# Code generated by skv2. DO NOT EDIT. apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: 836d4b728cecd889 crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: dashboards.admin.gloo.solo.io spec: group: admin.gloo.solo.io names: categories: - solo-io kind: Dashboard listKind: DashboardList plural: dashboards singular: dashboard scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .status.State name: Status type: string name: v2 schema: openAPIV3Schema: properties: spec: description: Specifications for the resource. properties: authn: description: Configuration used to authenticate incoming requests. oneOf: - not: anyOf: - required: - oidc - required: - oidc properties: oidc: description: |- Configuration for an OpenID Connect (OIDC) identity provider to secure the Gloo UI with. properties: appUrl: description: |- The URL that the Gloo UI is exposed at, such as 'https://localhost:8090', to redirect to after successful authentication. type: string authEndpointQueryParams: additionalProperties: type: string description: |- Extra query parameters to apply to authorization requests to the identity provider. For example, you might use the [PKCE flow](https://www.oauth.com/oauth2-servers/pkce/authorization-request/) by setting `code_challenge` and `code_challenge_method`. type: object caCertConfigmapName: description: |- A name of a config map that contains the root certificate to use when connecting to the OIDC provider. The config map must contain a key named "ca.crt" with the PEM-encoded CA. To change this name such as to rotate the config map, you must restart the gloo-mesh-ui pod after the upgrade. type: string callbackPath: description: Path to handle the OIDC callback. type: string clientId: description: The client ID from the OIDC provider. type: string clientSecretName: description: |- The client secret from the OIDC identity provider. Stored in a secret that you created in advance in the same namespace as the Gloo UI. To change this name such as to rotate the secret, you must restart the gloo-mesh-ui pod after the upgrade. type: string discoveryOverride: description: |- Ensure that certain values are set regardless of what the OIDC provider returns. properties: authEndpoint: description: URL of the provider authorization endpoint. type: string authMethods: description: |- List of client authentication methods supported by the provider token endpoint. items: type: string type: array claims: description: List of claim types that the provider supports. items: type: string type: array idTokenAlgs: description: |- List of JSON web signature signing algorithms that the provider supports for encoding claims in a JWT. items: type: string type: array jwksUri: description: URL of the provider JSON web key set. type: string responseTypes: description: List of response types that the provider supports. items: type: string type: array scopes: description: List of scope values that the provider supports. items: type: string type: array subjects: description: List of subject identifier types that the provider supports. items: type: string type: array tokenEndpoint: description: URL of the provider token endpoint. type: string type: object discoveryPollInterval: description: |- How often to poll the OIDC issuer for new configuration. For information about the value format, see the [Google protocol buffer documentation](https://protobuf.dev/reference/protobuf/google.protobuf/#duration). type: string issuerUrl: description: |- The URL to connect to the OIDC identity provider, often in the format `https://./`. Gloo looks for OIDC information in `{{ issuerURL }}/.well-known/openid-configuration`. type: string jwksCacheRefreshPolicy: description: |- If a user sends a request with a key that is not found in the JWKS, the keys might have rotated on the remote source, but not yet in the local cache. Use this policy to configure how to refresh the local cache when handling a request that provides an invalid key. oneOf: - not: anyOf: - required: - never - required: - always - required: - maxIdpReqPerPollingInterval - required: - never - required: - always - required: - maxIdpReqPerPollingInterval properties: always: description: |- If a key is not in the cache, fetch the most recent keys from the IdP and update the cache. NOTE: Use this setting only in trusted environments, because each missing key triggers a request to the IdP. When used in an environment that is exposed to the internet, malicious agents can execute a DDoS attack by spamming protected endpoints with tokens signed by invalid keys. For information about the value format, see the [Google protocol buffer documentation](https://protobuf.dev/reference/protobuf/google.protobuf/#empty). maxProperties: 0 type: object maxIdpReqPerPollingInterval: description: |- If a key is not in the cache, fetch the most recent keys from the IdP and update the cache. This value sets the number of requests to the IdP per polling interval. If that limit is exceeded, fetching from the IdP stops for the remainder of the polling interval. maximum: 4294967295 minimum: 0 type: integer never: description: |- Never refresh the local JWKS cache on demand. If a key is not in the local cache, it is assumed to be malicious. This is the default policy, because IdPs typically publish keys before they rotate them, and frequent polling finds the newest keys. For information about the value format, see the [Google protocol buffer documentation](https://protobuf.dev/reference/protobuf/google.protobuf/#empty). maxProperties: 0 type: object type: object logoutPath: description: |- Path used to logout. If unset or empty, logout is disabled. type: string scopes: description: Scopes to request in addition to 'openid'. items: type: string type: array session: description: Configuration for session storage. properties: cookieOptions: description: Configuration for storing the session data in the session cookie. properties: domain: description: Domain of the cookie. type: string maxAge: description: |- Max age of the cookie. If unset, defaults to 30. To disable expiration, set this field to 0. maximum: 4294967295 minimum: 0 nullable: true type: integer notSecure: description: |- Use an insecure cookie. Only set this field to true when testing in trusted environments. type: boolean path: description: |- Path of the cookie. Defaults to "/". To disable this option, set this field to "". nullable: true type: string type: object type: object tokenEndpointQueryParams: additionalProperties: type: string description: |- Extra query parameters to apply to token requests to the identity provider. For example, you might use the [PKCE flow](https://www.oauth.com/oauth2-servers/pkce/authorization-request/) by setting `code_challenge` and `code_challenge_method`. type: object userMapping: description: |- If set, the ID token is used to infer user identity, which can be used to make authorization decisions. If unset or empty, no authorization is made. properties: groupsClaim: description: |- Configure the OIDCAuthenticator to try to populate the user's groups with an ID Token field. If the GroupsClaim field is present in an ID Token, the value must be a string or list of strings. type: string groupsPrefix: description: |- Add a prefix to each mapped group name. For example, the value `oidc:` results in group names such as `oidc:engineering`. type: string usernameClaim: description: The JWT field to use as the user's username. type: string usernamePrefix: description: |- Add a prefix to each mapped username. For example, the value `oidc:` results in usernames such as `oidc:john`. type: string type: object type: object type: object authz: description: Configuration used to authorize incoming requests. oneOf: - not: anyOf: - required: - multiClusterRbac - required: - multiClusterRbac properties: multiClusterRbac: description: |- Enable multicluster RBAC so that RBAC resources in workload clusters are used to determine whether users can view resources in the Gloo UI. To use multicluster RBAC, the Gloo UI and the workload clusters must use the same identity source, such as an OIDC provider with the same user and group claims. When using OIDC, make sure to configure the `userMapping` field. type: object type: object type: object status: properties: errors: description: Any errors encountered while translating the Dashboard resource. items: type: string type: array observedGeneration: description: |- The most recent generation observed in the Dashboard metadata. If the `observedGeneration` does not match `metadata.generation`, Gloo has not processed the most recent version of this resource. format: int64 type: integer state: description: Whether the resource has been accepted as valid and processed in the Gloo config translation. enum: - PENDING - ACCEPTED - INVALID - WARNING - FAILED - UNLICENSED type: string type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: 5ec7a394807dfada crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: extauthservers.admin.gloo.solo.io spec: group: admin.gloo.solo.io names: categories: - solo-io kind: ExtAuthServer listKind: ExtAuthServerList plural: extauthservers shortNames: - ess - eas singular: extauthserver scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .status.common.State.approval name: Status type: string name: v2 schema: openAPIV3Schema: properties: spec: description: |- ExtAuthServer is used configure the backend server used to enforce ExtAuthPolicies. All ExtAuthPolicies in a workspace require an ExtAuthServer to in order to function. If no ExtAuthServer is provided, a default configuration will be used. Currently Gloo Mesh only supports a single ExtAuthServer per workspace. properties: clearRouteCache: description: |- Clear the route cache to force the external auth service to recalculate the routing decision. All cached routes are cleared if one of the following conditions is met. 1. The field is set to *true*. 