# Code generated by skv2. DO NOT EDIT. apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: 41b661f83577c798 crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: httpbufferpolicies.trafficcontrol.policy.gloo.solo.io spec: group: trafficcontrol.policy.gloo.solo.io names: categories: - solo-io kind: HTTPBufferPolicy listKind: HTTPBufferPolicyList plural: httpbufferpolicies singular: httpbufferpolicy scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .status.common.State.approval name: Status type: string name: v2 schema: openAPIV3Schema: properties: spec: description: |- HTTPBufferPolicy is used to enable http buffers for routes For more details on HTTPBuffer, visit: https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/buffer_filter ``` apiVersion: trafficcontrol.policy.gloo.solo.io/v2 kind: HTTPBufferPolicy metadata: name: buffer namespace: bookinfo spec: config: maxRequestBytes: 16384 applyToRoutes: - route: labels: route: productpage ``` properties: applyToRoutes: items: description: |- RouteSelector is a Selector specifically built for individual Routes inside of RouteTables. This selector can be used to select individual routes or entire route tables using the same label selector. oneOf: - not: anyOf: - required: - route - required: - withDestinations - required: - route - required: - withDestinations properties: route: description: |- select routes based on their labels. these labels can be used to match route tables or individual routes within route tables. properties: cluster: description: Only select routes attached to route tables matching the cluster. type: string labels: additionalProperties: type: string description: Select routes including all specified labels on the route or route table. type: object namespace: description: Only select routes attached to route tables matching the namespace. type: string workspace: description: Only select routes attached to route tables matching the workspace. type: string type: object withDestinations: description: |- select routes with `forwardTo` actions based on their destinations. this can be used to apply policy to routes regardless of their labels properties: kind: description: The kind of destination being selected. defaults to Kubernetes Service. enum: - SERVICE - VIRTUAL_DESTINATION - EXTERNAL_SERVICE type: string port: description: |- The port on the Destination which receives traffic. All ports on the Destination will be selected if left empty. oneOf: - not: anyOf: - required: - number - required: - name - required: - number - required: - name properties: name: description: the name of the port on the destination objects being targeted. type: string number: description: the number of the port on the destination objects being targeted. maximum: 65535 minimum: 1 type: integer type: object selector: description: The selector used to match destination objects by their metadata properties: cluster: description: |- Only select objects in the matching cluster. If omitted, Gloo selects matching objects across all clusters available in the parent object's workspace. type: string labels: additionalProperties: type: string description: labels matching those of the object type: object name: description: |- Only select objects with the matching name. If omitted, Gloo selects matching objects with any name available in the parent object's workspace. type: string namespace: description: |- Only select objects in the matching namespace. If omitted, Gloo selects matching objects across all namespaces available in the parent object's workspace. type: string workspace: description: |- Only select objects in the given workspace. If omitted, Gloo selects matching objects across all workspaces available in the parent object's workspace. type: string type: object type: object type: object type: array config: properties: maxRequestBytes: description: |- The maximum request size that the filter will buffer before the connection manager will stop buffering and return a 413 response maximum: 4294967295 minimum: 0 nullable: true type: integer type: object type: object status: description: The status of the policy after it is applied to your Gloo environment. properties: common: description: The state and workspace conditions of the applied resource. properties: State: properties: approval: description: |- Whether the resource has been accepted as valid and processed in the Gloo Mesh config translation. enum: - PENDING - ACCEPTED - INVALID - WARNING - FAILED - UNLICENSED type: string message: description: Additional information about the current state of the resource. type: string observedGeneration: description: |- The most recent generation observed in the object's metadata. If the `observedGeneration` does not match `metadata.generation`, Gloo Mesh has not processed the most recent version of this object. format: int64 type: integer type: object workspaceConditions: additionalProperties: maximum: 4294967295 minimum: 0 type: integer description: |- A map of ApprovalState to the number of workspaces in this condition, e.g., "Accepted" -> 2 "Pending" -> 1 type: object type: object numSelectedRoutes: description: The number of routes selected by the policy. maximum: 4294967295 minimum: 0 type: integer type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: d4cbb3bd943103f5 crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: headermanipulationpolicies.trafficcontrol.policy.gloo.solo.io spec: group: trafficcontrol.policy.gloo.solo.io names: categories: - solo-io kind: HeaderManipulationPolicy listKind: HeaderManipulationPolicyList plural: headermanipulationpolicies shortNames: - hmp singular: headermanipulationpolicy scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .status.common.State.approval name: Status type: string name: v2 schema: openAPIV3Schema: properties: spec: description: |- HeaderManipulationPolicy is used to transform HTTP requests and responses matching selected routes. TransformationPolicies are applied at the *Route* level. If no selectors are provided, will apply to all routes in the workspace. properties: applyToRouteDestinations: description: |- Select routes' destinations where the policy will be applied. This field is intended for when the config should be applied to a `forwardTo` route only when it is forwarded to a subset of the route's backing destinations. items: description: RouteDestinationSelector is a Selector specifically built for individual destinations on individual Routes inside of RouteTables. properties: onDestinations: description: for the selected routes, select destinations on which to apply this policy items: description: |- DestinationSelector is a selector for matching routable destinations for routes. DestinationSelectors can select a variety of object types. The behavior of the route action will vary depending on the type of destination selected. Defaults to the kubernetes `v1/Service`. Currently supported destination types: - v1 Service - networking.gloo.solo.io/v2 VirtualDestination (route traffic to a group of backing destinations) - networking.gloo.solo.io/v2 ExternalService (route traffic to a static set of service endpoints external to the mesh) properties: kind: description: The kind of destination being selected. defaults to Kubernetes Service. enum: - SERVICE - VIRTUAL_DESTINATION - EXTERNAL_SERVICE type: string port: description: |- The port on the Destination which receives traffic. All ports on the Destination will be selected if left empty. oneOf: - not: anyOf: - required: - number - required: - name - required: - number - required: - name properties: name: description: the name of the port on the destination objects being targeted. type: string number: description: the number of the port on the destination objects being targeted. maximum: 65535 minimum: 1 type: integer type: object selector: description: The selector used to match destination objects by their metadata properties: cluster: description: |- Only select objects in the matching cluster. If omitted, Gloo selects matching objects across all clusters available in the parent object's workspace. type: string labels: additionalProperties: type: string description: labels matching those of the object type: object name: description: |- Only select objects with the matching name. If omitted, Gloo selects matching objects with any name available in the parent object's workspace. type: string namespace: description: |- Only select objects in the matching namespace. If omitted, Gloo selects matching objects across all namespaces available in the parent object's workspace. type: string workspace: description: |- Only select objects in the given workspace. If omitted, Gloo selects matching objects across all workspaces available in the parent object's workspace. type: string type: object type: object type: array route: description: |- select routes based on their labels. these labels can be used to match route tables or individual routes within route tables. If empty, configuration will apply to all specified destinations on all routes in the workspace. properties: cluster: description: Only select routes attached to route tables matching the cluster. type: string labels: additionalProperties: type: string description: Select routes including all specified labels on the route or route table. type: object namespace: description: Only select routes attached to route tables matching the namespace. type: string workspace: description: Only select routes attached to route tables matching the workspace. type: string type: object type: object type: array applyToRoutes: description: select the routes where the policy will be applied items: description: |- RouteSelector is a Selector specifically built for individual Routes inside of RouteTables. This selector can be used to select individual routes or entire route tables using the same label selector. oneOf: - not: anyOf: - required: - route - required: - withDestinations - required: - route - required: - withDestinations properties: route: description: |- select routes based on their labels. these labels can be used to match route tables or individual routes within route tables. properties: cluster: description: Only select routes attached to route tables matching the cluster. type: string labels: additionalProperties: type: string description: Select routes including all specified labels on the route or route table. type: object namespace: description: Only select routes attached to route tables matching the namespace. type: string workspace: description: Only select routes attached to route tables matching the workspace. type: string type: object withDestinations: description: |- select routes with `forwardTo` actions based on their destinations. this can be used to apply policy to routes regardless of their labels properties: kind: description: The kind of destination being selected. defaults to Kubernetes Service. enum: - SERVICE - VIRTUAL_DESTINATION - EXTERNAL_SERVICE type: string port: description: |- The port on the Destination which receives traffic. All ports on the Destination will be selected if left empty. oneOf: - not: anyOf: - required: - number - required: - name - required: - number - required: - name properties: name: description: the name of the port on the destination objects being targeted. type: string number: description: the number of the port on the destination objects being targeted. maximum: 65535 minimum: 1 type: integer type: object selector: description: The selector used to match destination objects by their metadata properties: cluster: description: |- Only select objects in the matching cluster. If omitted, Gloo selects matching objects across all clusters available in the parent object's workspace. type: string labels: additionalProperties: type: string description: labels matching those of the object type: object name: description: |- Only select objects with the matching name. If omitted, Gloo selects matching objects with any name available in the parent object's workspace. type: string namespace: description: |- Only select objects in the matching namespace. If omitted, Gloo selects matching objects across all namespaces available in the parent object's workspace. type: string workspace: description: |- Only select objects in the given workspace. If omitted, Gloo selects matching objects across all workspaces available in the parent object's workspace. type: string type: object type: object type: object type: array config: description: The details of the transformation policy to apply to the selected routes or destinations for a given route. properties: appendRequestHeaders: additionalProperties: type: string description: Additional HTTP headers to add before forwarding a request to the destination service. type: object appendResponseHeaders: additionalProperties: type: string description: Additional HTTP headers to add before returning a response to the caller. type: object removeRequestHeaders: description: HTTP headers to remove before forwarding a request to the destination service. items: type: string type: array removeResponseHeaders: description: HTTP headers to remove before returning a response to the caller. items: type: string type: array type: object type: object status: properties: common: description: The state and workspace conditions of the applied resource. properties: State: properties: approval: description: |- Whether the resource has been accepted as valid and processed in the Gloo Mesh config translation. enum: - PENDING - ACCEPTED - INVALID - WARNING - FAILED - UNLICENSED type: string message: description: Additional information about the current state of the resource. type: string observedGeneration: description: |- The most recent generation observed in the object's metadata. If the `observedGeneration` does not match `metadata.generation`, Gloo Mesh has not processed the most recent version of this object. format: int64 type: integer type: object workspaceConditions: additionalProperties: maximum: 4294967295 minimum: 0 type: integer description: |- A map of ApprovalState to the number of workspaces in this condition, e.g., "Accepted" -> 2 "Pending" -> 1 type: object type: object numSelectedRoutes: description: The number of routes selected by this policy. maximum: 4294967295 minimum: 0 type: integer type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: 8b84b007629470e9 crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: loadbalancerpolicies.trafficcontrol.policy.gloo.solo.io spec: group: trafficcontrol.policy.gloo.solo.io names: categories: - solo-io kind: LoadBalancerPolicy listKind: LoadBalancerPolicyList plural: loadbalancerpolicies shortNames: - lbp singular: loadbalancerpolicy scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .status.common.State.approval name: Status type: string name: v2 schema: openAPIV3Schema: properties: spec: description: Specifications for the policy. properties: applyToDestinations: description: |- Destinations to apply the policy to. If empty or unset, the policy applies to all destinations in the workspace.
