# Code generated by skv2. DO NOT EDIT. apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: 3ecc2e8b8236e3d6 crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: certificaterequests.internal.gloo.solo.io spec: group: internal.gloo.solo.io names: categories: - solo-io kind: CertificateRequest listKind: CertificateRequestList plural: certificaterequests shortNames: - cr singular: certificaterequest scope: Namespaced versions: - name: v2 schema: openAPIV3Schema: properties: spec: description: |- CertificateRequests are generated by the Gloo Mesh agent installed on workload clusters. They are used to request a signed certificate from the certificate issuer (the Gloo Mesh server) based on a private key generated by the agent (which never leaves the workload cluster). When Gloo Mesh server creates an IssuedCertificate on a workload cluster, the local Gloo Mesh agent will generate a CertificateRequest corresponding to it. Gloo Mesh will then process the certificate signing request contained in the `CertificateRequestSpec` and write the signed SSL certificate back as a Kubernetes secret in the workload cluster, and update the `CertificateRequestStatus` to point to that secret. The certificate requested here is for Gloo Mesh agents on workload clusters to securely establish communication with Gloo Mesh server. This is not related to certificates for services running in the mesh. properties: certificateSigningRequest: description: |- Base64-encoded data for the PKCS#10 Certificate Signing Request issued by the Gloo Mesh agent deployed in the workload cluster, corresponding to the IssuedRequest received by the Gloo Mesh agent. format: byte type: string type: object status: properties: certChain: description: The cert chain of signing CA. format: byte type: string error: description: |- Any error observed which prevented the CertificateRequest from being processed. If the error is empty, the request has been processed successfully type: string observedGeneration: description: |- The most recent generation observed in the CertificateRequest metadata. If the `observedGeneration` does not match `metadata.generation`, the issuer has not processed the most recent version of this request. format: int64 type: integer signedCertificate: description: The signed intermediate certificate issued by the CA. format: byte type: string signingRootCa: description: The root CA used by the issuer to sign the certificate. format: byte type: string state: description: The current state of the CertificateRequest workflow reported by the issuer. enum: - PENDING - FINISHED - FAILED type: string type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: 964797310b5d56ba crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: discoveredcnis.internal.gloo.solo.io spec: group: internal.gloo.solo.io names: categories: - solo-io kind: DiscoveredCNI listKind: DiscoveredCNIList plural: discoveredcnis shortNames: - dcni singular: discoveredcni scope: Namespaced versions: - name: v2 schema: openAPIV3Schema: properties: spec: description: |- A DiscoveredCNISpec is an internal representation of a CNI discovered to be running in a cluster. DiscoveredCNIs are automatically detected from the node agent (DaemonSet) which runs on each CNI-networked cluster. oneOf: - not: anyOf: - required: - ciliumConfig - required: - ciliumConfig properties: agent: description: Reference to the Kubernetes DaemonSet that runs throughout the cluster. properties: clusterName: description: name of the cluster in which the resource exists type: string name: description: name of the resource being referenced type: string namespace: description: namespace of the resource being referenced type: string type: object ciliumConfig: description: Cilium CNI configuration. properties: data: additionalProperties: type: string description: Cilium CNI ConfigMap data. type: object type: object metricsPortNumber: description: the port number used to service CNI metrics. maximum: 4294967295 minimum: 0 type: integer provider: description: The provider of CNI installed. enum: - CILIUM - CALICO type: string version: description: the version of the CNI installed. type: string type: object status: properties: observedGeneration: description: |- The observed generation of the DiscoveredCNI. When this matches the DiscoveredCNI metadata.generation, it indicates that Gloo Mesh has processed the latest version of the DiscoveredCNI. format: int64 type: integer type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: a2ff3def5233e56a crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: discoveredgateways.internal.gloo.solo.io spec: group: internal.gloo.solo.io names: categories: - solo-io kind: DiscoveredGateway listKind: DiscoveredGatewayList plural: discoveredgateways shortNames: - dg singular: discoveredgateway scope: Namespaced versions: - name: v2 schema: openAPIV3Schema: properties: spec: description: |- A DiscoveredGateway is an internal representation of an Istio Gateway workload. DiscoveredGateways are automatically detected from Istio Gateway deployments and services. properties: externalAddresses: description: The externally-reachable addresses on which the gateway is listening for connections. items: properties: address: description: |- The externally-reachable address on which the gateway is listening for connections. Depending on the gateway service type and its properties, this can be a LoadBalancer address reported by Kubernetes, an externally-reachable Node address, and a user-defined external IP set on the service. type: string locality: description: The locality in which the node serving this address resides, typically representing a large geographic area. properties: region: description: |- Represents a large geographic area, such as us-east1. A region typically contains a number of availability zones. A workload's region is determined by the value of the "topology.kubernetes.io/region" label (or the deprecated "failure-domain.beta.kubernetes.io/region" one) of the Node that is running it. type: string subZone: description: |- A zone can be divided into sub-zones to have even more fine-grained control over load balancing behavior. The sub-zone concept doesn't exist in Kubernetes. This value is derived by the Istio-specific "topology.istio.io/subzone" Node label. type: string zone: description: |- Represents an availability zone within a region, e.g. us-east-1a. A workload's zone is determined by the value of the "topology.kubernetes.io/zone" label (or the deprecated "failure-domain.beta.kubernetes.io/zone" one) of the Node that is running it. type: string type: object ports: description: The externally-reachable ports on which the gateway is listening for connections. items: description: Port describes a port accessible on a DiscoveredGateway. properties: name: description: |- A label for the port, eg "http". This will match the port name from the underlying gateway k8s Service. type: string number: description: The port number exposed on the underlying gateway k8s Service. maximum: 4294967295 minimum: 0 type: integer protocol: description: |- The protocol used in communication with this destination MUST be one of the following: HTTP, HTTPS, GRPC, HTTP2, MONGO, TCP, TLS. type: string type: object type: array type: object type: array service: description: Reference to the Kubernetes service that exposes the gateway workloads. properties: clusterName: description: name of the cluster in which the resource exists type: string name: description: name of the resource being referenced type: string namespace: description: namespace of the resource being referenced type: string type: object serviceAccountRefs: description: References to any service accounts selected by the service that exposes the gateway workloads. items: description: Resource reference for a cross-cluster-scoped object properties: clusterName: description: name of the cluster in which the resource exists type: string name: description: name of the resource being referenced type: string namespace: description: namespace of the resource being referenced type: string type: object type: array serviceType: description: gateway resource type enum: - CLUSTER_IP - NODE_PORT - LOAD_BALANCER - EXTERNAL_NAME type: string workloadLabels: additionalProperties: type: string description: The labels used by the Kubernetes service to select the gateway workloads. type: object type: object status: properties: common: description: The state and workspace conditions of the applied resource. properties: State: properties: approval: description: |- Whether the resource has been accepted as valid and processed in the Gloo Mesh config translation. enum: - PENDING - ACCEPTED - INVALID - WARNING - FAILED - UNLICENSED type: string message: description: Additional information about the current state of the resource. type: string observedGeneration: description: |- The most recent generation observed in the object's metadata. If the `observedGeneration` does not match `metadata.generation`, Gloo Mesh has not processed the most recent version of this object. format: int64 type: integer type: object workspaceConditions: additionalProperties: maximum: 4294967295 minimum: 0 type: integer description: |- A map of ApprovalState to the number of workspaces in this condition, e.g., "Accepted" -> 2 "Pending" -> 1 type: object type: object numVirtualGateways: description: A count of virtual gateways that select this discovered gateway. maximum: 4294967295 minimum: 0 type: integer type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: 77faaa3eb22310fe crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: issuedcertificates.internal.gloo.solo.io spec: group: internal.gloo.solo.io names: categories: - solo-io kind: IssuedCertificate listKind: IssuedCertificateList plural: issuedcertificates shortNames: - ic singular: issuedcertificate scope: Namespaced versions: - name: v2 schema: openAPIV3Schema: properties: spec: description: |- IssuedCertificates are used to issue SSL certificates to workload Kubernetes clusters from a central (out-of-cluster) Certificate Authority. When an IssuedCertificate is created, a certificate is issued to a workload cluster by a central Certificate Authority via the following workflow: 1. The Certificate Issuer creates the IssuedCertificate resource on the remote cluster 2. The Certificate Signature Requesting agent installed to the remote cluster generates a Certificate Signing Request (CSR) and writes it to the status of the IssuedCertificate 3. Finally, the Certificate Issuer generates a signed certificate for the CSR and writes it back as Kubernetes Secret in the remote cluster. Trust can therefore be established across the Gloo Mesh server cluster and agents on workload clusters without requiring private keys to ever leave workload clusters. The certificate requested here is for Gloo Mesh agents on workload clusters to securely establish communication with