2. The external auth service returns a HTTP 200 or gRPC 0 response code. 3. At least one *authorization response header* is added to the client request, or is used to alter another client request header. The default value is **false**. type: boolean destinationServer: description: |- Select the destination that Gloo uses to externally authenticate traffic. The destination can be a Kubernetes service, such as the Gloo external auth service or your own external auth service, or a VirtualDestination. The destination cannot be an ExternalService. If this field is omitted, Gloo looks for the default `ext-auth-service` Kubernetes service in the `gloo-mesh` namespace in all workload clusters where an `ExtAuthPolicy` that uses this `ExtAuthServer` must be applied. oneOf: - not: anyOf: - required: - ref - required: - awsLambda - required: - ref - required: - awsLambda properties: awsLambda: description: Reference an AWS Lambda function. properties: cloudProvider: description: Reference to the AWS Cloud Provider. properties: cluster: description: the cluster of the object. If omitted, Gloo Mesh will use the same cluster as the parent object containing this reference. type: string name: description: the name of the object type: string namespace: description: the namespace of the object. If omitted, Gloo Mesh will use the same namespace as the parent object containing this reference. type: string type: object function: description: Name of the function to reference. type: string options: description: |- Specify how the destinations should be configured, for configuring lambda functions. If the destination config is required for the destination and not provided by the user, Gloo will invalidate the destination and its parent resources. properties: invocationStyle: description: |- Can be either Sync or Async. See [AWS Invoke](https://docs.aws.amazon.com/lambda/latest/dg/API_Invoke.html) for more details. enum: - SYNC - ASYNC type: string requestTransformation: enum: - REQUEST_DEFAULT - REQUEST_DISABLE type: string responseTransformation: enum: - RESPONSE_DEFAULT - RESPONSE_DISABLE type: string type: object qualifier: description: Qualifier of the function to reference. Defaults to $LATEST type: string type: object kind: description: |- the kind of Kubernetes destination being referenced. defaults to Service. Only applicable for Kubernetes destinations. For non Kubernetes destinations, this field is ignored. enum: - SERVICE - VIRTUAL_DESTINATION - EXTERNAL_SERVICE type: string port: description: the port on the destination object being targeted. required if the object provides more than one port. oneOf: - not: anyOf: - required: - number - required: - name - required: - number - required: - name properties: name: description: the name of the port on the destination objects being targeted. type: string number: description: the number of the port on the destination objects being targeted. maximum: 65535 minimum: 1 type: integer type: object ref: description: reference to a Kubernetes destination object by its metadata properties: cluster: description: the cluster of the object. If omitted, Gloo Mesh will use the same cluster as the parent object containing this reference. type: string name: description: the name of the object type: string namespace: description: the namespace of the object. If omitted, Gloo Mesh will use the same namespace as the parent object containing this reference. type: string type: object subset: additionalProperties: type: string description: |- select a subset of the destination's endpoints for routing based on their labels. Only applicable for Kubernetes destinations. type: object weight: description: |- Specify the proportion of traffic to be forwarded to this destination. Weights across all of the `destinations` must sum to 100. Weight is only relevant when used in the context of a route with multiple destinations. maximum: 4294967295 minimum: 0 type: integer type: object failureModeAllow: description: |- In case of a failure or timeout querying the auth server, normally a request is denied. if this is set to true, the request will be allowed. type: boolean httpService: description: If this is set, communication to the upstream will be via HTTP and not GRPC. properties: pathPrefix: description: Sets a prefix to the value of authorization request header *Path*. type: string request: properties: allowedHeaders: description: |- These headers will be copied from the incoming request to the request going to the auth server. Note that in addition to the user's supplied matchers: 1. *Host*, *Method*, *Path* and *Content-Length* are automatically included to the list. 2. *Content-Length* will be set to 0 and the request to the authorization service will not have a message body. items: type: string type: array headersToAdd: additionalProperties: type: string description: |- These headers that will be included to the request to authorization service. Note that client request of the same key will be overridden. type: object type: object response: properties: allowedClientHeaders: description: |- When this. is set, authorization response headers that will be added to the client's response when auth request is denied. Note that when this list is *not* set, all the authorization response headers, except *Authority (Host)* will be in the response to the client. When a header is included in this list, *Path*, *Status*, *Content-Length*, *WWW-Authenticate* and *Location* are automatically added. items: type: string type: array allowedUpstreamHeaders: description: |- When this is set, authorization response headers that have a will be added to the original client request and sent to the upstream. Note that coexistent headers will be overridden. items: type: string type: array type: object type: object requestBody: description: Set this if you also want to send the body of the request, and not just the headers. properties: allowPartialMessage: description: |- When this field is true, Envoy will buffer the message until *max_request_bytes* is reached. The authorization request will be dispatched and no 413 HTTP error will be returned by the filter. type: boolean maxRequestBytes: description: |- Sets the maximum size of a message body that the filter will hold in memory. Envoy will return *HTTP 413* and will *not* initiate the authorization process when buffer reaches the number set in this field. Note that this setting will have precedence over failure_mode_allow. Defaults to 4KB. maximum: 4294967295 minimum: 0 type: integer packAsBytes: description: When this field is true, Envoy will send the body sent to the external authorization service with raw bytes. type: boolean type: object requestTimeout: description: |- Timeout for the ext auth service to respond. Defaults to 2s. For information about the value format, see the [Google protocol buffer documentation](https://protobuf.dev/reference/protobuf/google.protobuf/#duration). type: string statPrefix: description: |- Optional additional prefix to use when emitting statistics. This allows to distinguish emitted statistics between configured ext_authz filters in an HTTP filter chain. type: string statusOnError: description: |- Sets the HTTP status that is returned to the client when there is a network error between the filter and the authorization server. The default status is HTTP 403 Forbidden. If set, this must be one of the following: - 100 - 200 201 202 203 204 205 206 207 208 226 - 300 301 302 303 304 305 307 308 - 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 421 422 423 424 426 428 429 431 - 500 501 502 503 504 505 506 507 508 510 511 maximum: 4294967295 minimum: 0 type: integer transportApiVersion: description: |- Determines the API version for the `ext_authz` transport protocol that will be used by Envoy to communicate with the auth server. Defaults to `V3`. For more info, see the `transport_api_version` field [here](https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/ext_authz/v3/ext_authz.proto#extensions-filters-http-ext-authz-v3-extauthz). enum: - GLOO_MESH_AUTO - ENVOY_AUTO - V3 type: string type: object status: description: The status of the resource after it is applied to your Gloo environment. properties: common: description: The state and workspace conditions of the applied resource. properties: State: properties: approval: description: |- Whether the resource has been accepted as valid and processed in the Gloo Mesh config translation. enum: - PENDING - ACCEPTED - INVALID - WARNING - FAILED - UNLICENSED type: string message: description: Additional information about the current state of the resource. type: string observedGeneration: description: |- The most recent generation observed in the object's metadata. If the `observedGeneration` does not match `metadata.generation`, Gloo Mesh has not processed the most recent version of this object. format: int64 type: integer type: object workspaceConditions: additionalProperties: maximum: 4294967295 minimum: 0 type: integer description: |- A map of ApprovalState to the number of workspaces in this condition, e.g., "Accepted" -> 2 "Pending" -> 1 type: object type: object numAppliedPolicies: description: The count of ExtAuthPolicies that reference this ExtAuthServer. maximum: 4294967295 minimum: 0 type: integer numSelectedBackingServices: description: |- The count of backing services that this ExtAuthServer selects. In the case of a VirtualDestination, this will be the count of backing services that the VirtualDestination selects. Otherwise, this will be the count of backing kube services that the ExtAuthServer selects. maximum: 4294967295 minimum: 0 type: integer type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: b4ad1c8f8fd3e48 crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: insightsconfigs.admin.gloo.solo.io spec: group: admin.gloo.solo.io names: categories: - solo-io kind: InsightsConfig listKind: InsightsConfigList plural: insightsconfigs singular: insightsconfig scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .status.common.State.approval name: Status type: string name: v2alpha1 schema: openAPIV3Schema: properties: spec: description: |- `InsightsConfig` describes the configuration for the Gloo Mesh Insight Engine. Define either an list of enabled insights or a list of disabled insights, based on the insight code. For example, to disable the insight CFG002: ```yaml apiVersion: admin.gloo.solo.io/v2alpha1 kind: InsightsConfig metadata: name: insights-config namespace: gloo-mesh spec: disabledInsights: - CFG0002 ``` properties: disabledInsights: description: A list of insight codes, such as `CFG0002` that disables insights. If included in