**Configuration constraints**: Only one load balancer policy can apply to a destination. Subsequent policies (sorted by creation time) are ignored and put into a FAILED state. items: description: |- DestinationSelector is a selector for matching routable destinations for routes. DestinationSelectors can select a variety of object types. The behavior of the route action will vary depending on the type of destination selected. Defaults to the kubernetes `v1/Service`. Currently supported destination types: - v1 Service - networking.gloo.solo.io/v2 VirtualDestination (route traffic to a group of backing destinations) - networking.gloo.solo.io/v2 ExternalService (route traffic to a static set of service endpoints external to the mesh) properties: kind: description: The kind of destination being selected. defaults to Kubernetes Service. enum: - SERVICE - VIRTUAL_DESTINATION - EXTERNAL_SERVICE type: string port: description: |- The port on the Destination which receives traffic. All ports on the Destination will be selected if left empty. oneOf: - not: anyOf: - required: - number - required: - name - required: - number - required: - name properties: name: description: the name of the port on the destination objects being targeted. type: string number: description: the number of the port on the destination objects being targeted. maximum: 65535 minimum: 1 type: integer type: object selector: description: The selector used to match destination objects by their metadata properties: cluster: description: |- Only select objects in the matching cluster. If omitted, Gloo selects matching objects across all clusters available in the parent object's workspace. type: string labels: additionalProperties: type: string description: labels matching those of the object type: object name: description: |- Only select objects with the matching name. If omitted, Gloo selects matching objects with any name available in the parent object's workspace. type: string namespace: description: |- Only select objects in the matching namespace. If omitted, Gloo selects matching objects across all namespaces available in the parent object's workspace. type: string workspace: description: |- Only select objects in the given workspace. If omitted, Gloo selects matching objects across all workspaces available in the parent object's workspace. type: string type: object type: object type: array config: description: The configuration for load balancer settings. oneOf: - not: anyOf: - required: - simple - required: - consistentHash - required: - simple - required: - consistentHash properties: consistentHash: description: |- Set up soft session affinity between a client and an upstream service by using a consistent hashing algorithm based on HTTP headers, cookies, or other properties. oneOf: - not: anyOf: - required: - httpHeaderName - required: - httpCookie - required: - useSourceIp - required: - httpQueryParameterName - required: - httpHeaderName - required: - httpCookie - required: - useSourceIp - required: - httpQueryParameterName properties: httpCookie: description: Hash based on an HTTP cookie. properties: name: description: Name of the cookie. type: string path: description: Path to set for the cookie. type: string ttl: description: |- Lifetime of the cookie.
**Configuration constraints**: type: string required: - name type: object httpHeaderName: description: Hash based on a specific HTTP header. type: string httpQueryParameterName: description: Hash based on a specific HTTP query parameter. type: string useSourceIp: description: |- Hash based on the source IP address. This is applicable for both TCP and HTTP connections. type: boolean type: object healthyPanicThreshold: description: |- The threshold at which Envoy disregards the upstream health status and either load balances requests either among all or no hosts.
**Implementation notes**:
**Configuration constraints**: The value must be in the range 0 - 100, inclusive. nullable: true type: number simple: description: |- Set a load balancing algorithm for selecting upstream services to forward incoming requests to. enum: - UNSPECIFIED - RANDOM - PASSTHROUGH - ROUND_ROBIN - LEAST_REQUEST type: string updateMergeWindow: description: |- The duration of time within which the gateway merges all health check, weight, and metadata updates together.
**Implementation notes**:
**Configuration constraints**: type: string warmupDurationSecs: description: |- The warm-up duration for a service. If set, the newly created endpoint of the service remains in warm-up mode, starting from its creation time and for the duration of this window. The gateway progressively increases the amount of traffic for that endpoint instead of sending a proportional amount of traffic. This setting is effective in scaling events, such as when new replicas are added to handle increased load. However, if all services start at the same time, this setting might not be as effective as all endpoints receiving the same amount of requests.
**Implementation notes**: This setting is supported only when `config.simple` is set to ROUND_ROBIN (default) or LEAST_REQUEST.
**Configuration constraints**: type: string type: object required: - config type: object status: description: The status of the policy after it is applied to your Gloo environment. properties: common: description: The state and workspace conditions of the applied resource. properties: State: properties: approval: description: |- Whether the resource has been accepted as valid and processed in the Gloo Mesh config translation. enum: - PENDING - ACCEPTED - INVALID - WARNING - FAILED - UNLICENSED type: string message: description: Additional information about the current state of the resource. type: string observedGeneration: description: |- The most recent generation observed in the object's metadata. If the `observedGeneration` does not match `metadata.generation`, Gloo Mesh has not processed the most recent version of this object. format: int64 type: integer type: object workspaceConditions: additionalProperties: maximum: 4294967295 minimum: 0 type: integer description: |- A map of ApprovalState to the number of workspaces in this condition, e.g., "Accepted" -> 2 "Pending" -> 1 type: object type: object numSelectedDestinationPorts: description: The number of destination ports selected by the policy. maximum: 4294967295 minimum: 0 type: integer type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: a29f436082e86607 crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: mirrorpolicies.trafficcontrol.policy.gloo.solo.io spec: group: trafficcontrol.policy.gloo.solo.io names: categories: - solo-io kind: MirrorPolicy listKind: MirrorPolicyList plural: mirrorpolicies shortNames: - mp singular: mirrorpolicy scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .status.common.State.approval name: Status type: string name: v2 schema: openAPIV3Schema: properties: spec: description: |- MirrorPolicy is used to mirror/shadow traffic to a another destination (traffic will be sent to its original destination in addition to the mirrored destinations). MirrorPolicies are applied at the *Route* level. properties: applyToRoutes: description: |- Routes to apply the policy to. If empty, the policy applies to all routes in the workspace. items: description: |- RouteSelector is a Selector specifically built for individual Routes inside of RouteTables. This selector can be used to select individual routes or entire route tables using the same label selector. oneOf: - not: anyOf: - required: - route - required: - withDestinations - required: - route - required: - withDestinations properties: route: description: |- select routes based on their labels. these labels can be used to match route tables or individual routes within route tables. properties: cluster: description: Only select routes attached to route tables matching the cluster. type: string labels: additionalProperties: type: string description: Select routes including all specified labels on the route or route table. type: object namespace: description: Only select routes attached to route tables matching the namespace. type: string workspace: description: Only select routes attached to route tables matching the workspace. type: string type: object withDestinations: description: |- select routes with `forwardTo` actions based on their destinations. this can be used to apply policy to routes regardless of their labels properties: kind: description: The kind of destination being selected. defaults to Kubernetes Service. enum: - SERVICE - VIRTUAL_DESTINATION - EXTERNAL_SERVICE type: string port: description: |- The port on the Destination which receives traffic. All ports on the Destination will be selected if left empty. oneOf: - not: anyOf: - required: - number - required: - name - required: - number - required: - name properties: name: description: the name of the port on the destination objects being targeted. type: string number: description: the number of the port on the destination objects being targeted. maximum: 65535 minimum: 1 type: integer type: object selector: description: The selector used to match destination objects by their metadata properties: cluster: description: |- Only select objects in the matching cluster. If omitted, Gloo selects matching objects across all clusters available in the parent object's workspace. type: string labels: additionalProperties: type: string description: labels matching those of the object type: object name: description: |- Only select objects with the matching name. If omitted, Gloo selects matching objects with any name available in the parent object's workspace. type: string namespace: description: |- Only select objects in the matching namespace. If omitted, Gloo selects matching objects across all namespaces available in the parent object's workspace. type: string workspace: description: |- Only select objects in the given workspace. If omitted, Gloo selects matching objects across all workspaces available in the parent object's workspace. type: string type: object type: object type: object type: array config: description: The details of the Mirror policy to apply to the selected routes properties: destination: description: The destination to which to send mirrored traffic oneOf: - not: anyOf: - required: - ref - required: - awsLambda - required: - ref - required: - awsLambda properties: awsLambda: description: Reference an AWS Lambda function. properties: cloudProvider: description: Reference to the AWS Cloud Provider. properties: cluster: description: the cluster of the object. If omitted, Gloo Mesh will use the same cluster as the parent object containing this reference. type: string name: description: the name of the object type: string namespace: description: the namespace of the object. If omitted, Gloo Mesh will use the same namespace as the parent object containing this reference. type: string type: object function: description: Name of the function to reference. type: string options: description: |- Specify how the destinations should be configured, for configuring lambda functions. If the destination config is required for the destination and not provided by the user, Gloo will invalidate the destination and its parent resources. properties: invocationStyle: description: |- Can be either Sync or Async. See [AWS Invoke](https://docs.aws.amazon.com/lambda/latest/dg/API_Invoke.html) for more details. enum: - SYNC - ASYNC type: string requestTransformation: enum: - REQUEST_DEFAULT - REQUEST_DISABLE type: string responseTransformation: enum: - RESPONSE_DEFAULT - RESPONSE_DISABLE type: string type: object qualifier: description: Qualifier of the function to reference. Defaults to $LATEST type: string type: object kind: description: |- the kind of Kubernetes destination being referenced. defaults to Service. Only applicable for Kubernetes destinations. For non Kubernetes destinations, this field is ignored. enum: - SERVICE - VIRTUAL_DESTINATION - EXTERNAL_SERVICE type: string port: description: the port on the destination object being targeted. required if the object provides more than one port. oneOf: - not: anyOf: - required: - number - required: - name - required: - number - required: - name properties: name: description: the name of the port on the destination objects being targeted. type: string number: description: the number of the port on the destination objects being targeted. maximum: 65535 minimum: 1 type: integer type: object ref: description: reference to a Kubernetes destination object by its metadata properties: cluster: description: the cluster of the object. If omitted, Gloo Mesh will use the same cluster as the parent object containing this reference. type: string name: description: the name of the object type: string namespace: description: the namespace of the object. If omitted, Gloo Mesh will use the same namespace as