Gloo Mesh server. This is not related to certificates for services running in the mesh. oneOf: - not: anyOf: - required: - mgmtServerCa - required: - agentCa - required: - mgmtServerCa - required: - agentCa properties: agentCa: description: Agent CA options oneOf: - not: anyOf: - required: - vault - required: - vault properties: vault: allOf: - oneOf: - not: anyOf: - required: - caBundle - required: - caSecretRef - required: - caLocalPath - required: - caBundle - required: - caSecretRef - required: - caLocalPath - oneOf: - not: anyOf: - required: - tokenSecretRef - required: - kubernetesAuth - required: - tokenSecretRef - required: - kubernetesAuth description: Use vault as the intermediate CA source properties: caBundle: description: Inline CA bytes format: byte type: string caLocalPath: description: Path to a local file containing the CA bytes type: string caPath: description: |- `ca_path` is the mount path of the Vault PKI backend's `sign` endpoint, e.g: "my_pki_mount/sign/my-role-name". type: string caSecretRef: description: |- Reference to a secret containing the CA bytes. The CA should be stored by the key `root-cert.pem` properties: name: description: name of the resource being referenced type: string namespace: description: namespace of the resource being referenced type: string type: object csrPath: description: |- `csr_path` is the mount path of the Vault PKI backend's `generate` endpoint, e.g: "my_pki_mount/intermediate/generate/exported". "exported" is necessary here as istio needs access to the private key See vault docs here: https://developer.hashicorp.com/vault/api-docs/secret/pki#parameters-4 type: string kubernetesAuth: description: |- Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server. oneOf: - not: anyOf: - required: - serviceAccountRef - required: - mountedSaPath - required: - serviceAccountRef - required: - mountedSaPath properties: mountPath: description: |- The Vault mountPath here is the mount path to use when authenticating with Vault. For example, setting a value to `/v1/auth/foo`, will use the path `/v1/auth/foo/login` to authenticate with Vault. If unspecified, the default value "/v1/auth/kubernetes" will be used. type: string mountedSaPath: description: |- File System path to grab the service account token from. Defaults to /var/run/secrets/kubernetes.io/serviceaccount type: string role: description: |- A required field containing the Vault Role to assume. A Role binds a Kubernetes ServiceAccount with a set of Vault policies. type: string secretTokenKey: description: |- Key to search for the sa_token Default to "token" type: string serviceAccountRef: description: Reference to service account, other than the one mounted to the current pod. properties: name: description: name of the resource being referenced type: string namespace: description: namespace of the resource being referenced type: string type: object type: object namespace: description: |- Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: "ns1" More about namespaces can be found [here](https://www.vaultproject.io/docs/enterprise/namespaces) type: string server: description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".' type: string tokenSecretRef: description: TokenSecretRef authenticates with Vault by presenting a token. properties: name: description: name of the resource being referenced type: string namespace: description: namespace of the resource being referenced type: string type: object type: object type: object autoRestartPods: description: |- Signals whether or not the workload pods should be restarted to pick up the new cert. type: boolean certOptions: description: Set of options to configure the intermediate certificate being generated properties: orgName: description: The organization name of the certificate. Defaults to "gloo-mesh". type: string rsaKeySizeBytes: description: Size in bytes of the certificate's private key. Defaults to 4096. maximum: 4294967295 minimum: 0 type: integer secretRotationGracePeriodRatio: description: |- The ratio of the certificate lifetime to when Gloo starts the certificate rotation process. The ratio must be between 0 and 1 (exclusive). For example, if a certificate is valid for 1 day (or 24 hours), and you specify a ratio of 0.1, Gloo starts the certificate rotation process 2.4 hours before it expires (24x0.1). type: number ttlDays: description: Number of days before the certificate expires. Defaults to 365. maximum: 4294967295 minimum: 0 type: integer type: object hosts: description: |- A list of hostnames and IPs to generate a certificate for. This can also be set to the identity running the workload, e.g. a Kubernetes service account. Generally for an Istio CA this will take the form `spiffe://cluster.local/ns/istio-system/sa/citadel`. "cluster.local" may be replaced by the root of trust domain for the mesh. items: type: string type: array issuedCertificateSecret: description: |- The secret containing the SSL certificate to be generated for this IssuedCertificate (located in the Gloo Mesh agent's cluster). If nil, the sidecar agent stores the signing certificate in memory. (Enterprise only) properties: name: description: name of the resource being referenced type: string namespace: description: namespace of the resource being referenced type: string type: object meshRef: description: Reference to the mesh on which this cert is being issued for. properties: name: description: name of the resource being referenced type: string namespace: description: namespace of the resource being referenced type: string type: object mgmtServerCa: description: Gloo Mesh CA options oneOf: - not: anyOf: - required: - signingCertificateSecret - required: - signingCertificateSecret properties: signingCertificateSecret: properties: name: description: name of the resource being referenced type: string namespace: description: namespace of the resource being referenced type: string type: object type: object passiveCertificateAuthorities: description: A list of certificate authorities that should also be trusted by workloads items: description: |- Set of options which represent the certificate authorities the management cluster can use to sign the intermediate certs. oneOf: - not: anyOf: - required: - signingCertificateSecret - required: - signingCertificateSecret properties: signingCertificateSecret: properties: name: description: name of the resource being referenced type: string namespace: description: namespace of the resource being referenced type: string type: object type: object type: array type: object status: description: The IssuedCertificate status is written by the CertificateRequesting agent. properties: error: description: |- Any error observed which prevented the CertificateRequest from being processed. If the error is empty, the request has been processed successfully. type: string observedGeneration: description: |- The most recent generation observed in the IssuedCertificate metadata. If the `observedGeneration` does not match `metadata.generation`, the Gloo Mesh agent has not processed the most recent version of this IssuedCertificate. format: int64 type: integer state: description: The current state of the IssuedCertificate workflow, reported by the agent. enum: - PENDING - REQUESTED - ISSUED - FINISHED - FAILED type: string type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: 5c64db01a7774d6c crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: meshes.internal.gloo.solo.io spec: group: internal.gloo.solo.io names: categories: - solo-io kind: Mesh listKind: MeshList plural: meshes singular: mesh scope: Namespaced versions: - name: v2 schema: openAPIV3Schema: properties: spec: description: A Mesh is an internal representation of a service mesh control plane deployment. properties: agentInfo: description: Describes the Gloo Mesh agent if it has been installed to the managed cluster. properties: namespace: description: The namespace in which the Gloo Mesh agent is installed. type: string relayRootTlsSecret: description: The location of the relay root tls secret properties: name: description: name of the resource being referenced type: string namespace: description: namespace of the resource being referenced type: string type: object version: description: The version of the Gloo Mesh agent. type: string type: object ambientCapable: description: If true, the mesh is capable of ambient dataplane mode. type: boolean discoveryNamespaces: description: |- The list of namespaces that are part of the mesh, which is computed based on the [discovery selectors](https://istio.io/latest/blog/2021/discovery-selectors/) defined in the Istio Mesh Config. And empty value implies that the Istio control place processes resources from all namespaces. items: type: string type: array hub: description: istiod image hub type: string installation: description: Describes the Istio control plane deployment. properties: cluster: description: The Gloo Mesh cluster in which the control plane has been installed. type: string namespace: description: Namespace in which the control plane has been installed. type: string podLabels: additionalProperties: type: string description: The labels on the control plane pods (read from the deployment). type: object revision: description: The revision of the Istio control plane that has been installed. type: string version: description: |- The version of the Mesh that has been installed, which is determined using the image tag on the mesh's primary control plane image (e.g. the istio-pilot image tag). type: string type: object ipFamily: description: 'Optional: The IPFamily supported by the cluster. Defaults to ''IPV4''.' enum: - IPV4 - IPV6 - DUAL type: string istiodServiceAccount: description: The istiod service account which determines identity for the Istio CA cert. type: string rootNamespace: description: |- Root Namespace as specified in the Istio Mesh Config. This namespace will be treated as the home for all root Istio config. type: string smartDnsProxyingEnabled: description: True if smart DNS proxying is enabled, which allows for arbitrary DNS domains. type: boolean spire: description: If set, SPIRE is installed. maxProperties: 0 type: object tag: description: istiod image tag type: string trustDomain: description: |- The Istio trust domain used for https/[spiffe](https://spiffe.io/spiffe/concepts/#trust-domain) [identity](https://istio.io/docs/reference/glossary/#identity). If empty will default to ["cluster.local"](https://github.com/istio/istio/blob/e768f408a7de224e64ccdfb2634442541ce08e6a/pilot/cmd/pilot-agent/main.go#L118). type: string type: object status: properties: observedGeneration: description: |- The observed generation of the Mesh. When this matches the Mesh's metadata.generation, it indicates that Gloo Mesh has processed the latest version of the Mesh. format: int64 type: integer type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: dd3e13e97320cd10 crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: podbouncedirectives.internal.gloo.solo.io spec: group: internal.gloo.solo.io names: categories: - solo-io kind: PodBounceDirective listKind: PodBounceDirectiveList plural: podbouncedirectives shortNames: - pbd singular: podbouncedirective scope: Namespaced versions: - name: v2 schema: openAPIV3Schema: properties: spec: description: |- When certificates are issued, Istio-controlled pods need to be bounced (restarted) to ensure they pick up the new certificates due to [this issue](https://github.com/istio/istio/issues/22993). The certificate issuer will create a PodBounceDirective containing the namespaces and labels of the pods that need to be bounced in order to pick up the new certs. properties: meshRef: description: Reference to the mesh on which this cert is being issued for properties: name: description: name of the resource being referenced type: string namespace: description: namespace of the resource being referenced type: string type: object podsToBounce: description: |- A list of Kubernetes pods to bounce (delete and cause a restart) when the certificate is issued. This will include the control plane pods as well as any Pods which share a data plane with the target mesh. items: description: pods that will be restarted. properties: labels: additionalProperties: type: string description: Any labels shared by the Pods. type: object namespace: description: The namespace in which the pods live. type: string rootCertSync: description: |- Wait for the control plane to have synced all root cert configmaps in data plane namespaces before bouncing these Pods. properties: configMapKey: type: string configMapRef: properties: name: description: name of the resource being referenced type: string namespace: description: namespace of the resource being referenced type: string type: object secretKey: type: string secretRef: properties: name: description: name of the resource being referenced type: string namespace: description: namespace of the resource being referenced type: string type: object type: object waitForReplicas: description: |- Wait for this number of replacement pods to reach be fully ready before deleting the next set of selected Pods. This is used to ensure the control plane pods are allowed to restart before sidecars and gateways are restarted. maximum: 4294967295 minimum: 0 type: integer type: object type: array type: object status: description: PodBounceDirectiveStatus reports the status for stateful Pod bounces (when bouncing pods requires waiting for readiness). properties: error: type: string observedGeneration: description: |- The most recent generation observed in the PodBounceDirective metadata. If the `observedGeneration` does not match `metadata.generation`, the Gloo Mesh agent has not processed the most recent version of this IssuedCertificate. format: int64 type: integer podsBounced: description: |- A list of Kubernetes pods to bounce (delete and cause a restart) when the certificate is issued. This will include the control plane pods as well as any Pods which share a data plane with the target mesh. items: description: A set of pods that were restarted. properties: bouncedPods: description: The names of the pods that were bounced for the corresponding selector specified in `PodBounceDirectiveSpec.PodSelector.labels`. items: type: string type: array type: object type: array state: description: The current state of the IssuedCertificate workflow, reported by the agent. enum: - PENDING - BOUNCING_PODS - FAILED - FINISHED type: string type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: b04251b2e1b80b8d crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: portalconfigs.internal.gloo.solo.io spec: group: internal.gloo.solo.io names: categories: - solo-io kind: PortalConfig listKind: PortalConfigList plural: portalconfigs shortNames: - pcfg singular: portalconfig scope: Namespaced versions: - name: v2 schema: openAPIV3Schema: properties: spec: description: |- PortalConfig is a internal representation of the user facing Portal resource. It is used to provide configuration information for a single Portal backend. The PortalConfig contains a list of all API resources that are exposed by the Portal, the associated usage plans for each API, and all usage plans available across the Portal. properties: apis: description: The list of API resources that are exposed by the Portal. items: description: |- TODO(jmhbh): Update this doc when we decide to support operation level usage plans. An API that is exposed by the Portal. API metadata is sourced from the referenced RouteTable and api_schema is a reference to the stitched API schema for the RouteTable. Also references a list of usage plan names that are associated with the API. properties: apiId: description: The ID for this API. type: string apiProductDisplayName: description: The api product display name type: string apiProductId: description: |- When set, the [/apis](https://docs.solo.io/gloo-mesh-gateway/latest/portal/redocly.html#tag/APIs/operation/ListAPIs) endpoint in the portal will return `apiProduct` in the response which can be used to group multiple APIs together. type: string apiSchema: properties: cluster: description: the cluster of the object. If omitted, Gloo Mesh will use the same cluster as the parent object containing this reference. type: string name: description: the name of the object type: string namespace: description: the namespace of the object. If omitted, Gloo Mesh will use the same namespace as the parent object containing this reference. type: string type: object apiVersion: description: |- The version of the openAPI specification for this route table. Must be unique within the apiProduct. `apiProduct` is required if `apiVersion` is set. type: string contact: type: string customMetadata: additionalProperties: type: string type: object description: type: string isPrivate: description: |- The API is private if its associated route table contains labels matching the privateAPILabels specified in the portal resource type: boolean license: type: string lifecycle: type: string routeTable: properties: cluster: description: the cluster of the object. If omitted, Gloo Mesh will use the same cluster as the parent object containing this reference. type: string name: description: the name of the object type: string namespace: description: the namespace of the object. If omitted, Gloo Mesh will use the same namespace as the parent object containing this reference. type: string type: object termsOfService: type: string title: type: string usagePlans: items: description: Reference to a usage plan by name. properties: name: type: string type: object type: array type: object type: array domains: description: |- The domains on which this Portal will be served. The Host header received by the Portal Web App will be matched to one of these domains in order to determine which Portal will be served. items: type: string type: array groups: description: The list of groups that are available across the Portal. items: description: |- A Portal group represents a set of group names, which has visibility into a set of APIs and the ability to manage API keys selected usage plans. properties: apis: description: The apis that are visible to this group items: description: |- reference to a Kubernetes API object. Kube API objects are referenced explicitly by the namespace and cluster containing them. properties: cluster: description: the cluster of the object. If omitted, Gloo Mesh will use the same cluster as the parent object containing this reference. type: string name: description: the name of the object type: string namespace: description: the namespace of the object. If omitted, Gloo Mesh will use the same namespace as the parent object containing this reference. type: string type: object type: array membershipClaims: description: The list of membership claims that are used to determine whether a user is a member of this group items: description: |- `Membership` contains a list of claims that is used to determine whether a user belongs to this group. A user is considered to be a member of this group if their idToken has all the claims in this list. For example, a user is considered to be a member of this group if they have defined the following list of membership criteria in their `PortalGroup`: ```yaml ... membership: - claims: - key: type value: customers - key: region value: us-east-1 - claims: - key: type value: customers - key: region value: us-west-1 ``` and the user has the following claims in their idToken: ```json { "type": "customers", "region": "us-east-1" } or { "type": "customers", "region": "us-west-1" } ``` claims within a `Membership` criteria is an AND operation, and the list of `Membership` criteria is an OR operation. properties: claims: description: |- A list of claims that is used to determine whether a user belongs to this group. A user is considered to be a member of this group if their idToken has claims that match all the claims in this list. items: description: A claim that can be used to define a group of users. properties: key: description: The key of the claim. For example, `customers` or `region`. This is the key that we will use to match against the claims in the idToken. type: string value: description: The value of the claim. type: string type: object type: array type: object type: array name: description: The name of the group this is derived from the `PortalGroup` resource type: string usagePlans: description: The names of the usage plans that are visible to this group items: type: string type: array type: object type: array portalCustomMetadata: description: |- Portal level metadata configured by the user in the user facing Portal resource as a JSON value. For information about the value format, see the [Google protocol buffer documentation](https://protobuf.dev/reference/protobuf/google.protobuf/#value). x-kubernetes-preserve-unknown-fields: true portalRef: description: Reference to the Portal resource that this PortalConfig resource is derived from. properties: cluster: description: the cluster of the object. If omitted, Gloo Mesh will use the same cluster as the parent object containing this reference. type: string name: description: the name of the object type: string namespace: description: the namespace of the object. If omitted, Gloo Mesh will use the same namespace as the parent object containing this reference. type: string type: object public: description: |- Indicates whether the Portal is public or private, this is based on the visibility setting specified in the `Portal` resource type: boolean usagePlans: description: The list of usage plans that are available across the Portal. items: description: A usage plan contains a list of auth policies and one rate limit policy. properties: description: type: string displayName: type: string extAuthPolicies: items: description: |- An ext auth