this list, insights will not show up in the Gloo Core Dashboard insights list. items: type: string type: array type: object status: properties: common: properties: State: properties: approval: description: |- Whether the resource has been accepted as valid and processed in the Gloo Mesh config translation. enum: - PENDING - ACCEPTED - INVALID - WARNING - FAILED - UNLICENSED type: string message: description: Additional information about the current state of the resource. type: string observedGeneration: description: |- The most recent generation observed in the object's metadata. If the `observedGeneration` does not match `metadata.generation`, Gloo Mesh has not processed the most recent version of this object. format: int64 type: integer type: object workspaceConditions: additionalProperties: maximum: 4294967295 minimum: 0 type: integer description: |- A map of ApprovalState to the number of workspaces in this condition, e.g., "Accepted" -> 2 "Pending" -> 1 type: object type: object type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: 3765d5787ae75988 crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: kubernetesclusters.admin.gloo.solo.io spec: group: admin.gloo.solo.io names: categories: - solo-io kind: KubernetesCluster listKind: KubernetesClusterList plural: kubernetesclusters shortNames: - kc singular: kubernetescluster scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .status.common.State.approval name: Status type: string name: v2 schema: openAPIV3Schema: properties: spec: description: |- `KubernetesCluster` defines a Kubernetes cluster that has been registered with Gloo Mesh for management. A KubernetesCluster must be created in order to connect the Gloo Mesh Agent with the Gloo Mesh Server. KubernetesCluster must be deployed to the management cluster in the `gloo-mesh` namespace. The name of the KubernetesCluster has to be unique among all managed workload clusters for a given Gloo Mesh management plane. The name or/and labels of a KubernetesCluster resource can be used in a Workspace resource to determine the workload clusters for a given workspace. **Note**: The KubernetesCluster resource name must be unique across the KubernetesCluster resources for other clusters that you register with Gloo. For simplicity, any KubernetesCluster resources that are created automatically for you during cluster registration use the same name as the workload cluster. However, the name of the KubernetesCluster resource is not required to match the name of the cluster. The following example show a simple KubernetesCluster resource named `cluster1` with `cluster.local` as its cluster domain: ```yaml apiVersion: admin.gloo.solo.io/v2 kind: KubernetesCluster metadata: name: cluster1 namespace: gloo-mesh spec: clusterDomain: cluster.local ``` The following example adds the region label to the KubernetesCluster resource: ```yaml apiVersion: admin.gloo.solo.io/v2 kind: KubernetesCluster metadata: name: cluster1 namespace: gloo-mesh labels: region: us-east spec: clusterDomain: cluster.local ``` The following example excludes the cluster from safe mode: ```yaml apiVersion: admin.gloo.solo.io/v2 kind: KubernetesCluster metadata: name: cluster1 namespace: gloo-mesh labels: region: us-east spec: clusterDomain: cluster.local skipWarming: true ``` properties: clusterDomain: description: 'Optional: The cluster domain suffix this Cluster is configured with. Defaults to ''cluster.local''.' type: string skipWarming: description: |- Optional: Exclude this cluster from safe mode. If set to true: In the event that Redis and the Gloo management server restart and their cache and local memory are cleared, the Gloo management server does not wait for this cluster to send an input snapshot to start the translation. Note that clusters that never connected to the Gloo management server to sent at least one input snapshot are automatically excluded from safe mode. type: boolean type: object status: description: // The status of the KubernetesCluster after it is applied to your Gloo environment. properties: common: description: Indicates the state of the Gloo agent that is connected to the Gloo management server. properties: State: properties: approval: description: |- Whether the resource has been accepted as valid and processed in the Gloo Mesh config translation. enum: - PENDING - ACCEPTED - INVALID - WARNING - FAILED - UNLICENSED type: string message: description: Additional information about the current state of the resource. type: string observedGeneration: description: |- The most recent generation observed in the object's metadata. If the `observedGeneration` does not match `metadata.generation`, Gloo Mesh has not processed the most recent version of this object. format: int64 type: integer type: object workspaceConditions: additionalProperties: maximum: 4294967295 minimum: 0 type: integer description: |- A map of ApprovalState to the number of workspaces in this condition, e.g., "Accepted" -> 2 "Pending" -> 1 type: object type: object conditions: description: List of conditions -- observations of KubernetesCluster state items: properties: lastTransitionTime: description: The timestamp when the condition last transitioned from one status to another. format: date-time type: string message: description: A human readable message that includes the details about why the condition transitioned to the current status. type: string observedGeneration: description: Optional. The `metadata.generation` that the condition is based on. format: int64 type: integer reason: description: The programmatic identifier that represents the reason the condition transitioned to the current status in CamelCase format. type: string status: description: The status of the condition. Commonly used values are `True`, `False`, and `Unknown`, but can contain controller-specific values too. type: string type: description: The type of the condition in CamelCase. type: string type: object type: array type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: a3bc1c4ccf1b4e2c crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: ratelimitserverconfigs.admin.gloo.solo.io spec: group: admin.gloo.solo.io names: categories: - solo-io kind: RateLimitServerConfig listKind: RateLimitServerConfigList plural: ratelimitserverconfigs shortNames: - rlsc singular: ratelimitserverconfig scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .status.common.State.approval name: Status type: string name: v2 schema: openAPIV3Schema: properties: spec: description: |- RateLimitServerConfig is used to configure the ratelimit rules enforced by the server. All RateLimitPolicy resources in a workspace require a RateLimitServerConfig to in order to configure ratelimit rules. If no RateLimitServerConfig is provided, no ratelimit rules will be enforced. oneOf: - not: anyOf: - required: - raw - required: - raw properties: destinationServers: description: Required field to specify the ratelimit servers that will enforce the defined descriptors. items: description: |- Destinations point to the upstream services that fulfill client requests on matching routes that you set up, such as in a route table. Each destination must resolve to one and only one hostname. Destinations can refer to a variety of resources. The behavior of the route action varies depending on the kind of destination. Currently supported destination types are: - Kubernetes `Service`, the default destination. - Gloo `VirtualDestination` to route traffic to one of the VirtualDestination's backing Kubernetes services. - Gloo `ExternalService` to route traffic to a static set of service endpoints that are external to your mesh setup. - Gloo `ExternalWorkload` to route traffic to external workloads that are part of your mesh. - Gloo `CloudProvider` to route traffic to a cloud provider function such as AWS Lambdas, selected by using the `functionCall` field. HTTP routes support all destinations. TCP routes support only Kubernetes `Service` and Gloo `VirtualDestination` destinations. oneOf: - not: anyOf: - required: - ref - required: - awsLambda - required: - ref - required: - awsLambda properties: awsLambda: description: Reference an AWS Lambda function. properties: cloudProvider: description: Reference to the AWS Cloud Provider. properties: cluster: description: the cluster of the object. If omitted, Gloo Mesh will use the same cluster as the parent object containing this reference. type: string name: description: the name of the object type: string namespace: description: the namespace of the object. If omitted, Gloo Mesh will use the same namespace as the parent object containing this reference. type: string type: object function: description: Name of the function to reference. type: string options: description: |- Specify how the destinations should be configured, for configuring lambda functions. If the destination config is required for the destination and not provided by the user, Gloo will invalidate the destination and its parent resources. properties: invocationStyle: description: |- Can be either Sync or Async. See [AWS Invoke](https://docs.aws.amazon.com/lambda/latest/dg/API_Invoke.html) for more details. enum: - SYNC - ASYNC type: string requestTransformation: enum: - REQUEST_DEFAULT - REQUEST_DISABLE type: string responseTransformation: enum: - RESPONSE_DEFAULT - RESPONSE_DISABLE type: string type: object qualifier: description: Qualifier of the function to reference. Defaults to $LATEST type: string type: object kind: description: |- the kind of Kubernetes destination being referenced. defaults to Service. Only applicable for Kubernetes destinations. For non Kubernetes destinations, this field is ignored. enum: - SERVICE - VIRTUAL_DESTINATION - EXTERNAL_SERVICE type: string port: description: the port on the destination object being targeted. required if the object provides more than one port. oneOf: - not: anyOf: - required: - number - required: - name - required: - number - required: - name properties: name: description: the name of the port on the destination objects being targeted. type: string number: description: the number of the port on the destination objects being targeted. maximum: 65535 minimum: 1 type: integer type: object ref: description: reference to a Kubernetes destination object by its metadata