the parent object containing this reference. type: string type: object subset: additionalProperties: type: string description: |- select a subset of the destination's endpoints for routing based on their labels. Only applicable for Kubernetes destinations. type: object weight: description: |- Specify the proportion of traffic to be forwarded to this destination. Weights across all of the `destinations` must sum to 100. Weight is only relevant when used in the context of a route with multiple destinations. maximum: 4294967295 minimum: 0 type: integer type: object percentage: description: |- Percentage of traffic to mirror. If omitted all traffic will be mirrored. Values must be between 0 and 100. For information about the value format, see the [Google protocol buffer documentation](https://protobuf.dev/reference/protobuf/google.protobuf/#double-value). nullable: true type: number type: object type: object status: description: The status of the policy after it is applied to your Gloo environment. properties: common: description: The state and workspace conditions of the applied resource. properties: State: properties: approval: description: |- Whether the resource has been accepted as valid and processed in the Gloo Mesh config translation. enum: - PENDING - ACCEPTED - INVALID - WARNING - FAILED - UNLICENSED type: string message: description: Additional information about the current state of the resource. type: string observedGeneration: description: |- The most recent generation observed in the object's metadata. If the `observedGeneration` does not match `metadata.generation`, Gloo Mesh has not processed the most recent version of this object. format: int64 type: integer type: object workspaceConditions: additionalProperties: maximum: 4294967295 minimum: 0 type: integer description: |- A map of ApprovalState to the number of workspaces in this condition, e.g., "Accepted" -> 2 "Pending" -> 1 type: object type: object numSelectedRoutes: description: The number of routes selected by this policy. maximum: 4294967295 minimum: 0 type: integer type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: e21598431be2cb40 crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: proxyprotocolpolicies.trafficcontrol.policy.gloo.solo.io spec: group: trafficcontrol.policy.gloo.solo.io names: categories: - solo-io kind: ProxyProtocolPolicy listKind: ProxyProtocolPolicyList plural: proxyprotocolpolicies singular: proxyprotocolpolicy scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .status.common.State.approval name: Status type: string name: v2 schema: openAPIV3Schema: properties: spec: description: |- ProxyProtocolPolicy is used to enable proxy protocol for gateway listener(s). For more details on ProxyProtocol, visit: https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt. ``` apiVersion: trafficcontrol.policy.gloo.solo.io/v2 kind: ProxyProtocolPolicy metadata: name: my-policy namespace: bookinfo spec: config: enabledProxyProtocol: true applyToListeners: - virtualGateway: name: virtual-gateway namespace: bookinfo cluster: my-cluster port: number: 443 ``` properties: applyToListeners: description: 'Required: The VirtualGateway(s) and Port(s) to which this policy applies.' items: description: ListenerSelector is a selector for a listener on a VirtualGateway. properties: port: description: The port to select on the selected listener. oneOf: - not: anyOf: - required: - number - required: - name - required: - number - required: - name properties: name: description: the name of the port on the destination objects being targeted. type: string number: description: the number of the port on the destination objects being targeted. maximum: 65535 minimum: 1 type: integer type: object virtualGateway: description: The virtual gateway on which to select a listener. properties: cluster: description: |- Only select objects in the matching cluster. If omitted, Gloo selects matching objects across all clusters available in the parent object's workspace. type: string labels: additionalProperties: type: string description: labels matching those of the object type: object name: description: |- Only select objects with the matching name. If omitted, Gloo selects matching objects with any name available in the parent object's workspace. type: string namespace: description: |- Only select objects in the matching namespace. If omitted, Gloo selects matching objects across all namespaces available in the parent object's workspace. type: string workspace: description: |- Only select objects in the given workspace. If omitted, Gloo selects matching objects across all workspaces available in the parent object's workspace. type: string type: object type: object type: array config: description: 'Required: The configuration to apply to the listener.' properties: enableProxyProtocol: type: boolean type: object type: object status: description: The status of the policy after it is applied to your Gloo environment. properties: common: description: The state and workspace conditions of the applied resource. properties: State: properties: approval: description: |- Whether the resource has been accepted as valid and processed in the Gloo Mesh config translation. enum: - PENDING - ACCEPTED - INVALID - WARNING - FAILED - UNLICENSED type: string message: description: Additional information about the current state of the resource. type: string observedGeneration: description: |- The most recent generation observed in the object's metadata. If the `observedGeneration` does not match `metadata.generation`, Gloo Mesh has not processed the most recent version of this object. format: int64 type: integer type: object workspaceConditions: additionalProperties: maximum: 4294967295 minimum: 0 type: integer description: |- A map of ApprovalState to the number of workspaces in this condition, e.g., "Accepted" -> 2 "Pending" -> 1 type: object type: object numSelectedListeners: description: The number of virtual gateway listeners selected by the policy. maximum: 4294967295 minimum: 0 type: integer type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: ed9bd19d5027d9eb crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: ratelimitclientconfigs.trafficcontrol.policy.gloo.solo.io spec: group: trafficcontrol.policy.gloo.solo.io names: categories: - solo-io kind: RateLimitClientConfig listKind: RateLimitClientConfigList plural: ratelimitclientconfigs shortNames: - rlcc singular: ratelimitclientconfig scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .status.common.State.approval name: Status type: string name: v2 schema: openAPIV3Schema: properties: spec: description: |- RateLimitClientConfig is used to configure the ratelimit rules on routes/destinations. All RateLimitPolicy resources in a workspace require an RateLimitClientConfig to in order to function. If no RateLimitClientConfig is provided, no ratelimit rules will be enforced. oneOf: - not: anyOf: - required: - raw - required: - raw properties: raw: description: Define a policy using the raw configuration format used by the client (Envoy). properties: rateLimits: description: |- Actions specify how the client (Envoy) will compose the descriptors that will be sent to the server to make a rate limiting decision. items: description: |- Each action and setAction in the lists maps part of the request (or its context) to a descriptor. The tuple or set of descriptors generated by the provided actions is sent to the rate limit server and matched against rate limit rules. Order matters on provided actions but not on setActions, e.g. the following actions: - actions: - requestHeaders: descriptorKey: account_id headerName: x-account-id - requestHeaders: descriptorKey: plan headerName: x-plan define an ordered descriptor tuple like so: ('account_id', ''), ('plan', '') While the current form matches, the same tuple in reverse order would not match the following descriptor: descriptors: - key: account_id descriptors: - key: plan value: BASIC rateLimit: requestsPerUnit: 1 unit: MINUTE - key: plan value: PLUS rateLimit: requestsPerUnit: 20 unit: MINUTE Similarly, the following setActions: - setActions: - requestHeaders: descriptorKey: account_id headerName: x-account-id - requestHeaders: descriptorKey: plan headerName: x-plan define an unordered descriptor set like so: {('account_id', ''), ('plan', '')} This set would match the following setDescriptor: setDescriptors: - simpleDescriptors: - key: plan value: BASIC - key: account_id rateLimit: requestsPerUnit: 20 unit: MINUTE It would also match the following setDescriptor which includes only a subset of the setActions enumerated: setDescriptors: - simpleDescriptors: - key: account_id rateLimit: requestsPerUnit: 20 unit: MINUTE It would even match the following setDescriptor. Any setActions list would match this setDescriptor which has simpleDescriptors omitted entirely: setDescriptors: - rateLimit: requestsPerUnit: 20 unit: MINUTE properties: actions: items: description: |- Copied directly from envoy https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v3-api-msg-config-route-v3-ratelimit-action oneOf: - not: anyOf: - required: - sourceCluster - required: - destinationCluster - required: - requestHeaders - required: - remoteAddress - required: - genericKey - required: - headerValueMatch - required: - metadata - required: - cel - required: - sourceCluster - required: - destinationCluster - required: - requestHeaders - required: - remoteAddress - required: - genericKey - required: - headerValueMatch - required: - metadata - required: - cel properties: cel: description: Rate limit on CEL expression. Only supported for agentgateway ratelimiting. properties: expression: description: The CEL expression to evaluate. type: string key: description: The key to use in the descriptor entry. type: string type: object destinationCluster: description: Rate limit on destination cluster. type: object genericKey: description: Rate limit on a generic key. properties: descriptorValue: description: The value to use in the descriptor entry. type: string type: object headerValueMatch: description: Rate limit on the existence of request headers. properties: descriptorValue: description: The value to use in the descriptor entry. type: string expectMatch: description: |- If set to true, the action will append a descriptor entry when the request matches the headers. If set to false, the action will append a descriptor entry when the request does not match the headers. The default value is true. nullable: true type: boolean headers: description: |- Specifies a set of headers that the rate limit action should match on. The action will check the request’s headers against all the specified headers in the config. A match will happen if all the headers in the config are present in the request with the same values (or based on presence if the value field is not in the config). items: oneOf: - not: anyOf: - required: - exactMatch - required: - regexMatch - required: - rangeMatch - required: - presentMatch - required: - prefixMatch - required: - suffixMatch - required: - exactMatch - required: - regexMatch - required: - rangeMatch - required: - presentMatch - required: - prefixMatch - required: - suffixMatch properties: exactMatch: description: If specified, header match will be performed based on the value of the header. type: string invertMatch: description: |- If specified, the match result will be inverted before checking. Defaults to false. Examples: * The regex *\d{3}* does not match the value *1234*, so it will match when inverted. * The range [-10,0) will match the value -1, so it will not match when inverted. type: boolean name: description: Specifies the name of the header in the request. type: string prefixMatch: description: |- If specified, header match will be performed based on the prefix of the header value. Note: empty prefix is not allowed, please use present_match instead. Examples: * The prefix *abcd* matches the value *abcdxyz*, but not for *abcxyz*. type: string presentMatch: description: |- If specified, header match will be performed based on whether the header is in the request. type: boolean rangeMatch: description: |- If specified, header match will be performed based on range. The rule will match if the request header value is within this range. The entire request header value must represent an integer in base 10 notation: consisting of an optional plus or minus sign followed by a sequence of digits. The rule will not match if the header value does not represent an integer. Match will fail for empty values, floating point numbers or if only a subsequence of the header value is an integer. Examples: * For range [-10,0), route will match for header value -1, but not for 0, "somestring", 10.9, "-1somestring" properties: end: description: end of the range (exclusive) format: int64 type: integer start: description: start of the