policy identified by its authentication type and contains a list of unique label selectors that are used to identify the set of clients that are authorized to use the auth policy. oneOf: - not: anyOf: - required: - apiKeyAuth - required: - oidcAuth - required: - accessTokenValidation - required: - apiKeyAuth - required: - oidcAuth - required: - accessTokenValidation properties: accessTokenValidation: properties: bearerFormat: type: string type: object apiKeyAuth: properties: extAuthLabelSelector: additionalProperties: type: string type: object type: object authConfigId: type: string extAuthPolicyRef: properties: cluster: description: the cluster of the object. If omitted, Gloo Mesh will use the same cluster as the parent object containing this reference. type: string name: description: the name of the object type: string namespace: description: the namespace of the object. If omitted, Gloo Mesh will use the same namespace as the parent object containing this reference. type: string type: object oidcAuth: properties: wellKnownOpenidConfig: type: string type: object type: object type: array name: type: string rateLimitPolicy: properties: rateLimitPolicyRef: properties: cluster: description: the cluster of the object. If omitted, Gloo Mesh will use the same cluster as the parent object containing this reference. type: string name: description: the name of the object type: string namespace: description: the namespace of the object. If omitted, Gloo Mesh will use the same namespace as the parent object containing this reference. type: string type: object requestsPerUnit: maximum: 4294967295 minimum: 0 type: integer unit: enum: - UNKNOWN - SECOND - MINUTE - HOUR - DAY type: string type: object type: object type: array type: object status: description: The status of the resource after it is applied to your Gloo environment. properties: common: description: The state and workspace conditions of the applied resource. properties: State: properties: approval: description: |- Whether the resource has been accepted as valid and processed in the Gloo Mesh config translation. enum: - PENDING - ACCEPTED - INVALID - WARNING - FAILED - UNLICENSED type: string message: description: Additional information about the current state of the resource. type: string observedGeneration: description: |- The most recent generation observed in the object's metadata. If the `observedGeneration` does not match `metadata.generation`, Gloo Mesh has not processed the most recent version of this object. format: int64 type: integer type: object workspaceConditions: additionalProperties: maximum: 4294967295 minimum: 0 type: integer description: |- A map of ApprovalState to the number of workspaces in this condition, e.g., "Accepted" -> 2 "Pending" -> 1 type: object type: object ownedByWorkspace: description: The name of the workspace that owns the PortalConfig schema. type: string type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: 3690913af546e6f5 crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: spireregistrationentries.internal.gloo.solo.io spec: group: internal.gloo.solo.io names: categories: - solo-io kind: SpireRegistrationEntry listKind: SpireRegistrationEntryList plural: spireregistrationentries shortNames: - sreg singular: spireregistrationentry scope: Namespaced versions: - name: v2alpha1 schema: openAPIV3Schema: properties: spec: description: |- SpireRegistrationEntrySpec describes a registration entry in SPIRE server. It is a subset of the upstream RegistrationEntry API: https://github.com/spiffe/spire/blob/v1.6.3/proto/spire/common/common.proto#L62 properties: dnsNames: description: DNS entries. items: type: string type: array parentId: description: The SPIFFE ID of an entity that is authorized to attest the validity of a selector. type: string selectors: description: A list of selectors. items: description: Selector describes the conditions under which a registration entry is matched. properties: type: description: A selector type represents the type of attestation used in attesting the entity. type: string value: description: The value to be attested. type: string type: object type: array spiffeId: description: |- The SPIFFE ID is a structured string used to identify a resource or caller. It is defined as a URI comprising a “trust domain” and an associated path. type: string x509SvidTtl: description: Time to live for X509-SVIDs generated from this entry. maximum: 4294967295 minimum: 0 nullable: true type: integer type: object status: description: The status of the SpireRegistrationEntry after it is applied to your Gloo environment. properties: common: properties: State: properties: approval: description: |- Whether the resource has been accepted as valid and processed in the Gloo Mesh config translation. enum: - PENDING - ACCEPTED - INVALID - WARNING - FAILED - UNLICENSED type: string message: description: Additional information about the current state of the resource. type: string observedGeneration: description: |- The most recent generation observed in the object's metadata. If the `observedGeneration` does not match `metadata.generation`, Gloo Mesh has not processed the most recent version of this object. format: int64 type: integer type: object workspaceConditions: additionalProperties: maximum: 4294967295 minimum: 0 type: integer description: |- A map of ApprovalState to the number of workspaces in this condition, e.g., "Accepted" -> 2 "Pending" -> 1 type: object type: object type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: 44c39d2b7155998d crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: virtualservicebackups.internal.gloo.solo.io spec: group: internal.gloo.solo.io names: categories: - solo-io kind: VirtualServiceBackup listKind: VirtualServiceBackupList plural: virtualservicebackups singular: virtualservicebackup scope: Namespaced versions: - name: v2alpha1 schema: openAPIV3Schema: properties: spec: properties: spec: description: The VirtualService spec that is being backed up properties: exportTo: description: |- A list of namespaces to which this virtual service is exported. Exporting a virtual service allows it to be used by sidecars and gateways defined in other namespaces. This feature provides a mechanism for service owners and mesh administrators to control the visibility of virtual services across namespace boundaries. If no namespaces are specified then the virtual service is exported to all namespaces by default. The value "." is reserved and defines an export to the same namespace that the virtual service is declared in. Similarly the value "*" is reserved and defines an export to all namespaces. items: type: string type: array gateways: description: |- The names of gateways and sidecars that should apply these routes. Gateways in other namespaces may be referred to by `/`; specifying a gateway with no namespace qualifier is the same as specifying the VirtualService's namespace. A single VirtualService is used for sidecars inside the mesh as well as for one or more gateways. The selection condition imposed by this field can be overridden using the source field in the match conditions of protocol-specific routes. The reserved word `mesh` is used to imply all the sidecars in the mesh. When this field is omitted, the default gateway (`mesh`) will be used, which would apply the rule to all sidecars in the mesh. If a list of gateway names is provided, the rules will apply only to the gateways. To apply the rules to both gateways and sidecars, specify `mesh` as one of the gateway names. items: type: string type: array hosts: description: |- The destination hosts to which traffic is being sent. Could be a DNS name with wildcard prefix or an IP address. Depending on the platform, short-names can also be used instead of a FQDN (i.e. has no dots in the name). In such a scenario, the FQDN of the host would be derived based on the underlying platform. A single VirtualService can be used to describe all the traffic properties of the corresponding hosts, including those for multiple HTTP and TCP ports. Alternatively, the traffic properties of a host can be defined using more than one VirtualService, with certain caveats. Refer to the [Operations Guide](https://istio.io/docs/ops/best-practices/traffic-management/#split-virtual-services) for details. *Note for Kubernetes users*: When short names are used (e.g. "reviews" instead of "reviews.default.svc.cluster.local"), Istio will interpret the short name based on the namespace of the rule, not the service. A rule in the "default" namespace containing a host "reviews" will be interpreted as "reviews.default.svc.cluster.local", irrespective of the actual namespace associated with the reviews service. _To avoid potential misconfigurations, it is recommended to always use fully qualified domain names over short names._ The hosts field applies to both HTTP and TCP services. Service inside the mesh, i.e., those found in the service registry, must always be referred to using their alphanumeric names. IP addresses are allowed only for services defined via the Gateway. *Note*: It must be empty for a delegate VirtualService. items: type: string type: array http: description: |- An ordered list of route rules for HTTP traffic. HTTP routes will be applied to platform service ports using HTTP/HTTP2/GRPC protocols, gateway ports with protocol HTTP/HTTP2/GRPC/TLS-terminated-HTTPS and service entry ports using HTTP/HTTP2/GRPC protocols. The first rule matching an incoming request is used. items: description: |- Describes match conditions and actions for routing HTTP/1.1, HTTP2, and gRPC traffic. See VirtualService for usage examples. properties: corsPolicy: description: |- Cross-Origin Resource Sharing policy (CORS). Refer to [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) for further details about cross origin resource sharing. properties: allowCredentials: description: |- Indicates whether the caller is allowed to send the actual request (not the preflight) using credentials. Translates to `Access-Control-Allow-Credentials` header. nullable: true type: boolean allowHeaders: description: |- List of HTTP headers that can be used when requesting the resource. Serialized to Access-Control-Allow-Headers header. items: type: string type: array allowMethods: description: |- List of HTTP methods allowed to access the resource. The content will be serialized into the Access-Control-Allow-Methods header. items: type: string type: array allowOrigin: description: |- The list of origins that are allowed to perform CORS requests. The content will be serialized into the Access-Control-Allow-Origin header. Wildcard * will allow all origins. items: type: string type: array allowOrigins: description: |- String patterns that match allowed origins. An origin is allowed if any of the string matchers match. If a match is found, then the outgoing Access-Control-Allow-Origin would be set to the origin as provided by the client. items: description: |- Describes how to match a given string in HTTP headers. `exact` and `prefix` matching is case-sensitive. `regex` matching supports case-insensitive matches. oneOf: - not: anyOf: - required: - exact - required: - prefix - required: - regex - required: - exact - required: - prefix - required: - regex properties: exact: description: exact string match type: string prefix: description: prefix-based match type: string regex: description: |- [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax). Example: `(?i)^aaa$` can be used to case-insensitive match a string consisting of three a's. type: string type: object type: array exposeHeaders: description: |- A list of HTTP headers that the browsers are allowed to access. Serialized into Access-Control-Expose-Headers header. items: type: string type: array maxAge: description: |- Specifies how long the results of a preflight request can be cached. Translates to the `Access-Control-Max-Age` header. type: string unmatchedPreflights: description: |- Indicates whether preflight requests not matching the configured allowed origin shouldn't be forwarded to the upstream. Default is forward to upstream. enum: - UNSPECIFIED - FORWARD - IGNORE type: string type: object delegate: description: |- Delegate is used to specify the particular VirtualService which can be used to define delegate HTTPRoute. It can be set only when `Route` and `Redirect` are empty, and the route rules of the delegate VirtualService will be merged with that in the current one. **NOTE**: 1. Only one level delegation is supported. 