES, GRPC_RESPONSE_MESSAGES enum: - - UPSERT - - REMOVE + - ALL_METRICS + - REQUEST_COUNT + - REQUEST_DURATION + - REQUEST_SIZE + - RESPONSE_SIZE + - TCP_OPENED_CONNECTIONS + - TCP_CLOSED_CONNECTIONS + - TCP_SENT_BYTES + - TCP_RECEIVED_BYTES + - GRPC_REQUEST_MESSAGES + - GRPC_RESPONSE_MESSAGES type: string - value: - description: Value is only considered if the operation - is `UPSERT`. + mode: + description: |- + Controls which mode of metrics generation is selected: `CLIENT`, `SERVER`, or `CLIENT_AND_SERVER`. + + Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER + enum: + - CLIENT_AND_SERVER + - CLIENT + - SERVER type: string type: object - x-kubernetes-validations: - - message: value must be set when operation is UPSERT - rule: '((has(self.operation) ? self.operation : "") - == "UPSERT") ? (self.value != "") : true' - - message: value must not be set when operation is REMOVE - rule: '((has(self.operation) ? self.operation : "") - == "REMOVE") ? !has(self.value) : true' - description: Optional. - type: object - type: object - type: array - providers: - description: Optional. - items: - properties: - name: - description: Required. - minLength: 1 - type: string - required: - - name - type: object - type: array - reportingInterval: - description: Optional. - type: string + tagOverrides: + additionalProperties: + properties: + operation: + description: |- + Operation controls whether or not to update/add a tag, or to remove it. + + Valid Options: UPSERT, REMOVE + enum: + - UPSERT + - REMOVE + type: string + value: + description: Value is only considered if the operation is `UPSERT`. + type: string + type: object + x-kubernetes-validations: + - message: value must be set when operation is UPSERT + rule: '((has(self.operation) ? self.operation : "") == "UPSERT") ? (self.value != "") : true' + - message: value must not be set when operation is REMOVE + rule: '((has(self.operation) ? self.operation : "") == "REMOVE") ? !has(self.value) : true' + description: Optional. + type: object + type: object + type: array + providers: + description: Optional. + items: + properties: + name: + description: Required. + minLength: 1 + type: string + required: + - name + type: object + type: array + reportingInterval: + description: Optional. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + type: array + selector: + description: Optional. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) type: object - type: array - selector: - description: Optional. - properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of - pods/VMs on which a policy should be applied. - maxProperties: 4096 - type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) - type: object - targetRef: - properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: name is the name of the target resource. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: namespace is the namespace of the referent. - type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 - required: - - kind - - name - type: object - targetRefs: - description: Optional. - items: + targetRef: properties: group: description: group is the group of the target resource. @@ -12629,229 +11278,244 @@ spec: description: namespace is the namespace of the referent. type: string x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 required: - - kind - - name + - kind + - name type: object - maxItems: 16 - type: array - tracing: - description: Optional. - items: - properties: - customTags: - additionalProperties: - oneOf: - - not: - anyOf: + targetRefs: + description: Optional. + items: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name + type: object + maxItems: 16 + type: array + tracing: + description: Optional. + items: + properties: + customTags: + additionalProperties: + oneOf: + - not: + anyOf: + - required: + - literal + - required: + - environment + - required: + - header + - required: + - formatter - required: - - literal + - literal - required: - - environment + - environment - required: - - header + - header - required: - - formatter - - required: - - literal - - required: - - environment - - required: - - header - - required: - - formatter + - formatter + properties: + environment: + description: Environment adds the value of an environment variable to each span. + properties: + defaultValue: + description: Optional. + type: string + name: + description: Name of the environment variable from which to extract the tag value. + minLength: 1 + type: string + required: + - name + type: object + formatter: + description: Formatter adds the value of access logging substitution formatter. + properties: + value: + description: The formatter tag value to use, same formatter as HTTP access logging (e.g. + minLength: 1 + type: string + required: + - value + type: object + header: + description: RequestHeader adds the value of an header from the request to each span. + properties: + defaultValue: + description: Optional. + type: string + name: + description: Name of the header from which to extract the tag value. + minLength: 1 + type: string + required: + - name + type: object + literal: + description: Literal adds the same, hard-coded value to each span. + properties: + value: + description: The tag value to use. + minLength: 1 + type: string + required: + - value + type: object + type: object + description: Optional. + type: object + disableSpanReporting: + description: Controls span reporting. + nullable: true + type: boolean + enableIstioTags: + description: Determines whether or not trace spans generated by Envoy will include Istio specific tags. + nullable: true + type: boolean + match: + description: Allows tailoring of behavior to specific conditions. properties: - environment: - description: Environment adds the value of an environment - variable to each span. - properties: - defaultValue: - description: Optional. - type: string - name: - description: Name of the environment variable from - which to extract the tag value. - minLength: 1 - type: string - required: - - name - type: object - formatter: - description: Formatter adds the value of access logging - substitution formatter. - properties: - value: - description: The formatter tag value to use, same - formatter as HTTP access logging (e.g. - minLength: 1 - type: string - required: - - value - type: object - header: - description: RequestHeader adds the value of an header - from the request to each span. - properties: - defaultValue: - description: Optional. - type: string - name: - description: Name of the header from which to extract - the tag value. - minLength: 1 - type: string - required: - - name - type: object - literal: - description: Literal adds the same, hard-coded value to - each span. - properties: - value: - description: The tag value to use. - minLength: 1 - type: string - required: - - value - type: object + mode: + description: |- + This determines whether or not to apply the tracing configuration based on the direction of traffic relative to the proxied workload. + + Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER + enum: + - CLIENT_AND_SERVER + - CLIENT + - SERVER + type: string type: object - description: Optional. - type: object - disableSpanReporting: - description: Controls span reporting. - nullable: true - type: boolean - enableIstioTags: - description: Determines whether or not trace spans generated - by Envoy will include Istio specific tags. - nullable: true - type: boolean - match: - description: Allows tailoring of behavior to specific conditions. - properties: - mode: - description: |- - This determines whether or not to apply the tracing configuration based on the direction of traffic relative to the proxied workload. + providers: + description: Optional. + items: + properties: + name: + description: Required. + minLength: 1 + type: string + required: + - name + type: object + type: array + randomSamplingPercentage: + description: Controls the rate at which traffic will be selected for tracing if no prior sampling decision has been made. + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + useRequestIdForTraceSampling: + nullable: true + type: boolean + type: object + type: array + type: object + x-kubernetes-validations: + - message: only one of targetRefs or selector can be set + rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + (has(self.targetRefs) ? 1 : 0) <= 1' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. + type: string + level: + description: |- + Represents how severe a message is. - Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER - enum: - - CLIENT_AND_SERVER - - CLIENT - - SERVER - type: string - type: object - providers: - description: Optional. - items: + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string name: - description: Required. - minLength: 1 + description: A human-readable name for the message type. type: string - required: - - name type: object - type: array - randomSamplingPercentage: - description: Controls the rate at which traffic will be selected - for tracing if no prior sampling decision has been made. - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - useRequestIdForTraceSampling: - nullable: true - type: boolean - type: object - type: array - type: object - x-kubernetes-validations: - - message: only one of targetRefs or selector can be set - rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) - + (has(self.targetRefs) ? 1 : 0) <= 1' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. - - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -12869,359 +11533,298 @@ spec: group: networking.istio.io names: categories: - - istio-io - - networking-istio-io + - istio-io + - networking-istio-io kind: VirtualService listKind: VirtualServiceList plural: virtualservices shortNames: - - vs + - vs singular: virtualservice scope: Namespaced versions: - - additionalPrinterColumns: - - description: The names of gateways and sidecars that should apply these routes - jsonPath: .spec.gateways - name: Gateways - type: string - - description: The destination hosts to which traffic is being sent - jsonPath: .spec.hosts - name: Hosts - type: string - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is represented - in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for - lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting label/content routing, sni routing, - etc. See more details at: https://istio.io/docs/reference/config/networking/virtual-service.html' - properties: - exportTo: - description: A list of namespaces to which this virtual service is - exported. - items: - type: string - type: array - gateways: - description: The names of gateways and sidecars that should apply - these routes. - items: - type: string - type: array - hosts: - description: The destination hosts to which traffic is being sent. - items: - type: string - type: array - http: - description: An ordered list of route rules for HTTP traffic. - items: - properties: - corsPolicy: - description: Cross-Origin Resource Sharing policy (CORS). - properties: - allowCredentials: - description: Indicates whether the caller is allowed to - send the actual request (not the preflight) using credentials. - nullable: true - type: boolean - allowHeaders: - description: List of HTTP headers that can be used when - requesting the resource. - items: + - additionalPrinterColumns: + - description: The names of gateways and sidecars that should apply these routes + jsonPath: .spec.gateways + name: Gateways + type: string + - description: The destination hosts to which traffic is being sent + jsonPath: .spec.hosts + name: Hosts + type: string + - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting label/content routing, sni routing, etc. See more details at: https://istio.io/docs/reference/config/networking/virtual-service.html' + properties: + exportTo: + description: A list of namespaces to which this virtual service is exported. + items: + type: string + type: array + gateways: + description: The names of gateways and sidecars that should apply these routes. + items: + type: string + type: array + hosts: + description: The destination hosts to which traffic is being sent. + items: + type: string + type: array + http: + description: An ordered list of route rules for HTTP traffic. + items: + properties: + corsPolicy: + description: Cross-Origin Resource Sharing policy (CORS). + properties: + allowCredentials: + description: Indicates whether the caller is allowed to send the actual request (not the preflight) using credentials. + nullable: true + type: boolean + allowHeaders: + description: List of HTTP headers that can be used when requesting the resource. + items: + type: string + type: array + allowMethods: + description: List of HTTP methods allowed to access the resource. + items: + type: string + type: array + allowOrigin: + items: + type: string + type: array + allowOrigins: + description: String patterns that match allowed origins. + items: + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + type: array + exposeHeaders: + description: A list of HTTP headers that the browsers are allowed to access. + items: + type: string + type: array + maxAge: + description: Specifies how long the results of a preflight request can be cached. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + unmatchedPreflights: + description: |- + Indicates whether preflight requests not matching the configured allowed origin shouldn't be forwarded to the upstream. + + Valid Options: FORWARD, IGNORE + enum: + - UNSPECIFIED + - FORWARD + - IGNORE type: string - type: array - allowMethods: - description: List of HTTP methods allowed to access the - resource. - items: + type: object + delegate: + description: Delegate is used to specify the particular VirtualService which can be used to define delegate HTTPRoute. + properties: + name: + description: Name specifies the name of the delegate VirtualService. type: string - type: array - allowOrigin: - items: + namespace: + description: Namespace specifies the namespace where the delegate VirtualService resides. type: string - type: array - allowOrigins: - description: String patterns that match allowed origins. - items: + type: object + directResponse: + description: A HTTP rule can either return a direct_response, redirect or forward (default) traffic. + properties: + body: + description: Specifies the content of the response body. oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex + - not: + anyOf: + - required: + - string + - required: + - bytes + - required: + - string + - required: + - bytes properties: - exact: + bytes: + description: response body as base64 encoded bytes. + format: byte type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + string: type: string type: object - type: array - exposeHeaders: - description: A list of HTTP headers that the browsers are - allowed to access. - items: - type: string - type: array - maxAge: - description: Specifies how long the results of a preflight - request can be cached. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - unmatchedPreflights: - description: |- - Indicates whether preflight requests not matching the configured allowed origin shouldn't be forwarded to the upstream. - - Valid Options: FORWARD, IGNORE - enum: - - UNSPECIFIED - - FORWARD - - IGNORE - type: string - type: object - delegate: - description: Delegate is used to specify the particular VirtualService - which can be used to define delegate HTTPRoute. - properties: - name: - description: Name specifies the name of the delegate VirtualService. - type: string - namespace: - description: Namespace specifies the namespace where the - delegate VirtualService resides. - type: string - type: object - directResponse: - description: A HTTP rule can either return a direct_response, - redirect or forward (default) traffic. - properties: - body: - description: Specifies the content of the response body. - oneOf: - - not: - anyOf: - - required: - - string - - required: - - bytes - - required: - - string - - required: - - bytes - properties: - bytes: - description: response body as base64 encoded bytes. - format: byte - type: string - string: - type: string - type: object - status: - description: Specifies the HTTP response status to be returned. - maximum: 4294967295 - minimum: 0 - type: integer - required: - - status - type: object - fault: - description: Fault injection policy to apply on HTTP traffic - at the client side. - properties: - abort: - description: Abort Http request attempts and return error - codes back to downstream service, giving the impression - that the upstream service is faulty. - oneOf: - - not: - anyOf: - - required: - - httpStatus - - required: - - grpcStatus + status: + description: Specifies the HTTP response status to be returned. + maximum: 4294967295 + minimum: 0 + type: integer + required: + - status + type: object + fault: + description: Fault injection policy to apply on HTTP traffic at the client side. + properties: + abort: + description: Abort Http request attempts and return error codes back to downstream service, giving the impression that the upstream service is faulty. + oneOf: + - not: + anyOf: + - required: + - httpStatus + - required: + - grpcStatus + - required: + - http2Error - required: - - http2Error - - required: - - httpStatus - - required: - - grpcStatus - - required: - - http2Error - properties: - grpcStatus: - description: GRPC status code to use to abort the request. - type: string - http2Error: - type: string - httpStatus: - description: HTTP status code to use to abort the Http - request. - format: int32 - type: integer - percentage: - description: Percentage of requests to be aborted with - the error code provided. - properties: - value: - format: double - type: number - type: object - type: object - delay: - description: Delay requests before forwarding, emulating - various failures such as network issues, overloaded upstream - service, etc. - oneOf: - - not: - anyOf: + - httpStatus - required: - - fixedDelay + - grpcStatus - required: - - exponentialDelay - - required: - - fixedDelay - - required: - - exponentialDelay - properties: - exponentialDelay: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - fixedDelay: - description: Add a fixed delay before forwarding the - request. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - percent: - description: Percentage of requests on which the delay - will be injected (0-100). - format: int32 - type: integer - percentage: - description: Percentage of requests on which the delay - will be injected. - properties: - value: - format: double - type: number - type: object - type: object - type: object - headers: - properties: - request: - properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object - type: object - response: - properties: - add: - additionalProperties: - type: string - type: object - remove: - items: + - http2Error + properties: + grpcStatus: + description: GRPC status code to use to abort the request. type: string - type: array - set: - additionalProperties: + http2Error: type: string - type: object - type: object - type: object - match: - description: Match conditions to be satisfied for the rule to - be activated. - items: - properties: - authority: - description: 'HTTP Authority values are case-sensitive - and formatted as follows: - `exact: "value"` for exact - string match - `prefix: "value"` for prefix-based match - - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + httpStatus: + description: HTTP status code to use to abort the Http request. + format: int32 + type: integer + percentage: + description: Percentage of requests to be aborted with the error code provided. + properties: + value: + format: double + type: number + type: object + type: object + delay: + description: Delay requests before forwarding, emulating various failures such as network issues, overloaded upstream service, etc. oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex + - not: + anyOf: + - required: + - fixedDelay + - required: + - exponentialDelay + - required: + - fixedDelay + - required: + - exponentialDelay properties: - exact: - type: string - prefix: + exponentialDelay: type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + fixedDelay: + description: Add a fixed delay before forwarding the request. type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + percent: + description: Percentage of requests on which the delay will be injected (0-100). + format: int32 + type: integer + percentage: + description: Percentage of requests on which the delay will be injected. + properties: + value: + format: double + type: number + type: object type: object - gateways: - description: Names of gateways where the rule should be - applied. - items: - type: string - type: array - headers: - additionalProperties: + type: object + headers: + properties: + request: + properties: + add: + additionalProperties: + type: string + type: object + remove: + items: + type: string + type: array + set: + additionalProperties: + type: string + type: object + type: object + response: + properties: + add: + additionalProperties: + type: string + type: object + remove: + items: + type: string + type: array + set: + additionalProperties: + type: string + type: object + type: object + type: object + match: + description: Match conditions to be satisfied for the rule to be activated. + items: + properties: + authority: + description: 'HTTP Authority values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' oneOf: - - not: - anyOf: - - required: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: - exact - - required: + - required: - prefix - - required: + - required: - regex - - required: - - exact - - required: - - prefix - - required: - - regex properties: exact: type: string @@ -13231,68 +11834,59 @@ spec: description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string type: object - description: The header keys must be lowercase and use - hyphen as the separator, e.g. - type: object - ignoreUriCase: - description: Flag to specify whether the URI matching - should be case-insensitive. - type: boolean - method: - description: 'HTTP Method values are case-sensitive and - formatted as follows: - `exact: "value"` for exact string - match - `prefix: "value"` for prefix-based match - `regex: - "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + gateways: + description: Names of gateways where the rule should be applied. + items: type: string - type: object - name: - description: The name assigned to a match. - type: string - port: - description: Specifies the ports on the host that is being - addressed. - maximum: 4294967295 - minimum: 0 - type: integer - queryParams: - additionalProperties: - oneOf: - - not: - anyOf: + type: array + headers: + additionalProperties: + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact - required: + - prefix + - required: + - regex + properties: + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + description: The header keys must be lowercase and use hyphen as the separator, e.g. + type: object + ignoreUriCase: + description: Flag to specify whether the URI matching should be case-insensitive. + type: boolean + method: + description: 'HTTP Method values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: - exact - - required: + - required: - prefix - - required: + - required: - regex - - required: - - exact - - required: - - prefix - - required: - - regex properties: exact: type: string @@ -13302,98 +11896,96 @@ spec: description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string type: object - description: Query parameters for matching. - type: object - scheme: - description: 'URI Scheme values are case-sensitive and - formatted as follows: - `exact: "value"` for exact string - match - `prefix: "value"` for prefix-based match - `regex: - "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - sourceLabels: - additionalProperties: + name: + description: The name assigned to a match. type: string - description: One or more labels that constrain the applicability - of a rule to source (client) workloads with the given - labels. - type: object - sourceNamespace: - description: Source namespace constraining the applicability - of a rule to workloads in that namespace. - type: string - statPrefix: - description: The human readable prefix to use when emitting - statistics for this route. - type: string - uri: - description: 'URI to match values are case-sensitive and - formatted as follows: - `exact: "value"` for exact string - match - `prefix: "value"` for prefix-based match - `regex: - "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - oneOf: - - not: - anyOf: + port: + description: Specifies the ports on the host that is being addressed. + maximum: 4294967295 + minimum: 0 + type: integer + queryParams: + additionalProperties: + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + description: Query parameters for matching. + type: object + scheme: + description: 'URI Scheme values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex - required: - - exact + - exact - required: - - prefix + - prefix - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + - regex + properties: + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + sourceLabels: + additionalProperties: type: string - type: object - withoutHeaders: - additionalProperties: + description: One or more labels that constrain the applicability of a rule to source (client) workloads with the given labels. + type: object + sourceNamespace: + description: Source namespace constraining the applicability of a rule to workloads in that namespace. + type: string + statPrefix: + description: The human readable prefix to use when emitting statistics for this route. + type: string + uri: + description: 'URI to match values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' oneOf: - - not: - anyOf: - - required: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: - exact - - required: + - required: - prefix - - required: + - required: - regex - - required: - - exact - - required: - - prefix - - required: - - regex properties: exact: type: string @@ -13403,877 +11995,577 @@ spec: description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string type: object - description: withoutHeader has the same syntax with the - header, but has opposite meaning. - type: object - type: object - type: array - mirror: - description: Mirror HTTP traffic to a another destination in - addition to forwarding the requests to the intended destination. - properties: - host: - description: The name of a service from the service registry. - type: string - port: - description: Specifies the port on the host that is being - addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - mirrorPercent: - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - mirrorPercentage: - description: Percentage of the traffic to be mirrored by the - `mirror` field. - properties: - value: - format: double - type: number - type: object - mirror_percent: - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - mirrors: - description: Specifies the destinations to mirror HTTP traffic - in addition to the original destination. - items: - properties: - destination: - description: Destination specifies the target of the mirror - operation. - properties: - host: - description: The name of a service from the service - registry. - type: string - port: - description: Specifies the port on the host that is - being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - percentage: - description: Percentage of the traffic to be mirrored - by the `destination` field. - properties: - value: - format: double - type: number - type: object - required: - - destination - type: object - type: array - name: - description: The name assigned to the route for debugging purposes. - type: string - redirect: - description: A HTTP rule can either return a direct_response, - redirect or forward (default) traffic. - oneOf: - - not: - anyOf: - - required: - - port - - required: - - derivePort - - required: - - port - - required: - - derivePort - properties: - authority: - description: On a redirect, overwrite the Authority/Host - portion of the URL with this value. - type: string - derivePort: - description: |- - On a redirect, dynamically set the port: * FROM_PROTOCOL_DEFAULT: automatically set to 80 for HTTP and 443 for HTTPS. - - Valid Options: FROM_PROTOCOL_DEFAULT, FROM_REQUEST_PORT - enum: - - FROM_PROTOCOL_DEFAULT - - FROM_REQUEST_PORT - type: string - port: - description: On a redirect, overwrite the port portion of - the URL with this value. - maximum: 4294967295 - minimum: 0 - type: integer - redirectCode: - description: On a redirect, Specifies the HTTP status code - to use in the redirect response. - maximum: 4294967295 - minimum: 0 - type: integer - scheme: - description: On a redirect, overwrite the scheme portion - of the URL with this value. - type: string - uri: - description: On a redirect, overwrite the Path portion of - the URL with this value. - type: string - type: object - retries: - description: Retry policy for HTTP requests. - properties: - attempts: - description: Number of retries to be allowed for a given - request. - format: int32 - type: integer - backoff: - description: Specifies the minimum duration between retry - attempts. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - perTryTimeout: - description: Timeout per attempt for a given request, including - the initial call and any retries. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - retryIgnorePreviousHosts: - description: Flag to specify whether the retries should - ignore previously tried hosts during retry. - nullable: true - type: boolean - retryOn: - description: Specifies the conditions under which retry - takes place. - type: string - retryRemoteLocalities: - description: Flag to specify whether the retries should - retry to other localities. - nullable: true - type: boolean - type: object - rewrite: - description: Rewrite HTTP URIs and Authority headers. - properties: - authority: - description: rewrite the Authority/Host header with this - value. - type: string - uri: - description: rewrite the path (or the prefix) portion of - the URI with this value. - type: string - uriRegexRewrite: - description: rewrite the path portion of the URI with the - specified regex. - properties: - match: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - rewrite: - description: The string that should replace into matching - portions of original URI. - type: string - type: object - type: object - route: - description: A HTTP rule can either return a direct_response, - redirect or forward (default) traffic. - items: - properties: - destination: - description: Destination uniquely identifies the instances - of a service to which the request/connection should - be forwarded to. - properties: - host: - description: The name of a service from the service - registry. - type: string - port: - description: Specifies the port on the host that is - being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - headers: - properties: - request: - properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object - type: object - response: + withoutHeaders: + additionalProperties: + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string type: object - type: object - weight: - description: Weight specifies the relative proportion - of traffic to be forwarded to the destination. - format: int32 - type: integer - required: - - destination - type: object - type: array - timeout: - description: Timeout for HTTP requests, default is disabled. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: array - tcp: - description: An ordered list of route rules for opaque TCP traffic. - items: - properties: - match: - description: Match conditions to be satisfied for the rule to - be activated. - items: - properties: - destinationSubnets: - description: IPv4 or IPv6 ip addresses of destination - with optional subnet. - items: - type: string - type: array - gateways: - description: Names of gateways where the rule should be - applied. - items: - type: string - type: array + description: withoutHeader has the same syntax with the header, but has opposite meaning. + type: object + type: object + type: array + mirror: + description: Mirror HTTP traffic to a another destination in addition to forwarding the requests to the intended destination. + properties: + host: + description: The name of a service from the service registry. + type: string port: - description: Specifies the port on the host that is being - addressed. - maximum: 4294967295 - minimum: 0 - type: integer - sourceLabels: - additionalProperties: - type: string - description: One or more labels that constrain the applicability - of a rule to workloads with the given labels. + description: Specifies the port on the host that is being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer type: object - sourceNamespace: - description: Source namespace constraining the applicability - of a rule to workloads in that namespace. - type: string - sourceSubnet: + subset: + description: The name of a subset within the service. type: string + required: + - host type: object - type: array - route: - description: The destination to which the connection should - be forwarded to. - items: + mirror_percent: + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + mirrorPercent: + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + mirrorPercentage: + description: Percentage of the traffic to be mirrored by the `mirror` field. properties: - destination: - description: Destination uniquely identifies the instances - of a service to which the request/connection should - be forwarded to. - properties: - host: - description: The name of a service from the service - registry. - type: string - port: - description: Specifies the port on the host that is - being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - weight: - description: Weight specifies the relative proportion - of traffic to be forwarded to the destination. - format: int32 - type: integer - required: - - destination + value: + format: double + type: number type: object - type: array - type: object - type: array - tls: - description: An ordered list of route rule for non-terminated TLS - & HTTPS traffic. - items: - properties: - match: - description: Match conditions to be satisfied for the rule to - be activated. - items: + mirrors: + description: Specifies the destinations to mirror HTTP traffic in addition to the original destination. + items: + properties: + destination: + description: Destination specifies the target of the mirror operation. + properties: + host: + description: The name of a service from the service registry. + type: string + port: + description: Specifies the port on the host that is being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + percentage: + description: Percentage of the traffic to be mirrored by the `destination` field. + properties: + value: + format: double + type: number + type: object + required: + - destination + type: object + type: array + name: + description: The name assigned to the route for debugging purposes. + type: string + redirect: + description: A HTTP rule can either return a direct_response, redirect or forward (default) traffic. + oneOf: + - not: + anyOf: + - required: + - port + - required: + - derivePort + - required: + - port + - required: + - derivePort properties: - destinationSubnets: - description: IPv4 or IPv6 ip addresses of destination - with optional subnet. - items: - type: string - type: array - gateways: - description: Names of gateways where the rule should be - applied. - items: - type: string - type: array + authority: + description: On a redirect, overwrite the Authority/Host portion of the URL with this value. + type: string + derivePort: + description: |- + On a redirect, dynamically set the port: * FROM_PROTOCOL_DEFAULT: automatically set to 80 for HTTP and 443 for HTTPS. + + Valid Options: FROM_PROTOCOL_DEFAULT, FROM_REQUEST_PORT + enum: + - FROM_PROTOCOL_DEFAULT + - FROM_REQUEST_PORT + type: string port: - description: Specifies the port on the host that is being - addressed. + description: On a redirect, overwrite the port portion of the URL with this value. maximum: 4294967295 minimum: 0 type: integer - sniHosts: - description: SNI (server name indicator) to match on. - items: - type: string - type: array - sourceLabels: - additionalProperties: - type: string - description: One or more labels that constrain the applicability - of a rule to workloads with the given labels. - type: object - sourceNamespace: - description: Source namespace constraining the applicability - of a rule to workloads in that namespace. + redirectCode: + description: On a redirect, Specifies the HTTP status code to use in the redirect response. + maximum: 4294967295 + minimum: 0 + type: integer + scheme: + description: On a redirect, overwrite the scheme portion of the URL with this value. + type: string + uri: + description: On a redirect, overwrite the Path portion of the URL with this value. type: string - required: - - sniHosts type: object - type: array - route: - description: The destination to which the connection should - be forwarded to. - items: + retries: + description: Retry policy for HTTP requests. properties: - destination: - description: Destination uniquely identifies the instances - of a service to which the request/connection should - be forwarded to. - properties: - host: - description: The name of a service from the service - registry. - type: string - port: - description: Specifies the port on the host that is - being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - weight: - description: Weight specifies the relative proportion - of traffic to be forwarded to the destination. + attempts: + description: Number of retries to be allowed for a given request. format: int32 type: integer - required: - - destination - type: object - type: array - required: - - match - type: object - type: array - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. - - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} - - additionalPrinterColumns: - - description: The names of gateways and sidecars that should apply these routes - jsonPath: .spec.gateways - name: Gateways - type: string - - description: The destination hosts to which traffic is being sent - jsonPath: .spec.hosts - name: Hosts - type: string - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is represented - in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for - lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1alpha3 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting label/content routing, sni routing, - etc. See more details at: https://istio.io/docs/reference/config/networking/virtual-service.html' - properties: - exportTo: - description: A list of namespaces to which this virtual service is - exported. - items: - type: string - type: array - gateways: - description: The names of gateways and sidecars that should apply - these routes. - items: - type: string - type: array - hosts: - description: The destination hosts to which traffic is being sent. - items: - type: string - type: array - http: - description: An ordered list of route rules for HTTP traffic. - items: - properties: - corsPolicy: - description: Cross-Origin Resource Sharing policy (CORS). - properties: - allowCredentials: - description: Indicates whether the caller is allowed to - send the actual request (not the preflight) using credentials. - nullable: true - type: boolean - allowHeaders: - description: List of HTTP headers that can be used when - requesting the resource. - items: + backoff: + description: Specifies the minimum duration between retry attempts. type: string - type: array - allowMethods: - description: List of HTTP methods allowed to access the - resource. - items: + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + perTryTimeout: + description: Timeout per attempt for a given request, including the initial call and any retries. type: string - type: array - allowOrigin: - items: + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + retryIgnorePreviousHosts: + description: Flag to specify whether the retries should ignore previously tried hosts during retry. + nullable: true + type: boolean + retryOn: + description: Specifies the conditions under which retry takes place. type: string - type: array - allowOrigins: - description: String patterns that match allowed origins. - items: - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex + retryRemoteLocalities: + description: Flag to specify whether the retries should retry to other localities. + nullable: true + type: boolean + type: object + rewrite: + description: Rewrite HTTP URIs and Authority headers. + properties: + authority: + description: rewrite the Authority/Host header with this value. + type: string + uri: + description: rewrite the path (or the prefix) portion of the URI with this value. + type: string + uriRegexRewrite: + description: rewrite the path portion of the URI with the specified regex. properties: - exact: - type: string - prefix: - type: string - regex: + match: description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string + rewrite: + description: The string that should replace into matching portions of original URI. + type: string type: object - type: array - exposeHeaders: - description: A list of HTTP headers that the browsers are - allowed to access. - items: - type: string - type: array - maxAge: - description: Specifies how long the results of a preflight - request can be cached. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - unmatchedPreflights: - description: |- - Indicates whether preflight requests not matching the configured allowed origin shouldn't be forwarded to the upstream. - - Valid Options: FORWARD, IGNORE - enum: - - UNSPECIFIED - - FORWARD - - IGNORE - type: string - type: object - delegate: - description: Delegate is used to specify the particular VirtualService - which can be used to define delegate HTTPRoute. - properties: - name: - description: Name specifies the name of the delegate VirtualService. - type: string - namespace: - description: Namespace specifies the namespace where the - delegate VirtualService resides. - type: string - type: object - directResponse: - description: A HTTP rule can either return a direct_response, - redirect or forward (default) traffic. - properties: - body: - description: Specifies the content of the response body. - oneOf: - - not: - anyOf: - - required: - - string - - required: - - bytes - - required: - - string - - required: - - bytes - properties: - bytes: - description: response body as base64 encoded bytes. - format: byte - type: string - string: - type: string - type: object - status: - description: Specifies the HTTP response status to be returned. - maximum: 4294967295 - minimum: 0 - type: integer - required: - - status - type: object - fault: - description: Fault injection policy to apply on HTTP traffic - at the client side. - properties: - abort: - description: Abort Http request attempts and return error - codes back to downstream service, giving the impression - that the upstream service is faulty. - oneOf: - - not: - anyOf: - - required: - - httpStatus - - required: - - grpcStatus - - required: - - http2Error - - required: - - httpStatus - - required: - - grpcStatus - - required: - - http2Error + type: object + route: + description: A HTTP rule can either return a direct_response, redirect or forward (default) traffic. + items: properties: - grpcStatus: - description: GRPC status code to use to abort the request. - type: string - http2Error: - type: string - httpStatus: - description: HTTP status code to use to abort the Http - request. - format: int32 - type: integer - percentage: - description: Percentage of requests to be aborted with - the error code provided. + destination: + description: Destination uniquely identifies the instances of a service to which the request/connection should be forwarded to. properties: - value: - format: double - type: number + host: + description: The name of a service from the service registry. + type: string + port: + description: Specifies the port on the host that is being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + headers: + properties: + request: + properties: + add: + additionalProperties: + type: string + type: object + remove: + items: + type: string + type: array + set: + additionalProperties: + type: string + type: object + type: object + response: + properties: + add: + additionalProperties: + type: string + type: object + remove: + items: + type: string + type: array + set: + additionalProperties: + type: string + type: object + type: object type: object - type: object - delay: - description: Delay requests before forwarding, emulating - various failures such as network issues, overloaded upstream - service, etc. - oneOf: - - not: - anyOf: - - required: - - fixedDelay - - required: - - exponentialDelay - - required: - - fixedDelay - - required: - - exponentialDelay - properties: - exponentialDelay: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - fixedDelay: - description: Add a fixed delay before forwarding the - request. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - percent: - description: Percentage of requests on which the delay - will be injected (0-100). + weight: + description: Weight specifies the relative proportion of traffic to be forwarded to the destination. format: int32 type: integer - percentage: - description: Percentage of requests on which the delay - will be injected. - properties: - value: - format: double - type: number - type: object + required: + - destination type: object - type: object - headers: - properties: - request: + type: array + timeout: + description: Timeout for HTTP requests, default is disabled. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + type: array + tcp: + description: An ordered list of route rules for opaque TCP traffic. + items: + properties: + match: + description: Match conditions to be satisfied for the rule to be activated. + items: properties: - add: - additionalProperties: + destinationSubnets: + description: IPv4 or IPv6 ip addresses of destination with optional subnet. + items: type: string - type: object - remove: + type: array + gateways: + description: Names of gateways where the rule should be applied. items: type: string type: array - set: + port: + description: Specifies the port on the host that is being addressed. + maximum: 4294967295 + minimum: 0 + type: integer + sourceLabels: additionalProperties: type: string + description: One or more labels that constrain the applicability of a rule to workloads with the given labels. type: object + sourceNamespace: + description: Source namespace constraining the applicability of a rule to workloads in that namespace. + type: string + sourceSubnet: + type: string type: object - response: + type: array + route: + description: The destination to which the connection should be forwarded to. + items: properties: - add: - additionalProperties: - type: string + destination: + description: Destination uniquely identifies the instances of a service to which the request/connection should be forwarded to. + properties: + host: + description: The name of a service from the service registry. + type: string + port: + description: Specifies the port on the host that is being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host type: object - remove: + weight: + description: Weight specifies the relative proportion of traffic to be forwarded to the destination. + format: int32 + type: integer + required: + - destination + type: object + type: array + type: object + type: array + tls: + description: An ordered list of route rule for non-terminated TLS & HTTPS traffic. + items: + properties: + match: + description: Match conditions to be satisfied for the rule to be activated. + items: + properties: + destinationSubnets: + description: IPv4 or IPv6 ip addresses of destination with optional subnet. + items: + type: string + type: array + gateways: + description: Names of gateways where the rule should be applied. + items: + type: string + type: array + port: + description: Specifies the port on the host that is being addressed. + maximum: 4294967295 + minimum: 0 + type: integer + sniHosts: + description: SNI (server name indicator) to match on. items: type: string type: array - set: + sourceLabels: additionalProperties: type: string + description: One or more labels that constrain the applicability of a rule to workloads with the given labels. type: object + sourceNamespace: + description: Source namespace constraining the applicability of a rule to workloads in that namespace. + type: string + required: + - sniHosts type: object - type: object - match: - description: Match conditions to be satisfied for the rule to - be activated. - items: + type: array + route: + description: The destination to which the connection should be forwarded to. + items: + properties: + destination: + description: Destination uniquely identifies the instances of a service to which the request/connection should be forwarded to. + properties: + host: + description: The name of a service from the service registry. + type: string + port: + description: Specifies the port on the host that is being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + weight: + description: Weight specifies the relative proportion of traffic to be forwarded to the destination. + format: int32 + type: integer + required: + - destination + type: object + type: array + required: + - match + type: object + type: array + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: properties: - authority: - description: 'HTTP Authority values are case-sensitive - and formatted as follows: - `exact: "value"` for exact - string match - `prefix: "value"` for prefix-based match - - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - gateways: - description: Names of gateways where the rule should be - applied. + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - description: The names of gateways and sidecars that should apply these routes + jsonPath: .spec.gateways + name: Gateways + type: string + - description: The destination hosts to which traffic is being sent + jsonPath: .spec.hosts + name: Hosts + type: string + - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha3 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting label/content routing, sni routing, etc. See more details at: https://istio.io/docs/reference/config/networking/virtual-service.html' + properties: + exportTo: + description: A list of namespaces to which this virtual service is exported. + items: + type: string + type: array + gateways: + description: The names of gateways and sidecars that should apply these routes. + items: + type: string + type: array + hosts: + description: The destination hosts to which traffic is being sent. + items: + type: string + type: array + http: + description: An ordered list of route rules for HTTP traffic. + items: + properties: + corsPolicy: + description: Cross-Origin Resource Sharing policy (CORS). + properties: + allowCredentials: + description: Indicates whether the caller is allowed to send the actual request (not the preflight) using credentials. + nullable: true + type: boolean + allowHeaders: + description: List of HTTP headers that can be used when requesting the resource. items: type: string type: array - headers: - additionalProperties: + allowMethods: + description: List of HTTP methods allowed to access the resource. + items: + type: string + type: array + allowOrigin: + items: + type: string + type: array + allowOrigins: + description: String patterns that match allowed origins. + items: oneOf: - - not: - anyOf: - - required: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: - exact - - required: + - required: - prefix - - required: + - required: - regex - - required: - - exact - - required: - - prefix - - required: - - regex properties: exact: type: string @@ -14283,68 +12575,201 @@ spec: description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string type: object - description: The header keys must be lowercase and use - hyphen as the separator, e.g. + type: array + exposeHeaders: + description: A list of HTTP headers that the browsers are allowed to access. + items: + type: string + type: array + maxAge: + description: Specifies how long the results of a preflight request can be cached. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + unmatchedPreflights: + description: |- + Indicates whether preflight requests not matching the configured allowed origin shouldn't be forwarded to the upstream. + + Valid Options: FORWARD, IGNORE + enum: + - UNSPECIFIED + - FORWARD + - IGNORE + type: string + type: object + delegate: + description: Delegate is used to specify the particular VirtualService which can be used to define delegate HTTPRoute. + properties: + name: + description: Name specifies the name of the delegate VirtualService. + type: string + namespace: + description: Namespace specifies the namespace where the delegate VirtualService resides. + type: string + type: object + directResponse: + description: A HTTP rule can either return a direct_response, redirect or forward (default) traffic. + properties: + body: + description: Specifies the content of the response body. + oneOf: + - not: + anyOf: + - required: + - string + - required: + - bytes + - required: + - string + - required: + - bytes + properties: + bytes: + description: response body as base64 encoded bytes. + format: byte + type: string + string: + type: string type: object - ignoreUriCase: - description: Flag to specify whether the URI matching - should be case-insensitive. - type: boolean - method: - description: 'HTTP Method values are case-sensitive and - formatted as follows: - `exact: "value"` for exact string - match - `prefix: "value"` for prefix-based match - `regex: - "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + status: + description: Specifies the HTTP response status to be returned. + maximum: 4294967295 + minimum: 0 + type: integer + required: + - status + type: object + fault: + description: Fault injection policy to apply on HTTP traffic at the client side. + properties: + abort: + description: Abort Http request attempts and return error codes back to downstream service, giving the impression that the upstream service is faulty. oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex + - not: + anyOf: + - required: + - httpStatus + - required: + - grpcStatus + - required: + - http2Error + - required: + - httpStatus + - required: + - grpcStatus + - required: + - http2Error properties: - exact: + grpcStatus: + description: GRPC status code to use to abort the request. type: string - prefix: + http2Error: type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + httpStatus: + description: HTTP status code to use to abort the Http request. + format: int32 + type: integer + percentage: + description: Percentage of requests to be aborted with the error code provided. + properties: + value: + format: double + type: number + type: object + type: object + delay: + description: Delay requests before forwarding, emulating various failures such as network issues, overloaded upstream service, etc. + oneOf: + - not: + anyOf: + - required: + - fixedDelay + - required: + - exponentialDelay + - required: + - fixedDelay + - required: + - exponentialDelay + properties: + exponentialDelay: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + fixedDelay: + description: Add a fixed delay before forwarding the request. type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + percent: + description: Percentage of requests on which the delay will be injected (0-100). + format: int32 + type: integer + percentage: + description: Percentage of requests on which the delay will be injected. + properties: + value: + format: double + type: number + type: object + type: object + type: object + headers: + properties: + request: + properties: + add: + additionalProperties: + type: string + type: object + remove: + items: + type: string + type: array + set: + additionalProperties: + type: string + type: object + type: object + response: + properties: + add: + additionalProperties: + type: string + type: object + remove: + items: + type: string + type: array + set: + additionalProperties: + type: string + type: object type: object - name: - description: The name assigned to a match. - type: string - port: - description: Specifies the ports on the host that is being - addressed. - maximum: 4294967295 - minimum: 0 - type: integer - queryParams: - additionalProperties: + type: object + match: + description: Match conditions to be satisfied for the rule to be activated. + items: + properties: + authority: + description: 'HTTP Authority values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' oneOf: - - not: - anyOf: - - required: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: - exact - - required: + - required: - prefix - - required: + - required: - regex - - required: - - exact - - required: - - prefix - - required: - - regex properties: exact: type: string @@ -14354,98 +12779,59 @@ spec: description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string type: object - description: Query parameters for matching. - type: object - scheme: - description: 'URI Scheme values are case-sensitive and - formatted as follows: - `exact: "value"` for exact string - match - `prefix: "value"` for prefix-based match - `regex: - "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - sourceLabels: - additionalProperties: - type: string - description: One or more labels that constrain the applicability - of a rule to source (client) workloads with the given - labels. - type: object - sourceNamespace: - description: Source namespace constraining the applicability - of a rule to workloads in that namespace. - type: string - statPrefix: - description: The human readable prefix to use when emitting - statistics for this route. - type: string - uri: - description: 'URI to match values are case-sensitive and - formatted as follows: - `exact: "value"` for exact string - match - `prefix: "value"` for prefix-based match - `regex: - "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + gateways: + description: Names of gateways where the rule should be applied. + items: type: string - type: object - withoutHeaders: - additionalProperties: - oneOf: - - not: - anyOf: + type: array + headers: + additionalProperties: + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex - required: - - exact + - exact - required: - - prefix + - prefix - required: + - regex + properties: + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + description: The header keys must be lowercase and use hyphen as the separator, e.g. + type: object + ignoreUriCase: + description: Flag to specify whether the URI matching should be case-insensitive. + type: boolean + method: + description: 'HTTP Method values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: - regex - - required: - - exact - - required: - - prefix - - required: - - regex properties: exact: type: string @@ -14455,877 +12841,676 @@ spec: description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string type: object - description: withoutHeader has the same syntax with the - header, but has opposite meaning. - type: object - type: object - type: array - mirror: - description: Mirror HTTP traffic to a another destination in - addition to forwarding the requests to the intended destination. - properties: - host: - description: The name of a service from the service registry. - type: string - port: - description: Specifies the port on the host that is being - addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - mirrorPercent: - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - mirrorPercentage: - description: Percentage of the traffic to be mirrored by the - `mirror` field. - properties: - value: - format: double - type: number - type: object - mirror_percent: - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - mirrors: - description: Specifies the destinations to mirror HTTP traffic - in addition to the original destination. - items: - properties: - destination: - description: Destination specifies the target of the mirror - operation. - properties: - host: - description: The name of a service from the service - registry. - type: string - port: - description: Specifies the port on the host that is - being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - percentage: - description: Percentage of the traffic to be mirrored - by the `destination` field. - properties: - value: - format: double - type: number - type: object - required: - - destination - type: object - type: array - name: - description: The name assigned to the route for debugging purposes. - type: string - redirect: - description: A HTTP rule can either return a direct_response, - redirect or forward (default) traffic. - oneOf: - - not: - anyOf: - - required: - - port - - required: - - derivePort - - required: - - port - - required: - - derivePort - properties: - authority: - description: On a redirect, overwrite the Authority/Host - portion of the URL with this value. - type: string - derivePort: - description: |- - On a redirect, dynamically set the port: * FROM_PROTOCOL_DEFAULT: automatically set to 80 for HTTP and 443 for HTTPS. - - Valid Options: FROM_PROTOCOL_DEFAULT, FROM_REQUEST_PORT - enum: - - FROM_PROTOCOL_DEFAULT - - FROM_REQUEST_PORT - type: string - port: - description: On a redirect, overwrite the port portion of - the URL with this value. - maximum: 4294967295 - minimum: 0 - type: integer - redirectCode: - description: On a redirect, Specifies the HTTP status code - to use in the redirect response. - maximum: 4294967295 - minimum: 0 - type: integer - scheme: - description: On a redirect, overwrite the scheme portion - of the URL with this value. - type: string - uri: - description: On a redirect, overwrite the Path portion of - the URL with this value. - type: string - type: object - retries: - description: Retry policy for HTTP requests. - properties: - attempts: - description: Number of retries to be allowed for a given - request. - format: int32 - type: integer - backoff: - description: Specifies the minimum duration between retry - attempts. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - perTryTimeout: - description: Timeout per attempt for a given request, including - the initial call and any retries. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - retryIgnorePreviousHosts: - description: Flag to specify whether the retries should - ignore previously tried hosts during retry. - nullable: true - type: boolean - retryOn: - description: Specifies the conditions under which retry - takes place. - type: string - retryRemoteLocalities: - description: Flag to specify whether the retries should - retry to other localities. - nullable: true - type: boolean - type: object - rewrite: - description: Rewrite HTTP URIs and Authority headers. - properties: - authority: - description: rewrite the Authority/Host header with this - value. - type: string - uri: - description: rewrite the path (or the prefix) portion of - the URI with this value. - type: string - uriRegexRewrite: - description: rewrite the path portion of the URI with the - specified regex. - properties: - match: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - rewrite: - description: The string that should replace into matching - portions of original URI. - type: string - type: object - type: object - route: - description: A HTTP rule can either return a direct_response, - redirect or forward (default) traffic. - items: - properties: - destination: - description: Destination uniquely identifies the instances - of a service to which the request/connection should - be forwarded to. - properties: - host: - description: The name of a service from the service - registry. - type: string - port: - description: Specifies the port on the host that is - being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - headers: - properties: - request: - properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object - type: object - response: - properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object - type: object - type: object - weight: - description: Weight specifies the relative proportion - of traffic to be forwarded to the destination. - format: int32 - type: integer - required: - - destination - type: object - type: array - timeout: - description: Timeout for HTTP requests, default is disabled. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: array - tcp: - description: An ordered list of route rules for opaque TCP traffic. - items: - properties: - match: - description: Match conditions to be satisfied for the rule to - be activated. - items: - properties: - destinationSubnets: - description: IPv4 or IPv6 ip addresses of destination - with optional subnet. - items: - type: string - type: array - gateways: - description: Names of gateways where the rule should be - applied. - items: - type: string - type: array - port: - description: Specifies the port on the host that is being - addressed. - maximum: 4294967295 - minimum: 0 - type: integer - sourceLabels: - additionalProperties: + name: + description: The name assigned to a match. type: string - description: One or more labels that constrain the applicability - of a rule to workloads with the given labels. - type: object - sourceNamespace: - description: Source namespace constraining the applicability - of a rule to workloads in that namespace. - type: string - sourceSubnet: - type: string - type: object - type: array - route: - description: The destination to which the connection should - be forwarded to. - items: - properties: - destination: - description: Destination uniquely identifies the instances - of a service to which the request/connection should - be forwarded to. - properties: - host: - description: The name of a service from the service - registry. - type: string - port: - description: Specifies the port on the host that is - being addressed. + port: + description: Specifies the ports on the host that is being addressed. + maximum: 4294967295 + minimum: 0 + type: integer + queryParams: + additionalProperties: + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string type: object - subset: - description: The name of a subset within the service. + description: Query parameters for matching. + type: object + scheme: + description: 'URI Scheme values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + sourceLabels: + additionalProperties: type: string - required: - - host - type: object - weight: - description: Weight specifies the relative proportion - of traffic to be forwarded to the destination. - format: int32 - type: integer - required: - - destination - type: object - type: array - type: object - type: array - tls: - description: An ordered list of route rule for non-terminated TLS - & HTTPS traffic. - items: - properties: - match: - description: Match conditions to be satisfied for the rule to - be activated. - items: - properties: - destinationSubnets: - description: IPv4 or IPv6 ip addresses of destination - with optional subnet. - items: + description: One or more labels that constrain the applicability of a rule to source (client) workloads with the given labels. + type: object + sourceNamespace: + description: Source namespace constraining the applicability of a rule to workloads in that namespace. type: string - type: array - gateways: - description: Names of gateways where the rule should be - applied. - items: + statPrefix: + description: The human readable prefix to use when emitting statistics for this route. type: string - type: array + uri: + description: 'URI to match values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + withoutHeaders: + additionalProperties: + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + description: withoutHeader has the same syntax with the header, but has opposite meaning. + type: object + type: object + type: array + mirror: + description: Mirror HTTP traffic to a another destination in addition to forwarding the requests to the intended destination. + properties: + host: + description: The name of a service from the service registry. + type: string port: - description: Specifies the port on the host that is being - addressed. - maximum: 4294967295 - minimum: 0 - type: integer - sniHosts: - description: SNI (server name indicator) to match on. - items: - type: string - type: array - sourceLabels: - additionalProperties: - type: string - description: One or more labels that constrain the applicability - of a rule to workloads with the given labels. + description: Specifies the port on the host that is being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer type: object - sourceNamespace: - description: Source namespace constraining the applicability - of a rule to workloads in that namespace. + subset: + description: The name of a subset within the service. type: string required: - - sniHosts + - host type: object - type: array - route: - description: The destination to which the connection should - be forwarded to. - items: + mirror_percent: + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + mirrorPercent: + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + mirrorPercentage: + description: Percentage of the traffic to be mirrored by the `mirror` field. properties: - destination: - description: Destination uniquely identifies the instances - of a service to which the request/connection should - be forwarded to. - properties: - host: - description: The name of a service from the service - registry. - type: string - port: - description: Specifies the port on the host that is - being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - weight: - description: Weight specifies the relative proportion - of traffic to be forwarded to the destination. - format: int32 - type: integer - required: - - destination + value: + format: double + type: number type: object - type: array - required: - - match - type: object - type: array - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. - - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} - - additionalPrinterColumns: - - description: The names of gateways and sidecars that should apply these routes - jsonPath: .spec.gateways - name: Gateways - type: string - - description: The destination hosts to which traffic is being sent - jsonPath: .spec.hosts - name: Hosts - type: string - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is represented - in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for - lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting label/content routing, sni routing, - etc. See more details at: https://istio.io/docs/reference/config/networking/virtual-service.html' - properties: - exportTo: - description: A list of namespaces to which this virtual service is - exported. - items: - type: string - type: array - gateways: - description: The names of gateways and sidecars that should apply - these routes. - items: - type: string - type: array - hosts: - description: The destination hosts to which traffic is being sent. - items: - type: string - type: array - http: - description: An ordered list of route rules for HTTP traffic. - items: - properties: - corsPolicy: - description: Cross-Origin Resource Sharing policy (CORS). - properties: - allowCredentials: - description: Indicates whether the caller is allowed to - send the actual request (not the preflight) using credentials. - nullable: true - type: boolean - allowHeaders: - description: List of HTTP headers that can be used when - requesting the resource. - items: - type: string - type: array - allowMethods: - description: List of HTTP methods allowed to access the - resource. - items: - type: string - type: array - allowOrigin: - items: - type: string - type: array - allowOrigins: - description: String patterns that match allowed origins. - items: - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - type: array - exposeHeaders: - description: A list of HTTP headers that the browsers are - allowed to access. - items: - type: string - type: array - maxAge: - description: Specifies how long the results of a preflight - request can be cached. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - unmatchedPreflights: - description: |- - Indicates whether preflight requests not matching the configured allowed origin shouldn't be forwarded to the upstream. - - Valid Options: FORWARD, IGNORE - enum: - - UNSPECIFIED - - FORWARD - - IGNORE - type: string - type: object - delegate: - description: Delegate is used to specify the particular VirtualService - which can be used to define delegate HTTPRoute. - properties: - name: - description: Name specifies the name of the delegate VirtualService. - type: string - namespace: - description: Namespace specifies the namespace where the - delegate VirtualService resides. - type: string - type: object - directResponse: - description: A HTTP rule can either return a direct_response, - redirect or forward (default) traffic. - properties: - body: - description: Specifies the content of the response body. - oneOf: - - not: - anyOf: - - required: - - string - - required: - - bytes - - required: - - string - - required: - - bytes - properties: - bytes: - description: response body as base64 encoded bytes. - format: byte - type: string - string: - type: string - type: object - status: - description: Specifies the HTTP response status to be returned. - maximum: 4294967295 - minimum: 0 - type: integer - required: - - status - type: object - fault: - description: Fault injection policy to apply on HTTP traffic - at the client side. - properties: - abort: - description: Abort Http request attempts and return error - codes back to downstream service, giving the impression - that the upstream service is faulty. - oneOf: - - not: - anyOf: - - required: - - httpStatus - - required: - - grpcStatus - - required: - - http2Error - - required: - - httpStatus - - required: - - grpcStatus - - required: - - http2Error + mirrors: + description: Specifies the destinations to mirror HTTP traffic in addition to the original destination. + items: properties: - grpcStatus: - description: GRPC status code to use to abort the request. - type: string - http2Error: - type: string - httpStatus: - description: HTTP status code to use to abort the Http - request. - format: int32 - type: integer + destination: + description: Destination specifies the target of the mirror operation. + properties: + host: + description: The name of a service from the service registry. + type: string + port: + description: Specifies the port on the host that is being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object percentage: - description: Percentage of requests to be aborted with - the error code provided. + description: Percentage of the traffic to be mirrored by the `destination` field. properties: value: format: double type: number type: object + required: + - destination type: object - delay: - description: Delay requests before forwarding, emulating - various failures such as network issues, overloaded upstream - service, etc. - oneOf: + type: array + name: + description: The name assigned to the route for debugging purposes. + type: string + redirect: + description: A HTTP rule can either return a direct_response, redirect or forward (default) traffic. + oneOf: - not: anyOf: - - required: - - fixedDelay - - required: - - exponentialDelay + - required: + - port + - required: + - derivePort - required: - - fixedDelay + - port - required: - - exponentialDelay - properties: - exponentialDelay: - type: string - x-kubernetes-validations: + - derivePort + properties: + authority: + description: On a redirect, overwrite the Authority/Host portion of the URL with this value. + type: string + derivePort: + description: |- + On a redirect, dynamically set the port: * FROM_PROTOCOL_DEFAULT: automatically set to 80 for HTTP and 443 for HTTPS. + + Valid Options: FROM_PROTOCOL_DEFAULT, FROM_REQUEST_PORT + enum: + - FROM_PROTOCOL_DEFAULT + - FROM_REQUEST_PORT + type: string + port: + description: On a redirect, overwrite the port portion of the URL with this value. + maximum: 4294967295 + minimum: 0 + type: integer + redirectCode: + description: On a redirect, Specifies the HTTP status code to use in the redirect response. + maximum: 4294967295 + minimum: 0 + type: integer + scheme: + description: On a redirect, overwrite the scheme portion of the URL with this value. + type: string + uri: + description: On a redirect, overwrite the Path portion of the URL with this value. + type: string + type: object + retries: + description: Retry policy for HTTP requests. + properties: + attempts: + description: Number of retries to be allowed for a given request. + format: int32 + type: integer + backoff: + description: Specifies the minimum duration between retry attempts. + type: string + x-kubernetes-validations: - message: must be a valid duration greater than 1ms rule: duration(self) >= duration('1ms') - fixedDelay: - description: Add a fixed delay before forwarding the - request. - type: string - x-kubernetes-validations: + perTryTimeout: + description: Timeout per attempt for a given request, including the initial call and any retries. + type: string + x-kubernetes-validations: - message: must be a valid duration greater than 1ms rule: duration(self) >= duration('1ms') - percent: - description: Percentage of requests on which the delay - will be injected (0-100). - format: int32 - type: integer - percentage: - description: Percentage of requests on which the delay - will be injected. + retryIgnorePreviousHosts: + description: Flag to specify whether the retries should ignore previously tried hosts during retry. + nullable: true + type: boolean + retryOn: + description: Specifies the conditions under which retry takes place. + type: string + retryRemoteLocalities: + description: Flag to specify whether the retries should retry to other localities. + nullable: true + type: boolean + type: object + rewrite: + description: Rewrite HTTP URIs and Authority headers. + properties: + authority: + description: rewrite the Authority/Host header with this value. + type: string + uri: + description: rewrite the path (or the prefix) portion of the URI with this value. + type: string + uriRegexRewrite: + description: rewrite the path portion of the URI with the specified regex. + properties: + match: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + rewrite: + description: The string that should replace into matching portions of original URI. + type: string + type: object + type: object + route: + description: A HTTP rule can either return a direct_response, redirect or forward (default) traffic. + items: + properties: + destination: + description: Destination uniquely identifies the instances of a service to which the request/connection should be forwarded to. properties: - value: - format: double - type: number + host: + description: The name of a service from the service registry. + type: string + port: + description: Specifies the port on the host that is being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + headers: + properties: + request: + properties: + add: + additionalProperties: + type: string + type: object + remove: + items: + type: string + type: array + set: + additionalProperties: + type: string + type: object + type: object + response: + properties: + add: + additionalProperties: + type: string + type: object + remove: + items: + type: string + type: array + set: + additionalProperties: + type: string + type: object + type: object type: object + weight: + description: Weight specifies the relative proportion of traffic to be forwarded to the destination. + format: int32 + type: integer + required: + - destination type: object - type: object - headers: - properties: - request: + type: array + timeout: + description: Timeout for HTTP requests, default is disabled. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + type: array + tcp: + description: An ordered list of route rules for opaque TCP traffic. + items: + properties: + match: + description: Match conditions to be satisfied for the rule to be activated. + items: properties: - add: - additionalProperties: + destinationSubnets: + description: IPv4 or IPv6 ip addresses of destination with optional subnet. + items: type: string - type: object - remove: + type: array + gateways: + description: Names of gateways where the rule should be applied. items: type: string type: array - set: + port: + description: Specifies the port on the host that is being addressed. + maximum: 4294967295 + minimum: 0 + type: integer + sourceLabels: additionalProperties: type: string + description: One or more labels that constrain the applicability of a rule to workloads with the given labels. type: object + sourceNamespace: + description: Source namespace constraining the applicability of a rule to workloads in that namespace. + type: string + sourceSubnet: + type: string type: object - response: + type: array + route: + description: The destination to which the connection should be forwarded to. + items: properties: - add: - additionalProperties: - type: string + destination: + description: Destination uniquely identifies the instances of a service to which the request/connection should be forwarded to. + properties: + host: + description: The name of a service from the service registry. + type: string + port: + description: Specifies the port on the host that is being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host type: object - remove: + weight: + description: Weight specifies the relative proportion of traffic to be forwarded to the destination. + format: int32 + type: integer + required: + - destination + type: object + type: array + type: object + type: array + tls: + description: An ordered list of route rule for non-terminated TLS & HTTPS traffic. + items: + properties: + match: + description: Match conditions to be satisfied for the rule to be activated. + items: + properties: + destinationSubnets: + description: IPv4 or IPv6 ip addresses of destination with optional subnet. + items: + type: string + type: array + gateways: + description: Names of gateways where the rule should be applied. + items: + type: string + type: array + port: + description: Specifies the port on the host that is being addressed. + maximum: 4294967295 + minimum: 0 + type: integer + sniHosts: + description: SNI (server name indicator) to match on. items: type: string type: array - set: + sourceLabels: additionalProperties: type: string + description: One or more labels that constrain the applicability of a rule to workloads with the given labels. type: object + sourceNamespace: + description: Source namespace constraining the applicability of a rule to workloads in that namespace. + type: string + required: + - sniHosts type: object - type: object - match: - description: Match conditions to be satisfied for the rule to - be activated. - items: + type: array + route: + description: The destination to which the connection should be forwarded to. + items: + properties: + destination: + description: Destination uniquely identifies the instances of a service to which the request/connection should be forwarded to. + properties: + host: + description: The name of a service from the service registry. + type: string + port: + description: Specifies the port on the host that is being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + weight: + description: Weight specifies the relative proportion of traffic to be forwarded to the destination. + format: int32 + type: integer + required: + - destination + type: object + type: array + required: + - match + type: object + type: array + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: properties: - authority: - description: 'HTTP Authority values are case-sensitive - and formatted as follows: - `exact: "value"` for exact - string match - `prefix: "value"` for prefix-based match - - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - gateways: - description: Names of gateways where the rule should be - applied. + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - description: The names of gateways and sidecars that should apply these routes + jsonPath: .spec.gateways + name: Gateways + type: string + - description: The destination hosts to which traffic is being sent + jsonPath: .spec.hosts + name: Hosts + type: string + - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting label/content routing, sni routing, etc. See more details at: https://istio.io/docs/reference/config/networking/virtual-service.html' + properties: + exportTo: + description: A list of namespaces to which this virtual service is exported. + items: + type: string + type: array + gateways: + description: The names of gateways and sidecars that should apply these routes. + items: + type: string + type: array + hosts: + description: The destination hosts to which traffic is being sent. + items: + type: string + type: array + http: + description: An ordered list of route rules for HTTP traffic. + items: + properties: + corsPolicy: + description: Cross-Origin Resource Sharing policy (CORS). + properties: + allowCredentials: + description: Indicates whether the caller is allowed to send the actual request (not the preflight) using credentials. + nullable: true + type: boolean + allowHeaders: + description: List of HTTP headers that can be used when requesting the resource. + items: + type: string + type: array + allowMethods: + description: List of HTTP methods allowed to access the resource. + items: + type: string + type: array + allowOrigin: items: type: string type: array - headers: - additionalProperties: + allowOrigins: + description: String patterns that match allowed origins. + items: oneOf: - - not: - anyOf: - - required: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: - exact - - required: + - required: - prefix - - required: + - required: - regex - - required: - - exact - - required: - - prefix - - required: - - regex properties: exact: type: string @@ -15335,169 +13520,201 @@ spec: description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string type: object - description: The header keys must be lowercase and use - hyphen as the separator, e.g. - type: object - ignoreUriCase: - description: Flag to specify whether the URI matching - should be case-insensitive. - type: boolean - method: - description: 'HTTP Method values are case-sensitive and - formatted as follows: - `exact: "value"` for exact string - match - `prefix: "value"` for prefix-based match - `regex: - "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex + type: array + exposeHeaders: + description: A list of HTTP headers that the browsers are allowed to access. + items: + type: string + type: array + maxAge: + description: Specifies how long the results of a preflight request can be cached. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + unmatchedPreflights: + description: |- + Indicates whether preflight requests not matching the configured allowed origin shouldn't be forwarded to the upstream. + + Valid Options: FORWARD, IGNORE + enum: + - UNSPECIFIED + - FORWARD + - IGNORE + type: string + type: object + delegate: + description: Delegate is used to specify the particular VirtualService which can be used to define delegate HTTPRoute. + properties: + name: + description: Name specifies the name of the delegate VirtualService. + type: string + namespace: + description: Namespace specifies the namespace where the delegate VirtualService resides. + type: string + type: object + directResponse: + description: A HTTP rule can either return a direct_response, redirect or forward (default) traffic. + properties: + body: + description: Specifies the content of the response body. + oneOf: + - not: + anyOf: + - required: + - string + - required: + - bytes + - required: + - string + - required: + - bytes properties: - exact: - type: string - prefix: + bytes: + description: response body as base64 encoded bytes. + format: byte type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + string: type: string type: object - name: - description: The name assigned to a match. - type: string - port: - description: Specifies the ports on the host that is being - addressed. + status: + description: Specifies the HTTP response status to be returned. maximum: 4294967295 minimum: 0 type: integer - queryParams: - additionalProperties: - oneOf: + required: + - status + type: object + fault: + description: Fault injection policy to apply on HTTP traffic at the client side. + properties: + abort: + description: Abort Http request attempts and return error codes back to downstream service, giving the impression that the upstream service is faulty. + oneOf: - not: anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex + - required: + - httpStatus + - required: + - grpcStatus + - required: + - http2Error - required: - - exact + - httpStatus - required: - - prefix + - grpcStatus - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - description: Query parameters for matching. - type: object - scheme: - description: 'URI Scheme values are case-sensitive and - formatted as follows: - `exact: "value"` for exact string - match - `prefix: "value"` for prefix-based match - `regex: - "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex + - http2Error properties: - exact: + grpcStatus: + description: GRPC status code to use to abort the request. type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + http2Error: type: string + httpStatus: + description: HTTP status code to use to abort the Http request. + format: int32 + type: integer + percentage: + description: Percentage of requests to be aborted with the error code provided. + properties: + value: + format: double + type: number + type: object type: object - sourceLabels: - additionalProperties: - type: string - description: One or more labels that constrain the applicability - of a rule to source (client) workloads with the given - labels. - type: object - sourceNamespace: - description: Source namespace constraining the applicability - of a rule to workloads in that namespace. - type: string - statPrefix: - description: The human readable prefix to use when emitting - statistics for this route. - type: string - uri: - description: 'URI to match values are case-sensitive and - formatted as follows: - `exact: "value"` for exact string - match - `prefix: "value"` for prefix-based match - `regex: - "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + delay: + description: Delay requests before forwarding, emulating various failures such as network issues, overloaded upstream service, etc. oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex + - not: + anyOf: + - required: + - fixedDelay + - required: + - exponentialDelay + - required: + - fixedDelay + - required: + - exponentialDelay properties: - exact: + exponentialDelay: type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + fixedDelay: + description: Add a fixed delay before forwarding the request. type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + percent: + description: Percentage of requests on which the delay will be injected (0-100). + format: int32 + type: integer + percentage: + description: Percentage of requests on which the delay will be injected. + properties: + value: + format: double + type: number + type: object + type: object + type: object + headers: + properties: + request: + properties: + add: + additionalProperties: + type: string + type: object + remove: + items: + type: string + type: array + set: + additionalProperties: + type: string + type: object + type: object + response: + properties: + add: + additionalProperties: + type: string + type: object + remove: + items: + type: string + type: array + set: + additionalProperties: + type: string + type: object type: object - withoutHeaders: - additionalProperties: + type: object + match: + description: Match conditions to be satisfied for the rule to be activated. + items: + properties: + authority: + description: 'HTTP Authority values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' oneOf: - - not: - anyOf: - - required: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: - exact - - required: + - required: - prefix - - required: + - required: - regex - - required: - - exact - - required: - - prefix - - required: - - regex properties: exact: type: string @@ -15507,534 +13724,660 @@ spec: description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string type: object - description: withoutHeader has the same syntax with the - header, but has opposite meaning. - type: object - type: object - type: array - mirror: - description: Mirror HTTP traffic to a another destination in - addition to forwarding the requests to the intended destination. - properties: - host: - description: The name of a service from the service registry. - type: string - port: - description: Specifies the port on the host that is being - addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - mirrorPercent: - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - mirrorPercentage: - description: Percentage of the traffic to be mirrored by the - `mirror` field. - properties: - value: - format: double - type: number - type: object - mirror_percent: - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - mirrors: - description: Specifies the destinations to mirror HTTP traffic - in addition to the original destination. - items: - properties: - destination: - description: Destination specifies the target of the mirror - operation. - properties: - host: - description: The name of a service from the service - registry. + gateways: + description: Names of gateways where the rule should be applied. + items: type: string - port: - description: Specifies the port on the host that is - being addressed. + type: array + headers: + additionalProperties: + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - percentage: - description: Percentage of the traffic to be mirrored - by the `destination` field. - properties: - value: - format: double - type: number - type: object - required: - - destination - type: object - type: array - name: - description: The name assigned to the route for debugging purposes. - type: string - redirect: - description: A HTTP rule can either return a direct_response, - redirect or forward (default) traffic. - oneOf: - - not: - anyOf: - - required: - - port - - required: - - derivePort - - required: - - port - - required: - - derivePort - properties: - authority: - description: On a redirect, overwrite the Authority/Host - portion of the URL with this value. - type: string - derivePort: - description: |- - On a redirect, dynamically set the port: * FROM_PROTOCOL_DEFAULT: automatically set to 80 for HTTP and 443 for HTTPS. - - Valid Options: FROM_PROTOCOL_DEFAULT, FROM_REQUEST_PORT - enum: - - FROM_PROTOCOL_DEFAULT - - FROM_REQUEST_PORT - type: string - port: - description: On a redirect, overwrite the port portion of - the URL with this value. - maximum: 4294967295 - minimum: 0 - type: integer - redirectCode: - description: On a redirect, Specifies the HTTP status code - to use in the redirect response. - maximum: 4294967295 - minimum: 0 - type: integer - scheme: - description: On a redirect, overwrite the scheme portion - of the URL with this value. - type: string - uri: - description: On a redirect, overwrite the Path portion of - the URL with this value. - type: string - type: object - retries: - description: Retry policy for HTTP requests. - properties: - attempts: - description: Number of retries to be allowed for a given - request. - format: int32 - type: integer - backoff: - description: Specifies the minimum duration between retry - attempts. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - perTryTimeout: - description: Timeout per attempt for a given request, including - the initial call and any retries. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - retryIgnorePreviousHosts: - description: Flag to specify whether the retries should - ignore previously tried hosts during retry. - nullable: true - type: boolean - retryOn: - description: Specifies the conditions under which retry - takes place. - type: string - retryRemoteLocalities: - description: Flag to specify whether the retries should - retry to other localities. - nullable: true - type: boolean - type: object - rewrite: - description: Rewrite HTTP URIs and Authority headers. - properties: - authority: - description: rewrite the Authority/Host header with this - value. - type: string - uri: - description: rewrite the path (or the prefix) portion of - the URI with this value. - type: string - uriRegexRewrite: - description: rewrite the path portion of the URI with the - specified regex. - properties: - match: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - rewrite: - description: The string that should replace into matching - portions of original URI. - type: string - type: object - type: object - route: - description: A HTTP rule can either return a direct_response, - redirect or forward (default) traffic. - items: - properties: - destination: - description: Destination uniquely identifies the instances - of a service to which the request/connection should - be forwarded to. - properties: - host: - description: The name of a service from the service - registry. - type: string - port: - description: Specifies the port on the host that is - being addressed. + description: The header keys must be lowercase and use hyphen as the separator, e.g. + type: object + ignoreUriCase: + description: Flag to specify whether the URI matching should be case-insensitive. + type: boolean + method: + description: 'HTTP Method values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + name: + description: The name assigned to a match. + type: string + port: + description: Specifies the ports on the host that is being addressed. + maximum: 4294967295 + minimum: 0 + type: integer + queryParams: + additionalProperties: + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string type: object - subset: - description: The name of a subset within the service. + description: Query parameters for matching. + type: object + scheme: + description: 'URI Scheme values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + sourceLabels: + additionalProperties: type: string - required: - - host - type: object - headers: - properties: - request: - properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object - type: object - response: + description: One or more labels that constrain the applicability of a rule to source (client) workloads with the given labels. + type: object + sourceNamespace: + description: Source namespace constraining the applicability of a rule to workloads in that namespace. + type: string + statPrefix: + description: The human readable prefix to use when emitting statistics for this route. + type: string + uri: + description: 'URI to match values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + withoutHeaders: + additionalProperties: + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string type: object + description: withoutHeader has the same syntax with the header, but has opposite meaning. + type: object + type: object + type: array + mirror: + description: Mirror HTTP traffic to a another destination in addition to forwarding the requests to the intended destination. + properties: + host: + description: The name of a service from the service registry. + type: string + port: + description: Specifies the port on the host that is being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer type: object - weight: - description: Weight specifies the relative proportion - of traffic to be forwarded to the destination. - format: int32 - type: integer + subset: + description: The name of a subset within the service. + type: string required: - - destination + - host type: object - type: array - timeout: - description: Timeout for HTTP requests, default is disabled. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: array - tcp: - description: An ordered list of route rules for opaque TCP traffic. - items: - properties: - match: - description: Match conditions to be satisfied for the rule to - be activated. - items: + mirror_percent: + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + mirrorPercent: + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + mirrorPercentage: + description: Percentage of the traffic to be mirrored by the `mirror` field. properties: - destinationSubnets: - description: IPv4 or IPv6 ip addresses of destination - with optional subnet. - items: - type: string - type: array - gateways: - description: Names of gateways where the rule should be - applied. - items: - type: string - type: array + value: + format: double + type: number + type: object + mirrors: + description: Specifies the destinations to mirror HTTP traffic in addition to the original destination. + items: + properties: + destination: + description: Destination specifies the target of the mirror operation. + properties: + host: + description: The name of a service from the service registry. + type: string + port: + description: Specifies the port on the host that is being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + percentage: + description: Percentage of the traffic to be mirrored by the `destination` field. + properties: + value: + format: double + type: number + type: object + required: + - destination + type: object + type: array + name: + description: The name assigned to the route for debugging purposes. + type: string + redirect: + description: A HTTP rule can either return a direct_response, redirect or forward (default) traffic. + oneOf: + - not: + anyOf: + - required: + - port + - required: + - derivePort + - required: + - port + - required: + - derivePort + properties: + authority: + description: On a redirect, overwrite the Authority/Host portion of the URL with this value. + type: string + derivePort: + description: |- + On a redirect, dynamically set the port: * FROM_PROTOCOL_DEFAULT: automatically set to 80 for HTTP and 443 for HTTPS. + + Valid Options: FROM_PROTOCOL_DEFAULT, FROM_REQUEST_PORT + enum: + - FROM_PROTOCOL_DEFAULT + - FROM_REQUEST_PORT + type: string port: - description: Specifies the port on the host that is being - addressed. + description: On a redirect, overwrite the port portion of the URL with this value. maximum: 4294967295 minimum: 0 type: integer - sourceLabels: - additionalProperties: - type: string - description: One or more labels that constrain the applicability - of a rule to workloads with the given labels. - type: object - sourceNamespace: - description: Source namespace constraining the applicability - of a rule to workloads in that namespace. + redirectCode: + description: On a redirect, Specifies the HTTP status code to use in the redirect response. + maximum: 4294967295 + minimum: 0 + type: integer + scheme: + description: On a redirect, overwrite the scheme portion of the URL with this value. type: string - sourceSubnet: + uri: + description: On a redirect, overwrite the Path portion of the URL with this value. type: string type: object - type: array - route: - description: The destination to which the connection should - be forwarded to. - items: + retries: + description: Retry policy for HTTP requests. + properties: + attempts: + description: Number of retries to be allowed for a given request. + format: int32 + type: integer + backoff: + description: Specifies the minimum duration between retry attempts. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + perTryTimeout: + description: Timeout per attempt for a given request, including the initial call and any retries. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + retryIgnorePreviousHosts: + description: Flag to specify whether the retries should ignore previously tried hosts during retry. + nullable: true + type: boolean + retryOn: + description: Specifies the conditions under which retry takes place. + type: string + retryRemoteLocalities: + description: Flag to specify whether the retries should retry to other localities. + nullable: true + type: boolean + type: object + rewrite: + description: Rewrite HTTP URIs and Authority headers. properties: - destination: - description: Destination uniquely identifies the instances - of a service to which the request/connection should - be forwarded to. + authority: + description: rewrite the Authority/Host header with this value. + type: string + uri: + description: rewrite the path (or the prefix) portion of the URI with this value. + type: string + uriRegexRewrite: + description: rewrite the path portion of the URI with the specified regex. properties: - host: - description: The name of a service from the service - registry. + match: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string - port: - description: Specifies the port on the host that is - being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. + rewrite: + description: The string that should replace into matching portions of original URI. + type: string + type: object + type: object + route: + description: A HTTP rule can either return a direct_response, redirect or forward (default) traffic. + items: + properties: + destination: + description: Destination uniquely identifies the instances of a service to which the request/connection should be forwarded to. + properties: + host: + description: The name of a service from the service registry. + type: string + port: + description: Specifies the port on the host that is being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + headers: + properties: + request: + properties: + add: + additionalProperties: + type: string + type: object + remove: + items: + type: string + type: array + set: + additionalProperties: + type: string + type: object + type: object + response: + properties: + add: + additionalProperties: + type: string + type: object + remove: + items: + type: string + type: array + set: + additionalProperties: + type: string + type: object + type: object + type: object + weight: + description: Weight specifies the relative proportion of traffic to be forwarded to the destination. + format: int32 + type: integer + required: + - destination + type: object + type: array + timeout: + description: Timeout for HTTP requests, default is disabled. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + type: array + tcp: + description: An ordered list of route rules for opaque TCP traffic. + items: + properties: + match: + description: Match conditions to be satisfied for the rule to be activated. + items: + properties: + destinationSubnets: + description: IPv4 or IPv6 ip addresses of destination with optional subnet. + items: + type: string + type: array + gateways: + description: Names of gateways where the rule should be applied. + items: type: string - required: - - host - type: object - weight: - description: Weight specifies the relative proportion - of traffic to be forwarded to the destination. - format: int32 - type: integer - required: - - destination - type: object - type: array - type: object - type: array - tls: - description: An ordered list of route rule for non-terminated TLS - & HTTPS traffic. - items: - properties: - match: - description: Match conditions to be satisfied for the rule to - be activated. - items: - properties: - destinationSubnets: - description: IPv4 or IPv6 ip addresses of destination - with optional subnet. - items: - type: string - type: array - gateways: - description: Names of gateways where the rule should be - applied. - items: - type: string - type: array - port: - description: Specifies the port on the host that is being - addressed. - maximum: 4294967295 - minimum: 0 - type: integer - sniHosts: - description: SNI (server name indicator) to match on. - items: + type: array + port: + description: Specifies the port on the host that is being addressed. + maximum: 4294967295 + minimum: 0 + type: integer + sourceLabels: + additionalProperties: + type: string + description: One or more labels that constrain the applicability of a rule to workloads with the given labels. + type: object + sourceNamespace: + description: Source namespace constraining the applicability of a rule to workloads in that namespace. type: string - type: array - sourceLabels: - additionalProperties: + sourceSubnet: type: string - description: One or more labels that constrain the applicability - of a rule to workloads with the given labels. - type: object - sourceNamespace: - description: Source namespace constraining the applicability - of a rule to workloads in that namespace. - type: string - required: - - sniHosts - type: object - type: array - route: - description: The destination to which the connection should - be forwarded to. - items: - properties: - destination: - description: Destination uniquely identifies the instances - of a service to which the request/connection should - be forwarded to. - properties: - host: - description: The name of a service from the service - registry. + type: object + type: array + route: + description: The destination to which the connection should be forwarded to. + items: + properties: + destination: + description: Destination uniquely identifies the instances of a service to which the request/connection should be forwarded to. + properties: + host: + description: The name of a service from the service registry. + type: string + port: + description: Specifies the port on the host that is being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + weight: + description: Weight specifies the relative proportion of traffic to be forwarded to the destination. + format: int32 + type: integer + required: + - destination + type: object + type: array + type: object + type: array + tls: + description: An ordered list of route rule for non-terminated TLS & HTTPS traffic. + items: + properties: + match: + description: Match conditions to be satisfied for the rule to be activated. + items: + properties: + destinationSubnets: + description: IPv4 or IPv6 ip addresses of destination with optional subnet. + items: type: string - port: - description: Specifies the port on the host that is - being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. + type: array + gateways: + description: Names of gateways where the rule should be applied. + items: type: string - required: - - host - type: object - weight: - description: Weight specifies the relative proportion - of traffic to be forwarded to the destination. - format: int32 - type: integer - required: - - destination - type: object - type: array - required: - - match - type: object - type: array - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. + type: array + port: + description: Specifies the port on the host that is being addressed. + maximum: 4294967295 + minimum: 0 + type: integer + sniHosts: + description: SNI (server name indicator) to match on. + items: + type: string + type: array + sourceLabels: + additionalProperties: + type: string + description: One or more labels that constrain the applicability of a rule to workloads with the given labels. + type: object + sourceNamespace: + description: Source namespace constraining the applicability of a rule to workloads in that namespace. + type: string + required: + - sniHosts + type: object + type: array + route: + description: The destination to which the connection should be forwarded to. + items: + properties: + destination: + description: Destination uniquely identifies the instances of a service to which the request/connection should be forwarded to. + properties: + host: + description: The name of a service from the service registry. + type: string + port: + description: Specifies the port on the host that is being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + weight: + description: Weight specifies the relative proportion of traffic to be forwarded to the destination. + format: int32 + type: integer + required: + - destination + type: object + type: array + required: + - match + type: object + type: array + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. + type: string + level: + description: |- + Represents how severe a message is. - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -16052,173 +14395,132 @@ spec: group: extensions.istio.io names: categories: - - istio-io - - extensions-istio-io + - istio-io + - extensions-istio-io kind: WasmPlugin listKind: WasmPluginList plural: wasmplugins singular: wasmplugin scope: Namespaced versions: - - additionalPrinterColumns: - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is represented - in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for - lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1alpha1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Extend the functionality provided by the Istio proxy through - WebAssembly filters. See more details at: https://istio.io/docs/reference/config/proxy_extensions/wasm-plugin.html' - properties: - failStrategy: - description: |- - Specifies the failure behavior for the plugin due to fatal errors. + - additionalPrinterColumns: + - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Extend the functionality provided by the Istio proxy through WebAssembly filters. See more details at: https://istio.io/docs/reference/config/proxy_extensions/wasm-plugin.html' + properties: + failStrategy: + description: |- + Specifies the failure behavior for the plugin due to fatal errors. - Valid Options: FAIL_CLOSE, FAIL_OPEN, FAIL_RELOAD - enum: - - FAIL_CLOSE - - FAIL_OPEN - - FAIL_RELOAD - type: string - imagePullPolicy: - description: |- - The pull behaviour to be applied when fetching Wasm module by either OCI image or `http/https`. + Valid Options: FAIL_CLOSE, FAIL_OPEN, FAIL_RELOAD + enum: + - FAIL_CLOSE + - FAIL_OPEN + - FAIL_RELOAD + type: string + imagePullPolicy: + description: |- + The pull behaviour to be applied when fetching Wasm module by either OCI image or `http/https`. - Valid Options: IfNotPresent, Always - enum: - - UNSPECIFIED_POLICY - - IfNotPresent - - Always - type: string - imagePullSecret: - description: Credentials to use for OCI image pulling. - maxLength: 253 - minLength: 1 - type: string - match: - description: Specifies the criteria to determine which traffic is - passed to WasmPlugin. - items: - properties: - mode: - description: |- - Criteria for selecting traffic by their direction. + Valid Options: IfNotPresent, Always + enum: + - UNSPECIFIED_POLICY + - IfNotPresent + - Always + type: string + imagePullSecret: + description: Credentials to use for OCI image pulling. + maxLength: 253 + minLength: 1 + type: string + match: + description: Specifies the criteria to determine which traffic is passed to WasmPlugin. + items: + properties: + mode: + description: |- + Criteria for selecting traffic by their direction. - Valid Options: CLIENT, SERVER, CLIENT_AND_SERVER - enum: - - UNDEFINED - - CLIENT - - SERVER - - CLIENT_AND_SERVER - type: string - ports: - description: Criteria for selecting traffic by their destination - port. - items: - properties: - number: - maximum: 65535 - minimum: 1 - type: integer - required: - - number - type: object - type: array - x-kubernetes-list-map-keys: - - number - x-kubernetes-list-type: map - type: object - type: array - phase: - description: |- - Determines where in the filter chain this `WasmPlugin` is to be injected. + Valid Options: CLIENT, SERVER, CLIENT_AND_SERVER + enum: + - UNDEFINED + - CLIENT + - SERVER + - CLIENT_AND_SERVER + type: string + ports: + description: Criteria for selecting traffic by their destination port. + items: + properties: + number: + maximum: 65535 + minimum: 1 + type: integer + required: + - number + type: object + type: array + x-kubernetes-list-map-keys: + - number + x-kubernetes-list-type: map + type: object + type: array + phase: + description: |- + Determines where in the filter chain this `WasmPlugin` is to be injected. - Valid Options: AUTHN, AUTHZ, STATS - enum: - - UNSPECIFIED_PHASE - - AUTHN - - AUTHZ - - STATS - type: string - pluginConfig: - description: The configuration that will be passed on to the plugin. - type: object - x-kubernetes-preserve-unknown-fields: true - pluginName: - description: The plugin name to be used in the Envoy configuration - (used to be called `rootID`). - maxLength: 256 - minLength: 1 - type: string - priority: - description: Determines ordering of `WasmPlugins` in the same `phase`. - format: int32 - nullable: true - type: integer - selector: - description: Criteria used to select the specific set of pods/VMs - on which this plugin configuration should be applied. - properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string + Valid Options: AUTHN, AUTHZ, STATS + enum: + - UNSPECIFIED_PHASE + - AUTHN + - AUTHZ + - STATS + type: string + pluginConfig: + description: The configuration that will be passed on to the plugin. + type: object + x-kubernetes-preserve-unknown-fields: true + pluginName: + description: The plugin name to be used in the Envoy configuration (used to be called `rootID`). + maxLength: 256 + minLength: 1 + type: string + priority: + description: Determines ordering of `WasmPlugins` in the same `phase`. + format: int32 + nullable: true + type: integer + selector: + description: Criteria used to select the specific set of pods/VMs on which this plugin configuration should be applied. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of - pods/VMs on which a policy should be applied. - maxProperties: 4096 - type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) - type: object - sha256: - description: SHA256 checksum that will be used to verify Wasm module - or OCI container. - pattern: (^$|^[a-f0-9]{64}$) - type: string - targetRef: - properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: name is the name of the target resource. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: namespace is the namespace of the referent. - type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 - required: - - kind - - name - type: object - targetRefs: - description: Optional. - items: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + sha256: + description: SHA256 checksum that will be used to verify Wasm module or OCI container. + pattern: (^$|^[a-f0-9]{64}$) + type: string + targetRef: properties: group: description: group is the group of the target resource. @@ -16240,163 +14542,185 @@ spec: description: namespace is the namespace of the referent. type: string x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 required: - - kind - - name + - kind + - name type: object - maxItems: 16 - type: array - type: - description: |- - Specifies the type of Wasm Extension to be used. - - Valid Options: HTTP, NETWORK - enum: - - UNSPECIFIED_PLUGIN_TYPE - - HTTP - - NETWORK - type: string - url: - description: URL of a Wasm module or OCI container. - minLength: 1 - type: string - x-kubernetes-validations: - - message: url must have schema one of [http, https, file, oci] - rule: |- - isURL(self) ? (url(self).getScheme() in ["", "http", "https", "oci", "file"]) : (isURL("http://" + self) && - url("http://" + self).getScheme() in ["", "http", "https", "oci", "file"]) - verificationKey: - type: string - vmConfig: - description: Configuration for a Wasm VM. - properties: - env: - description: Specifies environment variables to be injected to - this VM. - items: - properties: - name: - description: Name of the environment variable. - maxLength: 256 - minLength: 1 - type: string - value: - description: Value for the environment variable. - maxLength: 2048 - type: string - valueFrom: - description: |- - Source for the environment variable's value. - - Valid Options: INLINE, HOST - enum: - - INLINE - - HOST - type: string - required: + targetRefs: + description: Optional. + items: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind - name - type: object - x-kubernetes-validations: - - message: value may only be set when valueFrom is INLINE - rule: '(has(self.valueFrom) ? self.valueFrom : "") != "HOST" - || !has(self.value)' - maxItems: 256 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - type: object - required: - - url - type: object - x-kubernetes-validations: - - message: only one of targetRefs or selector can be set - rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) - + (has(self.targetRefs) ? 1 : 0) <= 1' - status: - properties: - conditions: - description: Current service state of the resource. - items: + type: object + maxItems: 16 + type: array + type: + description: |- + Specifies the type of Wasm Extension to be used. + + Valid Options: HTTP, NETWORK + enum: + - UNSPECIFIED_PLUGIN_TYPE + - HTTP + - NETWORK + type: string + url: + description: URL of a Wasm module or OCI container. + minLength: 1 + type: string + x-kubernetes-validations: + - message: url must have schema one of [http, https, file, oci] + rule: |- + isURL(self) ? (url(self).getScheme() in ["", "http", "https", "oci", "file"]) : (isURL("http://" + self) && + url("http://" + self).getScheme() in ["", "http", "https", "oci", "file"]) + verificationKey: + type: string + vmConfig: + description: Configuration for a Wasm VM. properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string + env: + description: Specifies environment variables to be injected to this VM. + items: + properties: + name: + description: Name of the environment variable. + maxLength: 256 + minLength: 1 + type: string + value: + description: Value for the environment variable. + maxLength: 2048 + type: string + valueFrom: + description: |- + Source for the environment variable's value. + + Valid Options: INLINE, HOST + enum: + - INLINE + - HOST + type: string + required: + - name + type: object + x-kubernetes-validations: + - message: value may only be set when valueFrom is INLINE + rule: '(has(self.valueFrom) ? self.valueFrom : "") != "HOST" || !has(self.value)' + maxItems: 256 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. + required: + - url + type: object + x-kubernetes-validations: + - message: only one of targetRefs or selector can be set + rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + (has(self.targetRefs) ? 1 : 0) <= 1' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. + type: string + level: + description: |- + Represents how severe a message is. - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -16414,1447 +14738,1330 @@ spec: group: networking.istio.io names: categories: - - istio-io - - networking-istio-io + - istio-io + - networking-istio-io kind: WorkloadEntry listKind: WorkloadEntryList plural: workloadentries shortNames: - - we + - we singular: workloadentry scope: Namespaced versions: - - additionalPrinterColumns: - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is represented - in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for - lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - - description: Address associated with the network endpoint. - jsonPath: .spec.address - name: Address - type: string - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting VMs onboarded into the mesh. See - more details at: https://istio.io/docs/reference/config/networking/workload-entry.html' - properties: - address: - description: Address associated with the network endpoint without - the port. - maxLength: 256 - type: string - x-kubernetes-validations: - - message: UDS must be an absolute path or abstract socket - rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" - || self.substring(7, 8) == "@") : true' - - message: UDS may not be a dir - rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' - labels: - additionalProperties: + - additionalPrinterColumns: + - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + - description: Address associated with the network endpoint. + jsonPath: .spec.address + name: Address + type: string + name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting VMs onboarded into the mesh. See more details at: https://istio.io/docs/reference/config/networking/workload-entry.html' + properties: + address: + description: Address associated with the network endpoint without the port. + maxLength: 256 + type: string + x-kubernetes-validations: + - message: UDS must be an absolute path or abstract socket + rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" || self.substring(7, 8) == "@") : true' + - message: UDS may not be a dir + rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' + labels: + additionalProperties: + type: string + description: One or more labels associated with the endpoint. + maxProperties: 256 + type: object + locality: + description: The locality associated with the endpoint. + maxLength: 2048 + type: string + network: + description: Network enables Istio to group endpoints resident in the same L3 domain/network. + maxLength: 2048 + type: string + ports: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + description: Set of ports associated with the endpoint. + maxProperties: 128 + type: object + x-kubernetes-validations: + - message: port name must be valid + rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) + serviceAccount: + description: The service account associated with the workload if a sidecar is present in the workload. + maxLength: 253 type: string - description: One or more labels associated with the endpoint. - maxProperties: 256 - type: object - locality: - description: The locality associated with the endpoint. - maxLength: 2048 - type: string - network: - description: Network enables Istio to group endpoints resident in - the same L3 domain/network. - maxLength: 2048 - type: string - ports: - additionalProperties: + weight: + description: The load balancing weight associated with the endpoint. maximum: 4294967295 minimum: 0 type: integer + type: object + x-kubernetes-validations: + - message: Address is required + rule: has(self.address) || has(self.network) + - message: UDS may not include ports + rule: '(has(self.address) ? self.address : "").startsWith("unix://") ? !has(self.ports) : true' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + - description: Address associated with the network endpoint. + jsonPath: .spec.address + name: Address + type: string + name: v1alpha3 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting VMs onboarded into the mesh. See more details at: https://istio.io/docs/reference/config/networking/workload-entry.html' + properties: + address: + description: Address associated with the network endpoint without the port. + maxLength: 256 + type: string x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - description: Set of ports associated with the endpoint. - maxProperties: 128 - type: object - x-kubernetes-validations: - - message: port name must be valid - rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) - serviceAccount: - description: The service account associated with the workload if a - sidecar is present in the workload. - maxLength: 253 - type: string - weight: - description: The load balancing weight associated with the endpoint. - maximum: 4294967295 - minimum: 0 - type: integer - type: object - x-kubernetes-validations: - - message: Address is required - rule: has(self.address) || has(self.network) - - message: UDS may not include ports - rule: '(has(self.address) ? self.address : "").startsWith("unix://") - ? !has(self.ports) : true' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string + - message: UDS must be an absolute path or abstract socket + rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" || self.substring(7, 8) == "@") : true' + - message: UDS may not be a dir + rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' + labels: + additionalProperties: + type: string + description: One or more labels associated with the endpoint. + maxProperties: 256 type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. - - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object + locality: + description: The locality associated with the endpoint. + maxLength: 2048 + type: string + network: + description: Network enables Istio to group endpoints resident in the same L3 domain/network. + maxLength: 2048 + type: string + ports: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + description: Set of ports associated with the endpoint. + maxProperties: 128 type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} - - additionalPrinterColumns: - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is represented - in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for - lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - - description: Address associated with the network endpoint. - jsonPath: .spec.address - name: Address - type: string - name: v1alpha3 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting VMs onboarded into the mesh. See - more details at: https://istio.io/docs/reference/config/networking/workload-entry.html' - properties: - address: - description: Address associated with the network endpoint without - the port. - maxLength: 256 - type: string - x-kubernetes-validations: - - message: UDS must be an absolute path or abstract socket - rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" - || self.substring(7, 8) == "@") : true' - - message: UDS may not be a dir - rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' - labels: - additionalProperties: + x-kubernetes-validations: + - message: port name must be valid + rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) + serviceAccount: + description: The service account associated with the workload if a sidecar is present in the workload. + maxLength: 253 type: string - description: One or more labels associated with the endpoint. - maxProperties: 256 - type: object - locality: - description: The locality associated with the endpoint. - maxLength: 2048 - type: string - network: - description: Network enables Istio to group endpoints resident in - the same L3 domain/network. - maxLength: 2048 - type: string - ports: - additionalProperties: + weight: + description: The load balancing weight associated with the endpoint. maximum: 4294967295 minimum: 0 type: integer + type: object + x-kubernetes-validations: + - message: Address is required + rule: has(self.address) || has(self.network) + - message: UDS may not include ports + rule: '(has(self.address) ? self.address : "").startsWith("unix://") ? !has(self.ports) : true' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + - description: Address associated with the network endpoint. + jsonPath: .spec.address + name: Address + type: string + name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting VMs onboarded into the mesh. See more details at: https://istio.io/docs/reference/config/networking/workload-entry.html' + properties: + address: + description: Address associated with the network endpoint without the port. + maxLength: 256 + type: string + x-kubernetes-validations: + - message: UDS must be an absolute path or abstract socket + rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" || self.substring(7, 8) == "@") : true' + - message: UDS may not be a dir + rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' + labels: + additionalProperties: + type: string + description: One or more labels associated with the endpoint. + maxProperties: 256 + type: object + locality: + description: The locality associated with the endpoint. + maxLength: 2048 + type: string + network: + description: Network enables Istio to group endpoints resident in the same L3 domain/network. + maxLength: 2048 + type: string + ports: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + description: Set of ports associated with the endpoint. + maxProperties: 128 + type: object x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - description: Set of ports associated with the endpoint. - maxProperties: 128 - type: object - x-kubernetes-validations: - - message: port name must be valid - rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) - serviceAccount: - description: The service account associated with the workload if a - sidecar is present in the workload. - maxLength: 253 - type: string - weight: - description: The load balancing weight associated with the endpoint. - maximum: 4294967295 - minimum: 0 - type: integer - type: object - x-kubernetes-validations: - - message: Address is required - rule: has(self.address) || has(self.network) - - message: UDS may not include ports - rule: '(has(self.address) ? self.address : "").startsWith("unix://") - ? !has(self.ports) : true' - status: - properties: - conditions: - description: Current service state of the resource. - items: + - message: port name must be valid + rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) + serviceAccount: + description: The service account associated with the workload if a sidecar is present in the workload. + maxLength: 253 + type: string + weight: + description: The load balancing weight associated with the endpoint. + maximum: 4294967295 + minimum: 0 + type: integer + type: object + x-kubernetes-validations: + - message: Address is required + rule: has(self.address) || has(self.network) + - message: UDS may not include ports + rule: '(has(self.address) ? self.address : "").startsWith("unix://") ? !has(self.ports) : true' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: istio + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/part-of: istio + app.kubernetes.io/version: 1.29.4 + helm.sh/chart: base-1.29.4 + name: workloadgroups.networking.istio.io +spec: + group: networking.istio.io + names: + categories: + - istio-io + - networking-istio-io + kind: WorkloadGroup + listKind: WorkloadGroupList + plural: workloadgroups + shortNames: + - wg + singular: workloadgroup + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Describes a collection of workload instances. See more details at: https://istio.io/docs/reference/config/networking/workload-group.html' + properties: + metadata: + description: Metadata that will be used for all corresponding `WorkloadEntries`. properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string + annotations: + additionalProperties: + type: string + maxProperties: 256 + type: object + labels: + additionalProperties: + type: string + maxProperties: 256 + type: object type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: + probe: + description: '`ReadinessProbe` describes the configuration the user must provide for healthchecking on their workload.' + oneOf: + - not: + anyOf: + - required: + - httpGet + - required: + - tcpSocket + - required: + - exec + - required: + - grpc + - required: + - httpGet + - required: + - tcpSocket + - required: + - exec + - required: + - grpc properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. - - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: + exec: + description: Health is determined by how the command that is executed exited. + properties: + command: + description: Command to run. + items: + minLength: 1 + type: string + type: array + required: + - command + type: object + failureThreshold: + description: Minimum consecutive failures for the probe to be considered failed after having succeeded. + format: int32 + minimum: 0 + type: integer + grpc: + description: GRPC call is made and response/error is used to determine health. + properties: + port: + description: Port on which the endpoint lives. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + service: + type: string + type: object + httpGet: + description: '`httpGet` is performed to a given endpoint and the status/able to connect determines health.' properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. + host: + description: Host name to connect to, defaults to the pod IP. + type: string + httpHeaders: + description: Headers the proxy will pass on to make the request. + items: + properties: + name: + pattern: ^[-_A-Za-z0-9]+$ + type: string + value: + type: string + type: object + type: array + path: + description: Path to access on the HTTP server. type: string - name: - description: A human-readable name for the message type. + port: + description: Port on which the endpoint lives. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + scheme: type: string + x-kubernetes-validations: + - message: scheme must be one of [HTTP, HTTPS] + rule: self in ["", "HTTP", "HTTPS"] + required: + - port type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: false - subresources: - status: {} - - additionalPrinterColumns: - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is represented - in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for - lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - - description: Address associated with the network endpoint. - jsonPath: .spec.address - name: Address - type: string - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting VMs onboarded into the mesh. See - more details at: https://istio.io/docs/reference/config/networking/workload-entry.html' - properties: - address: - description: Address associated with the network endpoint without - the port. - maxLength: 256 - type: string - x-kubernetes-validations: - - message: UDS must be an absolute path or abstract socket - rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" - || self.substring(7, 8) == "@") : true' - - message: UDS may not be a dir - rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' - labels: - additionalProperties: - type: string - description: One or more labels associated with the endpoint. - maxProperties: 256 - type: object - locality: - description: The locality associated with the endpoint. - maxLength: 2048 - type: string - network: - description: Network enables Istio to group endpoints resident in - the same L3 domain/network. - maxLength: 2048 - type: string - ports: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - description: Set of ports associated with the endpoint. - maxProperties: 128 - type: object - x-kubernetes-validations: - - message: port name must be valid - rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) - serviceAccount: - description: The service account associated with the workload if a - sidecar is present in the workload. - maxLength: 253 - type: string - weight: - description: The load balancing weight associated with the endpoint. - maximum: 4294967295 - minimum: 0 - type: integer - type: object - x-kubernetes-validations: - - message: Address is required - rule: has(self.address) || has(self.network) - - message: UDS may not include ports - rule: '(has(self.address) ? self.address : "").startsWith("unix://") - ? !has(self.ports) : true' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. - - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: + initialDelaySeconds: + description: Number of seconds after the container has started before readiness probes are initiated. + format: int32 + minimum: 0 + type: integer + periodSeconds: + description: How often (in seconds) to perform the probe. + format: int32 + minimum: 0 + type: integer + successThreshold: + description: Minimum consecutive successes for the probe to be considered successful after having failed. + format: int32 + minimum: 0 + type: integer + tcpSocket: + description: Health is determined by if the proxy is able to connect. properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. + host: type: string + port: + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + required: + - port type: object + timeoutSeconds: + description: Number of seconds after which the probe times out. + format: int32 + minimum: 0 + type: integer type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: false - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - helm.sh/resource-policy: keep - labels: - app.kubernetes.io/instance: istio - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.4 - helm.sh/chart: base-1.29.4 - name: workloadgroups.networking.istio.io -spec: - group: networking.istio.io - names: - categories: - - istio-io - - networking-istio-io - kind: WorkloadGroup - listKind: WorkloadGroupList - plural: workloadgroups - shortNames: - - wg - singular: workloadgroup - scope: Namespaced - versions: - - additionalPrinterColumns: - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is represented - in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for - lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Describes a collection of workload instances. See more details - at: https://istio.io/docs/reference/config/networking/workload-group.html' - properties: - metadata: - description: Metadata that will be used for all corresponding `WorkloadEntries`. - properties: - annotations: - additionalProperties: + template: + description: Template to be used for the generation of `WorkloadEntry` resources that belong to this `WorkloadGroup`. + properties: + address: + description: Address associated with the network endpoint without the port. + maxLength: 256 type: string - maxProperties: 256 - type: object - labels: - additionalProperties: + x-kubernetes-validations: + - message: UDS must be an absolute path or abstract socket + rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" || self.substring(7, 8) == "@") : true' + - message: UDS may not be a dir + rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' + labels: + additionalProperties: + type: string + description: One or more labels associated with the endpoint. + maxProperties: 256 + type: object + locality: + description: The locality associated with the endpoint. + maxLength: 2048 type: string - maxProperties: 256 - type: object - type: object - probe: - description: '`ReadinessProbe` describes the configuration the user - must provide for healthchecking on their workload.' - oneOf: - - not: - anyOf: - - required: - - httpGet - - required: - - tcpSocket - - required: - - exec - - required: - - grpc - - required: - - httpGet - - required: - - tcpSocket - - required: - - exec - - required: - - grpc - properties: - exec: - description: Health is determined by how the command that is executed - exited. - properties: - command: - description: Command to run. - items: - minLength: 1 - type: string - type: array - required: - - command - type: object - failureThreshold: - description: Minimum consecutive failures for the probe to be - considered failed after having succeeded. - format: int32 - minimum: 0 - type: integer - grpc: - description: GRPC call is made and response/error is used to determine - health. - properties: - port: - description: Port on which the endpoint lives. + network: + description: Network enables Istio to group endpoints resident in the same L3 domain/network. + maxLength: 2048 + type: string + ports: + additionalProperties: maximum: 4294967295 minimum: 0 type: integer x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - service: - type: string - type: object - httpGet: - description: '`httpGet` is performed to a given endpoint and the - status/able to connect determines health.' + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + description: Set of ports associated with the endpoint. + maxProperties: 128 + type: object + x-kubernetes-validations: + - message: port name must be valid + rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) + serviceAccount: + description: The service account associated with the workload if a sidecar is present in the workload. + maxLength: 253 + type: string + weight: + description: The load balancing weight associated with the endpoint. + maximum: 4294967295 + minimum: 0 + type: integer + type: object + x-kubernetes-validations: + - message: UDS may not include ports + rule: '(has(self.address) ? self.address : "").startsWith("unix://") ? !has(self.ports) : true' + required: + - template + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: properties: - host: - description: Host name to connect to, defaults to the pod - IP. + lastProbeTime: + description: Last time we probed the condition. + format: date-time type: string - httpHeaders: - description: Headers the proxy will pass on to make the request. - items: - properties: - name: - pattern: ^[-_A-Za-z0-9]+$ - type: string - value: - type: string - type: object - type: array - path: - description: Path to access on the HTTP server. + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time type: string - port: - description: Port on which the endpoint lives. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - scheme: + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. type: string - x-kubernetes-validations: - - message: scheme must be one of [HTTP, HTTPS] - rule: self in ["", "HTTP", "HTTPS"] - required: - - port type: object - initialDelaySeconds: - description: Number of seconds after the container has started - before readiness probes are initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: How often (in seconds) to perform the probe. - format: int32 - minimum: 0 - type: integer - successThreshold: - description: Minimum consecutive successes for the probe to be - considered successful after having failed. - format: int32 - minimum: 0 - type: integer - tcpSocket: - description: Health is determined by if the proxy is able to connect. + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: properties: - host: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. type: string - port: - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - required: - - port - type: object - timeoutSeconds: - description: Number of seconds after which the probe times out. - format: int32 - minimum: 0 - type: integer - type: object - template: - description: Template to be used for the generation of `WorkloadEntry` - resources that belong to this `WorkloadGroup`. - properties: - address: - description: Address associated with the network endpoint without - the port. - maxLength: 256 - type: string - x-kubernetes-validations: - - message: UDS must be an absolute path or abstract socket - rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == - "/" || self.substring(7, 8) == "@") : true' - - message: UDS may not be a dir - rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' - labels: - additionalProperties: - type: string - description: One or more labels associated with the endpoint. - maxProperties: 256 + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object type: object - locality: - description: The locality associated with the endpoint. - maxLength: 2048 - type: string - network: - description: Network enables Istio to group endpoints resident - in the same L3 domain/network. - maxLength: 2048 - type: string - ports: - additionalProperties: - maximum: 4294967295 + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha3 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Describes a collection of workload instances. See more details at: https://istio.io/docs/reference/config/networking/workload-group.html' + properties: + metadata: + description: Metadata that will be used for all corresponding `WorkloadEntries`. + properties: + annotations: + additionalProperties: + type: string + maxProperties: 256 + type: object + labels: + additionalProperties: + type: string + maxProperties: 256 + type: object + type: object + probe: + description: '`ReadinessProbe` describes the configuration the user must provide for healthchecking on their workload.' + oneOf: + - not: + anyOf: + - required: + - httpGet + - required: + - tcpSocket + - required: + - exec + - required: + - grpc + - required: + - httpGet + - required: + - tcpSocket + - required: + - exec + - required: + - grpc + properties: + exec: + description: Health is determined by how the command that is executed exited. + properties: + command: + description: Command to run. + items: + minLength: 1 + type: string + type: array + required: + - command + type: object + failureThreshold: + description: Minimum consecutive failures for the probe to be considered failed after having succeeded. + format: int32 + minimum: 0 + type: integer + grpc: + description: GRPC call is made and response/error is used to determine health. + properties: + port: + description: Port on which the endpoint lives. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + service: + type: string + type: object + httpGet: + description: '`httpGet` is performed to a given endpoint and the status/able to connect determines health.' + properties: + host: + description: Host name to connect to, defaults to the pod IP. + type: string + httpHeaders: + description: Headers the proxy will pass on to make the request. + items: + properties: + name: + pattern: ^[-_A-Za-z0-9]+$ + type: string + value: + type: string + type: object + type: array + path: + description: Path to access on the HTTP server. + type: string + port: + description: Port on which the endpoint lives. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + scheme: + type: string + x-kubernetes-validations: + - message: scheme must be one of [HTTP, HTTPS] + rule: self in ["", "HTTP", "HTTPS"] + required: + - port + type: object + initialDelaySeconds: + description: Number of seconds after the container has started before readiness probes are initiated. + format: int32 + minimum: 0 + type: integer + periodSeconds: + description: How often (in seconds) to perform the probe. + format: int32 + minimum: 0 + type: integer + successThreshold: + description: Minimum consecutive successes for the probe to be considered successful after having failed. + format: int32 + minimum: 0 + type: integer + tcpSocket: + description: Health is determined by if the proxy is able to connect. + properties: + host: + type: string + port: + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + required: + - port + type: object + timeoutSeconds: + description: Number of seconds after which the probe times out. + format: int32 minimum: 0 type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - description: Set of ports associated with the endpoint. - maxProperties: 128 - type: object - x-kubernetes-validations: - - message: port name must be valid - rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) - serviceAccount: - description: The service account associated with the workload - if a sidecar is present in the workload. - maxLength: 253 - type: string - weight: - description: The load balancing weight associated with the endpoint. - maximum: 4294967295 - minimum: 0 - type: integer - type: object - x-kubernetes-validations: - - message: UDS may not include ports - rule: '(has(self.address) ? self.address : "").startsWith("unix://") - ? !has(self.ports) : true' - required: - - template - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: + template: + description: Template to be used for the generation of `WorkloadEntry` resources that belong to this `WorkloadGroup`. properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. - - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO + address: + description: Address associated with the network endpoint without the port. + maxLength: 256 type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string + x-kubernetes-validations: + - message: UDS must be an absolute path or abstract socket + rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" || self.substring(7, 8) == "@") : true' + - message: UDS may not be a dir + rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' + labels: + additionalProperties: + type: string + description: One or more labels associated with the endpoint. + maxProperties: 256 type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} - - additionalPrinterColumns: - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is represented - in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for - lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1alpha3 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Describes a collection of workload instances. See more details - at: https://istio.io/docs/reference/config/networking/workload-group.html' - properties: - metadata: - description: Metadata that will be used for all corresponding `WorkloadEntries`. - properties: - annotations: - additionalProperties: + locality: + description: The locality associated with the endpoint. + maxLength: 2048 type: string - maxProperties: 256 - type: object - labels: - additionalProperties: + network: + description: Network enables Istio to group endpoints resident in the same L3 domain/network. + maxLength: 2048 type: string - maxProperties: 256 - type: object - type: object - probe: - description: '`ReadinessProbe` describes the configuration the user - must provide for healthchecking on their workload.' - oneOf: - - not: - anyOf: - - required: - - httpGet - - required: - - tcpSocket - - required: - - exec - - required: - - grpc - - required: - - httpGet - - required: - - tcpSocket - - required: - - exec - - required: - - grpc - properties: - exec: - description: Health is determined by how the command that is executed - exited. - properties: - command: - description: Command to run. - items: - minLength: 1 - type: string - type: array - required: - - command - type: object - failureThreshold: - description: Minimum consecutive failures for the probe to be - considered failed after having succeeded. - format: int32 - minimum: 0 - type: integer - grpc: - description: GRPC call is made and response/error is used to determine - health. - properties: - port: - description: Port on which the endpoint lives. + ports: + additionalProperties: maximum: 4294967295 minimum: 0 type: integer x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - service: - type: string - type: object - httpGet: - description: '`httpGet` is performed to a given endpoint and the - status/able to connect determines health.' + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + description: Set of ports associated with the endpoint. + maxProperties: 128 + type: object + x-kubernetes-validations: + - message: port name must be valid + rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) + serviceAccount: + description: The service account associated with the workload if a sidecar is present in the workload. + maxLength: 253 + type: string + weight: + description: The load balancing weight associated with the endpoint. + maximum: 4294967295 + minimum: 0 + type: integer + type: object + x-kubernetes-validations: + - message: UDS may not include ports + rule: '(has(self.address) ? self.address : "").startsWith("unix://") ? !has(self.ports) : true' + required: + - template + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: properties: - host: - description: Host name to connect to, defaults to the pod - IP. + lastProbeTime: + description: Last time we probed the condition. + format: date-time type: string - httpHeaders: - description: Headers the proxy will pass on to make the request. - items: - properties: - name: - pattern: ^[-_A-Za-z0-9]+$ - type: string - value: - type: string - type: object - type: array - path: - description: Path to access on the HTTP server. + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time type: string - port: - description: Port on which the endpoint lives. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - scheme: + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. type: string - x-kubernetes-validations: - - message: scheme must be one of [HTTP, HTTPS] - rule: self in ["", "HTTP", "HTTPS"] - required: - - port type: object - initialDelaySeconds: - description: Number of seconds after the container has started - before readiness probes are initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: How often (in seconds) to perform the probe. - format: int32 - minimum: 0 - type: integer - successThreshold: - description: Minimum consecutive successes for the probe to be - considered successful after having failed. - format: int32 - minimum: 0 - type: integer - tcpSocket: - description: Health is determined by if the proxy is able to connect. + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: properties: - host: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. type: string - port: - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - required: - - port - type: object - timeoutSeconds: - description: Number of seconds after which the probe times out. - format: int32 - minimum: 0 - type: integer - type: object - template: - description: Template to be used for the generation of `WorkloadEntry` - resources that belong to this `WorkloadGroup`. - properties: - address: - description: Address associated with the network endpoint without - the port. - maxLength: 256 - type: string - x-kubernetes-validations: - - message: UDS must be an absolute path or abstract socket - rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == - "/" || self.substring(7, 8) == "@") : true' - - message: UDS may not be a dir - rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' - labels: - additionalProperties: - type: string - description: One or more labels associated with the endpoint. - maxProperties: 256 - type: object - locality: - description: The locality associated with the endpoint. - maxLength: 2048 - type: string - network: - description: Network enables Istio to group endpoints resident - in the same L3 domain/network. - maxLength: 2048 - type: string - ports: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - description: Set of ports associated with the endpoint. - maxProperties: 128 + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object type: object - x-kubernetes-validations: - - message: port name must be valid - rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) - serviceAccount: - description: The service account associated with the workload - if a sidecar is present in the workload. - maxLength: 253 - type: string - weight: - description: The load balancing weight associated with the endpoint. - maximum: 4294967295 - minimum: 0 - type: integer - type: object - x-kubernetes-validations: - - message: UDS may not include ports - rule: '(has(self.address) ? self.address : "").startsWith("unix://") - ? !has(self.ports) : true' - required: - - template - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Describes a collection of workload instances. See more details at: https://istio.io/docs/reference/config/networking/workload-group.html' + properties: + metadata: + description: Metadata that will be used for all corresponding `WorkloadEntries`. properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string + annotations: + additionalProperties: + type: string + maxProperties: 256 + type: object + labels: + additionalProperties: + type: string + maxProperties: 256 + type: object type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: + probe: + description: '`ReadinessProbe` describes the configuration the user must provide for healthchecking on their workload.' + oneOf: + - not: + anyOf: + - required: + - httpGet + - required: + - tcpSocket + - required: + - exec + - required: + - grpc + - required: + - httpGet + - required: + - tcpSocket + - required: + - exec + - required: + - grpc properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. - - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: + exec: + description: Health is determined by how the command that is executed exited. + properties: + command: + description: Command to run. + items: + minLength: 1 + type: string + type: array + required: + - command + type: object + failureThreshold: + description: Minimum consecutive failures for the probe to be considered failed after having succeeded. + format: int32 + minimum: 0 + type: integer + grpc: + description: GRPC call is made and response/error is used to determine health. + properties: + port: + description: Port on which the endpoint lives. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + service: + type: string + type: object + httpGet: + description: '`httpGet` is performed to a given endpoint and the status/able to connect determines health.' properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. + host: + description: Host name to connect to, defaults to the pod IP. + type: string + httpHeaders: + description: Headers the proxy will pass on to make the request. + items: + properties: + name: + pattern: ^[-_A-Za-z0-9]+$ + type: string + value: + type: string + type: object + type: array + path: + description: Path to access on the HTTP server. + type: string + port: + description: Port on which the endpoint lives. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + scheme: type: string - name: - description: A human-readable name for the message type. + x-kubernetes-validations: + - message: scheme must be one of [HTTP, HTTPS] + rule: self in ["", "HTTP", "HTTPS"] + required: + - port + type: object + initialDelaySeconds: + description: Number of seconds after the container has started before readiness probes are initiated. + format: int32 + minimum: 0 + type: integer + periodSeconds: + description: How often (in seconds) to perform the probe. + format: int32 + minimum: 0 + type: integer + successThreshold: + description: Minimum consecutive successes for the probe to be considered successful after having failed. + format: int32 + minimum: 0 + type: integer + tcpSocket: + description: Health is determined by if the proxy is able to connect. + properties: + host: type: string + port: + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + required: + - port type: object + timeoutSeconds: + description: Number of seconds after which the probe times out. + format: int32 + minimum: 0 + type: integer type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: false - subresources: - status: {} - - additionalPrinterColumns: - - description: 'CreationTimestamp is a timestamp representing the server time - when this object was created. It is not guaranteed to be set in happens-before - order across separate operations. Clients may not set this value. It is represented - in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for - lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Describes a collection of workload instances. See more details - at: https://istio.io/docs/reference/config/networking/workload-group.html' - properties: - metadata: - description: Metadata that will be used for all corresponding `WorkloadEntries`. - properties: - annotations: - additionalProperties: + template: + description: Template to be used for the generation of `WorkloadEntry` resources that belong to this `WorkloadGroup`. + properties: + address: + description: Address associated with the network endpoint without the port. + maxLength: 256 + type: string + x-kubernetes-validations: + - message: UDS must be an absolute path or abstract socket + rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" || self.substring(7, 8) == "@") : true' + - message: UDS may not be a dir + rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' + labels: + additionalProperties: + type: string + description: One or more labels associated with the endpoint. + maxProperties: 256 + type: object + locality: + description: The locality associated with the endpoint. + maxLength: 2048 type: string - maxProperties: 256 - type: object - labels: - additionalProperties: + network: + description: Network enables Istio to group endpoints resident in the same L3 domain/network. + maxLength: 2048 type: string - maxProperties: 256 - type: object - type: object - probe: - description: '`ReadinessProbe` describes the configuration the user - must provide for healthchecking on their workload.' - oneOf: - - not: - anyOf: - - required: - - httpGet - - required: - - tcpSocket - - required: - - exec - - required: - - grpc - - required: - - httpGet - - required: - - tcpSocket - - required: - - exec - - required: - - grpc - properties: - exec: - description: Health is determined by how the command that is executed - exited. - properties: - command: - description: Command to run. - items: - minLength: 1 - type: string - type: array - required: - - command - type: object - failureThreshold: - description: Minimum consecutive failures for the probe to be - considered failed after having succeeded. - format: int32 - minimum: 0 - type: integer - grpc: - description: GRPC call is made and response/error is used to determine - health. - properties: - port: - description: Port on which the endpoint lives. + ports: + additionalProperties: maximum: 4294967295 minimum: 0 type: integer x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - service: - type: string - type: object - httpGet: - description: '`httpGet` is performed to a given endpoint and the - status/able to connect determines health.' + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + description: Set of ports associated with the endpoint. + maxProperties: 128 + type: object + x-kubernetes-validations: + - message: port name must be valid + rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) + serviceAccount: + description: The service account associated with the workload if a sidecar is present in the workload. + maxLength: 253 + type: string + weight: + description: The load balancing weight associated with the endpoint. + maximum: 4294967295 + minimum: 0 + type: integer + type: object + x-kubernetes-validations: + - message: UDS may not include ports + rule: '(has(self.address) ? self.address : "").startsWith("unix://") ? !has(self.ports) : true' + required: + - template + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: properties: - host: - description: Host name to connect to, defaults to the pod - IP. + lastProbeTime: + description: Last time we probed the condition. + format: date-time type: string - httpHeaders: - description: Headers the proxy will pass on to make the request. - items: - properties: - name: - pattern: ^[-_A-Za-z0-9]+$ - type: string - value: - type: string - type: object - type: array - path: - description: Path to access on the HTTP server. + lastTransitionTime: + description: Last time the condition transitioned from one status to another. + format: date-time type: string - port: - description: Port on which the endpoint lives. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - scheme: + message: + description: Human-readable message indicating details about last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. type: string - x-kubernetes-validations: - - message: scheme must be one of [HTTP, HTTPS] - rule: self in ["", "HTTP", "HTTPS"] - required: - - port type: object - initialDelaySeconds: - description: Number of seconds after the container has started - before readiness probes are initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: How often (in seconds) to perform the probe. - format: int32 - minimum: 0 - type: integer - successThreshold: - description: Minimum consecutive successes for the probe to be - considered successful after having failed. - format: int32 - minimum: 0 - type: integer - tcpSocket: - description: Health is determined by if the proxy is able to connect. + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: properties: - host: + documentationUrl: + description: A url pointing to the Istio documentation for this specific error type. type: string - port: - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - required: - - port - type: object - timeoutSeconds: - description: Number of seconds after which the probe times out. - format: int32 - minimum: 0 - type: integer - type: object - template: - description: Template to be used for the generation of `WorkloadEntry` - resources that belong to this `WorkloadGroup`. - properties: - address: - description: Address associated with the network endpoint without - the port. - maxLength: 256 - type: string - x-kubernetes-validations: - - message: UDS must be an absolute path or abstract socket - rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == - "/" || self.substring(7, 8) == "@") : true' - - message: UDS may not be a dir - rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' - labels: - additionalProperties: - type: string - description: One or more labels associated with the endpoint. - maxProperties: 256 - type: object - locality: - description: The locality associated with the endpoint. - maxLength: 2048 - type: string - network: - description: Network enables Istio to group endpoints resident - in the same L3 domain/network. - maxLength: 2048 - type: string - ports: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - description: Set of ports associated with the endpoint. - maxProperties: 128 - type: object - x-kubernetes-validations: - - message: port name must be valid - rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) - serviceAccount: - description: The service account associated with the workload - if a sidecar is present in the workload. - maxLength: 253 - type: string - weight: - description: The load balancing weight associated with the endpoint. - maximum: 4294967295 - minimum: 0 - type: integer - type: object - x-kubernetes-validations: - - message: UDS may not include ports - rule: '(has(self.address) ? self.address : "").startsWith("unix://") - ? !has(self.ports) : true' - required: - - template - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status - to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about - last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's - last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this - specific error type. - type: string - level: - description: |- - Represents how severe a message is. + level: + description: |- + Represents how severe a message is. - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` - intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: false - subresources: - status: {} + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} --- apiVersion: v1 kind: ServiceAccount @@ -17900,106 +16107,106 @@ metadata: release: istio name: istio-reader-clusterrole-default rules: -- apiGroups: - - config.istio.io - - security.istio.io - - networking.istio.io - - authentication.istio.io - - rbac.istio.io - - telemetry.istio.io - - extensions.istio.io - resources: - - '*' - verbs: - - get - - list - - watch -- apiGroups: - - '' - resources: - - endpoints - - pods - - services - - nodes - - replicationcontrollers - - namespaces - - secrets - - configmaps - verbs: - - get - - list - - watch -- apiGroups: - - networking.istio.io - resources: - - workloadentries - verbs: - - get - - watch - - list -- apiGroups: - - networking.x-k8s.io - - gateway.networking.k8s.io - resources: - - gateways - verbs: - - get - - watch - - list -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - get - - list - - watch -- apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - - watch -- apiGroups: - - multicluster.x-k8s.io - resources: - - serviceexports - verbs: - - get - - list - - watch - - create - - delete -- apiGroups: - - multicluster.x-k8s.io - resources: - - serviceimports - verbs: - - get - - list - - watch -- apiGroups: - - apps - resources: - - replicasets - verbs: - - get - - list - - watch -- apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create -- apiGroups: - - authorization.k8s.io - resources: - - subjectaccessreviews - verbs: - - create + - apiGroups: + - config.istio.io + - security.istio.io + - networking.istio.io + - authentication.istio.io + - rbac.istio.io + - telemetry.istio.io + - extensions.istio.io + resources: + - '*' + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - endpoints + - pods + - services + - nodes + - replicationcontrollers + - namespaces + - secrets + - configmaps + verbs: + - get + - list + - watch + - apiGroups: + - networking.istio.io + resources: + - workloadentries + verbs: + - get + - watch + - list + - apiGroups: + - networking.x-k8s.io + - gateway.networking.k8s.io + resources: + - gateways + verbs: + - get + - watch + - list + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch + - apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - get + - list + - watch + - apiGroups: + - multicluster.x-k8s.io + resources: + - serviceexports + verbs: + - get + - list + - watch + - create + - delete + - apiGroups: + - multicluster.x-k8s.io + resources: + - serviceimports + verbs: + - get + - list + - watch + - apiGroups: + - apps + resources: + - replicasets + verbs: + - get + - list + - watch + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -18015,235 +16222,235 @@ metadata: release: istio name: istiod-clusterrole-default rules: -- apiGroups: - - admissionregistration.k8s.io - resources: - - mutatingwebhookconfigurations - verbs: - - get - - list - - watch - - update - - patch -- apiGroups: - - admissionregistration.k8s.io - resources: - - validatingwebhookconfigurations - verbs: - - get - - list - - watch - - update -- apiGroups: - - config.istio.io - - security.istio.io - - networking.istio.io - - authentication.istio.io - - rbac.istio.io - - telemetry.istio.io - - extensions.istio.io - resources: - - '*' - verbs: - - get - - watch - - list -- apiGroups: - - networking.istio.io - resources: - - workloadentries - verbs: - - get - - watch - - list - - update - - patch - - create - - delete -- apiGroups: - - networking.istio.io - resources: - - workloadentries/status - - serviceentries/status - verbs: - - get - - watch - - list - - update - - patch - - create - - delete -- apiGroups: - - security.istio.io - resources: - - authorizationpolicies/status - verbs: - - get - - watch - - list - - update - - patch - - create - - delete -- apiGroups: - - '' - resources: - - services/status - verbs: - - get - - watch - - list - - update - - patch - - create - - delete -- apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - get - - list - - watch -- apiGroups: - - '' - resources: - - pods - - nodes - - services - - namespaces - - endpoints - verbs: - - get - - list - - watch -- apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - - watch -- apiGroups: - - networking.k8s.io - resources: - - ingresses - - ingressclasses - verbs: - - get - - list - - watch -- apiGroups: - - networking.k8s.io - resources: - - ingresses/status - verbs: - - '*' -- apiGroups: - - '' - resources: - - configmaps - verbs: - - create - - get - - list - - watch - - update -- apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create -- apiGroups: - - authorization.k8s.io - resources: - - subjectaccessreviews - verbs: - - create -- apiGroups: - - gateway.networking.k8s.io - - gateway.networking.x-k8s.io - resources: - - '*' - verbs: - - get - - watch - - list -- apiGroups: - - gateway.networking.x-k8s.io - resources: - - xbackendtrafficpolicies/status - - xlistenersets/status - verbs: - - update - - patch -- apiGroups: - - gateway.networking.k8s.io - resources: - - backendtlspolicies/status - - gatewayclasses/status - - gateways/status - - grpcroutes/status - - httproutes/status - - referencegrants/status - - tcproutes/status - - tlsroutes/status - - udproutes/status - verbs: - - update - - patch -- apiGroups: - - gateway.networking.k8s.io - resources: - - gatewayclasses - verbs: - - create - - update - - patch - - delete -- apiGroups: - - inference.networking.k8s.io - resources: - - inferencepools - verbs: - - get - - watch - - list -- apiGroups: - - inference.networking.k8s.io - resources: - - inferencepools/status - verbs: - - update - - patch -- apiGroups: - - '' - resources: - - secrets - verbs: - - get - - watch - - list -- apiGroups: - - multicluster.x-k8s.io - resources: - - serviceexports - verbs: - - get - - watch - - list - - create - - delete -- apiGroups: - - multicluster.x-k8s.io - resources: - - serviceimports - verbs: - - get - - watch - - list + - apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + verbs: + - get + - list + - watch + - update + - patch + - apiGroups: + - admissionregistration.k8s.io + resources: + - validatingwebhookconfigurations + verbs: + - get + - list + - watch + - update + - apiGroups: + - config.istio.io + - security.istio.io + - networking.istio.io + - authentication.istio.io + - rbac.istio.io + - telemetry.istio.io + - extensions.istio.io + resources: + - '*' + verbs: + - get + - watch + - list + - apiGroups: + - networking.istio.io + resources: + - workloadentries + verbs: + - get + - watch + - list + - update + - patch + - create + - delete + - apiGroups: + - networking.istio.io + resources: + - workloadentries/status + - serviceentries/status + verbs: + - get + - watch + - list + - update + - patch + - create + - delete + - apiGroups: + - security.istio.io + resources: + - authorizationpolicies/status + verbs: + - get + - watch + - list + - update + - patch + - create + - delete + - apiGroups: + - "" + resources: + - services/status + verbs: + - get + - watch + - list + - update + - patch + - create + - delete + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - pods + - nodes + - services + - namespaces + - endpoints + verbs: + - get + - list + - watch + - apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - get + - list + - watch + - apiGroups: + - networking.k8s.io + resources: + - ingresses + - ingressclasses + verbs: + - get + - list + - watch + - apiGroups: + - networking.k8s.io + resources: + - ingresses/status + verbs: + - '*' + - apiGroups: + - "" + resources: + - configmaps + verbs: + - create + - get + - list + - watch + - update + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create + - apiGroups: + - gateway.networking.k8s.io + - gateway.networking.x-k8s.io + resources: + - '*' + verbs: + - get + - watch + - list + - apiGroups: + - gateway.networking.x-k8s.io + resources: + - xbackendtrafficpolicies/status + - xlistenersets/status + verbs: + - update + - patch + - apiGroups: + - gateway.networking.k8s.io + resources: + - backendtlspolicies/status + - gatewayclasses/status + - gateways/status + - grpcroutes/status + - httproutes/status + - referencegrants/status + - tcproutes/status + - tlsroutes/status + - udproutes/status + verbs: + - update + - patch + - apiGroups: + - gateway.networking.k8s.io + resources: + - gatewayclasses + verbs: + - create + - update + - patch + - delete + - apiGroups: + - inference.networking.k8s.io + resources: + - inferencepools + verbs: + - get + - watch + - list + - apiGroups: + - inference.networking.k8s.io + resources: + - inferencepools/status + verbs: + - update + - patch + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - watch + - list + - apiGroups: + - multicluster.x-k8s.io + resources: + - serviceexports + verbs: + - get + - watch + - list + - create + - delete + - apiGroups: + - multicluster.x-k8s.io + resources: + - serviceimports + verbs: + - get + - watch + - list --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -18259,66 +16466,66 @@ metadata: release: istio name: istiod-gateway-controller-default rules: -- apiGroups: - - apps - resources: - - deployments - verbs: - - get - - watch - - list - - update - - patch - - create - - delete -- apiGroups: - - autoscaling - resources: - - horizontalpodautoscalers - verbs: - - get - - watch - - list - - update - - patch - - create - - delete -- apiGroups: - - policy - resources: - - poddisruptionbudgets - verbs: - - get - - watch - - list - - update - - patch - - create - - delete -- apiGroups: - - '' - resources: - - services - verbs: - - get - - watch - - list - - update - - patch - - create - - delete -- apiGroups: - - '' - resources: - - serviceaccounts - verbs: - - get - - watch - - list - - update - - patch - - create - - delete + - apiGroups: + - apps + resources: + - deployments + verbs: + - get + - watch + - list + - update + - patch + - create + - delete + - apiGroups: + - autoscaling + resources: + - horizontalpodautoscalers + verbs: + - get + - watch + - list + - update + - patch + - create + - delete + - apiGroups: + - policy + resources: + - poddisruptionbudgets + verbs: + - get + - watch + - list + - update + - patch + - create + - delete + - apiGroups: + - "" + resources: + - services + verbs: + - get + - watch + - list + - update + - patch + - create + - delete + - apiGroups: + - "" + resources: + - serviceaccounts + verbs: + - get + - watch + - list + - update + - patch + - create + - delete --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -18338,9 +16545,9 @@ roleRef: kind: ClusterRole name: istio-reader-clusterrole-default subjects: -- kind: ServiceAccount - name: istio-reader-service-account - namespace: default + - kind: ServiceAccount + name: istio-reader-service-account + namespace: default --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -18360,9 +16567,9 @@ roleRef: kind: ClusterRole name: istiod-clusterrole-default subjects: -- kind: ServiceAccount - name: istiod - namespace: default + - kind: ServiceAccount + name: istiod + namespace: default --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -18382,9 +16589,9 @@ roleRef: kind: ClusterRole name: istiod-gateway-controller-default subjects: -- kind: ServiceAccount - name: istiod - namespace: default + - kind: ServiceAccount + name: istiod + namespace: default --- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration @@ -18402,35 +16609,35 @@ metadata: release: istio name: istio-validator-default webhooks: -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: istiod - namespace: default - path: /validate - failurePolicy: Ignore - name: rev.validation.istio.io - objectSelector: - matchExpressions: - - key: istio.io/rev - operator: In - values: - - default - rules: - - apiGroups: - - security.istio.io - - networking.istio.io - - telemetry.istio.io - - extensions.istio.io - apiVersions: - - '*' - operations: - - CREATE - - UPDATE - resources: - - '*' - sideEffects: None + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: istiod + namespace: default + path: /validate + failurePolicy: Ignore + name: rev.validation.istio.io + objectSelector: + matchExpressions: + - key: istio.io/rev + operator: In + values: + - default + rules: + - apiGroups: + - security.istio.io + - networking.istio.io + - telemetry.istio.io + - extensions.istio.io + apiVersions: + - '*' + operations: + - CREATE + - UPDATE + resources: + - '*' + sideEffects: None --- apiVersion: v1 data: @@ -18446,9 +16653,9 @@ data: - prometheus enablePrometheusMerge: true extensionProviders: - {{- if .Values.istio.additionalExtensionProviders }} - {{- toYaml .Values.istio.additionalExtensionProviders | nindent 6 }} - {{- end }} + {{- if .Values.istio.additionalExtensionProviders }} + {{- toYaml .Values.istio.additionalExtensionProviders | nindent 6 }} + {{- end }} - envoyExtAuthzHttp: headersToUpstreamOnAllow: - authorization @@ -18480,8 +16687,10 @@ metadata: --- apiVersion: v1 data: - config: '{{ .Files.Get "files/istio-config.yaml" }}' - values: '{{ .Files.Get "files/istio-values.json" }}' + config: |- + {{ .Files.Get "files/istio-config.yaml" }} + values: |- + {{ .Files.Get "files/istio-values.json" }} kind: ConfigMap metadata: labels: @@ -18820,9 +17029,7 @@ data: kind: ConfigMap metadata: annotations: - kubernetes.io/description: This ConfigMap contains the Helm values used during - chart rendering. This ConfigMap is rendered for debugging purposes and external - tooling; modifying these values has no effect. + kubernetes.io/description: This ConfigMap contains the Helm values used during chart rendering. This ConfigMap is rendered for debugging purposes and external tooling; modifying these values has no effect. labels: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm @@ -18854,146 +17061,146 @@ metadata: release: istio name: istio-sidecar-injector-default webhooks: -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: istiod - namespace: default - path: /inject - port: 443 - failurePolicy: Fail - name: rev.namespace.sidecar-injector.istio.io - namespaceSelector: - matchExpressions: - - key: istio.io/rev - operator: In - values: - - default - - key: istio-injection - operator: DoesNotExist - objectSelector: - matchExpressions: - - key: sidecar.istio.io/inject - operator: NotIn - values: - - 'false' - reinvocationPolicy: Never - rules: - - apiGroups: - - '' - apiVersions: - - v1 - operations: - - CREATE - resources: - - pods - sideEffects: None -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: istiod - namespace: default - path: /inject - port: 443 - failurePolicy: Fail - name: rev.object.sidecar-injector.istio.io - namespaceSelector: - matchExpressions: - - key: istio.io/rev - operator: DoesNotExist - - key: istio-injection - operator: DoesNotExist - objectSelector: - matchExpressions: - - key: sidecar.istio.io/inject - operator: NotIn - values: - - 'false' - - key: istio.io/rev - operator: In - values: - - default - reinvocationPolicy: Never - rules: - - apiGroups: - - '' - apiVersions: - - v1 - operations: - - CREATE - resources: - - pods - sideEffects: None -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: istiod - namespace: default - path: /inject - port: 443 - failurePolicy: Fail - name: namespace.sidecar-injector.istio.io - namespaceSelector: - matchExpressions: - - key: istio-injection - operator: In - values: - - enabled - objectSelector: - matchExpressions: - - key: sidecar.istio.io/inject - operator: NotIn - values: - - 'false' - reinvocationPolicy: Never - rules: - - apiGroups: - - '' - apiVersions: - - v1 - operations: - - CREATE - resources: - - pods - sideEffects: None -- admissionReviewVersions: - - v1 - clientConfig: - service: - name: istiod - namespace: default - path: /inject - port: 443 - failurePolicy: Fail - name: object.sidecar-injector.istio.io - namespaceSelector: - matchExpressions: - - key: istio-injection - operator: DoesNotExist - - key: istio.io/rev - operator: DoesNotExist - objectSelector: - matchExpressions: - - key: sidecar.istio.io/inject - operator: In - values: - - 'true' - - key: istio.io/rev - operator: DoesNotExist - reinvocationPolicy: Never - rules: - - apiGroups: - - '' - apiVersions: - - v1 - operations: - - CREATE - resources: - - pods - sideEffects: None + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: istiod + namespace: default + path: /inject + port: 443 + failurePolicy: Fail + name: rev.namespace.sidecar-injector.istio.io + namespaceSelector: + matchExpressions: + - key: istio.io/rev + operator: In + values: + - default + - key: istio-injection + operator: DoesNotExist + objectSelector: + matchExpressions: + - key: sidecar.istio.io/inject + operator: NotIn + values: + - "false" + reinvocationPolicy: Never + rules: + - apiGroups: + - "" + apiVersions: + - v1 + operations: + - CREATE + resources: + - pods + sideEffects: None + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: istiod + namespace: default + path: /inject + port: 443 + failurePolicy: Fail + name: rev.object.sidecar-injector.istio.io + namespaceSelector: + matchExpressions: + - key: istio.io/rev + operator: DoesNotExist + - key: istio-injection + operator: DoesNotExist + objectSelector: + matchExpressions: + - key: sidecar.istio.io/inject + operator: NotIn + values: + - "false" + - key: istio.io/rev + operator: In + values: + - default + reinvocationPolicy: Never + rules: + - apiGroups: + - "" + apiVersions: + - v1 + operations: + - CREATE + resources: + - pods + sideEffects: None + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: istiod + namespace: default + path: /inject + port: 443 + failurePolicy: Fail + name: namespace.sidecar-injector.istio.io + namespaceSelector: + matchExpressions: + - key: istio-injection + operator: In + values: + - enabled + objectSelector: + matchExpressions: + - key: sidecar.istio.io/inject + operator: NotIn + values: + - "false" + reinvocationPolicy: Never + rules: + - apiGroups: + - "" + apiVersions: + - v1 + operations: + - CREATE + resources: + - pods + sideEffects: None + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: istiod + namespace: default + path: /inject + port: 443 + failurePolicy: Fail + name: object.sidecar-injector.istio.io + namespaceSelector: + matchExpressions: + - key: istio-injection + operator: DoesNotExist + - key: istio.io/rev + operator: DoesNotExist + objectSelector: + matchExpressions: + - key: sidecar.istio.io/inject + operator: In + values: + - "true" + - key: istio.io/rev + operator: DoesNotExist + reinvocationPolicy: Never + rules: + - apiGroups: + - "" + apiVersions: + - v1 + operations: + - CREATE + resources: + - pods + sideEffects: None --- apiVersion: apps/v1 kind: Deployment @@ -19024,9 +17231,9 @@ spec: template: metadata: annotations: - prometheus.io/port: '15014' - prometheus.io/scrape: 'true' - sidecar.istio.io/inject: 'false' + prometheus.io/port: "15014" + prometheus.io/scrape: "true" + sidecar.istio.io/inject: "false" labels: app: istiod app.kubernetes.io/instance: istio @@ -19040,140 +17247,140 @@ spec: istio.io/dataplane-mode: none istio.io/rev: default operator.istio.io/component: Pilot - sidecar.istio.io/inject: 'false' + sidecar.istio.io/inject: "false" spec: containers: - - args: - - discovery - - --monitoringAddr=:15014 - - --log_output_level=all:warn - - --domain - - cluster.local - - --keepaliveMaxServerConnectionAge - - 30m - env: - - name: REVISION - value: default - - name: PILOT_CERT_PROVIDER - value: istiod - - name: POD_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.name - - name: POD_NAMESPACE - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.namespace - - name: SERVICE_ACCOUNT - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: spec.serviceAccountName - - name: KUBECONFIG - value: /var/run/secrets/remote/config - - name: CA_TRUSTED_NODE_ACCOUNTS - value: default/ztunnel - - name: PILOT_TRACE_SAMPLING - value: '1' - - name: PILOT_ENABLE_ANALYSIS - value: 'false' - - name: CLUSTER_ID - value: Kubernetes - - name: GOMAXPROCS - valueFrom: - resourceFieldRef: - divisor: '1' - resource: limits.cpu - - name: PLATFORM - value: gke - image: docker.io/istio/pilot:1.29.4 - name: discovery - ports: - - containerPort: 8080 - name: http-debug - protocol: TCP - - containerPort: 15010 - name: grpc-xds - protocol: TCP - - containerPort: 15012 - name: tls-xds - protocol: TCP - - containerPort: 15017 - name: https-webhooks - protocol: TCP - - containerPort: 15014 - name: http-monitoring - protocol: TCP - readinessProbe: - httpGet: - path: /ready - port: 8080 - initialDelaySeconds: 1 - periodSeconds: 3 - timeoutSeconds: 5 - resources: - requests: - cpu: 500m - memory: 2048Mi - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - volumeMounts: - - mountPath: /var/run/secrets/tokens - name: istio-token - readOnly: true - - mountPath: /var/run/secrets/istio-dns - name: local-certs - - mountPath: /etc/cacerts - name: cacerts - readOnly: true - - mountPath: /var/run/secrets/remote - name: istio-kubeconfig - readOnly: true - - mountPath: /var/run/secrets/istiod/tls - name: istio-csr-dns-cert - readOnly: true - - mountPath: /var/run/secrets/istiod/ca - name: istio-csr-ca-configmap - readOnly: true + - args: + - discovery + - --monitoringAddr=:15014 + - --log_output_level=all:warn + - --domain + - cluster.local + - --keepaliveMaxServerConnectionAge + - 30m + env: + - name: REVISION + value: default + - name: PILOT_CERT_PROVIDER + value: istiod + - name: POD_NAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + - name: SERVICE_ACCOUNT + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: spec.serviceAccountName + - name: KUBECONFIG + value: /var/run/secrets/remote/config + - name: CA_TRUSTED_NODE_ACCOUNTS + value: default/ztunnel + - name: PILOT_TRACE_SAMPLING + value: "1" + - name: PILOT_ENABLE_ANALYSIS + value: "false" + - name: CLUSTER_ID + value: Kubernetes + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + divisor: "1" + resource: limits.cpu + - name: PLATFORM + value: gke + image: docker.io/istio/pilot:1.29.4 + name: discovery + ports: + - containerPort: 8080 + name: http-debug + protocol: TCP + - containerPort: 15010 + name: grpc-xds + protocol: TCP + - containerPort: 15012 + name: tls-xds + protocol: TCP + - containerPort: 15017 + name: https-webhooks + protocol: TCP + - containerPort: 15014 + name: http-monitoring + protocol: TCP + readinessProbe: + httpGet: + path: /ready + port: 8080 + initialDelaySeconds: 1 + periodSeconds: 3 + timeoutSeconds: 5 + resources: + requests: + cpu: 500m + memory: 2048Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + volumeMounts: + - mountPath: /var/run/secrets/tokens + name: istio-token + readOnly: true + - mountPath: /var/run/secrets/istio-dns + name: local-certs + - mountPath: /etc/cacerts + name: cacerts + readOnly: true + - mountPath: /var/run/secrets/remote + name: istio-kubeconfig + readOnly: true + - mountPath: /var/run/secrets/istiod/tls + name: istio-csr-dns-cert + readOnly: true + - mountPath: /var/run/secrets/istiod/ca + name: istio-csr-ca-configmap + readOnly: true serviceAccountName: istiod tolerations: - - key: cni.istio.io/not-ready - operator: Exists + - key: cni.istio.io/not-ready + operator: Exists volumes: - - emptyDir: - medium: Memory - name: local-certs - - name: istio-token - projected: - sources: - - serviceAccountToken: - audience: istio-ca - expirationSeconds: 43200 - path: istio-token - - name: cacerts - secret: - optional: true - secretName: cacerts - - name: istio-kubeconfig - secret: - optional: true - secretName: istio-kubeconfig - - name: istio-csr-dns-cert - secret: - optional: true - secretName: istiod-tls - - configMap: - defaultMode: 420 - name: istio-ca-root-cert - optional: true - name: istio-csr-ca-configmap + - emptyDir: + medium: Memory + name: local-certs + - name: istio-token + projected: + sources: + - serviceAccountToken: + audience: istio-ca + expirationSeconds: 43200 + path: istio-token + - name: cacerts + secret: + optional: true + secretName: cacerts + - name: istio-kubeconfig + secret: + optional: true + secretName: istio-kubeconfig + - name: istio-csr-dns-cert + secret: + optional: true + secretName: istiod-tls + - configMap: + defaultMode: 420 + name: istio-ca-root-cert + optional: true + name: istio-csr-ca-configmap --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role @@ -19190,38 +17397,38 @@ metadata: name: istiod namespace: default rules: -- apiGroups: - - networking.istio.io - resources: - - gateways - verbs: - - create -- apiGroups: - - '' - resources: - - secrets - verbs: - - create - - get - - watch - - list - - update - - delete -- apiGroups: - - '' - resources: - - configmaps - verbs: - - delete -- apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - get - - update - - patch - - create + - apiGroups: + - networking.istio.io + resources: + - gateways + verbs: + - create + - apiGroups: + - "" + resources: + - secrets + verbs: + - create + - get + - watch + - list + - update + - delete + - apiGroups: + - "" + resources: + - configmaps + verbs: + - delete + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - update + - patch + - create --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -19242,9 +17449,9 @@ roleRef: kind: Role name: istiod subjects: -- kind: ServiceAccount - name: istiod - namespace: default + - kind: ServiceAccount + name: istiod + namespace: default --- apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler @@ -19266,12 +17473,12 @@ metadata: spec: maxReplicas: 5 metrics: - - resource: - name: cpu - target: - averageUtilization: 80 - type: Utilization - type: Resource + - resource: + name: cpu + target: + averageUtilization: 80 + type: Utilization + type: Resource minReplicas: 1 scaleTargetRef: apiVersion: apps/v1 @@ -19298,20 +17505,22 @@ metadata: namespace: default spec: ports: - - name: grpc-xds - port: 15010 - protocol: TCP - - name: https-dns - port: 15012 - protocol: TCP - - name: https-webhook - port: 443 - protocol: TCP - targetPort: 15017 - - name: http-monitoring - port: 15014 - protocol: TCP + - name: grpc-xds + port: 15010 + protocol: TCP + - name: https-dns + port: 15012 + protocol: TCP + - name: https-webhook + port: 443 + protocol: TCP + targetPort: 15017 + - name: http-monitoring + port: 15014 + protocol: TCP selector: app: istiod istio: pilot +--- + {{- end }} diff --git a/third_party/istio/istio-values.json b/third_party/istio/istio-values.json index b5827c969..bfe247bc8 100644 --- a/third_party/istio/istio-values.json +++ b/third_party/istio/istio-values.json @@ -135,4 +135,4 @@ "rewriteAppHTTPProbe": true, "templates": {} } -} \ No newline at end of file +} diff --git a/third_party/istio/update-istio.sh b/third_party/istio/update-istio.sh index 17f461206..8e17c2036 100755 --- a/third_party/istio/update-istio.sh +++ b/third_party/istio/update-istio.sh @@ -2,9 +2,17 @@ VERSION=1.29.4 - SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd ) +YQ="${YQ:-yq}" +if ! command -v "${YQ}" &>/dev/null && [[ -x "/usr/local/google/home/tpeslalz/go/bin/yq" ]]; then + YQ="/usr/local/google/home/tpeslalz/go/bin/yq" +fi +if ! "${YQ}" --version 2>&1 | grep -q "yq"; then + echo "Error: yq is required for update-istio.sh." >&2 + exit 1 +fi + tmpdir="$(mktemp -d)" trap "rm -rf '${tmpdir}'" EXIT echo "Downloading istioctl ${VERSION}..." @@ -17,9 +25,6 @@ if [[ ! -x "${istioctl}" ]] ; then exit 1 fi -# Istio needs to be able to check the Kubernetes version, otherwise it targets -# 1.20 which is very old. It doesn't need to be identical to the target system, -# just not too far off that we have compatibility issues. if ! kubectl version --output=yaml "$@" >/dev/null; then echo "Failed to check kubernetes version." >&2 echo "Try using --context=minikube or another valid context." >&2 @@ -28,50 +33,23 @@ fi echo "Updating to istio $("${istioctl}" version --remote=false)..." -# Step 1: Generate Istio YAML. See istio_operator.yaml for our tweaks to the -# default profile. -# https://istio.io/latest/docs/setup/additional-setup/customize-installation/ - "${istioctl}" manifest generate \ -f "${SCRIPT_DIR}/istio_operator.yaml" \ --cluster-specific \ "$@" > ${tmpdir}/istio_full.yaml -# Step 2: Extract golang template -python3 -c ' -import sys, yaml - -full_file = sys.argv[1] -config_file = sys.argv[2] -values_file = sys.argv[3] -out_file = sys.argv[4] - -with open(full_file, "r") as f: - docs = list(yaml.safe_load_all(f)) - -docs = [d for d in docs if d is not None] - -for doc in docs: - if doc.get("kind") == "ConfigMap" and doc.get("metadata", {}).get("name") == "istio-sidecar-injector": - data = doc.setdefault("data", {}) - if "config" in data: - with open(config_file, "w") as f: - f.write(data["config"]) - data["config"] = "{{ .Files.Get \"files/istio-config.yaml\" }}" - if "values" in data: - with open(values_file, "w") as f: - f.write(data["values"]) - data["values"] = "{{ .Files.Get \"files/istio-values.json\" }}" - -class MultilineDumper(yaml.SafeDumper): - def represent_scalar(self, tag, value, style=None): - if "\n" in value and tag == "tag:yaml.org,2002:str": - style = "|" - return super().represent_scalar(tag, value, style) - -with open(out_file, "w") as f: - yaml.dump_all(docs, f, Dumper=MultilineDumper, default_flow_style=False) -' "${tmpdir}/istio_full.yaml" "${SCRIPT_DIR}/istio-config.yaml" "${SCRIPT_DIR}/istio-values.json" "${tmpdir}/istio.yaml" +# Step 2: Extract golang template (using yq v4+) +"${YQ}" '. | select(.kind == "ConfigMap" and .metadata.name == "istio-sidecar-injector").data.config' \ + "${tmpdir}/istio_full.yaml" > "${SCRIPT_DIR}/istio-config.yaml" +"${YQ}" '. | select(.kind == "ConfigMap" and .metadata.name == "istio-sidecar-injector").data.values' \ + "${tmpdir}/istio_full.yaml" > "${SCRIPT_DIR}/istio-values.json" + +cat "${tmpdir}/istio_full.yaml" \ + | "${YQ}" '(. | select(.kind == "ConfigMap" and .metadata.name == "istio-sidecar-injector").data.config) = "{{ .Files.Get \"files/istio-config.yaml\" }}"' - \ + | "${YQ}" '(. | select(.kind == "ConfigMap" and .metadata.name == "istio-sidecar-injector").data.values) = "{{ .Files.Get \"files/istio-values.json\" }}"' - \ + | grep -Ev "^(null|--- null|\.\.\.)$" \ + | sed 's/: '\''{{ .Files.Get "\(.*\)" }}'\''/: |-\n{{ .Files.Get "\1" | nindent 4 }}/g' \ + > "${tmpdir}/istio.yaml" # Step 3: Download and save Istio Grafana dashboards echo "Downloading Istio Grafana dashboards..." @@ -115,30 +93,20 @@ dst="${SCRIPT_DIR}/istio-generated.yaml" echo "# Istio System Manifests" echo "# ---------------------------------------------------------" python3 -c ' -import sys, yaml - -class MultilineDumper(yaml.SafeDumper): - def represent_scalar(self, tag, value, style=None): - if "\n" in value and tag == "tag:yaml.org,2002:str": - style = "|" - return super().represent_scalar(tag, value, style) +import sys with open(sys.argv[1], "r") as f: - docs = list(yaml.safe_load_all(f)) + content = f.read() snippet = """ {{- if .Values.istio.additionalExtensionProviders }} {{- toYaml .Values.istio.additionalExtensionProviders | nindent 6 }} {{- end }}""" -for doc in docs: - if doc and doc.get("kind") == "ConfigMap" and doc.get("metadata", {}).get("name") == "istio": - mesh_yaml = doc.get("data", {}).get("mesh", "") - if "extensionProviders:" in mesh_yaml and "additionalExtensionProviders" not in mesh_yaml: - mesh_yaml = mesh_yaml.replace("extensionProviders:", "extensionProviders:" + snippet, 1) - doc["data"]["mesh"] = mesh_yaml +if "extensionProviders:" in content and "additionalExtensionProviders" not in content: + content = content.replace("extensionProviders:", "extensionProviders:" + snippet, 1) -yaml.dump_all(docs, sys.stdout, Dumper=MultilineDumper, default_flow_style=False) +sys.stdout.write(content) ' "${tmpdir}/istio.yaml" echo '{{- end }}' } >${dst} From 72db040a3f143f44d42eb256c6745dc92313e0ee Mon Sep 17 00:00:00 2001 From: tpeslalz Date: Wed, 22 Jul 2026 17:31:18 +0000 Subject: [PATCH 6/6] Add mandatory YAML syntax verification step to update-istio.sh Created using jj-spr --- third_party/istio/istio-config.yaml | 2 +- third_party/istio/istio-generated.yaml | 34992 +++++++++++++---------- third_party/istio/istio-values.json | 2 +- third_party/istio/update-istio.sh | 66 +- 4 files changed, 19708 insertions(+), 15354 deletions(-) diff --git a/third_party/istio/istio-config.yaml b/third_party/istio/istio-config.yaml index 4eedd472a..6b84fa42c 100644 --- a/third_party/istio/istio-config.yaml +++ b/third_party/istio/istio-config.yaml @@ -2347,4 +2347,4 @@ templates: spec: selector: matchLabels: - gateway.networking.k8s.io/gateway-name: {{.Name|quote}} + gateway.networking.k8s.io/gateway-name: {{.Name|quote}} \ No newline at end of file diff --git a/third_party/istio/istio-generated.yaml b/third_party/istio/istio-generated.yaml index 473b276a6..76bf2e48e 100644 --- a/third_party/istio/istio-generated.yaml +++ b/third_party/istio/istio-generated.yaml @@ -19,235 +19,272 @@ spec: group: security.istio.io names: categories: - - istio-io - - security-istio-io + - istio-io + - security-istio-io kind: AuthorizationPolicy listKind: AuthorizationPolicyList plural: authorizationpolicies shortNames: - - ap + - ap singular: authorizationpolicy scope: Namespaced versions: - - additionalPrinterColumns: - - description: The operation to take. - jsonPath: .spec.action - name: Action - type: string - - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration for access control on workloads. See more details at: https://istio.io/docs/reference/config/security/authorization-policy.html' - oneOf: - - not: - anyOf: - - required: - - provider + - additionalPrinterColumns: + - description: The operation to take. + jsonPath: .spec.action + name: Action + type: string + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration for access control on workloads. See more + details at: https://istio.io/docs/reference/config/security/authorization-policy.html' + oneOf: + - not: + anyOf: - required: - - provider - properties: - action: - description: |- - Optional. + - provider + - required: + - provider + properties: + action: + description: |- + Optional. - Valid Options: ALLOW, DENY, AUDIT, CUSTOM - enum: - - ALLOW - - DENY - - AUDIT - - CUSTOM - type: string - provider: - description: Specifies detailed configuration of the CUSTOM action. + Valid Options: ALLOW, DENY, AUDIT, CUSTOM + enum: + - ALLOW + - DENY + - AUDIT + - CUSTOM + type: string + provider: + description: Specifies detailed configuration of the CUSTOM action. + properties: + name: + description: Specifies the name of the extension provider. + type: string + type: object + rules: + description: Optional. + items: properties: - name: - description: Specifies the name of the extension provider. - type: string - type: object - rules: - description: Optional. - items: - properties: - from: - description: Optional. - items: - properties: - source: - description: Source specifies the source of a request. - properties: - ipBlocks: - description: Optional. - items: - type: string - type: array - namespaces: - description: Optional. - items: - type: string - type: array - notIpBlocks: - description: Optional. - items: - type: string - type: array - notNamespaces: - description: Optional. - items: - type: string - type: array - notPrincipals: - description: Optional. - items: - type: string - type: array - notRemoteIpBlocks: - description: Optional. - items: - type: string - type: array - notRequestPrincipals: - description: Optional. - items: - type: string - type: array - notServiceAccounts: - description: Optional. - items: - maxLength: 320 - type: string - maxItems: 16 - type: array - principals: - description: Optional. - items: - type: string - type: array - remoteIpBlocks: - description: Optional. - items: - type: string - type: array - requestPrincipals: - description: Optional. - items: - type: string - type: array - serviceAccounts: - description: Optional. - items: - maxLength: 320 - type: string - maxItems: 16 - type: array - type: object - x-kubernetes-validations: - - message: Cannot set serviceAccounts with namespaces or principals - rule: |- - (has(self.serviceAccounts) || has(self.notServiceAccounts)) ? (!has(self.principals) && - !has(self.notPrincipals) && !has(self.namespaces) && !has(self.notNamespaces)) : true - type: object - maxItems: 512 - type: array - to: - description: Optional. - items: - properties: - operation: - description: Operation specifies the operation of a request. - properties: - hosts: - description: Optional. - items: - type: string - type: array - methods: - description: Optional. - items: - type: string - type: array - notHosts: - description: Optional. - items: - type: string - type: array - notMethods: - description: Optional. - items: - type: string - type: array - notPaths: - description: Optional. - items: - type: string - type: array - notPorts: - description: Optional. - items: - type: string - type: array - paths: - description: Optional. - items: - type: string - type: array - ports: - description: Optional. - items: - type: string - type: array - type: object - type: object - type: array - when: - description: Optional. - items: - properties: - key: - description: The name of an Istio attribute. + from: + description: Optional. + items: + properties: + source: + description: Source specifies the source of a request. + properties: + ipBlocks: + description: Optional. + items: + type: string + type: array + namespaces: + description: Optional. + items: + type: string + type: array + notIpBlocks: + description: Optional. + items: + type: string + type: array + notNamespaces: + description: Optional. + items: + type: string + type: array + notPrincipals: + description: Optional. + items: + type: string + type: array + notRemoteIpBlocks: + description: Optional. + items: + type: string + type: array + notRequestPrincipals: + description: Optional. + items: + type: string + type: array + notServiceAccounts: + description: Optional. + items: + maxLength: 320 + type: string + maxItems: 16 + type: array + principals: + description: Optional. + items: + type: string + type: array + remoteIpBlocks: + description: Optional. + items: + type: string + type: array + requestPrincipals: + description: Optional. + items: + type: string + type: array + serviceAccounts: + description: Optional. + items: + maxLength: 320 + type: string + maxItems: 16 + type: array + type: object + x-kubernetes-validations: + - message: Cannot set serviceAccounts with namespaces + or principals + rule: |- + (has(self.serviceAccounts) || has(self.notServiceAccounts)) ? (!has(self.principals) && + !has(self.notPrincipals) && !has(self.namespaces) && !has(self.notNamespaces)) : true + type: object + maxItems: 512 + type: array + to: + description: Optional. + items: + properties: + operation: + description: Operation specifies the operation of a request. + properties: + hosts: + description: Optional. + items: + type: string + type: array + methods: + description: Optional. + items: + type: string + type: array + notHosts: + description: Optional. + items: + type: string + type: array + notMethods: + description: Optional. + items: + type: string + type: array + notPaths: + description: Optional. + items: + type: string + type: array + notPorts: + description: Optional. + items: + type: string + type: array + paths: + description: Optional. + items: + type: string + type: array + ports: + description: Optional. + items: + type: string + type: array + type: object + type: object + type: array + when: + description: Optional. + items: + properties: + key: + description: The name of an Istio attribute. + type: string + notValues: + description: Optional. + items: type: string - notValues: - description: Optional. - items: - type: string - type: array - values: - description: Optional. - items: - type: string - type: array - required: - - key - type: object - type: array - type: object - maxItems: 512 - type: array - selector: - description: Optional. - properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied. - maxProperties: 4096 - type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) + type: array + values: + description: Optional. + items: + type: string + type: array + required: + - key + type: object + type: array type: object - targetRef: + maxItems: 512 + type: array + selector: + description: Optional. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + targetRef: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name + type: object + targetRefs: + description: Optional. + items: properties: group: description: group is the group of the target resource. @@ -269,342 +306,355 @@ spec: description: namespace is the namespace of the referent. type: string x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 required: - - kind - - name + - kind + - name type: object - targetRefs: - description: Optional. - items: - properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: name is the name of the target resource. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: namespace is the namespace of the referent. - type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 - required: - - kind - - name - type: object - maxItems: 16 - type: array - type: object - x-kubernetes-validations: - - message: only one of targetRefs or selector can be set - rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + (has(self.targetRefs) ? 1 : 0) <= 1' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. + maxItems: 16 + type: array + type: object + x-kubernetes-validations: + - message: only one of targetRefs or selector can be set + rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + + (has(self.targetRefs) ? 1 : 0) <= 1' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} - - additionalPrinterColumns: - - description: The operation to take. - jsonPath: .spec.action - name: Action - type: string - - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration for access control on workloads. See more details at: https://istio.io/docs/reference/config/security/authorization-policy.html' - oneOf: - - not: - anyOf: - - required: - - provider + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - description: The operation to take. + jsonPath: .spec.action + name: Action + type: string + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration for access control on workloads. See more + details at: https://istio.io/docs/reference/config/security/authorization-policy.html' + oneOf: + - not: + anyOf: - required: - - provider - properties: - action: - description: |- - Optional. + - provider + - required: + - provider + properties: + action: + description: |- + Optional. - Valid Options: ALLOW, DENY, AUDIT, CUSTOM - enum: - - ALLOW - - DENY - - AUDIT - - CUSTOM - type: string - provider: - description: Specifies detailed configuration of the CUSTOM action. + Valid Options: ALLOW, DENY, AUDIT, CUSTOM + enum: + - ALLOW + - DENY + - AUDIT + - CUSTOM + type: string + provider: + description: Specifies detailed configuration of the CUSTOM action. + properties: + name: + description: Specifies the name of the extension provider. + type: string + type: object + rules: + description: Optional. + items: properties: - name: - description: Specifies the name of the extension provider. - type: string - type: object - rules: - description: Optional. - items: - properties: - from: - description: Optional. - items: - properties: - source: - description: Source specifies the source of a request. - properties: - ipBlocks: - description: Optional. - items: - type: string - type: array - namespaces: - description: Optional. - items: - type: string - type: array - notIpBlocks: - description: Optional. - items: - type: string - type: array - notNamespaces: - description: Optional. - items: - type: string - type: array - notPrincipals: - description: Optional. - items: - type: string - type: array - notRemoteIpBlocks: - description: Optional. - items: - type: string - type: array - notRequestPrincipals: - description: Optional. - items: - type: string - type: array - notServiceAccounts: - description: Optional. - items: - maxLength: 320 - type: string - maxItems: 16 - type: array - principals: - description: Optional. - items: - type: string - type: array - remoteIpBlocks: - description: Optional. - items: - type: string - type: array - requestPrincipals: - description: Optional. - items: - type: string - type: array - serviceAccounts: - description: Optional. - items: - maxLength: 320 - type: string - maxItems: 16 - type: array - type: object - x-kubernetes-validations: - - message: Cannot set serviceAccounts with namespaces or principals - rule: |- - (has(self.serviceAccounts) || has(self.notServiceAccounts)) ? (!has(self.principals) && - !has(self.notPrincipals) && !has(self.namespaces) && !has(self.notNamespaces)) : true - type: object - maxItems: 512 - type: array - to: - description: Optional. - items: - properties: - operation: - description: Operation specifies the operation of a request. - properties: - hosts: - description: Optional. - items: - type: string - type: array - methods: - description: Optional. - items: - type: string - type: array - notHosts: - description: Optional. - items: - type: string - type: array - notMethods: - description: Optional. - items: - type: string - type: array - notPaths: - description: Optional. - items: - type: string - type: array - notPorts: - description: Optional. - items: - type: string - type: array - paths: - description: Optional. - items: - type: string - type: array - ports: - description: Optional. - items: - type: string - type: array - type: object - type: object - type: array - when: - description: Optional. - items: - properties: - key: - description: The name of an Istio attribute. + from: + description: Optional. + items: + properties: + source: + description: Source specifies the source of a request. + properties: + ipBlocks: + description: Optional. + items: + type: string + type: array + namespaces: + description: Optional. + items: + type: string + type: array + notIpBlocks: + description: Optional. + items: + type: string + type: array + notNamespaces: + description: Optional. + items: + type: string + type: array + notPrincipals: + description: Optional. + items: + type: string + type: array + notRemoteIpBlocks: + description: Optional. + items: + type: string + type: array + notRequestPrincipals: + description: Optional. + items: + type: string + type: array + notServiceAccounts: + description: Optional. + items: + maxLength: 320 + type: string + maxItems: 16 + type: array + principals: + description: Optional. + items: + type: string + type: array + remoteIpBlocks: + description: Optional. + items: + type: string + type: array + requestPrincipals: + description: Optional. + items: + type: string + type: array + serviceAccounts: + description: Optional. + items: + maxLength: 320 + type: string + maxItems: 16 + type: array + type: object + x-kubernetes-validations: + - message: Cannot set serviceAccounts with namespaces + or principals + rule: |- + (has(self.serviceAccounts) || has(self.notServiceAccounts)) ? (!has(self.principals) && + !has(self.notPrincipals) && !has(self.namespaces) && !has(self.notNamespaces)) : true + type: object + maxItems: 512 + type: array + to: + description: Optional. + items: + properties: + operation: + description: Operation specifies the operation of a request. + properties: + hosts: + description: Optional. + items: + type: string + type: array + methods: + description: Optional. + items: + type: string + type: array + notHosts: + description: Optional. + items: + type: string + type: array + notMethods: + description: Optional. + items: + type: string + type: array + notPaths: + description: Optional. + items: + type: string + type: array + notPorts: + description: Optional. + items: + type: string + type: array + paths: + description: Optional. + items: + type: string + type: array + ports: + description: Optional. + items: + type: string + type: array + type: object + type: object + type: array + when: + description: Optional. + items: + properties: + key: + description: The name of an Istio attribute. + type: string + notValues: + description: Optional. + items: type: string - notValues: - description: Optional. - items: - type: string - type: array - values: - description: Optional. - items: - type: string - type: array - required: - - key - type: object - type: array - type: object - maxItems: 512 - type: array - selector: - description: Optional. - properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied. - maxProperties: 4096 - type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) + type: array + values: + description: Optional. + items: + type: string + type: array + required: + - key + type: object + type: array type: object - targetRef: + maxItems: 512 + type: array + selector: + description: Optional. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + targetRef: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name + type: object + targetRefs: + description: Optional. + items: properties: group: description: group is the group of the target resource. @@ -626,123 +676,100 @@ spec: description: namespace is the namespace of the referent. type: string x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 required: - - kind - - name + - kind + - name type: object - targetRefs: - description: Optional. - items: - properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: name is the name of the target resource. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: namespace is the namespace of the referent. - type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 - required: - - kind - - name - type: object - maxItems: 16 - type: array - type: object - x-kubernetes-validations: - - message: only one of targetRefs or selector can be set - rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + (has(self.targetRefs) ? 1 : 0) <= 1' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. + maxItems: 16 + type: array + type: object + x-kubernetes-validations: + - message: only one of targetRefs or selector can be set + rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + + (has(self.targetRefs) ? 1 : 0) <= 1' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -760,5239 +787,6020 @@ spec: group: networking.istio.io names: categories: - - istio-io - - networking-istio-io + - istio-io + - networking-istio-io kind: DestinationRule listKind: DestinationRuleList plural: destinationrules shortNames: - - dr + - dr singular: destinationrule scope: Namespaced versions: - - additionalPrinterColumns: - - description: The name of a service from the service registry - jsonPath: .spec.host - name: Host - type: string - - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. For more information, see [Kubernetes API Conventions](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata) - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting load balancing, outlier detection, etc. See more details at: https://istio.io/docs/reference/config/networking/destination-rule.html' - properties: - exportTo: - description: A list of namespaces to which this destination rule is exported. - items: - type: string - type: array - host: - description: The name of a service from the service registry. + - additionalPrinterColumns: + - description: The name of a service from the service registry + jsonPath: .spec.host + name: Host + type: string + - description: CreationTimestamp is a timestamp representing the server time when + this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. For more information, see [Kubernetes API Conventions](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata) + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting load balancing, outlier detection, + etc. See more details at: https://istio.io/docs/reference/config/networking/destination-rule.html' + properties: + exportTo: + description: A list of namespaces to which this destination rule is + exported. + items: type: string - subsets: - description: One or more named sets that represent individual versions of a service. - items: - properties: - labels: - additionalProperties: - type: string - description: Labels apply a filter over the endpoints of a service in the service registry. - type: object - name: - description: Name of the subset. + type: array + host: + description: The name of a service from the service registry. + type: string + subsets: + description: One or more named sets that represent individual versions + of a service. + items: + properties: + labels: + additionalProperties: type: string - trafficPolicy: - description: Traffic policies that apply to this subset. - properties: - connectionPool: - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. + description: Labels apply a filter over the endpoints of a service + in the service registry. + type: object + name: + description: Name of the subset. + type: string + trafficPolicy: + description: Traffic policies that apply to this subset. + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will + be queued while waiting for a ready connection + pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to + a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection + pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams + allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection + to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can + be outstanding to all hosts in a cluster at a + given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will + be preserved while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream + connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections + to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the + socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between keep-alive + probes. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be preserved while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms + probes: + description: Maximum number of keepalive probes + to send without response before deciding the + connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection + needs to be idle before keep-alive probes + start being sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. + type: object + type: object + type: object + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: + - required: + - simple + - required: + - consistentHash + - required: + - simple + - required: + - consistentHash + properties: + consistentHash: + allOf: + - oneOf: + - not: + anyOf: + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - oneOf: + - not: + anyOf: + - required: + - ringHash + - required: + - maglev + - required: + - ringHash + - required: + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. + properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the + cookie attribute. + type: string + required: + - name + type: object + type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name + type: object + httpHeaderName: + description: Hash based on a specific HTTP header. + type: string + httpQueryParameterName: + description: Hash based on a specific HTTP query + parameter. + type: string + maglev: + description: The Maglev load balancer implements + consistent hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev hashing. + minimum: 0 + type: integer + type: object + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer + implements consistent hashing to backend hosts. + properties: + minimumRingSize: + description: The minimum number of virtual nodes + to use for the hash ring. + minimum: 0 + type: integer + type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean + type: object + localityLbSetting: + properties: + distribute: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating locality, '/' separated, + e.g. + type: string + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities to + traffic distribution weights. + type: object + type: object + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. + type: string + to: + description: Destination region the traffic + will fail over to when endpoints in the + 'from' region becomes unhealthy. + type: string + type: object + type: array + failoverPriority: + description: failoverPriority is an ordered list + of labels used to sort endpoints to do priority + based load balancing. + items: type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. + type: array + type: object + simple: + description: |2- + + + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST + type: string + warmup: + description: Represents the warmup configuration of + Service. + properties: + aggression: + description: This parameter controls the speed of + traffic increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: + properties: + baseEjectionTime: + description: Minimum ejection duration. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected + from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a host + is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated + failures before ejection occurs. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep analysis. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing + pool for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled as long + as the associated load balancing pool has at least + `minHealthPercent` hosts in healthy mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local + origin failures from external errors. + type: boolean + type: object + portLevelSettings: + description: Traffic policies specific to individual ports. + items: + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. properties: - interval: - description: The time duration between keep-alive probes. + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that + will be queued while waiting for a ready + connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests + to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream + connection pool connections. type: string x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes to send without response before deciding the connection is dead. - maximum: 4294967295 - minimum: 0 + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent + streams allowed for a peer on one HTTP/2 + connection. + format: int32 type: integer - time: - description: The time duration a connection needs to be idle before keep-alive probes start being sent. + maxRequestsPerConnection: + description: Maximum number of requests per + connection to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that + can be outstanding to all hosts in a cluster + at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol + will be preserved while initiating connection + to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and + TCP upstream connections. + properties: + connectTimeout: + description: TCP connection timeout. type: string x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP + connections to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE + on the socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between + keep-alive probes. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive + probes to send without response before + deciding the connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection + needs to be idle before keep-alive probes + start being sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + type: object type: object type: object - type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: + loadBalancer: + description: Settings controlling the load balancer + algorithms. + oneOf: + - not: + anyOf: - required: - - simple + - simple - required: - - consistentHash - - required: + - consistentHash + - required: - simple - - required: + - required: - consistentHash - properties: - consistentHash: - allOf: - - oneOf: + properties: + consistentHash: + allOf: + - oneOf: - not: anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName - required: - - httpHeaderName + - httpHeaderName - required: - - httpCookie + - httpCookie - required: - - useSourceIp + - useSourceIp - required: - - httpQueryParameterName - - oneOf: + - httpQueryParameterName + - oneOf: - not: anyOf: - - required: - - ringHash - - required: - - maglev + - required: + - ringHash + - required: + - maglev - required: - - ringHash + - ringHash - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. + - maglev properties: - attributes: - description: Additional attributes for the cookie. - items: - properties: - name: - description: The name of the cookie attribute. - type: string - value: - description: The optional value of the cookie attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. + httpCookie: + description: Hash based on HTTP cookie. + properties: + attributes: + description: Additional attributes for + the cookie. + items: + properties: + name: + description: The name of the cookie + attribute. + type: string + value: + description: The optional value + of the cookie attribute. + type: string + required: + - name + type: object + type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name + type: object + httpHeaderName: + description: Hash based on a specific HTTP + header. type: string - ttl: - description: Lifetime of the cookie. + httpQueryParameterName: + description: Hash based on a specific HTTP + query parameter. type: string - required: - - name + maglev: + description: The Maglev load balancer implements + consistent hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev + hashing. + minimum: 0 + type: integer + type: object + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer + implements consistent hashing to backend + hosts. + properties: + minimumRingSize: + description: The minimum number of virtual + nodes to use for the hash ring. + minimum: 0 + type: integer + type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean type: object - httpHeaderName: - description: Hash based on a specific HTTP header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query parameter. + localityLbSetting: + properties: + distribute: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating locality, '/' + separated, e.g. + type: string + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities + to traffic distribution weights. + type: object + type: object + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. + type: string + to: + description: Destination region the + traffic will fail over to when endpoints + in the 'from' region becomes unhealthy. + type: string + type: object + type: array + failoverPriority: + description: failoverPriority is an ordered + list of labels used to sort endpoints to + do priority based load balancing. + items: + type: string + type: array + type: object + simple: + description: |2- + + + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST type: string - maglev: - description: The Maglev load balancer implements consistent hashing to backend hosts. + warmup: + description: Represents the warmup configuration + of Service. properties: - tableSize: - description: The table size for Maglev hashing. + aggression: + description: This parameter controls the speed + of traffic increase over the warmup duration. + format: double minimum: 0 - type: integer + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration type: object - minimumRingSize: - description: Deprecated. + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: + properties: + baseEjectionTime: + description: Minimum ejection duration. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host + is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a + host is ejected from the connection pool. + maximum: 4294967295 minimum: 0 + nullable: true type: integer - ringHash: - description: The ring/modulo hash load balancer implements consistent hashing to backend hosts. - properties: - minimumRingSize: - description: The minimum number of virtual nodes to use for the hash ring. - minimum: 0 - type: integer - type: object - useSourceIp: - description: Hash based on the source IP address. + consecutiveLocalOriginFailures: + description: The number of consecutive locally + originated failures before ejection occurs. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep + analysis. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing + pool for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled + as long as the associated load balancing pool + has at least `minHealthPercent` hosts in healthy + mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish + local origin failures from external errors. type: boolean type: object - localityLbSetting: + port: + description: Specifies the number of a port on the + destination service on which this policy is being + applied. properties: - distribute: - description: 'Optional: only one of distribute, failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' separated, e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities to traffic distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + tls: + description: TLS related settings for connections + to the upstream service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing + certificate authority certificates to use in + verifying a presented server certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing + the certificate revocation list (CRL) to use + in verifying a presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds + the TLS certs for the client including the CA + certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether + the proxy should skip verifying the CA signature + and SAN for the server certificate corresponding + to the host.' nullable: true type: boolean - failover: - description: 'Optional: only one of distribute, failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the traffic will fail over to when endpoints in the 'from' region becomes unhealthy. - type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered list of labels used to sort endpoints to do priority based load balancing. + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. + + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server + during TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify + the subject identity in the certificate. items: type: string type: array type: object - simple: - description: |- + type: object + maxItems: 4096 + type: array + proxyProtocol: + description: The upstream PROXY protocol settings. + properties: + version: + description: |- + The PROXY protocol version to use. + Valid Options: V1, V2 + enum: + - V1 + - V2 + type: string + type: object + retryBudget: + description: Specifies a limit on concurrent retries in + relation to the number of active requests. + properties: + minRetryConcurrency: + description: Specifies the minimum retry concurrency + allowed for the retry budget. + maximum: 4294967295 + minimum: 0 + type: integer + percent: + description: Specifies the limit on concurrent retries + as a percentage of the sum of active requests and + active pending requests. + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + type: object + tls: + description: TLS related settings for connections to the + upstream service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing + certificate authority certificates to use in verifying + a presented server certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing + the certificate revocation list (CRL) to use in verifying + a presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds the TLS + certs for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether + the proxy should skip verifying the CA signature and + SAN for the server certificate corresponding to the + host.' + nullable: true + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration of Service. - properties: - aggression: - description: This parameter controls the speed of traffic increase over the warmup duration. - format: double - minimum: 0 - nullable: true - type: number - duration: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - required: - - duration - type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server during + TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify the + subject identity in the certificate. + items: type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - outlierDetection: + type: array + type: object + tunnel: + description: Configuration of tunneling TCP over other transport + or application layers for the host configured in the DestinationRule. + properties: + protocol: + description: Specifies which protocol to use for tunneling + the downstream connection. + type: string + targetHost: + description: Specifies a host to which the downstream + connection is tunneled. + type: string + targetPort: + description: Specifies a port to which the downstream + connection is tunneled. + maximum: 4294967295 + minimum: 0 + type: integer + required: + - targetHost + - targetPort + type: object + type: object + required: + - name + type: object + type: array + trafficPolicy: + description: Traffic policies to apply (load balancing policy, connection + pool sizes, outlier detection). + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will be queued + while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection + pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams + allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection + to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding + to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be preserved + while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream + connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections + to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket + to enable TCP Keepalives. properties: - baseEjectionTime: - description: Minimum ejection duration. + interval: + description: The time duration between keep-alive + probes. type: string x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated failures before ejection occurs. + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to + send without response before deciding the connection + is dead. maximum: 4294967295 minimum: 0 - nullable: true type: integer - interval: - description: Time interval between ejection sweep analysis. + time: + description: The time duration a connection needs + to be idle before keep-alive probes start being + sent. type: string x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local origin failures from external errors. - type: boolean + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') type: object - portLevelSettings: - description: Traffic policies specific to individual ports. - items: - properties: - connectionPool: + type: object + type: object + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: + - required: + - simple + - required: + - consistentHash + - required: + - simple + - required: + - consistentHash + properties: + consistentHash: + allOf: + - oneOf: + - not: + anyOf: + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - oneOf: + - not: + anyOf: + - required: + - ringHash + - required: + - maglev + - required: + - ringHash + - required: + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. + properties: + attributes: + description: Additional attributes for the cookie. + items: properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be preserved while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes to send without response before deciding the connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection needs to be idle before keep-alive probes start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: object - type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: - - required: - - simple - - required: - - consistentHash - - required: - - simple - - required: - - consistentHash - properties: - consistentHash: - allOf: - - oneOf: - - not: - anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - oneOf: - - not: - anyOf: - - required: - - ringHash - - required: - - maglev - - required: - - ringHash - - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. - properties: - attributes: - description: Additional attributes for the cookie. - items: - properties: - name: - description: The name of the cookie attribute. - type: string - value: - description: The optional value of the cookie attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. - type: string - ttl: - description: Lifetime of the cookie. - type: string - required: - - name - type: object - httpHeaderName: - description: Hash based on a specific HTTP header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query parameter. - type: string - maglev: - description: The Maglev load balancer implements consistent hashing to backend hosts. - properties: - tableSize: - description: The table size for Maglev hashing. - minimum: 0 - type: integer - type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer implements consistent hashing to backend hosts. - properties: - minimumRingSize: - description: The minimum number of virtual nodes to use for the hash ring. - minimum: 0 - type: integer - type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean - type: object - localityLbSetting: - properties: - distribute: - description: 'Optional: only one of distribute, failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' separated, e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities to traffic distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the traffic will fail over to when endpoints in the 'from' region becomes unhealthy. - type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered list of labels used to sort endpoints to do priority based load balancing. - items: - type: string - type: array - type: object - simple: - description: |- - - - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration of Service. - properties: - aggression: - description: This parameter controls the speed of traffic increase over the warmup duration. - format: double - minimum: 0 - nullable: true - type: number - duration: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - required: - - duration - type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - outlierDetection: - properties: - baseEjectionTime: - description: Minimum ejection duration. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated failures before ejection occurs. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - interval: - description: Time interval between ejection sweep analysis. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local origin failures from external errors. - type: boolean - type: object - port: - description: Specifies the number of a port on the destination service on which this policy is being applied. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - tls: - description: TLS related settings for connections to the upstream service. - properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.' + name: + description: The name of the cookie attribute. type: string - caCrl: - description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.' + value: + description: The optional value of the cookie + attribute. type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds the TLS certs for the client including the CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.' - nullable: true - type: boolean - mode: - description: |- - Indicates whether connections to this port should be secured using TLS. - - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. - type: string - sni: - description: SNI string to present to the server during TLS handshake. - type: string - subjectAltNames: - description: A list of alternate names to verify the subject identity in the certificate. - items: - type: string - type: array + required: + - name type: object - type: object - maxItems: 4096 - type: array - proxyProtocol: - description: The upstream PROXY protocol settings. - properties: - version: - description: |- - The PROXY protocol version to use. - - Valid Options: V1, V2 - enum: - - V1 - - V2 + type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name type: object - retryBudget: - description: Specifies a limit on concurrent retries in relation to the number of active requests. + httpHeaderName: + description: Hash based on a specific HTTP header. + type: string + httpQueryParameterName: + description: Hash based on a specific HTTP query parameter. + type: string + maglev: + description: The Maglev load balancer implements consistent + hashing to backend hosts. properties: - minRetryConcurrency: - description: Specifies the minimum retry concurrency allowed for the retry budget. - maximum: 4294967295 + tableSize: + description: The table size for Maglev hashing. minimum: 0 type: integer - percent: - description: Specifies the limit on concurrent retries as a percentage of the sum of active requests and active pending requests. - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - type: object - tls: - description: TLS related settings for connections to the upstream service. - properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds the TLS certs for the client including the CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.' - nullable: true - type: boolean - mode: - description: |- - Indicates whether connections to this port should be secured using TLS. - - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. - type: string - sni: - description: SNI string to present to the server during TLS handshake. - type: string - subjectAltNames: - description: A list of alternate names to verify the subject identity in the certificate. - items: - type: string - type: array type: object - tunnel: - description: Configuration of tunneling TCP over other transport or application layers for the host configured in the DestinationRule. + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer implements + consistent hashing to backend hosts. properties: - protocol: - description: Specifies which protocol to use for tunneling the downstream connection. - type: string - targetHost: - description: Specifies a host to which the downstream connection is tunneled. - type: string - targetPort: - description: Specifies a port to which the downstream connection is tunneled. - maximum: 4294967295 + minimumRingSize: + description: The minimum number of virtual nodes to + use for the hash ring. minimum: 0 type: integer - required: - - targetHost - - targetPort type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean type: object - required: - - name - type: object - type: array - trafficPolicy: - description: Traffic policies to apply (load balancing policy, connection pool sizes, outlier detection). - properties: - connectionPool: - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be preserved while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. + localityLbSetting: + properties: + distribute: + description: 'Optional: only one of distribute, failover + or failoverPriority can be set.' + items: properties: - interval: - description: The time duration between keep-alive probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes to send without response before deciding the connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection needs to be idle before keep-alive probes start being sent. + from: + description: Originating locality, '/' separated, + e.g. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities to traffic + distribution weights. + type: object type: object - type: object - type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: - - required: - - simple - - required: - - consistentHash - - required: - - simple - - required: - - consistentHash - properties: - consistentHash: - allOf: - - oneOf: - - not: - anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - oneOf: - - not: - anyOf: - - required: - - ringHash - - required: - - maglev - - required: - - ringHash - - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, failover + or failoverPriority can be set.' + items: properties: - attributes: - description: Additional attributes for the cookie. - items: - properties: - name: - description: The name of the cookie attribute. - type: string - value: - description: The optional value of the cookie attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. + from: + description: Originating region. type: string - path: - description: Path to set for the cookie. + to: + description: Destination region the traffic will + fail over to when endpoints in the 'from' region + becomes unhealthy. type: string - ttl: - description: Lifetime of the cookie. - type: string - required: - - name type: object - httpHeaderName: - description: Hash based on a specific HTTP header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query parameter. + type: array + failoverPriority: + description: failoverPriority is an ordered list of labels + used to sort endpoints to do priority based load balancing. + items: type: string - maglev: - description: The Maglev load balancer implements consistent hashing to backend hosts. + type: array + type: object + simple: + description: |2- + + + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST + type: string + warmup: + description: Represents the warmup configuration of Service. + properties: + aggression: + description: This parameter controls the speed of traffic + increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: + properties: + baseEjectionTime: + description: Minimum ejection duration. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected + from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a host is ejected + from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated + failures before ejection occurs. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep analysis. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing pool + for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled as long as + the associated load balancing pool has at least `minHealthPercent` + hosts in healthy mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local origin + failures from external errors. + type: boolean + type: object + portLevelSettings: + description: Traffic policies specific to individual ports. + items: + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. properties: - tableSize: - description: The table size for Maglev hashing. - minimum: 0 + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will + be queued while waiting for a ready connection + pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to + a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection + pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams + allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection + to a backend. + format: int32 type: integer + maxRetries: + description: Maximum number of retries that can + be outstanding to all hosts in a cluster at a + given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will + be preserved while initiating connection to backend. + type: boolean type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer implements consistent hashing to backend hosts. + tcp: + description: Settings common to both HTTP and TCP upstream + connections. properties: - minimumRingSize: - description: The minimum number of virtual nodes to use for the hash ring. - minimum: 0 + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections + to a destination host. + format: int32 type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the + socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between keep-alive + probes. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes + to send without response before deciding the + connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection + needs to be idle before keep-alive probes + start being sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + type: object type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean type: object - localityLbSetting: + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: + - required: + - simple + - required: + - consistentHash + - required: + - simple + - required: + - consistentHash properties: - distribute: - description: 'Optional: only one of distribute, failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' separated, e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 + consistentHash: + allOf: + - oneOf: + - not: + anyOf: + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - oneOf: + - not: + anyOf: + - required: + - ringHash + - required: + - maglev + - required: + - ringHash + - required: + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. + properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the + cookie attribute. + type: string + required: + - name + type: object + type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name + type: object + httpHeaderName: + description: Hash based on a specific HTTP header. + type: string + httpQueryParameterName: + description: Hash based on a specific HTTP query + parameter. + type: string + maglev: + description: The Maglev load balancer implements + consistent hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev hashing. + minimum: 0 + type: integer + type: object + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer + implements consistent hashing to backend hosts. + properties: + minimumRingSize: + description: The minimum number of virtual nodes + to use for the hash ring. minimum: 0 type: integer - description: Map of upstream localities to traffic distribution weights. + type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean + type: object + localityLbSetting: + properties: + distribute: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating locality, '/' separated, + e.g. + type: string + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities to + traffic distribution weights. + type: object type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the traffic will fail over to when endpoints in the 'from' region becomes unhealthy. + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. + type: string + to: + description: Destination region the traffic + will fail over to when endpoints in the + 'from' region becomes unhealthy. + type: string + type: object + type: array + failoverPriority: + description: failoverPriority is an ordered list + of labels used to sort endpoints to do priority + based load balancing. + items: type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered list of labels used to sort endpoints to do priority based load balancing. - items: - type: string - type: array - type: object - simple: - description: |- + type: array + type: object + simple: + description: |2- - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration of Service. + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST + type: string + warmup: + description: Represents the warmup configuration of + Service. + properties: + aggression: + description: This parameter controls the speed of + traffic increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: properties: - aggression: - description: This parameter controls the speed of traffic increase over the warmup duration. - format: double + baseEjectionTime: + description: Minimum ejection duration. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected + from the connection pool. + maximum: 4294967295 minimum: 0 nullable: true - type: number - duration: + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a host + is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated + failures before ejection occurs. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep analysis. type: string x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing + pool for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled as long + as the associated load balancing pool has at least + `minHealthPercent` hosts in healthy mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local + origin failures from external errors. + type: boolean + type: object + port: + description: Specifies the number of a port on the destination + service on which this policy is being applied. + properties: + number: + maximum: 4294967295 minimum: 0 + type: integer + type: object + tls: + description: TLS related settings for connections to the + upstream service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing + certificate authority certificates to use in verifying + a presented server certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing + the certificate revocation list (CRL) to use in verifying + a presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds the TLS + certs for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether + the proxy should skip verifying the CA signature and + SAN for the server certificate corresponding to the + host.' nullable: true - type: number - required: - - duration + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. + + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server during + TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify the + subject identity in the certificate. + items: + type: string + type: array type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') type: object - outlierDetection: + maxItems: 4096 + type: array + proxyProtocol: + description: The upstream PROXY protocol settings. + properties: + version: + description: |- + The PROXY protocol version to use. + + Valid Options: V1, V2 + enum: + - V1 + - V2 + type: string + type: object + retryBudget: + description: Specifies a limit on concurrent retries in relation + to the number of active requests. + properties: + minRetryConcurrency: + description: Specifies the minimum retry concurrency allowed + for the retry budget. + maximum: 4294967295 + minimum: 0 + type: integer + percent: + description: Specifies the limit on concurrent retries as + a percentage of the sum of active requests and active pending + requests. + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + type: object + tls: + description: TLS related settings for connections to the upstream + service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing certificate + authority certificates to use in verifying a presented server + certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing the + certificate revocation list (CRL) to use in verifying a + presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds the TLS certs + for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether the proxy + should skip verifying the CA signature and SAN for the server + certificate corresponding to the host.' + nullable: true + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. + + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server during TLS + handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject + identity in the certificate. + items: + type: string + type: array + type: object + tunnel: + description: Configuration of tunneling TCP over other transport + or application layers for the host configured in the DestinationRule. + properties: + protocol: + description: Specifies which protocol to use for tunneling + the downstream connection. + type: string + targetHost: + description: Specifies a host to which the downstream connection + is tunneled. + type: string + targetPort: + description: Specifies a port to which the downstream connection + is tunneled. + maximum: 4294967295 + minimum: 0 + type: integer + required: + - targetHost + - targetPort + type: object + type: object + workloadSelector: + description: Criteria used to select the specific set of pods/VMs + on which this `DestinationRule` configuration should be applied. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + required: + - host + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: properties: - baseEjectionTime: - description: Minimum ejection duration. + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated failures before ejection occurs. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - interval: - description: Time interval between ejection sweep analysis. + name: + description: A human-readable name for the message type. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local origin failures from external errors. - type: boolean type: object - portLevelSettings: - description: Traffic policies specific to individual ports. - items: - properties: - connectionPool: - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - description: The name of a service from the service registry + jsonPath: .spec.host + name: Host + type: string + - description: CreationTimestamp is a timestamp representing the server time when + this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. For more information, see [Kubernetes API Conventions](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata) + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha3 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting load balancing, outlier detection, + etc. See more details at: https://istio.io/docs/reference/config/networking/destination-rule.html' + properties: + exportTo: + description: A list of namespaces to which this destination rule is + exported. + items: + type: string + type: array + host: + description: The name of a service from the service registry. + type: string + subsets: + description: One or more named sets that represent individual versions + of a service. + items: + properties: + labels: + additionalProperties: + type: string + description: Labels apply a filter over the endpoints of a service + in the service registry. + type: object + name: + description: Name of the subset. + type: string + trafficPolicy: + description: Traffic policies that apply to this subset. + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be preserved while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will + be queued while waiting for a ready connection + pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to + a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection + pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams + allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection + to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can + be outstanding to all hosts in a cluster at a + given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will + be preserved while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream + connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections + to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the + socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between keep-alive + probes. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms + probes: + description: Maximum number of keepalive probes + to send without response before deciding the + connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection + needs to be idle before keep-alive probes + start being sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes to send without response before deciding the connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection needs to be idle before keep-alive probes start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: object - type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: - - required: - - simple - - required: - - consistentHash + type: object + type: object + type: object + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: - required: - - simple + - simple - required: - - consistentHash - properties: - consistentHash: - allOf: - - oneOf: - - not: - anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - oneOf: - - not: - anyOf: - - required: - - ringHash - - required: - - maglev - - required: - - ringHash - - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. + - consistentHash + - required: + - simple + - required: + - consistentHash + properties: + consistentHash: + allOf: + - oneOf: + - not: + anyOf: + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - oneOf: + - not: + anyOf: + - required: + - ringHash + - required: + - maglev + - required: + - ringHash + - required: + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. + properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the + cookie attribute. + type: string + required: + - name + type: object + type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name + type: object + httpHeaderName: + description: Hash based on a specific HTTP header. + type: string + httpQueryParameterName: + description: Hash based on a specific HTTP query + parameter. + type: string + maglev: + description: The Maglev load balancer implements + consistent hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev hashing. + minimum: 0 + type: integer + type: object + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer + implements consistent hashing to backend hosts. + properties: + minimumRingSize: + description: The minimum number of virtual nodes + to use for the hash ring. + minimum: 0 + type: integer + type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean + type: object + localityLbSetting: + properties: + distribute: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: properties: - attributes: - description: Additional attributes for the cookie. - items: - properties: - name: - description: The name of the cookie attribute. - type: string - value: - description: The optional value of the cookie attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. - type: string - ttl: - description: Lifetime of the cookie. + from: + description: Originating locality, '/' separated, + e.g. type: string - required: - - name + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities to + traffic distribution weights. + type: object type: object - httpHeaderName: - description: Hash based on a specific HTTP header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query parameter. + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. + type: string + to: + description: Destination region the traffic + will fail over to when endpoints in the + 'from' region becomes unhealthy. + type: string + type: object + type: array + failoverPriority: + description: failoverPriority is an ordered list + of labels used to sort endpoints to do priority + based load balancing. + items: type: string - maglev: - description: The Maglev load balancer implements consistent hashing to backend hosts. + type: array + type: object + simple: + description: |2- + + + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST + type: string + warmup: + description: Represents the warmup configuration of + Service. + properties: + aggression: + description: This parameter controls the speed of + traffic increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: + properties: + baseEjectionTime: + description: Minimum ejection duration. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected + from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a host + is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated + failures before ejection occurs. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep analysis. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing + pool for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled as long + as the associated load balancing pool has at least + `minHealthPercent` hosts in healthy mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local + origin failures from external errors. + type: boolean + type: object + portLevelSettings: + description: Traffic policies specific to individual ports. + items: + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. properties: - tableSize: - description: The table size for Maglev hashing. - minimum: 0 + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that + will be queued while waiting for a ready + connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests + to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream + connection pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent + streams allowed for a peer on one HTTP/2 + connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per + connection to a backend. + format: int32 type: integer + maxRetries: + description: Maximum number of retries that + can be outstanding to all hosts in a cluster + at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol + will be preserved while initiating connection + to backend. + type: boolean type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer implements consistent hashing to backend hosts. + tcp: + description: Settings common to both HTTP and + TCP upstream connections. properties: - minimumRingSize: - description: The minimum number of virtual nodes to use for the hash ring. - minimum: 0 + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP + connections to a destination host. + format: int32 type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE + on the socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between + keep-alive probes. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive + probes to send without response before + deciding the connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection + needs to be idle before keep-alive probes + start being sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + type: object type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean type: object - localityLbSetting: + loadBalancer: + description: Settings controlling the load balancer + algorithms. + oneOf: + - not: + anyOf: + - required: + - simple + - required: + - consistentHash + - required: + - simple + - required: + - consistentHash properties: - distribute: - description: 'Optional: only one of distribute, failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' separated, e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 + consistentHash: + allOf: + - oneOf: + - not: + anyOf: + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - oneOf: + - not: + anyOf: + - required: + - ringHash + - required: + - maglev + - required: + - ringHash + - required: + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. + properties: + attributes: + description: Additional attributes for + the cookie. + items: + properties: + name: + description: The name of the cookie + attribute. + type: string + value: + description: The optional value + of the cookie attribute. + type: string + required: + - name + type: object + type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name + type: object + httpHeaderName: + description: Hash based on a specific HTTP + header. + type: string + httpQueryParameterName: + description: Hash based on a specific HTTP + query parameter. + type: string + maglev: + description: The Maglev load balancer implements + consistent hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev + hashing. + minimum: 0 + type: integer + type: object + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer + implements consistent hashing to backend + hosts. + properties: + minimumRingSize: + description: The minimum number of virtual + nodes to use for the hash ring. minimum: 0 type: integer - description: Map of upstream localities to traffic distribution weights. + type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean + type: object + localityLbSetting: + properties: + distribute: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating locality, '/' + separated, e.g. + type: string + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities + to traffic distribution weights. + type: object type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the traffic will fail over to when endpoints in the 'from' region becomes unhealthy. + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. + type: string + to: + description: Destination region the + traffic will fail over to when endpoints + in the 'from' region becomes unhealthy. + type: string + type: object + type: array + failoverPriority: + description: failoverPriority is an ordered + list of labels used to sort endpoints to + do priority based load balancing. + items: type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered list of labels used to sort endpoints to do priority based load balancing. - items: - type: string - type: array - type: object - simple: - description: |- + type: array + type: object + simple: + description: |2- - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration of Service. + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST + type: string + warmup: + description: Represents the warmup configuration + of Service. + properties: + aggression: + description: This parameter controls the speed + of traffic increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: properties: - aggression: - description: This parameter controls the speed of traffic increase over the warmup duration. - format: double + baseEjectionTime: + description: Minimum ejection duration. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host + is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a + host is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally + originated failures before ejection occurs. + maximum: 4294967295 minimum: 0 nullable: true - type: number - duration: + type: integer + interval: + description: Time interval between ejection sweep + analysis. type: string x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing + pool for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled + as long as the associated load balancing pool + has at least `minHealthPercent` hosts in healthy + mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish + local origin failures from external errors. + type: boolean + type: object + port: + description: Specifies the number of a port on the + destination service on which this policy is being + applied. + properties: + number: + maximum: 4294967295 minimum: 0 + type: integer + type: object + tls: + description: TLS related settings for connections + to the upstream service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing + certificate authority certificates to use in + verifying a presented server certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing + the certificate revocation list (CRL) to use + in verifying a presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds + the TLS certs for the client including the CA + certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether + the proxy should skip verifying the CA signature + and SAN for the server certificate corresponding + to the host.' nullable: true - type: number - required: - - duration + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. + + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server + during TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify + the subject identity in the certificate. + items: + type: string + type: array type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') type: object - outlierDetection: - properties: - baseEjectionTime: - description: Minimum ejection duration. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated failures before ejection occurs. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer + maxItems: 4096 + type: array + proxyProtocol: + description: The upstream PROXY protocol settings. + properties: + version: + description: |- + The PROXY protocol version to use. + + Valid Options: V1, V2 + enum: + - V1 + - V2 + type: string + type: object + retryBudget: + description: Specifies a limit on concurrent retries in + relation to the number of active requests. + properties: + minRetryConcurrency: + description: Specifies the minimum retry concurrency + allowed for the retry budget. + maximum: 4294967295 + minimum: 0 + type: integer + percent: + description: Specifies the limit on concurrent retries + as a percentage of the sum of active requests and + active pending requests. + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + type: object + tls: + description: TLS related settings for connections to the + upstream service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing + certificate authority certificates to use in verifying + a presented server certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing + the certificate revocation list (CRL) to use in verifying + a presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds the TLS + certs for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether + the proxy should skip verifying the CA signature and + SAN for the server certificate corresponding to the + host.' + nullable: true + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. + + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server during + TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify the + subject identity in the certificate. + items: + type: string + type: array + type: object + tunnel: + description: Configuration of tunneling TCP over other transport + or application layers for the host configured in the DestinationRule. + properties: + protocol: + description: Specifies which protocol to use for tunneling + the downstream connection. + type: string + targetHost: + description: Specifies a host to which the downstream + connection is tunneled. + type: string + targetPort: + description: Specifies a port to which the downstream + connection is tunneled. + maximum: 4294967295 + minimum: 0 + type: integer + required: + - targetHost + - targetPort + type: object + type: object + required: + - name + type: object + type: array + trafficPolicy: + description: Traffic policies to apply (load balancing policy, connection + pool sizes, outlier detection). + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will be queued + while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection + pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams + allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection + to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding + to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be preserved + while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream + connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections + to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket + to enable TCP Keepalives. + properties: interval: - description: Time interval between ejection sweep analysis. + description: The time duration between keep-alive + probes. type: string x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local origin failures from external errors. - type: boolean - type: object - port: - description: Specifies the number of a port on the destination service on which this policy is being applied. - properties: - number: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to + send without response before deciding the connection + is dead. maximum: 4294967295 minimum: 0 type: integer + time: + description: The time duration a connection needs + to be idle before keep-alive probes start being + sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') type: object - tls: - description: TLS related settings for connections to the upstream service. + type: object + type: object + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: + - required: + - simple + - required: + - consistentHash + - required: + - simple + - required: + - consistentHash + properties: + consistentHash: + allOf: + - oneOf: + - not: + anyOf: + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - oneOf: + - not: + anyOf: + - required: + - ringHash + - required: + - maglev + - required: + - ringHash + - required: + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds the TLS certs for the client including the CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.' - nullable: true - type: boolean - mode: - description: |- - Indicates whether connections to this port should be secured using TLS. - - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the cookie + attribute. + type: string + required: + - name + type: object + type: array + name: + description: Name of the cookie. type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. + path: + description: Path to set for the cookie. type: string - sni: - description: SNI string to present to the server during TLS handshake. + ttl: + description: Lifetime of the cookie. type: string - subjectAltNames: - description: A list of alternate names to verify the subject identity in the certificate. - items: - type: string - type: array + required: + - name + type: object + httpHeaderName: + description: Hash based on a specific HTTP header. + type: string + httpQueryParameterName: + description: Hash based on a specific HTTP query parameter. + type: string + maglev: + description: The Maglev load balancer implements consistent + hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev hashing. + minimum: 0 + type: integer + type: object + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer implements + consistent hashing to backend hosts. + properties: + minimumRingSize: + description: The minimum number of virtual nodes to + use for the hash ring. + minimum: 0 + type: integer type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean type: object - maxItems: 4096 - type: array - proxyProtocol: - description: The upstream PROXY protocol settings. - properties: - version: - description: |- - The PROXY protocol version to use. + localityLbSetting: + properties: + distribute: + description: 'Optional: only one of distribute, failover + or failoverPriority can be set.' + items: + properties: + from: + description: Originating locality, '/' separated, + e.g. + type: string + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities to traffic + distribution weights. + type: object + type: object + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, failover + or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. + type: string + to: + description: Destination region the traffic will + fail over to when endpoints in the 'from' region + becomes unhealthy. + type: string + type: object + type: array + failoverPriority: + description: failoverPriority is an ordered list of labels + used to sort endpoints to do priority based load balancing. + items: + type: string + type: array + type: object + simple: + description: |2- - Valid Options: V1, V2 - enum: - - V1 - - V2 - type: string - type: object - retryBudget: - description: Specifies a limit on concurrent retries in relation to the number of active requests. - properties: - minRetryConcurrency: - description: Specifies the minimum retry concurrency allowed for the retry budget. - maximum: 4294967295 - minimum: 0 - type: integer - percent: - description: Specifies the limit on concurrent retries as a percentage of the sum of active requests and active pending requests. - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - type: object - tls: - description: TLS related settings for connections to the upstream service. - properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds the TLS certs for the client including the CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.' - nullable: true - type: boolean - mode: - description: |- - Indicates whether connections to this port should be secured using TLS. - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. - type: string - sni: - description: SNI string to present to the server during TLS handshake. - type: string - subjectAltNames: - description: A list of alternate names to verify the subject identity in the certificate. - items: + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST + type: string + warmup: + description: Represents the warmup configuration of Service. + properties: + aggression: + description: This parameter controls the speed of traffic + increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: type: string - type: array - type: object - tunnel: - description: Configuration of tunneling TCP over other transport or application layers for the host configured in the DestinationRule. - properties: - protocol: - description: Specifies which protocol to use for tunneling the downstream connection. - type: string - targetHost: - description: Specifies a host to which the downstream connection is tunneled. - type: string - targetPort: - description: Specifies a port to which the downstream connection is tunneled. - maximum: 4294967295 - minimum: 0 - type: integer - required: - - targetHost - - targetPort - type: object - type: object - workloadSelector: - description: Criteria used to select the specific set of pods/VMs on which this `DestinationRule` configuration should be applied. - properties: - matchLabels: - additionalProperties: - maxLength: 63 + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' type: string x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied. - maxProperties: 4096 - type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) - type: object - required: - - host - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. + baseEjectionTime: + description: Minimum ejection duration. type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. - - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected + from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a host is ejected + from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated + failures before ejection occurs. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep analysis. type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing pool + for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled as long as + the associated load balancing pool has at least `minHealthPercent` + hosts in healthy mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local origin + failures from external errors. + type: boolean type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} - - additionalPrinterColumns: - - description: The name of a service from the service registry - jsonPath: .spec.host - name: Host - type: string - - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. For more information, see [Kubernetes API Conventions](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata) - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1alpha3 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting load balancing, outlier detection, etc. See more details at: https://istio.io/docs/reference/config/networking/destination-rule.html' - properties: - exportTo: - description: A list of namespaces to which this destination rule is exported. - items: - type: string - type: array - host: - description: The name of a service from the service registry. - type: string - subsets: - description: One or more named sets that represent individual versions of a service. - items: - properties: - labels: - additionalProperties: - type: string - description: Labels apply a filter over the endpoints of a service in the service registry. - type: object - name: - description: Name of the subset. - type: string - trafficPolicy: - description: Traffic policies that apply to this subset. - properties: - connectionPool: - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. + portLevelSettings: + description: Traffic policies specific to individual ports. + items: + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be preserved while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will + be queued while waiting for a ready connection + pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to + a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection + pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams + allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection + to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can + be outstanding to all hosts in a cluster at a + given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will + be preserved while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream + connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections + to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the + socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between keep-alive + probes. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms + probes: + description: Maximum number of keepalive probes + to send without response before deciding the + connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection + needs to be idle before keep-alive probes + start being sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes to send without response before deciding the connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection needs to be idle before keep-alive probes start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: object - type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: - - required: - - simple - - required: - - consistentHash + type: object + type: object + type: object + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: - required: - - simple + - simple - required: - - consistentHash - properties: - consistentHash: - allOf: - - oneOf: - - not: - anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - oneOf: - - not: - anyOf: - - required: - - ringHash - - required: - - maglev - - required: - - ringHash - - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. + - consistentHash + - required: + - simple + - required: + - consistentHash + properties: + consistentHash: + allOf: + - oneOf: + - not: + anyOf: + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - oneOf: + - not: + anyOf: + - required: + - ringHash + - required: + - maglev + - required: + - ringHash + - required: + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. + properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the + cookie attribute. + type: string + required: + - name + type: object + type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name + type: object + httpHeaderName: + description: Hash based on a specific HTTP header. + type: string + httpQueryParameterName: + description: Hash based on a specific HTTP query + parameter. + type: string + maglev: + description: The Maglev load balancer implements + consistent hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev hashing. + minimum: 0 + type: integer + type: object + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer + implements consistent hashing to backend hosts. + properties: + minimumRingSize: + description: The minimum number of virtual nodes + to use for the hash ring. + minimum: 0 + type: integer + type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean + type: object + localityLbSetting: + properties: + distribute: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: properties: - attributes: - description: Additional attributes for the cookie. - items: - properties: - name: - description: The name of the cookie attribute. - type: string - value: - description: The optional value of the cookie attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. + from: + description: Originating locality, '/' separated, + e.g. type: string - path: - description: Path to set for the cookie. + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities to + traffic distribution weights. + type: object + type: object + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. type: string - ttl: - description: Lifetime of the cookie. + to: + description: Destination region the traffic + will fail over to when endpoints in the + 'from' region becomes unhealthy. type: string - required: - - name type: object - httpHeaderName: - description: Hash based on a specific HTTP header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query parameter. + type: array + failoverPriority: + description: failoverPriority is an ordered list + of labels used to sort endpoints to do priority + based load balancing. + items: type: string - maglev: - description: The Maglev load balancer implements consistent hashing to backend hosts. - properties: - tableSize: - description: The table size for Maglev hashing. - minimum: 0 - type: integer - type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer implements consistent hashing to backend hosts. - properties: - minimumRingSize: - description: The minimum number of virtual nodes to use for the hash ring. - minimum: 0 - type: integer - type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean - type: object - localityLbSetting: - properties: - distribute: - description: 'Optional: only one of distribute, failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' separated, e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities to traffic distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the traffic will fail over to when endpoints in the 'from' region becomes unhealthy. - type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered list of labels used to sort endpoints to do priority based load balancing. - items: - type: string - type: array - type: object - simple: - description: |- + type: array + type: object + simple: + description: |2- - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration of Service. - properties: - aggression: - description: This parameter controls the speed of traffic increase over the warmup duration. - format: double - minimum: 0 - nullable: true - type: number - duration: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - required: - - duration - type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - outlierDetection: - properties: - baseEjectionTime: - description: Minimum ejection duration. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated failures before ejection occurs. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - interval: - description: Time interval between ejection sweep analysis. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local origin failures from external errors. - type: boolean - type: object - portLevelSettings: - description: Traffic policies specific to individual ports. - items: + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST + type: string + warmup: + description: Represents the warmup configuration of + Service. properties: - connectionPool: - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be preserved while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes to send without response before deciding the connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection needs to be idle before keep-alive probes start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: object - type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: - - required: - - simple - - required: - - consistentHash - - required: - - simple - - required: - - consistentHash - properties: - consistentHash: - allOf: - - oneOf: - - not: - anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - oneOf: - - not: - anyOf: - - required: - - ringHash - - required: - - maglev - - required: - - ringHash - - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. - properties: - attributes: - description: Additional attributes for the cookie. - items: - properties: - name: - description: The name of the cookie attribute. - type: string - value: - description: The optional value of the cookie attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. - type: string - ttl: - description: Lifetime of the cookie. - type: string - required: - - name - type: object - httpHeaderName: - description: Hash based on a specific HTTP header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query parameter. - type: string - maglev: - description: The Maglev load balancer implements consistent hashing to backend hosts. - properties: - tableSize: - description: The table size for Maglev hashing. - minimum: 0 - type: integer - type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer implements consistent hashing to backend hosts. - properties: - minimumRingSize: - description: The minimum number of virtual nodes to use for the hash ring. - minimum: 0 - type: integer - type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean - type: object - localityLbSetting: - properties: - distribute: - description: 'Optional: only one of distribute, failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' separated, e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities to traffic distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the traffic will fail over to when endpoints in the 'from' region becomes unhealthy. - type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered list of labels used to sort endpoints to do priority based load balancing. - items: - type: string - type: array - type: object - simple: - description: |- - - - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration of Service. - properties: - aggression: - description: This parameter controls the speed of traffic increase over the warmup duration. - format: double - minimum: 0 - nullable: true - type: number - duration: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - required: - - duration - type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - outlierDetection: - properties: - baseEjectionTime: - description: Minimum ejection duration. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated failures before ejection occurs. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - interval: - description: Time interval between ejection sweep analysis. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local origin failures from external errors. - type: boolean - type: object - port: - description: Specifies the number of a port on the destination service on which this policy is being applied. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - tls: - description: TLS related settings for connections to the upstream service. - properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds the TLS certs for the client including the CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.' - nullable: true - type: boolean - mode: - description: |- - Indicates whether connections to this port should be secured using TLS. - - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. - type: string - sni: - description: SNI string to present to the server during TLS handshake. - type: string - subjectAltNames: - description: A list of alternate names to verify the subject identity in the certificate. - items: - type: string - type: array - type: object - type: object - maxItems: 4096 - type: array - proxyProtocol: - description: The upstream PROXY protocol settings. - properties: - version: - description: |- - The PROXY protocol version to use. - - Valid Options: V1, V2 - enum: - - V1 - - V2 - type: string - type: object - retryBudget: - description: Specifies a limit on concurrent retries in relation to the number of active requests. - properties: - minRetryConcurrency: - description: Specifies the minimum retry concurrency allowed for the retry budget. - maximum: 4294967295 - minimum: 0 - type: integer - percent: - description: Specifies the limit on concurrent retries as a percentage of the sum of active requests and active pending requests. - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - type: object - tls: - description: TLS related settings for connections to the upstream service. - properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds the TLS certs for the client including the CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.' - nullable: true - type: boolean - mode: - description: |- - Indicates whether connections to this port should be secured using TLS. - - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. - type: string - sni: - description: SNI string to present to the server during TLS handshake. - type: string - subjectAltNames: - description: A list of alternate names to verify the subject identity in the certificate. - items: + aggression: + description: This parameter controls the speed of + traffic increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: type: string - type: array - type: object - tunnel: - description: Configuration of tunneling TCP over other transport or application layers for the host configured in the DestinationRule. - properties: - protocol: - description: Specifies which protocol to use for tunneling the downstream connection. - type: string - targetHost: - description: Specifies a host to which the downstream connection is tunneled. - type: string - targetPort: - description: Specifies a port to which the downstream connection is tunneled. - maximum: 4294967295 - minimum: 0 - type: integer - required: - - targetHost - - targetPort - type: object - type: object - required: - - name - type: object - type: array - trafficPolicy: - description: Traffic policies to apply (load balancing policy, connection pool sizes, outlier detection). - properties: - connectionPool: - properties: - http: - description: HTTP connection pool settings. + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE + baseEjectionTime: + description: Minimum ejection duration. type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. - format: int32 + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected + from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true type: integer - http2MaxRequests: - description: Maximum number of active requests to a destination. + consecutiveErrors: format: int32 type: integer - idleTimeout: - description: The idle timeout for upstream connection pool connections. + consecutiveGatewayErrors: + description: Number of gateway errors before a host + is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated + failures before ejection occurs. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep analysis. type: string x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection to a backend. + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing + pool for the upstream service that can be ejected. format: int32 type: integer - maxRetries: - description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. + minHealthPercent: + description: Outlier detection will be enabled as long + as the associated load balancing pool has at least + `minHealthPercent` hosts in healthy mode. format: int32 type: integer - useClientProtocol: - description: If set to true, client protocol will be preserved while initiating connection to backend. + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local + origin failures from external errors. type: boolean type: object - tcp: - description: Settings common to both HTTP and TCP upstream connections. + port: + description: Specifies the number of a port on the destination + service on which this policy is being applied. properties: - connectTimeout: - description: TCP connection timeout. + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + tls: + description: TLS related settings for connections to the + upstream service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing + certificate authority certificates to use in verifying + a presented server certificate.' type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. + caCrl: + description: 'OPTIONAL: The path to the file containing + the certificate revocation list (CRL) to use in verifying + a presented server certificate.' type: string - maxConnectionDuration: - description: The maximum duration of a connection. + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. + credentialName: + description: The name of the secret that holds the TLS + certs for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether + the proxy should skip verifying the CA signature and + SAN for the server certificate corresponding to the + host.' + nullable: true + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. + + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server during + TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify the + subject identity in the certificate. + items: + type: string + type: array + type: object + type: object + maxItems: 4096 + type: array + proxyProtocol: + description: The upstream PROXY protocol settings. + properties: + version: + description: |- + The PROXY protocol version to use. + + Valid Options: V1, V2 + enum: + - V1 + - V2 + type: string + type: object + retryBudget: + description: Specifies a limit on concurrent retries in relation + to the number of active requests. + properties: + minRetryConcurrency: + description: Specifies the minimum retry concurrency allowed + for the retry budget. + maximum: 4294967295 + minimum: 0 + type: integer + percent: + description: Specifies the limit on concurrent retries as + a percentage of the sum of active requests and active pending + requests. + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + type: object + tls: + description: TLS related settings for connections to the upstream + service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing certificate + authority certificates to use in verifying a presented server + certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing the + certificate revocation list (CRL) to use in verifying a + presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds the TLS certs + for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether the proxy + should skip verifying the CA signature and SAN for the server + certificate corresponding to the host.' + nullable: true + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. + + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server during TLS + handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject + identity in the certificate. + items: + type: string + type: array + type: object + tunnel: + description: Configuration of tunneling TCP over other transport + or application layers for the host configured in the DestinationRule. + properties: + protocol: + description: Specifies which protocol to use for tunneling + the downstream connection. + type: string + targetHost: + description: Specifies a host to which the downstream connection + is tunneled. + type: string + targetPort: + description: Specifies a port to which the downstream connection + is tunneled. + maximum: 4294967295 + minimum: 0 + type: integer + required: + - targetHost + - targetPort + type: object + type: object + workloadSelector: + description: Criteria used to select the specific set of pods/VMs + on which this `DestinationRule` configuration should be applied. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + required: + - host + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - description: The name of a service from the service registry + jsonPath: .spec.host + name: Host + type: string + - description: CreationTimestamp is a timestamp representing the server time when + this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. For more information, see [Kubernetes API Conventions](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata) + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting load balancing, outlier detection, + etc. See more details at: https://istio.io/docs/reference/config/networking/destination-rule.html' + properties: + exportTo: + description: A list of namespaces to which this destination rule is + exported. + items: + type: string + type: array + host: + description: The name of a service from the service registry. + type: string + subsets: + description: One or more named sets that represent individual versions + of a service. + items: + properties: + labels: + additionalProperties: + type: string + description: Labels apply a filter over the endpoints of a service + in the service registry. + type: object + name: + description: Name of the subset. + type: string + trafficPolicy: + description: Traffic policies that apply to this subset. + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. properties: - interval: - description: The time duration between keep-alive probes. + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will + be queued while waiting for a ready connection + pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to + a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection + pool connections. type: string x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes to send without response before deciding the connection is dead. - maximum: 4294967295 - minimum: 0 + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams + allowed for a peer on one HTTP/2 connection. + format: int32 type: integer - time: - description: The time duration a connection needs to be idle before keep-alive probes start being sent. + maxRequestsPerConnection: + description: Maximum number of requests per connection + to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can + be outstanding to all hosts in a cluster at a + given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will + be preserved while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream + connections. + properties: + connectTimeout: + description: TCP connection timeout. type: string x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections + to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the + socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between keep-alive + probes. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes + to send without response before deciding the + connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection + needs to be idle before keep-alive probes + start being sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + type: object type: object type: object - type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: - required: - - simple + - simple - required: - - consistentHash - - required: + - consistentHash + - required: - simple - - required: + - required: - consistentHash - properties: - consistentHash: - allOf: - - oneOf: + properties: + consistentHash: + allOf: + - oneOf: - not: anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName - required: - - httpHeaderName + - httpHeaderName - required: - - httpCookie + - httpCookie - required: - - useSourceIp + - useSourceIp - required: - - httpQueryParameterName - - oneOf: + - httpQueryParameterName + - oneOf: - not: anyOf: - - required: - - ringHash - - required: - - maglev + - required: + - ringHash + - required: + - maglev - required: - - ringHash + - ringHash - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. + - maglev properties: - attributes: - description: Additional attributes for the cookie. - items: - properties: - name: - description: The name of the cookie attribute. - type: string - value: - description: The optional value of the cookie attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. + httpCookie: + description: Hash based on HTTP cookie. + properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the + cookie attribute. + type: string + required: + - name + type: object + type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name + type: object + httpHeaderName: + description: Hash based on a specific HTTP header. type: string - ttl: - description: Lifetime of the cookie. + httpQueryParameterName: + description: Hash based on a specific HTTP query + parameter. type: string - required: - - name - type: object - httpHeaderName: - description: Hash based on a specific HTTP header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query parameter. - type: string - maglev: - description: The Maglev load balancer implements consistent hashing to backend hosts. - properties: - tableSize: - description: The table size for Maglev hashing. - minimum: 0 - type: integer - type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer implements consistent hashing to backend hosts. - properties: + maglev: + description: The Maglev load balancer implements + consistent hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev hashing. + minimum: 0 + type: integer + type: object minimumRingSize: - description: The minimum number of virtual nodes to use for the hash ring. + description: Deprecated. minimum: 0 type: integer - type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean - type: object - localityLbSetting: - properties: - distribute: - description: 'Optional: only one of distribute, failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' separated, e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 + ringHash: + description: The ring/modulo hash load balancer + implements consistent hashing to backend hosts. + properties: + minimumRingSize: + description: The minimum number of virtual nodes + to use for the hash ring. minimum: 0 type: integer - description: Map of upstream localities to traffic distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the traffic will fail over to when endpoints in the 'from' region becomes unhealthy. - type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered list of labels used to sort endpoints to do priority based load balancing. - items: - type: string - type: array - type: object - simple: - description: |- - - - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration of Service. - properties: - aggression: - description: This parameter controls the speed of traffic increase over the warmup duration. - format: double - minimum: 0 - nullable: true - type: number - duration: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - required: - - duration - type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - outlierDetection: - properties: - baseEjectionTime: - description: Minimum ejection duration. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated failures before ejection occurs. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - interval: - description: Time interval between ejection sweep analysis. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local origin failures from external errors. - type: boolean - type: object - portLevelSettings: - description: Traffic policies specific to individual ports. - items: - properties: - connectionPool: - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be preserved while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. + type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean + type: object + localityLbSetting: + properties: + distribute: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: properties: - interval: - description: The time duration between keep-alive probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes to send without response before deciding the connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection needs to be idle before keep-alive probes start being sent. + from: + description: Originating locality, '/' separated, + e.g. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities to + traffic distribution weights. + type: object type: object - type: object - type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: - - required: - - simple - - required: - - consistentHash - - required: - - simple - - required: - - consistentHash - properties: - consistentHash: - allOf: - - oneOf: - - not: - anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - oneOf: - - not: - anyOf: - - required: - - ringHash - - required: - - maglev - - required: - - ringHash - - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: properties: - attributes: - description: Additional attributes for the cookie. - items: - properties: - name: - description: The name of the cookie attribute. - type: string - value: - description: The optional value of the cookie attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. + from: + description: Originating region. type: string - path: - description: Path to set for the cookie. + to: + description: Destination region the traffic + will fail over to when endpoints in the + 'from' region becomes unhealthy. type: string - ttl: - description: Lifetime of the cookie. - type: string - required: - - name type: object - httpHeaderName: - description: Hash based on a specific HTTP header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query parameter. - type: string - maglev: - description: The Maglev load balancer implements consistent hashing to backend hosts. - properties: - tableSize: - description: The table size for Maglev hashing. - minimum: 0 - type: integer - type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer implements consistent hashing to backend hosts. - properties: - minimumRingSize: - description: The minimum number of virtual nodes to use for the hash ring. - minimum: 0 - type: integer - type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean - type: object - localityLbSetting: - properties: - distribute: - description: 'Optional: only one of distribute, failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' separated, e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities to traffic distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the traffic will fail over to when endpoints in the 'from' region becomes unhealthy. - type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered list of labels used to sort endpoints to do priority based load balancing. - items: - type: string - type: array - type: object - simple: - description: |- - - - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration of Service. - properties: - aggression: - description: This parameter controls the speed of traffic increase over the warmup duration. - format: double - minimum: 0 - nullable: true - type: number - duration: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - required: - - duration - type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - outlierDetection: - properties: - baseEjectionTime: - description: Minimum ejection duration. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated failures before ejection occurs. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - interval: - description: Time interval between ejection sweep analysis. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local origin failures from external errors. - type: boolean - type: object - port: - description: Specifies the number of a port on the destination service on which this policy is being applied. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - tls: - description: TLS related settings for connections to the upstream service. - properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds the TLS certs for the client including the CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.' - nullable: true - type: boolean - mode: - description: |- - Indicates whether connections to this port should be secured using TLS. - - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. - type: string - sni: - description: SNI string to present to the server during TLS handshake. - type: string - subjectAltNames: - description: A list of alternate names to verify the subject identity in the certificate. - items: - type: string - type: array - type: object - type: object - maxItems: 4096 - type: array - proxyProtocol: - description: The upstream PROXY protocol settings. - properties: - version: - description: |- - The PROXY protocol version to use. - - Valid Options: V1, V2 - enum: - - V1 - - V2 - type: string - type: object - retryBudget: - description: Specifies a limit on concurrent retries in relation to the number of active requests. - properties: - minRetryConcurrency: - description: Specifies the minimum retry concurrency allowed for the retry budget. - maximum: 4294967295 - minimum: 0 - type: integer - percent: - description: Specifies the limit on concurrent retries as a percentage of the sum of active requests and active pending requests. - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - type: object - tls: - description: TLS related settings for connections to the upstream service. - properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds the TLS certs for the client including the CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.' - nullable: true - type: boolean - mode: - description: |- - Indicates whether connections to this port should be secured using TLS. + type: array + failoverPriority: + description: failoverPriority is an ordered list + of labels used to sort endpoints to do priority + based load balancing. + items: + type: string + type: array + type: object + simple: + description: |2- - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. - type: string - sni: - description: SNI string to present to the server during TLS handshake. - type: string - subjectAltNames: - description: A list of alternate names to verify the subject identity in the certificate. - items: - type: string - type: array - type: object - tunnel: - description: Configuration of tunneling TCP over other transport or application layers for the host configured in the DestinationRule. - properties: - protocol: - description: Specifies which protocol to use for tunneling the downstream connection. - type: string - targetHost: - description: Specifies a host to which the downstream connection is tunneled. - type: string - targetPort: - description: Specifies a port to which the downstream connection is tunneled. - maximum: 4294967295 - minimum: 0 - type: integer - required: - - targetHost - - targetPort - type: object - type: object - workloadSelector: - description: Criteria used to select the specific set of pods/VMs on which this `DestinationRule` configuration should be applied. - properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied. - maxProperties: 4096 - type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) - type: object - required: - - host - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} - - additionalPrinterColumns: - - description: The name of a service from the service registry - jsonPath: .spec.host - name: Host - type: string - - description: CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. For more information, see [Kubernetes API Conventions](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata) - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting load balancing, outlier detection, etc. See more details at: https://istio.io/docs/reference/config/networking/destination-rule.html' - properties: - exportTo: - description: A list of namespaces to which this destination rule is exported. - items: - type: string - type: array - host: - description: The name of a service from the service registry. - type: string - subsets: - description: One or more named sets that represent individual versions of a service. - items: - properties: - labels: - additionalProperties: - type: string - description: Labels apply a filter over the endpoints of a service in the service registry. - type: object - name: - description: Name of the subset. - type: string - trafficPolicy: - description: Traffic policies that apply to this subset. - properties: - connectionPool: + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST + type: string + warmup: + description: Represents the warmup configuration of + Service. + properties: + aggression: + description: This parameter controls the speed of + traffic increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: + properties: + baseEjectionTime: + description: Minimum ejection duration. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected + from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a host + is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated + failures before ejection occurs. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep analysis. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing + pool for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled as long + as the associated load balancing pool has at least + `minHealthPercent` hosts in healthy mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local + origin failures from external errors. + type: boolean + type: object + portLevelSettings: + description: Traffic policies specific to individual ports. + items: properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be preserved while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream connections. + connectionPool: properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. + http: + description: HTTP connection pool settings. properties: - interval: - description: The time duration between keep-alive probes. + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that + will be queued while waiting for a ready + connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests + to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream + connection pool connections. type: string x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes to send without response before deciding the connection is dead. - maximum: 4294967295 - minimum: 0 + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent + streams allowed for a peer on one HTTP/2 + connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per + connection to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that + can be outstanding to all hosts in a cluster + at a given time. + format: int32 type: integer - time: - description: The time duration a connection needs to be idle before keep-alive probes start being sent. + useClientProtocol: + description: If set to true, client protocol + will be preserved while initiating connection + to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and + TCP upstream connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. type: string x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP + connections to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE + on the socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between + keep-alive probes. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive + probes to send without response before + deciding the connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection + needs to be idle before keep-alive probes + start being sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + type: object type: object type: object - type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: + loadBalancer: + description: Settings controlling the load balancer + algorithms. + oneOf: + - not: + anyOf: - required: - - simple + - simple - required: - - consistentHash - - required: + - consistentHash + - required: - simple - - required: + - required: - consistentHash - properties: - consistentHash: - allOf: - - oneOf: + properties: + consistentHash: + allOf: + - oneOf: - not: anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName - required: - - httpHeaderName + - httpHeaderName - required: - - httpCookie + - httpCookie - required: - - useSourceIp + - useSourceIp - required: - - httpQueryParameterName - - oneOf: + - httpQueryParameterName + - oneOf: - not: anyOf: - - required: - - ringHash - - required: - - maglev + - required: + - ringHash + - required: + - maglev - required: - - ringHash + - ringHash - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. + properties: + attributes: + description: Additional attributes for + the cookie. + items: + properties: + name: + description: The name of the cookie + attribute. + type: string + value: + description: The optional value + of the cookie attribute. + type: string + required: + - name + type: object + type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name + type: object + httpHeaderName: + description: Hash based on a specific HTTP + header. + type: string + httpQueryParameterName: + description: Hash based on a specific HTTP + query parameter. + type: string + maglev: + description: The Maglev load balancer implements + consistent hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev + hashing. + minimum: 0 + type: integer + type: object + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer + implements consistent hashing to backend + hosts. + properties: + minimumRingSize: + description: The minimum number of virtual + nodes to use for the hash ring. + minimum: 0 + type: integer + type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean + type: object + localityLbSetting: properties: - attributes: - description: Additional attributes for the cookie. + distribute: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: + properties: + from: + description: Originating locality, '/' + separated, e.g. + type: string + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities + to traffic distribution weights. + type: object + type: object + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' items: properties: - name: - description: The name of the cookie attribute. + from: + description: Originating region. type: string - value: - description: The optional value of the cookie attribute. + to: + description: Destination region the + traffic will fail over to when endpoints + in the 'from' region becomes unhealthy. type: string - required: - - name type: object type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. - type: string - ttl: - description: Lifetime of the cookie. - type: string - required: - - name + failoverPriority: + description: failoverPriority is an ordered + list of labels used to sort endpoints to + do priority based load balancing. + items: + type: string + type: array type: object - httpHeaderName: - description: Hash based on a specific HTTP header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query parameter. + simple: + description: |2- + + + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST type: string - maglev: - description: The Maglev load balancer implements consistent hashing to backend hosts. + warmup: + description: Represents the warmup configuration + of Service. properties: - tableSize: - description: The table size for Maglev hashing. + aggression: + description: This parameter controls the speed + of traffic increase over the warmup duration. + format: double minimum: 0 - type: integer + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration type: object - minimumRingSize: - description: Deprecated. + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: + properties: + baseEjectionTime: + description: Minimum ejection duration. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host + is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a + host is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally + originated failures before ejection occurs. + maximum: 4294967295 minimum: 0 + nullable: true type: integer - ringHash: - description: The ring/modulo hash load balancer implements consistent hashing to backend hosts. - properties: - minimumRingSize: - description: The minimum number of virtual nodes to use for the hash ring. - minimum: 0 - type: integer - type: object - useSourceIp: - description: Hash based on the source IP address. + interval: + description: Time interval between ejection sweep + analysis. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing + pool for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled + as long as the associated load balancing pool + has at least `minHealthPercent` hosts in healthy + mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish + local origin failures from external errors. type: boolean type: object - localityLbSetting: + port: + description: Specifies the number of a port on the + destination service on which this policy is being + applied. properties: - distribute: - description: 'Optional: only one of distribute, failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' separated, e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities to traffic distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + tls: + description: TLS related settings for connections + to the upstream service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing + certificate authority certificates to use in + verifying a presented server certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing + the certificate revocation list (CRL) to use + in verifying a presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds + the TLS certs for the client including the CA + certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether + the proxy should skip verifying the CA signature + and SAN for the server certificate corresponding + to the host.' nullable: true type: boolean - failover: - description: 'Optional: only one of distribute, failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the traffic will fail over to when endpoints in the 'from' region becomes unhealthy. - type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered list of labels used to sort endpoints to do priority based load balancing. + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. + + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server + during TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify + the subject identity in the certificate. items: type: string type: array type: object - simple: - description: |- - - - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration of Service. - properties: - aggression: - description: This parameter controls the speed of traffic increase over the warmup duration. - format: double - minimum: 0 - nullable: true - type: number - duration: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - required: - - duration - type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - outlierDetection: - properties: - baseEjectionTime: - description: Minimum ejection duration. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated failures before ejection occurs. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - interval: - description: Time interval between ejection sweep analysis. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local origin failures from external errors. - type: boolean type: object - portLevelSettings: - description: Traffic policies specific to individual ports. - items: - properties: - connectionPool: - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be preserved while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes to send without response before deciding the connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection needs to be idle before keep-alive probes start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: object - type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: - - required: - - simple - - required: - - consistentHash - - required: - - simple - - required: - - consistentHash - properties: - consistentHash: - allOf: - - oneOf: - - not: - anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - oneOf: - - not: - anyOf: - - required: - - ringHash - - required: - - maglev - - required: - - ringHash - - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. - properties: - attributes: - description: Additional attributes for the cookie. - items: - properties: - name: - description: The name of the cookie attribute. - type: string - value: - description: The optional value of the cookie attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. - type: string - ttl: - description: Lifetime of the cookie. - type: string - required: - - name - type: object - httpHeaderName: - description: Hash based on a specific HTTP header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query parameter. - type: string - maglev: - description: The Maglev load balancer implements consistent hashing to backend hosts. - properties: - tableSize: - description: The table size for Maglev hashing. - minimum: 0 - type: integer - type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer implements consistent hashing to backend hosts. - properties: - minimumRingSize: - description: The minimum number of virtual nodes to use for the hash ring. - minimum: 0 - type: integer - type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean - type: object - localityLbSetting: - properties: - distribute: - description: 'Optional: only one of distribute, failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' separated, e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities to traffic distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the traffic will fail over to when endpoints in the 'from' region becomes unhealthy. - type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered list of labels used to sort endpoints to do priority based load balancing. - items: - type: string - type: array - type: object - simple: - description: |- + maxItems: 4096 + type: array + proxyProtocol: + description: The upstream PROXY protocol settings. + properties: + version: + description: |- + The PROXY protocol version to use. + Valid Options: V1, V2 + enum: + - V1 + - V2 + type: string + type: object + retryBudget: + description: Specifies a limit on concurrent retries in + relation to the number of active requests. + properties: + minRetryConcurrency: + description: Specifies the minimum retry concurrency + allowed for the retry budget. + maximum: 4294967295 + minimum: 0 + type: integer + percent: + description: Specifies the limit on concurrent retries + as a percentage of the sum of active requests and + active pending requests. + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + type: object + tls: + description: TLS related settings for connections to the + upstream service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing + certificate authority certificates to use in verifying + a presented server certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing + the certificate revocation list (CRL) to use in verifying + a presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds the TLS + certs for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether + the proxy should skip verifying the CA signature and + SAN for the server certificate corresponding to the + host.' + nullable: true + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration of Service. - properties: - aggression: - description: This parameter controls the speed of traffic increase over the warmup duration. - format: double - minimum: 0 - nullable: true - type: number - duration: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - required: - - duration - type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - outlierDetection: - properties: - baseEjectionTime: - description: Minimum ejection duration. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated failures before ejection occurs. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - interval: - description: Time interval between ejection sweep analysis. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local origin failures from external errors. - type: boolean - type: object - port: - description: Specifies the number of a port on the destination service on which this policy is being applied. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - tls: - description: TLS related settings for connections to the upstream service. - properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds the TLS certs for the client including the CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.' - nullable: true - type: boolean - mode: - description: |- - Indicates whether connections to this port should be secured using TLS. + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server during + TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify the + subject identity in the certificate. + items: + type: string + type: array + type: object + tunnel: + description: Configuration of tunneling TCP over other transport + or application layers for the host configured in the DestinationRule. + properties: + protocol: + description: Specifies which protocol to use for tunneling + the downstream connection. + type: string + targetHost: + description: Specifies a host to which the downstream + connection is tunneled. + type: string + targetPort: + description: Specifies a port to which the downstream + connection is tunneled. + maximum: 4294967295 + minimum: 0 + type: integer + required: + - targetHost + - targetPort + type: object + type: object + required: + - name + type: object + type: array + trafficPolicy: + description: Traffic policies to apply (load balancing policy, connection + pool sizes, outlier detection). + properties: + connectionPool: + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. - type: string - sni: - description: SNI string to present to the server during TLS handshake. - type: string - subjectAltNames: - description: A list of alternate names to verify the subject identity in the certificate. - items: - type: string - type: array - type: object - type: object - maxItems: 4096 - type: array - proxyProtocol: - description: The upstream PROXY protocol settings. + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will be queued + while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection + pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams + allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection + to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding + to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be preserved + while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream + connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections + to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket + to enable TCP Keepalives. properties: - version: - description: |- - The PROXY protocol version to use. - - Valid Options: V1, V2 - enum: - - V1 - - V2 + interval: + description: The time duration between keep-alive + probes. type: string - type: object - retryBudget: - description: Specifies a limit on concurrent retries in relation to the number of active requests. - properties: - minRetryConcurrency: - description: Specifies the minimum retry concurrency allowed for the retry budget. + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to + send without response before deciding the connection + is dead. maximum: 4294967295 minimum: 0 type: integer - percent: - description: Specifies the limit on concurrent retries as a percentage of the sum of active requests and active pending requests. - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number + time: + description: The time duration a connection needs + to be idle before keep-alive probes start being + sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') type: object - tls: - description: TLS related settings for connections to the upstream service. + type: object + type: object + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: + - required: + - simple + - required: + - consistentHash + - required: + - simple + - required: + - consistentHash + properties: + consistentHash: + allOf: + - oneOf: + - not: + anyOf: + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName + - oneOf: + - not: + anyOf: + - required: + - ringHash + - required: + - maglev + - required: + - ringHash + - required: + - maglev + properties: + httpCookie: + description: Hash based on HTTP cookie. properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds the TLS certs for the client including the CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.' - nullable: true - type: boolean - mode: - description: |- - Indicates whether connections to this port should be secured using TLS. - - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the cookie + attribute. + type: string + required: + - name + type: object + type: array + name: + description: Name of the cookie. type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. + path: + description: Path to set for the cookie. type: string - sni: - description: SNI string to present to the server during TLS handshake. + ttl: + description: Lifetime of the cookie. type: string - subjectAltNames: - description: A list of alternate names to verify the subject identity in the certificate. - items: - type: string - type: array + required: + - name type: object - tunnel: - description: Configuration of tunneling TCP over other transport or application layers for the host configured in the DestinationRule. + httpHeaderName: + description: Hash based on a specific HTTP header. + type: string + httpQueryParameterName: + description: Hash based on a specific HTTP query parameter. + type: string + maglev: + description: The Maglev load balancer implements consistent + hashing to backend hosts. properties: - protocol: - description: Specifies which protocol to use for tunneling the downstream connection. - type: string - targetHost: - description: Specifies a host to which the downstream connection is tunneled. - type: string - targetPort: - description: Specifies a port to which the downstream connection is tunneled. - maximum: 4294967295 + tableSize: + description: The table size for Maglev hashing. + minimum: 0 + type: integer + type: object + minimumRingSize: + description: Deprecated. + minimum: 0 + type: integer + ringHash: + description: The ring/modulo hash load balancer implements + consistent hashing to backend hosts. + properties: + minimumRingSize: + description: The minimum number of virtual nodes to + use for the hash ring. minimum: 0 type: integer - required: - - targetHost - - targetPort type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean type: object - required: - - name + localityLbSetting: + properties: + distribute: + description: 'Optional: only one of distribute, failover + or failoverPriority can be set.' + items: + properties: + from: + description: Originating locality, '/' separated, + e.g. + type: string + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities to traffic + distribution weights. + type: object + type: object + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, failover + or failoverPriority can be set.' + items: + properties: + from: + description: Originating region. + type: string + to: + description: Destination region the traffic will + fail over to when endpoints in the 'from' region + becomes unhealthy. + type: string + type: object + type: array + failoverPriority: + description: failoverPriority is an ordered list of labels + used to sort endpoints to do priority based load balancing. + items: + type: string + type: array + type: object + simple: + description: |2- + + + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST + type: string + warmup: + description: Represents the warmup configuration of Service. + properties: + aggression: + description: This parameter controls the speed of traffic + increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') type: object - type: array - trafficPolicy: - description: Traffic policies to apply (load balancing policy, connection pool sizes, outlier detection). - properties: - connectionPool: + outlierDetection: + properties: + baseEjectionTime: + description: Minimum ejection duration. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected + from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a host is ejected + from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated + failures before ejection occurs. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep analysis. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing pool + for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled as long as + the associated load balancing pool has at least `minHealthPercent` + hosts in healthy mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local origin + failures from external errors. + type: boolean + type: object + portLevelSettings: + description: Traffic policies specific to individual ports. + items: properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be preserved while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream connections. + connectionPool: properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. + http: + description: HTTP connection pool settings. properties: - interval: - description: The time duration between keep-alive probes. + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will + be queued while waiting for a ready connection + pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to + a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection + pool connections. type: string x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes to send without response before deciding the connection is dead. - maximum: 4294967295 - minimum: 0 + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams + allowed for a peer on one HTTP/2 connection. + format: int32 type: integer - time: - description: The time duration a connection needs to be idle before keep-alive probes start being sent. + maxRequestsPerConnection: + description: Maximum number of requests per connection + to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can + be outstanding to all hosts in a cluster at a + given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will + be preserved while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream + connections. + properties: + connectTimeout: + description: TCP connection timeout. type: string x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections + to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the + socket to enable TCP Keepalives. + properties: + interval: + description: The time duration between keep-alive + probes. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes + to send without response before deciding the + connection is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection + needs to be idle before keep-alive probes + start being sent. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater + than 1ms + rule: duration(self) >= duration('1ms') + type: object type: object type: object - type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: + loadBalancer: + description: Settings controlling the load balancer algorithms. + oneOf: + - not: + anyOf: - required: - - simple + - simple - required: - - consistentHash - - required: + - consistentHash + - required: - simple - - required: + - required: - consistentHash - properties: - consistentHash: - allOf: - - oneOf: + properties: + consistentHash: + allOf: + - oneOf: - not: anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName + - required: + - httpHeaderName + - required: + - httpCookie + - required: + - useSourceIp + - required: + - httpQueryParameterName - required: - - httpHeaderName + - httpHeaderName - required: - - httpCookie + - httpCookie - required: - - useSourceIp + - useSourceIp - required: - - httpQueryParameterName - - oneOf: + - httpQueryParameterName + - oneOf: - not: anyOf: - - required: - - ringHash - - required: - - maglev + - required: + - ringHash + - required: + - maglev - required: - - ringHash + - ringHash - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. + - maglev properties: - attributes: - description: Additional attributes for the cookie. - items: - properties: - name: - description: The name of the cookie attribute. - type: string - value: - description: The optional value of the cookie attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. + httpCookie: + description: Hash based on HTTP cookie. + properties: + attributes: + description: Additional attributes for the cookie. + items: + properties: + name: + description: The name of the cookie attribute. + type: string + value: + description: The optional value of the + cookie attribute. + type: string + required: + - name + type: object + type: array + name: + description: Name of the cookie. + type: string + path: + description: Path to set for the cookie. + type: string + ttl: + description: Lifetime of the cookie. + type: string + required: + - name + type: object + httpHeaderName: + description: Hash based on a specific HTTP header. type: string - ttl: - description: Lifetime of the cookie. + httpQueryParameterName: + description: Hash based on a specific HTTP query + parameter. type: string - required: - - name - type: object - httpHeaderName: - description: Hash based on a specific HTTP header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query parameter. - type: string - maglev: - description: The Maglev load balancer implements consistent hashing to backend hosts. - properties: - tableSize: - description: The table size for Maglev hashing. - minimum: 0 - type: integer - type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer implements consistent hashing to backend hosts. - properties: + maglev: + description: The Maglev load balancer implements + consistent hashing to backend hosts. + properties: + tableSize: + description: The table size for Maglev hashing. + minimum: 0 + type: integer + type: object minimumRingSize: - description: The minimum number of virtual nodes to use for the hash ring. + description: Deprecated. minimum: 0 type: integer - type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean - type: object - localityLbSetting: - properties: - distribute: - description: 'Optional: only one of distribute, failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' separated, e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 + ringHash: + description: The ring/modulo hash load balancer + implements consistent hashing to backend hosts. + properties: + minimumRingSize: + description: The minimum number of virtual nodes + to use for the hash ring. minimum: 0 type: integer - description: Map of upstream localities to traffic distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the traffic will fail over to when endpoints in the 'from' region becomes unhealthy. - type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered list of labels used to sort endpoints to do priority based load balancing. - items: - type: string - type: array - type: object - simple: - description: |- - - - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration of Service. - properties: - aggression: - description: This parameter controls the speed of traffic increase over the warmup duration. - format: double - minimum: 0 - nullable: true - type: number - duration: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - required: - - duration - type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - outlierDetection: - properties: - baseEjectionTime: - description: Minimum ejection duration. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated failures before ejection occurs. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - interval: - description: Time interval between ejection sweep analysis. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local origin failures from external errors. - type: boolean - type: object - portLevelSettings: - description: Traffic policies specific to individual ports. - items: - properties: - connectionPool: - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be preserved while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. + type: object + useSourceIp: + description: Hash based on the source IP address. + type: boolean + type: object + localityLbSetting: + properties: + distribute: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: properties: - interval: - description: The time duration between keep-alive probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes to send without response before deciding the connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection needs to be idle before keep-alive probes start being sent. + from: + description: Originating locality, '/' separated, + e.g. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') + to: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + description: Map of upstream localities to + traffic distribution weights. + type: object type: object - type: object - type: object - loadBalancer: - description: Settings controlling the load balancer algorithms. - oneOf: - - not: - anyOf: - - required: - - simple - - required: - - consistentHash - - required: - - simple - - required: - - consistentHash - properties: - consistentHash: - allOf: - - oneOf: - - not: - anyOf: - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - required: - - httpHeaderName - - required: - - httpCookie - - required: - - useSourceIp - - required: - - httpQueryParameterName - - oneOf: - - not: - anyOf: - - required: - - ringHash - - required: - - maglev - - required: - - ringHash - - required: - - maglev - properties: - httpCookie: - description: Hash based on HTTP cookie. + type: array + enabled: + description: Enable locality load balancing. + nullable: true + type: boolean + failover: + description: 'Optional: only one of distribute, + failover or failoverPriority can be set.' + items: properties: - attributes: - description: Additional attributes for the cookie. - items: - properties: - name: - description: The name of the cookie attribute. - type: string - value: - description: The optional value of the cookie attribute. - type: string - required: - - name - type: object - type: array - name: - description: Name of the cookie. - type: string - path: - description: Path to set for the cookie. - type: string - ttl: - description: Lifetime of the cookie. + from: + description: Originating region. type: string - required: - - name - type: object - httpHeaderName: - description: Hash based on a specific HTTP header. - type: string - httpQueryParameterName: - description: Hash based on a specific HTTP query parameter. - type: string - maglev: - description: The Maglev load balancer implements consistent hashing to backend hosts. - properties: - tableSize: - description: The table size for Maglev hashing. - minimum: 0 - type: integer - type: object - minimumRingSize: - description: Deprecated. - minimum: 0 - type: integer - ringHash: - description: The ring/modulo hash load balancer implements consistent hashing to backend hosts. - properties: - minimumRingSize: - description: The minimum number of virtual nodes to use for the hash ring. - minimum: 0 - type: integer - type: object - useSourceIp: - description: Hash based on the source IP address. - type: boolean - type: object - localityLbSetting: - properties: - distribute: - description: 'Optional: only one of distribute, failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating locality, '/' separated, e.g. - type: string - to: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - description: Map of upstream localities to traffic distribution weights. - type: object - type: object - type: array - enabled: - description: Enable locality load balancing. - nullable: true - type: boolean - failover: - description: 'Optional: only one of distribute, failover or failoverPriority can be set.' - items: - properties: - from: - description: Originating region. - type: string - to: - description: Destination region the traffic will fail over to when endpoints in the 'from' region becomes unhealthy. - type: string - type: object - type: array - failoverPriority: - description: failoverPriority is an ordered list of labels used to sort endpoints to do priority based load balancing. - items: - type: string - type: array - type: object - simple: - description: |- + to: + description: Destination region the traffic + will fail over to when endpoints in the + 'from' region becomes unhealthy. + type: string + type: object + type: array + failoverPriority: + description: failoverPriority is an ordered list + of labels used to sort endpoints to do priority + based load balancing. + items: + type: string + type: array + type: object + simple: + description: |2- - Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST - enum: - - UNSPECIFIED - - LEAST_CONN - - RANDOM - - PASSTHROUGH - - ROUND_ROBIN - - LEAST_REQUEST - type: string - warmup: - description: Represents the warmup configuration of Service. - properties: - aggression: - description: This parameter controls the speed of traffic increase over the warmup duration. - format: double - minimum: 0 - nullable: true - type: number - duration: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - minimumPercent: - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - required: - - duration - type: object - warmupDurationSecs: - description: 'Deprecated: use `warmup` instead.' - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - outlierDetection: - properties: - baseEjectionTime: - description: Minimum ejection duration. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - consecutive5xxErrors: - description: Number of 5xx errors before a host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveErrors: - format: int32 - type: integer - consecutiveGatewayErrors: - description: Number of gateway errors before a host is ejected from the connection pool. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - consecutiveLocalOriginFailures: - description: The number of consecutive locally originated failures before ejection occurs. - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - interval: - description: Time interval between ejection sweep analysis. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms + Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST + enum: + - UNSPECIFIED + - LEAST_CONN + - RANDOM + - PASSTHROUGH + - ROUND_ROBIN + - LEAST_REQUEST + type: string + warmup: + description: Represents the warmup configuration of + Service. + properties: + aggression: + description: This parameter controls the speed of + traffic increase over the warmup duration. + format: double + minimum: 0 + nullable: true + type: number + duration: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms rule: duration(self) >= duration('1ms') - maxEjectionPercent: - description: Maximum % of hosts in the load balancing pool for the upstream service that can be ejected. - format: int32 - type: integer - minHealthPercent: - description: Outlier detection will be enabled as long as the associated load balancing pool has at least `minHealthPercent` hosts in healthy mode. - format: int32 - type: integer - splitExternalLocalOriginErrors: - description: Determines whether to distinguish local origin failures from external errors. - type: boolean - type: object - port: - description: Specifies the number of a port on the destination service on which this policy is being applied. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - tls: - description: TLS related settings for connections to the upstream service. - properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds the TLS certs for the client including the CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.' - nullable: true - type: boolean - mode: - description: |- - Indicates whether connections to this port should be secured using TLS. + minimumPercent: + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + required: + - duration + type: object + warmupDurationSecs: + description: 'Deprecated: use `warmup` instead.' + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + outlierDetection: + properties: + baseEjectionTime: + description: Minimum ejection duration. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + consecutive5xxErrors: + description: Number of 5xx errors before a host is ejected + from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveErrors: + format: int32 + type: integer + consecutiveGatewayErrors: + description: Number of gateway errors before a host + is ejected from the connection pool. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + consecutiveLocalOriginFailures: + description: The number of consecutive locally originated + failures before ejection occurs. + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + interval: + description: Time interval between ejection sweep analysis. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxEjectionPercent: + description: Maximum % of hosts in the load balancing + pool for the upstream service that can be ejected. + format: int32 + type: integer + minHealthPercent: + description: Outlier detection will be enabled as long + as the associated load balancing pool has at least + `minHealthPercent` hosts in healthy mode. + format: int32 + type: integer + splitExternalLocalOriginErrors: + description: Determines whether to distinguish local + origin failures from external errors. + type: boolean + type: object + port: + description: Specifies the number of a port on the destination + service on which this policy is being applied. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + tls: + description: TLS related settings for connections to the + upstream service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing + certificate authority certificates to use in verifying + a presented server certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing + the certificate revocation list (CRL) to use in verifying + a presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds the TLS + certs for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether + the proxy should skip verifying the CA signature and + SAN for the server certificate corresponding to the + host.' + nullable: true + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. - type: string - sni: - description: SNI string to present to the server during TLS handshake. + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `MUTUAL`. + type: string + sni: + description: SNI string to present to the server during + TLS handshake. + type: string + subjectAltNames: + description: A list of alternate names to verify the + subject identity in the certificate. + items: type: string - subjectAltNames: - description: A list of alternate names to verify the subject identity in the certificate. - items: - type: string - type: array - type: object - type: object - maxItems: 4096 - type: array - proxyProtocol: - description: The upstream PROXY protocol settings. - properties: - version: - description: |- - The PROXY protocol version to use. - - Valid Options: V1, V2 - enum: - - V1 - - V2 - type: string - type: object - retryBudget: - description: Specifies a limit on concurrent retries in relation to the number of active requests. - properties: - minRetryConcurrency: - description: Specifies the minimum retry concurrency allowed for the retry budget. - maximum: 4294967295 - minimum: 0 - type: integer - percent: - description: Specifies the limit on concurrent retries as a percentage of the sum of active requests and active pending requests. - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number + type: array + type: object type: object - tls: - description: TLS related settings for connections to the upstream service. - properties: - caCertificates: - description: 'OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate.' - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented server certificate.' - type: string - clientCertificate: - description: REQUIRED if mode is `MUTUAL`. - type: string - credentialName: - description: The name of the secret that holds the TLS certs for the client including the CA certificates. - type: string - insecureSkipVerify: - description: '`insecureSkipVerify` specifies whether the proxy should skip verifying the CA signature and SAN for the server certificate corresponding to the host.' - nullable: true - type: boolean - mode: - description: |- - Indicates whether connections to this port should be secured using TLS. + maxItems: 4096 + type: array + proxyProtocol: + description: The upstream PROXY protocol settings. + properties: + version: + description: |- + The PROXY protocol version to use. - Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL - enum: - - DISABLE - - SIMPLE - - MUTUAL - - ISTIO_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `MUTUAL`. - type: string - sni: - description: SNI string to present to the server during TLS handshake. - type: string - subjectAltNames: - description: A list of alternate names to verify the subject identity in the certificate. - items: - type: string - type: array - type: object - tunnel: - description: Configuration of tunneling TCP over other transport or application layers for the host configured in the DestinationRule. - properties: - protocol: - description: Specifies which protocol to use for tunneling the downstream connection. - type: string - targetHost: - description: Specifies a host to which the downstream connection is tunneled. - type: string - targetPort: - description: Specifies a port to which the downstream connection is tunneled. - maximum: 4294967295 - minimum: 0 - type: integer - required: - - targetHost - - targetPort - type: object - type: object - workloadSelector: - description: Criteria used to select the specific set of pods/VMs on which this `DestinationRule` configuration should be applied. - properties: - matchLabels: - additionalProperties: - maxLength: 63 + Valid Options: V1, V2 + enum: + - V1 + - V2 type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied. - maxProperties: 4096 - type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) - type: object - required: - - host - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: + type: object + retryBudget: + description: Specifies a limit on concurrent retries in relation + to the number of active requests. properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. + minRetryConcurrency: + description: Specifies the minimum retry concurrency allowed + for the retry budget. + maximum: 4294967295 + minimum: 0 + type: integer + percent: + description: Specifies the limit on concurrent retries as + a percentage of the sum of active requests and active pending + requests. + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + type: object + tls: + description: TLS related settings for connections to the upstream + service. + properties: + caCertificates: + description: 'OPTIONAL: The path to the file containing certificate + authority certificates to use in verifying a presented server + certificate.' + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing the + certificate revocation list (CRL) to use in verifying a + presented server certificate.' + type: string + clientCertificate: + description: REQUIRED if mode is `MUTUAL`. + type: string + credentialName: + description: The name of the secret that holds the TLS certs + for the client including the CA certificates. + type: string + insecureSkipVerify: + description: '`insecureSkipVerify` specifies whether the proxy + should skip verifying the CA signature and SAN for the server + certificate corresponding to the host.' + nullable: true + type: boolean + mode: + description: |- + Indicates whether connections to this port should be secured using TLS. + + Valid Options: DISABLE, SIMPLE, MUTUAL, ISTIO_MUTUAL + enum: + - DISABLE + - SIMPLE + - MUTUAL + - ISTIO_MUTUAL type: string - status: - description: Status is the status of the condition. + privateKey: + description: REQUIRED if mode is `MUTUAL`. type: string - type: - description: Type is the type of the condition. + sni: + description: SNI string to present to the server during TLS + handshake. type: string + subjectAltNames: + description: A list of alternate names to verify the subject + identity in the certificate. + items: + type: string + type: array type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: + tunnel: + description: Configuration of tunneling TCP over other transport + or application layers for the host configured in the DestinationRule. properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. + protocol: + description: Specifies which protocol to use for tunneling + the downstream connection. type: string - level: - description: |- - Represents how severe a message is. + targetHost: + description: Specifies a host to which the downstream connection + is tunneled. + type: string + targetPort: + description: Specifies a port to which the downstream connection + is tunneled. + maximum: 4294967295 + minimum: 0 + type: integer + required: + - targetHost + - targetPort + type: object + type: object + workloadSelector: + description: Criteria used to select the specific set of pods/VMs + on which this `DestinationRule` configuration should be applied. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + required: + - host + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -6010,407 +6818,442 @@ spec: group: networking.istio.io names: categories: - - istio-io - - networking-istio-io + - istio-io + - networking-istio-io kind: EnvoyFilter listKind: EnvoyFilterList plural: envoyfilters singular: envoyfilter scope: Namespaced versions: - - name: v1alpha3 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Customizing Envoy configuration generated by Istio. See more details at: https://istio.io/docs/reference/config/networking/envoy-filter.html' - properties: - configPatches: - description: One or more patches with match conditions. - items: - properties: - applyTo: - description: |- - Specifies where in the Envoy configuration, the patch should be applied. + - name: v1alpha3 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Customizing Envoy configuration generated by Istio. See + more details at: https://istio.io/docs/reference/config/networking/envoy-filter.html' + properties: + configPatches: + description: One or more patches with match conditions. + items: + properties: + applyTo: + description: |- + Specifies where in the Envoy configuration, the patch should be applied. - Valid Options: LISTENER, FILTER_CHAIN, NETWORK_FILTER, HTTP_FILTER, ROUTE_CONFIGURATION, VIRTUAL_HOST, HTTP_ROUTE, CLUSTER, EXTENSION_CONFIG, BOOTSTRAP, LISTENER_FILTER - enum: - - INVALID - - LISTENER - - FILTER_CHAIN - - NETWORK_FILTER - - HTTP_FILTER - - ROUTE_CONFIGURATION - - VIRTUAL_HOST - - HTTP_ROUTE - - CLUSTER - - EXTENSION_CONFIG - - BOOTSTRAP - - LISTENER_FILTER - type: string - match: - description: Match on listener/route configuration/cluster. - oneOf: - - not: - anyOf: - - required: - - listener - - required: - - routeConfiguration - - required: - - cluster - - required: - - waypoint + Valid Options: LISTENER, FILTER_CHAIN, NETWORK_FILTER, HTTP_FILTER, ROUTE_CONFIGURATION, VIRTUAL_HOST, HTTP_ROUTE, CLUSTER, EXTENSION_CONFIG, BOOTSTRAP, LISTENER_FILTER + enum: + - INVALID + - LISTENER + - FILTER_CHAIN + - NETWORK_FILTER + - HTTP_FILTER + - ROUTE_CONFIGURATION + - VIRTUAL_HOST + - HTTP_ROUTE + - CLUSTER + - EXTENSION_CONFIG + - BOOTSTRAP + - LISTENER_FILTER + type: string + match: + description: Match on listener/route configuration/cluster. + oneOf: + - not: + anyOf: - required: - - listener + - listener - required: - - routeConfiguration + - routeConfiguration - required: - - cluster + - cluster - required: - - waypoint - properties: - cluster: - description: Match on envoy cluster attributes. - properties: - name: - description: The exact name of the cluster to match. - type: string - portNumber: - description: The service port for which this cluster was generated. - maximum: 4294967295 - minimum: 0 - type: integer - service: - description: The fully qualified service name for this cluster. - type: string - subset: - description: The subset associated with the service. - type: string - type: object - context: - description: |- - The specific config generation context to match on. + - waypoint + - required: + - listener + - required: + - routeConfiguration + - required: + - cluster + - required: + - waypoint + properties: + cluster: + description: Match on envoy cluster attributes. + properties: + name: + description: The exact name of the cluster to match. + type: string + portNumber: + description: The service port for which this cluster + was generated. + maximum: 4294967295 + minimum: 0 + type: integer + service: + description: The fully qualified service name for this + cluster. + type: string + subset: + description: The subset associated with the service. + type: string + type: object + context: + description: |- + The specific config generation context to match on. - Valid Options: ANY, SIDECAR_INBOUND, SIDECAR_OUTBOUND, GATEWAY, WAYPOINT - enum: - - ANY - - SIDECAR_INBOUND - - SIDECAR_OUTBOUND - - GATEWAY - - WAYPOINT - type: string - listener: - description: Match on envoy listener attributes. - properties: - filterChain: - description: Match a specific filter chain in a listener. - properties: - applicationProtocols: - description: Applies only to sidecars. - type: string - destinationPort: - description: The destination_port value used by a filter chain's match condition. - maximum: 4294967295 - minimum: 0 - type: integer - filter: - description: The name of a specific filter to apply the patch to. - properties: - name: - description: The filter name to match on. - type: string - subFilter: - description: The next level filter within this filter to match upon. - properties: - name: - description: The filter name to match on. - type: string - type: object - type: object - name: - description: The name assigned to the filter chain. - type: string - sni: - description: The SNI value used by a filter chain's match condition. - type: string - transportProtocol: - description: Applies only to `SIDECAR_INBOUND` context. - type: string - type: object - listenerFilter: - description: Match a specific listener filter. - type: string - name: - description: Match a specific listener by its name. - type: string - portName: - type: string - portNumber: - description: The service port/gateway port to which traffic is being sent/received. - maximum: 4294967295 - minimum: 0 - type: integer - type: object - proxy: - description: Match on properties associated with a proxy. - properties: - metadata: - additionalProperties: + Valid Options: ANY, SIDECAR_INBOUND, SIDECAR_OUTBOUND, GATEWAY, WAYPOINT + enum: + - ANY + - SIDECAR_INBOUND + - SIDECAR_OUTBOUND + - GATEWAY + - WAYPOINT + type: string + listener: + description: Match on envoy listener attributes. + properties: + filterChain: + description: Match a specific filter chain in a listener. + properties: + applicationProtocols: + description: Applies only to sidecars. type: string - description: Match on the node metadata supplied by a proxy when connecting to istiod. - type: object - proxyVersion: - description: A regular expression in golang regex format (RE2) that can be used to select proxies using a specific version of istio proxy. - type: string - type: object - routeConfiguration: - description: Match on envoy HTTP route configuration attributes. - properties: - gateway: - description: The Istio gateway config's namespace/name for which this route configuration was generated. - type: string - name: - description: Route configuration name to match on. - type: string - portName: - description: Applicable only for GATEWAY context. + destinationPort: + description: The destination_port value used by + a filter chain's match condition. + maximum: 4294967295 + minimum: 0 + type: integer + filter: + description: The name of a specific filter to apply + the patch to. + properties: + name: + description: The filter name to match on. + type: string + subFilter: + description: The next level filter within this + filter to match upon. + properties: + name: + description: The filter name to match on. + type: string + type: object + type: object + name: + description: The name assigned to the filter chain. + type: string + sni: + description: The SNI value used by a filter chain's + match condition. + type: string + transportProtocol: + description: Applies only to `SIDECAR_INBOUND` context. + type: string + type: object + listenerFilter: + description: Match a specific listener filter. + type: string + name: + description: Match a specific listener by its name. + type: string + portName: + type: string + portNumber: + description: The service port/gateway port to which + traffic is being sent/received. + maximum: 4294967295 + minimum: 0 + type: integer + type: object + proxy: + description: Match on properties associated with a proxy. + properties: + metadata: + additionalProperties: type: string - portNumber: - description: The service port number or gateway server port number for which this route configuration was generated. - maximum: 4294967295 - minimum: 0 - type: integer - vhost: - description: Match a specific virtual host in a route configuration and apply the patch to the virtual host. - properties: - domainName: - description: Match a domain name in a virtual host. - type: string - name: - description: The VirtualHosts objects generated by Istio are named as host:port, where the host typically corresponds to the VirtualService's host field or the hostname of a service in the registry. - type: string - route: - description: Match a specific route within the virtual host. - properties: - action: - description: |- - Match a route with specific action type. + description: Match on the node metadata supplied by + a proxy when connecting to istiod. + type: object + proxyVersion: + description: A regular expression in golang regex format + (RE2) that can be used to select proxies using a specific + version of istio proxy. + type: string + type: object + routeConfiguration: + description: Match on envoy HTTP route configuration attributes. + properties: + gateway: + description: The Istio gateway config's namespace/name + for which this route configuration was generated. + type: string + name: + description: Route configuration name to match on. + type: string + portName: + description: Applicable only for GATEWAY context. + type: string + portNumber: + description: The service port number or gateway server + port number for which this route configuration was + generated. + maximum: 4294967295 + minimum: 0 + type: integer + vhost: + description: Match a specific virtual host in a route + configuration and apply the patch to the virtual host. + properties: + domainName: + description: Match a domain name in a virtual host. + type: string + name: + description: The VirtualHosts objects generated + by Istio are named as host:port, where the host + typically corresponds to the VirtualService's + host field or the hostname of a service in the + registry. + type: string + route: + description: Match a specific route within the virtual + host. + properties: + action: + description: |- + Match a route with specific action type. - Valid Options: ANY, ROUTE, REDIRECT, DIRECT_RESPONSE - enum: - - ANY - - ROUTE - - REDIRECT - - DIRECT_RESPONSE - type: string - name: - description: The Route objects generated by default are named as default. - type: string - type: object - type: object - type: object - waypoint: - properties: - filter: - description: The name of a specific filter to apply the patch to. - properties: - name: - description: The filter name to match on. - type: string - subFilter: - description: The next level filter within this filter to match on. - properties: - name: - description: The filter name to match on. - type: string - type: object - type: object - portNumber: - description: The service port to match on. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - route: - description: Match a specific route. - properties: - name: - description: The Route objects generated by default are named as default. - type: string - type: object - type: object - type: object - x-kubernetes-validations: - - message: only support waypointMatch when context is WAYPOINT - rule: 'has(self.context) ? ((self.context == "WAYPOINT") ? has(self.waypoint) : !has(self.waypoint)) : !has(self.waypoint)' - patch: - description: The patch to apply along with the operation. - properties: - filterClass: - description: |- - Determines the filter insertion order. + Valid Options: ANY, ROUTE, REDIRECT, DIRECT_RESPONSE + enum: + - ANY + - ROUTE + - REDIRECT + - DIRECT_RESPONSE + type: string + name: + description: The Route objects generated by + default are named as default. + type: string + type: object + type: object + type: object + waypoint: + properties: + filter: + description: The name of a specific filter to apply + the patch to. + properties: + name: + description: The filter name to match on. + type: string + subFilter: + description: The next level filter within this filter + to match on. + properties: + name: + description: The filter name to match on. + type: string + type: object + type: object + portNumber: + description: The service port to match on. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + route: + description: Match a specific route. + properties: + name: + description: The Route objects generated by default + are named as default. + type: string + type: object + type: object + type: object + x-kubernetes-validations: + - message: only support waypointMatch when context is WAYPOINT + rule: 'has(self.context) ? ((self.context == "WAYPOINT") ? + has(self.waypoint) : !has(self.waypoint)) : !has(self.waypoint)' + patch: + description: The patch to apply along with the operation. + properties: + filterClass: + description: |- + Determines the filter insertion order. - Valid Options: AUTHN, AUTHZ, STATS - enum: - - UNSPECIFIED - - AUTHN - - AUTHZ - - STATS - type: string - operation: - description: |- - Determines how the patch should be applied. + Valid Options: AUTHN, AUTHZ, STATS + enum: + - UNSPECIFIED + - AUTHN + - AUTHZ + - STATS + type: string + operation: + description: |- + Determines how the patch should be applied. - Valid Options: MERGE, ADD, REMOVE, INSERT_BEFORE, INSERT_AFTER, INSERT_FIRST, REPLACE - enum: - - INVALID - - MERGE - - ADD - - REMOVE - - INSERT_BEFORE - - INSERT_AFTER - - INSERT_FIRST - - REPLACE - type: string - value: - description: The JSON config of the object being patched. - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - type: object - type: array - priority: - description: Priority defines the order in which patch sets are applied within a context. - format: int32 - type: integer - targetRefs: - description: Optional. - items: - properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: name is the name of the target resource. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: namespace is the namespace of the referent. - type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 - required: - - kind - - name + Valid Options: MERGE, ADD, REMOVE, INSERT_BEFORE, INSERT_AFTER, INSERT_FIRST, REPLACE + enum: + - INVALID + - MERGE + - ADD + - REMOVE + - INSERT_BEFORE + - INSERT_AFTER + - INSERT_FIRST + - REPLACE + type: string + value: + description: The JSON config of the object being patched. + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + type: object + type: array + priority: + description: Priority defines the order in which patch sets are applied + within a context. + format: int32 + type: integer + targetRefs: + description: Optional. + items: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name + type: object + maxItems: 16 + type: array + workloadSelector: + description: Criteria used to select the specific set of pods/VMs + on which this patch configuration should be applied. + properties: + labels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard is not supported in selector + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which the configuration should be applied. + maxProperties: 256 type: object - maxItems: 16 - type: array - workloadSelector: - description: Criteria used to select the specific set of pods/VMs on which this patch configuration should be applied. + type: object + type: object + x-kubernetes-validations: + - message: only one of targetRefs or workloadSelector can be set + rule: '(has(self.workloadSelector) ? 1 : 0) + (has(self.targetRefs) + ? 1 : 0) <= 1' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: properties: - labels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard is not supported in selector - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of pods/VMs on which the configuration should be applied. - maxProperties: 256 + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string type: object type: object - type: object - x-kubernetes-validations: - - message: only one of targetRefs or workloadSelector can be set - rule: '(has(self.workloadSelector) ? 1 : 0) + (has(self.targetRefs) ? 1 : 0) <= 1' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -6428,751 +7271,842 @@ spec: group: networking.istio.io names: categories: - - istio-io - - networking-istio-io + - istio-io + - networking-istio-io kind: Gateway listKind: GatewayList plural: gateways shortNames: - - gw + - gw singular: gateway scope: Namespaced versions: - - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting edge load balancer. See more details at: https://istio.io/docs/reference/config/networking/gateway.html' - properties: - selector: - additionalProperties: - type: string - description: One or more labels that indicate a specific set of pods/VMs on which this gateway configuration should be applied. - type: object - servers: - description: A list of server specifications. - items: - properties: - bind: - description: The ip or the Unix domain socket to which the listener should be bound to. - type: string - defaultEndpoint: + - name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting edge load balancer. See more details + at: https://istio.io/docs/reference/config/networking/gateway.html' + properties: + selector: + additionalProperties: + type: string + description: One or more labels that indicate a specific set of pods/VMs + on which this gateway configuration should be applied. + type: object + servers: + description: A list of server specifications. + items: + properties: + bind: + description: The ip or the Unix domain socket to which the listener + should be bound to. + type: string + defaultEndpoint: + type: string + hosts: + description: One or more hosts exposed by this gateway. + items: type: string - hosts: - description: One or more hosts exposed by this gateway. - items: + type: array + name: + description: An optional name of the server, when set must be + unique across all servers. + type: string + port: + description: The Port on which the proxy should listen for incoming + connections. + properties: + name: + description: Label assigned to the port. type: string - type: array - name: - description: An optional name of the server, when set must be unique across all servers. - type: string - port: - description: The Port on which the proxy should listen for incoming connections. - properties: - name: - description: Label assigned to the port. - type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - protocol: - description: The protocol exposed on the port. - type: string - targetPort: - maximum: 4294967295 - minimum: 0 - type: integer - required: - - number - - protocol - - name - type: object - tls: - description: Set of TLS related options that govern the server's behavior. - properties: - caCertCredentialName: - description: For mutual TLS, the name of the secret or the configmap that holds CA certificates. - type: string - caCertificates: - description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented client side certificate.' + number: + description: A valid non-negative integer port number. + maximum: 4294967295 + minimum: 0 + type: integer + protocol: + description: The protocol exposed on the port. + type: string + targetPort: + maximum: 4294967295 + minimum: 0 + type: integer + required: + - number + - protocol + - name + type: object + tls: + description: Set of TLS related options that govern the server's + behavior. + properties: + caCertCredentialName: + description: For mutual TLS, the name of the secret or the + configmap that holds CA certificates. + type: string + caCertificates: + description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing + the certificate revocation list (CRL) to use in verifying + a presented client side certificate.' + type: string + cipherSuites: + description: 'Optional: If specified, only support the specified + cipher list.' + items: type: string - cipherSuites: - description: 'Optional: If specified, only support the specified cipher list.' - items: - type: string - type: array - credentialName: - description: For gateways running on Kubernetes, the name of the secret that holds the TLS certs including the CA certificates. + type: array + credentialName: + description: For gateways running on Kubernetes, the name + of the secret that holds the TLS certs including the CA + certificates. + type: string + credentialNames: + description: Same as CredentialName but for multiple certificates. + items: type: string - credentialNames: - description: Same as CredentialName but for multiple certificates. - items: - type: string - maxItems: 2 - minItems: 1 - type: array - httpsRedirect: - description: If set to true, the load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS. - type: boolean - maxProtocolVersion: - description: |- - Optional: Maximum TLS protocol version. + maxItems: 2 + minItems: 1 + type: array + httpsRedirect: + description: If set to true, the load balancer will send + a 301 redirect for all http connections, asking the clients + to use HTTPS. + type: boolean + maxProtocolVersion: + description: |- + Optional: Maximum TLS protocol version. - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - minProtocolVersion: - description: |- - Optional: Minimum TLS protocol version. + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + minProtocolVersion: + description: |- + Optional: Minimum TLS protocol version. - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - mode: - description: |- - Optional: Indicates whether connections to this port should be secured using TLS. + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + mode: + description: |- + Optional: Indicates whether connections to this port should be secured using TLS. - Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL - enum: - - PASSTHROUGH - - SIMPLE - - MUTUAL - - AUTO_PASSTHROUGH - - ISTIO_MUTUAL - - OPTIONAL_MUTUAL + Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL + enum: + - PASSTHROUGH + - SIMPLE + - MUTUAL + - AUTO_PASSTHROUGH + - ISTIO_MUTUAL + - OPTIONAL_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject + identity in the certificate presented by the client. + items: type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: array + tlsCertificates: + description: Only one of `server_certificate`, `private_key` + or `credential_name` or `credential_names` or `tls_certificates` + should be specified. + items: + properties: + caCertificates: + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + type: object + maxItems: 2 + minItems: 1 + type: array + verifyCertificateHash: + description: An optional list of hex-encoded SHA-256 hashes + of the authorized client certificates. + items: type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: array + verifyCertificateSpki: + description: An optional list of base64-encoded SHA-256 + hashes of the SPKIs of authorized client certificates. + items: type: string - subjectAltNames: - description: A list of alternate names to verify the subject identity in the certificate presented by the client. - items: - type: string - type: array - tlsCertificates: - description: Only one of `server_certificate`, `private_key` or `credential_name` or `credential_names` or `tls_certificates` should be specified. - items: - properties: - caCertificates: - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - type: object - maxItems: 2 - minItems: 1 - type: array - verifyCertificateHash: - description: An optional list of hex-encoded SHA-256 hashes of the authorized client certificates. - items: - type: string - type: array - verifyCertificateSpki: - description: An optional list of base64-encoded SHA-256 hashes of the SPKIs of authorized client certificates. - items: - type: string - type: array - type: object - x-kubernetes-validations: - - message: only one of credentialNames or tlsCertificates can be set - rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) ? 1 : 0) <= 1' - - message: only one of credentialName or credentialNames can be set - rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) ? 1 : 0) <= 1' - - message: only one of credentialName or tlsCertificates can be set - rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) ? 1 : 0) <= 1' - required: - - port - - hosts - type: object - type: array - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. + type: array + type: object + x-kubernetes-validations: + - message: only one of credentialNames or tlsCertificates can + be set + rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) + ? 1 : 0) <= 1' + - message: only one of credentialName or credentialNames can + be set + rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) + ? 1 : 0) <= 1' + - message: only one of credentialName or tlsCertificates can + be set + rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) + ? 1 : 0) <= 1' + required: + - port + - hosts + type: object + type: array + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} - - name: v1alpha3 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting edge load balancer. See more details at: https://istio.io/docs/reference/config/networking/gateway.html' - properties: - selector: - additionalProperties: - type: string - description: One or more labels that indicate a specific set of pods/VMs on which this gateway configuration should be applied. + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object type: object - servers: - description: A list of server specifications. - items: - properties: - bind: - description: The ip or the Unix domain socket to which the listener should be bound to. - type: string - defaultEndpoint: + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} + - name: v1alpha3 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting edge load balancer. See more details + at: https://istio.io/docs/reference/config/networking/gateway.html' + properties: + selector: + additionalProperties: + type: string + description: One or more labels that indicate a specific set of pods/VMs + on which this gateway configuration should be applied. + type: object + servers: + description: A list of server specifications. + items: + properties: + bind: + description: The ip or the Unix domain socket to which the listener + should be bound to. + type: string + defaultEndpoint: + type: string + hosts: + description: One or more hosts exposed by this gateway. + items: type: string - hosts: - description: One or more hosts exposed by this gateway. - items: + type: array + name: + description: An optional name of the server, when set must be + unique across all servers. + type: string + port: + description: The Port on which the proxy should listen for incoming + connections. + properties: + name: + description: Label assigned to the port. type: string - type: array - name: - description: An optional name of the server, when set must be unique across all servers. - type: string - port: - description: The Port on which the proxy should listen for incoming connections. - properties: - name: - description: Label assigned to the port. - type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - protocol: - description: The protocol exposed on the port. - type: string - targetPort: - maximum: 4294967295 - minimum: 0 - type: integer - required: - - number - - protocol - - name - type: object - tls: - description: Set of TLS related options that govern the server's behavior. - properties: - caCertCredentialName: - description: For mutual TLS, the name of the secret or the configmap that holds CA certificates. - type: string - caCertificates: - description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented client side certificate.' + number: + description: A valid non-negative integer port number. + maximum: 4294967295 + minimum: 0 + type: integer + protocol: + description: The protocol exposed on the port. + type: string + targetPort: + maximum: 4294967295 + minimum: 0 + type: integer + required: + - number + - protocol + - name + type: object + tls: + description: Set of TLS related options that govern the server's + behavior. + properties: + caCertCredentialName: + description: For mutual TLS, the name of the secret or the + configmap that holds CA certificates. + type: string + caCertificates: + description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing + the certificate revocation list (CRL) to use in verifying + a presented client side certificate.' + type: string + cipherSuites: + description: 'Optional: If specified, only support the specified + cipher list.' + items: type: string - cipherSuites: - description: 'Optional: If specified, only support the specified cipher list.' - items: - type: string - type: array - credentialName: - description: For gateways running on Kubernetes, the name of the secret that holds the TLS certs including the CA certificates. + type: array + credentialName: + description: For gateways running on Kubernetes, the name + of the secret that holds the TLS certs including the CA + certificates. + type: string + credentialNames: + description: Same as CredentialName but for multiple certificates. + items: type: string - credentialNames: - description: Same as CredentialName but for multiple certificates. - items: - type: string - maxItems: 2 - minItems: 1 - type: array - httpsRedirect: - description: If set to true, the load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS. - type: boolean - maxProtocolVersion: - description: |- - Optional: Maximum TLS protocol version. + maxItems: 2 + minItems: 1 + type: array + httpsRedirect: + description: If set to true, the load balancer will send + a 301 redirect for all http connections, asking the clients + to use HTTPS. + type: boolean + maxProtocolVersion: + description: |- + Optional: Maximum TLS protocol version. - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - minProtocolVersion: - description: |- - Optional: Minimum TLS protocol version. + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + minProtocolVersion: + description: |- + Optional: Minimum TLS protocol version. - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - mode: - description: |- - Optional: Indicates whether connections to this port should be secured using TLS. + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + mode: + description: |- + Optional: Indicates whether connections to this port should be secured using TLS. - Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL - enum: - - PASSTHROUGH - - SIMPLE - - MUTUAL - - AUTO_PASSTHROUGH - - ISTIO_MUTUAL - - OPTIONAL_MUTUAL + Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL + enum: + - PASSTHROUGH + - SIMPLE + - MUTUAL + - AUTO_PASSTHROUGH + - ISTIO_MUTUAL + - OPTIONAL_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject + identity in the certificate presented by the client. + items: type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: array + tlsCertificates: + description: Only one of `server_certificate`, `private_key` + or `credential_name` or `credential_names` or `tls_certificates` + should be specified. + items: + properties: + caCertificates: + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + type: object + maxItems: 2 + minItems: 1 + type: array + verifyCertificateHash: + description: An optional list of hex-encoded SHA-256 hashes + of the authorized client certificates. + items: type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: array + verifyCertificateSpki: + description: An optional list of base64-encoded SHA-256 + hashes of the SPKIs of authorized client certificates. + items: type: string - subjectAltNames: - description: A list of alternate names to verify the subject identity in the certificate presented by the client. - items: - type: string - type: array - tlsCertificates: - description: Only one of `server_certificate`, `private_key` or `credential_name` or `credential_names` or `tls_certificates` should be specified. - items: - properties: - caCertificates: - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - type: object - maxItems: 2 - minItems: 1 - type: array - verifyCertificateHash: - description: An optional list of hex-encoded SHA-256 hashes of the authorized client certificates. - items: - type: string - type: array - verifyCertificateSpki: - description: An optional list of base64-encoded SHA-256 hashes of the SPKIs of authorized client certificates. - items: - type: string - type: array - type: object - x-kubernetes-validations: - - message: only one of credentialNames or tlsCertificates can be set - rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) ? 1 : 0) <= 1' - - message: only one of credentialName or credentialNames can be set - rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) ? 1 : 0) <= 1' - - message: only one of credentialName or tlsCertificates can be set - rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) ? 1 : 0) <= 1' - required: - - port - - hosts - type: object - type: array - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. + type: array + type: object + x-kubernetes-validations: + - message: only one of credentialNames or tlsCertificates can + be set + rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) + ? 1 : 0) <= 1' + - message: only one of credentialName or credentialNames can + be set + rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) + ? 1 : 0) <= 1' + - message: only one of credentialName or tlsCertificates can + be set + rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) + ? 1 : 0) <= 1' + required: + - port + - hosts + type: object + type: array + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} - - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting edge load balancer. See more details at: https://istio.io/docs/reference/config/networking/gateway.html' - properties: - selector: - additionalProperties: - type: string - description: One or more labels that indicate a specific set of pods/VMs on which this gateway configuration should be applied. + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object type: object - servers: - description: A list of server specifications. - items: - properties: - bind: - description: The ip or the Unix domain socket to which the listener should be bound to. - type: string - defaultEndpoint: + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} + - name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting edge load balancer. See more details + at: https://istio.io/docs/reference/config/networking/gateway.html' + properties: + selector: + additionalProperties: + type: string + description: One or more labels that indicate a specific set of pods/VMs + on which this gateway configuration should be applied. + type: object + servers: + description: A list of server specifications. + items: + properties: + bind: + description: The ip or the Unix domain socket to which the listener + should be bound to. + type: string + defaultEndpoint: + type: string + hosts: + description: One or more hosts exposed by this gateway. + items: type: string - hosts: - description: One or more hosts exposed by this gateway. - items: + type: array + name: + description: An optional name of the server, when set must be + unique across all servers. + type: string + port: + description: The Port on which the proxy should listen for incoming + connections. + properties: + name: + description: Label assigned to the port. type: string - type: array - name: - description: An optional name of the server, when set must be unique across all servers. - type: string - port: - description: The Port on which the proxy should listen for incoming connections. - properties: - name: - description: Label assigned to the port. - type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - protocol: - description: The protocol exposed on the port. - type: string - targetPort: - maximum: 4294967295 - minimum: 0 - type: integer - required: - - number - - protocol - - name - type: object - tls: - description: Set of TLS related options that govern the server's behavior. - properties: - caCertCredentialName: - description: For mutual TLS, the name of the secret or the configmap that holds CA certificates. - type: string - caCertificates: - description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented client side certificate.' - type: string - cipherSuites: - description: 'Optional: If specified, only support the specified cipher list.' - items: - type: string - type: array - credentialName: - description: For gateways running on Kubernetes, the name of the secret that holds the TLS certs including the CA certificates. + number: + description: A valid non-negative integer port number. + maximum: 4294967295 + minimum: 0 + type: integer + protocol: + description: The protocol exposed on the port. + type: string + targetPort: + maximum: 4294967295 + minimum: 0 + type: integer + required: + - number + - protocol + - name + type: object + tls: + description: Set of TLS related options that govern the server's + behavior. + properties: + caCertCredentialName: + description: For mutual TLS, the name of the secret or the + configmap that holds CA certificates. + type: string + caCertificates: + description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing + the certificate revocation list (CRL) to use in verifying + a presented client side certificate.' + type: string + cipherSuites: + description: 'Optional: If specified, only support the specified + cipher list.' + items: type: string - credentialNames: - description: Same as CredentialName but for multiple certificates. - items: - type: string - maxItems: 2 - minItems: 1 - type: array - httpsRedirect: - description: If set to true, the load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS. - type: boolean - maxProtocolVersion: - description: |- - Optional: Maximum TLS protocol version. - - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 + type: array + credentialName: + description: For gateways running on Kubernetes, the name + of the secret that holds the TLS certs including the CA + certificates. + type: string + credentialNames: + description: Same as CredentialName but for multiple certificates. + items: type: string - minProtocolVersion: - description: |- - Optional: Minimum TLS protocol version. + maxItems: 2 + minItems: 1 + type: array + httpsRedirect: + description: If set to true, the load balancer will send + a 301 redirect for all http connections, asking the clients + to use HTTPS. + type: boolean + maxProtocolVersion: + description: |- + Optional: Maximum TLS protocol version. - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - mode: - description: |- - Optional: Indicates whether connections to this port should be secured using TLS. + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + minProtocolVersion: + description: |- + Optional: Minimum TLS protocol version. - Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL - enum: - - PASSTHROUGH - - SIMPLE - - MUTUAL - - AUTO_PASSTHROUGH - - ISTIO_MUTUAL - - OPTIONAL_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - subjectAltNames: - description: A list of alternate names to verify the subject identity in the certificate presented by the client. - items: - type: string - type: array - tlsCertificates: - description: Only one of `server_certificate`, `private_key` or `credential_name` or `credential_names` or `tls_certificates` should be specified. - items: - properties: - caCertificates: - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - type: object - maxItems: 2 - minItems: 1 - type: array - verifyCertificateHash: - description: An optional list of hex-encoded SHA-256 hashes of the authorized client certificates. - items: - type: string - type: array - verifyCertificateSpki: - description: An optional list of base64-encoded SHA-256 hashes of the SPKIs of authorized client certificates. - items: - type: string - type: array - type: object - x-kubernetes-validations: - - message: only one of credentialNames or tlsCertificates can be set - rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) ? 1 : 0) <= 1' - - message: only one of credentialName or credentialNames can be set - rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) ? 1 : 0) <= 1' - - message: only one of credentialName or tlsCertificates can be set - rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) ? 