range (inclusive) format: int64 type: integer type: object regexMatch: description: |- If specified, this regex string is a regular expression rule which implies the entire request header value must match the regex. The rule will not match if only a subsequence of the request header value matches the regex. The regex grammar used in the value field is defined `(here)[https://en.cppreference.com/w/cpp/regex/ecmascript]`. Examples: * The regex *\d{3}* matches the value *123* * The regex *\d{3}* does not match the value *1234* * The regex *\d{3}* does not match the value *123.456* type: string suffixMatch: description: |- If specified, header match will be performed based on the suffix of the header value. Note: empty suffix is not allowed, please use present_match instead. Examples: * The suffix *abcd* matches the value *xyzabcd*, but not for *xyzbcd*. type: string type: object type: array type: object metadata: description: Rate limit on metadata. properties: defaultValue: description: |- An optional value to use if *metadata_key* is empty. If not set and no value is present under the metadata_key then no descriptor is generated. type: string descriptorKey: description: Required. The key to use in the descriptor entry. type: string metadataKey: description: |- Required. Metadata struct that defines the key and path to retrieve the string value. A match will only happen if the value in the metadata is of type string. properties: key: description: |- Required. The key name of Metadata to retrieve the Struct from the metadata. Typically, it represents a builtin subsystem or custom extension. type: string path: description: |- Must have at least one element. The path to retrieve the Value from the Struct. It can be a prefix or a full path, e.g. ``[prop, xyz]`` for a struct or ``[prop, foo]`` for a string in the example, which depends on the particular scenario. Note: Due to that only the key type segment is supported, the path can not specify a list unless the list is the last segment. items: description: |- Specifies the segment in a path to retrieve value from Metadata. Currently it is only supported to specify the key, i.e. field name, as one segment of a path. oneOf: - not: anyOf: - required: - key - required: - key properties: key: description: Required. If specified, use the key to retrieve the value in a Struct. type: string type: object type: array type: object source: description: Source of metadata enum: - DYNAMIC - ROUTE_ENTRY type: string type: object remoteAddress: description: Rate limit on remote address. type: object requestHeaders: description: Rate limit on request headers. properties: descriptorKey: description: The key to use in the descriptor entry. type: string headerName: description: |- The header name to be queried from the request headers. The header’s value is used to populate the value of the descriptor entry for the descriptor_key. type: string type: object sourceCluster: description: Rate limit on source cluster. type: object type: object type: array limit: description: An optional limit override to be appended to the descriptor produced by this rate limit configuration. If the override value is invalid or cannot be resolved from metadata, no override is provided. oneOf: - not: anyOf: - required: - dynamicMetadata - required: - dynamicMetadata properties: dynamicMetadata: description: Limit override from dynamic metadata. properties: metadataKey: description: |- Metadata struct that defines the key and path to retrieve the struct value. The value must be a struct containing an integer "requests_per_unit" property and a "unit" property with a value parseable to :ref:`RateLimitUnit enum ` properties: key: description: |- Required. The key name of Metadata to retrieve the Struct from the metadata. Typically, it represents a builtin subsystem or custom extension. type: string path: description: |- Must have at least one element. The path to retrieve the Value from the Struct. It can be a prefix or a full path, e.g. ``[prop, xyz]`` for a struct or ``[prop, foo]`` for a string in the example, which depends on the particular scenario. Note: Due to that only the key type segment is supported, the path can not specify a list unless the list is the last segment. items: description: |- Specifies the segment in a path to retrieve value from Metadata. Currently it is only supported to specify the key, i.e. field name, as one segment of a path. oneOf: - not: anyOf: - required: - key - required: - key properties: key: description: Required. If specified, use the key to retrieve the value in a Struct. type: string type: object type: array type: object type: object type: object setActions: items: description: |- Copied directly from envoy https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v3-api-msg-config-route-v3-ratelimit-action oneOf: - not: anyOf: - required: - sourceCluster - required: - destinationCluster - required: - requestHeaders - required: - remoteAddress - required: - genericKey - required: - headerValueMatch - required: - metadata - required: - cel - required: - sourceCluster - required: - destinationCluster - required: - requestHeaders - required: - remoteAddress - required: - genericKey - required: - headerValueMatch - required: - metadata - required: - cel properties: cel: description: Rate limit on CEL expression. Only supported for agentgateway ratelimiting. properties: expression: description: The CEL expression to evaluate. type: string key: description: The key to use in the descriptor entry. type: string type: object destinationCluster: description: Rate limit on destination cluster. type: object genericKey: description: Rate limit on a generic key. properties: descriptorValue: description: The value to use in the descriptor entry. type: string type: object headerValueMatch: description: Rate limit on the existence of request headers. properties: descriptorValue: description: The value to use in the descriptor entry. type: string expectMatch: description: |- If set to true, the action will append a descriptor entry when the request matches the headers. If set to false, the action will append a descriptor entry when the request does not match the headers. The default value is true. nullable: true type: boolean headers: description: |- Specifies a set of headers that the rate limit action should match on. The action will check the request’s headers against all the specified headers in the config. A match will happen if all the headers in the config are present in the request with the same values (or based on presence if the value field is not in the config). items: oneOf: - not: anyOf: - required: - exactMatch - required: - regexMatch - required: - rangeMatch - required: - presentMatch - required: - prefixMatch - required: - suffixMatch - required: - exactMatch - required: - regexMatch - required: - rangeMatch - required: - presentMatch - required: - prefixMatch - required: - suffixMatch properties: exactMatch: description: If specified, header match will be performed based on the value of the header. type: string invertMatch: description: |- If specified, the match result will be inverted before checking. Defaults to false. Examples: * The regex *\d{3}* does not match the value *1234*, so it will match when inverted. * The range [-10,0) will match the value -1, so it will not match when inverted. type: boolean name: description: Specifies the name of the header in the request. type: string prefixMatch: description: |- If specified, header match will be performed based on the prefix of the header value. Note: empty prefix is not allowed, please use present_match instead. Examples: * The prefix *abcd* matches the value *abcdxyz*, but not for *abcxyz*. type: string presentMatch: description: |- If specified, header match will be performed based on whether the header is in the request. type: boolean rangeMatch: description: |- If specified, header match will be performed based on range. The rule will match if the request header value is within this range. The entire request header value must represent an integer in base 10 notation: consisting of an optional plus or minus sign followed by a sequence of digits. The rule will not match if the header value does not represent an integer. Match will fail for empty values, floating point numbers or if only a subsequence of the header value is an integer. Examples: * For range [-10,0), route will match for header value -1, but not for 0, "somestring", 10.9, "-1somestring" properties: end: description: end of the range (exclusive) format: int64 type: integer start: description: start of the range (inclusive) format: int64 type: integer type: object regexMatch: description: |- If specified, this regex string is a regular expression rule which implies the entire request header value must match the regex. The rule will not match if only a subsequence of the request header value matches the regex. The regex grammar used in the value field is defined `(here)[https://en.cppreference.com/w/cpp/regex/ecmascript]`. Examples: * The regex *\d{3}* matches the value *123* * The regex *\d{3}* does not match the value *1234* * The regex *\d{3}* does not match the value *123.456* type: string suffixMatch: description: |- If specified, header match will be performed based on the suffix of the header value. Note: empty suffix is not allowed, please use present_match instead. Examples: * The suffix *abcd* matches the value *xyzabcd*, but not for *xyzbcd*. type: string type: object type: array type: object metadata: description: Rate limit on metadata. properties: defaultValue: description: |- An optional value to use if *metadata_key* is empty. If not set and no value is present under the metadata_key then no descriptor is generated. type: string descriptorKey: description: Required. The key to use in the descriptor entry. type: string metadataKey: description: |- Required. Metadata struct that defines the key and path to retrieve the string value. A match will only happen if the value in the metadata is of type string. properties: key: description: |- Required. The key name of Metadata to retrieve the Struct from the metadata. Typically, it represents a builtin subsystem or custom extension. type: string path: description: |- Must have at least one element. The path to retrieve the Value from the Struct. It can be a prefix or a full path, e.g. ``[prop, xyz]`` for a struct or ``[prop, foo]`` for a string in the example, which depends on the particular scenario. Note: Due to that only the key type segment is supported, the path can not specify a list unless the list is the last segment. items: description: |- Specifies the segment in a path to retrieve value from Metadata. Currently it is only supported to specify the key, i.e. field name, as one segment of a path. oneOf: - not: anyOf: - required: - key - required: - key properties: key: description: Required. If specified, use the key to retrieve the value in a Struct. type: string type: object type: array type: object source: description: Source of metadata enum: - DYNAMIC - ROUTE_ENTRY type: string type: object remoteAddress: description: Rate limit on remote address. type: object requestHeaders: description: Rate limit on request headers. properties: descriptorKey: description: The key to use in the descriptor entry. type: string headerName: description: |- The header name to be queried from the request headers. The header’s value is used to populate the value of the descriptor entry for the descriptor_key. type: string type: object sourceCluster: description: Rate limit on source cluster. type: object type: object type: array type: description: |- Optional type defining the rate limit metric, such as requests or token counts. The TOKEN type is only relevant for AI backends that emit a token count and is used by agentgateway. Defaults to REQUEST if not specified. enum: - REQUEST - TOKEN type: string type: object type: array type: object type: object status: description: The current status of the `RateLimitClientConfig`. properties: common: description: The state and workspace conditions of the applied resource. properties: State: properties: approval: description: |- Whether the resource has been accepted as valid and processed in the Gloo Mesh config translation. enum: - PENDING - ACCEPTED - INVALID - WARNING - FAILED - UNLICENSED type: string message: description: Additional information about the current state of the resource. type: string observedGeneration: description: |- The most recent generation observed in the object's metadata. If the `observedGeneration` does not match `metadata.generation`, Gloo Mesh has not processed the most recent version of this object. format: int64 type: integer type: object workspaceConditions: additionalProperties: maximum: 4294967295 minimum: 0 type: integer description: |- A map of ApprovalState to the number of