# Code generated by skv2. DO NOT EDIT.
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
crd.solo.io/specHash: 5175fa435d135ea1
crd.solo.io/version: 2.14.0
labels:
app: gloo-mesh-apis
app.kubernetes.io/name: gloo-mesh-apis
name: wasmdeploymentpolicies.extensions.policy.gloo.solo.io
spec:
group: extensions.policy.gloo.solo.io
names:
categories:
- solo-io
kind: WasmDeploymentPolicy
listKind: WasmDeploymentPolicyList
plural: wasmdeploymentpolicies
shortNames:
- wdp
singular: wasmdeploymentpolicy
scope: Namespaced
versions:
- name: v2
schema:
openAPIV3Schema:
properties:
spec:
description: Specifications for the policy.
properties:
applyToWorkloads:
description: |-
Select the workloads to apply the Wasm filter to.
If empty, the policy applies to all workloads in the workspace.
items:
description: |-
WorkloadSelector is a Selector specifically built for selecting individual workloads.
Workloads must have injected sidecar proxies or be standalone gateway proxies to be selected by Gloo Mesh policies.
This selector can be used to select Kubernetes workloads (KUBE) or sidecar-injected external endpoints (VM).
properties:
kind:
description: The kind of workload being selected. Defaults to Kube.
enum:
- KUBE
- VM
type: string
port:
description: |-
The port to select on the selected workloads.
Only applies to policies which select specific workload ports, such as the WasmDeploymentPolicy.
oneOf:
- not:
anyOf:
- required:
- number
- required:
- name
- required:
- number
- required:
- name
properties:
name:
description: the name of the port on the destination objects
being targeted.
type: string
number:
description: the number of the port on the destination objects
being targeted.
maximum: 65535
minimum: 1
type: integer
type: object
selector:
description: Selector used to match Workload objects by their metadata.
properties:
cluster:
description: |-
Only select objects in the matching cluster. If omitted, Gloo selects
matching objects across all clusters available in the parent object's workspace.
type: string
labels:
additionalProperties:
type: string
description: labels matching those of the object
type: object
name:
description: |-
Only select objects with the matching name. If omitted, Gloo selects
matching objects with any name available in the parent object's workspace.
type: string
namespace:
description: |-
Only select objects in the matching namespace. If omitted, Gloo selects
matching objects across all namespaces available in the parent object's workspace.
type: string
workspace:
description: |-
Only select objects in the given workspace. If omitted, Gloo selects
matching objects across all workspaces available in the parent object's workspace.
type: string
type: object
type: object
type: array
config:
description: Details of the policy specifying the Wasm filters to apply
to the selected workloads.
properties:
filters:
description: Wasm filter parameters.
items:
allOf:
- oneOf:
- not:
anyOf:
- required:
- localPathSource
- required:
- httpUriSource
- required:
- wasmImageSource
- required:
- localPathSource
- required:
- httpUriSource
- required:
- wasmImageSource
- oneOf:
- not:
anyOf:
- required:
- staticFilterConfig
- required:
- dynamicFilterConfig
- required:
- staticFilterConfig
- required:
- dynamicFilterConfig
description: Specify the Wasm filter to deploy.
properties:
dynamicFilterConfig:
description: |-
NOTE: **Not currently implemented.** This field serves as a placeholder.
Provide configuration from a dynamic configuration source.
This setting connects proxies to a configuration server to update filter
configuration instead of using a filter provided in the policy.
- `google.protobuf.Struct` is serialized as JSON before it is passed to the plugin.
- `google.protobuf.BytesValue` and `google.protobuf.StringValue` are passed directly without the wrapper.
type: string
filterContext:
description: |-
The context that the filter is attached to:
- Any workload context (`ANY`)
- A gateway (`GATEWAY`)
- Inbound traffic to a sidecar proxy (`SIDECAR_INBOUND`)
- Outbound traffic from a sidecar (`SIDECAR_OUTBOUND`)
By default, the value is `ANY` to permit any context.
enum:
- ANY
- SIDECAR_INBOUND
- SIDECAR_OUTBOUND
- GATEWAY
- WAYPOINT
type: string
httpUriSource:
description: |-
Select `http_uri_source` to deploy the filter from an HTTP/S URI accessible
to the workload proxy. Note that Gloo Mesh cannot verify
whether the target workload proxy containers have HTTP access the given URI.