1 : 0) <= 1' - required: - - port - - hosts - type: object - type: array - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + mode: + description: |- + Optional: Indicates whether connections to this port should be secured using TLS. - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL + enum: + - PASSTHROUGH + - SIMPLE + - MUTUAL + - AUTO_PASSTHROUGH + - ISTIO_MUTUAL + - OPTIONAL_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject + identity in the certificate presented by the client. + items: type: string - name: - description: A human-readable name for the message type. + type: array + tlsCertificates: + description: Only one of `server_certificate`, `private_key` + or `credential_name` or `credential_names` or `tls_certificates` + should be specified. + items: + properties: + caCertificates: + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + type: object + maxItems: 2 + minItems: 1 + type: array + verifyCertificateHash: + description: An optional list of hex-encoded SHA-256 hashes + of the authorized client certificates. + items: type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} + type: array + verifyCertificateSpki: + description: An optional list of base64-encoded SHA-256 + hashes of the SPKIs of authorized client certificates. + items: + type: string + type: array + type: object + x-kubernetes-validations: + - message: only one of credentialNames or tlsCertificates can + be set + rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) + ? 1 : 0) <= 1' + - message: only one of credentialName or credentialNames can + be set + rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) + ? 1 : 0) <= 1' + - message: only one of credentialName or tlsCertificates can + be set + rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) + ? 1 : 0) <= 1' + required: + - port + - hosts + type: object + type: array + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} + --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -7190,34 +8124,54 @@ spec: group: security.istio.io names: categories: - - istio-io - - security-istio-io + - istio-io + - security-istio-io kind: PeerAuthentication listKind: PeerAuthenticationList plural: peerauthentications shortNames: - - pa + - pa singular: peerauthentication scope: Namespaced versions: - - additionalPrinterColumns: - - description: Defines the mTLS mode used for peer authentication. - jsonPath: .spec.mtls.mode - name: Mode - type: string - - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Peer authentication configuration for workloads. See more details at: https://istio.io/docs/reference/config/security/peer_authentication.html' - properties: - mtls: - description: Mutual TLS settings for workload. + - additionalPrinterColumns: + - description: Defines the mTLS mode used for peer authentication. + jsonPath: .spec.mtls.mode + name: Mode + type: string + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Peer authentication configuration for workloads. See more + details at: https://istio.io/docs/reference/config/security/peer_authentication.html' + properties: + mtls: + description: Mutual TLS settings for workload. + properties: + mode: + description: |- + Defines the mTLS mode used for peer authentication. + + Valid Options: DISABLE, PERMISSIVE, STRICT + enum: + - UNSET + - DISABLE + - PERMISSIVE + - STRICT + type: string + type: object + portLevelMtls: + additionalProperties: properties: mode: description: |- @@ -7225,149 +8179,162 @@ spec: Valid Options: DISABLE, PERMISSIVE, STRICT enum: - - UNSET - - DISABLE - - PERMISSIVE - - STRICT + - UNSET + - DISABLE + - PERMISSIVE + - STRICT type: string type: object - portLevelMtls: - additionalProperties: - properties: - mode: - description: |- - Defines the mTLS mode used for peer authentication. - - Valid Options: DISABLE, PERMISSIVE, STRICT - enum: - - UNSET - - DISABLE - - PERMISSIVE - - STRICT - type: string + description: Port specific mutual TLS settings. + minProperties: 1 + type: object + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: self.all(key, 0 < int(key) && int(key) <= 65535) + selector: + description: The selector determines the workloads to apply the PeerAuthentication + on. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which a policy should be applied. + maxProperties: 4096 type: object - description: Port specific mutual TLS settings. - minProperties: 1 + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + type: object + x-kubernetes-validations: + - message: portLevelMtls requires selector + rule: 'has(self.portLevelMtls) ? (((has(self.selector) && has(self.selector.matchLabels)) + ? self.selector.matchLabels : {}).size() > 0) : true' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string type: object - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: self.all(key, 0 < int(key) && int(key) <= 65535) - selector: - description: The selector determines the workloads to apply the PeerAuthentication on. + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied. - maxProperties: 4096 + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) type: object - type: object - x-kubernetes-validations: - - message: portLevelMtls requires selector - rule: 'has(self.portLevelMtls) ? (((has(self.selector) && has(self.selector.matchLabels)) ? self.selector.matchLabels : {}).size() > 0) : true' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - description: Defines the mTLS mode used for peer authentication. + jsonPath: .spec.mtls.mode + name: Mode + type: string + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Peer authentication configuration for workloads. See more + details at: https://istio.io/docs/reference/config/security/peer_authentication.html' + properties: + mtls: + description: Mutual TLS settings for workload. + properties: + mode: + description: |- + Defines the mTLS mode used for peer authentication. - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} - - additionalPrinterColumns: - - description: Defines the mTLS mode used for peer authentication. - jsonPath: .spec.mtls.mode - name: Mode - type: string - - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Peer authentication configuration for workloads. See more details at: https://istio.io/docs/reference/config/security/peer_authentication.html' - properties: - mtls: - description: Mutual TLS settings for workload. + Valid Options: DISABLE, PERMISSIVE, STRICT + enum: + - UNSET + - DISABLE + - PERMISSIVE + - STRICT + type: string + type: object + portLevelMtls: + additionalProperties: properties: mode: description: |- @@ -7375,131 +8342,125 @@ spec: Valid Options: DISABLE, PERMISSIVE, STRICT enum: - - UNSET - - DISABLE - - PERMISSIVE - - STRICT + - UNSET + - DISABLE + - PERMISSIVE + - STRICT type: string type: object - portLevelMtls: - additionalProperties: - properties: - mode: - description: |- - Defines the mTLS mode used for peer authentication. - - Valid Options: DISABLE, PERMISSIVE, STRICT - enum: - - UNSET - - DISABLE - - PERMISSIVE - - STRICT - type: string + description: Port specific mutual TLS settings. + minProperties: 1 + type: object + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: self.all(key, 0 < int(key) && int(key) <= 65535) + selector: + description: The selector determines the workloads to apply the PeerAuthentication + on. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which a policy should be applied. + maxProperties: 4096 type: object - description: Port specific mutual TLS settings. - minProperties: 1 + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + type: object + x-kubernetes-validations: + - message: portLevelMtls requires selector + rule: 'has(self.portLevelMtls) ? (((has(self.selector) && has(self.selector.matchLabels)) + ? self.selector.matchLabels : {}).size() > 0) : true' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string type: object - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: self.all(key, 0 < int(key) && int(key) <= 65535) - selector: - description: The selector determines the workloads to apply the PeerAuthentication on. + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied. - maxProperties: 4096 + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) type: object - type: object - x-kubernetes-validations: - - message: portLevelMtls requires selector - rule: 'has(self.portLevelMtls) ? (((has(self.selector) && has(self.selector.matchLabels)) ? self.selector.matchLabels : {}).size() > 0) : true' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -7517,135 +8478,143 @@ spec: group: networking.istio.io names: categories: - - istio-io - - networking-istio-io + - istio-io + - networking-istio-io kind: ProxyConfig listKind: ProxyConfigList plural: proxyconfigs singular: proxyconfig scope: Namespaced versions: - - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Provides configuration for individual workloads. See more details at: https://istio.io/docs/reference/config/networking/proxy-config.html' - properties: - concurrency: - description: The number of worker threads to run. - format: int32 - minimum: 0 - nullable: true - type: integer - environmentVariables: - additionalProperties: - maxLength: 2048 + - name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Provides configuration for individual workloads. See more + details at: https://istio.io/docs/reference/config/networking/proxy-config.html' + properties: + concurrency: + description: The number of worker threads to run. + format: int32 + minimum: 0 + nullable: true + type: integer + environmentVariables: + additionalProperties: + maxLength: 2048 + type: string + description: Additional environment variables for the proxy. + type: object + image: + description: Specifies the details of the proxy image. + properties: + imageType: + description: The image type of the image. type: string - description: Additional environment variables for the proxy. - type: object - image: - description: Specifies the details of the proxy image. + type: object + selector: + description: Optional. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: properties: - imageType: - description: The image type of the image. + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. type: string type: object - selector: - description: Optional. + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied. - maxProperties: 4096 + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) type: object - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -7663,146 +8632,191 @@ spec: group: security.istio.io names: categories: - - istio-io - - security-istio-io + - istio-io + - security-istio-io kind: RequestAuthentication listKind: RequestAuthenticationList plural: requestauthentications shortNames: - - ra + - ra singular: requestauthentication scope: Namespaced versions: - - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Request authentication configuration for workloads. See more details at: https://istio.io/docs/reference/config/security/request_authentication.html' - properties: - jwtRules: - description: Define the list of JWTs that can be validated at the selected workloads' proxy. - items: - properties: - audiences: - description: The list of JWT [audiences](https://tools.ietf.org/html/rfc7519#section-4.1.3) that are allowed to access. - items: - minLength: 1 - type: string - type: array - forwardOriginalToken: - description: If set to true, the original token will be kept for the upstream request. - type: boolean - fromCookies: - description: List of cookie names from which JWT is expected. - items: - minLength: 1 - type: string - type: array - fromHeaders: - description: List of header locations from which JWT is expected. - items: - properties: - name: - description: The HTTP header name. - minLength: 1 - type: string - prefix: - description: The prefix that should be stripped before decoding the token. - type: string - required: - - name - type: object - type: array - fromParams: - description: List of query parameters from which JWT is expected. - items: - minLength: 1 - type: string - type: array - issuer: - description: Identifies the issuer that issued the JWT. + - name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Request authentication configuration for workloads. See + more details at: https://istio.io/docs/reference/config/security/request_authentication.html' + properties: + jwtRules: + description: Define the list of JWTs that can be validated at the + selected workloads' proxy. + items: + properties: + audiences: + description: The list of JWT [audiences](https://tools.ietf.org/html/rfc7519#section-4.1.3) + that are allowed to access. + items: minLength: 1 type: string - jwks: - description: JSON Web Key Set of public keys to validate signature of the JWT. + type: array + forwardOriginalToken: + description: If set to true, the original token will be kept + for the upstream request. + type: boolean + fromCookies: + description: List of cookie names from which JWT is expected. + items: + minLength: 1 type: string - jwks_uri: - description: URL of the provider's public key set to validate signature of the JWT. - maxLength: 2048 + type: array + fromHeaders: + description: List of header locations from which JWT is expected. + items: + properties: + name: + description: The HTTP header name. + minLength: 1 + type: string + prefix: + description: The prefix that should be stripped before + decoding the token. + type: string + required: + - name + type: object + type: array + fromParams: + description: List of query parameters from which JWT is expected. + items: minLength: 1 type: string - x-kubernetes-validations: - - message: url must have scheme http:// or https:// - rule: url(self).getScheme() in ["http", "https"] - jwksUri: - description: URL of the provider's public key set to validate signature of the JWT. - maxLength: 2048 + type: array + issuer: + description: Identifies the issuer that issued the JWT. + minLength: 1 + type: string + jwks: + description: JSON Web Key Set of public keys to validate signature + of the JWT. + type: string + jwks_uri: + description: URL of the provider's public key set to validate + signature of the JWT. + maxLength: 2048 + minLength: 1 + type: string + x-kubernetes-validations: + - message: url must have scheme http:// or https:// + rule: url(self).getScheme() in ["http", "https"] + jwksUri: + description: URL of the provider's public key set to validate + signature of the JWT. + maxLength: 2048 + minLength: 1 + type: string + x-kubernetes-validations: + - message: url must have scheme http:// or https:// + rule: url(self).getScheme() in ["http", "https"] + outputClaimToHeaders: + description: This field specifies a list of operations to copy + the claim to HTTP headers on a successfully verified token. + items: + properties: + claim: + description: The name of the claim to be copied from. + minLength: 1 + type: string + header: + description: The name of the header to be created. + minLength: 1 + pattern: ^[-_A-Za-z0-9]+$ + type: string + required: + - header + - claim + type: object + type: array + outputPayloadToHeader: + description: This field specifies the header name to output + a successfully verified JWT payload to the backend. + type: string + spaceDelimitedClaims: + description: List of JWT claim names that should be treated + as space-delimited strings. + items: minLength: 1 type: string - x-kubernetes-validations: - - message: url must have scheme http:// or https:// - rule: url(self).getScheme() in ["http", "https"] - outputClaimToHeaders: - description: This field specifies a list of operations to copy the claim to HTTP headers on a successfully verified token. - items: - properties: - claim: - description: The name of the claim to be copied from. - minLength: 1 - type: string - header: - description: The name of the header to be created. - minLength: 1 - pattern: ^[-_A-Za-z0-9]+$ - type: string - required: - - header - - claim - type: object - type: array - outputPayloadToHeader: - description: This field specifies the header name to output a successfully verified JWT payload to the backend. - type: string - spaceDelimitedClaims: - description: List of JWT claim names that should be treated as space-delimited strings. - items: - minLength: 1 - type: string - maxItems: 64 - type: array - timeout: - description: The maximum amount of time that the resolver, determined by the PILOT_JWT_ENABLE_REMOTE_JWKS environment variable, will spend waiting for the JWKS to be fetched. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - x-kubernetes-validations: - - message: only one of jwks or jwksUri can be set - rule: '(has(self.jwksUri) ? 1 : 0) + (has(self.jwks_uri) ? 1 : 0) + (has(self.jwks) ? 1 : 0) <= 1' - maxItems: 4096 - type: array - selector: - description: Optional. - properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied. - maxProperties: 4096 - type: object + maxItems: 64 + type: array + timeout: + description: The maximum amount of time that the resolver, determined + by the PILOT_JWT_ENABLE_REMOTE_JWKS environment variable, + will spend waiting for the JWKS to be fetched. + type: string x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') type: object - targetRef: + x-kubernetes-validations: + - message: only one of jwks or jwksUri can be set + rule: '(has(self.jwksUri) ? 1 : 0) + (has(self.jwks_uri) ? 1 : + 0) + (has(self.jwks) ? 1 : 0) <= 1' + maxItems: 4096 + type: array + selector: + description: Optional. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + targetRef: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name + type: object + targetRefs: + description: Optional. + items: properties: group: description: group is the group of the target resource. @@ -7824,253 +8838,274 @@ spec: description: namespace is the namespace of the referent. type: string x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 required: - - kind - - name + - kind + - name type: object - targetRefs: - description: Optional. - items: - properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 + maxItems: 16 + type: array + type: object + x-kubernetes-validations: + - message: only one of targetRefs or selector can be set + rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + + (has(self.targetRefs) ? 1 : 0) <= 1' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} + - name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Request authentication configuration for workloads. See + more details at: https://istio.io/docs/reference/config/security/request_authentication.html' + properties: + jwtRules: + description: Define the list of JWTs that can be validated at the + selected workloads' proxy. + items: + properties: + audiences: + description: The list of JWT [audiences](https://tools.ietf.org/html/rfc7519#section-4.1.3) + that are allowed to access. + items: minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string - name: - description: name is the name of the target resource. - maxLength: 253 + type: array + forwardOriginalToken: + description: If set to true, the original token will be kept + for the upstream request. + type: boolean + fromCookies: + description: List of cookie names from which JWT is expected. + items: minLength: 1 type: string - namespace: - description: namespace is the namespace of the referent. - type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 - required: - - kind - - name - type: object - maxItems: 16 - type: array - type: object - x-kubernetes-validations: - - message: only one of targetRefs or selector can be set - rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + (has(self.targetRefs) ? 1 : 0) <= 1' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. - - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: + type: array + fromHeaders: + description: List of header locations from which JWT is expected. + items: properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. - type: string name: - description: A human-readable name for the message type. + description: The HTTP header name. + minLength: 1 + type: string + prefix: + description: The prefix that should be stripped before + decoding the token. type: string + required: + - name type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} - - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Request authentication configuration for workloads. See more details at: https://istio.io/docs/reference/config/security/request_authentication.html' - properties: - jwtRules: - description: Define the list of JWTs that can be validated at the selected workloads' proxy. - items: - properties: - audiences: - description: The list of JWT [audiences](https://tools.ietf.org/html/rfc7519#section-4.1.3) that are allowed to access. - items: - minLength: 1 - type: string - type: array - forwardOriginalToken: - description: If set to true, the original token will be kept for the upstream request. - type: boolean - fromCookies: - description: List of cookie names from which JWT is expected. - items: - minLength: 1 - type: string - type: array - fromHeaders: - description: List of header locations from which JWT is expected. - items: - properties: - name: - description: The HTTP header name. - minLength: 1 - type: string - prefix: - description: The prefix that should be stripped before decoding the token. - type: string - required: - - name - type: object - type: array - fromParams: - description: List of query parameters from which JWT is expected. - items: - minLength: 1 - type: string - type: array - issuer: - description: Identifies the issuer that issued the JWT. - minLength: 1 - type: string - jwks: - description: JSON Web Key Set of public keys to validate signature of the JWT. - type: string - jwks_uri: - description: URL of the provider's public key set to validate signature of the JWT. - maxLength: 2048 + type: array + fromParams: + description: List of query parameters from which JWT is expected. + items: minLength: 1 type: string - x-kubernetes-validations: - - message: url must have scheme http:// or https:// - rule: url(self).getScheme() in ["http", "https"] - jwksUri: - description: URL of the provider's public key set to validate signature of the JWT. - maxLength: 2048 + type: array + issuer: + description: Identifies the issuer that issued the JWT. + minLength: 1 + type: string + jwks: + description: JSON Web Key Set of public keys to validate signature + of the JWT. + type: string + jwks_uri: + description: URL of the provider's public key set to validate + signature of the JWT. + maxLength: 2048 + minLength: 1 + type: string + x-kubernetes-validations: + - message: url must have scheme http:// or https:// + rule: url(self).getScheme() in ["http", "https"] + jwksUri: + description: URL of the provider's public key set to validate + signature of the JWT. + maxLength: 2048 + minLength: 1 + type: string + x-kubernetes-validations: + - message: url must have scheme http:// or https:// + rule: url(self).getScheme() in ["http", "https"] + outputClaimToHeaders: + description: This field specifies a list of operations to copy + the claim to HTTP headers on a successfully verified token. + items: + properties: + claim: + description: The name of the claim to be copied from. + minLength: 1 + type: string + header: + description: The name of the header to be created. + minLength: 1 + pattern: ^[-_A-Za-z0-9]+$ + type: string + required: + - header + - claim + type: object + type: array + outputPayloadToHeader: + description: This field specifies the header name to output + a successfully verified JWT payload to the backend. + type: string + spaceDelimitedClaims: + description: List of JWT claim names that should be treated + as space-delimited strings. + items: minLength: 1 type: string - x-kubernetes-validations: - - message: url must have scheme http:// or https:// - rule: url(self).getScheme() in ["http", "https"] - outputClaimToHeaders: - description: This field specifies a list of operations to copy the claim to HTTP headers on a successfully verified token. - items: - properties: - claim: - description: The name of the claim to be copied from. - minLength: 1 - type: string - header: - description: The name of the header to be created. - minLength: 1 - pattern: ^[-_A-Za-z0-9]+$ - type: string - required: - - header - - claim - type: object - type: array - outputPayloadToHeader: - description: This field specifies the header name to output a successfully verified JWT payload to the backend. - type: string - spaceDelimitedClaims: - description: List of JWT claim names that should be treated as space-delimited strings. - items: - minLength: 1 - type: string - maxItems: 64 - type: array - timeout: - description: The maximum amount of time that the resolver, determined by the PILOT_JWT_ENABLE_REMOTE_JWKS environment variable, will spend waiting for the JWKS to be fetched. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - x-kubernetes-validations: - - message: only one of jwks or jwksUri can be set - rule: '(has(self.jwksUri) ? 1 : 0) + (has(self.jwks_uri) ? 1 : 0) + (has(self.jwks) ? 1 : 0) <= 1' - maxItems: 4096 - type: array - selector: - description: Optional. - properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied. - maxProperties: 4096 - type: object + maxItems: 64 + type: array + timeout: + description: The maximum amount of time that the resolver, determined + by the PILOT_JWT_ENABLE_REMOTE_JWKS environment variable, + will spend waiting for the JWKS to be fetched. + type: string x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') type: object - targetRef: + x-kubernetes-validations: + - message: only one of jwks or jwksUri can be set + rule: '(has(self.jwksUri) ? 1 : 0) + (has(self.jwks_uri) ? 1 : + 0) + (has(self.jwks) ? 1 : 0) <= 1' + maxItems: 4096 + type: array + selector: + description: Optional. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + targetRef: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name + type: object + targetRefs: + description: Optional. + items: properties: group: description: group is the group of the target resource. @@ -8092,123 +9127,100 @@ spec: description: namespace is the namespace of the referent. type: string x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 required: - - kind - - name + - kind + - name type: object - targetRefs: - description: Optional. - items: - properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: name is the name of the target resource. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: namespace is the namespace of the referent. - type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 - required: - - kind - - name - type: object - maxItems: 16 - type: array - type: object - x-kubernetes-validations: - - message: only one of targetRefs or selector can be set - rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + (has(self.targetRefs) ? 1 : 0) <= 1' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. + maxItems: 16 + type: array + type: object + x-kubernetes-validations: + - message: only one of targetRefs or selector can be set + rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + + (has(self.targetRefs) ? 1 : 0) <= 1' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -8226,835 +9238,914 @@ spec: group: networking.istio.io names: categories: - - istio-io - - networking-istio-io + - istio-io + - networking-istio-io kind: ServiceEntry listKind: ServiceEntryList plural: serviceentries shortNames: - - se + - se singular: serviceentry scope: Namespaced versions: - - additionalPrinterColumns: - - description: The hosts associated with the ServiceEntry - jsonPath: .spec.hosts - name: Hosts - type: string - - description: Whether the service is external to the mesh or part of the mesh (MESH_EXTERNAL or MESH_INTERNAL) - jsonPath: .spec.location - name: Location - type: string - - description: Service resolution mode for the hosts (NONE, STATIC, or DNS) - jsonPath: .spec.resolution - name: Resolution - type: string - - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting service registry. See more details at: https://istio.io/docs/reference/config/networking/service-entry.html' - properties: - addresses: - description: The virtual IP addresses associated with the service. - items: - maxLength: 64 - type: string - maxItems: 256 - type: array - endpoints: - description: One or more endpoints associated with the service. - items: - properties: - address: - description: Address associated with the network endpoint without the port. - maxLength: 256 - type: string - x-kubernetes-validations: - - message: UDS must be an absolute path or abstract socket - rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" || self.substring(7, 8) == "@") : true' - - message: UDS may not be a dir - rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' - labels: - additionalProperties: - type: string - description: One or more labels associated with the endpoint. - maxProperties: 256 - type: object - locality: - description: The locality associated with the endpoint. - maxLength: 2048 - type: string - network: - description: Network enables Istio to group endpoints resident in the same L3 domain/network. - maxLength: 2048 - type: string - ports: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - description: Set of ports associated with the endpoint. - maxProperties: 128 - type: object - x-kubernetes-validations: - - message: port name must be valid - rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) - serviceAccount: - description: The service account associated with the workload if a sidecar is present in the workload. - maxLength: 253 - type: string - weight: - description: The load balancing weight associated with the endpoint. - maximum: 4294967295 - minimum: 0 - type: integer - type: object - x-kubernetes-validations: - - message: Address is required - rule: has(self.address) || has(self.network) - - message: UDS may not include ports - rule: '(has(self.address) ? self.address : "").startsWith("unix://") ? !has(self.ports) : true' - maxItems: 4096 - type: array - exportTo: - description: A list of namespaces to which this service is exported. - items: - type: string - type: array - hosts: - description: The hosts associated with the ServiceEntry. - items: - type: string - x-kubernetes-validations: - - message: hostname cannot be wildcard - rule: self != "*" - maxItems: 256 - minItems: 1 - type: array - location: - description: |- - Specify whether the service should be considered external to the mesh or part of the mesh. - - Valid Options: MESH_EXTERNAL, MESH_INTERNAL - enum: - - MESH_EXTERNAL - - MESH_INTERNAL + - additionalPrinterColumns: + - description: The hosts associated with the ServiceEntry + jsonPath: .spec.hosts + name: Hosts + type: string + - description: Whether the service is external to the mesh or part of the mesh + (MESH_EXTERNAL or MESH_INTERNAL) + jsonPath: .spec.location + name: Location + type: string + - description: Service resolution mode for the hosts (NONE, STATIC, or DNS) + jsonPath: .spec.resolution + name: Resolution + type: string + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting service registry. See more details + at: https://istio.io/docs/reference/config/networking/service-entry.html' + properties: + addresses: + description: The virtual IP addresses associated with the service. + items: + maxLength: 64 type: string - ports: - description: The ports associated with the external service. - items: - properties: - name: - description: Label assigned to the port. - maxLength: 256 - type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - protocol: - description: The protocol exposed on the port. - maxLength: 256 + maxItems: 256 + type: array + endpoints: + description: One or more endpoints associated with the service. + items: + properties: + address: + description: Address associated with the network endpoint without + the port. + maxLength: 256 + type: string + x-kubernetes-validations: + - message: UDS must be an absolute path or abstract socket + rule: 'self.startsWith("unix://") ? (self.substring(7, 8) + == "/" || self.substring(7, 8) == "@") : true' + - message: UDS may not be a dir + rule: 'self.startsWith("unix://") ? !self.endsWith("/") : + true' + labels: + additionalProperties: type: string - targetPort: - description: The port number on the endpoint where the traffic will be received. + description: One or more labels associated with the endpoint. + maxProperties: 256 + type: object + locality: + description: The locality associated with the endpoint. + maxLength: 2048 + type: string + network: + description: Network enables Istio to group endpoints resident + in the same L3 domain/network. + maxLength: 2048 + type: string + ports: + additionalProperties: maximum: 4294967295 minimum: 0 type: integer x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - required: - - number - - name - type: object - maxItems: 256 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + description: Set of ports associated with the endpoint. + maxProperties: 128 + type: object + x-kubernetes-validations: + - message: port name must be valid + rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) + serviceAccount: + description: The service account associated with the workload + if a sidecar is present in the workload. + maxLength: 253 + type: string + weight: + description: The load balancing weight associated with the endpoint. + maximum: 4294967295 + minimum: 0 + type: integer + type: object + x-kubernetes-validations: + - message: Address is required + rule: has(self.address) || has(self.network) + - message: UDS may not include ports + rule: '(has(self.address) ? self.address : "").startsWith("unix://") + ? !has(self.ports) : true' + maxItems: 4096 + type: array + exportTo: + description: A list of namespaces to which this service is exported. + items: + type: string + type: array + hosts: + description: The hosts associated with the ServiceEntry. + items: + type: string x-kubernetes-validations: - - message: port number cannot be duplicated - rule: self.all(l1, self.exists_one(l2, l1.number == l2.number)) - resolution: - description: |- - Service resolution mode for the hosts. + - message: hostname cannot be wildcard + rule: self != "*" + maxItems: 256 + minItems: 1 + type: array + location: + description: |- + Specify whether the service should be considered external to the mesh or part of the mesh. + + Valid Options: MESH_EXTERNAL, MESH_INTERNAL + enum: + - MESH_EXTERNAL + - MESH_INTERNAL + type: string + ports: + description: The ports associated with the external service. + items: + properties: + name: + description: Label assigned to the port. + maxLength: 256 + type: string + number: + description: A valid non-negative integer port number. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + protocol: + description: The protocol exposed on the port. + maxLength: 256 + type: string + targetPort: + description: The port number on the endpoint where the traffic + will be received. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + required: + - number + - name + type: object + maxItems: 256 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + x-kubernetes-validations: + - message: port number cannot be duplicated + rule: self.all(l1, self.exists_one(l2, l1.number == l2.number)) + resolution: + description: |- + Service resolution mode for the hosts. - Valid Options: NONE, STATIC, DNS, DNS_ROUND_ROBIN, DYNAMIC_DNS - enum: - - NONE - - STATIC - - DNS - - DNS_ROUND_ROBIN - - DYNAMIC_DNS + Valid Options: NONE, STATIC, DNS, DNS_ROUND_ROBIN, DYNAMIC_DNS + enum: + - NONE + - STATIC + - DNS + - DNS_ROUND_ROBIN + - DYNAMIC_DNS + type: string + subjectAltNames: + description: If specified, the proxy will verify that the server certificate's + subject alternate name matches one of the specified values. + items: type: string - subjectAltNames: - description: If specified, the proxy will verify that the server certificate's subject alternate name matches one of the specified values. - items: - type: string - type: array - workloadSelector: - description: Applicable only for MESH_INTERNAL services. + type: array + workloadSelector: + description: Applicable only for MESH_INTERNAL services. + properties: + labels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard is not supported in selector + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which the configuration should be applied. + maxProperties: 256 + type: object + type: object + required: + - hosts + type: object + x-kubernetes-validations: + - message: only one of WorkloadSelector or Endpoints can be set + rule: '(has(self.workloadSelector) ? 1 : 0) + (has(self.endpoints) ? + 1 : 0) <= 1' + - message: CIDR addresses are allowed only for NONE/STATIC resolution + types + rule: '!((has(self.addresses) ? self.addresses : []).exists(k, k.contains("/")) + && !((has(self.resolution) ? self.resolution : "NONE") in ["STATIC", + "NONE"]))' + - message: NONE mode cannot set endpoints + rule: '((has(self.resolution) ? self.resolution : "NONE") == "NONE") + ? !has(self.endpoints) : true' + - message: DNS_ROUND_ROBIN mode cannot have multiple endpoints + rule: '((has(self.resolution) ? self.resolution : "") == "DNS_ROUND_ROBIN") + ? ((has(self.endpoints) ? self.endpoints : []).size() <= 1) : true' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - description: The hosts associated with the ServiceEntry + jsonPath: .spec.hosts + name: Hosts + type: string + - description: Whether the service is external to the mesh or part of the mesh + (MESH_EXTERNAL or MESH_INTERNAL) + jsonPath: .spec.location + name: Location + type: string + - description: Service resolution mode for the hosts (NONE, STATIC, or DNS) + jsonPath: .spec.resolution + name: Resolution + type: string + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha3 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting service registry. See more details + at: https://istio.io/docs/reference/config/networking/service-entry.html' + properties: + addresses: + description: The virtual IP addresses associated with the service. + items: + maxLength: 64 + type: string + maxItems: 256 + type: array + endpoints: + description: One or more endpoints associated with the service. + items: properties: + address: + description: Address associated with the network endpoint without + the port. + maxLength: 256 + type: string + x-kubernetes-validations: + - message: UDS must be an absolute path or abstract socket + rule: 'self.startsWith("unix://") ? (self.substring(7, 8) + == "/" || self.substring(7, 8) == "@") : true' + - message: UDS may not be a dir + rule: 'self.startsWith("unix://") ? !self.endsWith("/") : + true' labels: additionalProperties: - maxLength: 63 type: string - x-kubernetes-validations: - - message: wildcard is not supported in selector - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of pods/VMs on which the configuration should be applied. + description: One or more labels associated with the endpoint. maxProperties: 256 type: object - type: object - required: - - hosts - type: object - x-kubernetes-validations: - - message: only one of WorkloadSelector or Endpoints can be set - rule: '(has(self.workloadSelector) ? 1 : 0) + (has(self.endpoints) ? 1 : 0) <= 1' - - message: CIDR addresses are allowed only for NONE/STATIC resolution types - rule: '!((has(self.addresses) ? self.addresses : []).exists(k, k.contains("/")) && !((has(self.resolution) ? self.resolution : "NONE") in ["STATIC", "NONE"]))' - - message: NONE mode cannot set endpoints - rule: '((has(self.resolution) ? self.resolution : "NONE") == "NONE") ? !has(self.endpoints) : true' - - message: DNS_ROUND_ROBIN mode cannot have multiple endpoints - rule: '((has(self.resolution) ? self.resolution : "") == "DNS_ROUND_ROBIN") ? ((has(self.endpoints) ? self.endpoints : []).size() <= 1) : true' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. - - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} - - additionalPrinterColumns: - - description: The hosts associated with the ServiceEntry - jsonPath: .spec.hosts - name: Hosts - type: string - - description: Whether the service is external to the mesh or part of the mesh (MESH_EXTERNAL or MESH_INTERNAL) - jsonPath: .spec.location - name: Location - type: string - - description: Service resolution mode for the hosts (NONE, STATIC, or DNS) - jsonPath: .spec.resolution - name: Resolution - type: string - - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1alpha3 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting service registry. See more details at: https://istio.io/docs/reference/config/networking/service-entry.html' - properties: - addresses: - description: The virtual IP addresses associated with the service. - items: - maxLength: 64 - type: string - maxItems: 256 - type: array - endpoints: - description: One or more endpoints associated with the service. - items: - properties: - address: - description: Address associated with the network endpoint without the port. - maxLength: 256 - type: string - x-kubernetes-validations: - - message: UDS must be an absolute path or abstract socket - rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" || self.substring(7, 8) == "@") : true' - - message: UDS may not be a dir - rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' - labels: - additionalProperties: - type: string - description: One or more labels associated with the endpoint. - maxProperties: 256 - type: object - locality: - description: The locality associated with the endpoint. - maxLength: 2048 - type: string - network: - description: Network enables Istio to group endpoints resident in the same L3 domain/network. - maxLength: 2048 - type: string - ports: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - description: Set of ports associated with the endpoint. - maxProperties: 128 - type: object - x-kubernetes-validations: - - message: port name must be valid - rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) - serviceAccount: - description: The service account associated with the workload if a sidecar is present in the workload. - maxLength: 253 - type: string - weight: - description: The load balancing weight associated with the endpoint. + locality: + description: The locality associated with the endpoint. + maxLength: 2048 + type: string + network: + description: Network enables Istio to group endpoints resident + in the same L3 domain/network. + maxLength: 2048 + type: string + ports: + additionalProperties: maximum: 4294967295 minimum: 0 type: integer - type: object - x-kubernetes-validations: - - message: Address is required - rule: has(self.address) || has(self.network) - - message: UDS may not include ports - rule: '(has(self.address) ? self.address : "").startsWith("unix://") ? !has(self.ports) : true' - maxItems: 4096 - type: array - exportTo: - description: A list of namespaces to which this service is exported. - items: - type: string - type: array - hosts: - description: The hosts associated with the ServiceEntry. - items: - type: string - x-kubernetes-validations: - - message: hostname cannot be wildcard - rule: self != "*" - maxItems: 256 - minItems: 1 - type: array - location: - description: |- - Specify whether the service should be considered external to the mesh or part of the mesh. + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + description: Set of ports associated with the endpoint. + maxProperties: 128 + type: object + x-kubernetes-validations: + - message: port name must be valid + rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) + serviceAccount: + description: The service account associated with the workload + if a sidecar is present in the workload. + maxLength: 253 + type: string + weight: + description: The load balancing weight associated with the endpoint. + maximum: 4294967295 + minimum: 0 + type: integer + type: object + x-kubernetes-validations: + - message: Address is required + rule: has(self.address) || has(self.network) + - message: UDS may not include ports + rule: '(has(self.address) ? self.address : "").startsWith("unix://") + ? !has(self.ports) : true' + maxItems: 4096 + type: array + exportTo: + description: A list of namespaces to which this service is exported. + items: + type: string + type: array + hosts: + description: The hosts associated with the ServiceEntry. + items: + type: string + x-kubernetes-validations: + - message: hostname cannot be wildcard + rule: self != "*" + maxItems: 256 + minItems: 1 + type: array + location: + description: |- + Specify whether the service should be considered external to the mesh or part of the mesh. + + Valid Options: MESH_EXTERNAL, MESH_INTERNAL + enum: + - MESH_EXTERNAL + - MESH_INTERNAL + type: string + ports: + description: The ports associated with the external service. + items: + properties: + name: + description: Label assigned to the port. + maxLength: 256 + type: string + number: + description: A valid non-negative integer port number. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + protocol: + description: The protocol exposed on the port. + maxLength: 256 + type: string + targetPort: + description: The port number on the endpoint where the traffic + will be received. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + required: + - number + - name + type: object + maxItems: 256 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + x-kubernetes-validations: + - message: port number cannot be duplicated + rule: self.all(l1, self.exists_one(l2, l1.number == l2.number)) + resolution: + description: |- + Service resolution mode for the hosts. - Valid Options: MESH_EXTERNAL, MESH_INTERNAL - enum: - - MESH_EXTERNAL - - MESH_INTERNAL + Valid Options: NONE, STATIC, DNS, DNS_ROUND_ROBIN, DYNAMIC_DNS + enum: + - NONE + - STATIC + - DNS + - DNS_ROUND_ROBIN + - DYNAMIC_DNS + type: string + subjectAltNames: + description: If specified, the proxy will verify that the server certificate's + subject alternate name matches one of the specified values. + items: type: string - ports: - description: The ports associated with the external service. - items: - properties: - name: - description: Label assigned to the port. - maxLength: 256 - type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - protocol: - description: The protocol exposed on the port. - maxLength: 256 - type: string - targetPort: - description: The port number on the endpoint where the traffic will be received. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - required: - - number - - name + type: array + workloadSelector: + description: Applicable only for MESH_INTERNAL services. + properties: + labels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard is not supported in selector + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which the configuration should be applied. + maxProperties: 256 type: object - maxItems: 256 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map - x-kubernetes-validations: - - message: port number cannot be duplicated - rule: self.all(l1, self.exists_one(l2, l1.number == l2.number)) - resolution: - description: |- - Service resolution mode for the hosts. + type: object + required: + - hosts + type: object + x-kubernetes-validations: + - message: only one of WorkloadSelector or Endpoints can be set + rule: '(has(self.workloadSelector) ? 1 : 0) + (has(self.endpoints) ? + 1 : 0) <= 1' + - message: CIDR addresses are allowed only for NONE/STATIC resolution + types + rule: '!((has(self.addresses) ? self.addresses : []).exists(k, k.contains("/")) + && !((has(self.resolution) ? self.resolution : "NONE") in ["STATIC", + "NONE"]))' + - message: NONE mode cannot set endpoints + rule: '((has(self.resolution) ? self.resolution : "NONE") == "NONE") + ? !has(self.endpoints) : true' + - message: DNS_ROUND_ROBIN mode cannot have multiple endpoints + rule: '((has(self.resolution) ? self.resolution : "") == "DNS_ROUND_ROBIN") + ? ((has(self.endpoints) ? self.endpoints : []).size() <= 1) : true' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. - Valid Options: NONE, STATIC, DNS, DNS_ROUND_ROBIN, DYNAMIC_DNS - enum: - - NONE - - STATIC - - DNS - - DNS_ROUND_ROBIN - - DYNAMIC_DNS + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - description: The hosts associated with the ServiceEntry + jsonPath: .spec.hosts + name: Hosts + type: string + - description: Whether the service is external to the mesh or part of the mesh + (MESH_EXTERNAL or MESH_INTERNAL) + jsonPath: .spec.location + name: Location + type: string + - description: Service resolution mode for the hosts (NONE, STATIC, or DNS) + jsonPath: .spec.resolution + name: Resolution + type: string + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting service registry. See more details + at: https://istio.io/docs/reference/config/networking/service-entry.html' + properties: + addresses: + description: The virtual IP addresses associated with the service. + items: + maxLength: 64 type: string - subjectAltNames: - description: If specified, the proxy will verify that the server certificate's subject alternate name matches one of the specified values. - items: - type: string - type: array - workloadSelector: - description: Applicable only for MESH_INTERNAL services. + maxItems: 256 + type: array + endpoints: + description: One or more endpoints associated with the service. + items: properties: + address: + description: Address associated with the network endpoint without + the port. + maxLength: 256 + type: string + x-kubernetes-validations: + - message: UDS must be an absolute path or abstract socket + rule: 'self.startsWith("unix://") ? (self.substring(7, 8) + == "/" || self.substring(7, 8) == "@") : true' + - message: UDS may not be a dir + rule: 'self.startsWith("unix://") ? !self.endsWith("/") : + true' labels: additionalProperties: - maxLength: 63 type: string - x-kubernetes-validations: - - message: wildcard is not supported in selector - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of pods/VMs on which the configuration should be applied. + description: One or more labels associated with the endpoint. maxProperties: 256 type: object - type: object - required: - - hosts - type: object - x-kubernetes-validations: - - message: only one of WorkloadSelector or Endpoints can be set - rule: '(has(self.workloadSelector) ? 1 : 0) + (has(self.endpoints) ? 1 : 0) <= 1' - - message: CIDR addresses are allowed only for NONE/STATIC resolution types - rule: '!((has(self.addresses) ? self.addresses : []).exists(k, k.contains("/")) && !((has(self.resolution) ? self.resolution : "NONE") in ["STATIC", "NONE"]))' - - message: NONE mode cannot set endpoints - rule: '((has(self.resolution) ? self.resolution : "NONE") == "NONE") ? !has(self.endpoints) : true' - - message: DNS_ROUND_ROBIN mode cannot have multiple endpoints - rule: '((has(self.resolution) ? self.resolution : "") == "DNS_ROUND_ROBIN") ? ((has(self.endpoints) ? self.endpoints : []).size() <= 1) : true' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. - - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: false - subresources: - status: {} - - additionalPrinterColumns: - - description: The hosts associated with the ServiceEntry - jsonPath: .spec.hosts - name: Hosts - type: string - - description: Whether the service is external to the mesh or part of the mesh (MESH_EXTERNAL or MESH_INTERNAL) - jsonPath: .spec.location - name: Location - type: string - - description: Service resolution mode for the hosts (NONE, STATIC, or DNS) - jsonPath: .spec.resolution - name: Resolution - type: string - - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting service registry. See more details at: https://istio.io/docs/reference/config/networking/service-entry.html' - properties: - addresses: - description: The virtual IP addresses associated with the service. - items: - maxLength: 64 - type: string - maxItems: 256 - type: array - endpoints: - description: One or more endpoints associated with the service. - items: - properties: - address: - description: Address associated with the network endpoint without the port. - maxLength: 256 - type: string - x-kubernetes-validations: - - message: UDS must be an absolute path or abstract socket - rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" || self.substring(7, 8) == "@") : true' - - message: UDS may not be a dir - rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' - labels: - additionalProperties: - type: string - description: One or more labels associated with the endpoint. - maxProperties: 256 - type: object - locality: - description: The locality associated with the endpoint. - maxLength: 2048 - type: string - network: - description: Network enables Istio to group endpoints resident in the same L3 domain/network. - maxLength: 2048 - type: string - ports: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - description: Set of ports associated with the endpoint. - maxProperties: 128 - type: object - x-kubernetes-validations: - - message: port name must be valid - rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) - serviceAccount: - description: The service account associated with the workload if a sidecar is present in the workload. - maxLength: 253 - type: string - weight: - description: The load balancing weight associated with the endpoint. - maximum: 4294967295 - minimum: 0 - type: integer - type: object - x-kubernetes-validations: - - message: Address is required - rule: has(self.address) || has(self.network) - - message: UDS may not include ports - rule: '(has(self.address) ? self.address : "").startsWith("unix://") ? !has(self.ports) : true' - maxItems: 4096 - type: array - exportTo: - description: A list of namespaces to which this service is exported. - items: - type: string - type: array - hosts: - description: The hosts associated with the ServiceEntry. - items: - type: string - x-kubernetes-validations: - - message: hostname cannot be wildcard - rule: self != "*" - maxItems: 256 - minItems: 1 - type: array - location: - description: |- - Specify whether the service should be considered external to the mesh or part of the mesh. - - Valid Options: MESH_EXTERNAL, MESH_INTERNAL - enum: - - MESH_EXTERNAL - - MESH_INTERNAL - type: string - ports: - description: The ports associated with the external service. - items: - properties: - name: - description: Label assigned to the port. - maxLength: 256 - type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - protocol: - description: The protocol exposed on the port. - maxLength: 256 - type: string - targetPort: - description: The port number on the endpoint where the traffic will be received. + locality: + description: The locality associated with the endpoint. + maxLength: 2048 + type: string + network: + description: Network enables Istio to group endpoints resident + in the same L3 domain/network. + maxLength: 2048 + type: string + ports: + additionalProperties: maximum: 4294967295 minimum: 0 type: integer x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - required: - - number - - name - type: object - maxItems: 256 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + description: Set of ports associated with the endpoint. + maxProperties: 128 + type: object + x-kubernetes-validations: + - message: port name must be valid + rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) + serviceAccount: + description: The service account associated with the workload + if a sidecar is present in the workload. + maxLength: 253 + type: string + weight: + description: The load balancing weight associated with the endpoint. + maximum: 4294967295 + minimum: 0 + type: integer + type: object + x-kubernetes-validations: + - message: Address is required + rule: has(self.address) || has(self.network) + - message: UDS may not include ports + rule: '(has(self.address) ? self.address : "").startsWith("unix://") + ? !has(self.ports) : true' + maxItems: 4096 + type: array + exportTo: + description: A list of namespaces to which this service is exported. + items: + type: string + type: array + hosts: + description: The hosts associated with the ServiceEntry. + items: + type: string x-kubernetes-validations: - - message: port number cannot be duplicated - rule: self.all(l1, self.exists_one(l2, l1.number == l2.number)) - resolution: - description: |- - Service resolution mode for the hosts. + - message: hostname cannot be wildcard + rule: self != "*" + maxItems: 256 + minItems: 1 + type: array + location: + description: |- + Specify whether the service should be considered external to the mesh or part of the mesh. + + Valid Options: MESH_EXTERNAL, MESH_INTERNAL + enum: + - MESH_EXTERNAL + - MESH_INTERNAL + type: string + ports: + description: The ports associated with the external service. + items: + properties: + name: + description: Label assigned to the port. + maxLength: 256 + type: string + number: + description: A valid non-negative integer port number. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + protocol: + description: The protocol exposed on the port. + maxLength: 256 + type: string + targetPort: + description: The port number on the endpoint where the traffic + will be received. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + required: + - number + - name + type: object + maxItems: 256 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + x-kubernetes-validations: + - message: port number cannot be duplicated + rule: self.all(l1, self.exists_one(l2, l1.number == l2.number)) + resolution: + description: |- + Service resolution mode for the hosts. - Valid Options: NONE, STATIC, DNS, DNS_ROUND_ROBIN, DYNAMIC_DNS - enum: - - NONE - - STATIC - - DNS - - DNS_ROUND_ROBIN - - DYNAMIC_DNS + Valid Options: NONE, STATIC, DNS, DNS_ROUND_ROBIN, DYNAMIC_DNS + enum: + - NONE + - STATIC + - DNS + - DNS_ROUND_ROBIN + - DYNAMIC_DNS + type: string + subjectAltNames: + description: If specified, the proxy will verify that the server certificate's + subject alternate name matches one of the specified values. + items: type: string - subjectAltNames: - description: If specified, the proxy will verify that the server certificate's subject alternate name matches one of the specified values. - items: - type: string - type: array - workloadSelector: - description: Applicable only for MESH_INTERNAL services. + type: array + workloadSelector: + description: Applicable only for MESH_INTERNAL services. + properties: + labels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard is not supported in selector + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which the configuration should be applied. + maxProperties: 256 + type: object + type: object + required: + - hosts + type: object + x-kubernetes-validations: + - message: only one of WorkloadSelector or Endpoints can be set + rule: '(has(self.workloadSelector) ? 1 : 0) + (has(self.endpoints) ? + 1 : 0) <= 1' + - message: CIDR addresses are allowed only for NONE/STATIC resolution + types + rule: '!((has(self.addresses) ? self.addresses : []).exists(k, k.contains("/")) + && !((has(self.resolution) ? self.resolution : "NONE") in ["STATIC", + "NONE"]))' + - message: NONE mode cannot set endpoints + rule: '((has(self.resolution) ? self.resolution : "NONE") == "NONE") + ? !has(self.endpoints) : true' + - message: DNS_ROUND_ROBIN mode cannot have multiple endpoints + rule: '((has(self.resolution) ? self.resolution : "") == "DNS_ROUND_ROBIN") + ? ((has(self.endpoints) ? self.endpoints : []).size() <= 1) : true' + status: + properties: + conditions: + description: Current service state of the resource. + items: properties: - labels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard is not supported in selector - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of pods/VMs on which the configuration should be applied. - maxProperties: 256 + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string type: object type: object - required: - - hosts - type: object - x-kubernetes-validations: - - message: only one of WorkloadSelector or Endpoints can be set - rule: '(has(self.workloadSelector) ? 1 : 0) + (has(self.endpoints) ? 1 : 0) <= 1' - - message: CIDR addresses are allowed only for NONE/STATIC resolution types - rule: '!((has(self.addresses) ? self.addresses : []).exists(k, k.contains("/")) && !((has(self.resolution) ? self.resolution : "NONE") in ["STATIC", "NONE"]))' - - message: NONE mode cannot set endpoints - rule: '((has(self.resolution) ? self.resolution : "NONE") == "NONE") ? !has(self.endpoints) : true' - - message: DNS_ROUND_ROBIN mode cannot have multiple endpoints - rule: '((has(self.resolution) ? self.resolution : "") == "DNS_ROUND_ROBIN") ? ((has(self.endpoints) ? self.endpoints : []).size() <= 1) : true' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: false - subresources: - status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -9072,1547 +10163,1749 @@ spec: group: networking.istio.io names: categories: - - istio-io - - networking-istio-io + - istio-io + - networking-istio-io kind: Sidecar listKind: SidecarList plural: sidecars singular: sidecar scope: Namespaced versions: - - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting network reachability of a sidecar. See more details at: https://istio.io/docs/reference/config/networking/sidecar.html' - properties: - egress: - description: Egress specifies the configuration of the sidecar for processing outbound traffic from the attached workload instance to other services in the mesh. - items: - properties: - bind: - description: The IP(IPv4 or IPv6) or the Unix domain socket to which the listener should be bound to. - type: string - captureMode: - description: |- - When the bind address is an IP, the captureMode option dictates how traffic to the listener is expected to be captured (or not). - - Valid Options: DEFAULT, IPTABLES, NONE - enum: - - DEFAULT - - IPTABLES - - NONE - type: string - hosts: - description: One or more service hosts exposed by the listener in `namespace/dnsName` format. - items: - type: string - type: array - port: - description: The port associated with the listener. - properties: - name: - description: Label assigned to the port. - type: string - number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - protocol: - description: The protocol exposed on the port. - type: string - targetPort: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - required: - - hosts - type: object - type: array - inboundConnectionPool: - description: Settings controlling the volume of connections Envoy will accept from the network. + - name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting network reachability of a sidecar. + See more details at: https://istio.io/docs/reference/config/networking/sidecar.html' + properties: + egress: + description: Egress specifies the configuration of the sidecar for + processing outbound traffic from the attached workload instance + to other services in the mesh. + items: properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. + bind: + description: The IP(IPv4 or IPv6) or the Unix domain socket + to which the listener should be bound to. + type: string + captureMode: + description: |- + When the bind address is an IP, the captureMode option dictates how traffic to the listener is expected to be captured (or not). - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be preserved while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. + Valid Options: DEFAULT, IPTABLES, NONE + enum: + - DEFAULT + - IPTABLES + - NONE + type: string + hosts: + description: One or more service hosts exposed by the listener + in `namespace/dnsName` format. + items: + type: string + type: array + port: + description: The port associated with the listener. + properties: + name: + description: Label assigned to the port. type: string - maxConnectionDuration: - description: The maximum duration of a connection. + number: + description: A valid non-negative integer port number. + maximum: 4294967295 + minimum: 0 + type: integer + protocol: + description: The protocol exposed on the port. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections to a destination host. - format: int32 + targetPort: + maximum: 4294967295 + minimum: 0 type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes to send without response before deciding the connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection needs to be idle before keep-alive probes start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object type: object + required: + - hosts type: object - ingress: - description: Ingress specifies the configuration of the sidecar for processing inbound traffic to the attached workload instance. - items: + type: array + inboundConnectionPool: + description: Settings controlling the volume of connections Envoy + will accept from the network. + properties: + http: + description: HTTP connection pool settings. properties: - bind: - description: The IP(IPv4 or IPv6) to which the listener should be bound. - type: string - captureMode: + h2UpgradePolicy: description: |- - The captureMode option dictates how traffic to the listener is expected to be captured (or not). + Specify if http1.1 connection should be upgraded to http2 for the associated destination. - Valid Options: DEFAULT, IPTABLES, NONE + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE enum: - - DEFAULT - - IPTABLES - - NONE + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will be queued + while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection pool + connections. type: string - connectionPool: - description: Settings controlling the volume of connections Envoy will accept from the network. - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be preserved while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes to send without response before deciding the connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection needs to be idle before keep-alive probes start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: object - type: object - defaultEndpoint: - description: The IP endpoint or Unix domain socket to which traffic should be forwarded to. + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams allowed + for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection to + a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding + to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be preserved + while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream connections. + properties: + connectTimeout: + description: TCP connection timeout. type: string - port: - description: The port associated with the listener. + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections to a + destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket to + enable TCP Keepalives. properties: - name: - description: Label assigned to the port. + interval: + description: The time duration between keep-alive probes. type: string - number: - description: A valid non-negative integer port number. + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to send + without response before deciding the connection is dead. maximum: 4294967295 minimum: 0 type: integer - protocol: - description: The protocol exposed on the port. + time: + description: The time duration a connection needs to be + idle before keep-alive probes start being sent. type: string - targetPort: - maximum: 4294967295 - minimum: 0 - type: integer + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') type: object - tls: - description: Set of TLS related options that will enable TLS termination on the sidecar for requests originating from outside the mesh. - properties: - caCertCredentialName: - description: For mutual TLS, the name of the secret or the configmap that holds CA certificates. - type: string - caCertificates: - description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented client side certificate.' - type: string - cipherSuites: - description: 'Optional: If specified, only support the specified cipher list.' - items: - type: string - type: array - credentialName: - description: For gateways running on Kubernetes, the name of the secret that holds the TLS certs including the CA certificates. - type: string - credentialNames: - description: Same as CredentialName but for multiple certificates. - items: - type: string - maxItems: 2 - minItems: 1 - type: array - httpsRedirect: - description: If set to true, the load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS. - type: boolean - maxProtocolVersion: - description: |- - Optional: Maximum TLS protocol version. - - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - minProtocolVersion: - description: |- - Optional: Minimum TLS protocol version. + type: object + type: object + ingress: + description: Ingress specifies the configuration of the sidecar for + processing inbound traffic to the attached workload instance. + items: + properties: + bind: + description: The IP(IPv4 or IPv6) to which the listener should + be bound. + type: string + captureMode: + description: |- + The captureMode option dictates how traffic to the listener is expected to be captured (or not). - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - mode: - description: |- - Optional: Indicates whether connections to this port should be secured using TLS. + Valid Options: DEFAULT, IPTABLES, NONE + enum: + - DEFAULT + - IPTABLES + - NONE + type: string + connectionPool: + description: Settings controlling the volume of connections + Envoy will accept from the network. + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. - Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL - enum: - - PASSTHROUGH - - SIMPLE - - MUTUAL - - AUTO_PASSTHROUGH - - ISTIO_MUTUAL - - OPTIONAL_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - subjectAltNames: - description: A list of alternate names to verify the subject identity in the certificate presented by the client. - items: + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE type: string - type: array - tlsCertificates: - description: Only one of `server_certificate`, `private_key` or `credential_name` or `credential_names` or `tls_certificates` should be specified. - items: + http1MaxPendingRequests: + description: Maximum number of requests that will be + queued while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a + destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection + pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams + allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection + to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding + to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be + preserved while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream + connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections + to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket + to enable TCP Keepalives. properties: - caCertificates: - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + interval: + description: The time duration between keep-alive + probes. type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes + to send without response before deciding the connection + is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection needs + to be idle before keep-alive probes start being + sent. type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') type: object - maxItems: 2 - minItems: 1 - type: array - verifyCertificateHash: - description: An optional list of hex-encoded SHA-256 hashes of the authorized client certificates. - items: - type: string - type: array - verifyCertificateSpki: - description: An optional list of base64-encoded SHA-256 hashes of the SPKIs of authorized client certificates. - items: - type: string - type: array - type: object - x-kubernetes-validations: - - message: only one of credentialNames or tlsCertificates can be set - rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) ? 1 : 0) <= 1' - - message: only one of credentialName or credentialNames can be set - rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) ? 1 : 0) <= 1' - - message: only one of credentialName or tlsCertificates can be set - rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) ? 1 : 0) <= 1' - required: - - port - type: object - type: array - outboundTrafficPolicy: - description: Set the default behavior of the sidecar for handling outbound traffic from the application. - properties: - egressProxy: + type: object + type: object + defaultEndpoint: + description: The IP endpoint or Unix domain socket to which + traffic should be forwarded to. + type: string + port: + description: The port associated with the listener. properties: - host: - description: The name of a service from the service registry. + name: + description: Label assigned to the port. type: string - port: - description: Specifies the port on the host that is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. + number: + description: A valid non-negative integer port number. + maximum: 4294967295 + minimum: 0 + type: integer + protocol: + description: The protocol exposed on the port. type: string - required: - - host + targetPort: + maximum: 4294967295 + minimum: 0 + type: integer type: object - mode: - description: |- + tls: + description: Set of TLS related options that will enable TLS + termination on the sidecar for requests originating from outside + the mesh. + properties: + caCertCredentialName: + description: For mutual TLS, the name of the secret or the + configmap that holds CA certificates. + type: string + caCertificates: + description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing + the certificate revocation list (CRL) to use in verifying + a presented client side certificate.' + type: string + cipherSuites: + description: 'Optional: If specified, only support the specified + cipher list.' + items: + type: string + type: array + credentialName: + description: For gateways running on Kubernetes, the name + of the secret that holds the TLS certs including the CA + certificates. + type: string + credentialNames: + description: Same as CredentialName but for multiple certificates. + items: + type: string + maxItems: 2 + minItems: 1 + type: array + httpsRedirect: + description: If set to true, the load balancer will send + a 301 redirect for all http connections, asking the clients + to use HTTPS. + type: boolean + maxProtocolVersion: + description: |- + Optional: Maximum TLS protocol version. + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + minProtocolVersion: + description: |- + Optional: Minimum TLS protocol version. - Valid Options: REGISTRY_ONLY, ALLOW_ANY - enum: - - REGISTRY_ONLY - - ALLOW_ANY - type: string - type: object - workloadSelector: - description: Criteria used to select the specific set of pods/VMs on which this `Sidecar` configuration should be applied. - properties: - labels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard is not supported in selector - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of pods/VMs on which the configuration should be applied. - maxProperties: 256 - type: object - type: object - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + mode: + description: |- + Optional: Indicates whether connections to this port should be secured using TLS. - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL + enum: + - PASSTHROUGH + - SIMPLE + - MUTUAL + - AUTO_PASSTHROUGH + - ISTIO_MUTUAL + - OPTIONAL_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject + identity in the certificate presented by the client. + items: type: string - name: - description: A human-readable name for the message type. + type: array + tlsCertificates: + description: Only one of `server_certificate`, `private_key` + or `credential_name` or `credential_names` or `tls_certificates` + should be specified. + items: + properties: + caCertificates: + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + type: object + maxItems: 2 + minItems: 1 + type: array + verifyCertificateHash: + description: An optional list of hex-encoded SHA-256 hashes + of the authorized client certificates. + items: type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} - - name: v1alpha3 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting network reachability of a sidecar. See more details at: https://istio.io/docs/reference/config/networking/sidecar.html' - properties: - egress: - description: Egress specifies the configuration of the sidecar for processing outbound traffic from the attached workload instance to other services in the mesh. - items: + type: array + verifyCertificateSpki: + description: An optional list of base64-encoded SHA-256 + hashes of the SPKIs of authorized client certificates. + items: + type: string + type: array + type: object + x-kubernetes-validations: + - message: only one of credentialNames or tlsCertificates can + be set + rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) + ? 1 : 0) <= 1' + - message: only one of credentialName or credentialNames can + be set + rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) + ? 1 : 0) <= 1' + - message: only one of credentialName or tlsCertificates can + be set + rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) + ? 1 : 0) <= 1' + required: + - port + type: object + type: array + outboundTrafficPolicy: + description: Set the default behavior of the sidecar for handling + outbound traffic from the application. + properties: + egressProxy: properties: - bind: - description: The IP(IPv4 or IPv6) or the Unix domain socket to which the listener should be bound to. - type: string - captureMode: - description: |- - When the bind address is an IP, the captureMode option dictates how traffic to the listener is expected to be captured (or not). - - Valid Options: DEFAULT, IPTABLES, NONE - enum: - - DEFAULT - - IPTABLES - - NONE + host: + description: The name of a service from the service registry. type: string - hosts: - description: One or more service hosts exposed by the listener in `namespace/dnsName` format. - items: - type: string - type: array port: - description: The port associated with the listener. + description: Specifies the port on the host that is being + addressed. properties: - name: - description: Label assigned to the port. - type: string number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - protocol: - description: The protocol exposed on the port. - type: string - targetPort: maximum: 4294967295 minimum: 0 type: integer type: object + subset: + description: The name of a subset within the service. + type: string required: - - hosts + - host + type: object + mode: + description: |2- + + + Valid Options: REGISTRY_ONLY, ALLOW_ANY + enum: + - REGISTRY_ONLY + - ALLOW_ANY + type: string + type: object + workloadSelector: + description: Criteria used to select the specific set of pods/VMs + on which this `Sidecar` configuration should be applied. + properties: + labels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard is not supported in selector + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which the configuration should be applied. + maxProperties: 256 type: object - type: array - inboundConnectionPool: - description: Settings controlling the volume of connections Envoy will accept from the network. + type: object + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection pool connections. + name: + description: A human-readable name for the message type. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be preserved while initiating connection to backend. - type: boolean type: object - tcp: - description: Settings common to both HTTP and TCP upstream connections. + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} + - name: v1alpha3 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting network reachability of a sidecar. + See more details at: https://istio.io/docs/reference/config/networking/sidecar.html' + properties: + egress: + description: Egress specifies the configuration of the sidecar for + processing outbound traffic from the attached workload instance + to other services in the mesh. + items: + properties: + bind: + description: The IP(IPv4 or IPv6) or the Unix domain socket + to which the listener should be bound to. + type: string + captureMode: + description: |- + When the bind address is an IP, the captureMode option dictates how traffic to the listener is expected to be captured (or not). + + Valid Options: DEFAULT, IPTABLES, NONE + enum: + - DEFAULT + - IPTABLES + - NONE + type: string + hosts: + description: One or more service hosts exposed by the listener + in `namespace/dnsName` format. + items: + type: string + type: array + port: + description: The port associated with the listener. properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. + name: + description: Label assigned to the port. type: string - maxConnectionDuration: - description: The maximum duration of a connection. + number: + description: A valid non-negative integer port number. + maximum: 4294967295 + minimum: 0 + type: integer + protocol: + description: The protocol exposed on the port. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections to a destination host. - format: int32 + targetPort: + maximum: 4294967295 + minimum: 0 type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes to send without response before deciding the connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection needs to be idle before keep-alive probes start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object type: object + required: + - hosts type: object - ingress: - description: Ingress specifies the configuration of the sidecar for processing inbound traffic to the attached workload instance. - items: + type: array + inboundConnectionPool: + description: Settings controlling the volume of connections Envoy + will accept from the network. + properties: + http: + description: HTTP connection pool settings. properties: - bind: - description: The IP(IPv4 or IPv6) to which the listener should be bound. - type: string - captureMode: + h2UpgradePolicy: description: |- - The captureMode option dictates how traffic to the listener is expected to be captured (or not). + Specify if http1.1 connection should be upgraded to http2 for the associated destination. - Valid Options: DEFAULT, IPTABLES, NONE + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE enum: - - DEFAULT - - IPTABLES - - NONE + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will be queued + while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection pool + connections. type: string - connectionPool: - description: Settings controlling the volume of connections Envoy will accept from the network. - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be preserved while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes to send without response before deciding the connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection needs to be idle before keep-alive probes start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: object - type: object - defaultEndpoint: - description: The IP endpoint or Unix domain socket to which traffic should be forwarded to. + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams allowed + for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection to + a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding + to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be preserved + while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream connections. + properties: + connectTimeout: + description: TCP connection timeout. type: string - port: - description: The port associated with the listener. + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections to a + destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket to + enable TCP Keepalives. properties: - name: - description: Label assigned to the port. + interval: + description: The time duration between keep-alive probes. type: string - number: - description: A valid non-negative integer port number. + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to send + without response before deciding the connection is dead. maximum: 4294967295 minimum: 0 type: integer - protocol: - description: The protocol exposed on the port. + time: + description: The time duration a connection needs to be + idle before keep-alive probes start being sent. type: string - targetPort: - maximum: 4294967295 - minimum: 0 - type: integer + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') type: object - tls: - description: Set of TLS related options that will enable TLS termination on the sidecar for requests originating from outside the mesh. - properties: - caCertCredentialName: - description: For mutual TLS, the name of the secret or the configmap that holds CA certificates. - type: string - caCertificates: - description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented client side certificate.' - type: string - cipherSuites: - description: 'Optional: If specified, only support the specified cipher list.' - items: + type: object + type: object + ingress: + description: Ingress specifies the configuration of the sidecar for + processing inbound traffic to the attached workload instance. + items: + properties: + bind: + description: The IP(IPv4 or IPv6) to which the listener should + be bound. + type: string + captureMode: + description: |- + The captureMode option dictates how traffic to the listener is expected to be captured (or not). + + Valid Options: DEFAULT, IPTABLES, NONE + enum: + - DEFAULT + - IPTABLES + - NONE + type: string + connectionPool: + description: Settings controlling the volume of connections + Envoy will accept from the network. + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. + + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will be + queued while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a + destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection + pool connections. type: string - type: array - credentialName: - description: For gateways running on Kubernetes, the name of the secret that holds the TLS certs including the CA certificates. - type: string - credentialNames: - description: Same as CredentialName but for multiple certificates. - items: + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams + allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection + to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding + to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be + preserved while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream + connections. + properties: + connectTimeout: + description: TCP connection timeout. type: string - maxItems: 2 - minItems: 1 - type: array - httpsRedirect: - description: If set to true, the load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS. - type: boolean - maxProtocolVersion: - description: |- - Optional: Maximum TLS protocol version. - - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - minProtocolVersion: - description: |- - Optional: Minimum TLS protocol version. - - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - mode: - description: |- - Optional: Indicates whether connections to this port should be secured using TLS. - - Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL - enum: - - PASSTHROUGH - - SIMPLE - - MUTUAL - - AUTO_PASSTHROUGH - - ISTIO_MUTUAL - - OPTIONAL_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - subjectAltNames: - description: A list of alternate names to verify the subject identity in the certificate presented by the client. - items: + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. type: string - type: array - tlsCertificates: - description: Only one of `server_certificate`, `private_key` or `credential_name` or `credential_names` or `tls_certificates` should be specified. - items: + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections + to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket + to enable TCP Keepalives. properties: - caCertificates: - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + interval: + description: The time duration between keep-alive + probes. type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes + to send without response before deciding the connection + is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection needs + to be idle before keep-alive probes start being + sent. type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') type: object - maxItems: 2 - minItems: 1 - type: array - verifyCertificateHash: - description: An optional list of hex-encoded SHA-256 hashes of the authorized client certificates. - items: - type: string - type: array - verifyCertificateSpki: - description: An optional list of base64-encoded SHA-256 hashes of the SPKIs of authorized client certificates. - items: - type: string - type: array - type: object - x-kubernetes-validations: - - message: only one of credentialNames or tlsCertificates can be set - rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) ? 1 : 0) <= 1' - - message: only one of credentialName or credentialNames can be set - rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) ? 1 : 0) <= 1' - - message: only one of credentialName or tlsCertificates can be set - rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) ? 1 : 0) <= 1' - required: - - port - type: object - type: array - outboundTrafficPolicy: - description: Set the default behavior of the sidecar for handling outbound traffic from the application. - properties: - egressProxy: + type: object + type: object + defaultEndpoint: + description: The IP endpoint or Unix domain socket to which + traffic should be forwarded to. + type: string + port: + description: The port associated with the listener. properties: - host: - description: The name of a service from the service registry. + name: + description: Label assigned to the port. type: string - port: - description: Specifies the port on the host that is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. + number: + description: A valid non-negative integer port number. + maximum: 4294967295 + minimum: 0 + type: integer + protocol: + description: The protocol exposed on the port. type: string - required: - - host + targetPort: + maximum: 4294967295 + minimum: 0 + type: integer type: object - mode: - description: |- + tls: + description: Set of TLS related options that will enable TLS + termination on the sidecar for requests originating from outside + the mesh. + properties: + caCertCredentialName: + description: For mutual TLS, the name of the secret or the + configmap that holds CA certificates. + type: string + caCertificates: + description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing + the certificate revocation list (CRL) to use in verifying + a presented client side certificate.' + type: string + cipherSuites: + description: 'Optional: If specified, only support the specified + cipher list.' + items: + type: string + type: array + credentialName: + description: For gateways running on Kubernetes, the name + of the secret that holds the TLS certs including the CA + certificates. + type: string + credentialNames: + description: Same as CredentialName but for multiple certificates. + items: + type: string + maxItems: 2 + minItems: 1 + type: array + httpsRedirect: + description: If set to true, the load balancer will send + a 301 redirect for all http connections, asking the clients + to use HTTPS. + type: boolean + maxProtocolVersion: + description: |- + Optional: Maximum TLS protocol version. + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + minProtocolVersion: + description: |- + Optional: Minimum TLS protocol version. - Valid Options: REGISTRY_ONLY, ALLOW_ANY - enum: - - REGISTRY_ONLY - - ALLOW_ANY - type: string - type: object - workloadSelector: - description: Criteria used to select the specific set of pods/VMs on which this `Sidecar` configuration should be applied. - properties: - labels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard is not supported in selector - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of pods/VMs on which the configuration should be applied. - maxProperties: 256 - type: object - type: object - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + mode: + description: |- + Optional: Indicates whether connections to this port should be secured using TLS. - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. + Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL + enum: + - PASSTHROUGH + - SIMPLE + - MUTUAL + - AUTO_PASSTHROUGH + - ISTIO_MUTUAL + - OPTIONAL_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject + identity in the certificate presented by the client. + items: type: string - name: - description: A human-readable name for the message type. + type: array + tlsCertificates: + description: Only one of `server_certificate`, `private_key` + or `credential_name` or `credential_names` or `tls_certificates` + should be specified. + items: + properties: + caCertificates: + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + type: object + maxItems: 2 + minItems: 1 + type: array + verifyCertificateHash: + description: An optional list of hex-encoded SHA-256 hashes + of the authorized client certificates. + items: type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} - - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting network reachability of a sidecar. See more details at: https://istio.io/docs/reference/config/networking/sidecar.html' - properties: - egress: - description: Egress specifies the configuration of the sidecar for processing outbound traffic from the attached workload instance to other services in the mesh. - items: + type: array + verifyCertificateSpki: + description: An optional list of base64-encoded SHA-256 + hashes of the SPKIs of authorized client certificates. + items: + type: string + type: array + type: object + x-kubernetes-validations: + - message: only one of credentialNames or tlsCertificates can + be set + rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) + ? 1 : 0) <= 1' + - message: only one of credentialName or credentialNames can + be set + rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) + ? 1 : 0) <= 1' + - message: only one of credentialName or tlsCertificates can + be set + rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) + ? 1 : 0) <= 1' + required: + - port + type: object + type: array + outboundTrafficPolicy: + description: Set the default behavior of the sidecar for handling + outbound traffic from the application. + properties: + egressProxy: properties: - bind: - description: The IP(IPv4 or IPv6) or the Unix domain socket to which the listener should be bound to. + host: + description: The name of a service from the service registry. type: string - captureMode: - description: |- - When the bind address is an IP, the captureMode option dictates how traffic to the listener is expected to be captured (or not). - - Valid Options: DEFAULT, IPTABLES, NONE - enum: - - DEFAULT - - IPTABLES - - NONE - type: string - hosts: - description: One or more service hosts exposed by the listener in `namespace/dnsName` format. - items: - type: string - type: array port: - description: The port associated with the listener. + description: Specifies the port on the host that is being + addressed. properties: - name: - description: Label assigned to the port. - type: string number: - description: A valid non-negative integer port number. - maximum: 4294967295 - minimum: 0 - type: integer - protocol: - description: The protocol exposed on the port. - type: string - targetPort: maximum: 4294967295 minimum: 0 type: integer type: object + subset: + description: The name of a subset within the service. + type: string required: - - hosts + - host + type: object + mode: + description: |2- + + + Valid Options: REGISTRY_ONLY, ALLOW_ANY + enum: + - REGISTRY_ONLY + - ALLOW_ANY + type: string + type: object + workloadSelector: + description: Criteria used to select the specific set of pods/VMs + on which this `Sidecar` configuration should be applied. + properties: + labels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard is not supported in selector + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which the configuration should be applied. + maxProperties: 256 type: object - type: array - inboundConnectionPool: - description: Settings controlling the volume of connections Envoy will accept from the network. + type: object + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection pool connections. + name: + description: A human-readable name for the message type. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be preserved while initiating connection to backend. - type: boolean type: object - tcp: - description: Settings common to both HTTP and TCP upstream connections. + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} + - name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting network reachability of a sidecar. + See more details at: https://istio.io/docs/reference/config/networking/sidecar.html' + properties: + egress: + description: Egress specifies the configuration of the sidecar for + processing outbound traffic from the attached workload instance + to other services in the mesh. + items: + properties: + bind: + description: The IP(IPv4 or IPv6) or the Unix domain socket + to which the listener should be bound to. + type: string + captureMode: + description: |- + When the bind address is an IP, the captureMode option dictates how traffic to the listener is expected to be captured (or not). + + Valid Options: DEFAULT, IPTABLES, NONE + enum: + - DEFAULT + - IPTABLES + - NONE + type: string + hosts: + description: One or more service hosts exposed by the listener + in `namespace/dnsName` format. + items: + type: string + type: array + port: + description: The port associated with the listener. properties: - connectTimeout: - description: TCP connection timeout. + name: + description: Label assigned to the port. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. + number: + description: A valid non-negative integer port number. + maximum: 4294967295 + minimum: 0 + type: integer + protocol: + description: The protocol exposed on the port. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections to a destination host. - format: int32 + targetPort: + maximum: 4294967295 + minimum: 0 type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes to send without response before deciding the connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection needs to be idle before keep-alive probes start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object type: object + required: + - hosts type: object - ingress: - description: Ingress specifies the configuration of the sidecar for processing inbound traffic to the attached workload instance. - items: + type: array + inboundConnectionPool: + description: Settings controlling the volume of connections Envoy + will accept from the network. + properties: + http: + description: HTTP connection pool settings. properties: - bind: - description: The IP(IPv4 or IPv6) to which the listener should be bound. - type: string - captureMode: + h2UpgradePolicy: description: |- - The captureMode option dictates how traffic to the listener is expected to be captured (or not). + Specify if http1.1 connection should be upgraded to http2 for the associated destination. - Valid Options: DEFAULT, IPTABLES, NONE + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE enum: - - DEFAULT - - IPTABLES - - NONE + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE + type: string + http1MaxPendingRequests: + description: Maximum number of requests that will be queued + while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection pool + connections. type: string - connectionPool: - description: Settings controlling the volume of connections Envoy will accept from the network. - properties: - http: - description: HTTP connection pool settings. - properties: - h2UpgradePolicy: - description: |- - Specify if http1.1 connection should be upgraded to http2 for the associated destination. - - Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE - enum: - - DEFAULT - - DO_NOT_UPGRADE - - UPGRADE - type: string - http1MaxPendingRequests: - description: Maximum number of requests that will be queued while waiting for a ready connection pool connection. - format: int32 - type: integer - http2MaxRequests: - description: Maximum number of active requests to a destination. - format: int32 - type: integer - idleTimeout: - description: The idle timeout for upstream connection pool connections. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConcurrentStreams: - description: The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection. - format: int32 - type: integer - maxRequestsPerConnection: - description: Maximum number of requests per connection to a backend. - format: int32 - type: integer - maxRetries: - description: Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. - format: int32 - type: integer - useClientProtocol: - description: If set to true, client protocol will be preserved while initiating connection to backend. - type: boolean - type: object - tcp: - description: Settings common to both HTTP and TCP upstream connections. - properties: - connectTimeout: - description: TCP connection timeout. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - idleTimeout: - description: The idle timeout for TCP connections. - type: string - maxConnectionDuration: - description: The maximum duration of a connection. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - maxConnections: - description: Maximum number of HTTP1 /TCP connections to a destination host. - format: int32 - type: integer - tcpKeepalive: - description: If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives. - properties: - interval: - description: The time duration between keep-alive probes. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - probes: - description: Maximum number of keepalive probes to send without response before deciding the connection is dead. - maximum: 4294967295 - minimum: 0 - type: integer - time: - description: The time duration a connection needs to be idle before keep-alive probes start being sent. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: object - type: object - defaultEndpoint: - description: The IP endpoint or Unix domain socket to which traffic should be forwarded to. + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams allowed + for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection to + a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding + to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be preserved + while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream connections. + properties: + connectTimeout: + description: TCP connection timeout. type: string - port: - description: The port associated with the listener. + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections to a + destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket to + enable TCP Keepalives. properties: - name: - description: Label assigned to the port. + interval: + description: The time duration between keep-alive probes. type: string - number: - description: A valid non-negative integer port number. + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes to send + without response before deciding the connection is dead. maximum: 4294967295 minimum: 0 type: integer - protocol: - description: The protocol exposed on the port. + time: + description: The time duration a connection needs to be + idle before keep-alive probes start being sent. type: string - targetPort: - maximum: 4294967295 - minimum: 0 - type: integer + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') type: object - tls: - description: Set of TLS related options that will enable TLS termination on the sidecar for requests originating from outside the mesh. - properties: - caCertCredentialName: - description: For mutual TLS, the name of the secret or the configmap that holds CA certificates. - type: string - caCertificates: - description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. - type: string - caCrl: - description: 'OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented client side certificate.' - type: string - cipherSuites: - description: 'Optional: If specified, only support the specified cipher list.' - items: - type: string - type: array - credentialName: - description: For gateways running on Kubernetes, the name of the secret that holds the TLS certs including the CA certificates. - type: string - credentialNames: - description: Same as CredentialName but for multiple certificates. - items: - type: string - maxItems: 2 - minItems: 1 - type: array - httpsRedirect: - description: If set to true, the load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS. - type: boolean - maxProtocolVersion: - description: |- - Optional: Maximum TLS protocol version. - - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - minProtocolVersion: - description: |- - Optional: Minimum TLS protocol version. + type: object + type: object + ingress: + description: Ingress specifies the configuration of the sidecar for + processing inbound traffic to the attached workload instance. + items: + properties: + bind: + description: The IP(IPv4 or IPv6) to which the listener should + be bound. + type: string + captureMode: + description: |- + The captureMode option dictates how traffic to the listener is expected to be captured (or not). - Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 - enum: - - TLS_AUTO - - TLSV1_0 - - TLSV1_1 - - TLSV1_2 - - TLSV1_3 - type: string - mode: - description: |- - Optional: Indicates whether connections to this port should be secured using TLS. + Valid Options: DEFAULT, IPTABLES, NONE + enum: + - DEFAULT + - IPTABLES + - NONE + type: string + connectionPool: + description: Settings controlling the volume of connections + Envoy will accept from the network. + properties: + http: + description: HTTP connection pool settings. + properties: + h2UpgradePolicy: + description: |- + Specify if http1.1 connection should be upgraded to http2 for the associated destination. - Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL - enum: - - PASSTHROUGH - - SIMPLE - - MUTUAL - - AUTO_PASSTHROUGH - - ISTIO_MUTUAL - - OPTIONAL_MUTUAL - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. - type: string - subjectAltNames: - description: A list of alternate names to verify the subject identity in the certificate presented by the client. - items: + Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE + enum: + - DEFAULT + - DO_NOT_UPGRADE + - UPGRADE type: string - type: array - tlsCertificates: - description: Only one of `server_certificate`, `private_key` or `credential_name` or `credential_names` or `tls_certificates` should be specified. - items: + http1MaxPendingRequests: + description: Maximum number of requests that will be + queued while waiting for a ready connection pool connection. + format: int32 + type: integer + http2MaxRequests: + description: Maximum number of active requests to a + destination. + format: int32 + type: integer + idleTimeout: + description: The idle timeout for upstream connection + pool connections. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConcurrentStreams: + description: The maximum number of concurrent streams + allowed for a peer on one HTTP/2 connection. + format: int32 + type: integer + maxRequestsPerConnection: + description: Maximum number of requests per connection + to a backend. + format: int32 + type: integer + maxRetries: + description: Maximum number of retries that can be outstanding + to all hosts in a cluster at a given time. + format: int32 + type: integer + useClientProtocol: + description: If set to true, client protocol will be + preserved while initiating connection to backend. + type: boolean + type: object + tcp: + description: Settings common to both HTTP and TCP upstream + connections. + properties: + connectTimeout: + description: TCP connection timeout. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + idleTimeout: + description: The idle timeout for TCP connections. + type: string + maxConnectionDuration: + description: The maximum duration of a connection. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + maxConnections: + description: Maximum number of HTTP1 /TCP connections + to a destination host. + format: int32 + type: integer + tcpKeepalive: + description: If set then set SO_KEEPALIVE on the socket + to enable TCP Keepalives. properties: - caCertificates: - type: string - privateKey: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + interval: + description: The time duration between keep-alive + probes. type: string - serverCertificate: - description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') + probes: + description: Maximum number of keepalive probes + to send without response before deciding the connection + is dead. + maximum: 4294967295 + minimum: 0 + type: integer + time: + description: The time duration a connection needs + to be idle before keep-alive probes start being + sent. type: string + x-kubernetes-validations: + - message: must be a valid duration greater than + 1ms + rule: duration(self) >= duration('1ms') type: object - maxItems: 2 - minItems: 1 - type: array - verifyCertificateHash: - description: An optional list of hex-encoded SHA-256 hashes of the authorized client certificates. - items: - type: string - type: array - verifyCertificateSpki: - description: An optional list of base64-encoded SHA-256 hashes of the SPKIs of authorized client certificates. - items: - type: string - type: array - type: object - x-kubernetes-validations: - - message: only one of credentialNames or tlsCertificates can be set - rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) ? 1 : 0) <= 1' - - message: only one of credentialName or credentialNames can be set - rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) ? 1 : 0) <= 1' - - message: only one of credentialName or tlsCertificates can be set - rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) ? 1 : 0) <= 1' - required: - - port - type: object - type: array - outboundTrafficPolicy: - description: Set the default behavior of the sidecar for handling outbound traffic from the application. - properties: - egressProxy: + type: object + type: object + defaultEndpoint: + description: The IP endpoint or Unix domain socket to which + traffic should be forwarded to. + type: string + port: + description: The port associated with the listener. properties: - host: - description: The name of a service from the service registry. + name: + description: Label assigned to the port. type: string - port: - description: Specifies the port on the host that is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. + number: + description: A valid non-negative integer port number. + maximum: 4294967295 + minimum: 0 + type: integer + protocol: + description: The protocol exposed on the port. + type: string + targetPort: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + tls: + description: Set of TLS related options that will enable TLS + termination on the sidecar for requests originating from outside + the mesh. + properties: + caCertCredentialName: + description: For mutual TLS, the name of the secret or the + configmap that holds CA certificates. + type: string + caCertificates: + description: REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`. + type: string + caCrl: + description: 'OPTIONAL: The path to the file containing + the certificate revocation list (CRL) to use in verifying + a presented client side certificate.' + type: string + cipherSuites: + description: 'Optional: If specified, only support the specified + cipher list.' + items: + type: string + type: array + credentialName: + description: For gateways running on Kubernetes, the name + of the secret that holds the TLS certs including the CA + certificates. + type: string + credentialNames: + description: Same as CredentialName but for multiple certificates. + items: + type: string + maxItems: 2 + minItems: 1 + type: array + httpsRedirect: + description: If set to true, the load balancer will send + a 301 redirect for all http connections, asking the clients + to use HTTPS. + type: boolean + maxProtocolVersion: + description: |- + Optional: Maximum TLS protocol version. + + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 type: string - required: - - host - type: object - mode: - description: |- + minProtocolVersion: + description: |- + Optional: Minimum TLS protocol version. + Valid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3 + enum: + - TLS_AUTO + - TLSV1_0 + - TLSV1_1 + - TLSV1_2 + - TLSV1_3 + type: string + mode: + description: |- + Optional: Indicates whether connections to this port should be secured using TLS. - Valid Options: REGISTRY_ONLY, ALLOW_ANY - enum: - - REGISTRY_ONLY - - ALLOW_ANY - type: string - type: object - workloadSelector: - description: Criteria used to select the specific set of pods/VMs on which this `Sidecar` configuration should be applied. - properties: - labels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard is not supported in selector - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of pods/VMs on which the configuration should be applied. - maxProperties: 256 + Valid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL + enum: + - PASSTHROUGH + - SIMPLE + - MUTUAL + - AUTO_PASSTHROUGH + - ISTIO_MUTUAL + - OPTIONAL_MUTUAL + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + subjectAltNames: + description: A list of alternate names to verify the subject + identity in the certificate presented by the client. + items: + type: string + type: array + tlsCertificates: + description: Only one of `server_certificate`, `private_key` + or `credential_name` or `credential_names` or `tls_certificates` + should be specified. + items: + properties: + caCertificates: + type: string + privateKey: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + serverCertificate: + description: REQUIRED if mode is `SIMPLE` or `MUTUAL`. + type: string + type: object + maxItems: 2 + minItems: 1 + type: array + verifyCertificateHash: + description: An optional list of hex-encoded SHA-256 hashes + of the authorized client certificates. + items: + type: string + type: array + verifyCertificateSpki: + description: An optional list of base64-encoded SHA-256 + hashes of the SPKIs of authorized client certificates. + items: + type: string + type: array type: object + x-kubernetes-validations: + - message: only one of credentialNames or tlsCertificates can + be set + rule: '(has(self.tlsCertificates) ? 1 : 0) + (has(self.credentialNames) + ? 1 : 0) <= 1' + - message: only one of credentialName or credentialNames can + be set + rule: '(has(self.credentialName) ? 1 : 0) + (has(self.credentialNames) + ? 1 : 0) <= 1' + - message: only one of credentialName or tlsCertificates can + be set + rule: '(has(self.credentialNames) ? 1 : 0) + (has(self.tlsCertificates) + ? 1 : 0) <= 1' + required: + - port type: object - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: + type: array + outboundTrafficPolicy: + description: Set the default behavior of the sidecar for handling + outbound traffic from the application. + properties: + egressProxy: properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. - type: string - status: - description: Status is the status of the condition. + host: + description: The name of a service from the service registry. type: string - type: - description: Type is the type of the condition. + port: + description: Specifies the port on the host that is being + addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. type: string + required: + - host type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. + mode: + description: |2- - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object + + Valid Options: REGISTRY_ONLY, ALLOW_ANY + enum: + - REGISTRY_ONLY + - ALLOW_ANY + type: string + type: object + workloadSelector: + description: Criteria used to select the specific set of pods/VMs + on which this `Sidecar` configuration should be applied. + properties: + labels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard is not supported in selector + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which the configuration should be applied. + maxProperties: 256 type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} + type: object + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} + --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -10630,195 +11923,236 @@ spec: group: telemetry.istio.io names: categories: - - istio-io - - telemetry-istio-io + - istio-io + - telemetry-istio-io kind: Telemetry listKind: TelemetryList plural: telemetries shortNames: - - telemetry + - telemetry singular: telemetry scope: Namespaced versions: - - additionalPrinterColumns: - - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Telemetry configuration for workloads. See more details at: https://istio.io/docs/reference/config/telemetry.html' - properties: - accessLogging: - description: Optional. - items: - properties: - disabled: - description: Controls logging. - nullable: true - type: boolean - filter: - description: Optional. + - additionalPrinterColumns: + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Telemetry configuration for workloads. See more details + at: https://istio.io/docs/reference/config/telemetry.html' + properties: + accessLogging: + description: Optional. + items: + properties: + disabled: + description: Controls logging. + nullable: true + type: boolean + filter: + description: Optional. + properties: + expression: + description: CEL expression for selecting when requests/connections + should be logged. + type: string + type: object + match: + description: Allows tailoring of logging behavior to specific + conditions. + properties: + mode: + description: |- + This determines whether or not to apply the access logging configuration based on the direction of traffic relative to the proxied workload. + + Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER + enum: + - CLIENT_AND_SERVER + - CLIENT + - SERVER + type: string + type: object + providers: + description: Optional. + items: properties: - expression: - description: CEL expression for selecting when requests/connections should be logged. + name: + description: Required. + minLength: 1 type: string + required: + - name type: object - match: - description: Allows tailoring of logging behavior to specific conditions. + type: array + type: object + type: array + metrics: + description: Optional. + items: + properties: + overrides: + description: Optional. + items: properties: - mode: - description: |- - This determines whether or not to apply the access logging configuration based on the direction of traffic relative to the proxied workload. - - Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER - enum: - - CLIENT_AND_SERVER - - CLIENT - - SERVER - type: string - type: object - providers: - description: Optional. - items: - properties: - name: - description: Required. - minLength: 1 - type: string - required: - - name - type: object - type: array - type: object - type: array - metrics: - description: Optional. - items: - properties: - overrides: - description: Optional. - items: - properties: - disabled: - description: Optional. - nullable: true - type: boolean - match: - description: Match allows providing the scope of the override. - oneOf: - - not: - anyOf: - - required: - - metric - - required: - - customMetric + disabled: + description: Optional. + nullable: true + type: boolean + match: + description: Match allows providing the scope of the override. + oneOf: + - not: + anyOf: - required: - - metric + - metric - required: - - customMetric + - customMetric + - required: + - metric + - required: + - customMetric + properties: + customMetric: + description: Allows free-form specification of a metric. + minLength: 1 + type: string + metric: + description: |- + One of the well-known [Istio Standard Metrics](https://istio.io/latest/docs/reference/config/metrics/). + + Valid Options: ALL_METRICS, REQUEST_COUNT, REQUEST_DURATION, REQUEST_SIZE, RESPONSE_SIZE, TCP_OPENED_CONNECTIONS, TCP_CLOSED_CONNECTIONS, TCP_SENT_BYTES, TCP_RECEIVED_BYTES, GRPC_REQUEST_MESSAGES, GRPC_RESPONSE_MESSAGES + enum: + - ALL_METRICS + - REQUEST_COUNT + - REQUEST_DURATION + - REQUEST_SIZE + - RESPONSE_SIZE + - TCP_OPENED_CONNECTIONS + - TCP_CLOSED_CONNECTIONS + - TCP_SENT_BYTES + - TCP_RECEIVED_BYTES + - GRPC_REQUEST_MESSAGES + - GRPC_RESPONSE_MESSAGES + type: string + mode: + description: |- + Controls which mode of metrics generation is selected: `CLIENT`, `SERVER`, or `CLIENT_AND_SERVER`. + + Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER + enum: + - CLIENT_AND_SERVER + - CLIENT + - SERVER + type: string + type: object + tagOverrides: + additionalProperties: properties: - customMetric: - description: Allows free-form specification of a metric. - minLength: 1 - type: string - metric: + operation: description: |- - One of the well-known [Istio Standard Metrics](https://istio.io/latest/docs/reference/config/metrics/). + Operation controls whether or not to update/add a tag, or to remove it. - Valid Options: ALL_METRICS, REQUEST_COUNT, REQUEST_DURATION, REQUEST_SIZE, RESPONSE_SIZE, TCP_OPENED_CONNECTIONS, TCP_CLOSED_CONNECTIONS, TCP_SENT_BYTES, TCP_RECEIVED_BYTES, GRPC_REQUEST_MESSAGES, GRPC_RESPONSE_MESSAGES + Valid Options: UPSERT, REMOVE enum: - - ALL_METRICS - - REQUEST_COUNT - - REQUEST_DURATION - - REQUEST_SIZE - - RESPONSE_SIZE - - TCP_OPENED_CONNECTIONS - - TCP_CLOSED_CONNECTIONS - - TCP_SENT_BYTES - - TCP_RECEIVED_BYTES - - GRPC_REQUEST_MESSAGES - - GRPC_RESPONSE_MESSAGES + - UPSERT + - REMOVE type: string - mode: - description: |- - Controls which mode of metrics generation is selected: `CLIENT`, `SERVER`, or `CLIENT_AND_SERVER`. - - Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER - enum: - - CLIENT_AND_SERVER - - CLIENT - - SERVER + value: + description: Value is only considered if the operation + is `UPSERT`. type: string type: object - tagOverrides: - additionalProperties: - properties: - operation: - description: |- - Operation controls whether or not to update/add a tag, or to remove it. - - Valid Options: UPSERT, REMOVE - enum: - - UPSERT - - REMOVE - type: string - value: - description: Value is only considered if the operation is `UPSERT`. - type: string - type: object - x-kubernetes-validations: - - message: value must be set when operation is UPSERT - rule: '((has(self.operation) ? self.operation : "") == "UPSERT") ? (self.value != "") : true' - - message: value must not be set when operation is REMOVE - rule: '((has(self.operation) ? self.operation : "") == "REMOVE") ? !has(self.value) : true' - description: Optional. - type: object - type: object - type: array - providers: - description: Optional. - items: - properties: - name: - description: Required. - minLength: 1 - type: string - required: - - name - type: object - type: array - reportingInterval: - description: Optional. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: array - selector: - description: Optional. - properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied. - maxProperties: 4096 - type: object + x-kubernetes-validations: + - message: value must be set when operation is UPSERT + rule: '((has(self.operation) ? self.operation : "") + == "UPSERT") ? (self.value != "") : true' + - message: value must not be set when operation is REMOVE + rule: '((has(self.operation) ? self.operation : "") + == "REMOVE") ? !has(self.value) : true' + description: Optional. + type: object + type: object + type: array + providers: + description: Optional. + items: + properties: + name: + description: Required. + minLength: 1 + type: string + required: + - name + type: object + type: array + reportingInterval: + description: Optional. + type: string x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') type: object - targetRef: + type: array + selector: + description: Optional. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + targetRef: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name + type: object + targetRefs: + description: Optional. + items: properties: group: description: group is the group of the target resource. @@ -10834,429 +12168,455 @@ spec: name: description: name is the name of the target resource. maxLength: 253 - minLength: 1 - type: string - namespace: - description: namespace is the namespace of the referent. - type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 - required: - - kind - - name - type: object - targetRefs: - description: Optional. - items: - properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: name is the name of the target resource. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: namespace is the namespace of the referent. - type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 - required: - - kind - - name - type: object - maxItems: 16 - type: array - tracing: - description: Optional. - items: - properties: - customTags: - additionalProperties: - oneOf: - - not: - anyOf: - - required: - - literal - - required: - - environment - - required: - - header - - required: - - formatter + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name + type: object + maxItems: 16 + type: array + tracing: + description: Optional. + items: + properties: + customTags: + additionalProperties: + oneOf: + - not: + anyOf: - required: - - literal + - literal - required: - - environment + - environment - required: - - header + - header - required: - - formatter - properties: - environment: - description: Environment adds the value of an environment variable to each span. - properties: - defaultValue: - description: Optional. - type: string - name: - description: Name of the environment variable from which to extract the tag value. - minLength: 1 - type: string - required: - - name - type: object - formatter: - description: Formatter adds the value of access logging substitution formatter. - properties: - value: - description: The formatter tag value to use, same formatter as HTTP access logging (e.g. - minLength: 1 - type: string - required: - - value - type: object - header: - description: RequestHeader adds the value of an header from the request to each span. - properties: - defaultValue: - description: Optional. - type: string - name: - description: Name of the header from which to extract the tag value. - minLength: 1 - type: string - required: - - name - type: object - literal: - description: Literal adds the same, hard-coded value to each span. - properties: - value: - description: The tag value to use. - minLength: 1 - type: string - required: - - value - type: object - type: object - description: Optional. - type: object - disableSpanReporting: - description: Controls span reporting. - nullable: true - type: boolean - enableIstioTags: - description: Determines whether or not trace spans generated by Envoy will include Istio specific tags. - nullable: true - type: boolean - match: - description: Allows tailoring of behavior to specific conditions. + - formatter + - required: + - literal + - required: + - environment + - required: + - header + - required: + - formatter properties: - mode: - description: |- - This determines whether or not to apply the tracing configuration based on the direction of traffic relative to the proxied workload. - - Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER - enum: - - CLIENT_AND_SERVER - - CLIENT - - SERVER - type: string - type: object - providers: - description: Optional. - items: - properties: - name: - description: Required. - minLength: 1 - type: string - required: + environment: + description: Environment adds the value of an environment + variable to each span. + properties: + defaultValue: + description: Optional. + type: string + name: + description: Name of the environment variable from + which to extract the tag value. + minLength: 1 + type: string + required: - name - type: object - type: array - randomSamplingPercentage: - description: Controls the rate at which traffic will be selected for tracing if no prior sampling decision has been made. - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - useRequestIdForTraceSampling: - nullable: true - type: boolean - type: object - type: array - type: object - x-kubernetes-validations: - - message: only one of targetRefs or selector can be set - rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + (has(self.targetRefs) ? 1 : 0) <= 1' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. + type: object + formatter: + description: Formatter adds the value of access logging + substitution formatter. + properties: + value: + description: The formatter tag value to use, same + formatter as HTTP access logging (e.g. + minLength: 1 + type: string + required: + - value + type: object + header: + description: RequestHeader adds the value of an header + from the request to each span. + properties: + defaultValue: + description: Optional. + type: string + name: + description: Name of the header from which to extract + the tag value. + minLength: 1 + type: string + required: + - name + type: object + literal: + description: Literal adds the same, hard-coded value to + each span. + properties: + value: + description: The tag value to use. + minLength: 1 + type: string + required: + - value + type: object + type: object + description: Optional. + type: object + disableSpanReporting: + description: Controls span reporting. + nullable: true + type: boolean + enableIstioTags: + description: Determines whether or not trace spans generated + by Envoy will include Istio specific tags. + nullable: true + type: boolean + match: + description: Allows tailoring of behavior to specific conditions. + properties: + mode: + description: |- + This determines whether or not to apply the tracing configuration based on the direction of traffic relative to the proxied workload. - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: + Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER + enum: + - CLIENT_AND_SERVER + - CLIENT + - SERVER + type: string + type: object + providers: + description: Optional. + items: properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. - type: string name: - description: A human-readable name for the message type. + description: Required. + minLength: 1 type: string + required: + - name type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} - - additionalPrinterColumns: - - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1alpha1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Telemetry configuration for workloads. See more details at: https://istio.io/docs/reference/config/telemetry.html' - properties: - accessLogging: - description: Optional. - items: - properties: - disabled: - description: Controls logging. - nullable: true - type: boolean - filter: - description: Optional. + type: array + randomSamplingPercentage: + description: Controls the rate at which traffic will be selected + for tracing if no prior sampling decision has been made. + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + useRequestIdForTraceSampling: + nullable: true + type: boolean + type: object + type: array + type: object + x-kubernetes-validations: + - message: only one of targetRefs or selector can be set + rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + + (has(self.targetRefs) ? 1 : 0) <= 1' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Telemetry configuration for workloads. See more details + at: https://istio.io/docs/reference/config/telemetry.html' + properties: + accessLogging: + description: Optional. + items: + properties: + disabled: + description: Controls logging. + nullable: true + type: boolean + filter: + description: Optional. + properties: + expression: + description: CEL expression for selecting when requests/connections + should be logged. + type: string + type: object + match: + description: Allows tailoring of logging behavior to specific + conditions. + properties: + mode: + description: |- + This determines whether or not to apply the access logging configuration based on the direction of traffic relative to the proxied workload. + + Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER + enum: + - CLIENT_AND_SERVER + - CLIENT + - SERVER + type: string + type: object + providers: + description: Optional. + items: properties: - expression: - description: CEL expression for selecting when requests/connections should be logged. + name: + description: Required. + minLength: 1 type: string + required: + - name type: object - match: - description: Allows tailoring of logging behavior to specific conditions. + type: array + type: object + type: array + metrics: + description: Optional. + items: + properties: + overrides: + description: Optional. + items: properties: - mode: - description: |- - This determines whether or not to apply the access logging configuration based on the direction of traffic relative to the proxied workload. - - Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER - enum: - - CLIENT_AND_SERVER - - CLIENT - - SERVER - type: string - type: object - providers: - description: Optional. - items: - properties: - name: - description: Required. - minLength: 1 - type: string - required: - - name - type: object - type: array - type: object - type: array - metrics: - description: Optional. - items: - properties: - overrides: - description: Optional. - items: - properties: - disabled: - description: Optional. - nullable: true - type: boolean - match: - description: Match allows providing the scope of the override. - oneOf: - - not: - anyOf: - - required: - - metric - - required: - - customMetric + disabled: + description: Optional. + nullable: true + type: boolean + match: + description: Match allows providing the scope of the override. + oneOf: + - not: + anyOf: - required: - - metric + - metric - required: - - customMetric + - customMetric + - required: + - metric + - required: + - customMetric + properties: + customMetric: + description: Allows free-form specification of a metric. + minLength: 1 + type: string + metric: + description: |- + One of the well-known [Istio Standard Metrics](https://istio.io/latest/docs/reference/config/metrics/). + + Valid Options: ALL_METRICS, REQUEST_COUNT, REQUEST_DURATION, REQUEST_SIZE, RESPONSE_SIZE, TCP_OPENED_CONNECTIONS, TCP_CLOSED_CONNECTIONS, TCP_SENT_BYTES, TCP_RECEIVED_BYTES, GRPC_REQUEST_MESSAGES, GRPC_RESPONSE_MESSAGES + enum: + - ALL_METRICS + - REQUEST_COUNT + - REQUEST_DURATION + - REQUEST_SIZE + - RESPONSE_SIZE + - TCP_OPENED_CONNECTIONS + - TCP_CLOSED_CONNECTIONS + - TCP_SENT_BYTES + - TCP_RECEIVED_BYTES + - GRPC_REQUEST_MESSAGES + - GRPC_RESPONSE_MESSAGES + type: string + mode: + description: |- + Controls which mode of metrics generation is selected: `CLIENT`, `SERVER`, or `CLIENT_AND_SERVER`. + + Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER + enum: + - CLIENT_AND_SERVER + - CLIENT + - SERVER + type: string + type: object + tagOverrides: + additionalProperties: properties: - customMetric: - description: Allows free-form specification of a metric. - minLength: 1 - type: string - metric: + operation: description: |- - One of the well-known [Istio Standard Metrics](https://istio.io/latest/docs/reference/config/metrics/). + Operation controls whether or not to update/add a tag, or to remove it. - Valid Options: ALL_METRICS, REQUEST_COUNT, REQUEST_DURATION, REQUEST_SIZE, RESPONSE_SIZE, TCP_OPENED_CONNECTIONS, TCP_CLOSED_CONNECTIONS, TCP_SENT_BYTES, TCP_RECEIVED_BYTES, GRPC_REQUEST_MESSAGES, GRPC_RESPONSE_MESSAGES + Valid Options: UPSERT, REMOVE enum: - - ALL_METRICS - - REQUEST_COUNT - - REQUEST_DURATION - - REQUEST_SIZE - - RESPONSE_SIZE - - TCP_OPENED_CONNECTIONS - - TCP_CLOSED_CONNECTIONS - - TCP_SENT_BYTES - - TCP_RECEIVED_BYTES - - GRPC_REQUEST_MESSAGES - - GRPC_RESPONSE_MESSAGES + - UPSERT + - REMOVE type: string - mode: - description: |- - Controls which mode of metrics generation is selected: `CLIENT`, `SERVER`, or `CLIENT_AND_SERVER`. - - Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER - enum: - - CLIENT_AND_SERVER - - CLIENT - - SERVER + value: + description: Value is only considered if the operation + is `UPSERT`. type: string type: object - tagOverrides: - additionalProperties: - properties: - operation: - description: |- - Operation controls whether or not to update/add a tag, or to remove it. - - Valid Options: UPSERT, REMOVE - enum: - - UPSERT - - REMOVE - type: string - value: - description: Value is only considered if the operation is `UPSERT`. - type: string - type: object - x-kubernetes-validations: - - message: value must be set when operation is UPSERT - rule: '((has(self.operation) ? self.operation : "") == "UPSERT") ? (self.value != "") : true' - - message: value must not be set when operation is REMOVE - rule: '((has(self.operation) ? self.operation : "") == "REMOVE") ? !has(self.value) : true' - description: Optional. - type: object - type: object - type: array - providers: - description: Optional. - items: - properties: - name: - description: Required. - minLength: 1 - type: string - required: - - name - type: object - type: array - reportingInterval: - description: Optional. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: array - selector: - description: Optional. - properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied. - maxProperties: 4096 - type: object + x-kubernetes-validations: + - message: value must be set when operation is UPSERT + rule: '((has(self.operation) ? self.operation : "") + == "UPSERT") ? (self.value != "") : true' + - message: value must not be set when operation is REMOVE + rule: '((has(self.operation) ? self.operation : "") + == "REMOVE") ? !has(self.value) : true' + description: Optional. + type: object + type: object + type: array + providers: + description: Optional. + items: + properties: + name: + description: Required. + minLength: 1 + type: string + required: + - name + type: object + type: array + reportingInterval: + description: Optional. + type: string x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') type: object - targetRef: + type: array + selector: + description: Optional. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which a policy should be applied. + maxProperties: 4096 + type: object + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + targetRef: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name + type: object + targetRefs: + description: Optional. + items: properties: group: description: group is the group of the target resource. @@ -11278,615 +12638,600 @@ spec: description: namespace is the namespace of the referent. type: string x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 required: - - kind - - name + - kind + - name type: object - targetRefs: - description: Optional. - items: - properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: name is the name of the target resource. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: namespace is the namespace of the referent. - type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 - required: - - kind - - name - type: object - maxItems: 16 - type: array - tracing: - description: Optional. - items: - properties: - customTags: - additionalProperties: - oneOf: - - not: - anyOf: - - required: - - literal - - required: - - environment - - required: - - header - - required: - - formatter + maxItems: 16 + type: array + tracing: + description: Optional. + items: + properties: + customTags: + additionalProperties: + oneOf: + - not: + anyOf: - required: - - literal + - literal - required: - - environment + - environment - required: - - header + - header - required: - - formatter - properties: - environment: - description: Environment adds the value of an environment variable to each span. - properties: - defaultValue: - description: Optional. - type: string - name: - description: Name of the environment variable from which to extract the tag value. - minLength: 1 - type: string - required: - - name - type: object - formatter: - description: Formatter adds the value of access logging substitution formatter. - properties: - value: - description: The formatter tag value to use, same formatter as HTTP access logging (e.g. - minLength: 1 - type: string - required: - - value - type: object - header: - description: RequestHeader adds the value of an header from the request to each span. - properties: - defaultValue: - description: Optional. - type: string - name: - description: Name of the header from which to extract the tag value. - minLength: 1 - type: string - required: - - name - type: object - literal: - description: Literal adds the same, hard-coded value to each span. - properties: - value: - description: The tag value to use. - minLength: 1 - type: string - required: - - value - type: object - type: object - description: Optional. - type: object - disableSpanReporting: - description: Controls span reporting. - nullable: true - type: boolean - enableIstioTags: - description: Determines whether or not trace spans generated by Envoy will include Istio specific tags. - nullable: true - type: boolean - match: - description: Allows tailoring of behavior to specific conditions. + - formatter + - required: + - literal + - required: + - environment + - required: + - header + - required: + - formatter properties: - mode: - description: |- - This determines whether or not to apply the tracing configuration based on the direction of traffic relative to the proxied workload. - - Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER - enum: - - CLIENT_AND_SERVER - - CLIENT - - SERVER - type: string - type: object - providers: - description: Optional. - items: - properties: - name: - description: Required. - minLength: 1 - type: string - required: + environment: + description: Environment adds the value of an environment + variable to each span. + properties: + defaultValue: + description: Optional. + type: string + name: + description: Name of the environment variable from + which to extract the tag value. + minLength: 1 + type: string + required: - name - type: object - type: array - randomSamplingPercentage: - description: Controls the rate at which traffic will be selected for tracing if no prior sampling decision has been made. - format: double - maximum: 100 - minimum: 0 - nullable: true - type: number - useRequestIdForTraceSampling: - nullable: true - type: boolean - type: object - type: array - type: object - x-kubernetes-validations: - - message: only one of targetRefs or selector can be set - rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + (has(self.targetRefs) ? 1 : 0) <= 1' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. + type: object + formatter: + description: Formatter adds the value of access logging + substitution formatter. + properties: + value: + description: The formatter tag value to use, same + formatter as HTTP access logging (e.g. + minLength: 1 + type: string + required: + - value + type: object + header: + description: RequestHeader adds the value of an header + from the request to each span. + properties: + defaultValue: + description: Optional. + type: string + name: + description: Name of the header from which to extract + the tag value. + minLength: 1 + type: string + required: + - name + type: object + literal: + description: Literal adds the same, hard-coded value to + each span. + properties: + value: + description: The tag value to use. + minLength: 1 + type: string + required: + - value + type: object + type: object + description: Optional. + type: object + disableSpanReporting: + description: Controls span reporting. + nullable: true + type: boolean + enableIstioTags: + description: Determines whether or not trace spans generated + by Envoy will include Istio specific tags. + nullable: true + type: boolean + match: + description: Allows tailoring of behavior to specific conditions. + properties: + mode: + description: |- + This determines whether or not to apply the tracing configuration based on the direction of traffic relative to the proxied workload. - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: + Valid Options: CLIENT_AND_SERVER, CLIENT, SERVER + enum: + - CLIENT_AND_SERVER + - CLIENT + - SERVER + type: string + type: object + providers: + description: Optional. + items: properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. - type: string name: - description: A human-readable name for the message type. + description: Required. + minLength: 1 type: string + required: + - name type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - helm.sh/resource-policy: keep - labels: - app.kubernetes.io/instance: istio - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.4 - helm.sh/chart: base-1.29.4 - name: virtualservices.networking.istio.io -spec: - group: networking.istio.io - names: - categories: - - istio-io - - networking-istio-io - kind: VirtualService - listKind: VirtualServiceList - plural: virtualservices - shortNames: - - vs - singular: virtualservice - scope: Namespaced - versions: - - additionalPrinterColumns: - - description: The names of gateways and sidecars that should apply these routes - jsonPath: .spec.gateways - name: Gateways - type: string - - description: The destination hosts to which traffic is being sent - jsonPath: .spec.hosts - name: Hosts - type: string - - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting label/content routing, sni routing, etc. See more details at: https://istio.io/docs/reference/config/networking/virtual-service.html' - properties: - exportTo: - description: A list of namespaces to which this virtual service is exported. - items: - type: string - type: array - gateways: - description: The names of gateways and sidecars that should apply these routes. - items: - type: string - type: array - hosts: - description: The destination hosts to which traffic is being sent. - items: - type: string - type: array - http: - description: An ordered list of route rules for HTTP traffic. - items: - properties: - corsPolicy: - description: Cross-Origin Resource Sharing policy (CORS). - properties: - allowCredentials: - description: Indicates whether the caller is allowed to send the actual request (not the preflight) using credentials. - nullable: true - type: boolean - allowHeaders: - description: List of HTTP headers that can be used when requesting the resource. - items: - type: string - type: array - allowMethods: - description: List of HTTP methods allowed to access the resource. - items: - type: string - type: array - allowOrigin: - items: - type: string - type: array - allowOrigins: - description: String patterns that match allowed origins. - items: - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - type: array - exposeHeaders: - description: A list of HTTP headers that the browsers are allowed to access. - items: - type: string - type: array - maxAge: - description: Specifies how long the results of a preflight request can be cached. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - unmatchedPreflights: - description: |- - Indicates whether preflight requests not matching the configured allowed origin shouldn't be forwarded to the upstream. + type: array + randomSamplingPercentage: + description: Controls the rate at which traffic will be selected + for tracing if no prior sampling decision has been made. + format: double + maximum: 100 + minimum: 0 + nullable: true + type: number + useRequestIdForTraceSampling: + nullable: true + type: boolean + type: object + type: array + type: object + x-kubernetes-validations: + - message: only one of targetRefs or selector can be set + rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + + (has(self.targetRefs) ? 1 : 0) <= 1' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. - Valid Options: FORWARD, IGNORE - enum: - - UNSPECIFIED - - FORWARD - - IGNORE + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} + +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: istio + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/part-of: istio + app.kubernetes.io/version: 1.29.4 + helm.sh/chart: base-1.29.4 + name: virtualservices.networking.istio.io +spec: + group: networking.istio.io + names: + categories: + - istio-io + - networking-istio-io + kind: VirtualService + listKind: VirtualServiceList + plural: virtualservices + shortNames: + - vs + singular: virtualservice + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: The names of gateways and sidecars that should apply these routes + jsonPath: .spec.gateways + name: Gateways + type: string + - description: The destination hosts to which traffic is being sent + jsonPath: .spec.hosts + name: Hosts + type: string + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting label/content routing, sni routing, + etc. See more details at: https://istio.io/docs/reference/config/networking/virtual-service.html' + properties: + exportTo: + description: A list of namespaces to which this virtual service is + exported. + items: + type: string + type: array + gateways: + description: The names of gateways and sidecars that should apply + these routes. + items: + type: string + type: array + hosts: + description: The destination hosts to which traffic is being sent. + items: + type: string + type: array + http: + description: An ordered list of route rules for HTTP traffic. + items: + properties: + corsPolicy: + description: Cross-Origin Resource Sharing policy (CORS). + properties: + allowCredentials: + description: Indicates whether the caller is allowed to + send the actual request (not the preflight) using credentials. + nullable: true + type: boolean + allowHeaders: + description: List of HTTP headers that can be used when + requesting the resource. + items: type: string - type: object - delegate: - description: Delegate is used to specify the particular VirtualService which can be used to define delegate HTTPRoute. - properties: - name: - description: Name specifies the name of the delegate VirtualService. + type: array + allowMethods: + description: List of HTTP methods allowed to access the + resource. + items: type: string - namespace: - description: Namespace specifies the namespace where the delegate VirtualService resides. + type: array + allowOrigin: + items: type: string - type: object - directResponse: - description: A HTTP rule can either return a direct_response, redirect or forward (default) traffic. - properties: - body: - description: Specifies the content of the response body. + type: array + allowOrigins: + description: String patterns that match allowed origins. + items: oneOf: - - not: - anyOf: - - required: - - string - - required: - - bytes - - required: - - string - - required: - - bytes + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex properties: - bytes: - description: response body as base64 encoded bytes. - format: byte + exact: + type: string + prefix: type: string - string: + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string type: object - status: - description: Specifies the HTTP response status to be returned. - maximum: 4294967295 - minimum: 0 - type: integer - required: - - status - type: object - fault: - description: Fault injection policy to apply on HTTP traffic at the client side. - properties: - abort: - description: Abort Http request attempts and return error codes back to downstream service, giving the impression that the upstream service is faulty. - oneOf: - - not: - anyOf: - - required: - - httpStatus - - required: - - grpcStatus - - required: - - http2Error + type: array + exposeHeaders: + description: A list of HTTP headers that the browsers are + allowed to access. + items: + type: string + type: array + maxAge: + description: Specifies how long the results of a preflight + request can be cached. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + unmatchedPreflights: + description: |- + Indicates whether preflight requests not matching the configured allowed origin shouldn't be forwarded to the upstream. + + Valid Options: FORWARD, IGNORE + enum: + - UNSPECIFIED + - FORWARD + - IGNORE + type: string + type: object + delegate: + description: Delegate is used to specify the particular VirtualService + which can be used to define delegate HTTPRoute. + properties: + name: + description: Name specifies the name of the delegate VirtualService. + type: string + namespace: + description: Namespace specifies the namespace where the + delegate VirtualService resides. + type: string + type: object + directResponse: + description: A HTTP rule can either return a direct_response, + redirect or forward (default) traffic. + properties: + body: + description: Specifies the content of the response body. + oneOf: + - not: + anyOf: - required: - - httpStatus + - string - required: - - grpcStatus + - bytes + - required: + - string + - required: + - bytes + properties: + bytes: + description: response body as base64 encoded bytes. + format: byte + type: string + string: + type: string + type: object + status: + description: Specifies the HTTP response status to be returned. + maximum: 4294967295 + minimum: 0 + type: integer + required: + - status + type: object + fault: + description: Fault injection policy to apply on HTTP traffic + at the client side. + properties: + abort: + description: Abort Http request attempts and return error + codes back to downstream service, giving the impression + that the upstream service is faulty. + oneOf: + - not: + anyOf: - required: - - http2Error - properties: - grpcStatus: - description: GRPC status code to use to abort the request. - type: string - http2Error: - type: string - httpStatus: - description: HTTP status code to use to abort the Http request. - format: int32 - type: integer - percentage: - description: Percentage of requests to be aborted with the error code provided. - properties: - value: - format: double - type: number - type: object - type: object - delay: - description: Delay requests before forwarding, emulating various failures such as network issues, overloaded upstream service, etc. - oneOf: - - not: - anyOf: - - required: - - fixedDelay - - required: - - exponentialDelay + - httpStatus - required: - - fixedDelay + - grpcStatus - required: - - exponentialDelay - properties: - exponentialDelay: + - http2Error + - required: + - httpStatus + - required: + - grpcStatus + - required: + - http2Error + properties: + grpcStatus: + description: GRPC status code to use to abort the request. + type: string + http2Error: + type: string + httpStatus: + description: HTTP status code to use to abort the Http + request. + format: int32 + type: integer + percentage: + description: Percentage of requests to be aborted with + the error code provided. + properties: + value: + format: double + type: number + type: object + type: object + delay: + description: Delay requests before forwarding, emulating + various failures such as network issues, overloaded upstream + service, etc. + oneOf: + - not: + anyOf: + - required: + - fixedDelay + - required: + - exponentialDelay + - required: + - fixedDelay + - required: + - exponentialDelay + properties: + exponentialDelay: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + fixedDelay: + description: Add a fixed delay before forwarding the + request. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + percent: + description: Percentage of requests on which the delay + will be injected (0-100). + format: int32 + type: integer + percentage: + description: Percentage of requests on which the delay + will be injected. + properties: + value: + format: double + type: number + type: object + type: object + type: object + headers: + properties: + request: + properties: + add: + additionalProperties: type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - fixedDelay: - description: Add a fixed delay before forwarding the request. + type: object + remove: + items: type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - percent: - description: Percentage of requests on which the delay will be injected (0-100). - format: int32 - type: integer - percentage: - description: Percentage of requests on which the delay will be injected. - properties: - value: - format: double - type: number - type: object - type: object - type: object - headers: - properties: - request: - properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object - type: object - response: - properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object - type: object - type: object - match: - description: Match conditions to be satisfied for the rule to be activated. - items: + type: array + set: + additionalProperties: + type: string + type: object + type: object + response: properties: - authority: - description: 'HTTP Authority values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string + add: + additionalProperties: + type: string type: object - gateways: - description: Names of gateways where the rule should be applied. + remove: items: type: string type: array - headers: + set: additionalProperties: - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - description: The header keys must be lowercase and use hyphen as the separator, e.g. + type: string type: object - ignoreUriCase: - description: Flag to specify whether the URI matching should be case-insensitive. - type: boolean - method: - description: 'HTTP Method values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: object + type: object + match: + description: Match conditions to be satisfied for the rule to + be activated. + items: + properties: + authority: + description: 'HTTP Authority values are case-sensitive + and formatted as follows: - `exact: "value"` for exact + string match - `prefix: "value"` for prefix-based match + - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + gateways: + description: Names of gateways where the rule should be + applied. + items: + type: string + type: array + headers: + additionalProperties: oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: + - not: + anyOf: + - required: - exact - - required: + - required: - prefix - - required: + - required: - regex + - required: + - exact + - required: + - prefix + - required: + - regex properties: exact: type: string @@ -11896,96 +13241,68 @@ spec: description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string type: object - name: - description: The name assigned to a match. - type: string - port: - description: Specifies the ports on the host that is being addressed. - maximum: 4294967295 - minimum: 0 - type: integer - queryParams: - additionalProperties: - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - description: Query parameters for matching. - type: object - scheme: - description: 'URI Scheme values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex + description: The header keys must be lowercase and use + hyphen as the separator, e.g. + type: object + ignoreUriCase: + description: Flag to specify whether the URI matching + should be case-insensitive. + type: boolean + method: + description: 'HTTP Method values are case-sensitive and + formatted as follows: - `exact: "value"` for exact string + match - `prefix: "value"` for prefix-based match - `regex: + "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: - required: - - exact + - exact - required: - - prefix + - prefix - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - sourceLabels: - additionalProperties: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: type: string - description: One or more labels that constrain the applicability of a rule to source (client) workloads with the given labels. - type: object - sourceNamespace: - description: Source namespace constraining the applicability of a rule to workloads in that namespace. - type: string - statPrefix: - description: The human readable prefix to use when emitting statistics for this route. - type: string - uri: - description: 'URI to match values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + name: + description: The name assigned to a match. + type: string + port: + description: Specifies the ports on the host that is being + addressed. + maximum: 4294967295 + minimum: 0 + type: integer + queryParams: + additionalProperties: oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: + - not: + anyOf: + - required: - exact - - required: + - required: - prefix - - required: + - required: - regex + - required: + - exact + - required: + - prefix + - required: + - regex properties: exact: type: string @@ -11995,781 +13312,1049 @@ spec: description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string type: object - withoutHeaders: - additionalProperties: - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - description: withoutHeader has the same syntax with the header, but has opposite meaning. - type: object - type: object - type: array - mirror: - description: Mirror HTTP traffic to a another destination in addition to forwarding the requests to the intended destination. - properties: - host: - description: The name of a service from the service registry. - type: string - port: - description: Specifies the port on the host that is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer + description: Query parameters for matching. type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - mirror_percent: - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - mirrorPercent: - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - mirrorPercentage: - description: Percentage of the traffic to be mirrored by the `mirror` field. - properties: - value: - format: double - type: number - type: object - mirrors: - description: Specifies the destinations to mirror HTTP traffic in addition to the original destination. - items: - properties: - destination: - description: Destination specifies the target of the mirror operation. - properties: - host: - description: The name of a service from the service registry. - type: string - port: - description: Specifies the port on the host that is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - percentage: - description: Percentage of the traffic to be mirrored by the `destination` field. - properties: - value: - format: double - type: number - type: object - required: - - destination - type: object - type: array - name: - description: The name assigned to the route for debugging purposes. - type: string - redirect: - description: A HTTP rule can either return a direct_response, redirect or forward (default) traffic. - oneOf: - - not: - anyOf: + scheme: + description: 'URI Scheme values are case-sensitive and + formatted as follows: - `exact: "value"` for exact string + match - `prefix: "value"` for prefix-based match - `regex: + "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: - required: - - port + - exact - required: - - derivePort - - required: - - port - - required: - - derivePort - properties: - authority: - description: On a redirect, overwrite the Authority/Host portion of the URL with this value. - type: string - derivePort: - description: |- - On a redirect, dynamically set the port: * FROM_PROTOCOL_DEFAULT: automatically set to 80 for HTTP and 443 for HTTPS. - - Valid Options: FROM_PROTOCOL_DEFAULT, FROM_REQUEST_PORT - enum: - - FROM_PROTOCOL_DEFAULT - - FROM_REQUEST_PORT - type: string - port: - description: On a redirect, overwrite the port portion of the URL with this value. - maximum: 4294967295 - minimum: 0 - type: integer - redirectCode: - description: On a redirect, Specifies the HTTP status code to use in the redirect response. - maximum: 4294967295 - minimum: 0 - type: integer - scheme: - description: On a redirect, overwrite the scheme portion of the URL with this value. - type: string - uri: - description: On a redirect, overwrite the Path portion of the URL with this value. - type: string - type: object - retries: - description: Retry policy for HTTP requests. - properties: - attempts: - description: Number of retries to be allowed for a given request. - format: int32 - type: integer - backoff: - description: Specifies the minimum duration between retry attempts. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - perTryTimeout: - description: Timeout per attempt for a given request, including the initial call and any retries. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - retryIgnorePreviousHosts: - description: Flag to specify whether the retries should ignore previously tried hosts during retry. - nullable: true - type: boolean - retryOn: - description: Specifies the conditions under which retry takes place. - type: string - retryRemoteLocalities: - description: Flag to specify whether the retries should retry to other localities. - nullable: true - type: boolean - type: object - rewrite: - description: Rewrite HTTP URIs and Authority headers. - properties: - authority: - description: rewrite the Authority/Host header with this value. - type: string - uri: - description: rewrite the path (or the prefix) portion of the URI with this value. - type: string - uriRegexRewrite: - description: rewrite the path portion of the URI with the specified regex. + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex properties: - match: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + exact: type: string - rewrite: - description: The string that should replace into matching portions of original URI. + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string type: object - type: object - route: - description: A HTTP rule can either return a direct_response, redirect or forward (default) traffic. - items: - properties: - destination: - description: Destination uniquely identifies the instances of a service to which the request/connection should be forwarded to. - properties: - host: - description: The name of a service from the service registry. - type: string - port: - description: Specifies the port on the host that is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - headers: - properties: - request: - properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object - type: object - response: - properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object - type: object - type: object - weight: - description: Weight specifies the relative proportion of traffic to be forwarded to the destination. - format: int32 - type: integer - required: - - destination - type: object - type: array - timeout: - description: Timeout for HTTP requests, default is disabled. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: array - tcp: - description: An ordered list of route rules for opaque TCP traffic. - items: - properties: - match: - description: Match conditions to be satisfied for the rule to be activated. - items: - properties: - destinationSubnets: - description: IPv4 or IPv6 ip addresses of destination with optional subnet. - items: + sourceLabels: + additionalProperties: + type: string + description: One or more labels that constrain the applicability + of a rule to source (client) workloads with the given + labels. + type: object + sourceNamespace: + description: Source namespace constraining the applicability + of a rule to workloads in that namespace. + type: string + statPrefix: + description: The human readable prefix to use when emitting + statistics for this route. + type: string + uri: + description: 'URI to match values are case-sensitive and + formatted as follows: - `exact: "value"` for exact string + match - `prefix: "value"` for prefix-based match - `regex: + "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: type: string - type: array - gateways: - description: Names of gateways where the rule should be applied. - items: + prefix: type: string - type: array - port: - description: Specifies the port on the host that is being addressed. - maximum: 4294967295 - minimum: 0 - type: integer - sourceLabels: - additionalProperties: + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string - description: One or more labels that constrain the applicability of a rule to workloads with the given labels. - type: object - sourceNamespace: - description: Source namespace constraining the applicability of a rule to workloads in that namespace. - type: string - sourceSubnet: - type: string - type: object - type: array - route: - description: The destination to which the connection should be forwarded to. - items: - properties: - destination: - description: Destination uniquely identifies the instances of a service to which the request/connection should be forwarded to. + type: object + withoutHeaders: + additionalProperties: + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex properties: - host: - description: The name of a service from the service registry. + exact: type: string - port: - description: Specifies the port on the host that is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string - required: - - host type: object - weight: - description: Weight specifies the relative proportion of traffic to be forwarded to the destination. - format: int32 - type: integer - required: - - destination - type: object - type: array - type: object - type: array - tls: - description: An ordered list of route rule for non-terminated TLS & HTTPS traffic. - items: - properties: - match: - description: Match conditions to be satisfied for the rule to be activated. - items: + description: withoutHeader has the same syntax with the + header, but has opposite meaning. + type: object + type: object + type: array + mirror: + description: Mirror HTTP traffic to a another destination in + addition to forwarding the requests to the intended destination. + properties: + host: + description: The name of a service from the service registry. + type: string + port: + description: Specifies the port on the host that is being + addressed. properties: - destinationSubnets: - description: IPv4 or IPv6 ip addresses of destination with optional subnet. - items: - type: string - type: array - gateways: - description: Names of gateways where the rule should be applied. - items: - type: string - type: array - port: - description: Specifies the port on the host that is being addressed. + number: maximum: 4294967295 minimum: 0 type: integer - sniHosts: - description: SNI (server name indicator) to match on. - items: + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + mirror_percent: + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + mirrorPercent: + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + mirrorPercentage: + description: Percentage of the traffic to be mirrored by the + `mirror` field. + properties: + value: + format: double + type: number + type: object + mirrors: + description: Specifies the destinations to mirror HTTP traffic + in addition to the original destination. + items: + properties: + destination: + description: Destination specifies the target of the mirror + operation. + properties: + host: + description: The name of a service from the service + registry. type: string - type: array - sourceLabels: - additionalProperties: + port: + description: Specifies the port on the host that is + being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. type: string - description: One or more labels that constrain the applicability of a rule to workloads with the given labels. - type: object - sourceNamespace: - description: Source namespace constraining the applicability of a rule to workloads in that namespace. - type: string - required: - - sniHosts - type: object - type: array - route: - description: The destination to which the connection should be forwarded to. - items: + required: + - host + type: object + percentage: + description: Percentage of the traffic to be mirrored + by the `destination` field. + properties: + value: + format: double + type: number + type: object + required: + - destination + type: object + type: array + name: + description: The name assigned to the route for debugging purposes. + type: string + redirect: + description: A HTTP rule can either return a direct_response, + redirect or forward (default) traffic. + oneOf: + - not: + anyOf: + - required: + - port + - required: + - derivePort + - required: + - port + - required: + - derivePort + properties: + authority: + description: On a redirect, overwrite the Authority/Host + portion of the URL with this value. + type: string + derivePort: + description: |- + On a redirect, dynamically set the port: * FROM_PROTOCOL_DEFAULT: automatically set to 80 for HTTP and 443 for HTTPS. + + Valid Options: FROM_PROTOCOL_DEFAULT, FROM_REQUEST_PORT + enum: + - FROM_PROTOCOL_DEFAULT + - FROM_REQUEST_PORT + type: string + port: + description: On a redirect, overwrite the port portion of + the URL with this value. + maximum: 4294967295 + minimum: 0 + type: integer + redirectCode: + description: On a redirect, Specifies the HTTP status code + to use in the redirect response. + maximum: 4294967295 + minimum: 0 + type: integer + scheme: + description: On a redirect, overwrite the scheme portion + of the URL with this value. + type: string + uri: + description: On a redirect, overwrite the Path portion of + the URL with this value. + type: string + type: object + retries: + description: Retry policy for HTTP requests. + properties: + attempts: + description: Number of retries to be allowed for a given + request. + format: int32 + type: integer + backoff: + description: Specifies the minimum duration between retry + attempts. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + perTryTimeout: + description: Timeout per attempt for a given request, including + the initial call and any retries. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + retryIgnorePreviousHosts: + description: Flag to specify whether the retries should + ignore previously tried hosts during retry. + nullable: true + type: boolean + retryOn: + description: Specifies the conditions under which retry + takes place. + type: string + retryRemoteLocalities: + description: Flag to specify whether the retries should + retry to other localities. + nullable: true + type: boolean + type: object + rewrite: + description: Rewrite HTTP URIs and Authority headers. + properties: + authority: + description: rewrite the Authority/Host header with this + value. + type: string + uri: + description: rewrite the path (or the prefix) portion of + the URI with this value. + type: string + uriRegexRewrite: + description: rewrite the path portion of the URI with the + specified regex. properties: - destination: - description: Destination uniquely identifies the instances of a service to which the request/connection should be forwarded to. - properties: - host: - description: The name of a service from the service registry. - type: string - port: - description: Specifies the port on the host that is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - weight: - description: Weight specifies the relative proportion of traffic to be forwarded to the destination. - format: int32 - type: integer - required: - - destination + match: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + rewrite: + description: The string that should replace into matching + portions of original URI. + type: string type: object - type: array - required: - - match - type: object - type: array - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. - - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: + type: object + route: + description: A HTTP rule can either return a direct_response, + redirect or forward (default) traffic. + items: properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string + destination: + description: Destination uniquely identifies the instances + of a service to which the request/connection should + be forwarded to. + properties: + host: + description: The name of a service from the service + registry. + type: string + port: + description: Specifies the port on the host that is + being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + headers: + properties: + request: + properties: + add: + additionalProperties: + type: string + type: object + remove: + items: + type: string + type: array + set: + additionalProperties: + type: string + type: object + type: object + response: + properties: + add: + additionalProperties: + type: string + type: object + remove: + items: + type: string + type: array + set: + additionalProperties: + type: string + type: object + type: object + type: object + weight: + description: Weight specifies the relative proportion + of traffic to be forwarded to the destination. + format: int32 + type: integer + required: + - destination type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: true - subresources: - status: {} - - additionalPrinterColumns: - - description: The names of gateways and sidecars that should apply these routes - jsonPath: .spec.gateways - name: Gateways - type: string - - description: The destination hosts to which traffic is being sent - jsonPath: .spec.hosts - name: Hosts - type: string - - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1alpha3 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting label/content routing, sni routing, etc. See more details at: https://istio.io/docs/reference/config/networking/virtual-service.html' - properties: - exportTo: - description: A list of namespaces to which this virtual service is exported. - items: - type: string - type: array - gateways: - description: The names of gateways and sidecars that should apply these routes. - items: - type: string - type: array - hosts: - description: The destination hosts to which traffic is being sent. - items: - type: string - type: array - http: - description: An ordered list of route rules for HTTP traffic. - items: - properties: - corsPolicy: - description: Cross-Origin Resource Sharing policy (CORS). + type: array + timeout: + description: Timeout for HTTP requests, default is disabled. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + type: array + tcp: + description: An ordered list of route rules for opaque TCP traffic. + items: + properties: + match: + description: Match conditions to be satisfied for the rule to + be activated. + items: properties: - allowCredentials: - description: Indicates whether the caller is allowed to send the actual request (not the preflight) using credentials. - nullable: true - type: boolean - allowHeaders: - description: List of HTTP headers that can be used when requesting the resource. + destinationSubnets: + description: IPv4 or IPv6 ip addresses of destination + with optional subnet. items: type: string type: array - allowMethods: - description: List of HTTP methods allowed to access the resource. + gateways: + description: Names of gateways where the rule should be + applied. items: type: string type: array - allowOrigin: + port: + description: Specifies the port on the host that is being + addressed. + maximum: 4294967295 + minimum: 0 + type: integer + sourceLabels: + additionalProperties: + type: string + description: One or more labels that constrain the applicability + of a rule to workloads with the given labels. + type: object + sourceNamespace: + description: Source namespace constraining the applicability + of a rule to workloads in that namespace. + type: string + sourceSubnet: + type: string + type: object + type: array + route: + description: The destination to which the connection should + be forwarded to. + items: + properties: + destination: + description: Destination uniquely identifies the instances + of a service to which the request/connection should + be forwarded to. + properties: + host: + description: The name of a service from the service + registry. + type: string + port: + description: Specifies the port on the host that is + being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + weight: + description: Weight specifies the relative proportion + of traffic to be forwarded to the destination. + format: int32 + type: integer + required: + - destination + type: object + type: array + type: object + type: array + tls: + description: An ordered list of route rule for non-terminated TLS + & HTTPS traffic. + items: + properties: + match: + description: Match conditions to be satisfied for the rule to + be activated. + items: + properties: + destinationSubnets: + description: IPv4 or IPv6 ip addresses of destination + with optional subnet. items: type: string type: array - allowOrigins: - description: String patterns that match allowed origins. + gateways: + description: Names of gateways where the rule should be + applied. items: - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object + type: string type: array - exposeHeaders: - description: A list of HTTP headers that the browsers are allowed to access. + port: + description: Specifies the port on the host that is being + addressed. + maximum: 4294967295 + minimum: 0 + type: integer + sniHosts: + description: SNI (server name indicator) to match on. items: type: string type: array - maxAge: - description: Specifies how long the results of a preflight request can be cached. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - unmatchedPreflights: - description: |- - Indicates whether preflight requests not matching the configured allowed origin shouldn't be forwarded to the upstream. - - Valid Options: FORWARD, IGNORE - enum: - - UNSPECIFIED - - FORWARD - - IGNORE - type: string - type: object - delegate: - description: Delegate is used to specify the particular VirtualService which can be used to define delegate HTTPRoute. - properties: - name: - description: Name specifies the name of the delegate VirtualService. - type: string - namespace: - description: Namespace specifies the namespace where the delegate VirtualService resides. + sourceLabels: + additionalProperties: + type: string + description: One or more labels that constrain the applicability + of a rule to workloads with the given labels. + type: object + sourceNamespace: + description: Source namespace constraining the applicability + of a rule to workloads in that namespace. type: string + required: + - sniHosts type: object - directResponse: - description: A HTTP rule can either return a direct_response, redirect or forward (default) traffic. + type: array + route: + description: The destination to which the connection should + be forwarded to. + items: properties: - body: - description: Specifies the content of the response body. - oneOf: - - not: - anyOf: - - required: - - string - - required: - - bytes - - required: - - string - - required: - - bytes + destination: + description: Destination uniquely identifies the instances + of a service to which the request/connection should + be forwarded to. properties: - bytes: - description: response body as base64 encoded bytes. - format: byte + host: + description: The name of a service from the service + registry. type: string - string: + port: + description: Specifies the port on the host that is + being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. type: string + required: + - host type: object - status: - description: Specifies the HTTP response status to be returned. - maximum: 4294967295 - minimum: 0 + weight: + description: Weight specifies the relative proportion + of traffic to be forwarded to the destination. + format: int32 type: integer required: - - status + - destination type: object - fault: - description: Fault injection policy to apply on HTTP traffic at the client side. - properties: - abort: - description: Abort Http request attempts and return error codes back to downstream service, giving the impression that the upstream service is faulty. + type: array + required: + - match + type: object + type: array + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - description: The names of gateways and sidecars that should apply these routes + jsonPath: .spec.gateways + name: Gateways + type: string + - description: The destination hosts to which traffic is being sent + jsonPath: .spec.hosts + name: Hosts + type: string + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha3 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting label/content routing, sni routing, + etc. See more details at: https://istio.io/docs/reference/config/networking/virtual-service.html' + properties: + exportTo: + description: A list of namespaces to which this virtual service is + exported. + items: + type: string + type: array + gateways: + description: The names of gateways and sidecars that should apply + these routes. + items: + type: string + type: array + hosts: + description: The destination hosts to which traffic is being sent. + items: + type: string + type: array + http: + description: An ordered list of route rules for HTTP traffic. + items: + properties: + corsPolicy: + description: Cross-Origin Resource Sharing policy (CORS). + properties: + allowCredentials: + description: Indicates whether the caller is allowed to + send the actual request (not the preflight) using credentials. + nullable: true + type: boolean + allowHeaders: + description: List of HTTP headers that can be used when + requesting the resource. + items: + type: string + type: array + allowMethods: + description: List of HTTP methods allowed to access the + resource. + items: + type: string + type: array + allowOrigin: + items: + type: string + type: array + allowOrigins: + description: String patterns that match allowed origins. + items: oneOf: - - not: - anyOf: - - required: - - httpStatus - - required: - - grpcStatus - - required: - - http2Error + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + type: array + exposeHeaders: + description: A list of HTTP headers that the browsers are + allowed to access. + items: + type: string + type: array + maxAge: + description: Specifies how long the results of a preflight + request can be cached. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + unmatchedPreflights: + description: |- + Indicates whether preflight requests not matching the configured allowed origin shouldn't be forwarded to the upstream. + + Valid Options: FORWARD, IGNORE + enum: + - UNSPECIFIED + - FORWARD + - IGNORE + type: string + type: object + delegate: + description: Delegate is used to specify the particular VirtualService + which can be used to define delegate HTTPRoute. + properties: + name: + description: Name specifies the name of the delegate VirtualService. + type: string + namespace: + description: Namespace specifies the namespace where the + delegate VirtualService resides. + type: string + type: object + directResponse: + description: A HTTP rule can either return a direct_response, + redirect or forward (default) traffic. + properties: + body: + description: Specifies the content of the response body. + oneOf: + - not: + anyOf: + - required: + - string + - required: + - bytes + - required: + - string + - required: + - bytes + properties: + bytes: + description: response body as base64 encoded bytes. + format: byte + type: string + string: + type: string + type: object + status: + description: Specifies the HTTP response status to be returned. + maximum: 4294967295 + minimum: 0 + type: integer + required: + - status + type: object + fault: + description: Fault injection policy to apply on HTTP traffic + at the client side. + properties: + abort: + description: Abort Http request attempts and return error + codes back to downstream service, giving the impression + that the upstream service is faulty. + oneOf: + - not: + anyOf: + - required: + - httpStatus + - required: + - grpcStatus - required: - - httpStatus + - http2Error + - required: + - httpStatus + - required: + - grpcStatus + - required: + - http2Error + properties: + grpcStatus: + description: GRPC status code to use to abort the request. + type: string + http2Error: + type: string + httpStatus: + description: HTTP status code to use to abort the Http + request. + format: int32 + type: integer + percentage: + description: Percentage of requests to be aborted with + the error code provided. + properties: + value: + format: double + type: number + type: object + type: object + delay: + description: Delay requests before forwarding, emulating + various failures such as network issues, overloaded upstream + service, etc. + oneOf: + - not: + anyOf: - required: - - grpcStatus + - fixedDelay - required: - - http2Error + - exponentialDelay + - required: + - fixedDelay + - required: + - exponentialDelay + properties: + exponentialDelay: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + fixedDelay: + description: Add a fixed delay before forwarding the + request. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + percent: + description: Percentage of requests on which the delay + will be injected (0-100). + format: int32 + type: integer + percentage: + description: Percentage of requests on which the delay + will be injected. + properties: + value: + format: double + type: number + type: object + type: object + type: object + headers: + properties: + request: + properties: + add: + additionalProperties: + type: string + type: object + remove: + items: + type: string + type: array + set: + additionalProperties: + type: string + type: object + type: object + response: + properties: + add: + additionalProperties: + type: string + type: object + remove: + items: + type: string + type: array + set: + additionalProperties: + type: string + type: object + type: object + type: object + match: + description: Match conditions to be satisfied for the rule to + be activated. + items: + properties: + authority: + description: 'HTTP Authority values are case-sensitive + and formatted as follows: - `exact: "value"` for exact + string match - `prefix: "value"` for prefix-based match + - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex properties: - grpcStatus: - description: GRPC status code to use to abort the request. + exact: type: string - http2Error: + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string - httpStatus: - description: HTTP status code to use to abort the Http request. - format: int32 - type: integer - percentage: - description: Percentage of requests to be aborted with the error code provided. - properties: - value: - format: double - type: number - type: object type: object - delay: - description: Delay requests before forwarding, emulating various failures such as network issues, overloaded upstream service, etc. - oneOf: + gateways: + description: Names of gateways where the rule should be + applied. + items: + type: string + type: array + headers: + additionalProperties: + oneOf: - not: anyOf: - - required: - - fixedDelay - - required: - - exponentialDelay + - required: + - exact + - required: + - prefix + - required: + - regex - required: - - fixedDelay + - exact - required: - - exponentialDelay - properties: - exponentialDelay: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - fixedDelay: - description: Add a fixed delay before forwarding the request. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - percent: - description: Percentage of requests on which the delay will be injected (0-100). - format: int32 - type: integer - percentage: - description: Percentage of requests on which the delay will be injected. - properties: - value: - format: double - type: number - type: object - type: object - type: object - headers: - properties: - request: - properties: - add: - additionalProperties: + - prefix + - required: + - regex + properties: + exact: type: string - type: object - remove: - items: + prefix: type: string - type: array - set: - additionalProperties: + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string - type: object + type: object + description: The header keys must be lowercase and use + hyphen as the separator, e.g. type: object - response: + ignoreUriCase: + description: Flag to specify whether the URI matching + should be case-insensitive. + type: boolean + method: + description: 'HTTP Method values are case-sensitive and + formatted as follows: - `exact: "value"` for exact string + match - `prefix: "value"` for prefix-based match - `regex: + "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string type: object - type: object - match: - description: Match conditions to be satisfied for the rule to be activated. - items: - properties: - authority: - description: 'HTTP Authority values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + name: + description: The name assigned to a match. + type: string + port: + description: Specifies the ports on the host that is being + addressed. + maximum: 4294967295 + minimum: 0 + type: integer + queryParams: + additionalProperties: oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: + - not: + anyOf: + - required: - exact - - required: + - required: - prefix - - required: + - required: - regex + - required: + - exact + - required: + - prefix + - required: + - regex properties: exact: type: string @@ -12779,59 +14364,98 @@ spec: description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string type: object - gateways: - description: Names of gateways where the rule should be applied. - items: + description: Query parameters for matching. + type: object + scheme: + description: 'URI Scheme values are case-sensitive and + formatted as follows: - `exact: "value"` for exact string + match - `prefix: "value"` for prefix-based match - `regex: + "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: type: string - type: array - headers: - additionalProperties: - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - description: The header keys must be lowercase and use hyphen as the separator, e.g. - type: object - ignoreUriCase: - description: Flag to specify whether the URI matching should be case-insensitive. - type: boolean - method: - description: 'HTTP Method values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + sourceLabels: + additionalProperties: + type: string + description: One or more labels that constrain the applicability + of a rule to source (client) workloads with the given + labels. + type: object + sourceNamespace: + description: Source namespace constraining the applicability + of a rule to workloads in that namespace. + type: string + statPrefix: + description: The human readable prefix to use when emitting + statistics for this route. + type: string + uri: + description: 'URI to match values are case-sensitive and + formatted as follows: - `exact: "value"` for exact string + match - `prefix: "value"` for prefix-based match - `regex: + "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: - required: - - exact + - exact - required: - - prefix + - prefix - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + withoutHeaders: + additionalProperties: + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: - regex + - required: + - exact + - required: + - prefix + - required: + - regex properties: exact: type: string @@ -12841,676 +14465,877 @@ spec: description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string type: object - name: - description: The name assigned to a match. + description: withoutHeader has the same syntax with the + header, but has opposite meaning. + type: object + type: object + type: array + mirror: + description: Mirror HTTP traffic to a another destination in + addition to forwarding the requests to the intended destination. + properties: + host: + description: The name of a service from the service registry. + type: string + port: + description: Specifies the port on the host that is being + addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + mirror_percent: + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + mirrorPercent: + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + mirrorPercentage: + description: Percentage of the traffic to be mirrored by the + `mirror` field. + properties: + value: + format: double + type: number + type: object + mirrors: + description: Specifies the destinations to mirror HTTP traffic + in addition to the original destination. + items: + properties: + destination: + description: Destination specifies the target of the mirror + operation. + properties: + host: + description: The name of a service from the service + registry. + type: string + port: + description: Specifies the port on the host that is + being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + percentage: + description: Percentage of the traffic to be mirrored + by the `destination` field. + properties: + value: + format: double + type: number + type: object + required: + - destination + type: object + type: array + name: + description: The name assigned to the route for debugging purposes. + type: string + redirect: + description: A HTTP rule can either return a direct_response, + redirect or forward (default) traffic. + oneOf: + - not: + anyOf: + - required: + - port + - required: + - derivePort + - required: + - port + - required: + - derivePort + properties: + authority: + description: On a redirect, overwrite the Authority/Host + portion of the URL with this value. + type: string + derivePort: + description: |- + On a redirect, dynamically set the port: * FROM_PROTOCOL_DEFAULT: automatically set to 80 for HTTP and 443 for HTTPS. + + Valid Options: FROM_PROTOCOL_DEFAULT, FROM_REQUEST_PORT + enum: + - FROM_PROTOCOL_DEFAULT + - FROM_REQUEST_PORT + type: string + port: + description: On a redirect, overwrite the port portion of + the URL with this value. + maximum: 4294967295 + minimum: 0 + type: integer + redirectCode: + description: On a redirect, Specifies the HTTP status code + to use in the redirect response. + maximum: 4294967295 + minimum: 0 + type: integer + scheme: + description: On a redirect, overwrite the scheme portion + of the URL with this value. + type: string + uri: + description: On a redirect, overwrite the Path portion of + the URL with this value. + type: string + type: object + retries: + description: Retry policy for HTTP requests. + properties: + attempts: + description: Number of retries to be allowed for a given + request. + format: int32 + type: integer + backoff: + description: Specifies the minimum duration between retry + attempts. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + perTryTimeout: + description: Timeout per attempt for a given request, including + the initial call and any retries. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + retryIgnorePreviousHosts: + description: Flag to specify whether the retries should + ignore previously tried hosts during retry. + nullable: true + type: boolean + retryOn: + description: Specifies the conditions under which retry + takes place. + type: string + retryRemoteLocalities: + description: Flag to specify whether the retries should + retry to other localities. + nullable: true + type: boolean + type: object + rewrite: + description: Rewrite HTTP URIs and Authority headers. + properties: + authority: + description: rewrite the Authority/Host header with this + value. + type: string + uri: + description: rewrite the path (or the prefix) portion of + the URI with this value. + type: string + uriRegexRewrite: + description: rewrite the path portion of the URI with the + specified regex. + properties: + match: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string - port: - description: Specifies the ports on the host that is being addressed. - maximum: 4294967295 - minimum: 0 - type: integer - queryParams: - additionalProperties: - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex + rewrite: + description: The string that should replace into matching + portions of original URI. + type: string + type: object + type: object + route: + description: A HTTP rule can either return a direct_response, + redirect or forward (default) traffic. + items: + properties: + destination: + description: Destination uniquely identifies the instances + of a service to which the request/connection should + be forwarded to. + properties: + host: + description: The name of a service from the service + registry. + type: string + port: + description: Specifies the port on the host that is + being addressed. properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string + number: + maximum: 4294967295 + minimum: 0 + type: integer type: object - description: Query parameters for matching. - type: object - scheme: - description: 'URI Scheme values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - sourceLabels: - additionalProperties: + subset: + description: The name of a subset within the service. type: string - description: One or more labels that constrain the applicability of a rule to source (client) workloads with the given labels. - type: object - sourceNamespace: - description: Source namespace constraining the applicability of a rule to workloads in that namespace. - type: string - statPrefix: - description: The human readable prefix to use when emitting statistics for this route. - type: string - uri: - description: 'URI to match values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - withoutHeaders: - additionalProperties: - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex + required: + - host + type: object + headers: + properties: + request: properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string + add: + additionalProperties: + type: string + type: object + remove: + items: + type: string + type: array + set: + additionalProperties: + type: string + type: object type: object - description: withoutHeader has the same syntax with the header, but has opposite meaning. - type: object - type: object - type: array - mirror: - description: Mirror HTTP traffic to a another destination in addition to forwarding the requests to the intended destination. + response: + properties: + add: + additionalProperties: + type: string + type: object + remove: + items: + type: string + type: array + set: + additionalProperties: + type: string + type: object + type: object + type: object + weight: + description: Weight specifies the relative proportion + of traffic to be forwarded to the destination. + format: int32 + type: integer + required: + - destination + type: object + type: array + timeout: + description: Timeout for HTTP requests, default is disabled. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + type: array + tcp: + description: An ordered list of route rules for opaque TCP traffic. + items: + properties: + match: + description: Match conditions to be satisfied for the rule to + be activated. + items: properties: - host: - description: The name of a service from the service registry. - type: string + destinationSubnets: + description: IPv4 or IPv6 ip addresses of destination + with optional subnet. + items: + type: string + type: array + gateways: + description: Names of gateways where the rule should be + applied. + items: + type: string + type: array port: - description: Specifies the port on the host that is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer + description: Specifies the port on the host that is being + addressed. + maximum: 4294967295 + minimum: 0 + type: integer + sourceLabels: + additionalProperties: + type: string + description: One or more labels that constrain the applicability + of a rule to workloads with the given labels. type: object - subset: - description: The name of a subset within the service. + sourceNamespace: + description: Source namespace constraining the applicability + of a rule to workloads in that namespace. + type: string + sourceSubnet: type: string - required: - - host type: object - mirror_percent: - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - mirrorPercent: - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - mirrorPercentage: - description: Percentage of the traffic to be mirrored by the `mirror` field. + type: array + route: + description: The destination to which the connection should + be forwarded to. + items: properties: - value: - format: double - type: number + destination: + description: Destination uniquely identifies the instances + of a service to which the request/connection should + be forwarded to. + properties: + host: + description: The name of a service from the service + registry. + type: string + port: + description: Specifies the port on the host that is + being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + weight: + description: Weight specifies the relative proportion + of traffic to be forwarded to the destination. + format: int32 + type: integer + required: + - destination type: object - mirrors: - description: Specifies the destinations to mirror HTTP traffic in addition to the original destination. - items: - properties: - destination: - description: Destination specifies the target of the mirror operation. - properties: - host: - description: The name of a service from the service registry. - type: string - port: - description: Specifies the port on the host that is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - percentage: - description: Percentage of the traffic to be mirrored by the `destination` field. - properties: - value: - format: double - type: number - type: object - required: - - destination - type: object - type: array - name: - description: The name assigned to the route for debugging purposes. - type: string - redirect: - description: A HTTP rule can either return a direct_response, redirect or forward (default) traffic. - oneOf: - - not: - anyOf: - - required: - - port - - required: - - derivePort - - required: - - port - - required: - - derivePort + type: array + type: object + type: array + tls: + description: An ordered list of route rule for non-terminated TLS + & HTTPS traffic. + items: + properties: + match: + description: Match conditions to be satisfied for the rule to + be activated. + items: properties: - authority: - description: On a redirect, overwrite the Authority/Host portion of the URL with this value. - type: string - derivePort: - description: |- - On a redirect, dynamically set the port: * FROM_PROTOCOL_DEFAULT: automatically set to 80 for HTTP and 443 for HTTPS. - - Valid Options: FROM_PROTOCOL_DEFAULT, FROM_REQUEST_PORT - enum: - - FROM_PROTOCOL_DEFAULT - - FROM_REQUEST_PORT - type: string + destinationSubnets: + description: IPv4 or IPv6 ip addresses of destination + with optional subnet. + items: + type: string + type: array + gateways: + description: Names of gateways where the rule should be + applied. + items: + type: string + type: array port: - description: On a redirect, overwrite the port portion of the URL with this value. - maximum: 4294967295 - minimum: 0 - type: integer - redirectCode: - description: On a redirect, Specifies the HTTP status code to use in the redirect response. + description: Specifies the port on the host that is being + addressed. maximum: 4294967295 minimum: 0 type: integer - scheme: - description: On a redirect, overwrite the scheme portion of the URL with this value. - type: string - uri: - description: On a redirect, overwrite the Path portion of the URL with this value. + sniHosts: + description: SNI (server name indicator) to match on. + items: + type: string + type: array + sourceLabels: + additionalProperties: + type: string + description: One or more labels that constrain the applicability + of a rule to workloads with the given labels. + type: object + sourceNamespace: + description: Source namespace constraining the applicability + of a rule to workloads in that namespace. type: string + required: + - sniHosts type: object - retries: - description: Retry policy for HTTP requests. + type: array + route: + description: The destination to which the connection should + be forwarded to. + items: properties: - attempts: - description: Number of retries to be allowed for a given request. + destination: + description: Destination uniquely identifies the instances + of a service to which the request/connection should + be forwarded to. + properties: + host: + description: The name of a service from the service + registry. + type: string + port: + description: Specifies the port on the host that is + being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + weight: + description: Weight specifies the relative proportion + of traffic to be forwarded to the destination. format: int32 type: integer - backoff: - description: Specifies the minimum duration between retry attempts. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - perTryTimeout: - description: Timeout per attempt for a given request, including the initial call and any retries. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - retryIgnorePreviousHosts: - description: Flag to specify whether the retries should ignore previously tried hosts during retry. - nullable: true - type: boolean - retryOn: - description: Specifies the conditions under which retry takes place. + required: + - destination + type: object + type: array + required: + - match + type: object + type: array + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - description: The names of gateways and sidecars that should apply these routes + jsonPath: .spec.gateways + name: Gateways + type: string + - description: The destination hosts to which traffic is being sent + jsonPath: .spec.hosts + name: Hosts + type: string + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting label/content routing, sni routing, + etc. See more details at: https://istio.io/docs/reference/config/networking/virtual-service.html' + properties: + exportTo: + description: A list of namespaces to which this virtual service is + exported. + items: + type: string + type: array + gateways: + description: The names of gateways and sidecars that should apply + these routes. + items: + type: string + type: array + hosts: + description: The destination hosts to which traffic is being sent. + items: + type: string + type: array + http: + description: An ordered list of route rules for HTTP traffic. + items: + properties: + corsPolicy: + description: Cross-Origin Resource Sharing policy (CORS). + properties: + allowCredentials: + description: Indicates whether the caller is allowed to + send the actual request (not the preflight) using credentials. + nullable: true + type: boolean + allowHeaders: + description: List of HTTP headers that can be used when + requesting the resource. + items: type: string - retryRemoteLocalities: - description: Flag to specify whether the retries should retry to other localities. - nullable: true - type: boolean - type: object - rewrite: - description: Rewrite HTTP URIs and Authority headers. - properties: - authority: - description: rewrite the Authority/Host header with this value. + type: array + allowMethods: + description: List of HTTP methods allowed to access the + resource. + items: type: string - uri: - description: rewrite the path (or the prefix) portion of the URI with this value. + type: array + allowOrigin: + items: type: string - uriRegexRewrite: - description: rewrite the path portion of the URI with the specified regex. + type: array + allowOrigins: + description: String patterns that match allowed origins. + items: + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex properties: - match: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + exact: + type: string + prefix: type: string - rewrite: - description: The string that should replace into matching portions of original URI. + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string type: object - type: object - route: - description: A HTTP rule can either return a direct_response, redirect or forward (default) traffic. - items: - properties: - destination: - description: Destination uniquely identifies the instances of a service to which the request/connection should be forwarded to. - properties: - host: - description: The name of a service from the service registry. - type: string - port: - description: Specifies the port on the host that is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - headers: - properties: - request: - properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object - type: object - response: - properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object - type: object - type: object - weight: - description: Weight specifies the relative proportion of traffic to be forwarded to the destination. - format: int32 - type: integer - required: - - destination - type: object - type: array - timeout: - description: Timeout for HTTP requests, default is disabled. - type: string - x-kubernetes-validations: + type: array + exposeHeaders: + description: A list of HTTP headers that the browsers are + allowed to access. + items: + type: string + type: array + maxAge: + description: Specifies how long the results of a preflight + request can be cached. + type: string + x-kubernetes-validations: - message: must be a valid duration greater than 1ms rule: duration(self) >= duration('1ms') - type: object - type: array - tcp: - description: An ordered list of route rules for opaque TCP traffic. - items: - properties: - match: - description: Match conditions to be satisfied for the rule to be activated. - items: + unmatchedPreflights: + description: |- + Indicates whether preflight requests not matching the configured allowed origin shouldn't be forwarded to the upstream. + + Valid Options: FORWARD, IGNORE + enum: + - UNSPECIFIED + - FORWARD + - IGNORE + type: string + type: object + delegate: + description: Delegate is used to specify the particular VirtualService + which can be used to define delegate HTTPRoute. + properties: + name: + description: Name specifies the name of the delegate VirtualService. + type: string + namespace: + description: Namespace specifies the namespace where the + delegate VirtualService resides. + type: string + type: object + directResponse: + description: A HTTP rule can either return a direct_response, + redirect or forward (default) traffic. + properties: + body: + description: Specifies the content of the response body. + oneOf: + - not: + anyOf: + - required: + - string + - required: + - bytes + - required: + - string + - required: + - bytes properties: - destinationSubnets: - description: IPv4 or IPv6 ip addresses of destination with optional subnet. - items: - type: string - type: array - gateways: - description: Names of gateways where the rule should be applied. - items: - type: string - type: array - port: - description: Specifies the port on the host that is being addressed. - maximum: 4294967295 - minimum: 0 - type: integer - sourceLabels: - additionalProperties: - type: string - description: One or more labels that constrain the applicability of a rule to workloads with the given labels. - type: object - sourceNamespace: - description: Source namespace constraining the applicability of a rule to workloads in that namespace. + bytes: + description: response body as base64 encoded bytes. + format: byte type: string - sourceSubnet: + string: type: string type: object - type: array - route: - description: The destination to which the connection should be forwarded to. - items: + status: + description: Specifies the HTTP response status to be returned. + maximum: 4294967295 + minimum: 0 + type: integer + required: + - status + type: object + fault: + description: Fault injection policy to apply on HTTP traffic + at the client side. + properties: + abort: + description: Abort Http request attempts and return error + codes back to downstream service, giving the impression + that the upstream service is faulty. + oneOf: + - not: + anyOf: + - required: + - httpStatus + - required: + - grpcStatus + - required: + - http2Error + - required: + - httpStatus + - required: + - grpcStatus + - required: + - http2Error properties: - destination: - description: Destination uniquely identifies the instances of a service to which the request/connection should be forwarded to. - properties: - host: - description: The name of a service from the service registry. - type: string - port: - description: Specifies the port on the host that is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - weight: - description: Weight specifies the relative proportion of traffic to be forwarded to the destination. + grpcStatus: + description: GRPC status code to use to abort the request. + type: string + http2Error: + type: string + httpStatus: + description: HTTP status code to use to abort the Http + request. format: int32 type: integer - required: - - destination - type: object - type: array - type: object - type: array - tls: - description: An ordered list of route rule for non-terminated TLS & HTTPS traffic. - items: - properties: - match: - description: Match conditions to be satisfied for the rule to be activated. - items: - properties: - destinationSubnets: - description: IPv4 or IPv6 ip addresses of destination with optional subnet. - items: - type: string - type: array - gateways: - description: Names of gateways where the rule should be applied. - items: - type: string - type: array - port: - description: Specifies the port on the host that is being addressed. - maximum: 4294967295 - minimum: 0 - type: integer - sniHosts: - description: SNI (server name indicator) to match on. - items: - type: string - type: array - sourceLabels: - additionalProperties: - type: string - description: One or more labels that constrain the applicability of a rule to workloads with the given labels. + percentage: + description: Percentage of requests to be aborted with + the error code provided. + properties: + value: + format: double + type: number type: object - sourceNamespace: - description: Source namespace constraining the applicability of a rule to workloads in that namespace. - type: string - required: - - sniHosts type: object - type: array - route: - description: The destination to which the connection should be forwarded to. - items: + delay: + description: Delay requests before forwarding, emulating + various failures such as network issues, overloaded upstream + service, etc. + oneOf: + - not: + anyOf: + - required: + - fixedDelay + - required: + - exponentialDelay + - required: + - fixedDelay + - required: + - exponentialDelay properties: - destination: - description: Destination uniquely identifies the instances of a service to which the request/connection should be forwarded to. - properties: - host: - description: The name of a service from the service registry. - type: string - port: - description: Specifies the port on the host that is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - weight: - description: Weight specifies the relative proportion of traffic to be forwarded to the destination. + exponentialDelay: + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + fixedDelay: + description: Add a fixed delay before forwarding the + request. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + percent: + description: Percentage of requests on which the delay + will be injected (0-100). format: int32 type: integer - required: - - destination + percentage: + description: Percentage of requests on which the delay + will be injected. + properties: + value: + format: double + type: number + type: object type: object - type: array - required: - - match - type: object - type: array - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. - - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} - - additionalPrinterColumns: - - description: The names of gateways and sidecars that should apply these routes - jsonPath: .spec.gateways - name: Gateways - type: string - - description: The destination hosts to which traffic is being sent - jsonPath: .spec.hosts - name: Hosts - type: string - - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting label/content routing, sni routing, etc. See more details at: https://istio.io/docs/reference/config/networking/virtual-service.html' - properties: - exportTo: - description: A list of namespaces to which this virtual service is exported. - items: - type: string - type: array - gateways: - description: The names of gateways and sidecars that should apply these routes. - items: - type: string - type: array - hosts: - description: The destination hosts to which traffic is being sent. - items: - type: string - type: array - http: - description: An ordered list of route rules for HTTP traffic. - items: - properties: - corsPolicy: - description: Cross-Origin Resource Sharing policy (CORS). + type: object + headers: + properties: + request: + properties: + add: + additionalProperties: + type: string + type: object + remove: + items: + type: string + type: array + set: + additionalProperties: + type: string + type: object + type: object + response: + properties: + add: + additionalProperties: + type: string + type: object + remove: + items: + type: string + type: array + set: + additionalProperties: + type: string + type: object + type: object + type: object + match: + description: Match conditions to be satisfied for the rule to + be activated. + items: properties: - allowCredentials: - description: Indicates whether the caller is allowed to send the actual request (not the preflight) using credentials. - nullable: true - type: boolean - allowHeaders: - description: List of HTTP headers that can be used when requesting the resource. - items: - type: string - type: array - allowMethods: - description: List of HTTP methods allowed to access the resource. - items: - type: string - type: array - allowOrigin: + authority: + description: 'HTTP Authority values are case-sensitive + and formatted as follows: - `exact: "value"` for exact + string match - `prefix: "value"` for prefix-based match + - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + gateways: + description: Names of gateways where the rule should be + applied. items: type: string type: array - allowOrigins: - description: String patterns that match allowed origins. - items: + headers: + additionalProperties: oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: + - not: + anyOf: + - required: - exact - - required: + - required: - prefix - - required: + - required: - regex + - required: + - exact + - required: + - prefix + - required: + - regex properties: exact: type: string @@ -13520,201 +15345,68 @@ spec: description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string type: object - type: array - exposeHeaders: - description: A list of HTTP headers that the browsers are allowed to access. - items: - type: string - type: array - maxAge: - description: Specifies how long the results of a preflight request can be cached. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - unmatchedPreflights: - description: |- - Indicates whether preflight requests not matching the configured allowed origin shouldn't be forwarded to the upstream. - - Valid Options: FORWARD, IGNORE - enum: - - UNSPECIFIED - - FORWARD - - IGNORE - type: string - type: object - delegate: - description: Delegate is used to specify the particular VirtualService which can be used to define delegate HTTPRoute. - properties: - name: - description: Name specifies the name of the delegate VirtualService. - type: string - namespace: - description: Namespace specifies the namespace where the delegate VirtualService resides. - type: string - type: object - directResponse: - description: A HTTP rule can either return a direct_response, redirect or forward (default) traffic. - properties: - body: - description: Specifies the content of the response body. + description: The header keys must be lowercase and use + hyphen as the separator, e.g. + type: object + ignoreUriCase: + description: Flag to specify whether the URI matching + should be case-insensitive. + type: boolean + method: + description: 'HTTP Method values are case-sensitive and + formatted as follows: - `exact: "value"` for exact string + match - `prefix: "value"` for prefix-based match - `regex: + "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' oneOf: - - not: - anyOf: - - required: - - string - - required: - - bytes - - required: - - string - - required: - - bytes + - not: + anyOf: + - required: + - exact + - required: + - prefix + - required: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex properties: - bytes: - description: response body as base64 encoded bytes. - format: byte + exact: type: string - string: + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string type: object - status: - description: Specifies the HTTP response status to be returned. + name: + description: The name assigned to a match. + type: string + port: + description: Specifies the ports on the host that is being + addressed. maximum: 4294967295 minimum: 0 type: integer - required: - - status - type: object - fault: - description: Fault injection policy to apply on HTTP traffic at the client side. - properties: - abort: - description: Abort Http request attempts and return error codes back to downstream service, giving the impression that the upstream service is faulty. - oneOf: - - not: - anyOf: - - required: - - httpStatus - - required: - - grpcStatus - - required: - - http2Error - - required: - - httpStatus - - required: - - grpcStatus - - required: - - http2Error - properties: - grpcStatus: - description: GRPC status code to use to abort the request. - type: string - http2Error: - type: string - httpStatus: - description: HTTP status code to use to abort the Http request. - format: int32 - type: integer - percentage: - description: Percentage of requests to be aborted with the error code provided. - properties: - value: - format: double - type: number - type: object - type: object - delay: - description: Delay requests before forwarding, emulating various failures such as network issues, overloaded upstream service, etc. - oneOf: + queryParams: + additionalProperties: + oneOf: - not: anyOf: - - required: - - fixedDelay - - required: - - exponentialDelay - - required: - - fixedDelay - - required: - - exponentialDelay - properties: - exponentialDelay: - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - fixedDelay: - description: Add a fixed delay before forwarding the request. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - percent: - description: Percentage of requests on which the delay will be injected (0-100). - format: int32 - type: integer - percentage: - description: Percentage of requests on which the delay will be injected. - properties: - value: - format: double - type: number - type: object - type: object - type: object - headers: - properties: - request: - properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object - type: object - response: - properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object - type: object - type: object - match: - description: Match conditions to be satisfied for the rule to be activated. - items: - properties: - authority: - description: 'HTTP Authority values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: + - required: - exact - - required: + - required: - prefix - - required: + - required: - regex + - required: + - exact + - required: + - prefix + - required: + - regex properties: exact: type: string @@ -13724,158 +15416,98 @@ spec: description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string type: object - gateways: - description: Names of gateways where the rule should be applied. - items: - type: string - type: array - headers: - additionalProperties: - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - description: The header keys must be lowercase and use hyphen as the separator, e.g. - type: object - ignoreUriCase: - description: Flag to specify whether the URI matching should be case-insensitive. - type: boolean - method: - description: 'HTTP Method values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex + description: Query parameters for matching. + type: object + scheme: + description: 'URI Scheme values are case-sensitive and + formatted as follows: - `exact: "value"` for exact string + match - `prefix: "value"` for prefix-based match - `regex: + "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: - required: - - exact + - exact - required: - - prefix + - prefix - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - name: - description: The name assigned to a match. + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: + type: string + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + sourceLabels: + additionalProperties: type: string - port: - description: Specifies the ports on the host that is being addressed. - maximum: 4294967295 - minimum: 0 - type: integer - queryParams: - additionalProperties: - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - description: Query parameters for matching. - type: object - scheme: - description: 'URI Scheme values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex + description: One or more labels that constrain the applicability + of a rule to source (client) workloads with the given + labels. + type: object + sourceNamespace: + description: Source namespace constraining the applicability + of a rule to workloads in that namespace. + type: string + statPrefix: + description: The human readable prefix to use when emitting + statistics for this route. + type: string + uri: + description: 'URI to match values are case-sensitive and + formatted as follows: - `exact: "value"` for exact string + match - `prefix: "value"` for prefix-based match - `regex: + "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + oneOf: + - not: + anyOf: - required: - - exact + - exact - required: - - prefix + - prefix - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - sourceLabels: - additionalProperties: + - regex + - required: + - exact + - required: + - prefix + - required: + - regex + properties: + exact: type: string - description: One or more labels that constrain the applicability of a rule to source (client) workloads with the given labels. - type: object - sourceNamespace: - description: Source namespace constraining the applicability of a rule to workloads in that namespace. - type: string - statPrefix: - description: The human readable prefix to use when emitting statistics for this route. - type: string - uri: - description: 'URI to match values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + prefix: + type: string + regex: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + type: object + withoutHeaders: + additionalProperties: oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: + - not: + anyOf: + - required: - exact - - required: + - required: - prefix - - required: + - required: - regex + - required: + - exact + - required: + - prefix + - required: + - regex properties: exact: type: string @@ -13885,842 +15517,535 @@ spec: description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string type: object - withoutHeaders: - additionalProperties: - oneOf: - - not: - anyOf: - - required: - - exact - - required: - - prefix - - required: - - regex - - required: - - exact - - required: - - prefix - - required: - - regex - properties: - exact: - type: string - prefix: - type: string - regex: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' - type: string - type: object - description: withoutHeader has the same syntax with the header, but has opposite meaning. - type: object + description: withoutHeader has the same syntax with the + header, but has opposite meaning. + type: object + type: object + type: array + mirror: + description: Mirror HTTP traffic to a another destination in + addition to forwarding the requests to the intended destination. + properties: + host: + description: The name of a service from the service registry. + type: string + port: + description: Specifies the port on the host that is being + addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer type: object - type: array - mirror: - description: Mirror HTTP traffic to a another destination in addition to forwarding the requests to the intended destination. + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + mirror_percent: + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + mirrorPercent: + maximum: 4294967295 + minimum: 0 + nullable: true + type: integer + mirrorPercentage: + description: Percentage of the traffic to be mirrored by the + `mirror` field. + properties: + value: + format: double + type: number + type: object + mirrors: + description: Specifies the destinations to mirror HTTP traffic + in addition to the original destination. + items: properties: - host: - description: The name of a service from the service registry. - type: string - port: - description: Specifies the port on the host that is being addressed. + destination: + description: Destination specifies the target of the mirror + operation. properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer + host: + description: The name of a service from the service + registry. + type: string + port: + description: Specifies the port on the host that is + being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + percentage: + description: Percentage of the traffic to be mirrored + by the `destination` field. + properties: + value: + format: double + type: number type: object - subset: - description: The name of a subset within the service. - type: string required: - - host - type: object - mirror_percent: - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - mirrorPercent: - maximum: 4294967295 - minimum: 0 - nullable: true - type: integer - mirrorPercentage: - description: Percentage of the traffic to be mirrored by the `mirror` field. - properties: - value: - format: double - type: number + - destination type: object - mirrors: - description: Specifies the destinations to mirror HTTP traffic in addition to the original destination. - items: - properties: - destination: - description: Destination specifies the target of the mirror operation. - properties: - host: - description: The name of a service from the service registry. - type: string - port: - description: Specifies the port on the host that is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - percentage: - description: Percentage of the traffic to be mirrored by the `destination` field. - properties: - value: - format: double - type: number - type: object - required: - - destination - type: object - type: array - name: - description: The name assigned to the route for debugging purposes. - type: string - redirect: - description: A HTTP rule can either return a direct_response, redirect or forward (default) traffic. - oneOf: - - not: - anyOf: - - required: - - port - - required: - - derivePort + type: array + name: + description: The name assigned to the route for debugging purposes. + type: string + redirect: + description: A HTTP rule can either return a direct_response, + redirect or forward (default) traffic. + oneOf: + - not: + anyOf: - required: - - port + - port - required: - - derivePort - properties: - authority: - description: On a redirect, overwrite the Authority/Host portion of the URL with this value. - type: string - derivePort: - description: |- - On a redirect, dynamically set the port: * FROM_PROTOCOL_DEFAULT: automatically set to 80 for HTTP and 443 for HTTPS. + - derivePort + - required: + - port + - required: + - derivePort + properties: + authority: + description: On a redirect, overwrite the Authority/Host + portion of the URL with this value. + type: string + derivePort: + description: |- + On a redirect, dynamically set the port: * FROM_PROTOCOL_DEFAULT: automatically set to 80 for HTTP and 443 for HTTPS. - Valid Options: FROM_PROTOCOL_DEFAULT, FROM_REQUEST_PORT - enum: - - FROM_PROTOCOL_DEFAULT - - FROM_REQUEST_PORT - type: string - port: - description: On a redirect, overwrite the port portion of the URL with this value. - maximum: 4294967295 - minimum: 0 - type: integer - redirectCode: - description: On a redirect, Specifies the HTTP status code to use in the redirect response. - maximum: 4294967295 - minimum: 0 + Valid Options: FROM_PROTOCOL_DEFAULT, FROM_REQUEST_PORT + enum: + - FROM_PROTOCOL_DEFAULT + - FROM_REQUEST_PORT + type: string + port: + description: On a redirect, overwrite the port portion of + the URL with this value. + maximum: 4294967295 + minimum: 0 + type: integer + redirectCode: + description: On a redirect, Specifies the HTTP status code + to use in the redirect response. + maximum: 4294967295 + minimum: 0 + type: integer + scheme: + description: On a redirect, overwrite the scheme portion + of the URL with this value. + type: string + uri: + description: On a redirect, overwrite the Path portion of + the URL with this value. + type: string + type: object + retries: + description: Retry policy for HTTP requests. + properties: + attempts: + description: Number of retries to be allowed for a given + request. + format: int32 + type: integer + backoff: + description: Specifies the minimum duration between retry + attempts. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + perTryTimeout: + description: Timeout per attempt for a given request, including + the initial call and any retries. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + retryIgnorePreviousHosts: + description: Flag to specify whether the retries should + ignore previously tried hosts during retry. + nullable: true + type: boolean + retryOn: + description: Specifies the conditions under which retry + takes place. + type: string + retryRemoteLocalities: + description: Flag to specify whether the retries should + retry to other localities. + nullable: true + type: boolean + type: object + rewrite: + description: Rewrite HTTP URIs and Authority headers. + properties: + authority: + description: rewrite the Authority/Host header with this + value. + type: string + uri: + description: rewrite the path (or the prefix) portion of + the URI with this value. + type: string + uriRegexRewrite: + description: rewrite the path portion of the URI with the + specified regex. + properties: + match: + description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + type: string + rewrite: + description: The string that should replace into matching + portions of original URI. + type: string + type: object + type: object + route: + description: A HTTP rule can either return a direct_response, + redirect or forward (default) traffic. + items: + properties: + destination: + description: Destination uniquely identifies the instances + of a service to which the request/connection should + be forwarded to. + properties: + host: + description: The name of a service from the service + registry. + type: string + port: + description: Specifies the port on the host that is + being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + headers: + properties: + request: + properties: + add: + additionalProperties: + type: string + type: object + remove: + items: + type: string + type: array + set: + additionalProperties: + type: string + type: object + type: object + response: + properties: + add: + additionalProperties: + type: string + type: object + remove: + items: + type: string + type: array + set: + additionalProperties: + type: string + type: object + type: object + type: object + weight: + description: Weight specifies the relative proportion + of traffic to be forwarded to the destination. + format: int32 type: integer - scheme: - description: On a redirect, overwrite the scheme portion of the URL with this value. - type: string - uri: - description: On a redirect, overwrite the Path portion of the URL with this value. - type: string + required: + - destination type: object - retries: - description: Retry policy for HTTP requests. + type: array + timeout: + description: Timeout for HTTP requests, default is disabled. + type: string + x-kubernetes-validations: + - message: must be a valid duration greater than 1ms + rule: duration(self) >= duration('1ms') + type: object + type: array + tcp: + description: An ordered list of route rules for opaque TCP traffic. + items: + properties: + match: + description: Match conditions to be satisfied for the rule to + be activated. + items: properties: - attempts: - description: Number of retries to be allowed for a given request. - format: int32 + destinationSubnets: + description: IPv4 or IPv6 ip addresses of destination + with optional subnet. + items: + type: string + type: array + gateways: + description: Names of gateways where the rule should be + applied. + items: + type: string + type: array + port: + description: Specifies the port on the host that is being + addressed. + maximum: 4294967295 + minimum: 0 type: integer - backoff: - description: Specifies the minimum duration between retry attempts. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - perTryTimeout: - description: Timeout per attempt for a given request, including the initial call and any retries. + sourceLabels: + additionalProperties: + type: string + description: One or more labels that constrain the applicability + of a rule to workloads with the given labels. + type: object + sourceNamespace: + description: Source namespace constraining the applicability + of a rule to workloads in that namespace. type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - retryIgnorePreviousHosts: - description: Flag to specify whether the retries should ignore previously tried hosts during retry. - nullable: true - type: boolean - retryOn: - description: Specifies the conditions under which retry takes place. + sourceSubnet: type: string - retryRemoteLocalities: - description: Flag to specify whether the retries should retry to other localities. - nullable: true - type: boolean type: object - rewrite: - description: Rewrite HTTP URIs and Authority headers. + type: array + route: + description: The destination to which the connection should + be forwarded to. + items: properties: - authority: - description: rewrite the Authority/Host header with this value. - type: string - uri: - description: rewrite the path (or the prefix) portion of the URI with this value. - type: string - uriRegexRewrite: - description: rewrite the path portion of the URI with the specified regex. + destination: + description: Destination uniquely identifies the instances + of a service to which the request/connection should + be forwarded to. properties: - match: - description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' + host: + description: The name of a service from the service + registry. type: string - rewrite: - description: The string that should replace into matching portions of original URI. + port: + description: Specifies the port on the host that is + being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. type: string + required: + - host type: object + weight: + description: Weight specifies the relative proportion + of traffic to be forwarded to the destination. + format: int32 + type: integer + required: + - destination type: object - route: - description: A HTTP rule can either return a direct_response, redirect or forward (default) traffic. - items: - properties: - destination: - description: Destination uniquely identifies the instances of a service to which the request/connection should be forwarded to. - properties: - host: - description: The name of a service from the service registry. - type: string - port: - description: Specifies the port on the host that is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - headers: - properties: - request: - properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object - type: object - response: - properties: - add: - additionalProperties: - type: string - type: object - remove: - items: - type: string - type: array - set: - additionalProperties: - type: string - type: object - type: object - type: object - weight: - description: Weight specifies the relative proportion of traffic to be forwarded to the destination. - format: int32 - type: integer - required: - - destination - type: object - type: array - timeout: - description: Timeout for HTTP requests, default is disabled. - type: string - x-kubernetes-validations: - - message: must be a valid duration greater than 1ms - rule: duration(self) >= duration('1ms') - type: object - type: array - tcp: - description: An ordered list of route rules for opaque TCP traffic. - items: - properties: - match: - description: Match conditions to be satisfied for the rule to be activated. - items: - properties: - destinationSubnets: - description: IPv4 or IPv6 ip addresses of destination with optional subnet. - items: - type: string - type: array - gateways: - description: Names of gateways where the rule should be applied. - items: - type: string - type: array - port: - description: Specifies the port on the host that is being addressed. - maximum: 4294967295 - minimum: 0 - type: integer - sourceLabels: - additionalProperties: - type: string - description: One or more labels that constrain the applicability of a rule to workloads with the given labels. - type: object - sourceNamespace: - description: Source namespace constraining the applicability of a rule to workloads in that namespace. + type: array + type: object + type: array + tls: + description: An ordered list of route rule for non-terminated TLS + & HTTPS traffic. + items: + properties: + match: + description: Match conditions to be satisfied for the rule to + be activated. + items: + properties: + destinationSubnets: + description: IPv4 or IPv6 ip addresses of destination + with optional subnet. + items: type: string - sourceSubnet: + type: array + gateways: + description: Names of gateways where the rule should be + applied. + items: type: string - type: object - type: array - route: - description: The destination to which the connection should be forwarded to. - items: - properties: - destination: - description: Destination uniquely identifies the instances of a service to which the request/connection should be forwarded to. - properties: - host: - description: The name of a service from the service registry. - type: string - port: - description: Specifies the port on the host that is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - weight: - description: Weight specifies the relative proportion of traffic to be forwarded to the destination. - format: int32 - type: integer - required: - - destination - type: object - type: array - type: object - type: array - tls: - description: An ordered list of route rule for non-terminated TLS & HTTPS traffic. - items: - properties: - match: - description: Match conditions to be satisfied for the rule to be activated. - items: - properties: - destinationSubnets: - description: IPv4 or IPv6 ip addresses of destination with optional subnet. - items: - type: string - type: array - gateways: - description: Names of gateways where the rule should be applied. - items: - type: string - type: array - port: - description: Specifies the port on the host that is being addressed. - maximum: 4294967295 - minimum: 0 - type: integer - sniHosts: - description: SNI (server name indicator) to match on. - items: - type: string - type: array - sourceLabels: - additionalProperties: - type: string - description: One or more labels that constrain the applicability of a rule to workloads with the given labels. - type: object - sourceNamespace: - description: Source namespace constraining the applicability of a rule to workloads in that namespace. + type: array + port: + description: Specifies the port on the host that is being + addressed. + maximum: 4294967295 + minimum: 0 + type: integer + sniHosts: + description: SNI (server name indicator) to match on. + items: type: string - required: - - sniHosts - type: object - type: array - route: - description: The destination to which the connection should be forwarded to. - items: - properties: - destination: - description: Destination uniquely identifies the instances of a service to which the request/connection should be forwarded to. - properties: - host: - description: The name of a service from the service registry. - type: string - port: - description: Specifies the port on the host that is being addressed. - properties: - number: - maximum: 4294967295 - minimum: 0 - type: integer - type: object - subset: - description: The name of a subset within the service. - type: string - required: - - host - type: object - weight: - description: Weight specifies the relative proportion of traffic to be forwarded to the destination. - format: int32 - type: integer - required: - - destination - type: object - type: array - required: - - match - type: object - type: array - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. - - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. + type: array + sourceLabels: + additionalProperties: + type: string + description: One or more labels that constrain the applicability + of a rule to workloads with the given labels. + type: object + sourceNamespace: + description: Source namespace constraining the applicability + of a rule to workloads in that namespace. type: string + required: + - sniHosts type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - type: object - served: true - storage: false - subresources: - status: {} ---- -apiVersion: apiextensions.k8s.io/v1 -kind: CustomResourceDefinition -metadata: - annotations: - helm.sh/resource-policy: keep - labels: - app.kubernetes.io/instance: istio - app.kubernetes.io/managed-by: Helm - app.kubernetes.io/part-of: istio - app.kubernetes.io/version: 1.29.4 - helm.sh/chart: base-1.29.4 - name: wasmplugins.extensions.istio.io -spec: - group: extensions.istio.io - names: - categories: - - istio-io - - extensions-istio-io - kind: WasmPlugin - listKind: WasmPluginList - plural: wasmplugins - singular: wasmplugin - scope: Namespaced - versions: - - additionalPrinterColumns: - - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1alpha1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Extend the functionality provided by the Istio proxy through WebAssembly filters. See more details at: https://istio.io/docs/reference/config/proxy_extensions/wasm-plugin.html' - properties: - failStrategy: - description: |- - Specifies the failure behavior for the plugin due to fatal errors. - - Valid Options: FAIL_CLOSE, FAIL_OPEN, FAIL_RELOAD - enum: - - FAIL_CLOSE - - FAIL_OPEN - - FAIL_RELOAD - type: string - imagePullPolicy: - description: |- - The pull behaviour to be applied when fetching Wasm module by either OCI image or `http/https`. - - Valid Options: IfNotPresent, Always - enum: - - UNSPECIFIED_POLICY - - IfNotPresent - - Always - type: string - imagePullSecret: - description: Credentials to use for OCI image pulling. - maxLength: 253 - minLength: 1 - type: string - match: - description: Specifies the criteria to determine which traffic is passed to WasmPlugin. - items: - properties: - mode: - description: |- - Criteria for selecting traffic by their direction. - - Valid Options: CLIENT, SERVER, CLIENT_AND_SERVER - enum: - - UNDEFINED - - CLIENT - - SERVER - - CLIENT_AND_SERVER - type: string - ports: - description: Criteria for selecting traffic by their destination port. - items: - properties: - number: - maximum: 65535 - minimum: 1 - type: integer - required: - - number - type: object - type: array - x-kubernetes-list-map-keys: - - number - x-kubernetes-list-type: map - type: object - type: array - phase: - description: |- - Determines where in the filter chain this `WasmPlugin` is to be injected. - - Valid Options: AUTHN, AUTHZ, STATS - enum: - - UNSPECIFIED_PHASE - - AUTHN - - AUTHZ - - STATS - type: string - pluginConfig: - description: The configuration that will be passed on to the plugin. - type: object - x-kubernetes-preserve-unknown-fields: true - pluginName: - description: The plugin name to be used in the Envoy configuration (used to be called `rootID`). - maxLength: 256 - minLength: 1 - type: string - priority: - description: Determines ordering of `WasmPlugins` in the same `phase`. - format: int32 - nullable: true - type: integer - selector: - description: Criteria used to select the specific set of pods/VMs on which this plugin configuration should be applied. - properties: - matchLabels: - additionalProperties: - maxLength: 63 - type: string - x-kubernetes-validations: - - message: wildcard not allowed in label value match - rule: '!self.contains("*")' - description: One or more labels that indicate a specific set of pods/VMs on which a policy should be applied. - maxProperties: 4096 - type: object - x-kubernetes-validations: - - message: wildcard not allowed in label key match - rule: self.all(key, !key.contains("*")) - - message: key must not be empty - rule: self.all(key, key.size() != 0) + type: array + route: + description: The destination to which the connection should + be forwarded to. + items: + properties: + destination: + description: Destination uniquely identifies the instances + of a service to which the request/connection should + be forwarded to. + properties: + host: + description: The name of a service from the service + registry. + type: string + port: + description: Specifies the port on the host that is + being addressed. + properties: + number: + maximum: 4294967295 + minimum: 0 + type: integer + type: object + subset: + description: The name of a subset within the service. + type: string + required: + - host + type: object + weight: + description: Weight specifies the relative proportion + of traffic to be forwarded to the destination. + format: int32 + type: integer + required: + - destination + type: object + type: array + required: + - match type: object - sha256: - description: SHA256 checksum that will be used to verify Wasm module or OCI container. - pattern: (^$|^[a-f0-9]{64}$) - type: string - targetRef: + type: array + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + lastProbeTime: + description: Last time we probed the condition. + format: date-time type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time type: string - name: - description: name is the name of the target resource. - maxLength: 253 - minLength: 1 + message: + description: Human-readable message indicating details about + last transition. type: string - namespace: - description: namespace is the namespace of the referent. + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 - required: - - kind - - name type: object - targetRefs: - description: Optional. - items: - properties: - group: - description: group is the group of the target resource. - maxLength: 253 - pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ - type: string - kind: - description: kind is kind of the target resource. - maxLength: 63 - minLength: 1 - pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ - type: string - name: - description: name is the name of the target resource. - maxLength: 253 - minLength: 1 - type: string - namespace: - description: namespace is the namespace of the referent. - type: string - x-kubernetes-validations: - - message: cross namespace referencing is not currently supported - rule: self.size() == 0 - required: - - kind - - name - type: object - maxItems: 16 - type: array - type: - description: |- - Specifies the type of Wasm Extension to be used. - - Valid Options: HTTP, NETWORK - enum: - - UNSPECIFIED_PLUGIN_TYPE - - HTTP - - NETWORK - type: string - url: - description: URL of a Wasm module or OCI container. - minLength: 1 - type: string - x-kubernetes-validations: - - message: url must have schema one of [http, https, file, oci] - rule: |- - isURL(self) ? (url(self).getScheme() in ["", "http", "https", "oci", "file"]) : (isURL("http://" + self) && - url("http://" + self).getScheme() in ["", "http", "https", "oci", "file"]) - verificationKey: - type: string - vmConfig: - description: Configuration for a Wasm VM. + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: properties: - env: - description: Specifies environment variables to be injected to this VM. - items: - properties: - name: - description: Name of the environment variable. - maxLength: 256 - minLength: 1 - type: string - value: - description: Value for the environment variable. - maxLength: 2048 - type: string - valueFrom: - description: |- - Source for the environment variable's value. + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. - Valid Options: INLINE, HOST - enum: - - INLINE - - HOST - type: string - required: - - name - type: object - x-kubernetes-validations: - - message: value may only be set when valueFrom is INLINE - rule: '(has(self.valueFrom) ? self.valueFrom : "") != "HOST" || !has(self.value)' - maxItems: 256 - type: array - x-kubernetes-list-map-keys: - - name - x-kubernetes-list-type: map + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object type: object - required: - - url - type: object - x-kubernetes-validations: - - message: only one of targetRefs or selector can be set - rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + (has(self.targetRefs) ? 1 : 0) <= 1' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: false + subresources: + status: {} - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -14733,456 +16058,357 @@ metadata: app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.29.4 helm.sh/chart: base-1.29.4 - name: workloadentries.networking.istio.io + name: wasmplugins.extensions.istio.io spec: - group: networking.istio.io + group: extensions.istio.io names: categories: - - istio-io - - networking-istio-io - kind: WorkloadEntry - listKind: WorkloadEntryList - plural: workloadentries - shortNames: - - we - singular: workloadentry + - istio-io + - extensions-istio-io + kind: WasmPlugin + listKind: WasmPluginList + plural: wasmplugins + singular: wasmplugin scope: Namespaced - versions: - - additionalPrinterColumns: - - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - - description: Address associated with the network endpoint. - jsonPath: .spec.address - name: Address - type: string - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting VMs onboarded into the mesh. See more details at: https://istio.io/docs/reference/config/networking/workload-entry.html' - properties: - address: - description: Address associated with the network endpoint without the port. - maxLength: 256 - type: string - x-kubernetes-validations: - - message: UDS must be an absolute path or abstract socket - rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" || self.substring(7, 8) == "@") : true' - - message: UDS may not be a dir - rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' - labels: - additionalProperties: - type: string - description: One or more labels associated with the endpoint. - maxProperties: 256 - type: object - locality: - description: The locality associated with the endpoint. - maxLength: 2048 - type: string - network: - description: Network enables Istio to group endpoints resident in the same L3 domain/network. - maxLength: 2048 - type: string - ports: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - description: Set of ports associated with the endpoint. - maxProperties: 128 - type: object - x-kubernetes-validations: - - message: port name must be valid - rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) - serviceAccount: - description: The service account associated with the workload if a sidecar is present in the workload. - maxLength: 253 - type: string - weight: - description: The load balancing weight associated with the endpoint. - maximum: 4294967295 - minimum: 0 - type: integer - type: object - x-kubernetes-validations: - - message: Address is required - rule: has(self.address) || has(self.network) - - message: UDS may not include ports - rule: '(has(self.address) ? self.address : "").startsWith("unix://") ? !has(self.ports) : true' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. - - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} - - additionalPrinterColumns: - - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - - description: Address associated with the network endpoint. - jsonPath: .spec.address - name: Address - type: string - name: v1alpha3 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting VMs onboarded into the mesh. See more details at: https://istio.io/docs/reference/config/networking/workload-entry.html' - properties: - address: - description: Address associated with the network endpoint without the port. - maxLength: 256 - type: string - x-kubernetes-validations: - - message: UDS must be an absolute path or abstract socket - rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" || self.substring(7, 8) == "@") : true' - - message: UDS may not be a dir - rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' - labels: - additionalProperties: - type: string - description: One or more labels associated with the endpoint. - maxProperties: 256 - type: object - locality: - description: The locality associated with the endpoint. - maxLength: 2048 - type: string - network: - description: Network enables Istio to group endpoints resident in the same L3 domain/network. - maxLength: 2048 - type: string - ports: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - description: Set of ports associated with the endpoint. - maxProperties: 128 - type: object - x-kubernetes-validations: - - message: port name must be valid - rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) - serviceAccount: - description: The service account associated with the workload if a sidecar is present in the workload. - maxLength: 253 - type: string - weight: - description: The load balancing weight associated with the endpoint. - maximum: 4294967295 - minimum: 0 - type: integer - type: object - x-kubernetes-validations: - - message: Address is required - rule: has(self.address) || has(self.network) - - message: UDS may not include ports - rule: '(has(self.address) ? self.address : "").startsWith("unix://") ? !has(self.ports) : true' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. - - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: false - subresources: - status: {} - - additionalPrinterColumns: - - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - - description: Address associated with the network endpoint. - jsonPath: .spec.address - name: Address - type: string - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Configuration affecting VMs onboarded into the mesh. See more details at: https://istio.io/docs/reference/config/networking/workload-entry.html' - properties: - address: - description: Address associated with the network endpoint without the port. - maxLength: 256 - type: string - x-kubernetes-validations: - - message: UDS must be an absolute path or abstract socket - rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" || self.substring(7, 8) == "@") : true' - - message: UDS may not be a dir - rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' - labels: - additionalProperties: - type: string - description: One or more labels associated with the endpoint. - maxProperties: 256 - type: object - locality: - description: The locality associated with the endpoint. - maxLength: 2048 - type: string - network: - description: Network enables Istio to group endpoints resident in the same L3 domain/network. - maxLength: 2048 - type: string - ports: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - description: Set of ports associated with the endpoint. - maxProperties: 128 - type: object - x-kubernetes-validations: - - message: port name must be valid - rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) - serviceAccount: - description: The service account associated with the workload if a sidecar is present in the workload. - maxLength: 253 - type: string - weight: - description: The load balancing weight associated with the endpoint. - maximum: 4294967295 - minimum: 0 - type: integer - type: object - x-kubernetes-validations: - - message: Address is required - rule: has(self.address) || has(self.network) - - message: UDS may not include ports - rule: '(has(self.address) ? self.address : "").startsWith("unix://") ? !has(self.ports) : true' - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. + versions: + - additionalPrinterColumns: + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Extend the functionality provided by the Istio proxy through + WebAssembly filters. See more details at: https://istio.io/docs/reference/config/proxy_extensions/wasm-plugin.html' + properties: + failStrategy: + description: |- + Specifies the failure behavior for the plugin due to fatal errors. - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: + Valid Options: FAIL_CLOSE, FAIL_OPEN, FAIL_RELOAD + enum: + - FAIL_CLOSE + - FAIL_OPEN + - FAIL_RELOAD + type: string + imagePullPolicy: + description: |- + The pull behaviour to be applied when fetching Wasm module by either OCI image or `http/https`. + + Valid Options: IfNotPresent, Always + enum: + - UNSPECIFIED_POLICY + - IfNotPresent + - Always + type: string + imagePullSecret: + description: Credentials to use for OCI image pulling. + maxLength: 253 + minLength: 1 + type: string + match: + description: Specifies the criteria to determine which traffic is + passed to WasmPlugin. + items: + properties: + mode: + description: |- + Criteria for selecting traffic by their direction. + + Valid Options: CLIENT, SERVER, CLIENT_AND_SERVER + enum: + - UNDEFINED + - CLIENT + - SERVER + - CLIENT_AND_SERVER + type: string + ports: + description: Criteria for selecting traffic by their destination + port. + items: properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string + number: + maximum: 65535 + minimum: 1 + type: integer + required: + - number type: object + type: array + x-kubernetes-list-map-keys: + - number + x-kubernetes-list-type: map + type: object + type: array + phase: + description: |- + Determines where in the filter chain this `WasmPlugin` is to be injected. + + Valid Options: AUTHN, AUTHZ, STATS + enum: + - UNSPECIFIED_PHASE + - AUTHN + - AUTHZ + - STATS + type: string + pluginConfig: + description: The configuration that will be passed on to the plugin. + type: object + x-kubernetes-preserve-unknown-fields: true + pluginName: + description: The plugin name to be used in the Envoy configuration + (used to be called `rootID`). + maxLength: 256 + minLength: 1 + type: string + priority: + description: Determines ordering of `WasmPlugins` in the same `phase`. + format: int32 + nullable: true + type: integer + selector: + description: Criteria used to select the specific set of pods/VMs + on which this plugin configuration should be applied. + properties: + matchLabels: + additionalProperties: + maxLength: 63 + type: string + x-kubernetes-validations: + - message: wildcard not allowed in label value match + rule: '!self.contains("*")' + description: One or more labels that indicate a specific set of + pods/VMs on which a policy should be applied. + maxProperties: 4096 type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: false - subresources: - status: {} + x-kubernetes-validations: + - message: wildcard not allowed in label key match + rule: self.all(key, !key.contains("*")) + - message: key must not be empty + rule: self.all(key, key.size() != 0) + type: object + sha256: + description: SHA256 checksum that will be used to verify Wasm module + or OCI container. + pattern: (^$|^[a-f0-9]{64}$) + type: string + targetRef: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name + type: object + targetRefs: + description: Optional. + items: + properties: + group: + description: group is the group of the target resource. + maxLength: 253 + pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + kind: + description: kind is kind of the target resource. + maxLength: 63 + minLength: 1 + pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ + type: string + name: + description: name is the name of the target resource. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: namespace is the namespace of the referent. + type: string + x-kubernetes-validations: + - message: cross namespace referencing is not currently supported + rule: self.size() == 0 + required: + - kind + - name + type: object + maxItems: 16 + type: array + type: + description: |- + Specifies the type of Wasm Extension to be used. + + Valid Options: HTTP, NETWORK + enum: + - UNSPECIFIED_PLUGIN_TYPE + - HTTP + - NETWORK + type: string + url: + description: URL of a Wasm module or OCI container. + minLength: 1 + type: string + x-kubernetes-validations: + - message: url must have schema one of [http, https, file, oci] + rule: |- + isURL(self) ? (url(self).getScheme() in ["", "http", "https", "oci", "file"]) : (isURL("http://" + self) && + url("http://" + self).getScheme() in ["", "http", "https", "oci", "file"]) + verificationKey: + type: string + vmConfig: + description: Configuration for a Wasm VM. + properties: + env: + description: Specifies environment variables to be injected to + this VM. + items: + properties: + name: + description: Name of the environment variable. + maxLength: 256 + minLength: 1 + type: string + value: + description: Value for the environment variable. + maxLength: 2048 + type: string + valueFrom: + description: |- + Source for the environment variable's value. + + Valid Options: INLINE, HOST + enum: + - INLINE + - HOST + type: string + required: + - name + type: object + x-kubernetes-validations: + - message: value may only be set when valueFrom is INLINE + rule: '(has(self.valueFrom) ? self.valueFrom : "") != "HOST" + || !has(self.value)' + maxItems: 256 + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + type: object + required: + - url + type: object + x-kubernetes-validations: + - message: only one of targetRefs or selector can be set + rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0) + + (has(self.targetRefs) ? 1 : 0) <= 1' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} + --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition @@ -15195,873 +16421,1454 @@ metadata: app.kubernetes.io/part-of: istio app.kubernetes.io/version: 1.29.4 helm.sh/chart: base-1.29.4 - name: workloadgroups.networking.istio.io + name: workloadentries.networking.istio.io spec: group: networking.istio.io names: categories: - - istio-io - - networking-istio-io - kind: WorkloadGroup - listKind: WorkloadGroupList - plural: workloadgroups + - istio-io + - networking-istio-io + kind: WorkloadEntry + listKind: WorkloadEntryList + plural: workloadentries shortNames: - - wg - singular: workloadgroup + - we + singular: workloadentry scope: Namespaced versions: - - additionalPrinterColumns: - - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Describes a collection of workload instances. See more details at: https://istio.io/docs/reference/config/networking/workload-group.html' - properties: - metadata: - description: Metadata that will be used for all corresponding `WorkloadEntries`. + - additionalPrinterColumns: + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + - description: Address associated with the network endpoint. + jsonPath: .spec.address + name: Address + type: string + name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting VMs onboarded into the mesh. See + more details at: https://istio.io/docs/reference/config/networking/workload-entry.html' + properties: + address: + description: Address associated with the network endpoint without + the port. + maxLength: 256 + type: string + x-kubernetes-validations: + - message: UDS must be an absolute path or abstract socket + rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" + || self.substring(7, 8) == "@") : true' + - message: UDS may not be a dir + rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' + labels: + additionalProperties: + type: string + description: One or more labels associated with the endpoint. + maxProperties: 256 + type: object + locality: + description: The locality associated with the endpoint. + maxLength: 2048 + type: string + network: + description: Network enables Istio to group endpoints resident in + the same L3 domain/network. + maxLength: 2048 + type: string + ports: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + description: Set of ports associated with the endpoint. + maxProperties: 128 + type: object + x-kubernetes-validations: + - message: port name must be valid + rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) + serviceAccount: + description: The service account associated with the workload if a + sidecar is present in the workload. + maxLength: 253 + type: string + weight: + description: The load balancing weight associated with the endpoint. + maximum: 4294967295 + minimum: 0 + type: integer + type: object + x-kubernetes-validations: + - message: Address is required + rule: has(self.address) || has(self.network) + - message: UDS may not include ports + rule: '(has(self.address) ? self.address : "").startsWith("unix://") + ? !has(self.ports) : true' + status: + properties: + conditions: + description: Current service state of the resource. + items: properties: - annotations: - additionalProperties: - type: string - maxProperties: 256 - type: object - labels: - additionalProperties: - type: string - maxProperties: 256 - type: object + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string type: object - probe: - description: '`ReadinessProbe` describes the configuration the user must provide for healthchecking on their workload.' - oneOf: - - not: - anyOf: - - required: - - httpGet - - required: - - tcpSocket - - required: - - exec - - required: - - grpc - - required: - - httpGet - - required: - - tcpSocket - - required: - - exec - - required: - - grpc + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: properties: - exec: - description: Health is determined by how the command that is executed exited. - properties: - command: - description: Command to run. - items: - minLength: 1 - type: string - type: array - required: - - command - type: object - failureThreshold: - description: Minimum consecutive failures for the probe to be considered failed after having succeeded. - format: int32 - minimum: 0 - type: integer - grpc: - description: GRPC call is made and response/error is used to determine health. - properties: - port: - description: Port on which the endpoint lives. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - service: - type: string - type: object - httpGet: - description: '`httpGet` is performed to a given endpoint and the status/able to connect determines health.' + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: properties: - host: - description: Host name to connect to, defaults to the pod IP. - type: string - httpHeaders: - description: Headers the proxy will pass on to make the request. - items: - properties: - name: - pattern: ^[-_A-Za-z0-9]+$ - type: string - value: - type: string - type: object - type: array - path: - description: Path to access on the HTTP server. + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. type: string - port: - description: Port on which the endpoint lives. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - scheme: + name: + description: A human-readable name for the message type. type: string - x-kubernetes-validations: - - message: scheme must be one of [HTTP, HTTPS] - rule: self in ["", "HTTP", "HTTPS"] - required: - - port type: object - initialDelaySeconds: - description: Number of seconds after the container has started before readiness probes are initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: How often (in seconds) to perform the probe. - format: int32 - minimum: 0 - type: integer - successThreshold: - description: Minimum consecutive successes for the probe to be considered successful after having failed. - format: int32 - minimum: 0 - type: integer - tcpSocket: - description: Health is determined by if the proxy is able to connect. + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + - description: Address associated with the network endpoint. + jsonPath: .spec.address + name: Address + type: string + name: v1alpha3 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting VMs onboarded into the mesh. See + more details at: https://istio.io/docs/reference/config/networking/workload-entry.html' + properties: + address: + description: Address associated with the network endpoint without + the port. + maxLength: 256 + type: string + x-kubernetes-validations: + - message: UDS must be an absolute path or abstract socket + rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" + || self.substring(7, 8) == "@") : true' + - message: UDS may not be a dir + rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' + labels: + additionalProperties: + type: string + description: One or more labels associated with the endpoint. + maxProperties: 256 + type: object + locality: + description: The locality associated with the endpoint. + maxLength: 2048 + type: string + network: + description: Network enables Istio to group endpoints resident in + the same L3 domain/network. + maxLength: 2048 + type: string + ports: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + description: Set of ports associated with the endpoint. + maxProperties: 128 + type: object + x-kubernetes-validations: + - message: port name must be valid + rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) + serviceAccount: + description: The service account associated with the workload if a + sidecar is present in the workload. + maxLength: 253 + type: string + weight: + description: The load balancing weight associated with the endpoint. + maximum: 4294967295 + minimum: 0 + type: integer + type: object + x-kubernetes-validations: + - message: Address is required + rule: has(self.address) || has(self.network) + - message: UDS may not include ports + rule: '(has(self.address) ? self.address : "").startsWith("unix://") + ? !has(self.ports) : true' + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: properties: - host: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. type: string - port: - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - required: - - port type: object - timeoutSeconds: - description: Number of seconds after which the probe times out. - format: int32 - minimum: 0 - type: integer type: object - template: - description: Template to be used for the generation of `WorkloadEntry` resources that belong to this `WorkloadGroup`. + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + - description: Address associated with the network endpoint. + jsonPath: .spec.address + name: Address + type: string + name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Configuration affecting VMs onboarded into the mesh. See + more details at: https://istio.io/docs/reference/config/networking/workload-entry.html' + properties: + address: + description: Address associated with the network endpoint without + the port. + maxLength: 256 + type: string + x-kubernetes-validations: + - message: UDS must be an absolute path or abstract socket + rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" + || self.substring(7, 8) == "@") : true' + - message: UDS may not be a dir + rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' + labels: + additionalProperties: + type: string + description: One or more labels associated with the endpoint. + maxProperties: 256 + type: object + locality: + description: The locality associated with the endpoint. + maxLength: 2048 + type: string + network: + description: Network enables Istio to group endpoints resident in + the same L3 domain/network. + maxLength: 2048 + type: string + ports: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + description: Set of ports associated with the endpoint. + maxProperties: 128 + type: object + x-kubernetes-validations: + - message: port name must be valid + rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) + serviceAccount: + description: The service account associated with the workload if a + sidecar is present in the workload. + maxLength: 253 + type: string + weight: + description: The load balancing weight associated with the endpoint. + maximum: 4294967295 + minimum: 0 + type: integer + type: object + x-kubernetes-validations: + - message: Address is required + rule: has(self.address) || has(self.network) + - message: UDS may not include ports + rule: '(has(self.address) ? self.address : "").startsWith("unix://") + ? !has(self.ports) : true' + status: + properties: + conditions: + description: Current service state of the resource. + items: properties: - address: - description: Address associated with the network endpoint without the port. - maxLength: 256 + lastProbeTime: + description: Last time we probed the condition. + format: date-time type: string - x-kubernetes-validations: - - message: UDS must be an absolute path or abstract socket - rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" || self.substring(7, 8) == "@") : true' - - message: UDS may not be a dir - rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' - labels: - additionalProperties: - type: string - description: One or more labels associated with the endpoint. - maxProperties: 256 + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string + type: object + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string type: object - locality: - description: The locality associated with the endpoint. - maxLength: 2048 + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} + +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: istio + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/part-of: istio + app.kubernetes.io/version: 1.29.4 + helm.sh/chart: base-1.29.4 + name: workloadgroups.networking.istio.io +spec: + group: networking.istio.io + names: + categories: + - istio-io + - networking-istio-io + kind: WorkloadGroup + listKind: WorkloadGroupList + plural: workloadgroups + shortNames: + - wg + singular: workloadgroup + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Describes a collection of workload instances. See more details + at: https://istio.io/docs/reference/config/networking/workload-group.html' + properties: + metadata: + description: Metadata that will be used for all corresponding `WorkloadEntries`. + properties: + annotations: + additionalProperties: type: string - network: - description: Network enables Istio to group endpoints resident in the same L3 domain/network. - maxLength: 2048 + maxProperties: 256 + type: object + labels: + additionalProperties: type: string - ports: - additionalProperties: + maxProperties: 256 + type: object + type: object + probe: + description: '`ReadinessProbe` describes the configuration the user + must provide for healthchecking on their workload.' + oneOf: + - not: + anyOf: + - required: + - httpGet + - required: + - tcpSocket + - required: + - exec + - required: + - grpc + - required: + - httpGet + - required: + - tcpSocket + - required: + - exec + - required: + - grpc + properties: + exec: + description: Health is determined by how the command that is executed + exited. + properties: + command: + description: Command to run. + items: + minLength: 1 + type: string + type: array + required: + - command + type: object + failureThreshold: + description: Minimum consecutive failures for the probe to be + considered failed after having succeeded. + format: int32 + minimum: 0 + type: integer + grpc: + description: GRPC call is made and response/error is used to determine + health. + properties: + port: + description: Port on which the endpoint lives. maximum: 4294967295 minimum: 0 type: integer x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - description: Set of ports associated with the endpoint. - maxProperties: 128 - type: object - x-kubernetes-validations: - - message: port name must be valid - rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) - serviceAccount: - description: The service account associated with the workload if a sidecar is present in the workload. - maxLength: 253 - type: string - weight: - description: The load balancing weight associated with the endpoint. - maximum: 4294967295 - minimum: 0 - type: integer - type: object - x-kubernetes-validations: - - message: UDS may not include ports - rule: '(has(self.address) ? self.address : "").startsWith("unix://") ? !has(self.ports) : true' - required: - - template - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + service: type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. + type: object + httpGet: + description: '`httpGet` is performed to a given endpoint and the + status/able to connect determines health.' + properties: + host: + description: Host name to connect to, defaults to the pod + IP. type: string - status: - description: Status is the status of the condition. + httpHeaders: + description: Headers the proxy will pass on to make the request. + items: + properties: + name: + pattern: ^[-_A-Za-z0-9]+$ + type: string + value: + type: string + type: object + type: array + path: + description: Path to access on the HTTP server. type: string - type: - description: Type is the type of the condition. + port: + description: Port on which the endpoint lives. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + scheme: type: string + x-kubernetes-validations: + - message: scheme must be one of [HTTP, HTTPS] + rule: self in ["", "HTTP", "HTTPS"] + required: + - port type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: + initialDelaySeconds: + description: Number of seconds after the container has started + before readiness probes are initiated. + format: int32 + minimum: 0 + type: integer + periodSeconds: + description: How often (in seconds) to perform the probe. + format: int32 + minimum: 0 + type: integer + successThreshold: + description: Minimum consecutive successes for the probe to be + considered successful after having failed. + format: int32 + minimum: 0 + type: integer + tcpSocket: + description: Health is determined by if the proxy is able to connect. properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. + host: type: string - level: - description: |- - Represents how severe a message is. - - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object + port: + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + required: + - port type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: true - subresources: - status: {} - - additionalPrinterColumns: - - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1alpha3 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Describes a collection of workload instances. See more details at: https://istio.io/docs/reference/config/networking/workload-group.html' - properties: - metadata: - description: Metadata that will be used for all corresponding `WorkloadEntries`. + timeoutSeconds: + description: Number of seconds after which the probe times out. + format: int32 + minimum: 0 + type: integer + type: object + template: + description: Template to be used for the generation of `WorkloadEntry` + resources that belong to this `WorkloadGroup`. + properties: + address: + description: Address associated with the network endpoint without + the port. + maxLength: 256 + type: string + x-kubernetes-validations: + - message: UDS must be an absolute path or abstract socket + rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == + "/" || self.substring(7, 8) == "@") : true' + - message: UDS may not be a dir + rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' + labels: + additionalProperties: + type: string + description: One or more labels associated with the endpoint. + maxProperties: 256 + type: object + locality: + description: The locality associated with the endpoint. + maxLength: 2048 + type: string + network: + description: Network enables Istio to group endpoints resident + in the same L3 domain/network. + maxLength: 2048 + type: string + ports: + additionalProperties: + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + description: Set of ports associated with the endpoint. + maxProperties: 128 + type: object + x-kubernetes-validations: + - message: port name must be valid + rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) + serviceAccount: + description: The service account associated with the workload + if a sidecar is present in the workload. + maxLength: 253 + type: string + weight: + description: The load balancing weight associated with the endpoint. + maximum: 4294967295 + minimum: 0 + type: integer + type: object + x-kubernetes-validations: + - message: UDS may not include ports + rule: '(has(self.address) ? self.address : "").startsWith("unix://") + ? !has(self.ports) : true' + required: + - template + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: properties: - annotations: - additionalProperties: - type: string - maxProperties: 256 - type: object - labels: - additionalProperties: - type: string - maxProperties: 256 - type: object + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string type: object - probe: - description: '`ReadinessProbe` describes the configuration the user must provide for healthchecking on their workload.' - oneOf: - - not: - anyOf: - - required: - - httpGet - - required: - - tcpSocket - - required: - - exec - - required: - - grpc - - required: - - httpGet - - required: - - tcpSocket - - required: - - exec - - required: - - grpc + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: properties: - exec: - description: Health is determined by how the command that is executed exited. - properties: - command: - description: Command to run. - items: - minLength: 1 - type: string - type: array - required: - - command - type: object - failureThreshold: - description: Minimum consecutive failures for the probe to be considered failed after having succeeded. - format: int32 - minimum: 0 - type: integer - grpc: - description: GRPC call is made and response/error is used to determine health. - properties: - port: - description: Port on which the endpoint lives. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - service: - type: string - type: object - httpGet: - description: '`httpGet` is performed to a given endpoint and the status/able to connect determines health.' + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: properties: - host: - description: Host name to connect to, defaults to the pod IP. - type: string - httpHeaders: - description: Headers the proxy will pass on to make the request. - items: - properties: - name: - pattern: ^[-_A-Za-z0-9]+$ - type: string - value: - type: string - type: object - type: array - path: - description: Path to access on the HTTP server. + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. type: string - port: - description: Port on which the endpoint lives. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - scheme: + name: + description: A human-readable name for the message type. type: string - x-kubernetes-validations: - - message: scheme must be one of [HTTP, HTTPS] - rule: self in ["", "HTTP", "HTTPS"] - required: - - port type: object - initialDelaySeconds: - description: Number of seconds after the container has started before readiness probes are initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: How often (in seconds) to perform the probe. - format: int32 - minimum: 0 - type: integer - successThreshold: - description: Minimum consecutive successes for the probe to be considered successful after having failed. - format: int32 - minimum: 0 - type: integer - tcpSocket: - description: Health is determined by if the proxy is able to connect. - properties: - host: + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha3 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Describes a collection of workload instances. See more details + at: https://istio.io/docs/reference/config/networking/workload-group.html' + properties: + metadata: + description: Metadata that will be used for all corresponding `WorkloadEntries`. + properties: + annotations: + additionalProperties: + type: string + maxProperties: 256 + type: object + labels: + additionalProperties: + type: string + maxProperties: 256 + type: object + type: object + probe: + description: '`ReadinessProbe` describes the configuration the user + must provide for healthchecking on their workload.' + oneOf: + - not: + anyOf: + - required: + - httpGet + - required: + - tcpSocket + - required: + - exec + - required: + - grpc + - required: + - httpGet + - required: + - tcpSocket + - required: + - exec + - required: + - grpc + properties: + exec: + description: Health is determined by how the command that is executed + exited. + properties: + command: + description: Command to run. + items: + minLength: 1 type: string - port: - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - required: - - port - type: object - timeoutSeconds: - description: Number of seconds after which the probe times out. - format: int32 + type: array + required: + - command + type: object + failureThreshold: + description: Minimum consecutive failures for the probe to be + considered failed after having succeeded. + format: int32 + minimum: 0 + type: integer + grpc: + description: GRPC call is made and response/error is used to determine + health. + properties: + port: + description: Port on which the endpoint lives. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + service: + type: string + type: object + httpGet: + description: '`httpGet` is performed to a given endpoint and the + status/able to connect determines health.' + properties: + host: + description: Host name to connect to, defaults to the pod + IP. + type: string + httpHeaders: + description: Headers the proxy will pass on to make the request. + items: + properties: + name: + pattern: ^[-_A-Za-z0-9]+$ + type: string + value: + type: string + type: object + type: array + path: + description: Path to access on the HTTP server. + type: string + port: + description: Port on which the endpoint lives. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + scheme: + type: string + x-kubernetes-validations: + - message: scheme must be one of [HTTP, HTTPS] + rule: self in ["", "HTTP", "HTTPS"] + required: + - port + type: object + initialDelaySeconds: + description: Number of seconds after the container has started + before readiness probes are initiated. + format: int32 + minimum: 0 + type: integer + periodSeconds: + description: How often (in seconds) to perform the probe. + format: int32 + minimum: 0 + type: integer + successThreshold: + description: Minimum consecutive successes for the probe to be + considered successful after having failed. + format: int32 + minimum: 0 + type: integer + tcpSocket: + description: Health is determined by if the proxy is able to connect. + properties: + host: + type: string + port: + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + required: + - port + type: object + timeoutSeconds: + description: Number of seconds after which the probe times out. + format: int32 + minimum: 0 + type: integer + type: object + template: + description: Template to be used for the generation of `WorkloadEntry` + resources that belong to this `WorkloadGroup`. + properties: + address: + description: Address associated with the network endpoint without + the port. + maxLength: 256 + type: string + x-kubernetes-validations: + - message: UDS must be an absolute path or abstract socket + rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == + "/" || self.substring(7, 8) == "@") : true' + - message: UDS may not be a dir + rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' + labels: + additionalProperties: + type: string + description: One or more labels associated with the endpoint. + maxProperties: 256 + type: object + locality: + description: The locality associated with the endpoint. + maxLength: 2048 + type: string + network: + description: Network enables Istio to group endpoints resident + in the same L3 domain/network. + maxLength: 2048 + type: string + ports: + additionalProperties: + maximum: 4294967295 minimum: 0 type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + description: Set of ports associated with the endpoint. + maxProperties: 128 + type: object + x-kubernetes-validations: + - message: port name must be valid + rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) + serviceAccount: + description: The service account associated with the workload + if a sidecar is present in the workload. + maxLength: 253 + type: string + weight: + description: The load balancing weight associated with the endpoint. + maximum: 4294967295 + minimum: 0 + type: integer + type: object + x-kubernetes-validations: + - message: UDS may not include ports + rule: '(has(self.address) ? self.address : "").startsWith("unix://") + ? !has(self.ports) : true' + required: + - template + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: + properties: + lastProbeTime: + description: Last time we probed the condition. + format: date-time + type: string + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time + type: string + message: + description: Human-readable message indicating details about + last transition. + type: string + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. + type: string type: object - template: - description: Template to be used for the generation of `WorkloadEntry` resources that belong to this `WorkloadGroup`. + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: properties: - address: - description: Address associated with the network endpoint without the port. - maxLength: 256 + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. type: string - x-kubernetes-validations: - - message: UDS must be an absolute path or abstract socket - rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" || self.substring(7, 8) == "@") : true' - - message: UDS may not be a dir - rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' - labels: - additionalProperties: - type: string - description: One or more labels associated with the endpoint. - maxProperties: 256 + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string type: object - locality: - description: The locality associated with the endpoint. - maxLength: 2048 + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - description: 'CreationTimestamp is a timestamp representing the server time + when this object was created. It is not guaranteed to be set in happens-before + order across separate operations. Clients may not set this value. It is represented + in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for + lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + properties: + spec: + description: 'Describes a collection of workload instances. See more details + at: https://istio.io/docs/reference/config/networking/workload-group.html' + properties: + metadata: + description: Metadata that will be used for all corresponding `WorkloadEntries`. + properties: + annotations: + additionalProperties: type: string - network: - description: Network enables Istio to group endpoints resident in the same L3 domain/network. - maxLength: 2048 + maxProperties: 256 + type: object + labels: + additionalProperties: type: string - ports: - additionalProperties: + maxProperties: 256 + type: object + type: object + probe: + description: '`ReadinessProbe` describes the configuration the user + must provide for healthchecking on their workload.' + oneOf: + - not: + anyOf: + - required: + - httpGet + - required: + - tcpSocket + - required: + - exec + - required: + - grpc + - required: + - httpGet + - required: + - tcpSocket + - required: + - exec + - required: + - grpc + properties: + exec: + description: Health is determined by how the command that is executed + exited. + properties: + command: + description: Command to run. + items: + minLength: 1 + type: string + type: array + required: + - command + type: object + failureThreshold: + description: Minimum consecutive failures for the probe to be + considered failed after having succeeded. + format: int32 + minimum: 0 + type: integer + grpc: + description: GRPC call is made and response/error is used to determine + health. + properties: + port: + description: Port on which the endpoint lives. maximum: 4294967295 minimum: 0 type: integer x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - description: Set of ports associated with the endpoint. - maxProperties: 128 - type: object - x-kubernetes-validations: - - message: port name must be valid - rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) - serviceAccount: - description: The service account associated with the workload if a sidecar is present in the workload. - maxLength: 253 - type: string - weight: - description: The load balancing weight associated with the endpoint. - maximum: 4294967295 - minimum: 0 - type: integer - type: object - x-kubernetes-validations: - - message: UDS may not include ports - rule: '(has(self.address) ? self.address : "").startsWith("unix://") ? !has(self.ports) : true' - required: - - template - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + service: type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. + type: object + httpGet: + description: '`httpGet` is performed to a given endpoint and the + status/able to connect determines health.' + properties: + host: + description: Host name to connect to, defaults to the pod + IP. type: string - status: - description: Status is the status of the condition. + httpHeaders: + description: Headers the proxy will pass on to make the request. + items: + properties: + name: + pattern: ^[-_A-Za-z0-9]+$ + type: string + value: + type: string + type: object + type: array + path: + description: Path to access on the HTTP server. type: string - type: - description: Type is the type of the condition. + port: + description: Port on which the endpoint lives. + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + scheme: type: string + x-kubernetes-validations: + - message: scheme must be one of [HTTP, HTTPS] + rule: self in ["", "HTTP", "HTTPS"] + required: + - port type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: + initialDelaySeconds: + description: Number of seconds after the container has started + before readiness probes are initiated. + format: int32 + minimum: 0 + type: integer + periodSeconds: + description: How often (in seconds) to perform the probe. + format: int32 + minimum: 0 + type: integer + successThreshold: + description: Minimum consecutive successes for the probe to be + considered successful after having failed. + format: int32 + minimum: 0 + type: integer + tcpSocket: + description: Health is determined by if the proxy is able to connect. properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. - - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO + host: type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object + port: + maximum: 4294967295 + minimum: 0 + type: integer + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + required: + - port type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: false - subresources: - status: {} - - additionalPrinterColumns: - - description: 'CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata' - jsonPath: .metadata.creationTimestamp - name: Age - type: date - name: v1beta1 - schema: - openAPIV3Schema: - properties: - spec: - description: 'Describes a collection of workload instances. See more details at: https://istio.io/docs/reference/config/networking/workload-group.html' - properties: - metadata: - description: Metadata that will be used for all corresponding `WorkloadEntries`. - properties: - annotations: - additionalProperties: - type: string - maxProperties: 256 - type: object - labels: - additionalProperties: - type: string - maxProperties: 256 - type: object - type: object - probe: - description: '`ReadinessProbe` describes the configuration the user must provide for healthchecking on their workload.' - oneOf: - - not: - anyOf: - - required: - - httpGet - - required: - - tcpSocket - - required: - - exec - - required: - - grpc - - required: - - httpGet - - required: - - tcpSocket - - required: - - exec - - required: - - grpc - properties: - exec: - description: Health is determined by how the command that is executed exited. - properties: - command: - description: Command to run. - items: - minLength: 1 - type: string - type: array - required: - - command - type: object - failureThreshold: - description: Minimum consecutive failures for the probe to be considered failed after having succeeded. - format: int32 - minimum: 0 - type: integer - grpc: - description: GRPC call is made and response/error is used to determine health. - properties: - port: - description: Port on which the endpoint lives. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - service: - type: string - type: object - httpGet: - description: '`httpGet` is performed to a given endpoint and the status/able to connect determines health.' - properties: - host: - description: Host name to connect to, defaults to the pod IP. - type: string - httpHeaders: - description: Headers the proxy will pass on to make the request. - items: - properties: - name: - pattern: ^[-_A-Za-z0-9]+$ - type: string - value: - type: string - type: object - type: array - path: - description: Path to access on the HTTP server. - type: string - port: - description: Port on which the endpoint lives. - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - scheme: - type: string - x-kubernetes-validations: - - message: scheme must be one of [HTTP, HTTPS] - rule: self in ["", "HTTP", "HTTPS"] - required: - - port - type: object - initialDelaySeconds: - description: Number of seconds after the container has started before readiness probes are initiated. - format: int32 - minimum: 0 - type: integer - periodSeconds: - description: How often (in seconds) to perform the probe. - format: int32 - minimum: 0 - type: integer - successThreshold: - description: Minimum consecutive successes for the probe to be considered successful after having failed. - format: int32 - minimum: 0 - type: integer - tcpSocket: - description: Health is determined by if the proxy is able to connect. - properties: - host: - type: string - port: - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - required: - - port - type: object - timeoutSeconds: - description: Number of seconds after which the probe times out. - format: int32 + timeoutSeconds: + description: Number of seconds after which the probe times out. + format: int32 + minimum: 0 + type: integer + type: object + template: + description: Template to be used for the generation of `WorkloadEntry` + resources that belong to this `WorkloadGroup`. + properties: + address: + description: Address associated with the network endpoint without + the port. + maxLength: 256 + type: string + x-kubernetes-validations: + - message: UDS must be an absolute path or abstract socket + rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == + "/" || self.substring(7, 8) == "@") : true' + - message: UDS may not be a dir + rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' + labels: + additionalProperties: + type: string + description: One or more labels associated with the endpoint. + maxProperties: 256 + type: object + locality: + description: The locality associated with the endpoint. + maxLength: 2048 + type: string + network: + description: Network enables Istio to group endpoints resident + in the same L3 domain/network. + maxLength: 2048 + type: string + ports: + additionalProperties: + maximum: 4294967295 minimum: 0 type: integer - type: object - template: - description: Template to be used for the generation of `WorkloadEntry` resources that belong to this `WorkloadGroup`. + x-kubernetes-validations: + - message: port must be between 1-65535 + rule: 0 < self && self <= 65535 + description: Set of ports associated with the endpoint. + maxProperties: 128 + type: object + x-kubernetes-validations: + - message: port name must be valid + rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) + serviceAccount: + description: The service account associated with the workload + if a sidecar is present in the workload. + maxLength: 253 + type: string + weight: + description: The load balancing weight associated with the endpoint. + maximum: 4294967295 + minimum: 0 + type: integer + type: object + x-kubernetes-validations: + - message: UDS may not include ports + rule: '(has(self.address) ? self.address : "").startsWith("unix://") + ? !has(self.ports) : true' + required: + - template + type: object + status: + properties: + conditions: + description: Current service state of the resource. + items: properties: - address: - description: Address associated with the network endpoint without the port. - maxLength: 256 + lastProbeTime: + description: Last time we probed the condition. + format: date-time type: string - x-kubernetes-validations: - - message: UDS must be an absolute path or abstract socket - rule: 'self.startsWith("unix://") ? (self.substring(7, 8) == "/" || self.substring(7, 8) == "@") : true' - - message: UDS may not be a dir - rule: 'self.startsWith("unix://") ? !self.endsWith("/") : true' - labels: - additionalProperties: - type: string - description: One or more labels associated with the endpoint. - maxProperties: 256 - type: object - locality: - description: The locality associated with the endpoint. - maxLength: 2048 + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. + format: date-time type: string - network: - description: Network enables Istio to group endpoints resident in the same L3 domain/network. - maxLength: 2048 + message: + description: Human-readable message indicating details about + last transition. type: string - ports: - additionalProperties: - maximum: 4294967295 - minimum: 0 - type: integer - x-kubernetes-validations: - - message: port must be between 1-65535 - rule: 0 < self && self <= 65535 - description: Set of ports associated with the endpoint. - maxProperties: 128 - type: object - x-kubernetes-validations: - - message: port name must be valid - rule: self.all(key, size(key) < 63 && key.matches("^[a-zA-Z0-9](?:[-a-zA-Z0-9]*[a-zA-Z0-9])?