workspaces in this condition, e.g., "Accepted" -> 2 "Pending" -> 1 type: object type: object type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: 302e5603f4068bf5 crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: ratelimitpolicies.trafficcontrol.policy.gloo.solo.io spec: group: trafficcontrol.policy.gloo.solo.io names: categories: - solo-io kind: RateLimitPolicy listKind: RateLimitPolicyList plural: ratelimitpolicies shortNames: - rlp singular: ratelimitpolicy scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .status.common.State.approval name: Status type: string name: v2 schema: openAPIV3Schema: properties: spec: description: |- RateLimitPolicy is used to assign ratelimit configuration to specific routes or destinations. Traffic is forwarded to a rate-limited destinations specified in the RatelimitServerSettings. The RatelimitServerSettings is also used to configure connecting settings. If this is not provided, the default connection settings and default gloo mesh ratelimiter server destination will be used. RateLimitPolicies are applied at the *Route* level and *Destination* levels. Default is to apply policy to all destinations. properties: applyToDestinations: description: |- Select the destinations where the policy will be applied. {{< reuse "conrefs/snippets/field-desc/dest-no-ext-svc-or-vdest.md" >}} If empty, the rate limit policy applies to all destinations in the workspace. If the destination selector is empty but the route selector is set, no rate limits are applied on destinations, only on routes. items: description: |- DestinationSelector is a selector for matching routable destinations for routes. DestinationSelectors can select a variety of object types. The behavior of the route action will vary depending on the type of destination selected. Defaults to the kubernetes `v1/Service`. Currently supported destination types: - v1 Service - networking.gloo.solo.io/v2 VirtualDestination (route traffic to a group of backing destinations) - networking.gloo.solo.io/v2 ExternalService (route traffic to a static set of service endpoints external to the mesh) properties: kind: description: The kind of destination being selected. defaults to Kubernetes Service. enum: - SERVICE - VIRTUAL_DESTINATION - EXTERNAL_SERVICE type: string port: description: |- The port on the Destination which receives traffic. All ports on the Destination will be selected if left empty. oneOf: - not: anyOf: - required: - number - required: - name - required: - number - required: - name properties: name: description: the name of the port on the destination objects being targeted. type: string number: description: the number of the port on the destination objects being targeted. maximum: 65535 minimum: 1 type: integer type: object selector: description: The selector used to match destination objects by their metadata properties: cluster: description: |- Only select objects in the matching cluster. If omitted, Gloo selects matching objects across all clusters available in the parent object's workspace. type: string labels: additionalProperties: type: string description: labels matching those of the object type: object name: description: |- Only select objects with the matching name. If omitted, Gloo selects matching objects with any name available in the parent object's workspace. type: string namespace: description: |- Only select objects in the matching namespace. If omitted, Gloo selects matching objects across all namespaces available in the parent object's workspace. type: string workspace: description: |- Only select objects in the given workspace. If omitted, Gloo selects matching objects across all workspaces available in the parent object's workspace. type: string type: object type: object type: array applyToRoutes: description: |- Select the routes to apply the policy to. If empty, no rate limits are applied on routes in the workspace.
**Configuration constraints**: Rate limit policies are only applied to routes on a VirtualGateway. East-west routes that are configured with the `workloadSelectors` field in the RouteTable cannot be selected. items: description: |- RouteSelector is a Selector specifically built for individual Routes inside of RouteTables. This selector can be used to select individual routes or entire route tables using the same label selector. oneOf: - not: anyOf: - required: - route - required: - withDestinations - required: - route - required: - withDestinations properties: route: description: |- select routes based on their labels. these labels can be used to match route tables or individual routes within route tables. properties: cluster: description: Only select routes attached to route tables matching the cluster. type: string labels: additionalProperties: type: string description: Select routes including all specified labels on the route or route table. type: object namespace: description: Only select routes attached to route tables matching the namespace. type: string workspace: description: Only select routes attached to route tables matching the workspace. type: string type: object withDestinations: description: |- select routes with `forwardTo` actions based on their destinations. this can be used to apply policy to routes regardless of their labels properties: kind: description: The kind of destination being selected. defaults to Kubernetes Service. enum: - SERVICE - VIRTUAL_DESTINATION - EXTERNAL_SERVICE type: string port: description: |- The port on the Destination which receives traffic. All ports on the Destination will be selected if left empty. oneOf: - not: anyOf: - required: - number - required: - name - required: - number - required: - name properties: name: description: the name of the port on the destination objects being targeted. type: string number: description: the number of the port on the destination objects being targeted. maximum: 65535 minimum: 1 type: integer type: object selector: description: The selector used to match destination objects by their metadata properties: cluster: description: |- Only select objects in the matching cluster. If omitted, Gloo selects matching objects across all clusters available in the parent object's workspace. type: string labels: additionalProperties: type: string description: labels matching those of the object type: object name: description: |- Only select objects with the matching name. If omitted, Gloo selects matching objects with any name available in the parent object's workspace. type: string namespace: description: |- Only select objects in the matching namespace. If omitted, Gloo selects matching objects across all namespaces available in the parent object's workspace. type: string workspace: description: |- Only select objects in the given workspace. If omitted, Gloo selects matching objects across all workspaces available in the parent object's workspace. type: string type: object type: object type: object type: array config: description: The configuration details of the rate limit policy to apply to the selected routes oneOf: - not: anyOf: - required: - raw - required: - ratelimitClientConfig - required: - raw - required: - ratelimitClientConfig properties: phase: description: |- Specify the phase to indicate where this policy should be applied relative to other policies. If no phase is specified, the default will be post AuthZ. oneOf: - not: anyOf: - required: - preAuthz - required: - postAuthz - required: - preAuthz - required: - postAuthz properties: postAuthz: description: Apply this policy after Authorization policies are applied. properties: priority: description: |- The priority at which this policy should be applied relative to other policies defined in the same phase. The lowest priority will be run first and the default priority value is 0. For information about the value format, see the [Google protocol buffer documentation](https://protobuf.dev/reference/protobuf/google.protobuf/#int32-value). maximum: 2147483647 minimum: -2147483648 nullable: true type: integer type: object preAuthz: description: Apply this policy before Authorization policies are applied. properties: priority: description: |- The priority at which this policy should be applied relative to other policies defined in the same phase. The lowest priority will be run first and the default priority value is 0. For information about the value format, see the [Google protocol buffer documentation](https://protobuf.dev/reference/protobuf/google.protobuf/#int32-value). maximum: 2147483647 minimum: -2147483648 nullable: true type: integer type: object type: object ratelimitClientConfig: description: Select a RatelimitClientConfig policy to apply. properties: cluster: description: the cluster of the object. If omitted, Gloo Mesh will use the same cluster as the parent object containing this reference. type: string name: description: the name of the object type: string namespace: description: the namespace of the object. If omitted, Gloo Mesh will use the same namespace as the parent object containing this reference. type: string type: object ratelimitServerConfig: description: |- Reference to the RatelimitServerConfig to use for this policy. If none is provided, no ratelimit will be enforced properties: cluster: description: the cluster of the object. If omitted, Gloo Mesh will use the same cluster as the parent object containing this reference. type: string name: description: the name of the object type: string namespace: description: the namespace of the object. If omitted, Gloo Mesh will use the same namespace as the parent object containing this reference. type: string type: object raw: description: Inline a policy using the raw configuration format used by the ratelimit server. properties: rateLimits: description: |- Actions specify how the client (Envoy) will compose the descriptors that will be sent to the server to make a rate limiting decision. items: description: |- Each action and setAction in the lists maps part of the request (or its context) to a descriptor. The tuple or set of descriptors generated by the provided actions is sent to the rate limit server and matched against rate limit rules. Order matters on provided actions but not on setActions, e.g. the following actions: - actions: - requestHeaders: descriptorKey: account_id headerName: x-account-id - requestHeaders: descriptorKey: plan headerName: x-plan define an ordered descriptor tuple like so: ('account_id', ''), ('plan', '') While the current form matches, the same tuple in reverse order would not match the following descriptor: descriptors: - key: account_id descriptors: - key: plan value: BASIC rateLimit: requestsPerUnit: 1 unit: MINUTE - key: plan value: PLUS rateLimit: requestsPerUnit: 20 unit: MINUTE Similarly, the following setActions: - setActions: - requestHeaders: descriptorKey: account_id headerName: x-account-id - requestHeaders: descriptorKey: plan headerName: x-plan define an unordered descriptor set like so: {('account_id', ''), ('plan', '')} This set would match the following setDescriptor: setDescriptors: - simpleDescriptors: - key: plan value: BASIC - key: account_id rateLimit: requestsPerUnit: 20 unit: MINUTE It would also match the following setDescriptor which includes only a subset of the setActions enumerated: setDescriptors: - simpleDescriptors: - key: account_id rateLimit: requestsPerUnit: 20 unit: MINUTE It would even match the following setDescriptor. Any setActions list would match this setDescriptor which has simpleDescriptors omitted entirely: setDescriptors: - rateLimit: requestsPerUnit: 20 unit: MINUTE properties: actions: items: description: |- Copied directly from envoy https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v3-api-msg-config-route-v3-ratelimit-action oneOf: - not: anyOf: - required: - sourceCluster - required: - destinationCluster - required: - requestHeaders - required: - remoteAddress - required: - genericKey - required: - headerValueMatch - required: - metadata - required: - cel - required: - sourceCluster - required: - destinationCluster - required: - requestHeaders - required: - remoteAddress - required: - genericKey - required: - headerValueMatch - required: - metadata - required: - cel properties: cel: description: Rate limit on CEL expression. Only supported for agentgateway ratelimiting. properties: expression: description: The CEL expression to evaluate. type: string key: description: The key to use in the descriptor entry. type: string type: object destinationCluster: description: Rate limit on destination cluster. type: object genericKey: description: Rate limit on a generic key. properties: descriptorValue: description: The value to use in the descriptor entry. type: string type: object headerValueMatch: description: Rate limit on the existence of request headers. properties: descriptorValue: description: The value to use in the descriptor entry. type: string