properties: cluster: description: the cluster of the object. If omitted, Gloo Mesh will use the same cluster as the parent object containing this reference. type: string name: description: the name of the object type: string namespace: description: the namespace of the object. If omitted, Gloo Mesh will use the same namespace as the parent object containing this reference. type: string type: object subset: additionalProperties: type: string description: |- select a subset of the destination's endpoints for routing based on their labels. Only applicable for Kubernetes destinations. type: object weight: description: |- Specify the proportion of traffic to be forwarded to this destination. Weights across all of the `destinations` must sum to 100. Weight is only relevant when used in the context of a route with multiple destinations. maximum: 4294967295 minimum: 0 type: integer type: object type: array raw: description: Define a policy using the raw configuration format used by the ratelimit server. properties: descriptors: description: |- The descriptors that will be applied to the server. {{/* Note: validation of this field disabled because it slows down cue tremendously*/}} items: type: object x-kubernetes-preserve-unknown-fields: true type: array setDescriptors: description: |- The set descriptors that will be applied to the server. {{/* Note: validation of this field disabled because it slows down cue tremendously*/}} items: type: object x-kubernetes-preserve-unknown-fields: true type: array type: object type: object status: description: The current status of the `RateLimitServerConfig`. properties: common: description: The state and workspace conditions of the applied resource. properties: State: properties: approval: description: |- Whether the resource has been accepted as valid and processed in the Gloo Mesh config translation. enum: - PENDING - ACCEPTED - INVALID - WARNING - FAILED - UNLICENSED type: string message: description: Additional information about the current state of the resource. type: string observedGeneration: description: |- The most recent generation observed in the object's metadata. If the `observedGeneration` does not match `metadata.generation`, Gloo Mesh has not processed the most recent version of this object. format: int64 type: integer type: object workspaceConditions: additionalProperties: maximum: 4294967295 minimum: 0 type: integer description: |- A map of ApprovalState to the number of workspaces in this condition, e.g., "Accepted" -> 2 "Pending" -> 1 type: object type: object numSelectedDestinationServers: description: The number of ratelimit servers for which server config was translated. maximum: 4294967295 minimum: 0 type: integer type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: af2b5c62c8e1b96c crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: ratelimitserversettings.admin.gloo.solo.io spec: group: admin.gloo.solo.io names: categories: - solo-io kind: RateLimitServerSettings listKind: RateLimitServerSettingsList plural: ratelimitserversettings shortNames: - rlss singular: ratelimitserversettings scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .status.State name: Status type: string name: v2 schema: openAPIV3Schema: properties: spec: description: |- RateLimitServerSettings is an optional resource used to configure how a client (i.e. a sidecar or gateway proxy) connects to a rate limit server. If no RateLimitServerSetting is selected in a RatelimitPolicy, a default configuration will be used. properties: denyOnFail: description: |- Behaviour in case the rate limiting service does not respond back. When it is set to true, Envoy will not allow traffic in case of communication failure between rate limiting service and the proxy. Defaults to false type: boolean destinationServer: description: |- The ratelimit service to ask about ratelimit decisions. The provided reference will be used to search for a service of the given name/namespace on the cluster the traffic policy is applied on If omitted, Gloo Mesh will search for a service with the name rate-limiter in the gloo-mesh namespace. oneOf: - not: anyOf: - required: - ref - required: - awsLambda - required: - ref - required: - awsLambda properties: awsLambda: description: Reference an AWS Lambda function. properties: cloudProvider: description: Reference to the AWS Cloud Provider. properties: cluster: description: the cluster of the object. If omitted, Gloo Mesh will use the same cluster as the parent object containing this reference. type: string name: description: the name of the object type: string namespace: description: the namespace of the object. If omitted, Gloo Mesh will use the same namespace as the parent object containing this reference. type: string type: object function: description: Name of the function to reference. type: string options: description: |- Specify how the destinations should be configured, for configuring lambda functions. If the destination config is required for the destination and not provided by the user, Gloo will invalidate the destination and its parent resources. properties: invocationStyle: description: |- Can be either Sync or Async. See [AWS Invoke](https://docs.aws.amazon.com/lambda/latest/dg/API_Invoke.html) for more details. enum: - SYNC - ASYNC type: string requestTransformation: enum: - REQUEST_DEFAULT - REQUEST_DISABLE type: string responseTransformation: enum: - RESPONSE_DEFAULT - RESPONSE_DISABLE type: string type: object qualifier: description: Qualifier of the function to reference. Defaults to $LATEST type: string type: object kind: description: |- the kind of Kubernetes destination being referenced. defaults to Service. Only applicable for Kubernetes destinations. For non Kubernetes destinations, this field is ignored. enum: - SERVICE - VIRTUAL_DESTINATION - EXTERNAL_SERVICE type: string port: description: the port on the destination object being targeted. required if the object provides more than one port. oneOf: - not: anyOf: - required: - number - required: - name - required: - number - required: - name properties: name: description: the name of the port on the destination objects being targeted. type: string number: description: the number of the port on the destination objects being targeted. maximum: 65535 minimum: 1 type: integer type: object ref: description: reference to a Kubernetes destination object by its metadata properties: cluster: description: the cluster of the object. If omitted, Gloo Mesh will use the same cluster as the parent object containing this reference. type: string name: description: the name of the object type: string namespace: description: the namespace of the object. If omitted, Gloo Mesh will use the same namespace as the parent object containing this reference. type: string type: object subset: additionalProperties: type: string description: |- select a subset of the destination's endpoints for routing based on their labels. Only applicable for Kubernetes destinations. type: object weight: description: |- Specify the proportion of traffic to be forwarded to this destination. Weights across all of the `destinations` must sum to 100. Weight is only relevant when used in the context of a route with multiple destinations. maximum: 4294967295 minimum: 0 type: integer type: object requestTimeout: description: |- The timeout in milliseconds for the rate limit service RPC. Defaults to 100ms. Behaviour after request timeout is reached is set by `deny_on_fail`. For information about the value format, see the [Google protocol buffer documentation](https://protobuf.dev/reference/protobuf/google.protobuf/#duration). type: string type: object status: description: |- The current status of the `RateLimitServerSettings`. properties: observedGeneration: description: |- The most recent generation observed in the RateLimitServerSettings metadata. If the `observedGeneration` does not match `metadata.generation`, Gloo Mesh has not processed the most recent version of this resource. format: int64 type: integer state: description: Whether the resource has been accepted as valid and processed in the Gloo Mesh config translation. enum: - PENDING - ACCEPTED - INVALID - WARNING - FAILED - UNLICENSED type: string type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: e3974a026a0f306c crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: roottrustpolicies.admin.gloo.solo.io spec: group: admin.gloo.solo.io names: categories: - solo-io kind: RootTrustPolicy listKind: RootTrustPolicyList plural: roottrustpolicies shortNames: - rtp singular: roottrustpolicy scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .status.State name: Status type: string name: v2 schema: openAPIV3Schema: properties: spec: properties: applyToMeshes: description: |- select the meshes where the root of trust will be applied. If empty, will apply to all Meshes in the workspace. items: description: MeshSelector is a Selector built for selecting instances of Mesh control planes. A control plane is understood to have a single domain and provide a single root of trust for the data plane proxies it is managing. Each revision of Istiod maps oneOf: - not: anyOf: - required: - istio - required: - istio properties: istio: description: options for selecting istio Mesh control planes. properties: clusterSelector: additionalProperties: type: string description: |- match the labels of the cluster where istiod is deployed. omit to select across all clusters. type: object namespace: description: |- match the name of the namespace where istiod is deployed. omit to select across all namespaces. type: string revision: description: |- istio.io/revision of Istio to select. regex supported. omit to select across all revisions. type: string selector: additionalProperties: type: string description: |- select via the labels of the istiod deployment. omit to select across all labels. type: object type: object type: object type: array config: description: The details of the root of trust to apply to the selected meshes. oneOf: - not: anyOf: - required: - mgmtServerCa - required: - agentCa - required: - mgmtServerCa - required: - agentCa properties: agentCa: description: |- Configures an Intermediate Certificate Authority which selected meshes will use to generate intermediate certificates. The CA being used