If filters do not load, check the sidecar proxy logs.
properties:
sha:
description: |-
Required: The sha256 checksum of the filter binary.
This value is verified by the proxy.
type: string
uri:
description: The HTTP URI from which to fetch the filter.
type: string
type: object
insertBeforeFilter:
description: |-
In the Envoy HTTP Filter Chain, the filter that the Wasm filter is inserted
immediately before. Note that not all filters might be applied to a
particular workload. Default value: `envoy.router`.
type: string
localPathSource:
description: |-
Select `local_path_source` to deploy the filter from a file accessible
to the workload proxy. Note that Gloo Mesh cannot verify
whether the target workload proxy containers contain the given path.
If filters do not load, check the sidecar proxy logs.
type: string
rootId:
description: |-
The `rootId` must match the `rootId` defined in the filter. If omitted,
Gloo Mesh pulls and sets the image from the `filter_conf` contained
in the image config. Note that if the `filter_source` is not set to
`wasm_image_source`, this field is required.
type: string
staticFilterConfig:
description: |-
Provide configuration as a static configuration source.
- `google.protobuf.Struct` is serialized as JSON before it is passed to the plugin.
- `google.protobuf.BytesValue` and `google.protobuf.StringValue` are passed directly without the wrapper.
For information about the value format, see the
[Google protocol buffer documentation](https://protobuf.dev/reference/protobuf/google.protobuf/#any).
type: object
x-kubernetes-preserve-unknown-fields: true
vmId:
description: |-
Optional: A VM ID, used along with a hash of the Wasm code (or the name of the
registered Null VM plugin), to determine which VM loads the Wasm filter.
All filters on the same workload that use the same `vmId` and code within
use the same VM.
Note that sharing a VM between plugins can reduce memory
utilization and make sharing of data easier, which may have security implications.
type: string
wasmImageSource:
description: |-
Fetch the image from a WASM OCI Registry.
Images can be built and pushed to registries using `meshctl` and `wasme` CLI tool.
properties:
wasmImageTag:
description: |-
The full tag of the Wasm image. The tag must include the registry
address at the beginning, such as `webassemblyhub.io/ilackarms/helloworld:v0.1`.
type: string
type: object
type: object
type: array
weight:
description: |-
If you apply multiple Wasm filters to a single workload, add a `weight`
to specify the order in which the filters are applied.
Deployed Wasm filters are sorted in order of highest to lowest weight.
Wasm filters with equal weights are sorted non-deterministically.
Note that all Wasm filters are inserted immediately before the Envoy router filter
in the HTTP Connection Manager's HTTP Filter Chain.
maximum: 4294967295
minimum: 0
type: integer
type: object
type: object
status:
description: The status of the policy after it is applied to your Gloo environment.
properties:
common:
description: The state and workspace conditions of the applied resource.
properties:
State:
properties:
approval:
description: |-
Whether the resource has been accepted as valid and processed in the Gloo
Mesh config translation.
enum:
- PENDING
- ACCEPTED
- INVALID
- WARNING
- FAILED
- UNLICENSED
type: string
message:
description: Additional information about the current state of
the resource.
type: string
observedGeneration:
description: |-
The most recent generation observed in the object's metadata.
If the `observedGeneration` does not match `metadata.generation`, Gloo Mesh
has not processed the most recent version of this object.
format: int64
type: integer
type: object
workspaceConditions:
additionalProperties:
maximum: 4294967295
minimum: 0
type: integer
description: |-
A map of ApprovalState to the number of workspaces in this condition, e.g.,
"Accepted" -> 2
"Pending" -> 1
type: object
type: object
numSelectedWorkloads:
description: The number of workloads selected by the policy.
maximum: 4294967295
minimum: 0
type: integer
type: object
type: object
served: true
storage: true
subresources:
status: {}
---