expectMatch: description: |- If set to true, the action will append a descriptor entry when the request matches the headers. If set to false, the action will append a descriptor entry when the request does not match the headers. The default value is true. nullable: true type: boolean headers: description: |- Specifies a set of headers that the rate limit action should match on. The action will check the request’s headers against all the specified headers in the config. A match will happen if all the headers in the config are present in the request with the same values (or based on presence if the value field is not in the config). items: oneOf: - not: anyOf: - required: - exactMatch - required: - regexMatch - required: - rangeMatch - required: - presentMatch - required: - prefixMatch - required: - suffixMatch - required: - exactMatch - required: - regexMatch - required: - rangeMatch - required: - presentMatch - required: - prefixMatch - required: - suffixMatch properties: exactMatch: description: If specified, header match will be performed based on the value of the header. type: string invertMatch: description: |- If specified, the match result will be inverted before checking. Defaults to false. Examples: * The regex *\d{3}* does not match the value *1234*, so it will match when inverted. * The range [-10,0) will match the value -1, so it will not match when inverted. type: boolean name: description: Specifies the name of the header in the request. type: string prefixMatch: description: |- If specified, header match will be performed based on the prefix of the header value. Note: empty prefix is not allowed, please use present_match instead. Examples: * The prefix *abcd* matches the value *abcdxyz*, but not for *abcxyz*. type: string presentMatch: description: |- If specified, header match will be performed based on whether the header is in the request. type: boolean rangeMatch: description: |- If specified, header match will be performed based on range. The rule will match if the request header value is within this range. The entire request header value must represent an integer in base 10 notation: consisting of an optional plus or minus sign followed by a sequence of digits. The rule will not match if the header value does not represent an integer. Match will fail for empty values, floating point numbers or if only a subsequence of the header value is an integer. Examples: * For range [-10,0), route will match for header value -1, but not for 0, "somestring", 10.9, "-1somestring" properties: end: description: end of the range (exclusive) format: int64 type: integer start: description: start of the range (inclusive) format: int64 type: integer type: object regexMatch: description: |- If specified, this regex string is a regular expression rule which implies the entire request header value must match the regex. The rule will not match if only a subsequence of the request header value matches the regex. The regex grammar used in the value field is defined `(here)[https://en.cppreference.com/w/cpp/regex/ecmascript]`. Examples: * The regex *\d{3}* matches the value *123* * The regex *\d{3}* does not match the value *1234* * The regex *\d{3}* does not match the value *123.456* type: string suffixMatch: description: |- If specified, header match will be performed based on the suffix of the header value. Note: empty suffix is not allowed, please use present_match instead. Examples: * The suffix *abcd* matches the value *xyzabcd*, but not for *xyzbcd*. type: string type: object type: array type: object metadata: description: Rate limit on metadata. properties: defaultValue: description: |- An optional value to use if *metadata_key* is empty. If not set and no value is present under the metadata_key then no descriptor is generated. type: string descriptorKey: description: Required. The key to use in the descriptor entry. type: string metadataKey: description: |- Required. Metadata struct that defines the key and path to retrieve the string value. A match will only happen if the value in the metadata is of type string. properties: key: description: |- Required. The key name of Metadata to retrieve the Struct from the metadata. Typically, it represents a builtin subsystem or custom extension. type: string path: description: |- Must have at least one element. The path to retrieve the Value from the Struct. It can be a prefix or a full path, e.g. ``[prop, xyz]`` for a struct or ``[prop, foo]`` for a string in the example, which depends on the particular scenario. Note: Due to that only the key type segment is supported, the path can not specify a list unless the list is the last segment. items: description: |- Specifies the segment in a path to retrieve value from Metadata. Currently it is only supported to specify the key, i.e. field name, as one segment of a path. oneOf: - not: anyOf: - required: - key - required: - key properties: key: description: Required. If specified, use the key to retrieve the value in a Struct. type: string type: object type: array type: object source: description: Source of metadata enum: - DYNAMIC - ROUTE_ENTRY type: string type: object remoteAddress: description: Rate limit on remote address. type: object requestHeaders: description: Rate limit on request headers. properties: descriptorKey: description: The key to use in the descriptor entry. type: string headerName: description: |- The header name to be queried from the request headers. The header’s value is used to populate the value of the descriptor entry for the descriptor_key. type: string type: object sourceCluster: description: Rate limit on source cluster. type: object type: object type: array limit: description: An optional limit override to be appended to the descriptor produced by this rate limit configuration. If the override value is invalid or cannot be resolved from metadata, no override is provided. oneOf: - not: anyOf: - required: - dynamicMetadata - required: - dynamicMetadata properties: dynamicMetadata: description: Limit override from dynamic metadata. properties: metadataKey: description: |- Metadata struct that defines the key and path to retrieve the struct value. The value must be a struct containing an integer "requests_per_unit" property and a "unit" property with a value parseable to :ref:`RateLimitUnit enum ` properties: key: description: |- Required. The key name of Metadata to retrieve the Struct from the metadata. Typically, it represents a builtin subsystem or custom extension. type: string path: description: |- Must have at least one element. The path to retrieve the Value from the Struct. It can be a prefix or a full path, e.g. ``[prop, xyz]`` for a struct or ``[prop, foo]`` for a string in the example, which depends on the particular scenario. Note: Due to that only the key type segment is supported, the path can not specify a list unless the list is the last segment. items: description: |- Specifies the segment in a path to retrieve value from Metadata. Currently it is only supported to specify the key, i.e. field name, as one segment of a path. oneOf: - not: anyOf: - required: - key - required: - key properties: key: description: Required. If specified, use the key to retrieve the value in a Struct. type: string type: object type: array type: object type: object type: object setActions: items: description: |- Copied directly from envoy https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v3-api-msg-config-route-v3-ratelimit-action oneOf: - not: anyOf: - required: - sourceCluster - required: - destinationCluster - required: - requestHeaders - required: - remoteAddress - required: - genericKey - required: - headerValueMatch - required: - metadata - required: - cel - required: - sourceCluster - required: - destinationCluster - required: - requestHeaders - required: - remoteAddress - required: - genericKey - required: - headerValueMatch - required: - metadata - required: - cel properties: cel: description: Rate limit on CEL expression. Only supported for agentgateway ratelimiting. properties: expression: description: The CEL expression to evaluate. type: string key: description: The key to use in the descriptor entry. type: string type: object destinationCluster: description: Rate limit on destination cluster. type: object genericKey: description: Rate limit on a generic key. properties: descriptorValue: description: The value to use in the descriptor entry. type: string type: object headerValueMatch: description: Rate limit on the existence of request headers. properties: descriptorValue: description: The value to use in the descriptor entry. type: string expectMatch: description: |- If set to true, the action will append a descriptor entry when the request matches the headers. If set to false, the action will append a descriptor entry when the request does not match the headers. The default value is true. nullable: true type: boolean headers: description: |- Specifies a set of headers that the rate limit action should match on. The action will check the request’s headers against all the specified headers in the config. A match will happen if all the headers in the config are present in the request with the same values (or based on presence if the value field is not in the config). items: oneOf: - not: anyOf: - required: - exactMatch - required: - regexMatch - required: - rangeMatch - required: - presentMatch - required: - prefixMatch - required: - suffixMatch - required: - exactMatch - required: - regexMatch - required: - rangeMatch - required: - presentMatch - required: - prefixMatch - required: - suffixMatch properties: exactMatch: description: If specified, header match will be performed based on the value of the header. type: string invertMatch: description: |- If specified, the match result will be inverted before checking. Defaults to false. Examples: * The regex *\d{3}* does not match the value *1234*, so it will match when inverted. * The range [-10,0) will match the value -1, so it will not match when inverted. type: boolean name: description: Specifies the name of the header in the request. type: string prefixMatch: description: |- If specified, header match will be performed based on the prefix of the header value. Note: empty prefix is not allowed, please use present_match instead. Examples: * The prefix *abcd* matches the value *abcdxyz*, but not for *abcxyz*. type: string presentMatch: description: |- If specified, header match will be performed based on whether the header is in the request. type: boolean rangeMatch: description: |- If specified, header match will be performed based on range. The rule will match if the request header value is within this range. The entire request header value must represent an integer in base 10 notation: consisting of an optional plus or minus sign followed by a sequence of digits. The rule will not match if the header value does not represent an integer. Match will fail for empty values, floating point numbers or if only a subsequence of the header value is an integer. Examples: * For range [-10,0), route will match for header value -1, but not for 0, "somestring", 10.9, "-1somestring" properties: end: description: end of the range (exclusive) format: int64 type: integer start: description: start of the range (inclusive) format: int64 type: integer type: object regexMatch: description: |- If specified, this regex string is a regular expression rule which implies the entire request header value must match the regex. The rule will not match if only a subsequence of the request header value matches the regex. The regex grammar used in the value field is defined `(here)[https://en.cppreference.com/w/cpp/regex/ecmascript]`. Examples: * The regex *\d{3}* matches the value *123* * The regex *\d{3}* does not match the value *1234* * The regex *\d{3}* does not match the value *123.456* type: string suffixMatch: description: |- If specified, header match will be performed based on the suffix of the header value. Note: empty suffix is not allowed, please use present_match instead. Examples: * The suffix *abcd* matches the value *xyzabcd*, but not for *xyzbcd*. type: string type: object type: array type: object metadata: description: Rate limit on metadata. properties: defaultValue: description: |- An optional value to use if *metadata_key* is empty. If not set and no value is present under the metadata_key then no descriptor is generated. type: string descriptorKey: description: Required. The key to use in the descriptor entry. type: string metadataKey: description: |- Required. Metadata struct that defines the key and path to retrieve the string value. A match will only happen if the value in the metadata is of type string. properties: key: description: |- Required. The key name of Metadata to retrieve the Struct from the metadata. Typically, it represents a builtin subsystem or custom extension. type: string