must be configured to generate the intermediate certificates. oneOf: - not: anyOf: - required: - vault - required: - vault properties: vault: allOf: - oneOf: - not: anyOf: - required: - caBundle - required: - caSecretRef - required: - caLocalPath - required: - caBundle - required: - caSecretRef - required: - caLocalPath - oneOf: - not: anyOf: - required: - tokenSecretRef - required: - kubernetesAuth - required: - tokenSecretRef - required: - kubernetesAuth description: Use vault as the intermediate CA source properties: caBundle: description: Inline CA bytes format: byte type: string caLocalPath: description: Path to a local file containing the CA bytes type: string caPath: description: |- `ca_path` is the mount path of the Vault PKI backend's `sign` endpoint, e.g: "my_pki_mount/sign/my-role-name". type: string caSecretRef: description: |- Reference to a secret containing the CA bytes. The CA should be stored by the key `root-cert.pem` properties: name: description: name of the resource being referenced type: string namespace: description: namespace of the resource being referenced type: string type: object csrPath: description: |- `csr_path` is the mount path of the Vault PKI backend's `generate` endpoint, e.g: "my_pki_mount/intermediate/generate/exported". "exported" is necessary here as istio needs access to the private key See vault docs here: https://developer.hashicorp.com/vault/api-docs/secret/pki#parameters-4 type: string kubernetesAuth: description: |- Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server. oneOf: - not: anyOf: - required: - serviceAccountRef - required: - mountedSaPath - required: - serviceAccountRef - required: - mountedSaPath properties: mountPath: description: |- The Vault mountPath here is the mount path to use when authenticating with Vault. For example, setting a value to `/v1/auth/foo`, will use the path `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the default value "/v1/auth/kubernetes" will be used. type: string mountedSaPath: description: |- File System path to grab the service account token from. Defaults to /var/run/secrets/kubernetes.io/serviceaccount type: string role: description: |- A required field containing the Vault Role to assume. A Role binds a Kubernetes ServiceAccount with a set of Vault policies. type: string secretTokenKey: description: |- Key to search for the sa_token Default to "token" type: string serviceAccountRef: description: Reference to service account, other than the one mounted to the current pod. properties: name: description: name of the resource being referenced type: string namespace: description: namespace of the resource being referenced type: string type: object type: object namespace: description: |- Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" More about namespaces can be found [here](https://www.vaultproject.io/docs/enterprise/namespaces) type: string server: description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".' type: string tokenSecretRef: description: TokenSecretRef authenticates with Vault by presenting a token. properties: name: description: name of the resource being referenced type: string namespace: description: namespace of the resource being referenced type: string type: object type: object type: object autoRestartPods: description: |- This setting specifies whether or not workload pods should be automatically restarted upon completion of a successful certificate issuance. type: boolean intermediateCertOptions: description: Configuration options for generated intermediate certs. properties: orgName: description: The organization name of the certificate. Defaults to "gloo-mesh". type: string rsaKeySizeBytes: description: Size in bytes of the certificate's private key. Defaults to 4096. maximum: 4294967295 minimum: 0 type: integer secretRotationGracePeriodRatio: description: |- The ratio of the certificate lifetime to when Gloo starts the certificate rotation process. The ratio must be between 0 and 1 (exclusive). For example, if a certificate is valid for 1 day (or 24 hours), and you specify a ratio of 0.1, Gloo starts the certificate rotation process 2.4 hours before it expires (24x0.1). type: number ttlDays: description: Number of days before the certificate expires. Defaults to 365. maximum: 4294967295 minimum: 0 type: integer type: object mgmtServerCa: description: |- Configure a Root Certificate Authority which will be shared by all Meshes associated with this RootTrustPolicy. If this is not provided, a self-signed certificate will be generated by Gloo Mesh. oneOf: - not: anyOf: - required: - generated - required: - secretRef - required: - generated - required: - secretRef properties: generated: description: |- Generate a self-signed root certificate with the given options. By default, the root CA is valid for 1 year. properties: orgName: description: The organization name of the certificate. Defaults to "gloo-mesh". type: string rsaKeySizeBytes: description: Size in bytes of the certificate's private key. Defaults to 4096. maximum: 4294967295 minimum: 0 type: integer secretRotationGracePeriodRatio: description: |- The ratio of the certificate lifetime to when Gloo starts the certificate rotation process. The ratio must be between 0 and 1 (exclusive). For example, if a certificate is valid for 1 day (or 24 hours), and you specify a ratio of 0.1, Gloo starts the certificate rotation process 2.4 hours before it expires (24x0.1). type: number ttlDays: description: Number of days before the certificate expires. Defaults to 365. maximum: 4294967295 minimum: 0 type: integer type: object secretRef: description: |- The name of a Kubernetes secret in the same namespace as the RootTrustPolicy that contains the root certificate authority. Provided certificates must conform to a specified format, [documented here]({{< link path="/setup/prod/certs/relay/" >}}). properties: name: description: name of the resource being referenced type: string namespace: description: namespace of the resource being referenced type: string type: object type: object passiveCertificateAuthorities: description: |- Configure a Root Certificate Authority which will be used for validating certificates, but not signing them. This CA can be used to rotate out expiring root certificates. items: description: Specify parameters for configuring the root certificate authority for a RootTrustPolicy. oneOf: - not: anyOf: - required: - generated - required: - secretRef - required: - generated - required: - secretRef properties: generated: description: |- Generate a self-signed root certificate with the given options. By default, the root CA is valid for 1 year. properties: orgName: description: The organization name of the certificate. Defaults to "gloo-mesh". type: string rsaKeySizeBytes: description: Size in bytes of the certificate's private key. Defaults to 4096. maximum: 4294967295 minimum: 0 type: integer secretRotationGracePeriodRatio: description: |- The ratio of the certificate lifetime to when Gloo starts the certificate rotation process. The ratio must be between 0 and 1 (exclusive). For example, if a certificate is valid for 1 day (or 24 hours), and you specify a ratio of 0.1, Gloo starts the certificate rotation process 2.4 hours before it expires (24x0.1). type: number ttlDays: description: Number of days before the certificate expires. Defaults to 365. maximum: 4294967295 minimum: 0 type: integer type: object secretRef: description: |- The name of a Kubernetes secret in the same namespace as the RootTrustPolicy that contains the root certificate authority. Provided certificates must conform to a specified format, [documented here]({{< link path="/setup/prod/certs/relay/" >}}). properties: name: description: name of the resource being referenced type: string namespace: description: namespace of the resource being referenced type: string type: object type: object type: array type: object type: object status: description: |- The status of the policy after it is applied to your Gloo environment. properties: observedGeneration: description: |- The most recent generation observed in the object's metadata. If the `observedGeneration` does not match `metadata.generation`, Gloo Mesh has not processed the most recent version of this object. format: int64 type: integer state: description: Whether the resource has been accepted as valid and processed in the Gloo Mesh config translation. enum: - PENDING - ACCEPTED - INVALID - WARNING - FAILED - UNLICENSED type: string type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: 4e64062b421505f8 crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: workspaces.admin.gloo.solo.io spec: group: admin.gloo.solo.io names: categories: - solo-io kind: Workspace listKind: WorkspaceList plural: workspaces shortNames: - ws singular: workspace scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .status.common.State.approval name: Status type: string name: v2 schema: openAPIV3Schema: properties: spec: description: |- `Workspace` describes a logical grouping of Kubernetes namespaces within the clusters that are part of a virtual mesh. Workspace can be treated as a boundary for configuration and service discovery. The specification describes how to select namespaces or/and clusters for a given workspace. The workspace-wide settings such as `importFrom`, `exportTo` are configured in the `WorkspaceSettings` object. Refer to the `WorkspaceSettings` documentation for details. The following example creates the `web` workspace that selects all workload clusters and all namespaces within those clusters to be part of the workspace. ```yaml apiVersion: admin.gloo.solo.io/v2 kind: Workspace metadata: name: web namespace: gloo-mesh spec: workloadClusters: - name: "*" namespaces: - name: "*" ``` The following configuration creates the `web` workspace that selects the `web` namespace from all workload clusters that have the label of `region: us-east` to be part of the workspace. Refer to the `KubernetesCluster` documentation for examples on how to label your KubernetesCluster resource. ```yaml apiVersion: admin.gloo.solo.io/v2 kind: Workspace metadata: name: web namespace: gloo-mesh spec: workloadClusters: - selector: region: us-east namespaces: - name: web ``` The following example creates the `policy` namespace that