2. The delegate's HTTPMatchRequest must be a strict subset of the root's, otherwise there is a conflict and the HTTPRoute will not take effect. properties: name: description: Name specifies the name of the delegate VirtualService. type: string namespace: description: |- Namespace specifies the namespace where the delegate VirtualService resides. By default, it is same to the root's. type: string type: object directResponse: description: |- A HTTP rule can either return a direct_response, redirect or forward (default) traffic. Direct Response is used to specify a fixed response that should be sent to clients. It can be set only when `Route` and `Redirect` are empty. properties: body: description: |- Specifies the content of the response body. If this setting is omitted, no body is included in the generated response. oneOf: - not: anyOf: - required: - string - required: - bytes - required: - string - required: - bytes properties: bytes: description: response body as base64 encoded bytes. format: byte type: string string: description: response body as a string type: string type: object status: description: Specifies the HTTP response status to be returned. maximum: 4294967295 minimum: 0 type: integer type: object fault: description: |- Fault injection policy to apply on HTTP traffic at the client side. Note that timeouts or retries will not be enabled when faults are enabled on the client side. properties: abort: description: |- Abort Http request attempts and return error codes back to downstream service, giving the impression that the upstream service is faulty. oneOf: - not: anyOf: - required: - httpStatus - required: - grpcStatus - required: - http2Error - required: - httpStatus - required: - grpcStatus - required: - http2Error properties: grpcStatus: description: |- GRPC status code to use to abort the request. The supported codes are documented in https://github.com/grpc/grpc/blob/master/doc/statuscodes.md Note: If you want to return the status "Unavailable", then you should specify the code as `UNAVAILABLE`(all caps), but not `14`. type: string http2Error: type: string httpStatus: description: HTTP status code to use to abort the Http request. format: int32 type: integer percentage: description: |- Percentage of requests to be aborted with the error code provided. If not specified, no request will be aborted. properties: value: type: number type: object type: object delay: description: |- Delay requests before forwarding, emulating various failures such as network issues, overloaded upstream service, etc. oneOf: - not: anyOf: - required: - fixedDelay - required: - exponentialDelay - required: - fixedDelay - required: - exponentialDelay properties: exponentialDelay: type: string fixedDelay: description: |- Add a fixed delay before forwarding the request. Format: 1h/1m/1s/1ms. MUST be >=1ms. type: string percent: description: |- Percentage of requests on which the delay will be injected (0-100). Use of integer `percent` value is deprecated. Use the double `percentage` field instead. format: int32 type: integer percentage: description: |- Percentage of requests on which the delay will be injected. If left unspecified, no request will be delayed. properties: value: type: number type: object type: object type: object headers: description: Header manipulation rules properties: request: description: |- Header manipulation rules to apply before forwarding a request to the destination service properties: add: additionalProperties: type: string description: |- Append the given values to the headers specified by keys (will create a comma-separated list of values) type: object remove: description: Remove the specified headers items: type: string type: array set: additionalProperties: type: string description: Overwrite the headers specified by key with the given values type: object type: object response: description: |- Header manipulation rules to apply before returning a response to the caller properties: add: additionalProperties: type: string description: |- Append the given values to the headers specified by keys (will create a comma-separated list of values) type: object remove: description: Remove the specified headers items: type: string type: array set: additionalProperties: type: string description: Overwrite the headers specified by key with the given values type: object type: object type: object match: description: |- Match conditions to be satisfied for the rule to be activated. All conditions inside a single match block have AND semantics, while the list of match blocks have OR semantics. The rule is matched if any one of the match blocks succeed. items: description: |- HttpMatchRequest specifies a set of criteria to be met in order for the rule to be applied to the HTTP request. For example, the following restricts the rule to match only requests where the URL path starts with /ratings/v2/ and the request contains a custom `end-user` header with value `jason`. ```yaml apiVersion: networking.istio.io/v1 kind: VirtualService metadata: name: ratings-route spec: hosts: - ratings.prod.svc.cluster.local http: - match: - headers: end-user: exact: jason uri: prefix: "/ratings/v2/" ignoreUriCase: true route: - destination: host: ratings.prod.svc.cluster.local ``` HTTPMatchRequest CANNOT be empty. **Note:** 1. If a root VirtualService have matched any property (path, header etc.) by regex, delegate VirtualServices should not have any other matches on the same property. 2. If a delegate VirtualService have matched any property (path, header etc.) by regex, root VirtualServices should not have any other matches on the same property. properties: authority: description: |- HTTP Authority values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax). oneOf: - not: anyOf: - required: - exact - required: - prefix - required: - regex - required: - exact - required: - prefix - required: - regex properties: exact: description: exact string match type: string prefix: description: prefix-based match type: string regex: description: |- [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax). Example: `(?i)^aaa$` can be used to case-insensitive match a string consisting of three a's. type: string type: object gateways: description: |- Names of gateways where the rule should be applied. Gateway names in the top-level `gateways` field of the VirtualService (if any) are overridden. The gateway match is independent of sourceLabels. items: type: string type: array headers: additionalProperties: oneOf: - not: anyOf: - required: - exact - required: - prefix - required: - regex - required: - exact - required: - prefix - required: - regex properties: exact: description: exact string match type: string prefix: description: prefix-based match type: string regex: description: |- [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax). Example: `(?i)^aaa$` can be used to case-insensitive match a string consisting of three a's. type: string type: object description: |- The header keys must be lowercase and use hyphen as the separator, e.g. _x-request-id_. Header values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax). If the value is empty and only the name of header is specified, presence of the header is checked. To provide an empty value, use `{}`, for example: ``` - match: - headers: myheader: {} ``` **Note:** The keys `uri`, `scheme`, `method`, and `authority` will be ignored. type: object ignoreUriCase: description: |- Flag to specify whether the URI matching should be case-insensitive. **Note:** The case will be ignored only in the case of `exact` and `prefix` URI matches. type: boolean method: description: |- HTTP Method values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax). oneOf: - not: anyOf: - required: - exact - required: - prefix - required: - regex - required: - exact - required: - prefix - required: - regex properties: exact: description: exact string match type: string prefix: description: prefix-based match type: string regex: description: |- [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax). Example: `(?i)^aaa$` can be used to case-insensitive match a string consisting of three a's. type: string type: object name: description: |- The name assigned to a match. The match's name will be concatenated with the parent route's name and will be logged in the access logs for requests matching this route. type: string port: description: |- Specifies the ports on the host that is being addressed. Many services only expose a single port or label ports with the protocols they support, in these cases it is not required to explicitly select the port. maximum: 4294967295 minimum: 0 type: integer queryParams: additionalProperties: oneOf: - not: anyOf: - required: - exact - required: - prefix - required: - regex - required: - exact - required: - prefix - required: - regex properties: exact: description: exact string match type: string prefix: description: prefix-based match type: string regex: description: |- [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax). Example: `(?i)^aaa$` can be used to case-insensitive match a string consisting of three a's. type: string type: object description: |- Query parameters for matching. Ex: - For a query parameter like "?key=true", the map key would be "key" and the string match could be defined as `exact: "true"`. - For a query parameter like "?key", the map key would be "key" and the string match could be defined as `exact: ""`. - For a query parameter like "?key=abc" or "?key=abx", the map key would be "key" and the string match could be defined as `prefix: "ab"`. - For a query parameter like "?key=123", the map key would be "key" and the string match could be defined as `regex: "\d+$"`. Note that this configuration will only match values like "123" but not "a123" or "123a". type: object scheme: description: |- URI Scheme values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax). oneOf: - not: anyOf: - required: - exact - required: - prefix - required: - regex - required: - exact - required: - prefix - required: - regex properties: exact: description: exact string match type: string prefix: description: prefix-based match type: string regex: description: |- [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax). Example: `(?i)^aaa$` can be used to case-insensitive match a string consisting of three a's. type: string type: object sourceLabels: additionalProperties: type: string description: |- One or more labels that constrain the applicability of a rule to source (client) workloads with the given labels. If the VirtualService has a list of gateways specified in the top-level `gateways` field, it must include the reserved gateway `mesh` for this field to be applicable. **Note:** This is not a runtime match, but is a selector; it filters which workloads the VirtualService applies to. type: object sourceNamespace: description: |- Source namespace constraining the applicability of a rule to workloads in that namespace. If the VirtualService has a list of gateways specified in the top-level `gateways` field, it must include the reserved gateway `mesh` for this field to be applicable. **Note:** This is not a runtime match, but is a selector; it filters which workloads the VirtualService applies to. type: string statPrefix: description: |- The human readable prefix to use when emitting statistics for this route. The statistics are generated with prefix route.. This should be set for highly critical routes that one wishes to get "per-route" statistics on. This prefix is only for proxy-level statistics (envoy_*) and not service-level (istio_*) statistics. Refer to https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v3-api-field-config-route-v3-route-stat-prefix for statistics that are generated when this is configured. type: string uri: description: |- URI to match values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax). **Note:** Case-insensitive matching could be enabled via the `ignoreUriCase` flag. oneOf: - not: anyOf: - required: - exact - required: - prefix - required: - regex - required: - exact - required: - prefix - required: - regex properties: exact: description: exact string match type: string prefix: description: prefix-based match type: string regex: description: |- [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax). Example: `(?i)^aaa$` can be used to case-insensitive match a string consisting of three a's. type: string type: object withoutHeaders: additionalProperties: oneOf: - not: anyOf: - required: - exact - required: - prefix - required: - regex - required: - exact - required: - prefix - required: - regex properties: exact: description: exact string match type: string prefix: description: prefix-based match type: string regex: description: |- [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax). Example: `(?i)^aaa$` can be used to case-insensitive match a string consisting of three a's. type: string type: object description: |- withoutHeader has the same syntax with the header, but has opposite meaning. If a header is matched with a matching rule among withoutHeader, the traffic becomes not matched one. type: object type: object type: array mirror: description: |- Mirror HTTP traffic to a another destination in addition to forwarding the requests to the intended destination. Mirrored traffic is on a best effort basis where the sidecar/gateway will not wait for the mirrored cluster to respond before returning the response from the original destination. Statistics will be generated for the mirrored destination. properties: host: description: |- The name of a service from the service registry. Service names are looked up from the platform's service registry (e.g., Kubernetes services, Consul services, etc.) and from the hosts declared by [ServiceEntry](https://istio.io/docs/reference/config/networking/service-entry/#ServiceEntry). Traffic forwarded to destinations that are not found in either of the two, will be dropped. *Note for Kubernetes users*: When short names are used (e.g. "reviews" instead of "reviews.default.svc.cluster.local"), Istio will interpret the short name based on the namespace of the rule, not the service. A rule in the "default" namespace containing a host "reviews" will be interpreted as "reviews.default.svc.cluster.local", irrespective of the actual namespace associated with the reviews service. To avoid potential misconfiguration, it is recommended to always use fully qualified domain names over short names. type: string port: description: |- Specifies the port on the host that is being addressed. If a service exposes only a single port it is not required to explicitly select the port. properties: number: description: Valid port number maximum: 4294967295 minimum: 0 type: integer type: object subset: description: |- The name of a subset within the service. Applicable only to services within the mesh. The subset must be defined in a corresponding DestinationRule. type: string type: object mirrorPercent: description: |- Percentage of the traffic to be mirrored by the `mirror` field. Use of integer `mirror_percent` value is deprecated. Use the double `mirror_percentage` field instead maximum: 4294967295 minimum: 0 nullable: true type: integer mirrorPercentage: description: |- Percentage of the traffic to be mirrored by the `mirror` field. If this field is absent, all the traffic (100%) will be mirrored. Max value is 100. properties: value: type: number type: object mirrors: description: |- Specifies the destinations to mirror HTTP traffic in addition to the original destination. Mirrored traffic is on a best effort basis where the sidecar/gateway will not wait for the mirrored destinations to respond before returning the response from the original destination. Statistics will be generated for the mirrored destination. items: description: |- HTTPMirrorPolicy can be used to specify the destinations to mirror HTTP traffic in addition to the original destination. Mirrored traffic is on a best effort basis where the sidecar/gateway will not wait for the mirrored destinations to respond before returning the response from the original destination. Statistics will be generated for the mirrored destination. properties: destination: description: Destination specifies the target of the mirror operation. properties: host: description: |- The name of a service from the service registry. Service names are looked up from the platform's service registry (e.g., Kubernetes services, Consul services, etc.) and from the hosts declared by [ServiceEntry](https://istio.io/docs/reference/config/networking/service-entry/#ServiceEntry). Traffic forwarded to destinations that are not found in either of the two, will be dropped. *Note for Kubernetes users*: When short names are used (e.g. "reviews" instead of "reviews.default.svc.cluster.local"), Istio will interpret the short name based on the namespace of the rule, not the service. A rule in the "default" namespace containing a host "reviews" will be interpreted as "reviews.default.svc.cluster.local", irrespective of the actual namespace associated with the reviews service. To avoid potential misconfiguration, it is recommended to always use fully qualified domain names over short names. type: string port: description: |- Specifies the port on the host that is being addressed. If a service exposes only a single port it is not required to explicitly select the port. properties: number: description: Valid port number maximum: 4294967295 minimum: 0 type: integer type: object subset: description: |- The name of a subset within the service. Applicable only to services within the mesh. The subset must be defined in a corresponding DestinationRule. type: string type: object percentage: description: |- Percentage of the traffic to be mirrored by the `destination` field. If this field is absent, all the traffic (100%) will be mirrored. Max value is 100. properties: value: type: number type: object type: object type: array name: description: |- The name assigned to the route for debugging purposes. The route's name will be concatenated with the match's name and will be logged in the access logs for requests matching this route/match. type: string redirect: description: |- A HTTP rule can either return a direct_response, redirect or forward (default) traffic. If traffic passthrough option is specified in the rule, route/redirect will be ignored. The redirect primitive can be used to send a HTTP 301 redirect to a different URI or Authority. oneOf: - not: anyOf: - required: - port - required: - derivePort - required: - port - required: - derivePort properties: authority: description: |- On a redirect, overwrite the Authority/Host portion of the URL with this value. type: string derivePort: description: |- On a redirect, dynamically set the port: * FROM_PROTOCOL_DEFAULT: automatically set to 80 for HTTP and 443 for HTTPS. * FROM_REQUEST_PORT: automatically use the port of the request. enum: - FROM_PROTOCOL_DEFAULT - FROM_REQUEST_PORT type: string port: description: On a redirect, overwrite the port portion of the URL with this value. maximum: 4294967295 minimum: 0 type: integer prefixRewrite: description: |- On a redirect, replace the matched prefix with this value. The route match must use a prefix match type. The matched prefix is stripped from the path and this value is prepended. Examples (route prefix match: /foo): - prefix_rewrite: /bar → /foo/baz becomes /bar/baz - prefix_rewrite: / → /foo/baz becomes //baz (use /foo/ match to get /baz) Mutually exclusive with uri. type: string redirectCode: description: |- On a redirect, Specifies the HTTP status code to use in the redirect response. The default response code is MOVED_PERMANENTLY (301). maximum: 4294967295 minimum: 0 type: integer scheme: description: |- On a redirect, overwrite the scheme portion of the URL with this value. For example, `http` or `https`. If unset, the original scheme will be used. If `derivePort` is set to `FROM_PROTOCOL_DEFAULT`, this will impact the port used as well type: string uri: description: |- On a redirect, overwrite the Path portion of the URL with this value. Note that the entire path will be replaced, irrespective of the request URI being matched as an exact path or prefix. Mutually exclusive with prefix_rewrite. type: string