$")) - serviceAccount: - description: The service account associated with the workload if a sidecar is present in the workload. - maxLength: 253 + observedGeneration: + anyOf: + - type: integer + - type: string + description: Resource Generation to which the Condition refers. + x-kubernetes-int-or-string: true + reason: + description: Unique, one-word, CamelCase reason for the condition's + last transition. + type: string + status: + description: Status is the status of the condition. + type: string + type: + description: Type is the type of the condition. type: string - weight: - description: The load balancing weight associated with the endpoint. - maximum: 4294967295 - minimum: 0 - type: integer type: object - x-kubernetes-validations: - - message: UDS may not include ports - rule: '(has(self.address) ? self.address : "").startsWith("unix://") ? !has(self.ports) : true' - required: - - template - type: object - status: - properties: - conditions: - description: Current service state of the resource. - items: - properties: - lastProbeTime: - description: Last time we probed the condition. - format: date-time - type: string - lastTransitionTime: - description: Last time the condition transitioned from one status to another. - format: date-time - type: string - message: - description: Human-readable message indicating details about last transition. - type: string - observedGeneration: - anyOf: - - type: integer - - type: string - description: Resource Generation to which the Condition refers. - x-kubernetes-int-or-string: true - reason: - description: Unique, one-word, CamelCase reason for the condition's last transition. - type: string - status: - description: Status is the status of the condition. - type: string - type: - description: Type is the type of the condition. - type: string - type: object - type: array - observedGeneration: - anyOf: - - type: integer - - type: string - x-kubernetes-int-or-string: true - validationMessages: - description: Includes any errors or warnings detected by Istio's analyzers. - items: - properties: - documentationUrl: - description: A url pointing to the Istio documentation for this specific error type. - type: string - level: - description: |- - Represents how severe a message is. + type: array + observedGeneration: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + validationMessages: + description: Includes any errors or warnings detected by Istio's analyzers. + items: + properties: + documentationUrl: + description: A url pointing to the Istio documentation for this + specific error type. + type: string + level: + description: |- + Represents how severe a message is. + + Valid Options: UNKNOWN, ERROR, WARNING, INFO + enum: + - UNKNOWN + - ERROR + - WARNING + - INFO + type: string + type: + properties: + code: + description: A 7 character code matching `^IST[0-9]{4}$` + intended to uniquely identify the message type. + type: string + name: + description: A human-readable name for the message type. + type: string + type: object + type: object + type: array + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} - Valid Options: UNKNOWN, ERROR, WARNING, INFO - enum: - - UNKNOWN - - ERROR - - WARNING - - INFO - type: string - type: - properties: - code: - description: A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type. - type: string - name: - description: A human-readable name for the message type. - type: string - type: object - type: object - type: array - type: object - x-kubernetes-preserve-unknown-fields: true - required: - - spec - type: object - served: true - storage: false - subresources: - status: {} --- apiVersion: v1 kind: ServiceAccount @@ -16077,6 +17884,7 @@ metadata: release: istio name: istio-reader-service-account namespace: default + --- apiVersion: v1 kind: ServiceAccount @@ -16092,6 +17900,7 @@ metadata: release: istio name: istiod namespace: default + --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -16107,106 +17916,107 @@ metadata: release: istio name: istio-reader-clusterrole-default rules: - - apiGroups: - - config.istio.io - - security.istio.io - - networking.istio.io - - authentication.istio.io - - rbac.istio.io - - telemetry.istio.io - - extensions.istio.io - resources: - - '*' - verbs: - - get - - list - - watch - - apiGroups: - - "" - resources: - - endpoints - - pods - - services - - nodes - - replicationcontrollers - - namespaces - - secrets - - configmaps - verbs: - - get - - list - - watch - - apiGroups: - - networking.istio.io - resources: - - workloadentries - verbs: - - get - - watch - - list - - apiGroups: - - networking.x-k8s.io - - gateway.networking.k8s.io - resources: - - gateways - verbs: - - get - - watch - - list - - apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - get - - list - - watch - - apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - - watch - - apiGroups: - - multicluster.x-k8s.io - resources: - - serviceexports - verbs: - - get - - list - - watch - - create - - delete - - apiGroups: - - multicluster.x-k8s.io - resources: - - serviceimports - verbs: - - get - - list - - watch - - apiGroups: - - apps - resources: - - replicasets - verbs: - - get - - list - - watch - - apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create - - apiGroups: - - authorization.k8s.io - resources: - - subjectaccessreviews - verbs: - - create +- apiGroups: + - config.istio.io + - security.istio.io + - networking.istio.io + - authentication.istio.io + - rbac.istio.io + - telemetry.istio.io + - extensions.istio.io + resources: + - '*' + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - endpoints + - pods + - services + - nodes + - replicationcontrollers + - namespaces + - secrets + - configmaps + verbs: + - get + - list + - watch +- apiGroups: + - networking.istio.io + resources: + - workloadentries + verbs: + - get + - watch + - list +- apiGroups: + - networking.x-k8s.io + - gateway.networking.k8s.io + resources: + - gateways + verbs: + - get + - watch + - list +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch +- apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - get + - list + - watch +- apiGroups: + - multicluster.x-k8s.io + resources: + - serviceexports + verbs: + - get + - list + - watch + - create + - delete +- apiGroups: + - multicluster.x-k8s.io + resources: + - serviceimports + verbs: + - get + - list + - watch +- apiGroups: + - apps + resources: + - replicasets + verbs: + - get + - list + - watch +- apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create +- apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create + --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -16222,235 +18032,236 @@ metadata: release: istio name: istiod-clusterrole-default rules: - - apiGroups: - - admissionregistration.k8s.io - resources: - - mutatingwebhookconfigurations - verbs: - - get - - list - - watch - - update - - patch - - apiGroups: - - admissionregistration.k8s.io - resources: - - validatingwebhookconfigurations - verbs: - - get - - list - - watch - - update - - apiGroups: - - config.istio.io - - security.istio.io - - networking.istio.io - - authentication.istio.io - - rbac.istio.io - - telemetry.istio.io - - extensions.istio.io - resources: - - '*' - verbs: - - get - - watch - - list - - apiGroups: - - networking.istio.io - resources: - - workloadentries - verbs: - - get - - watch - - list - - update - - patch - - create - - delete - - apiGroups: - - networking.istio.io - resources: - - workloadentries/status - - serviceentries/status - verbs: - - get - - watch - - list - - update - - patch - - create - - delete - - apiGroups: - - security.istio.io - resources: - - authorizationpolicies/status - verbs: - - get - - watch - - list - - update - - patch - - create - - delete - - apiGroups: - - "" - resources: - - services/status - verbs: - - get - - watch - - list - - update - - patch - - create - - delete - - apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - get - - list - - watch - - apiGroups: - - "" - resources: - - pods - - nodes - - services - - namespaces - - endpoints - verbs: - - get - - list - - watch - - apiGroups: - - discovery.k8s.io - resources: - - endpointslices - verbs: - - get - - list - - watch - - apiGroups: - - networking.k8s.io - resources: - - ingresses - - ingressclasses - verbs: - - get - - list - - watch - - apiGroups: - - networking.k8s.io - resources: - - ingresses/status - verbs: - - '*' - - apiGroups: - - "" - resources: - - configmaps - verbs: - - create - - get - - list - - watch - - update - - apiGroups: - - authentication.k8s.io - resources: - - tokenreviews - verbs: - - create - - apiGroups: - - authorization.k8s.io - resources: - - subjectaccessreviews - verbs: - - create - - apiGroups: - - gateway.networking.k8s.io - - gateway.networking.x-k8s.io - resources: - - '*' - verbs: - - get - - watch - - list - - apiGroups: - - gateway.networking.x-k8s.io - resources: - - xbackendtrafficpolicies/status - - xlistenersets/status - verbs: - - update - - patch - - apiGroups: - - gateway.networking.k8s.io - resources: - - backendtlspolicies/status - - gatewayclasses/status - - gateways/status - - grpcroutes/status - - httproutes/status - - referencegrants/status - - tcproutes/status - - tlsroutes/status - - udproutes/status - verbs: - - update - - patch - - apiGroups: - - gateway.networking.k8s.io - resources: - - gatewayclasses - verbs: - - create - - update - - patch - - delete - - apiGroups: - - inference.networking.k8s.io - resources: - - inferencepools - verbs: - - get - - watch - - list - - apiGroups: - - inference.networking.k8s.io - resources: - - inferencepools/status - verbs: - - update - - patch - - apiGroups: - - "" - resources: - - secrets - verbs: - - get - - watch - - list - - apiGroups: - - multicluster.x-k8s.io - resources: - - serviceexports - verbs: - - get - - watch - - list - - create - - delete - - apiGroups: - - multicluster.x-k8s.io - resources: - - serviceimports - verbs: - - get - - watch - - list +- apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + verbs: + - get + - list + - watch + - update + - patch +- apiGroups: + - admissionregistration.k8s.io + resources: + - validatingwebhookconfigurations + verbs: + - get + - list + - watch + - update +- apiGroups: + - config.istio.io + - security.istio.io + - networking.istio.io + - authentication.istio.io + - rbac.istio.io + - telemetry.istio.io + - extensions.istio.io + resources: + - '*' + verbs: + - get + - watch + - list +- apiGroups: + - networking.istio.io + resources: + - workloadentries + verbs: + - get + - watch + - list + - update + - patch + - create + - delete +- apiGroups: + - networking.istio.io + resources: + - workloadentries/status + - serviceentries/status + verbs: + - get + - watch + - list + - update + - patch + - create + - delete +- apiGroups: + - security.istio.io + resources: + - authorizationpolicies/status + verbs: + - get + - watch + - list + - update + - patch + - create + - delete +- apiGroups: + - "" + resources: + - services/status + verbs: + - get + - watch + - list + - update + - patch + - create + - delete +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - pods + - nodes + - services + - namespaces + - endpoints + verbs: + - get + - list + - watch +- apiGroups: + - discovery.k8s.io + resources: + - endpointslices + verbs: + - get + - list + - watch +- apiGroups: + - networking.k8s.io + resources: + - ingresses + - ingressclasses + verbs: + - get + - list + - watch +- apiGroups: + - networking.k8s.io + resources: + - ingresses/status + verbs: + - '*' +- apiGroups: + - "" + resources: + - configmaps + verbs: + - create + - get + - list + - watch + - update +- apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create +- apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create +- apiGroups: + - gateway.networking.k8s.io + - gateway.networking.x-k8s.io + resources: + - '*' + verbs: + - get + - watch + - list +- apiGroups: + - gateway.networking.x-k8s.io + resources: + - xbackendtrafficpolicies/status + - xlistenersets/status + verbs: + - update + - patch +- apiGroups: + - gateway.networking.k8s.io + resources: + - backendtlspolicies/status + - gatewayclasses/status + - gateways/status + - grpcroutes/status + - httproutes/status + - referencegrants/status + - tcproutes/status + - tlsroutes/status + - udproutes/status + verbs: + - update + - patch +- apiGroups: + - gateway.networking.k8s.io + resources: + - gatewayclasses + verbs: + - create + - update + - patch + - delete +- apiGroups: + - inference.networking.k8s.io + resources: + - inferencepools + verbs: + - get + - watch + - list +- apiGroups: + - inference.networking.k8s.io + resources: + - inferencepools/status + verbs: + - update + - patch +- apiGroups: + - "" + resources: + - secrets + verbs: + - get + - watch + - list +- apiGroups: + - multicluster.x-k8s.io + resources: + - serviceexports + verbs: + - get + - watch + - list + - create + - delete +- apiGroups: + - multicluster.x-k8s.io + resources: + - serviceimports + verbs: + - get + - watch + - list + --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole @@ -16466,66 +18277,67 @@ metadata: release: istio name: istiod-gateway-controller-default rules: - - apiGroups: - - apps - resources: - - deployments - verbs: - - get - - watch - - list - - update - - patch - - create - - delete - - apiGroups: - - autoscaling - resources: - - horizontalpodautoscalers - verbs: - - get - - watch - - list - - update - - patch - - create - - delete - - apiGroups: - - policy - resources: - - poddisruptionbudgets - verbs: - - get - - watch - - list - - update - - patch - - create - - delete - - apiGroups: - - "" - resources: - - services - verbs: - - get - - watch - - list - - update - - patch - - create - - delete - - apiGroups: - - "" - resources: - - serviceaccounts - verbs: - - get - - watch - - list - - update - - patch - - create - - delete +- apiGroups: + - apps + resources: + - deployments + verbs: + - get + - watch + - list + - update + - patch + - create + - delete +- apiGroups: + - autoscaling + resources: + - horizontalpodautoscalers + verbs: + - get + - watch + - list + - update + - patch + - create + - delete +- apiGroups: + - policy + resources: + - poddisruptionbudgets + verbs: + - get + - watch + - list + - update + - patch + - create + - delete +- apiGroups: + - "" + resources: + - services + verbs: + - get + - watch + - list + - update + - patch + - create + - delete +- apiGroups: + - "" + resources: + - serviceaccounts + verbs: + - get + - watch + - list + - update + - patch + - create + - delete + --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -16545,9 +18357,10 @@ roleRef: kind: ClusterRole name: istio-reader-clusterrole-default subjects: - - kind: ServiceAccount - name: istio-reader-service-account - namespace: default +- kind: ServiceAccount + name: istio-reader-service-account + namespace: default + --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -16567,9 +18380,10 @@ roleRef: kind: ClusterRole name: istiod-clusterrole-default subjects: - - kind: ServiceAccount - name: istiod - namespace: default +- kind: ServiceAccount + name: istiod + namespace: default + --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding @@ -16589,9 +18403,10 @@ roleRef: kind: ClusterRole name: istiod-gateway-controller-default subjects: - - kind: ServiceAccount - name: istiod - namespace: default +- kind: ServiceAccount + name: istiod + namespace: default + --- apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration @@ -16609,35 +18424,36 @@ metadata: release: istio name: istio-validator-default webhooks: - - admissionReviewVersions: - - v1 - clientConfig: - service: - name: istiod - namespace: default - path: /validate - failurePolicy: Ignore - name: rev.validation.istio.io - objectSelector: - matchExpressions: - - key: istio.io/rev - operator: In - values: - - default - rules: - - apiGroups: - - security.istio.io - - networking.istio.io - - telemetry.istio.io - - extensions.istio.io - apiVersions: - - '*' - operations: - - CREATE - - UPDATE - resources: - - '*' - sideEffects: None +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: istiod + namespace: default + path: /validate + failurePolicy: Ignore + name: rev.validation.istio.io + objectSelector: + matchExpressions: + - key: istio.io/rev + operator: In + values: + - default + rules: + - apiGroups: + - security.istio.io + - networking.istio.io + - telemetry.istio.io + - extensions.istio.io + apiVersions: + - '*' + operations: + - CREATE + - UPDATE + resources: + - '*' + sideEffects: None + --- apiVersion: v1 data: @@ -16684,13 +18500,2500 @@ metadata: release: istio name: istio namespace: default + --- apiVersion: v1 data: config: |- - {{ .Files.Get "files/istio-config.yaml" }} + # defaultTemplates defines the default template to use for pods that do not explicitly specify a template + defaultTemplates: [sidecar] + policy: enabled + alwaysInjectSelector: + [] + neverInjectSelector: + [] + injectedAnnotations: + template: "{{ .Values.sidecarInjectorWebhook.templates.sidecar }}" + templates: + sidecar: | + {{- define "resources" }} + {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }} + {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }} + requests: + {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}} + cpu: {{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` | quote }} + {{ end }} + {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}} + memory: {{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` | quote }} + {{ end }} + {{- end }} + {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }} + limits: + {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}} + cpu: {{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` | quote }} + {{ end }} + {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}} + memory: {{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` | quote }} + {{ end }} + {{- end }} + {{- else }} + {{- if .Values.global.proxy.resources }} + {{ toYaml (omitNil .Values.global.proxy.resources) | indent 6 }} + {{- end }} + {{- end }} + {{- end }} + {{ $tproxy := (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `TPROXY`) }} + {{ $capNetBindService := (eq (annotation .ObjectMeta `sidecar.istio.io/capNetBindService` .Values.global.proxy.capNetBindService) `true`) }} + {{ $nativeSidecar := ne (index .ObjectMeta.Annotations `sidecar.istio.io/nativeSidecar` | default (printf "%t" .NativeSidecars)) "false" }} + {{- $containers := list }} + {{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}} + metadata: + labels: + security.istio.io/tlsMode: {{ index .ObjectMeta.Labels `security.istio.io/tlsMode` | default "istio" | quote }} + {{- if eq (index .ProxyConfig.ProxyMetadata "ISTIO_META_ENABLE_HBONE") "true" }} + networking.istio.io/tunnel: {{ index .ObjectMeta.Labels `networking.istio.io/tunnel` | default "http" | quote }} + {{- end }} + service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name | trunc 63 | trimSuffix "-" | quote }} + service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest" | quote }} + annotations: { + istio.io/rev: {{ .Revision | default "default" | quote }}, + {{- if ge (len $containers) 1 }} + {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }} + kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}", + {{- end }} + {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }} + kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}", + {{- end }} + {{- end }} + {{- if .Values.pilot.cni.enabled }} + {{- if eq .Values.pilot.cni.provider "multus" }} + k8s.v1.cni.cncf.io/networks: '{{ appendMultusNetwork (index .ObjectMeta.Annotations `k8s.v1.cni.cncf.io/networks`) `default/istio-cni` }}', + {{- end }} + sidecar.istio.io/interceptionMode: "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}", + {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}traffic.sidecar.istio.io/includeOutboundIPRanges: "{{.}}",{{ end }} + {{ with annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}traffic.sidecar.istio.io/excludeOutboundIPRanges: "{{.}}",{{ end }} + traffic.sidecar.istio.io/includeInboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}", + traffic.sidecar.istio.io/excludeInboundPorts: "{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}", + {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") }} + traffic.sidecar.istio.io/includeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}", + {{- end }} + {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne .Values.global.proxy.excludeOutboundPorts "") }} + traffic.sidecar.istio.io/excludeOutboundPorts: "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}", + {{- end }} + {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}traffic.sidecar.istio.io/kubevirtInterfaces: "{{.}}",{{ end }} + {{ with index .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces` }}istio.io/reroute-virtual-interfaces: "{{.}}",{{ end }} + {{ with index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}traffic.sidecar.istio.io/excludeInterfaces: "{{.}}",{{ end }} + {{- end }} + } + spec: + {{- $holdProxy := and + (or .ProxyConfig.HoldApplicationUntilProxyStarts.GetValue .Values.global.proxy.holdApplicationUntilProxyStarts) + (not $nativeSidecar) }} + {{- $noInitContainer := and + (eq (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE`) + (not $nativeSidecar) }} + {{ if $noInitContainer }} + initContainers: [] + {{ else -}} + initContainers: + {{ if ne (annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode) `NONE` }} + {{ if .Values.pilot.cni.enabled -}} + - name: istio-validation + {{ else -}} + - name: istio-init + {{ end -}} + {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image) }} + image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy_init.image }}" + {{- else }} + image: "{{ .ProxyImage }}" + {{- end }} + args: + - istio-iptables + - "-p" + - {{ .MeshConfig.ProxyListenPort | default "15001" | quote }} + - "-z" + - {{ .MeshConfig.ProxyInboundListenPort | default "15006" | quote }} + - "-u" + - {{ if $tproxy }} "1337" {{ else }} {{ .ProxyUID | default "1337" | quote }} {{ end }} + - "-m" + - "{{ annotation .ObjectMeta `sidecar.istio.io/interceptionMode` .ProxyConfig.InterceptionMode }}" + - "-i" + - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundIPRanges` .Values.global.proxy.includeIPRanges }}" + - "-x" + - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundIPRanges` .Values.global.proxy.excludeIPRanges }}" + - "-b" + - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeInboundPorts` .Values.global.proxy.includeInboundPorts }}" + - "-d" + {{- if excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }} + - "15090,15021,{{ excludeInboundPort (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) (annotation .ObjectMeta `traffic.sidecar.istio.io/excludeInboundPorts` .Values.global.proxy.excludeInboundPorts) }}" + {{- else }} + - "15090,15021" + {{- end }} + {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/includeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.includeOutboundPorts "") "") -}} + - "-q" + - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/includeOutboundPorts` .Values.global.proxy.includeOutboundPorts }}" + {{ end -}} + {{ if or (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeOutboundPorts`) (ne (valueOrDefault .Values.global.proxy.excludeOutboundPorts "") "") -}} + - "-o" + - "{{ annotation .ObjectMeta `traffic.sidecar.istio.io/excludeOutboundPorts` .Values.global.proxy.excludeOutboundPorts }}" + {{ end -}} + {{ if (isset .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces`) -}} + - "-k" + - "{{ index .ObjectMeta.Annotations `istio.io/reroute-virtual-interfaces` }}" + {{ else if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces`) -}} + - "-k" + - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/kubevirtInterfaces` }}" + {{ end -}} + {{ if (isset .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces`) -}} + - "-c" + - "{{ index .ObjectMeta.Annotations `traffic.sidecar.istio.io/excludeInterfaces` }}" + {{ end -}} + - "--log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }}" + {{ if .Values.global.logAsJson -}} + - "--log_as_json" + {{ end -}} + {{ if .Values.pilot.cni.enabled -}} + - "--run-validation" + - "--skip-rule-apply" + {{ else if .Values.global.proxy_init.forceApplyIptables -}} + - "--force-apply" + {{ end -}} + {{ if .Values.global.nativeNftables -}} + - "--native-nftables" + {{ end -}} + {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}} + {{- if .ProxyConfig.ProxyMetadata }} + env: + {{- range $key, $value := .ProxyConfig.ProxyMetadata }} + - name: {{ $key }} + value: "{{ $value }}" + {{- end }} + {{- end }} + resources: + {{ template "resources" . }} + securityContext: + allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }} + privileged: {{ .Values.global.proxy.privileged }} + capabilities: + {{- if not .Values.pilot.cni.enabled }} + add: + - NET_ADMIN + - NET_RAW + {{- end }} + drop: + - ALL + {{- if not .Values.pilot.cni.enabled }} + readOnlyRootFilesystem: false + runAsGroup: 0 + runAsNonRoot: false + runAsUser: 0 + {{- else }} + readOnlyRootFilesystem: true + runAsGroup: {{ if $tproxy }} 1337 {{ else }} {{ .ProxyGID | default "1337" }} {{ end }} + runAsUser: {{ if $tproxy }} 1337 {{ else }} {{ .ProxyUID | default "1337" }} {{ end }} + runAsNonRoot: true + {{- end }} + {{- if .Values.global.proxy.seccompProfile }} + seccompProfile: + {{- toYaml .Values.global.proxy.seccompProfile | nindent 8 }} + {{- end }} + {{ end -}} + {{ end -}} + {{ if not $nativeSidecar }} + containers: + {{ end }} + - name: istio-proxy + {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }} + image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}" + {{- else }} + image: "{{ .ProxyImage }}" + {{- end }} + {{ if $nativeSidecar }}restartPolicy: Always{{end}} + ports: + - containerPort: 15090 + protocol: TCP + name: http-envoy-prom + args: + - proxy + - sidecar + - --domain + - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }} + - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }} + - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }} + - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }} + {{- if .Values.global.sts.servicePort }} + - --stsPort={{ .Values.global.sts.servicePort }} + {{- end }} + {{- if .Values.global.logAsJson }} + - --log_as_json + {{- end }} + {{- if .Values.global.proxy.outlierLogPath }} + - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }} + {{- end}} + {{- if .Values.global.proxy.lifecycle }} + lifecycle: + {{ toYaml .Values.global.proxy.lifecycle | indent 6 }} + {{- else if $holdProxy }} + lifecycle: + postStart: + exec: + command: + - pilot-agent + - wait + {{- else if $nativeSidecar }} + {{- /* preStop is called when the pod starts shutdown. Initialize drain. We will get SIGTERM once applications are torn down. */}} + lifecycle: + preStop: + exec: + command: + - pilot-agent + - request + - --debug-port={{(annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort)}} + - POST + - drain + {{- end }} + env: + {{- if eq .InboundTrafficPolicyMode "localhost" }} + - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION + value: "true" + {{- end }} + - name: PILOT_CERT_PROVIDER + value: {{ .Values.global.pilotCertProvider }} + - name: CA_ADDR + {{- if .Values.global.caAddress }} + value: {{ .Values.global.caAddress }} + {{- else }} + value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012 + {{- end }} + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: INSTANCE_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: SERVICE_ACCOUNT + valueFrom: + fieldRef: + fieldPath: spec.serviceAccountName + - name: HOST_IP + valueFrom: + fieldRef: + fieldPath: status.hostIP + - name: ISTIO_CPU_LIMIT + valueFrom: + resourceFieldRef: + resource: limits.cpu + divisor: "1" + - name: PROXY_CONFIG + value: | + {{ protoToJSON .ProxyConfig }} + - name: ISTIO_META_POD_PORTS + value: |- + [ + {{- $first := true }} + {{- range $index1, $c := .Spec.Containers }} + {{- range $index2, $p := $c.Ports }} + {{- if (structToJSON $p) }} + {{if not $first}},{{end}}{{ structToJSON $p }} + {{- $first = false }} + {{- end }} + {{- end}} + {{- end}} + ] + - name: ISTIO_META_APP_CONTAINERS + value: "{{ $containers | join "," }}" + - name: GOMEMLIMIT + valueFrom: + resourceFieldRef: + resource: limits.memory + divisor: "1" + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + resource: limits.cpu + divisor: "1" + {{- if .CompliancePolicy }} + - name: COMPLIANCE_POLICY + value: "{{ .CompliancePolicy }}" + {{- end }} + - name: ISTIO_META_CLUSTER_ID + value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}" + - name: ISTIO_META_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + - name: ISTIO_META_INTERCEPTION_MODE + value: "{{ or (index .ObjectMeta.Annotations `sidecar.istio.io/interceptionMode`) .ProxyConfig.InterceptionMode.String }}" + {{- if .Values.global.network }} + - name: ISTIO_META_NETWORK + value: "{{ .Values.global.network }}" + {{- end }} + {{- with (index .ObjectMeta.Labels `service.istio.io/workload-name` | default .DeploymentMeta.Name) }} + - name: ISTIO_META_WORKLOAD_NAME + value: "{{ . }}" + {{ end }} + {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }} + - name: ISTIO_META_OWNER + value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }} + {{- end}} + {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }} + - name: ISTIO_BOOTSTRAP_OVERRIDE + value: "/etc/istio/custom-bootstrap/custom_bootstrap.json" + {{- end }} + {{- if .Values.global.meshID }} + - name: ISTIO_META_MESH_ID + value: "{{ .Values.global.meshID }}" + {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }} + - name: ISTIO_META_MESH_ID + value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}" + {{- end }} + {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }} + - name: TRUST_DOMAIN + value: "{{ . }}" + {{- end }} + {{- if and (eq .Values.global.proxy.tracer "datadog") (isset .ObjectMeta.Annotations `apm.datadoghq.com/env`) }} + {{- range $key, $value := fromJSON (index .ObjectMeta.Annotations `apm.datadoghq.com/env`) }} + - name: {{ $key }} + value: "{{ $value }}" + {{- end }} + {{- end }} + {{- range $key, $value := .ProxyConfig.ProxyMetadata }} + - name: {{ $key }} + value: "{{ $value }}" + {{- end }} + {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}} + {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }} + {{ if .Values.global.proxy.startupProbe.enabled }} + startupProbe: + httpGet: + path: /healthz/ready + port: 15021 + initialDelaySeconds: 0 + periodSeconds: 1 + timeoutSeconds: 3 + failureThreshold: {{ .Values.global.proxy.startupProbe.failureThreshold }} + {{ end }} + readinessProbe: + httpGet: + path: /healthz/ready + port: 15021 + initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }} + periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }} + timeoutSeconds: 3 + failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }} + {{ end -}} + securityContext: + {{- if eq (index .ProxyConfig.ProxyMetadata "IPTABLES_TRACE_LOGGING") "true" }} + allowPrivilegeEscalation: true + capabilities: + add: + - NET_ADMIN + drop: + - ALL + privileged: true + readOnlyRootFilesystem: true + runAsGroup: {{ .ProxyGID | default "1337" }} + runAsNonRoot: false + runAsUser: 0 + {{- else }} + allowPrivilegeEscalation: {{ .Values.global.proxy.privileged }} + capabilities: + {{ if or $tproxy $capNetBindService -}} + add: + {{ if $tproxy -}} + - NET_ADMIN + {{- end }} + {{ if $capNetBindService -}} + - NET_BIND_SERVICE + {{- end }} + {{- end }} + drop: + - ALL + privileged: {{ .Values.global.proxy.privileged }} + readOnlyRootFilesystem: true + {{ if or $tproxy $capNetBindService -}} + runAsNonRoot: false + runAsUser: 0 + runAsGroup: 1337 + {{- else -}} + runAsNonRoot: true + runAsUser: {{ .ProxyUID | default "1337" }} + runAsGroup: {{ .ProxyGID | default "1337" }} + {{- end }} + {{- end }} + {{- if .Values.global.proxy.seccompProfile }} + seccompProfile: + {{- toYaml .Values.global.proxy.seccompProfile | nindent 8 }} + {{- end }} + resources: + {{ template "resources" . }} + volumeMounts: + - name: workload-socket + mountPath: /var/run/secrets/workload-spiffe-uds + - name: credential-socket + mountPath: /var/run/secrets/credential-uds + {{- if eq .Values.global.caName "GkeWorkloadCertificate" }} + - name: gke-workload-certificate + mountPath: /var/run/secrets/workload-spiffe-credentials + readOnly: true + {{- else }} + - name: workload-certs + mountPath: /var/run/secrets/workload-spiffe-credentials + {{- end }} + {{- if eq .Values.global.pilotCertProvider "istiod" }} + - mountPath: /var/run/secrets/istio + name: istiod-ca-cert + - mountPath: /var/run/secrets/istio/crl + name: istio-ca-crl + {{- end }} + - mountPath: /var/lib/istio/data + name: istio-data + {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }} + - mountPath: /etc/istio/custom-bootstrap + name: custom-bootstrap-volume + {{- end }} + # SDS channel between istioagent and Envoy + - mountPath: /etc/istio/proxy + name: istio-envoy + - mountPath: /var/run/secrets/tokens + name: istio-token + {{- if .Values.global.mountMtlsCerts }} + # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications. + - mountPath: /etc/certs/ + name: istio-certs + readOnly: true + {{- end }} + - name: istio-podinfo + mountPath: /etc/istio/pod + {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }} + - mountPath: {{ directory .ProxyConfig.GetTracing.GetTlsSettings.GetCaCertificates }} + name: lightstep-certs + readOnly: true + {{- end }} + {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }} + {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }} + - name: "{{ $index }}" + {{ toYaml $value | indent 6 }} + {{ end }} + {{- end }} + volumes: + - emptyDir: + name: workload-socket + - emptyDir: + name: credential-socket + {{- if eq .Values.global.caName "GkeWorkloadCertificate" }} + - name: gke-workload-certificate + csi: + driver: workloadcertificates.security.cloud.google.com + {{- else }} + - emptyDir: + name: workload-certs + {{- end }} + {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }} + - name: custom-bootstrap-volume + configMap: + name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }} + {{- end }} + # SDS channel between istioagent and Envoy + - emptyDir: + medium: Memory + name: istio-envoy + - name: istio-data + emptyDir: {} + - name: istio-podinfo + downwardAPI: + items: + - path: "labels" + fieldRef: + fieldPath: metadata.labels + - path: "annotations" + fieldRef: + fieldPath: metadata.annotations + - name: istio-token + projected: + sources: + - serviceAccountToken: + path: istio-token + expirationSeconds: 43200 + audience: {{ .Values.global.sds.token.aud }} + {{- if eq .Values.global.pilotCertProvider "istiod" }} + - name: istiod-ca-cert + {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }} + projected: + sources: + - clusterTrustBundle: + name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }} + path: root-cert.pem + {{- else }} + configMap: + name: {{ .Values.global.trustBundleName | default "istio-ca-root-cert" }} + {{- end }} + {{- end }} + - name: istio-ca-crl + configMap: + name: {{ .Values.pilot.crlConfigMapName | default "istio-ca-crl" }} + optional: true + {{- if .Values.global.mountMtlsCerts }} + # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications. + - name: istio-certs + secret: + optional: true + {{ if eq .Spec.ServiceAccountName "" }} + secretName: istio.default + {{ else -}} + secretName: {{ printf "istio.%s" .Spec.ServiceAccountName }} + {{ end -}} + {{- end }} + {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }} + {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }} + - name: "{{ $index }}" + {{ toYaml $value | indent 4 }} + {{ end }} + {{ end }} + {{- if and (eq .Values.global.proxy.tracer "lightstep") .ProxyConfig.GetTracing.GetTlsSettings }} + - name: lightstep-certs + secret: + optional: true + secretName: lightstep.cacert + {{- end }} + {{- if .Values.global.imagePullSecrets }} + imagePullSecrets: + {{- range .Values.global.imagePullSecrets }} + - name: {{ . }} + {{- end }} + {{- end }} + gateway: | + {{- $containers := list }} + {{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}} + metadata: + labels: + service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name | quote }} + service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest" | quote }} + annotations: + istio.io/rev: {{ .Revision | default "default" | quote }} + {{- if ge (len $containers) 1 }} + {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }} + kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}" + {{- end }} + {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }} + kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}" + {{- end }} + {{- end }} + spec: + securityContext: + {{- if .Values.gateways.securityContext }} + {{- toYaml .Values.gateways.securityContext | nindent 4 }} + {{- else }} + sysctls: + - name: net.ipv4.ip_unprivileged_port_start + value: "0" + {{- end }} + containers: + - name: istio-proxy + {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }} + image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}" + {{- else }} + image: "{{ .ProxyImage }}" + {{- end }} + ports: + - containerPort: 15090 + protocol: TCP + name: http-envoy-prom + args: + - proxy + - router + - --domain + - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }} + - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }} + - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }} + - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }} + {{- if .Values.global.sts.servicePort }} + - --stsPort={{ .Values.global.sts.servicePort }} + {{- end }} + {{- if .Values.global.logAsJson }} + - --log_as_json + {{- end }} + {{- if .Values.global.proxy.lifecycle }} + lifecycle: + {{ toYaml .Values.global.proxy.lifecycle | indent 6 }} + {{- end }} + securityContext: + runAsUser: {{ .ProxyUID | default "1337" }} + runAsGroup: {{ .ProxyGID | default "1337" }} + env: + - name: PILOT_CERT_PROVIDER + value: {{ .Values.global.pilotCertProvider }} + - name: CA_ADDR + {{- if .Values.global.caAddress }} + value: {{ .Values.global.caAddress }} + {{- else }} + value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012 + {{- end }} + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: INSTANCE_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: SERVICE_ACCOUNT + valueFrom: + fieldRef: + fieldPath: spec.serviceAccountName + - name: HOST_IP + valueFrom: + fieldRef: + fieldPath: status.hostIP + - name: ISTIO_CPU_LIMIT + valueFrom: + resourceFieldRef: + resource: limits.cpu + divisor: "1" + - name: PROXY_CONFIG + value: | + {{ protoToJSON .ProxyConfig }} + - name: ISTIO_META_POD_PORTS + value: |- + [ + {{- $first := true }} + {{- range $index1, $c := .Spec.Containers }} + {{- range $index2, $p := $c.Ports }} + {{- if (structToJSON $p) }} + {{if not $first}},{{end}}{{ structToJSON $p }} + {{- $first = false }} + {{- end }} + {{- end}} + {{- end}} + ] + - name: GOMEMLIMIT + valueFrom: + resourceFieldRef: + resource: limits.memory + divisor: "1" + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + resource: limits.cpu + divisor: "1" + {{- if .CompliancePolicy }} + - name: COMPLIANCE_POLICY + value: "{{ .CompliancePolicy }}" + {{- end }} + - name: ISTIO_META_APP_CONTAINERS + value: "{{ $containers | join "," }}" + - name: ISTIO_META_CLUSTER_ID + value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}" + - name: ISTIO_META_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + - name: ISTIO_META_INTERCEPTION_MODE + value: "{{ .ProxyConfig.InterceptionMode.String }}" + {{- if .Values.global.network }} + - name: ISTIO_META_NETWORK + value: "{{ .Values.global.network }}" + {{- end }} + {{- if .DeploymentMeta.Name }} + - name: ISTIO_META_WORKLOAD_NAME + value: "{{ .DeploymentMeta.Name }}" + {{ end }} + {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }} + - name: ISTIO_META_OWNER + value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }} + {{- end}} + {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }} + - name: ISTIO_BOOTSTRAP_OVERRIDE + value: "/etc/istio/custom-bootstrap/custom_bootstrap.json" + {{- end }} + {{- if .Values.global.meshID }} + - name: ISTIO_META_MESH_ID + value: "{{ .Values.global.meshID }}" + {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }} + - name: ISTIO_META_MESH_ID + value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}" + {{- end }} + {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }} + - name: TRUST_DOMAIN + value: "{{ . }}" + {{- end }} + {{- range $key, $value := .ProxyConfig.ProxyMetadata }} + - name: {{ $key }} + value: "{{ $value }}" + {{- end }} + {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}} + readinessProbe: + httpGet: + path: /healthz/ready + port: 15021 + initialDelaySeconds: {{.Values.global.proxy.readinessInitialDelaySeconds }} + periodSeconds: {{ .Values.global.proxy.readinessPeriodSeconds }} + timeoutSeconds: 3 + failureThreshold: {{ .Values.global.proxy.readinessFailureThreshold }} + volumeMounts: + - name: workload-socket + mountPath: /var/run/secrets/workload-spiffe-uds + - name: credential-socket + mountPath: /var/run/secrets/credential-uds + {{- if eq .Values.global.caName "GkeWorkloadCertificate" }} + - name: gke-workload-certificate + mountPath: /var/run/secrets/workload-spiffe-credentials + readOnly: true + {{- else }} + - name: workload-certs + mountPath: /var/run/secrets/workload-spiffe-credentials + {{- end }} + {{- if eq .Values.global.pilotCertProvider "istiod" }} + - mountPath: /var/run/secrets/istio + name: istiod-ca-cert + {{- end }} + - mountPath: /var/lib/istio/data + name: istio-data + {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }} + - mountPath: /etc/istio/custom-bootstrap + name: custom-bootstrap-volume + {{- end }} + # SDS channel between istioagent and Envoy + - mountPath: /etc/istio/proxy + name: istio-envoy + - mountPath: /var/run/secrets/tokens + name: istio-token + {{- if .Values.global.mountMtlsCerts }} + # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications. + - mountPath: /etc/certs/ + name: istio-certs + readOnly: true + {{- end }} + - name: istio-podinfo + mountPath: /etc/istio/pod + volumes: + - emptyDir: + name: workload-socket + - emptyDir: {} + name: credential-socket + {{- if eq .Values.global.caName "GkeWorkloadCertificate" }} + - name: gke-workload-certificate + csi: + driver: workloadcertificates.security.cloud.google.com + {{- else}} + - emptyDir: {} + name: workload-certs + {{- end }} + {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }} + - name: custom-bootstrap-volume + configMap: + name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }} + {{- end }} + # SDS channel between istioagent and Envoy + - emptyDir: + medium: Memory + name: istio-envoy + - name: istio-data + emptyDir: {} + - name: istio-podinfo + downwardAPI: + items: + - path: "labels" + fieldRef: + fieldPath: metadata.labels + - path: "annotations" + fieldRef: + fieldPath: metadata.annotations + - name: istio-token + projected: + sources: + - serviceAccountToken: + path: istio-token + expirationSeconds: 43200 + audience: {{ .Values.global.sds.token.aud }} + {{- if eq .Values.global.pilotCertProvider "istiod" }} + - name: istiod-ca-cert + {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }} + projected: + sources: + - clusterTrustBundle: + name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }} + path: root-cert.pem + {{- else }} + configMap: + name: {{ .Values.global.trustBundleName | default "istio-ca-root-cert" }} + {{- end }} + {{- end }} + {{- if .Values.global.mountMtlsCerts }} + # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications. + - name: istio-certs + secret: + optional: true + {{ if eq .Spec.ServiceAccountName "" }} + secretName: istio.default + {{ else -}} + secretName: {{ printf "istio.%s" .Spec.ServiceAccountName }} + {{ end -}} + {{- end }} + {{- if .Values.global.imagePullSecrets }} + imagePullSecrets: + {{- range .Values.global.imagePullSecrets }} + - name: {{ . }} + {{- end }} + {{- end }} + grpc-simple: | + metadata: + annotations: + sidecar.istio.io/rewriteAppHTTPProbers: "false" + spec: + initContainers: + - name: grpc-bootstrap-init + image: busybox:1.28 + volumeMounts: + - mountPath: /var/lib/grpc/data/ + name: grpc-io-proxyless-bootstrap + env: + - name: INSTANCE_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: ISTIO_NAMESPACE + value: | + {{ .Values.global.istioNamespace }} + command: + - sh + - "-c" + - |- + NODE_ID="sidecar~${INSTANCE_IP}~${POD_NAME}.${POD_NAMESPACE}~cluster.local" + SERVER_URI="dns:///istiod.${ISTIO_NAMESPACE}.svc:15010" + echo ' + { + "xds_servers": [ + { + "server_uri": "'${SERVER_URI}'", + "channel_creds": [{"type": "insecure"}], + "server_features" : ["xds_v3"] + } + ], + "node": { + "id": "'${NODE_ID}'", + "metadata": { + "GENERATOR": "grpc" + } + } + }' > /var/lib/grpc/data/bootstrap.json + containers: + {{- range $index, $container := .Spec.Containers }} + - name: {{ $container.Name }} + env: + - name: GRPC_XDS_BOOTSTRAP + value: /var/lib/grpc/data/bootstrap.json + - name: GRPC_GO_LOG_VERBOSITY_LEVEL + value: "99" + - name: GRPC_GO_LOG_SEVERITY_LEVEL + value: info + volumeMounts: + - mountPath: /var/lib/grpc/data/ + name: grpc-io-proxyless-bootstrap + {{- end }} + volumes: + - name: grpc-io-proxyless-bootstrap + emptyDir: {} + grpc-agent: | + {{- define "resources" }} + {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }} + {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) }} + requests: + {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU`) -}} + cpu: {{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPU` | quote }} + {{ end }} + {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory`) -}} + memory: {{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemory` | quote }} + {{ end }} + {{- end }} + {{- if or (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) }} + limits: + {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit`) -}} + cpu: {{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyCPULimit` | quote }} + {{ end }} + {{ if (isset .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit`) -}} + memory: {{ index .ObjectMeta.Annotations `sidecar.istio.io/proxyMemoryLimit` | quote }} + {{ end }} + {{- end }} + {{- else }} + {{- if .Values.global.proxy.resources }} + {{ toYaml (omitNil .Values.global.proxy.resources) | indent 6 }} + {{- end }} + {{- end }} + {{- end }} + {{- $containers := list }} + {{- range $index, $container := .Spec.Containers }}{{ if not (eq $container.Name "istio-proxy") }}{{ $containers = append $containers $container.Name }}{{end}}{{- end}} + metadata: + labels: + {{/* security.istio.io/tlsMode: istio must be set by user, if gRPC is using mTLS initialization code. We can't set it automatically. */}} + service.istio.io/canonical-name: {{ index .ObjectMeta.Labels `service.istio.io/canonical-name` | default (index .ObjectMeta.Labels `app.kubernetes.io/name`) | default (index .ObjectMeta.Labels `app`) | default .DeploymentMeta.Name | quote }} + service.istio.io/canonical-revision: {{ index .ObjectMeta.Labels `service.istio.io/canonical-revision` | default (index .ObjectMeta.Labels `app.kubernetes.io/version`) | default (index .ObjectMeta.Labels `version`) | default "latest" | quote }} + annotations: { + istio.io/rev: {{ .Revision | default "default" | quote }}, + {{- if ge (len $containers) 1 }} + {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-logs-container`) }} + kubectl.kubernetes.io/default-logs-container: "{{ index $containers 0 }}", + {{- end }} + {{- if not (isset .ObjectMeta.Annotations `kubectl.kubernetes.io/default-container`) }} + kubectl.kubernetes.io/default-container: "{{ index $containers 0 }}", + {{- end }} + {{- end }} + sidecar.istio.io/rewriteAppHTTPProbers: "false", + } + spec: + containers: + - name: istio-proxy + {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }} + image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}" + {{- else }} + image: "{{ .ProxyImage }}" + {{- end }} + ports: + - containerPort: 15020 + protocol: TCP + name: mesh-metrics + args: + - proxy + - sidecar + - --domain + - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }} + - --proxyLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel }} + - --proxyComponentLogLevel={{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel }} + - --log_output_level={{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level }} + {{- if .Values.global.sts.servicePort }} + - --stsPort={{ .Values.global.sts.servicePort }} + {{- end }} + {{- if .Values.global.logAsJson }} + - --log_as_json + {{- end }} + lifecycle: + postStart: + exec: + command: + - pilot-agent + - wait + - --url=http://localhost:15020/healthz/ready + env: + - name: ISTIO_META_GENERATOR + value: grpc + - name: OUTPUT_CERTS + value: /var/lib/istio/data + {{- if eq .InboundTrafficPolicyMode "localhost" }} + - name: REWRITE_PROBE_LEGACY_LOCALHOST_DESTINATION + value: "true" + {{- end }} + - name: PILOT_CERT_PROVIDER + value: {{ .Values.global.pilotCertProvider }} + - name: CA_ADDR + {{- if .Values.global.caAddress }} + value: {{ .Values.global.caAddress }} + {{- else }} + value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012 + {{- end }} + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: INSTANCE_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: SERVICE_ACCOUNT + valueFrom: + fieldRef: + fieldPath: spec.serviceAccountName + - name: HOST_IP + valueFrom: + fieldRef: + fieldPath: status.hostIP + - name: PROXY_CONFIG + value: | + {{ protoToJSON .ProxyConfig }} + - name: ISTIO_META_POD_PORTS + value: |- + [ + {{- $first := true }} + {{- range $index1, $c := .Spec.Containers }} + {{- range $index2, $p := $c.Ports }} + {{- if (structToJSON $p) }} + {{if not $first}},{{end}}{{ structToJSON $p }} + {{- $first = false }} + {{- end }} + {{- end}} + {{- end}} + ] + - name: ISTIO_META_APP_CONTAINERS + value: "{{ $containers | join "," }}" + - name: ISTIO_META_CLUSTER_ID + value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}" + - name: ISTIO_META_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + {{- if .Values.global.network }} + - name: ISTIO_META_NETWORK + value: "{{ .Values.global.network }}" + {{- end }} + {{- if .DeploymentMeta.Name }} + - name: ISTIO_META_WORKLOAD_NAME + value: "{{ .DeploymentMeta.Name }}" + {{ end }} + {{- if and .TypeMeta.APIVersion .DeploymentMeta.Name }} + - name: ISTIO_META_OWNER + value: kubernetes://apis/{{ .TypeMeta.APIVersion }}/namespaces/{{ valueOrDefault .DeploymentMeta.Namespace `default` }}/{{ toLower .TypeMeta.Kind}}s/{{ .DeploymentMeta.Name }} + {{- end}} + {{- if .Values.global.meshID }} + - name: ISTIO_META_MESH_ID + value: "{{ .Values.global.meshID }}" + {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }} + - name: ISTIO_META_MESH_ID + value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}" + {{- end }} + {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }} + - name: TRUST_DOMAIN + value: "{{ . }}" + {{- end }} + {{- range $key, $value := .ProxyConfig.ProxyMetadata }} + - name: {{ $key }} + value: "{{ $value }}" + {{- end }} + # grpc uses xds:/// to resolve – no need to resolve VIP + - name: ISTIO_META_DNS_CAPTURE + value: "false" + - name: DISABLE_ENVOY + value: "true" + {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}} + {{ if ne (annotation .ObjectMeta `status.sidecar.istio.io/port` .Values.global.proxy.statusPort) `0` }} + readinessProbe: + httpGet: + path: /healthz/ready + port: 15020 + initialDelaySeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/initialDelaySeconds` .Values.global.proxy.readinessInitialDelaySeconds }} + periodSeconds: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/periodSeconds` .Values.global.proxy.readinessPeriodSeconds }} + timeoutSeconds: 3 + failureThreshold: {{ annotation .ObjectMeta `readiness.status.sidecar.istio.io/failureThreshold` .Values.global.proxy.readinessFailureThreshold }} + resources: + {{ template "resources" . }} + volumeMounts: + - name: workload-socket + mountPath: /var/run/secrets/workload-spiffe-uds + {{- if eq .Values.global.caName "GkeWorkloadCertificate" }} + - name: gke-workload-certificate + mountPath: /var/run/secrets/workload-spiffe-credentials + readOnly: true + {{- else }} + - name: workload-certs + mountPath: /var/run/secrets/workload-spiffe-credentials + {{- end }} + {{- if eq .Values.global.pilotCertProvider "istiod" }} + - mountPath: /var/run/secrets/istio + name: istiod-ca-cert + {{- end }} + - mountPath: /var/lib/istio/data + name: istio-data + # UDS channel between istioagent and gRPC client for XDS/SDS + - mountPath: /etc/istio/proxy + name: istio-xds + - mountPath: /var/run/secrets/tokens + name: istio-token + {{- if .Values.global.mountMtlsCerts }} + # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications. + - mountPath: /etc/certs/ + name: istio-certs + readOnly: true + {{- end }} + - name: istio-podinfo + mountPath: /etc/istio/pod + {{- end }} + {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount` }} + {{ range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolumeMount`) }} + - name: "{{ $index }}" + {{ toYaml $value | indent 6 }} + {{ end }} + {{- end }} + {{- range $index, $container := .Spec.Containers }} + {{ if not (eq $container.Name "istio-proxy") }} + - name: {{ $container.Name }} + env: + - name: "GRPC_XDS_EXPERIMENTAL_SECURITY_SUPPORT" + value: "true" + - name: "GRPC_XDS_BOOTSTRAP" + value: "/etc/istio/proxy/grpc-bootstrap.json" + volumeMounts: + - mountPath: /var/lib/istio/data + name: istio-data + # UDS channel between istioagent and gRPC client for XDS/SDS + - mountPath: /etc/istio/proxy + name: istio-xds + {{- if eq $.Values.global.caName "GkeWorkloadCertificate" }} + - name: gke-workload-certificate + mountPath: /var/run/secrets/workload-spiffe-credentials + readOnly: true + {{- else }} + - name: workload-certs + mountPath: /var/run/secrets/workload-spiffe-credentials + {{- end }} + {{- end }} + {{- end }} + volumes: + - emptyDir: + name: workload-socket + {{- if eq .Values.global.caName "GkeWorkloadCertificate" }} + - name: gke-workload-certificate + csi: + driver: workloadcertificates.security.cloud.google.com + {{- else }} + - emptyDir: + name: workload-certs + {{- end }} + {{- if (isset .ObjectMeta.Annotations `sidecar.istio.io/bootstrapOverride`) }} + - name: custom-bootstrap-volume + configMap: + name: {{ annotation .ObjectMeta `sidecar.istio.io/bootstrapOverride` "" }} + {{- end }} + # SDS channel between istioagent and Envoy + - emptyDir: + medium: Memory + name: istio-xds + - name: istio-data + emptyDir: {} + - name: istio-podinfo + downwardAPI: + items: + - path: "labels" + fieldRef: + fieldPath: metadata.labels + - path: "annotations" + fieldRef: + fieldPath: metadata.annotations + - name: istio-token + projected: + sources: + - serviceAccountToken: + path: istio-token + expirationSeconds: 43200 + audience: {{ .Values.global.sds.token.aud }} + {{- if eq .Values.global.pilotCertProvider "istiod" }} + - name: istiod-ca-cert + {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }} + projected: + sources: + - clusterTrustBundle: + name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }} + path: root-cert.pem + {{- else }} + configMap: + name: {{ .Values.global.trustBundleName | default "istio-ca-root-cert" }} + {{- end }} + {{- end }} + {{- if .Values.global.mountMtlsCerts }} + # Use the key and cert mounted to /etc/certs/ for the in-cluster mTLS communications. + - name: istio-certs + secret: + optional: true + {{ if eq .Spec.ServiceAccountName "" }} + secretName: istio.default + {{ else -}} + secretName: {{ printf "istio.%s" .Spec.ServiceAccountName }} + {{ end -}} + {{- end }} + {{- if isset .ObjectMeta.Annotations `sidecar.istio.io/userVolume` }} + {{range $index, $value := fromJSON (index .ObjectMeta.Annotations `sidecar.istio.io/userVolume`) }} + - name: "{{ $index }}" + {{ toYaml $value | indent 4 }} + {{ end }} + {{ end }} + {{- if .Values.global.imagePullSecrets }} + imagePullSecrets: + {{- range .Values.global.imagePullSecrets }} + - name: {{ . }} + {{- end }} + {{- end }} + waypoint: | + apiVersion: v1 + kind: ServiceAccount + metadata: + name: {{.ServiceAccount | quote}} + namespace: {{.Namespace | quote}} + annotations: + {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }} + labels: + {{- toJsonMap + .InfrastructureLabels + (strdict + "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass + ) | nindent 4 }} + {{- if ge .KubeVersion 128 }} + # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412 + ownerReferences: + - apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + name: "{{.Name}}" + uid: "{{.UID}}" + {{- end }} + --- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: {{.DeploymentName | quote}} + namespace: {{.Namespace | quote}} + annotations: + {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }} + labels: + {{- toJsonMap + .InfrastructureLabels + (strdict + "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass + "gateway.istio.io/managed" .ControllerLabel + ) | nindent 4 }} + ownerReferences: + - apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + name: "{{.Name}}" + uid: "{{.UID}}" + spec: + selector: + matchLabels: + "{{.GatewayNameLabel}}": "{{.Name}}" + template: + metadata: + annotations: + {{- toJsonMap + (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") + (strdict "istio.io/rev" (.Revision | default "default")) + (strdict + "prometheus.io/path" "/stats/prometheus" + "prometheus.io/port" "15020" + "prometheus.io/scrape" "true" + ) | nindent 8 }} + labels: + {{- toJsonMap + (strdict + "sidecar.istio.io/inject" "false" + "istio.io/dataplane-mode" "none" + "service.istio.io/canonical-name" .DeploymentName + "service.istio.io/canonical-revision" "latest" + ) + .InfrastructureLabels + (strdict + "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass + "gateway.istio.io/managed" .ControllerLabel + ) | nindent 8}} + spec: + {{- if .Values.global.waypoint.affinity }} + affinity: + {{- toYaml .Values.global.waypoint.affinity | nindent 8 }} + {{- end }} + {{- if .Values.global.waypoint.topologySpreadConstraints }} + topologySpreadConstraints: + {{- toYaml .Values.global.waypoint.topologySpreadConstraints | nindent 8 }} + {{- end }} + {{- if .Values.global.waypoint.nodeSelector }} + nodeSelector: + {{- toYaml .Values.global.waypoint.nodeSelector | nindent 8 }} + {{- end }} + {{- if .Values.global.waypoint.tolerations }} + tolerations: + {{- toYaml .Values.global.waypoint.tolerations | nindent 8 }} + {{- end }} + serviceAccountName: {{.ServiceAccount | quote}} + containers: + - name: istio-proxy + ports: + - containerPort: 15020 + name: metrics + protocol: TCP + - containerPort: 15021 + name: status-port + protocol: TCP + - containerPort: 15090 + protocol: TCP + name: http-envoy-prom + {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }} + image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}" + {{- else }} + image: "{{ .ProxyImage }}" + {{- end }} + {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}} + args: + - proxy + - waypoint + - --domain + - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }} + - --serviceCluster + - {{.ServiceAccount}}.$(POD_NAMESPACE) + - --proxyLogLevel + - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}} + - --proxyComponentLogLevel + - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}} + - --log_output_level + - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}} + {{- if .Values.global.logAsJson }} + - --log_as_json + {{- end }} + {{- if .Values.global.proxy.outlierLogPath }} + - --outlierLogPath={{ .Values.global.proxy.outlierLogPath }} + {{- end}} + env: + - name: ISTIO_META_SERVICE_ACCOUNT + valueFrom: + fieldRef: + fieldPath: spec.serviceAccountName + - name: ISTIO_META_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + - name: PILOT_CERT_PROVIDER + value: {{ .Values.global.pilotCertProvider }} + - name: CA_ADDR + {{- if .Values.global.caAddress }} + value: {{ .Values.global.caAddress }} + {{- else }} + value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012 + {{- end }} + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: INSTANCE_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: SERVICE_ACCOUNT + valueFrom: + fieldRef: + fieldPath: spec.serviceAccountName + - name: HOST_IP + valueFrom: + fieldRef: + fieldPath: status.hostIP + - name: ISTIO_CPU_LIMIT + valueFrom: + resourceFieldRef: + resource: limits.cpu + divisor: "1" + - name: PROXY_CONFIG + value: | + {{ protoToJSON .ProxyConfig }} + {{- if .ProxyConfig.ProxyMetadata }} + {{- range $key, $value := .ProxyConfig.ProxyMetadata }} + - name: {{ $key }} + value: "{{ $value }}" + {{- end }} + {{- end }} + - name: GOMEMLIMIT + valueFrom: + resourceFieldRef: + resource: limits.memory + divisor: "1" + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + resource: limits.cpu + divisor: "1" + - name: ISTIO_META_CLUSTER_ID + value: "{{ valueOrDefault .Values.global.multiCluster.clusterName `Kubernetes` }}" + {{- $network := valueOrDefault (index .InfrastructureLabels `topology.istio.io/network`) .Values.global.network }} + {{- if $network }} + - name: ISTIO_META_NETWORK + value: "{{ $network }}" + {{- if eq .ControllerLabel "istio.io-eastwest-controller" }} + - name: ISTIO_META_REQUESTED_NETWORK_VIEW + value: "{{ $network }}" + {{- end }} + {{- end }} + - name: ISTIO_META_INTERCEPTION_MODE + value: REDIRECT + - name: ISTIO_META_WORKLOAD_NAME + value: {{.DeploymentName}} + - name: ISTIO_META_OWNER + value: kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}} + {{- if .Values.global.meshID }} + - name: ISTIO_META_MESH_ID + value: "{{ .Values.global.meshID }}" + {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }} + - name: ISTIO_META_MESH_ID + value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}" + {{- end }} + {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }} + - name: TRUST_DOMAIN + value: "{{ . }}" + {{- end }} + {{- if .Values.global.waypoint.resources }} + resources: + {{- toYaml (omitNil .Values.global.waypoint.resources) | nindent 10 }} + {{- end }} + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz/ready + port: 15021 + scheme: HTTP + initialDelaySeconds: 1 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 + readinessProbe: + failureThreshold: 4 + httpGet: + path: /healthz/ready + port: 15021 + scheme: HTTP + initialDelaySeconds: 0 + periodSeconds: 15 + successThreshold: 1 + timeoutSeconds: 1 + securityContext: + privileged: false + {{- if not (eq .Values.global.platform "openshift") }} + runAsGroup: 1337 + runAsUser: 1337 + {{- end }} + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + capabilities: + drop: + - ALL + {{- if .Values.gateways.seccompProfile }} + seccompProfile: + {{- toYaml .Values.gateways.seccompProfile | nindent 12 }} + {{- end }} + volumeMounts: + - mountPath: /var/run/secrets/workload-spiffe-uds + name: workload-socket + - mountPath: /var/run/secrets/istio + name: istiod-ca-cert + - mountPath: /var/lib/istio/data + name: istio-data + - mountPath: /etc/istio/proxy + name: istio-envoy + - mountPath: /var/run/secrets/tokens + name: istio-token + - mountPath: /etc/istio/pod + name: istio-podinfo + volumes: + - emptyDir: {} + name: workload-socket + - emptyDir: + medium: Memory + name: istio-envoy + - emptyDir: + medium: Memory + name: go-proxy-envoy + - emptyDir: {} + name: istio-data + - emptyDir: {} + name: go-proxy-data + - downwardAPI: + items: + - fieldRef: + fieldPath: metadata.labels + path: labels + - fieldRef: + fieldPath: metadata.annotations + path: annotations + name: istio-podinfo + - name: istio-token + projected: + sources: + - serviceAccountToken: + audience: istio-ca + expirationSeconds: 43200 + path: istio-token + - name: istiod-ca-cert + {{- if eq (.Values.pilot.env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }} + projected: + sources: + - clusterTrustBundle: + name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }} + path: root-cert.pem + {{- else }} + configMap: + name: {{ .Values.global.trustBundleName | default "istio-ca-root-cert" }} + {{- end }} + {{- if .Values.global.imagePullSecrets }} + imagePullSecrets: + {{- range .Values.global.imagePullSecrets }} + - name: {{ . }} + {{- end }} + {{- end }} + --- + apiVersion: v1 + kind: Service + metadata: + annotations: + {{ toJsonMap + (strdict "networking.istio.io/traffic-distribution" "PreferClose") + (omit .InfrastructureAnnotations + "kubectl.kubernetes.io/last-applied-configuration" + "gateway.istio.io/name-override" + "gateway.istio.io/service-account" + "gateway.istio.io/controller-version" + ) | nindent 4 }} + labels: + {{- toJsonMap + .InfrastructureLabels + (strdict + "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass + ) | nindent 4 }} + name: {{.DeploymentName | quote}} + namespace: {{.Namespace | quote}} + ownerReferences: + - apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + name: "{{.Name}}" + uid: "{{.UID}}" + spec: + ipFamilyPolicy: PreferDualStack + ports: + {{- range $key, $val := .Ports }} + - name: {{ $val.Name | quote }} + port: {{ $val.Port }} + protocol: TCP + appProtocol: {{ $val.AppProtocol }} + {{- end }} + selector: + "{{.GatewayNameLabel}}": "{{.Name}}" + {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }} + loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}} + {{- end }} + type: {{ .ServiceType | quote }} + --- + apiVersion: autoscaling/v2 + kind: HorizontalPodAutoscaler + metadata: + name: {{.DeploymentName | quote}} + namespace: {{.Namespace | quote}} + annotations: + {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }} + labels: + {{- toJsonMap + .InfrastructureLabels + (strdict + "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass + ) | nindent 4 }} + ownerReferences: + - apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + name: {{.Name}} + uid: "{{.UID}}" + spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{.DeploymentName | quote}} + maxReplicas: 1 + --- + apiVersion: policy/v1 + kind: PodDisruptionBudget + metadata: + name: {{.DeploymentName | quote}} + namespace: {{.Namespace | quote}} + annotations: + {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }} + labels: + {{- toJsonMap + .InfrastructureLabels + (strdict + "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass + ) | nindent 4 }} + ownerReferences: + - apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + name: {{.Name}} + uid: "{{.UID}}" + spec: + selector: + matchLabels: + gateway.networking.k8s.io/gateway-name: {{.Name|quote}} + kube-gateway: | + apiVersion: v1 + kind: ServiceAccount + metadata: + name: {{.ServiceAccount | quote}} + namespace: {{.Namespace | quote}} + annotations: + {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }} + labels: + {{- toJsonMap + .InfrastructureLabels + (strdict + "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass + ) | nindent 4 }} + {{- if ge .KubeVersion 128 }} + # Safe since 1.28: https://github.com/kubernetes/kubernetes/pull/117412 + ownerReferences: + - apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + name: "{{.Name}}" + uid: "{{.UID}}" + {{- end }} + --- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: {{.DeploymentName | quote}} + namespace: {{.Namespace | quote}} + annotations: + {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }} + labels: + {{- toJsonMap + .InfrastructureLabels + (strdict + "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass + "gateway.istio.io/managed" "istio.io-gateway-controller" + ) | nindent 4 }} + ownerReferences: + - apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + name: {{.Name}} + uid: "{{.UID}}" + spec: + selector: + matchLabels: + "{{.GatewayNameLabel}}": {{.Name}} + template: + metadata: + annotations: + {{- toJsonMap + (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") + (strdict "istio.io/rev" (.Revision | default "default")) + (strdict + "prometheus.io/path" "/stats/prometheus" + "prometheus.io/port" "15020" + "prometheus.io/scrape" "true" + ) | nindent 8 }} + labels: + {{- toJsonMap + (strdict + "sidecar.istio.io/inject" "false" + "service.istio.io/canonical-name" .DeploymentName + "service.istio.io/canonical-revision" "latest" + ) + .InfrastructureLabels + (strdict + "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass + "gateway.istio.io/managed" "istio.io-gateway-controller" + ) | nindent 8 }} + spec: + securityContext: + {{- if .Values.gateways.securityContext }} + {{- toYaml .Values.gateways.securityContext | nindent 8 }} + {{- else }} + sysctls: + - name: net.ipv4.ip_unprivileged_port_start + value: "0" + {{- if .Values.gateways.seccompProfile }} + seccompProfile: + {{- toYaml .Values.gateways.seccompProfile | nindent 10 }} + {{- end }} + {{- end }} + serviceAccountName: {{.ServiceAccount | quote}} + containers: + - name: istio-proxy + {{- if contains "/" (annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image) }} + image: "{{ annotation .ObjectMeta `sidecar.istio.io/proxyImage` .Values.global.proxy.image }}" + {{- else }} + image: "{{ .ProxyImage }}" + {{- end }} + {{- if .Values.global.proxy.resources }} + resources: + {{- toYaml (omitNil .Values.global.proxy.resources) | nindent 10 }} + {{- end }} + {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}} + securityContext: + capabilities: + drop: + - ALL + allowPrivilegeEscalation: false + privileged: false + readOnlyRootFilesystem: true + runAsUser: {{ .ProxyUID | default "1337" }} + runAsGroup: {{ .ProxyGID | default "1337" }} + runAsNonRoot: true + ports: + - containerPort: 15020 + name: metrics + protocol: TCP + - containerPort: 15021 + name: status-port + protocol: TCP + - containerPort: 15090 + protocol: TCP + name: http-envoy-prom + args: + - proxy + - router + - --domain + - $(POD_NAMESPACE).svc.{{ .Values.global.proxy.clusterDomain }} + - --proxyLogLevel + - {{ annotation .ObjectMeta `sidecar.istio.io/logLevel` .Values.global.proxy.logLevel | quote}} + - --proxyComponentLogLevel + - {{ annotation .ObjectMeta `sidecar.istio.io/componentLogLevel` .Values.global.proxy.componentLogLevel | quote}} + - --log_output_level + - {{ annotation .ObjectMeta `sidecar.istio.io/agentLogLevel` .Values.global.logging.level | quote}} + {{- if .Values.global.sts.servicePort }} + - --stsPort={{ .Values.global.sts.servicePort }} + {{- end }} + {{- if .Values.global.logAsJson }} + - --log_as_json + {{- end }} + {{- if .Values.global.proxy.lifecycle }} + lifecycle: + {{- toYaml .Values.global.proxy.lifecycle | nindent 10 }} + {{- end }} + env: + - name: PILOT_CERT_PROVIDER + value: {{ .Values.global.pilotCertProvider }} + - name: CA_ADDR + {{- if .Values.global.caAddress }} + value: {{ .Values.global.caAddress }} + {{- else }} + value: istiod{{- if not (eq .Values.revision "") }}-{{ .Values.revision }}{{- end }}.{{ .Values.global.istioNamespace }}.svc:15012 + {{- end }} + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: INSTANCE_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: SERVICE_ACCOUNT + valueFrom: + fieldRef: + fieldPath: spec.serviceAccountName + - name: HOST_IP + valueFrom: + fieldRef: + fieldPath: status.hostIP + - name: ISTIO_CPU_LIMIT + valueFrom: + resourceFieldRef: + resource: limits.cpu + divisor: "1" + - name: PROXY_CONFIG + value: | + {{ protoToJSON .ProxyConfig }} + - name: ISTIO_META_POD_PORTS + value: "[]" + - name: ISTIO_META_APP_CONTAINERS + value: "" + - name: GOMEMLIMIT + valueFrom: + resourceFieldRef: + resource: limits.memory + divisor: "1" + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + resource: limits.cpu + divisor: "1" + - name: ISTIO_META_CLUSTER_ID + value: "{{ valueOrDefault .Values.global.multiCluster.clusterName .ClusterID }}" + - name: ISTIO_META_NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + - name: ISTIO_META_INTERCEPTION_MODE + value: "{{ .ProxyConfig.InterceptionMode.String }}" + {{- with (valueOrDefault (index .InfrastructureLabels "topology.istio.io/network") .Values.global.network) }} + - name: ISTIO_META_NETWORK + value: {{.|quote}} + {{- end }} + - name: ISTIO_META_WORKLOAD_NAME + value: {{.DeploymentName|quote}} + - name: ISTIO_META_OWNER + value: "kubernetes://apis/apps/v1/namespaces/{{.Namespace}}/deployments/{{.DeploymentName}}" + {{- if .Values.global.meshID }} + - name: ISTIO_META_MESH_ID + value: "{{ .Values.global.meshID }}" + {{- else if (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }} + - name: ISTIO_META_MESH_ID + value: "{{ (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }}" + {{- end }} + {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }} + - name: TRUST_DOMAIN + value: "{{ . }}" + {{- end }} + {{- range $key, $value := .ProxyConfig.ProxyMetadata }} + - name: {{ $key }} + value: "{{ $value }}" + {{- end }} + {{- with (index .InfrastructureLabels "topology.istio.io/network") }} + - name: ISTIO_META_REQUESTED_NETWORK_VIEW + value: {{.|quote}} + {{- end }} + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz/ready + port: 15021 + scheme: HTTP + initialDelaySeconds: 1 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 + readinessProbe: + failureThreshold: 4 + httpGet: + path: /healthz/ready + port: 15021 + scheme: HTTP + initialDelaySeconds: 0 + periodSeconds: 15 + successThreshold: 1 + timeoutSeconds: 1 + volumeMounts: + - name: workload-socket + mountPath: /var/run/secrets/workload-spiffe-uds + - name: credential-socket + mountPath: /var/run/secrets/credential-uds + {{- if eq .Values.global.caName "GkeWorkloadCertificate" }} + - name: gke-workload-certificate + mountPath: /var/run/secrets/workload-spiffe-credentials + readOnly: true + {{- else }} + - name: workload-certs + mountPath: /var/run/secrets/workload-spiffe-credentials + {{- end }} + {{- if eq .Values.global.pilotCertProvider "istiod" }} + - mountPath: /var/run/secrets/istio + name: istiod-ca-cert + {{- end }} + - mountPath: /var/lib/istio/data + name: istio-data + # SDS channel between istioagent and Envoy + - mountPath: /etc/istio/proxy + name: istio-envoy + - mountPath: /var/run/secrets/tokens + name: istio-token + - name: istio-podinfo + mountPath: /etc/istio/pod + volumes: + - emptyDir: {} + name: workload-socket + - emptyDir: {} + name: credential-socket + {{- if eq .Values.global.caName "GkeWorkloadCertificate" }} + - name: gke-workload-certificate + csi: + driver: workloadcertificates.security.cloud.google.com + {{- else}} + - emptyDir: {} + name: workload-certs + {{- end }} + # SDS channel between istioagent and Envoy + - emptyDir: + medium: Memory + name: istio-envoy + - name: istio-data + emptyDir: {} + - name: istio-podinfo + downwardAPI: + items: + - path: "labels" + fieldRef: + fieldPath: metadata.labels + - path: "annotations" + fieldRef: + fieldPath: metadata.annotations + - name: istio-token + projected: + sources: + - serviceAccountToken: + path: istio-token + expirationSeconds: 43200 + audience: {{ .Values.global.sds.token.aud }} + {{- if eq .Values.global.pilotCertProvider "istiod" }} + - name: istiod-ca-cert + {{- if eq ((.Values.pilot).env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }} + projected: + sources: + - clusterTrustBundle: + name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }} + path: root-cert.pem + {{- else }} + configMap: + name: {{ .Values.global.trustBundleName | default "istio-ca-root-cert" }} + {{- end }} + {{- end }} + {{- if .Values.global.imagePullSecrets }} + imagePullSecrets: + {{- range .Values.global.imagePullSecrets }} + - name: {{ . }} + {{- end }} + {{- end }} + --- + apiVersion: v1 + kind: Service + metadata: + annotations: + {{ toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }} + labels: + {{- toJsonMap + .InfrastructureLabels + (strdict + "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass + ) | nindent 4 }} + name: {{.DeploymentName | quote}} + namespace: {{.Namespace | quote}} + ownerReferences: + - apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + name: {{.Name}} + uid: {{.UID}} + spec: + ipFamilyPolicy: PreferDualStack + ports: + {{- range $key, $val := .Ports }} + - name: {{ $val.Name | quote }} + port: {{ $val.Port }} + protocol: TCP + appProtocol: {{ $val.AppProtocol }} + {{- end }} + selector: + "{{.GatewayNameLabel}}": {{.Name}} + {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }} + loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}} + {{- end }} + type: {{ .ServiceType | quote }} + --- + apiVersion: autoscaling/v2 + kind: HorizontalPodAutoscaler + metadata: + name: {{.DeploymentName | quote}} + namespace: {{.Namespace | quote}} + annotations: + {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }} + labels: + {{- toJsonMap + .InfrastructureLabels + (strdict + "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass + ) | nindent 4 }} + ownerReferences: + - apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + name: {{.Name}} + uid: "{{.UID}}" + spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{.DeploymentName | quote}} + maxReplicas: 1 + --- + apiVersion: policy/v1 + kind: PodDisruptionBudget + metadata: + name: {{.DeploymentName | quote}} + namespace: {{.Namespace | quote}} + annotations: + {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }} + labels: + {{- toJsonMap + .InfrastructureLabels + (strdict + "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass + ) | nindent 4 }} + ownerReferences: + - apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + name: {{.Name}} + uid: "{{.UID}}" + spec: + selector: + matchLabels: + gateway.networking.k8s.io/gateway-name: {{.Name|quote}} + agentgateway: | + apiVersion: v1 + kind: ServiceAccount + metadata: + name: {{.ServiceAccount | quote}} + namespace: {{.Namespace | quote}} + annotations: + {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }} + labels: + {{- toJsonMap + .InfrastructureLabels + (strdict + "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass + ) | nindent 4 }} + ownerReferences: + - apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + name: "{{.Name}}" + uid: "{{.UID}}" + --- + apiVersion: apps/v1 + kind: Deployment + metadata: + name: {{.DeploymentName | quote}} + namespace: {{.Namespace | quote}} + annotations: + {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }} + labels: + {{- toJsonMap + .InfrastructureLabels + (strdict + "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass + "gateway.istio.io/managed" "istio.io-agentgateway-controller" + ) | nindent 4 }} + ownerReferences: + - apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + name: {{.Name}} + uid: "{{.UID}}" + spec: + selector: + matchLabels: + "{{.GatewayNameLabel}}": {{.Name}} + template: + metadata: + annotations: + {{- toJsonMap + (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") + (strdict "istio.io/rev" (.Revision | default "default")) + (strdict + "prometheus.io/path" "/stats/prometheus" + "prometheus.io/port" "15020" + "prometheus.io/scrape" "true" + ) | nindent 8 }} + labels: + {{- toJsonMap + (strdict + "sidecar.istio.io/inject" "false" + "service.istio.io/canonical-name" .DeploymentName + "service.istio.io/canonical-revision" "latest" + ) + .InfrastructureLabels + (strdict + "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass + "gateway.istio.io/managed" "istio.io-agentgateway-controller" + ) | nindent 8 }} + spec: + securityContext: + {{- if .Values.gateways.securityContext }} + {{- toYaml .Values.gateways.securityContext | nindent 8 }} + {{- else }} + sysctls: + - name: net.ipv4.ip_unprivileged_port_start # allows binding to 80 and 443 without root + value: "0" + {{- if .Values.gateways.seccompProfile }} + seccompProfile: + {{- toYaml .Values.gateways.seccompProfile | nindent 10 }} + {{- end }} + {{- end }} + serviceAccountName: {{.ServiceAccount | quote}} + containers: + - name: agentgateway + {{- if contains "/" (annotation .ObjectMeta `gateway.istio.io/agentgatewayImage` .Values.global.agentgateway.image) }} + image: "{{ annotation .ObjectMeta `gateway.istio.io/agentgatewayImage` .Values.global.agentgateway.image }}" + {{- else }} + image: "{{ .AgentgatewayImage }}" + {{- end }} + {{- if .Values.global.proxy.resources }} + resources: + {{- toYaml (omitNil .Values.global.proxy.resources) | nindent 10 }} + {{- end }} + {{with .Values.global.imagePullPolicy }}imagePullPolicy: "{{.}}"{{end}} + securityContext: + capabilities: + drop: + - ALL + allowPrivilegeEscalation: false + privileged: false + readOnlyRootFilesystem: true + runAsUser: {{ .ProxyUID | default "10101" }} + runAsGroup: {{ .ProxyGID | default "10101" }} + runAsNonRoot: true + ports: + - containerPort: 15020 + name: metrics + protocol: TCP + - containerPort: 15021 + name: status-port + protocol: TCP + args: + - --config + - '{}' + {{- if .Values.global.proxy.lifecycle }} + lifecycle: + {{- toYaml .Values.global.proxy.lifecycle | nindent 10 }} + {{- end }} + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: INSTANCE_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: SERVICE_ACCOUNT + valueFrom: + fieldRef: + fieldPath: spec.serviceAccountName + - name: CPU_LIMIT + valueFrom: + resourceFieldRef: + resource: limits.cpu + divisor: "1" + - name: GATEWAY + value: {{.Name|quote}} + - name: RUST_BACKTRACE + value: "1" + - name: CLUSTER_ID + value: "{{ valueOrDefault .Values.global.multiCluster.clusterName .ClusterID }}" + {{- with (valueOrDefault (index .InfrastructureLabels "topology.istio.io/network") .Values.global.network) }} + - name: NETWORK + value: {{.|quote}} + {{- end }} + {{- with (valueOrDefault .MeshConfig.TrustDomain .Values.global.trustDomain) }} + - name: TRUST_DOMAIN + value: "{{ . }}" + {{- end }} + {{- range $key, $value := .ProxyConfig.ProxyMetadata }} + - name: {{ $key }} + value: "{{ $value }}" + {{- end }} + - name: XDS_ADDRESS + value: {{ .ProxyConfig.DiscoveryAddress | quote }} + startupProbe: + failureThreshold: 30 + httpGet: + path: /healthz/ready + port: 15021 + scheme: HTTP + initialDelaySeconds: 1 + periodSeconds: 1 + successThreshold: 1 + timeoutSeconds: 1 + readinessProbe: + failureThreshold: 4 + httpGet: + path: /healthz/ready + port: 15021 + scheme: HTTP + initialDelaySeconds: 0 + periodSeconds: 15 + successThreshold: 1 + timeoutSeconds: 1 + volumeMounts: + - mountPath: /var/run/secrets/xds + name: istiod-ca-cert + - mountPath: /var/run/secrets/xds-tokens + name: istio-token + - mountPath: /tmp + name: tmp + volumes: + - emptyDir: {} + name: tmp + - name: istio-token + projected: + sources: + - serviceAccountToken: + path: xds-token + expirationSeconds: 43200 + audience: {{ .Values.global.sds.token.aud }} + {{- if eq .Values.global.pilotCertProvider "istiod" }} + - name: istiod-ca-cert + {{- if eq ((.Values.pilot).env).ENABLE_CLUSTER_TRUST_BUNDLE_API true }} + projected: + sources: + - clusterTrustBundle: + name: istio.io:istiod-ca:{{ .Values.global.trustBundleName | default "root-cert" }} + path: root-cert.pem + {{- else }} + configMap: + name: {{ .Values.global.trustBundleName | default "istio-ca-root-cert" }} + {{- end }} + {{- end }} + {{- if .Values.global.imagePullSecrets }} + imagePullSecrets: + {{- range .Values.global.imagePullSecrets }} + - name: {{ . }} + {{- end }} + {{- end }} + --- + apiVersion: v1 + kind: Service + metadata: + annotations: + {{ toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }} + labels: + {{- toJsonMap + .InfrastructureLabels + (strdict + "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass + ) | nindent 4 }} + name: {{.DeploymentName | quote}} + namespace: {{.Namespace | quote}} + ownerReferences: + - apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + name: {{.Name}} + uid: {{.UID}} + spec: + ipFamilyPolicy: PreferDualStack + ports: + {{- range $key, $val := .Ports }} + - name: {{ $val.Name | quote }} + port: {{ $val.Port }} + protocol: TCP + appProtocol: {{ $val.AppProtocol }} + {{- end }} + selector: + "{{.GatewayNameLabel}}": {{.Name}} + {{- if and (.Spec.Addresses) (eq .ServiceType "LoadBalancer") }} + loadBalancerIP: {{ (index .Spec.Addresses 0).Value | quote}} + {{- end }} + type: {{ .ServiceType | quote }} + --- + apiVersion: autoscaling/v2 + kind: HorizontalPodAutoscaler + metadata: + name: {{.DeploymentName | quote}} + namespace: {{.Namespace | quote}} + annotations: + {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }} + labels: + {{- toJsonMap + .InfrastructureLabels + (strdict + "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass + ) | nindent 4 }} + ownerReferences: + - apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + name: {{.Name}} + uid: "{{.UID}}" + spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{.DeploymentName | quote}} + maxReplicas: 1 + --- + apiVersion: policy/v1 + kind: PodDisruptionBudget + metadata: + name: {{.DeploymentName | quote}} + namespace: {{.Namespace | quote}} + annotations: + {{- toJsonMap (omit .InfrastructureAnnotations "kubectl.kubernetes.io/last-applied-configuration" "gateway.istio.io/name-override" "gateway.istio.io/service-account" "gateway.istio.io/controller-version") | nindent 4 }} + labels: + {{- toJsonMap + .InfrastructureLabels + (strdict + "gateway.networking.k8s.io/gateway-name" .Name + "gateway.networking.k8s.io/gateway-class-name" .GatewayClass + ) | nindent 4 }} + ownerReferences: + - apiVersion: gateway.networking.k8s.io/v1 + kind: Gateway + name: {{.Name}} + uid: "{{.UID}}" + spec: + selector: + matchLabels: + gateway.networking.k8s.io/gateway-name: {{.Name|quote}} values: |- - {{ .Files.Get "files/istio-values.json" }} + { + "gateways": { + "seccompProfile": {}, + "securityContext": {} + }, + "global": { + "caAddress": "", + "caName": "", + "certSigners": [], + "configCluster": false, + "configValidation": true, + "defaultPodDisruptionBudget": { + "enabled": true + }, + "defaultResources": { + "requests": { + "cpu": "10m" + } + }, + "externalIstiod": false, + "hub": "docker.io/istio", + "imagePullPolicy": "", + "imagePullSecrets": [], + "istioNamespace": "default", + "istiod": { + "enableAnalysis": false + }, + "logAsJson": false, + "logging": { + "level": "all:warn" + }, + "meshID": "", + "meshNetworks": {}, + "mountMtlsCerts": false, + "multiCluster": { + "clusterName": "" + }, + "nativeNftables": false, + "network": "", + "networkPolicy": { + "enabled": false + }, + "omitSidecarInjectorConfigMap": false, + "operatorManageWebhooks": false, + "pilotCertProvider": "istiod", + "platform": "gke", + "priorityClassName": "", + "proxy": { + "autoInject": "enabled", + "clusterDomain": "cluster.local", + "componentLogLevel": "misc:error", + "excludeIPRanges": "", + "excludeInboundPorts": "", + "excludeOutboundPorts": "", + "image": "proxyv2", + "includeIPRanges": "*", + "includeInboundPorts": "*", + "includeOutboundPorts": "", + "logLevel": "warning", + "outlierLogPath": "", + "privileged": false, + "readinessFailureThreshold": 4, + "readinessInitialDelaySeconds": 0, + "readinessPeriodSeconds": 15, + "resources": { + "limits": { + "cpu": "2000m", + "memory": "1024Mi" + }, + "requests": { + "cpu": "100m", + "memory": "128Mi" + } + }, + "seccompProfile": {}, + "startupProbe": { + "enabled": true, + "failureThreshold": 600 + }, + "statusPort": 15020, + "tracer": "none" + }, + "proxy_init": { + "forceApplyIptables": false, + "image": "proxyv2" + }, + "remotePilotAddress": "", + "resourceScope": "all", + "sds": { + "token": { + "aud": "istio-ca" + } + }, + "sts": { + "servicePort": 0 + }, + "tag": "1.29.4", + "variant": "", + "waypoint": { + "affinity": {}, + "nodeSelector": {}, + "resources": { + "limits": { + "cpu": "2", + "memory": "1Gi" + }, + "requests": { + "cpu": "100m", + "memory": "128Mi" + } + }, + "tolerations": [], + "topologySpreadConstraints": [] + } + }, + "pilot": { + "cni": { + "cniBinDir": "", + "enabled": false, + "provider": "default", + "resourceQuotas": { + "enabled": false + } + }, + "env": {} + }, + "revision": "", + "sidecarInjectorWebhook": { + "alwaysInjectSelector": [], + "defaultTemplates": [], + "enableNamespacesByDefault": false, + "injectedAnnotations": {}, + "neverInjectSelector": [], + "reinvocationPolicy": "Never", + "rewriteAppHTTPProbe": true, + "templates": {} + } + } kind: ConfigMap metadata: labels: @@ -16706,6 +21009,7 @@ metadata: release: istio name: istio-sidecar-injector namespace: default + --- apiVersion: v1 data: @@ -17029,7 +21333,9 @@ data: kind: ConfigMap metadata: annotations: - kubernetes.io/description: This ConfigMap contains the Helm values used during chart rendering. This ConfigMap is rendered for debugging purposes and external tooling; modifying these values has no effect. + kubernetes.io/description: This ConfigMap contains the Helm values used during + chart rendering. This ConfigMap is rendered for debugging purposes and external + tooling; modifying these values has no effect. labels: app.kubernetes.io/instance: istio app.kubernetes.io/managed-by: Helm @@ -17043,6 +21349,7 @@ metadata: release: istio name: values namespace: default + --- apiVersion: admissionregistration.k8s.io/v1 kind: MutatingWebhookConfiguration @@ -17061,146 +21368,147 @@ metadata: release: istio name: istio-sidecar-injector-default webhooks: - - admissionReviewVersions: - - v1 - clientConfig: - service: - name: istiod - namespace: default - path: /inject - port: 443 - failurePolicy: Fail - name: rev.namespace.sidecar-injector.istio.io - namespaceSelector: - matchExpressions: - - key: istio.io/rev - operator: In - values: - - default - - key: istio-injection - operator: DoesNotExist - objectSelector: - matchExpressions: - - key: sidecar.istio.io/inject - operator: NotIn - values: - - "false" - reinvocationPolicy: Never - rules: - - apiGroups: - - "" - apiVersions: - - v1 - operations: - - CREATE - resources: - - pods - sideEffects: None - - admissionReviewVersions: - - v1 - clientConfig: - service: - name: istiod - namespace: default - path: /inject - port: 443 - failurePolicy: Fail - name: rev.object.sidecar-injector.istio.io - namespaceSelector: - matchExpressions: - - key: istio.io/rev - operator: DoesNotExist - - key: istio-injection - operator: DoesNotExist - objectSelector: - matchExpressions: - - key: sidecar.istio.io/inject - operator: NotIn - values: - - "false" - - key: istio.io/rev - operator: In - values: - - default - reinvocationPolicy: Never - rules: - - apiGroups: - - "" - apiVersions: - - v1 - operations: - - CREATE - resources: - - pods - sideEffects: None - - admissionReviewVersions: - - v1 - clientConfig: - service: - name: istiod - namespace: default - path: /inject - port: 443 - failurePolicy: Fail - name: namespace.sidecar-injector.istio.io - namespaceSelector: - matchExpressions: - - key: istio-injection - operator: In - values: - - enabled - objectSelector: - matchExpressions: - - key: sidecar.istio.io/inject - operator: NotIn - values: - - "false" - reinvocationPolicy: Never - rules: - - apiGroups: - - "" - apiVersions: - - v1 - operations: - - CREATE - resources: - - pods - sideEffects: None - - admissionReviewVersions: - - v1 - clientConfig: - service: - name: istiod - namespace: default - path: /inject - port: 443 - failurePolicy: Fail - name: object.sidecar-injector.istio.io - namespaceSelector: - matchExpressions: - - key: istio-injection - operator: DoesNotExist - - key: istio.io/rev - operator: DoesNotExist - objectSelector: - matchExpressions: - - key: sidecar.istio.io/inject - operator: In - values: - - "true" - - key: istio.io/rev - operator: DoesNotExist - reinvocationPolicy: Never - rules: - - apiGroups: - - "" - apiVersions: - - v1 - operations: - - CREATE - resources: - - pods - sideEffects: None +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: istiod + namespace: default + path: /inject + port: 443 + failurePolicy: Fail + name: rev.namespace.sidecar-injector.istio.io + namespaceSelector: + matchExpressions: + - key: istio.io/rev + operator: In + values: + - default + - key: istio-injection + operator: DoesNotExist + objectSelector: + matchExpressions: + - key: sidecar.istio.io/inject + operator: NotIn + values: + - "false" + reinvocationPolicy: Never + rules: + - apiGroups: + - "" + apiVersions: + - v1 + operations: + - CREATE + resources: + - pods + sideEffects: None +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: istiod + namespace: default + path: /inject + port: 443 + failurePolicy: Fail + name: rev.object.sidecar-injector.istio.io + namespaceSelector: + matchExpressions: + - key: istio.io/rev + operator: DoesNotExist + - key: istio-injection + operator: DoesNotExist + objectSelector: + matchExpressions: + - key: sidecar.istio.io/inject + operator: NotIn + values: + - "false" + - key: istio.io/rev + operator: In + values: + - default + reinvocationPolicy: Never + rules: + - apiGroups: + - "" + apiVersions: + - v1 + operations: + - CREATE + resources: + - pods + sideEffects: None +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: istiod + namespace: default + path: /inject + port: 443 + failurePolicy: Fail + name: namespace.sidecar-injector.istio.io + namespaceSelector: + matchExpressions: + - key: istio-injection + operator: In + values: + - enabled + objectSelector: + matchExpressions: + - key: sidecar.istio.io/inject + operator: NotIn + values: + - "false" + reinvocationPolicy: Never + rules: + - apiGroups: + - "" + apiVersions: + - v1 + operations: + - CREATE + resources: + - pods + sideEffects: None +- admissionReviewVersions: + - v1 + clientConfig: + service: + name: istiod + namespace: default + path: /inject + port: 443 + failurePolicy: Fail + name: object.sidecar-injector.istio.io + namespaceSelector: + matchExpressions: + - key: istio-injection + operator: DoesNotExist + - key: istio.io/rev + operator: DoesNotExist + objectSelector: + matchExpressions: + - key: sidecar.istio.io/inject + operator: In + values: + - "true" + - key: istio.io/rev + operator: DoesNotExist + reinvocationPolicy: Never + rules: + - apiGroups: + - "" + apiVersions: + - v1 + operations: + - CREATE + resources: + - pods + sideEffects: None + --- apiVersion: apps/v1 kind: Deployment @@ -17250,137 +21558,138 @@ spec: sidecar.istio.io/inject: "false" spec: containers: - - args: - - discovery - - --monitoringAddr=:15014 - - --log_output_level=all:warn - - --domain - - cluster.local - - --keepaliveMaxServerConnectionAge - - 30m - env: - - name: REVISION - value: default - - name: PILOT_CERT_PROVIDER - value: istiod - - name: POD_NAME - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.name - - name: POD_NAMESPACE - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: metadata.namespace - - name: SERVICE_ACCOUNT - valueFrom: - fieldRef: - apiVersion: v1 - fieldPath: spec.serviceAccountName - - name: KUBECONFIG - value: /var/run/secrets/remote/config - - name: CA_TRUSTED_NODE_ACCOUNTS - value: default/ztunnel - - name: PILOT_TRACE_SAMPLING - value: "1" - - name: PILOT_ENABLE_ANALYSIS - value: "false" - - name: CLUSTER_ID - value: Kubernetes - - name: GOMAXPROCS - valueFrom: - resourceFieldRef: - divisor: "1" - resource: limits.cpu - - name: PLATFORM - value: gke - image: docker.io/istio/pilot:1.29.4 - name: discovery - ports: - - containerPort: 8080 - name: http-debug - protocol: TCP - - containerPort: 15010 - name: grpc-xds - protocol: TCP - - containerPort: 15012 - name: tls-xds - protocol: TCP - - containerPort: 15017 - name: https-webhooks - protocol: TCP - - containerPort: 15014 - name: http-monitoring - protocol: TCP - readinessProbe: - httpGet: - path: /ready - port: 8080 - initialDelaySeconds: 1 - periodSeconds: 3 - timeoutSeconds: 5 - resources: - requests: - cpu: 500m - memory: 2048Mi - securityContext: - allowPrivilegeEscalation: false - capabilities: - drop: - - ALL - readOnlyRootFilesystem: true - runAsNonRoot: true - volumeMounts: - - mountPath: /var/run/secrets/tokens - name: istio-token - readOnly: true - - mountPath: /var/run/secrets/istio-dns - name: local-certs - - mountPath: /etc/cacerts - name: cacerts - readOnly: true - - mountPath: /var/run/secrets/remote - name: istio-kubeconfig - readOnly: true - - mountPath: /var/run/secrets/istiod/tls - name: istio-csr-dns-cert - readOnly: true - - mountPath: /var/run/secrets/istiod/ca - name: istio-csr-ca-configmap - readOnly: true + - args: + - discovery + - --monitoringAddr=:15014 + - --log_output_level=all:warn + - --domain + - cluster.local + - --keepaliveMaxServerConnectionAge + - 30m + env: + - name: REVISION + value: default + - name: PILOT_CERT_PROVIDER + value: istiod + - name: POD_NAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + - name: SERVICE_ACCOUNT + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: spec.serviceAccountName + - name: KUBECONFIG + value: /var/run/secrets/remote/config + - name: CA_TRUSTED_NODE_ACCOUNTS + value: default/ztunnel + - name: PILOT_TRACE_SAMPLING + value: "1" + - name: PILOT_ENABLE_ANALYSIS + value: "false" + - name: CLUSTER_ID + value: Kubernetes + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + divisor: "1" + resource: limits.cpu + - name: PLATFORM + value: gke + image: docker.io/istio/pilot:1.29.4 + name: discovery + ports: + - containerPort: 8080 + name: http-debug + protocol: TCP + - containerPort: 15010 + name: grpc-xds + protocol: TCP + - containerPort: 15012 + name: tls-xds + protocol: TCP + - containerPort: 15017 + name: https-webhooks + protocol: TCP + - containerPort: 15014 + name: http-monitoring + protocol: TCP + readinessProbe: + httpGet: + path: /ready + port: 8080 + initialDelaySeconds: 1 + periodSeconds: 3 + timeoutSeconds: 5 + resources: + requests: + cpu: 500m + memory: 2048Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + volumeMounts: + - mountPath: /var/run/secrets/tokens + name: istio-token + readOnly: true + - mountPath: /var/run/secrets/istio-dns + name: local-certs + - mountPath: /etc/cacerts + name: cacerts + readOnly: true + - mountPath: /var/run/secrets/remote + name: istio-kubeconfig + readOnly: true + - mountPath: /var/run/secrets/istiod/tls + name: istio-csr-dns-cert + readOnly: true + - mountPath: /var/run/secrets/istiod/ca + name: istio-csr-ca-configmap + readOnly: true serviceAccountName: istiod tolerations: - - key: cni.istio.io/not-ready - operator: Exists + - key: cni.istio.io/not-ready + operator: Exists volumes: - - emptyDir: - medium: Memory - name: local-certs - - name: istio-token - projected: - sources: - - serviceAccountToken: - audience: istio-ca - expirationSeconds: 43200 - path: istio-token - - name: cacerts - secret: - optional: true - secretName: cacerts - - name: istio-kubeconfig - secret: - optional: true - secretName: istio-kubeconfig - - name: istio-csr-dns-cert - secret: - optional: true - secretName: istiod-tls - - configMap: - defaultMode: 420 - name: istio-ca-root-cert - optional: true - name: istio-csr-ca-configmap + - emptyDir: + medium: Memory + name: local-certs + - name: istio-token + projected: + sources: + - serviceAccountToken: + audience: istio-ca + expirationSeconds: 43200 + path: istio-token + - name: cacerts + secret: + optional: true + secretName: cacerts + - name: istio-kubeconfig + secret: + optional: true + secretName: istio-kubeconfig + - name: istio-csr-dns-cert + secret: + optional: true + secretName: istiod-tls + - configMap: + defaultMode: 420 + name: istio-ca-root-cert + optional: true + name: istio-csr-ca-configmap + --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role @@ -17397,38 +21706,39 @@ metadata: name: istiod namespace: default rules: - - apiGroups: - - networking.istio.io - resources: - - gateways - verbs: - - create - - apiGroups: - - "" - resources: - - secrets - verbs: - - create - - get - - watch - - list - - update - - delete - - apiGroups: - - "" - resources: - - configmaps - verbs: - - delete - - apiGroups: - - coordination.k8s.io - resources: - - leases - verbs: - - get - - update - - patch - - create +- apiGroups: + - networking.istio.io + resources: + - gateways + verbs: + - create +- apiGroups: + - "" + resources: + - secrets + verbs: + - create + - get + - watch + - list + - update + - delete +- apiGroups: + - "" + resources: + - configmaps + verbs: + - delete +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - update + - patch + - create + --- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding @@ -17449,9 +21759,10 @@ roleRef: kind: Role name: istiod subjects: - - kind: ServiceAccount - name: istiod - namespace: default +- kind: ServiceAccount + name: istiod + namespace: default + --- apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler @@ -17473,17 +21784,18 @@ metadata: spec: maxReplicas: 5 metrics: - - resource: - name: cpu - target: - averageUtilization: 80 - type: Utilization - type: Resource + - resource: + name: cpu + target: + averageUtilization: 80 + type: Utilization + type: Resource minReplicas: 1 scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: istiod + --- apiVersion: v1 kind: Service @@ -17505,22 +21817,22 @@ metadata: namespace: default spec: ports: - - name: grpc-xds - port: 15010 - protocol: TCP - - name: https-dns - port: 15012 - protocol: TCP - - name: https-webhook - port: 443 - protocol: TCP - targetPort: 15017 - - name: http-monitoring - port: 15014 - protocol: TCP + - name: grpc-xds + port: 15010 + protocol: TCP + - name: https-dns + port: 15012 + protocol: TCP + - name: https-webhook + port: 443 + protocol: TCP + targetPort: 15017 + - name: http-monitoring + port: 15014 + protocol: TCP selector: app: istiod istio: pilot ---- +--- {{- end }} diff --git a/third_party/istio/istio-values.json b/third_party/istio/istio-values.json index bfe247bc8..b5827c969 100644 --- a/third_party/istio/istio-values.json +++ b/third_party/istio/istio-values.json @@ -135,4 +135,4 @@ "rewriteAppHTTPProbe": true, "templates": {} } -} +} \ No newline at end of file diff --git a/third_party/istio/update-istio.sh b/third_party/istio/update-istio.sh index 8e17c2036..d2c7ee24a 100755 --- a/third_party/istio/update-istio.sh +++ b/third_party/istio/update-istio.sh @@ -38,18 +38,42 @@ echo "Updating to istio $("${istioctl}" version --remote=false)..." --cluster-specific \ "$@" > ${tmpdir}/istio_full.yaml -# Step 2: Extract golang template (using yq v4+) -"${YQ}" '. | select(.kind == "ConfigMap" and .metadata.name == "istio-sidecar-injector").data.config' \ - "${tmpdir}/istio_full.yaml" > "${SCRIPT_DIR}/istio-config.yaml" -"${YQ}" '. | select(.kind == "ConfigMap" and .metadata.name == "istio-sidecar-injector").data.values' \ - "${tmpdir}/istio_full.yaml" > "${SCRIPT_DIR}/istio-values.json" - -cat "${tmpdir}/istio_full.yaml" \ - | "${YQ}" '(. | select(.kind == "ConfigMap" and .metadata.name == "istio-sidecar-injector").data.config) = "{{ .Files.Get \"files/istio-config.yaml\" }}"' - \ - | "${YQ}" '(. | select(.kind == "ConfigMap" and .metadata.name == "istio-sidecar-injector").data.values) = "{{ .Files.Get \"files/istio-values.json\" }}"' - \ - | grep -Ev "^(null|--- null|\.\.\.)$" \ - | sed 's/: '\''{{ .Files.Get "\(.*\)" }}'\''/: |-\n{{ .Files.Get "\1" | nindent 4 }}/g' \ - > "${tmpdir}/istio.yaml" +# Step 2: Extract golang template using non-destructive regex substitution +python3 -c ' +import re, sys, yaml + +full_file = sys.argv[1] +config_file = sys.argv[2] +values_file = sys.argv[3] +out_file = sys.argv[4] + +with open(full_file, "r") as f: + content = f.read() + +# Load YAML docs to extract config & values strings +docs = list(yaml.safe_load_all(content)) +for doc in docs: + if doc and doc.get("kind") == "ConfigMap" and doc.get("metadata", {}).get("name") == "istio-sidecar-injector": + data = doc.get("data", {}) + if "config" in data: + with open(config_file, "w") as f: + f.write(data["config"]) + if "values" in data: + with open(values_file, "w") as f: + f.write(data["values"]) + +# Targeted regex string substitution to preserve 100% of original file formatting +def replace_sidecar_data(match): + prefix = match.group(1) + suffix = match.group(2) + return prefix + " config: |-\n{{ .Files.Get \"files/istio-config.yaml\" | nindent 4 }}\n values: |-\n{{ .Files.Get \"files/istio-values.json\" | nindent 4 }}\n" + suffix + +pattern = r"(name:\s*istio-sidecar-injector\n\s*namespace:\s*default\n\s*data:\n)[\s\S]*?(\nkind:|\Z)" +new_content = re.sub(pattern, replace_sidecar_data, content) + +with open(out_file, "w") as f: + f.write(new_content) +' "${tmpdir}/istio_full.yaml" "${SCRIPT_DIR}/istio-config.yaml" "${SCRIPT_DIR}/istio-values.json" "${tmpdir}/istio.yaml" # Step 3: Download and save Istio Grafana dashboards echo "Downloading Istio Grafana dashboards..." @@ -106,9 +130,27 @@ snippet = """ if "extensionProviders:" in content and "additionalExtensionProviders" not in content: content = content.replace("extensionProviders:", "extensionProviders:" + snippet, 1) +if "Template_Version_And_Istio_Version_Mismatched_Check_Installation" in content: + content = content.replace("Template_Version_And_Istio_Version_Mismatched_Check_Installation", ".Values.sidecarInjectorWebhook.templates.sidecar") + sys.stdout.write(content) ' "${tmpdir}/istio.yaml" echo '{{- end }}' } >${dst} echo "Updated ${dst}" + +# Step 5: Verify generated YAML syntax +echo "Verifying generated YAML syntax..." +if ! python3 -c ' +import sys, yaml +with open(sys.argv[1], "r") as f: + text = f.read() +clean_text = "\n".join(l for l in text.splitlines() if not l.strip().startswith("{{") and not l.strip().startswith("}}")) +docs = list(yaml.safe_load_all(clean_text)) +print(f"YAML Verification Passed: {len(docs)} valid Kubernetes documents.") +' "${dst}"; then + echo "Error: ${dst} failed YAML validation!" >&2 + exit 1 +fi +