does NOT have any workload clusters. This workspace also has the `gloo.solo.io/global` label which other workspaces can use to import this workspace by label in their `WorkspaceSettings` resource. ```yaml apiVersion: admin.gloo.solo.io/v2 kind: Workspace metadata: name: policy namespace: gloo-mesh labels: gloo.solo.io/global: 'true' ``` The example below creates the `backend` workspace that select any namespace that starts with `ns1` in `cluster1` and any namespace that starts with `ns2` in `cluster2`. It has the `gloo.solo.io/exportToGateway` label, which other workspaces can use to import this workspace by label in their `WorkspaceSettings` resource. Refer to the `KubernetesCluster` documentation for examples on how to name your KubernetesCluster resource. ```yaml apiVersion: admin.gloo.solo.io/v2 kind: Workspace metadata: name: backend namespace: gloo-mesh labels: gloo.solo.io/exportToGateway: tier1 team: backend spec: workloadClusters: - name: cluster1 namespaces: - name: ns1* - name: cluster2 namespaces: - name: ns2* ``` properties: workloadClusters: description: |- Optional: Select workload clusters and namespaces for the workload clusters that are part of the workspace. When this is not specified, the workspace contains no workload clusters. items: description: Select clusters and namespaces for a workspace properties: configEnabled: description: |- Optional: Read Gloo configuration from specific clusters and namespaces that are included in a workspace. If you omit this field for any cluster in a workspace, it is set to `true` by default, and Gloo configuration is read for all clusters and namespaces in that workspace. If you explicitly set this field to either true or false on a specific cluster, you must also explicitly set the field for every other cluster that is listed in that workspace. For example, if you have a workspace that spans namespaces in three clusters, but you want to read Gloo configuration from the namespaces in only one of the clusters, you must explicitly set `configEnabled: true` for the cluster to read from, and explicitly set `configEnabled: false` for the other two clusters. type: boolean name: description: |- Optional: Name of the cluster to select. Use * to match name patterns in multiple clusters name. type: string namespaces: description: Select the namespaces in the cluster(s) to include in the workspace. If you do not select any namespaces, the workspace is empty and results in an error. items: description: Select namespaces for the selected cluster(s) properties: configEnabled: description: |- Optional: Read Gloo configuration from this namespace. If you omit this field for any other namespace in the cluster, it is set to `true` by default, and Gloo configuration is read for all namespaces in that cluster. If you explicitly set this field to either true or false for one namespace, you must also explicitly set the field for every other namespace that is listed in the workspace for that cluster. For example, if you have a cluster in your workspace that has three namespaces, but you want to read Gloo configuration from only one of the namespaces in the cluster, you must explicitly set `configEnabled: true` for the namespace to read from, and explicitly set `configEnabled: false` for the other two namespaces. type: boolean labels: additionalProperties: type: string description: |- Optional: Select groups of namespaces via labels. Leaving this field empty will NOT select all namespaces, but rather be ignored. Note: When this field is used in conjunction with "name", both conditions are ANDed together. type: object name: description: |- Name of the namespace to select. Can use * to match name patterns in multiple namespaces. Note: When this field is used in conjunction with "labels", both conditions are ANDed together. type: string type: object type: array selector: additionalProperties: type: string description: |- Optional: Include workload clusters in the workspace by using a selector. The selector matches the selector values in the KubernetesCluster resource on the management cluster. Selector is a map of {key,value} pairs. A single {key,value} in the selector map is equivalent to an element of labelRequirements, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object type: array type: object status: properties: common: description: The state and workspace conditions of the applied policy. properties: State: properties: approval: description: |- Whether the resource has been accepted as valid and processed in the Gloo Mesh config translation. enum: - PENDING - ACCEPTED - INVALID - WARNING - FAILED - UNLICENSED type: string message: description: Additional information about the current state of the resource. type: string observedGeneration: description: |- The most recent generation observed in the object's metadata. If the `observedGeneration` does not match `metadata.generation`, Gloo Mesh has not processed the most recent version of this object. format: int64 type: integer type: object workspaceConditions: additionalProperties: maximum: 4294967295 minimum: 0 type: integer description: |- A map of ApprovalState to the number of workspaces in this condition, e.g., "Accepted" -> 2 "Pending" -> 1 type: object type: object destinationCounts: additionalProperties: maximum: 4294967295 minimum: 0 type: integer description: The number of destination resources in this workspace, sorted by type (Kubernetes service, virtual destination, external service). type: object numImportedWorkspaces: description: The number of workspaces imported into this workspace. maximum: 4294967295 minimum: 0 type: integer numResources: additionalProperties: properties: exported: maximum: 4294967295 minimum: 0 type: integer imported: maximum: 4294967295 minimum: 0 type: integer private: maximum: 4294967295 minimum: 0 type: integer type: object description: The number of resources that the workspace imports and exports, sorted by type (imported, exported, private). type: object numSelectedClusters: description: The number of selected Kubernetes clusters. maximum: 4294967295 minimum: 0 type: integer numSelectedNamespaces: description: The number of selected namespaces. maximum: 4294967295 minimum: 0 type: integer policyCounts: additionalProperties: maximum: 4294967295 minimum: 0 type: integer description: The number of policy resources in this workspace, sorted by type (security, trafficcontrol, resilience, observability). type: object workspaceSettings: description: The workspacesettings object configuring this workspace. properties: cluster: description: the cluster of the object. If omitted, Gloo Mesh will use the same cluster as the parent object containing this reference. type: string name: description: the name of the object type: string namespace: description: the namespace of the object. If omitted, Gloo Mesh will use the same namespace as the parent object containing this reference. type: string type: object type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: 932c77f2ee226482 crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: workspacesettings.admin.gloo.solo.io spec: group: admin.gloo.solo.io names: categories: - solo-io kind: WorkspaceSettings listKind: WorkspaceSettingsList plural: workspacesettings shortNames: - wss singular: workspacesettings scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .status.common.State.approval name: Status type: string name: v2 schema: openAPIV3Schema: properties: spec: description: |- `WorkspaceSettings` define a set of workspace-wide parameters such as `importFrom` and `exportTo` for the workspace. These settings are commonly defined by the workspace admin. There are 3 key configurations related to `WorkspaceSettings`: - importFrom: To import resources from another workspace to your workspace, configure the `importFrom` field in the `WorkspaceSettings` resource for your workspace. - exportTo: To export resources in your workspace to other workspaces, configure the `exportTo` field in the `WorkspaceSettings` resource for your workspace. - options: Configure service isolation, federation, proxy trimming and other options for the workspace. You can specify your workspace's `importFrom` or `exportTo` or other workspace configuration options in your `WorkspaceSettings` resource for your workspace. Only one `WorkspaceSettings` resource can be defined for each workspace. The resource can be deployed to any of your workspace's namespaces in your workload cluster(s). Export: Only the resources below can be exported to other workspaces: - Kubernetes Service - VirtualDestination - ExternalService - RouteTable - ApiDoc - GraphQLResolverMap - GraphQLSchema - GraphQLStitchedSchema You can use the `exportTo` field in the `WorkspaceSettings` resource for the workspace to configure what resources are exported to which other workspaces. For example, the `web` application developer can export the RouteTable resource from the `web` workspace to an admin-owned gateway workspace. The following workspace example defines the `backend` workspace. The workspace settings example exports the `backend` workspace to any workspaces that matches the label `team: web`. In addition, all exported resources from the `backend` workspace are made available for any workspace that has the label `team: web` to import. ```yaml apiVersion: admin.gloo.solo.io/v2 kind: Workspace metadata: name: backend namespace: gloo-mesh labels: team: backend spec: workloadClusters: - namespaces: - name: backend* --- apiVersion: admin.gloo.solo.io/v2 kind: WorkspaceSettings metadata: name: default namespace: backend-namespace spec: exportTo: - workspaces: - selector: team: web ``` Import: To import exported resources from other workspaces, configure the `importFrom` field in the `WorkspaceSettings` resource for your workspace. For example, by importing the `web` workspace, the admin-owned gateway workspace can delegate routing for a subset of the gateway traffic to a RouteTable resource in the `web` workspace. The following workspace defines the `web` workspace. The workspace settings example imports the exported resources from the `backend` workspace into the `web` workspace. The exported resources from the `backend` workspace is available to the `web` workspace for imports because the `web` workspace has the `team:web` label. ```yaml apiVersion: admin.gloo.solo.io/v2 kind: Workspace metadata: name: web namespace: gloo-mesh labels: team: web spec: workloadClusters: - namespaces: - name: web* --- apiVersion: admin.gloo.solo.io/v2 kind: WorkspaceSettings metadata: name: default namespace: web-namespace spec: importFrom: - workspaces: - name: backend ``` The following example imports any workspaces that are available for the `web` workspace to import and has the `team: backend` label into the `web` workspace. After this is deployed in the `web-namepsace` namespace of a given workload cluster that are part of the workspace, all exported resources from the `backend` workspaces which has the label `team: backend` are imported into the `web` workspace and available for use by anything in the `web` workspace. ```yaml apiVersion: admin.gloo.solo.io/v2 kind: WorkspaceSettings metadata: name: default namespace: web-namepsace spec: importFrom: - workspaces: - selector: team: backend ``` To create global workspace settings that apply to all namespaces in all clusters, you can create a WorkspaceSettings resource named `global` in the admin namespace, which is typically `gloo-mesh`. If you have multiple workspaces, you must still create one WorkspaceSettings resource per workspaces. However, global workspace settings override settings defined in individual workspaces. properties: exportTo: description: |- A workspace can specify resources to export for use by other workspaces. Currently the following types of objects can be exported across workspaces: Kubernetes services, virtual destinations, external destinations, route tables, API schemas, and GraphQL resolver maps. You can select workspace using labels, such as setting `exportTo.workspaces.selector` to `team: backend`. Or select workspace name using exact name match, such as setting `exportTo.workspaces.name` to `backend`. Or exportTo all other workspaces, such as setting `exportTo.workspaces.name` to `*`. Or select workspace using labels and name using simple regex, such as setting `exportTo.workspaces.selector` to `team: backend` and `team: backend*`. Or select workspace name using labels or select name using simple regex, such as setting `exportTo.workspaces.selector` to `team: backend` and `exportTo.workspaces.name` to `backend`. items: description: Select a set of resources from a set of workspaces for import or export. properties: resources: description: the resources (and types of those resources) which will be imported from or exported to the selected workspaces. items: description: selects objects of various types properties: cluster: description: |- Only select objects in the exactly matching cluster. If omitted, Gloo selects matching objects across all clusters available in the workspace. type: string kind: description: |- The type of the resource to import or export. The type must be a valid importable/exportable Kubernetes or Gloo Mesh resource type. Supported types: `ROUTE_TABLE`, `SERVICE`, `VIRTUAL_DESTINATION`, `EXTERNAL_SERVICE`, `API_DOC`, `GRAPHQL_RESOLVER_MAP`, `GRAPHQL_SCHEMA`, `GRAPHQL_STITCHED_SCHEMA`, `EXTERNAL_WORKLOAD`, `ALL` (all types). enum: - ALL - ROUTE_TABLE - SERVICE - VIRTUAL_DESTINATION - EXTERNAL_SERVICE - API_DOC - GRAPHQL_RESOLVER_MAP - GRAPHQL_SCHEMA - GRAPHQL_STITCHED_SCHEMA - EXTERNAL_WORKLOAD type: string labels: additionalProperties: type: string description: labels matching those of the object type: object name: description: |- Only select objects exactly matching the name. If omitted, Gloo selects matching objects with any name available in the workspace. type: string namespace: description: |- Only select objects exactly matching the namespace. If omitted, Gloo selects matching objects across all namespaces available in the workspace. type: string type: object type: array workspaces: description: the workspaces with the resources to export to or import. items: description: WorkspaceSelector is a selector for workspaces. properties: name: description: |- Optional: Name of the workspace to select. Use * to match name patterns in multiple workspace names. type: string selector: additionalProperties: type: string description: |- Optional: Select workspaces based on their labels, such as setting `selector` to `team: backend`. type: object type: object type: array type: object type: array importFrom: description: |- Select the workspaces whose objects will be imported into this workspace. Objects must both be exported by the workspace that is being imported and imported into this workspace in order to be shared across workspaces. Imported objects allow the creation of routes and outbound-communication from one workspace to another. Currently the following types of objects can be imported across workspaces: Kubernetes services, virtual destinations, external destinations, route tables, API schemas, and GraphQL resolver maps. You can select workspace using labels, such as setting `importFrom.workspaces.selector` to `team: backend`. Or select workspace name using exact name match, such as setting `importFrom.workspaces.name` to `backend`. Or select workspace using labels and name using simple regex, such as setting `importFrom.workspaces.selector` to `team: backend` and `importFrom.workspaces.name` to `backend*`. items: description: Select a set of resources from a set of workspaces for import or export. properties: resources: description: the resources (and types of those resources) which will be imported from or exported to the selected workspaces. items: description: selects objects of various types properties: cluster: description: |- Only select objects in the exactly matching cluster. If omitted, Gloo selects matching objects across all clusters available in the workspace. type: string kind: description: |- The type of the resource to import or export. The type must be a valid importable/exportable Kubernetes or Gloo Mesh resource type. Supported types: `ROUTE_TABLE`, `SERVICE`, `VIRTUAL_DESTINATION`, `EXTERNAL_SERVICE`, `API_DOC`, `GRAPHQL_RESOLVER_MAP`, `GRAPHQL_SCHEMA`, `GRAPHQL_STITCHED_SCHEMA`, `EXTERNAL_WORKLOAD`, `ALL` (all types). enum: - ALL - ROUTE_TABLE - SERVICE - VIRTUAL_DESTINATION - EXTERNAL_SERVICE - API_DOC - GRAPHQL_RESOLVER_MAP - GRAPHQL_SCHEMA - GRAPHQL_STITCHED_SCHEMA - EXTERNAL_WORKLOAD type: string labels: additionalProperties: type: string description: labels matching those of the object type: object name: description: |- Only select objects exactly matching the name. If omitted, Gloo selects matching objects with any name available in the workspace. type: string namespace: description: |- Only select objects exactly matching the namespace. If omitted, Gloo selects matching objects across all namespaces available in the workspace. type: string type: object type: array workspaces: description: the workspaces with the resources to export to or import. items: description: WorkspaceSelector is a selector for workspaces. properties: name: description: |- Optional: Name of the workspace to select. Use * to match name patterns in multiple workspace names. type: string selector: additionalProperties: type: string description: |- Optional: Select workspaces based on their labels, such as setting `selector` to `team: backend`. type: object type: object type: array type: object type: array options: description: Options for configuring the workspace as a whole. properties: eastWestGateways: description: |- Selects the eastwest gateways in a workspace. These options are used to select which gateways should be used to route East-West traffic. This traffic can be either passthrough TLS or terminated at the EastWest Gateway. A different port is expected in each case. The `virtual_dest_client_mode` field provides additional information related to this traffic. If no gateways are selected, an attempt will be made to match any service with the label `"istio": "eastwestgateway"` with ports named either "tls" or "https". The selection will fail with an error if the label exists but neither of the ports are defined. items: properties: hostInfoOverrides: description: |- Host information for an east-west gateway. Can be used to specify a set of routable destinations that proxy traffic back to the east-west gateway selected by the selector. Useful when a load balancer external to the mesh is being used. When using this feature, be careful to ensure that the selectors are granular enough to ensure that the correct HostInfo is mapped to the proper gateway. items: description: Specify Host Info to override discovered routing information for an east-west gateway. properties: addr: description: |- Address to be used to direct traffic to instead of the default gateway discovered address. Can be an IP address or hostname. type: string port: description: Port to be used to direct traffic to instead of the default gateway discovered port. maximum: 4294967295 minimum: 0 type: integer portType: description: The type of the specified port. Default is SNI passthrough. enum: - SNI_PASSTHROUGH - TLS_TERMINATION type: string type: object type: array port: description: |- Used to match tls port on gateway service. Traffic on this port will be used for passthrough TLS, as described on the `virtual_dest_client_mode` field. Default matches ports named "tls". Matching is done by both the port name as well as the port number. A match is required for either `port` or `tls_termination_port`, otherwise an error will be reported. oneOf: - not: anyOf: - required: - number - required: - name - required: - number - required: - name properties: name: description: the name of the port on the destination objects being targeted. type: string number: description: the number of the port on the destination objects being targeted. maximum: 65535 minimum: 1 type: integer type: object selector: description: |- Evaluated against the discovered Istio gateway services. When this field is blank, gateway services will be matched using the default labels described on the `east_west_gateways` field. properties: cluster: description: |- Only select objects in the matching cluster. If omitted, Gloo selects matching objects across all clusters available in the parent object's workspace. type: string labels: additionalProperties: type: string description: labels matching those of the object