type: object retries: description: |- Retry policy for HTTP requests. Note: the default cluster-wide retry policy, if not specified, is: ```yaml attempts: 2 retryOn: "connect-failure,refused-stream,unavailable,cancelled" ``` This can be customized in [`Mesh Config` `defaultHttpRetryPolicy`](https://istio.io/latest/docs/reference/config/istio.mesh.v1alpha1/#MeshConfig). properties: attempts: description: |- Number of retries to be allowed for a given request. The interval between retries will be determined automatically (25ms+). When request `timeout` of the [HTTP route](https://istio.io/docs/reference/config/networking/virtual-service/#HTTPRoute) or `per_try_timeout` is configured, the actual number of retries attempted also depends on the specified request `timeout` and `per_try_timeout` values. MUST be >= 0. If `0`, retries will be disabled. The maximum possible number of requests made will be 1 + `attempts`. format: int32 type: integer backoff: description: |- Specifies the minimum duration between retry attempts. If unset, default minimum duration of 25ms is used as base interval for exponetial backoff. This has an impact on the total number of retries that will be attempted based on the `attempts` field and route timeout. For example, with attempts is set to 3, backoff to 2s and timeout to 3s, the request will be retried only once. type: string perTryTimeout: description: |- Timeout per attempt for a given request, including the initial call and any retries. Format: 1h/1m/1s/1ms. MUST be >=1ms. Default is same value as request `timeout` of the [HTTP route](https://istio.io/docs/reference/config/networking/virtual-service/#HTTPRoute), which means no timeout. type: string retryIgnorePreviousHosts: description: |- Flag to specify whether the retries should ignore previously tried hosts during retry. Defaults to true. nullable: true type: boolean retryOn: description: |- Specifies the conditions under which retry takes place. One or more policies can be specified using a ‘,’ delimited list. See the [retry policies](https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#x-envoy-retry-on) and [gRPC retry policies](https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#x-envoy-retry-grpc-on) for more details. In addition to the policies specified above, a list of HTTP status codes can be passed, such as `retryOn: "503,reset"`. Note these status codes refer to the actual responses received from the destination. For example, if a connection is reset, Istio will translate this to 503 for it's response. However, the destination did not return a 503 error, so this would not match `"503"` (it would, however, match `"reset"`). If not specified, this defaults to `connect-failure,refused-stream,unavailable,cancelled`. type: string retryRemoteLocalities: description: |- Flag to specify whether the retries should retry to other localities. See the [retry plugin configuration](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/http/http_connection_management#retry-plugin-configuration) for more details. nullable: true type: boolean type: object rewrite: description: |- Rewrite HTTP URIs and Authority headers. Rewrite cannot be used with Redirect primitive. Rewrite will be performed before forwarding. properties: authority: description: rewrite the Authority/Host header with this value. type: string uri: description: |- rewrite the path (or the prefix) portion of the URI with this value. If the original URI was matched based on prefix, the value provided in this field will replace the corresponding matched prefix. type: string uriRegexRewrite: description: rewrite the path portion of the URI with the specified regex. properties: match: description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).' type: string rewrite: description: |- The string that should replace into matching portions of original URI. Capture groups in the pattern can be referenced in the new URI. Examples: Example 1: rewrite with capture groups Path pattern "/service/update/v1/api" with match "^/service/([^/]+)(/.*)$" and rewrite string of "/customprefix/\2/\1" would transform into "/customprefix/v1/api/update". Example 2: case insensitive rewrite Path pattern "/aaa/XxX/bbb" with match "(?i)/xxx/" and a rewrite string of /yyy/ would do a case-insensitive match and transform the path to "/aaa/yyy/bbb". type: string type: object type: object route: description: |- A HTTP rule can either return a direct_response, redirect or forward (default) traffic. The forwarding target can be one of several versions of a service (see glossary in beginning of document). Weights associated with the service version determine the proportion of traffic it receives. items: description: |- Each routing rule is associated with one or more service versions (see glossary in beginning of document). Weights associated with the version determine the proportion of traffic it receives. For example, the following rule will route 25% of traffic for the "reviews" service to instances with the "v2" tag and the remaining traffic (i.e., 75%) to "v1". ```yaml apiVersion: networking.istio.io/v1 kind: VirtualService metadata: name: reviews-route spec: hosts: - reviews.prod.svc.cluster.local http: - route: - destination: host: reviews.prod.svc.cluster.local subset: v2 weight: 25 - destination: host: reviews.prod.svc.cluster.local subset: v1 weight: 75 ``` And the associated DestinationRule ```yaml apiVersion: networking.istio.io/v1 kind: DestinationRule metadata: name: reviews-destination spec: host: reviews.prod.svc.cluster.local subsets: - name: v1 labels: version: v1 - name: v2 labels: version: v2 ``` Traffic can also be split across two entirely different services without having to define new subsets. For example, the following rule forwards 25% of traffic to reviews.com to dev.reviews.com ```yaml apiVersion: networking.istio.io/v1 kind: VirtualService metadata: name: reviews-route-two-domains spec: hosts: - reviews.com http: - route: - destination: host: dev.reviews.com weight: 25 - destination: host: reviews.com weight: 75 ``` properties: destination: description: |- Destination uniquely identifies the instances of a service to which the request/connection should be forwarded to. properties: host: description: |- The name of a service from the service registry. Service names are looked up from the platform's service registry (e.g., Kubernetes services, Consul services, etc.) and from the hosts declared by [ServiceEntry](https://istio.io/docs/reference/config/networking/service-entry/#ServiceEntry). Traffic forwarded to destinations that are not found in either of the two, will be dropped. *Note for Kubernetes users*: When short names are used (e.g. "reviews" instead of "reviews.default.svc.cluster.local"), Istio will interpret the short name based on the namespace of the rule, not the service. A rule in the "default" namespace containing a host "reviews" will be interpreted as "reviews.default.svc.cluster.local", irrespective of the actual namespace associated with the reviews service. To avoid potential misconfiguration, it is recommended to always use fully qualified domain names over short names. type: string port: description: |- Specifies the port on the host that is being addressed. If a service exposes only a single port it is not required to explicitly select the port. properties: number: description: Valid port number maximum: 4294967295 minimum: 0 type: integer type: object subset: description: |- The name of a subset within the service. Applicable only to services within the mesh. The subset must be defined in a corresponding DestinationRule. type: string type: object headers: description: Header manipulation rules properties: request: description: |- Header manipulation rules to apply before forwarding a request to the destination service properties: add: additionalProperties: type: string description: |- Append the given values to the headers specified by keys (will create a comma-separated list of values) type: object remove: description: Remove the specified headers items: type: string type: array set: additionalProperties: type: string description: Overwrite the headers specified by key with the given values type: object type: object response: description: |- Header manipulation rules to apply before returning a response to the caller properties: add: additionalProperties: type: string description: |- Append the given values to the headers specified by keys (will create a comma-separated list of values) type: object remove: description: Remove the specified headers items: type: string type: array set: additionalProperties: type: string description: Overwrite the headers specified by key with the given values type: object type: object type: object weight: description: |- Weight specifies the relative proportion of traffic to be forwarded to the destination. A destination will receive `weight/(sum of all weights)` requests. If there is only one destination in a rule, it will receive all traffic. Otherwise, if weight is `0`, the destination will not receive any traffic. format: int32 type: integer type: object type: array timeout: description: Timeout for HTTP requests, default is disabled. type: string type: object type: array tcp: description: |- An ordered list of route rules for opaque TCP traffic. TCP routes will be applied to any port that is not a HTTP or TLS port. The first rule matching an incoming request is used. items: description: |- Describes match conditions and actions for routing TCP traffic. The following routing rule forwards traffic arriving at port 27017 for mongo.prod.svc.cluster.local to another Mongo server on port 5555. ```yaml apiVersion: networking.istio.io/v1 kind: VirtualService metadata: name: bookinfo-mongo spec: hosts: - mongo.prod.svc.cluster.local tcp: - match: - port: 27017 route: - destination: host: mongo.backup.svc.cluster.local port: number: 5555 ``` properties: match: description: |- Match conditions to be satisfied for the rule to be activated. All conditions inside a single match block have AND semantics, while the list of match blocks have OR semantics. The rule is matched if any one of the match blocks succeed. items: description: |- L4 connection match attributes. Note that L4 connection matching support is incomplete. properties: destinationSubnets: description: |- IPv4 or IPv6 ip addresses of destination with optional subnet. E.g., a.b.c.d/xx form or just a.b.c.d. items: type: string type: array gateways: description: |- Names of gateways where the rule should be applied. Gateway names in the top-level `gateways` field of the VirtualService (if any) are overridden. The gateway match is independent of sourceLabels. items: type: string type: array port: description: |- Specifies the port on the host that is being addressed. Many services only expose a single port or label ports with the protocols they support, in these cases it is not required to explicitly select the port. maximum: 4294967295 minimum: 0 type: integer sourceLabels: additionalProperties: type: string description: |- One or more labels that constrain the applicability of a rule to workloads with the given labels. If the VirtualService has a list of gateways specified in the top-level `gateways` field, it should include the reserved gateway `mesh` in order for this field to be applicable. **Note:** This is not a runtime match, but is a selector; it filters which workloads the VirtualService applies to. type: object sourceNamespace: description: |- Source namespace constraining the applicability of a rule to workloads in that namespace. If the VirtualService has a list of gateways specified in the top-level `gateways` field, it must include the reserved gateway `mesh` for this field to be applicable. **Note:** This is not a runtime match, but is a selector; it filters which workloads the VirtualService applies to. type: string sourceSubnet: description: |- IPv4 or IPv6 ip address of source with optional subnet. E.g., a.b.c.d/xx form or just a.b.c.d type: string type: object type: array route: description: The destination to which the connection should be forwarded to. items: description: L4 routing rule weighted destination. properties: destination: description: |- Destination uniquely identifies the instances of a service to which the request/connection should be forwarded to. properties: host: description: |- The name of a service from the service registry. Service names are looked up from the platform's service registry (e.g., Kubernetes services, Consul services, etc.) and from the hosts declared by [ServiceEntry](https://istio.io/docs/reference/config/networking/service-entry/#ServiceEntry). Traffic forwarded to destinations that are not found in either of the two, will be dropped. *Note for Kubernetes users*: When short names are used (e.g. "reviews" instead of "reviews.default.svc.cluster.local"), Istio will interpret the short name based on the namespace of the rule, not the service. A rule in the "default" namespace containing a host "reviews" will be interpreted as "reviews.default.svc.cluster.local", irrespective of the actual namespace associated with the reviews service. To avoid potential misconfiguration, it is recommended to always use fully qualified domain names over short names. type: string port: description: |- Specifies the port on the host that is being addressed. If a service exposes only a single port it is not required to explicitly select the port. properties: number: description: Valid port number maximum: 4294967295 minimum: 0 type: integer type: object subset: description: |- The name of a subset within the service. Applicable only to services within the mesh. The subset must be defined in a corresponding DestinationRule. type: string type: object weight: description: |- Weight specifies the relative proportion of traffic to be forwarded to the destination. A destination will receive `weight/(sum of all weights)` requests. If there is only one destination in a rule, it will receive all traffic. Otherwise, if weight is `0`, the destination will not receive any traffic. format: int32 type: integer type: object type: array type: object type: array tls: description: |- An ordered list of route rule for non-terminated TLS & HTTPS traffic. Routing is typically performed using the SNI value presented by the ClientHello message. TLS routes will be applied to platform service ports named 'https-*', 'tls-*', unterminated gateway ports using HTTPS/TLS protocols (i.e. with "passthrough" TLS mode) and service entry ports using HTTPS/TLS protocols. The first rule matching an incoming request is used. NOTE: Traffic 'https-*' or 'tls-*' ports without associated virtual service will be treated as opaque TCP traffic. items: description: |- Describes match conditions and actions for routing unterminated TLS traffic (TLS/HTTPS) The following routing rule forwards unterminated TLS traffic arriving at port 443 of gateway called "mygateway" to internal services in the mesh based on the SNI value. ```yaml apiVersion: networking.istio.io/v1 kind: VirtualService metadata: name: bookinfo-sni spec: hosts: - "*.bookinfo.com" gateways: - mygateway tls: - match: - port: 443 sniHosts: - login.bookinfo.com route: - destination: host: login.prod.svc.cluster.local - match: - port: 443 sniHosts: - reviews.bookinfo.com route: - destination: host: reviews.prod.svc.cluster.local ``` properties: match: description: |- Match conditions to be satisfied for the rule to be activated. All conditions inside a single match block have AND semantics, while the list of match blocks have OR semantics. The rule is matched if any one of the match blocks succeed. items: description: TLS connection match attributes. properties: destinationSubnets: description: |- IPv4 or IPv6 ip addresses of destination with optional subnet. E.g., a.b.c.d/xx form or just a.b.c.d. items: type: string type: array gateways: description: |- Names of gateways where the rule should be applied. Gateway names in the top-level `gateways` field of the VirtualService (if any) are overridden. The gateway match is independent of sourceLabels. items: type: string type: array port: description: |- Specifies the port on the host that is being addressed. Many services only expose a single port or label ports with the protocols they support, in these cases it is not required to explicitly select the port. maximum: 4294967295 minimum: 0 type: integer sniHosts: description: |- SNI (server name indicator) to match on. Wildcard prefixes can be used in the SNI value, e.g., *.com will match foo.example.com as well as example.com. An SNI value must be a subset (i.e., fall within the domain) of the corresponding virtual service's hosts. items: type: string type: array sourceLabels: additionalProperties: type: string description: |- One or more labels that constrain the applicability of a rule to workloads with the given labels. If the VirtualService has a list of gateways specified in the top-level `gateways` field, it should include the reserved gateway `mesh` in order for this field to be applicable. **Note:** This is not a runtime match, but is a selector; it filters which workloads the VirtualService applies to. type: object sourceNamespace: description: |- Source namespace constraining the applicability of a rule to workloads in that namespace. If the VirtualService has a list of gateways specified in the top-level `gateways` field, it must include the reserved gateway `mesh` for this field to be applicable. **Note:** This is not a runtime match, but is a selector; it filters which workloads the VirtualService applies to. type: string type: object type: array route: description: The destination to which the connection should be forwarded to. items: description: L4 routing rule weighted destination. properties: destination: description: |- Destination uniquely identifies the instances of a service to which the request/connection should be forwarded to. properties: host: description: |- The name of a service from the service registry. Service names are looked up from the platform's service registry (e.g., Kubernetes services, Consul services, etc.) and from the hosts declared by [ServiceEntry](https://istio.io/docs/reference/config/networking/service-entry/#ServiceEntry). Traffic forwarded to destinations that are not found in either of the two, will be dropped. *Note for Kubernetes users*: When short names are used (e.g. "reviews" instead of "reviews.default.svc.cluster.local"), Istio will interpret the short name based on the namespace of the rule, not the service. A rule in the "default" namespace containing a host "reviews" will be interpreted as "reviews.default.svc.cluster.local", irrespective of the actual namespace associated with the reviews service. To avoid potential misconfiguration, it is recommended to always use fully qualified domain names over short names. type: string port: description: |- Specifies the port on the host that is being addressed. If a service exposes only a single port it is not required to explicitly select the port. properties: number: description: Valid port number maximum: 4294967295 minimum: 0 type: integer type: object subset: description: |- The name of a subset within the service. Applicable only to services within the mesh. The subset must be defined in a corresponding DestinationRule. type: string type: object weight: description: |- Weight specifies the relative proportion of traffic to be forwarded to the destination. A destination will receive `weight/(sum of all weights)` requests. If there is only one destination in a rule, it will receive all traffic. Otherwise, if weight is `0`, the destination will not receive any traffic. format: int32 type: integer type: object type: array type: object type: array type: object type: object type: object served: true storage: true subresources: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: 9f657752618d8112 crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: xdsconfigs.internal.gloo.solo.io spec: group: internal.gloo.solo.io names: categories: - solo-io kind: XdsConfig listKind: XdsConfigList plural: xdsconfigs shortNames: - xc singular: xdsconfig scope: Namespaced versions: - name: v2 schema: openAPIV3Schema: properties: spec: description: |- XdsConfigs are used to issue xDS Configuration Resources to running Envoy instances. They are created by Gloo Mesh for processing by an agent running on managed clusters. The agent will serve the specified xDS configuration resources on its grpc-xds port (default 9977) to the Envoy instances (nodes) defined in the XDSConfigSpec. This feature is currently only available in Gloo Mesh Enterprise. properties: types: description: |- The xDS resources to serve to the nodes. Mapped by type URL. items: description: A set of resources of a single type (typeURL). type: object x-kubernetes-preserve-unknown-fields: true type: array workloads: description: The Workloads that will receive this xDS Configuration. items: description: Resource reference for an object properties: name: description: name of the resource being referenced type: string namespace: description: namespace of the resource being referenced type: string type: object type: array type: object status: description: The XdsConfig status is written by the CertificateRequesting agent. properties: error: description: |- Any error observed which prevented the XdsConfig from being processed. If the error is empty, the request has been processed successfully. type: string observedGeneration: description: |- The most recent generation observed in the XdsConfig metadata. If the `observedGeneration` does not match `metadata.generation`, the Gloo Mesh agent has not processed the most recent version of this XdsConfig. format: int64 type: integer type: object type: object served: true storage: true subresources: status: {} ---