type: object name: description: |- Only select objects with the matching name. If omitted, Gloo selects matching objects with any name available in the parent object's workspace. type: string namespace: description: |- Only select objects in the matching namespace. If omitted, Gloo selects matching objects across all namespaces available in the parent object's workspace. type: string workspace: description: |- Only select objects in the given workspace. If omitted, Gloo selects matching objects across all workspaces available in the parent object's workspace. type: string type: object tlsTerminationPort: description: |- Used to match tls termination port on gateway service. Traffic on this port will be used for TLS-terminated traffic, as described on the `virtual_dest_client_mode` field. Default matches ports named "https". Matching is done by both the port name as well as the port number. A match is required for either `port` or `tls_termination_port`, otherwise an error will be reported. oneOf: - not: anyOf: - required: - number - required: - name - required: - number - required: - name properties: name: description: the name of the port on the destination objects being targeted. type: string number: description: the number of the port on the destination objects being targeted. maximum: 65535 minimum: 1 type: integer type: object type: object type: array federation: description: |- Federation is a feature which allows Kubernetes Services to directly communicate with each other across clusters using generated hostnames. When enabled, federation will generate a hostname for each Service selected, which is reachable by all network clients in the workspace. Federation allows routes to be created in RouteTables which forward traffic across clusters. These routes will otherwise be treated by Gloo Mesh as errors. properties: enabled: description: |- Enables the federation feature for selected Kubernetes services in the workspace. Default value is disabled. type: boolean hostSuffix: description: 'Optional: The suffix used for generated hostnames. Hostnames will be generated for each selected service in the format `{{ service name }}.{{ service namespace }}.{{ service cluster }}.{{ host suffix }}`.' type: string ports: description: if provided, expose only selected ports to cross-cluster traffic. items: description: selects an individual port by number or name oneOf: - not: anyOf: - required: - number - required: - name - required: - number - required: - name properties: name: description: the name of the port on the destination objects being targeted. type: string number: description: the number of the port on the destination objects being targeted. maximum: 65535 minimum: 1 type: integer type: object type: array serviceSelector: description: |- Selector for the K8s services that will be exposed to cross-cluster traffic within the Workspace. Federated hostnames will be generated for selected imported services. items: description: selects zero or more Kubernetes API resources by matching on labels, name, namespace, cluster, and workspace. properties: cluster: description: |- Only select objects in the matching cluster. If omitted, Gloo selects matching objects across all clusters available in the parent object's workspace. type: string labels: additionalProperties: type: string description: labels matching those of the object type: object name: description: |- Only select objects with the matching name. If omitted, Gloo selects matching objects with any name available in the parent object's workspace. type: string namespace: description: |- Only select objects in the matching namespace. If omitted, Gloo selects matching objects across all namespaces available in the parent object's workspace. type: string workspace: description: |- Only select objects in the given workspace. If omitted, Gloo selects matching objects across all workspaces available in the parent object's workspace. type: string type: object type: array type: object serviceIsolation: description: |- If Enabled, serviceIsolation will automatically block communication from non-importing workspaces into this one, enforced using mTLS. Applying AccessPolicies to destinations in this workspace will override the default service isolation behavior. properties: enabled: description: |- Automatically enables strict mTLS and blocks any access from non-importing workspaces into any destination in the current workspaces. Default value is disabled. type: boolean enforcementLayers: description: |- Optional: When NetworkPolicy translation is enabled, by default, all available layers will be used to enforce Service Isolation. You can optionally explicitly define which available layers will enforce Service Isolation. Only the layers set here will be used. properties: cni: type: boolean mesh: type: boolean type: object trimProxyConfig: description: |- When enabled, trim the outbound config from the Istio sidecar proxies for any destination outside the workspace. The sidecar proxies keep the configuration for all destinations in the workspace (including imported destinations). To trim proxies for specific destinations with the workspace, you can use the `TrimProxyConfigPolicy` instead. {{< reuse "conrefs/snippets/policies/trim-proxy-workloads-limit.md" >}} nullable: true type: boolean type: object trimAllProxyConfig: description: |- When enabled, trim the outbound config from the Istio sidecar proxies of all destinations in the workspace (including imported destinations). Without the outbound destination config, the Istio sidecar proxies cannot talk to other destinations in the workspace by default. This way, you reduce the size of the proxy config to improve performance. You can add destinations back into the sidecar proxy config by enabling the `serviceIsolation.trimProxyConfig` field in the workspace settings or by using a `TrimProxyConfigPolicy`. The preferred way is the `TrimProxyConfigPolicy`, which gives you more fine-grained control over the allowed destinations than the workspace-wide `serviceIsolation.trimProxyConfig` setting. {{< reuse "conrefs/snippets/policies/trim-proxy-workloads-limit.md" >}} For more information, see the [Trim proxy config guide](https://docs.solo.io/gloo-mesh-enterprise/latest/resiliency/trim-proxy-config/workspace-service-isolation/). type: boolean virtualDestClientMode: description: |- Optional: Virtual destination client mode determines how VirtualDestinations will be translated. If nil, the default value of auto mode will be used. Any configuration here can be overridden on any individual virtual destination. The settings defined here apply to both user-provided VirtualDestinations and those generated internally when federation is enabled. oneOf: - not: anyOf: - required: - auto - required: - sniRouting - required: - tlsTermination - required: - auto - required: - sniRouting - required: - tlsTermination properties: auto: description: |- The default mode is to use sni routing via tls passthrough at the East/West Gateway to route to services across clusters. In the future, this may change to become smarter (e.g., detect if any pods backing the virtual destination don't have sidecars, if so, then use tls termination so all pods are routeable). For information about the value format, see the [Google protocol buffer documentation](https://protobuf.dev/reference/protobuf/google.protobuf/#empty). maxProperties: 0 type: object sniRouting: description: |- Sni routing mode uses tls passthrough to route traffic to the proper pod (with sidecar) from the East/West Gateway. For information about the value format, see the [Google protocol buffer documentation](https://protobuf.dev/reference/protobuf/google.protobuf/#empty). maxProperties: 0 type: object tlsTermination: description: |- Tls termination mode uses tls termination at the East/West Gateway to route traffic to the correct pod. This mode is ideal for Gloo Mesh Gateway, i.e. some backing pods don't have sidecars. Since TLS is terminated at the East/West Gateway, the backing service (if it has a sidecar) will not be able to verify the istio mTLS identity of the originating client; rather it will verify the istio mTLS cert of the East/West Gateway. For information about the value format, see the [Google protocol buffer documentation](https://protobuf.dev/reference/protobuf/google.protobuf/#empty). maxProperties: 0 type: object type: object type: object type: object status: properties: common: description: The state and workspace conditions of the applied resource. properties: State: properties: approval: description: |- Whether the resource has been accepted as valid and processed in the Gloo Mesh config translation. enum: - PENDING - ACCEPTED - INVALID - WARNING - FAILED - UNLICENSED type: string message: description: Additional information about the current state of the resource. type: string observedGeneration: description: |- The most recent generation observed in the object's metadata. If the `observedGeneration` does not match `metadata.generation`, Gloo Mesh has not processed the most recent version of this object. format: int64 type: integer type: object workspaceConditions: additionalProperties: maximum: 4294967295 minimum: 0 type: integer description: |- A map of ApprovalState to the number of workspaces in this condition, e.g., "Accepted" -> 2 "Pending" -> 1 type: object type: object numFederatedServices: description: The number of services federated to this workspace, determined by the workspace settings configuration. maximum: 4294967295 minimum: 0 type: integer numSelectedEastWestGateways: description: The number of selected east-west gateways determined by the EastWestGatewaySelector. maximum: 4294967295 minimum: 0 type: integer workspace: description: The workspace that this workspacesettings object configures. properties: cluster: description: the cluster of the object. If omitted, Gloo Mesh will use the same cluster as the parent object containing this reference. type: string name: description: the name of the object type: string namespace: description: the namespace of the object. If omitted, Gloo Mesh will use the same namespace as the parent object containing this reference. type: string type: object type: object type: object served: true storage: true subresources: status: {} ---