path: description: |- Must have at least one element. The path to retrieve the Value from the Struct. It can be a prefix or a full path, e.g. ``[prop, xyz]`` for a struct or ``[prop, foo]`` for a string in the example, which depends on the particular scenario. Note: Due to that only the key type segment is supported, the path can not specify a list unless the list is the last segment. items: description: |- Specifies the segment in a path to retrieve value from Metadata. Currently it is only supported to specify the key, i.e. field name, as one segment of a path. oneOf: - not: anyOf: - required: - key - required: - key properties: key: description: Required. If specified, use the key to retrieve the value in a Struct. type: string type: object type: array type: object source: description: Source of metadata enum: - DYNAMIC - ROUTE_ENTRY type: string type: object remoteAddress: description: Rate limit on remote address. type: object requestHeaders: description: Rate limit on request headers. properties: descriptorKey: description: The key to use in the descriptor entry. type: string headerName: description: |- The header name to be queried from the request headers. The header’s value is used to populate the value of the descriptor entry for the descriptor_key. type: string type: object sourceCluster: description: Rate limit on source cluster. type: object type: object type: array type: description: |- Optional type defining the rate limit metric, such as requests or token counts. The TOKEN type is only relevant for AI backends that emit a token count and is used by agentgateway. Defaults to REQUEST if not specified. enum: - REQUEST - TOKEN type: string type: object type: array type: object serverSettings: description: |- Reference to the RatelimitServerSettings to use for this policy. Currently routes on a single VirtualGateway or destination must share a single RatelimitServerSettings. If none is provided, the default Gloo RatelimitServerSettings will be used. properties: cluster: description: the cluster of the object. If omitted, Gloo Mesh will use the same cluster as the parent object containing this reference. type: string name: description: the name of the object type: string namespace: description: the namespace of the object. If omitted, Gloo Mesh will use the same namespace as the parent object containing this reference. type: string type: object type: object type: object status: description: The status of the policy after it is applied to your Gloo environment. properties: common: description: The state and workspace conditions of the applied resource. properties: State: properties: approval: description: |- Whether the resource has been accepted as valid and processed in the Gloo Mesh config translation. enum: - PENDING - ACCEPTED - INVALID - WARNING - FAILED - UNLICENSED type: string message: description: Additional information about the current state of the resource. type: string observedGeneration: description: |- The most recent generation observed in the object's metadata. If the `observedGeneration` does not match `metadata.generation`, Gloo Mesh has not processed the most recent version of this object. format: int64 type: integer type: object workspaceConditions: additionalProperties: maximum: 4294967295 minimum: 0 type: integer description: |- A map of ApprovalState to the number of workspaces in this condition, e.g., "Accepted" -> 2 "Pending" -> 1 type: object type: object destinationServer: description: The rate limit server specified by the `server_settings`. oneOf: - not: anyOf: - required: - ref - required: - awsLambda - required: - ref - required: - awsLambda properties: awsLambda: description: Reference an AWS Lambda function. properties: cloudProvider: description: Reference to the AWS Cloud Provider. properties: cluster: description: the cluster of the object. If omitted, Gloo Mesh will use the same cluster as the parent object containing this reference. type: string name: description: the name of the object type: string namespace: description: the namespace of the object. If omitted, Gloo Mesh will use the same namespace as the parent object containing this reference. type: string type: object function: description: Name of the function to reference. type: string options: description: |- Specify how the destinations should be configured, for configuring lambda functions. If the destination config is required for the destination and not provided by the user, Gloo will invalidate the destination and its parent resources. properties: invocationStyle: description: |- Can be either Sync or Async. See [AWS Invoke](https://docs.aws.amazon.com/lambda/latest/dg/API_Invoke.html) for more details. enum: - SYNC - ASYNC type: string requestTransformation: enum: - REQUEST_DEFAULT - REQUEST_DISABLE type: string responseTransformation: enum: - RESPONSE_DEFAULT - RESPONSE_DISABLE type: string type: object qualifier: description: Qualifier of the function to reference. Defaults to $LATEST type: string type: object kind: description: |- the kind of Kubernetes destination being referenced. defaults to Service. Only applicable for Kubernetes destinations. For non Kubernetes destinations, this field is ignored. enum: - SERVICE - VIRTUAL_DESTINATION - EXTERNAL_SERVICE type: string port: description: the port on the destination object being targeted. required if the object provides more than one port. oneOf: - not: anyOf: - required: - number - required: - name - required: - number - required: - name properties: name: description: the name of the port on the destination objects being targeted. type: string number: description: the number of the port on the destination objects being targeted. maximum: 65535 minimum: 1 type: integer type: object ref: description: reference to a Kubernetes destination object by its metadata properties: cluster: description: the cluster of the object. If omitted, Gloo Mesh will use the same cluster as the parent object containing this reference. type: string name: description: the name of the object type: string namespace: description: the namespace of the object. If omitted, Gloo Mesh will use the same namespace as the parent object containing this reference. type: string type: object subset: additionalProperties: type: string description: |- select a subset of the destination's endpoints for routing based on their labels. Only applicable for Kubernetes destinations. type: object weight: description: |- Specify the proportion of traffic to be forwarded to this destination. Weights across all of the `destinations` must sum to 100. Weight is only relevant when used in the context of a route with multiple destinations. maximum: 4294967295 minimum: 0 type: integer type: object numSelectedDestinationPorts: description: The number of destination ports selected by the policy. maximum: 4294967295 minimum: 0 type: integer numSelectedRoutes: description: The number of routes selected by the policy. maximum: 4294967295 minimum: 0 type: integer type: object type: object served: true storage: true subresources: status: {} --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: crd.solo.io/specHash: bb0f59b148b47a5c crd.solo.io/version: 2.14.0 labels: app: gloo-mesh-apis app.kubernetes.io/name: gloo-mesh-apis name: transformationpolicies.trafficcontrol.policy.gloo.solo.io spec: group: trafficcontrol.policy.gloo.solo.io names: categories: - solo-io kind: TransformationPolicy listKind: TransformationPolicyList plural: transformationpolicies shortNames: - tp singular: transformationpolicy scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .status.common.State.approval name: Status type: string name: v2 schema: openAPIV3Schema: properties: spec: description: |- TransformationPolicy is used to transform HTTP requests and responses matching selected routes. TransformationPolicies are applied at the *Route* level. properties: applyToRoutes: description: |- Routes to apply the policy to. If empty, the policy applies to all routes in the workspace. items: description: |- RouteSelector is a Selector specifically built for individual Routes inside of RouteTables. This selector can be used to select individual routes or entire route tables using the same label selector. oneOf: - not: anyOf: - required: - route - required: - withDestinations - required: - route - required: - withDestinations properties: route: description: |- select routes based on their labels. these labels can be used to match route tables or individual routes within route tables. properties: cluster: description: Only select routes attached to route tables matching the cluster. type: string labels: additionalProperties: type: string description: Select routes including all specified labels on the route or route table. type: object namespace: description: Only select routes attached to route tables matching the namespace. type: string workspace: description: Only select routes attached to route tables matching the workspace. type: string type: object withDestinations: description: |- select routes with `forwardTo` actions based on their destinations. this can be used to apply policy to routes regardless of their labels properties: kind: description: The kind of destination being selected. defaults to Kubernetes Service. enum: - SERVICE - VIRTUAL_DESTINATION - EXTERNAL_SERVICE type: string port: description: |- The port on the Destination which receives traffic. All ports on the Destination will be selected if left empty. oneOf: - not: anyOf: - required: - number - required: - name - required: - number - required: - name properties: name: description: the name of the port on the destination objects being targeted. type: string number: description: the number of the port on the destination objects being targeted. maximum: 65535 minimum: 1 type: integer type: object selector: description: The selector used to match destination objects by their metadata properties: cluster: description: |- Only select objects in the matching cluster. If omitted, Gloo selects matching objects across all clusters available in the parent object's workspace. type: string labels: additionalProperties: type: string description: labels matching those of the object type: object name: description: |- Only select objects with the matching name. If omitted, Gloo selects matching objects with any name available in the parent object's workspace. type: string namespace: description: |- Only select objects in the matching namespace. If omitted, Gloo selects matching objects across all namespaces available in the parent object's workspace. type: string workspace: description: |- Only select objects in the given workspace. If omitted, Gloo selects matching objects across all workspaces available in the parent object's workspace. type: string type: object type: object type: object type: array config: description: The details of the transformation policy to apply to the selected routes. properties: phase: description: |- Specify the phase to indicate where this policy should be applied relative to other policies. If no phase is specified, the default will be post AuthZ. oneOf: - not: anyOf: - required: - preAuthz - required: - postAuthz - required: - preAuthz - required: - postAuthz properties: postAuthz: description: Apply this policy after Authorization policies are applied. properties: priority: description: |- The priority at which this policy should be applied relative to other policies defined in the same phase. The lowest priority will be run first and the default priority value is 0. For information about the value format, see the [Google protocol buffer documentation](https://protobuf.dev/reference/protobuf/google.protobuf/#int32-value). maximum: 2147483647 minimum: -2147483648 nullable: true type: integer type: object preAuthz: description: Apply this policy before Authorization policies are applied. properties: priority: description: |- The priority at which this policy should be applied relative to other policies defined in the same phase. The lowest priority will be run first and the default priority value is 0. For information about the value format, see the [Google protocol buffer documentation](https://protobuf.dev/reference/protobuf/google.protobuf/#int32-value). maximum: 2147483647 minimum: -2147483648 nullable: true type: integer type: object type: object request: description: Transformation to be applied before the request is sent to the upstream service. properties: injaTemplate: description: |- Transform HTTP body and headers using Inja templates. Note that the dynamicMetadataValues.jsonToProto subfield is only supported by Istio versions 1.22 and later. For more information, see the [Envoy `transformation_filter.proto`](https://github.com/solo-io/envoy-gloo/blob/master/api/envoy/config/filter/http/transformation/v2/transformation_filter.proto#L155). oneOf: - not: anyOf: - required: - body - required: - passthrough - required: - mergeExtractorsToBody - required: - body - required: - passthrough - required: - mergeExtractorsToBody properties: advancedTemplates: description: |- If set to true, use JSON pointer notation (e.g. "time/start") instead of dot notation (e.g. "time.start") to access JSON elements. Defaults to false. Please note that, if set to 'true', you will need to use the `extraction` function to access extractors in the template (e.g. '{{ extraction("my_extractor") }}'); if the default value of 'false' is used, extractors will simply be available by their name (e.g. '{{ my_extractor }}'). type: boolean body: description: Apply a template to the body properties: text: type: string type: object dynamicMetadataValues: description: Use this field to set Dynamic Metadata. items: description: |- Defines an [Envoy Dynamic Metadata](https://www.envoyproxy.io/docs/envoy/latest/configuration/advanced/well_known_dynamic_metadata) entry. properties: jsonToProto: description: Unused to be implemented in 1.30 type: boolean key: description: The metadata key. type: string metadataNamespace: description: The metadata namespace. Defaults to the filter namespace. type: string value: description: A template that determines the metadata value. properties: text: type: string type: object type: object type: array escapeCharacters: description: |- Use to escape the output of a body transformation. This will cause rendered string values to be escaped in order to make valid JSON/YAML strings type: boolean extractors: additionalProperties: oneOf: - not: anyOf: - required: - header - required: - body - required: - header - required: - body properties: body: description: Extract information from the request/response body maxProperties: 0 type: object header: description: Extract information from headers type: string mode: description: |- The mode of operation for the extraction. Defaults to EXTRACT. enum: - EXTRACT - SINGLE_REPLACE - REPLACE_ALL type: string regex: description: |- The regex field specifies the regular expression used for matching against the source content. This field is required. - In EXTRACT mode, the entire source must match the regex. The subgroup-th capturing group, if specified, determines which part of the match is extracted. if the regex does not match the source the result of the extraction will be an empty value. - In SINGLE_REPLACE mode, the regex also needs to match the entire source. The subgroup-th capturing group is targeted for replacement with the replacement_text. if the regex does not match the source the result of the extraction will be the source itself. - In REPLACE_ALL mode, the regex is applied repeatedly to find all occurrences within the source that match. Each matching occurrence is replaced with the replacement_text, and the subgroup field is not used. if the regex does not match the source the result of the extraction will be the source itself. type: string replacementText: description: |- Used in SINGLE_REPLACE and REPLACE_ALL modes. `replacement_text` is used to format the substitution for matched sequences in the input string - In SINGLE_REPLACE mode, the content in the subgroup-th capturing group is replaced with the `replacement_text`. - In REPLACE_ALL mode, each sequence matching the specified regex in the in the input is replaced with the `replacement_text`. The replacement_text may contain special syntax, such as $1, $2, etc., to refer to captured groups within the regular expression. The value contained within `replacement_text` is treated as a string, and is passed to std::regex_replace as the replacement string. see https://en.cppreference.com/w/cpp/regex/regex_replace for more details. nullable: true type: string subgroup: description: |- If your regex contains capturing groups, use this field to determine which group should be selected. For EXTRACT and SINGLE_REPLACE, refers to the portion of the text to extract/replace. Config will be rejected if this is specified in REPLACE_ALL mode. maximum: 4294967295 minimum: 0 type: integer type: object description: |- Use this attribute to extract information from the request. It consists of a map of strings to extractors. The extractor will defines which information will be extracted, while the string key will provide the extractor with a name. You can reference extractors by their name in templates, e.g. "{{ my-extractor }}" will render to the value of the "my-extractor" extractor. type: object headers: additionalProperties: properties: text: type: string type: object description: |- Use this attribute to transform request/response headers. It consists of a map of strings to templates. The string key determines the name of the resulting header, the rendered template will determine the value. Any existing headers with the same header name will be replaced by the transformed header. If a header name is included in `headers` and `headers_to_append`, it will first be replaced the template in `headers`, then additional header values will be appended by the templates defined in `headers_to_append`. type: object headersToAppend: description: |- Use this attribute to transform request/response headers. It consists of an array of string/template objects. Use this attribute to define multiple templates for a single header. Header template(s) defined here will be appended to any existing headers with the same header name, not replace existing ones. items: description: Defines a header-template pair to be used in `headers_to_append` properties: key: description: Header name type: string value: description: Apply a template to the header value properties: text: type: string type: object type: object type: array headersToRemove: items: type: string type: array ignoreErrorOnParse: description: |- If set to true, Envoy will not throw an exception in case the body parsing fails. type: boolean mergeExtractorsToBody: description: |- Merge all defined extractors to the request/response body. If you want to nest elements inside the body, use dot separator in the extractor name. type: object parseBodyBehavior: enum: - ParseAsJson - DontParse type: string passthrough: description: |- This will cause the transformation filter not to buffer the body. Use this setting if the response body is large and you don't need to transform nor extract information from it. type: object type: object recalculateRoutingDestination: description: |- If set to **true**, recalculate the routing destination and select a new route for transformed requests. For example, if you have a request that is transformed to match a new route, the new route is selected when calculating the routing destination. The default value is **false**. type: boolean type: object response: description: Transform the response received from the upstream service before returning it to the client. properties: injaTemplate: description: |- Transform response body and headers using Inja templates. Note that the dynamicMetadataValues.jsonToProto subfield is only supported by Istio versions 1.22 and later. For more information, see the [Envoy `transformation_filter.proto`](https://github.com/solo-io/envoy-gloo/blob/master/api/envoy/config/filter/http/transformation/v2/transformation_filter.proto#L155). oneOf: - not: anyOf: - required: - body - required: - passthrough - required: - mergeExtractorsToBody - required: - body - required: - passthrough - required: - mergeExtractorsToBody properties: advancedTemplates: description: |- If set to true, use JSON pointer notation (e.g. "time/start") instead of dot notation (e.g. "time.start") to access JSON elements. Defaults to false. Please note that, if set to 'true', you will need to use the `extraction` function to access extractors in the template (e.g. '{{ extraction("my_extractor") }}'); if the default value of 'false' is used, extractors will simply be available by their name (e.g. '{{ my_extractor }}'). type: boolean body: description: Apply a template to the body properties: text: type: string type: object dynamicMetadataValues: description: Use this field to set Dynamic Metadata. items: description: |- Defines an [Envoy Dynamic Metadata](https://www.envoyproxy.io/docs/envoy/latest/configuration/advanced/well_known_dynamic_metadata) entry. properties: jsonToProto: description: Unused to be implemented in 1.30 type: boolean key: description: The metadata key. type: string metadataNamespace: description: The metadata namespace. Defaults to the filter namespace. type: string value: description: A template that determines the metadata value. properties: text: type: string type: object type: object type: array escapeCharacters: description: |- Use to escape the output of a body transformation. This will cause rendered string values to be escaped in order to make valid JSON/YAML strings type: boolean extractors: additionalProperties: oneOf: - not: anyOf: - required: - header - required: - body - required: - header - required: - body properties: body: description: Extract information from the request/response body maxProperties: 0 type: object header: description: Extract information from headers type: string mode: description: |- The mode of operation for the extraction. Defaults to EXTRACT. enum: - EXTRACT - SINGLE_REPLACE - REPLACE_ALL type: string regex: description: |- The regex field specifies the regular expression used for matching against the source content. This field is required. - In EXTRACT mode, the entire source must match the regex. The subgroup-th capturing group, if specified, determines which part of the match is extracted. if the regex does not match the source the result of the extraction will be an empty value. - In SINGLE_REPLACE mode, the regex also needs to match the entire source. The subgroup-th capturing group is targeted for replacement with the replacement_text. if the regex does not match the source the result of the extraction will be the source itself. - In REPLACE_ALL mode, the regex is applied repeatedly to find all occurrences within the source that match. Each matching occurrence is replaced with the replacement_text, and the subgroup field is not used. if the regex does not match the source the result of the extraction will be the source itself. type: string replacementText: description: |- Used in SINGLE_REPLACE and REPLACE_ALL modes. `replacement_text` is used to format the substitution for matched sequences in the input string - In SINGLE_REPLACE mode, the content in the subgroup-th capturing group is replaced with the `replacement_text`. - In REPLACE_ALL mode, each sequence matching the specified regex in the in the input is replaced with the `replacement_text`. The replacement_text may contain special syntax, such as $1, $2, etc., to refer to captured groups within the regular expression. The value contained within `replacement_text` is treated as a string, and is passed to std::regex_replace as the replacement string. see https://en.cppreference.com/w/cpp/regex/regex_replace for more details. nullable: true type: string subgroup: description: |- If your regex contains capturing groups, use this field to determine which group should be selected. For EXTRACT and SINGLE_REPLACE, refers to the portion of the text to extract/replace. Config will be rejected if this is specified in REPLACE_ALL mode. maximum: 4294967295 minimum: 0 type: integer type: object description: |- Use this attribute to extract information from the request. It consists of a map of strings to extractors. The extractor will defines which information will be extracted, while the string key will provide the extractor with a name. You can reference extractors by their name in templates, e.g. "{{ my-extractor }}" will render to the value of the "my-extractor" extractor. type: object headers: additionalProperties: properties: text: type: string type: object description: |- Use this attribute to transform request/response headers. It consists of a map of strings to templates. The string key determines the name of the resulting header, the rendered template will determine the value. Any existing headers with the same header name will be replaced by the transformed header. If a header name is included in `headers` and `headers_to_append`, it will first be replaced the template in `headers`, then additional header values will be appended by the templates defined in `headers_to_append`. type: object headersToAppend: description: |- Use this attribute to transform request/response headers. It consists of an array of string/template objects. Use this attribute to define multiple templates for a single header. Header template(s) defined here will be appended to any existing headers with the same header name, not replace existing ones. items: description: Defines a header-template pair to be used in `headers_to_append` properties: key: description: Header name type: string value: description: Apply a template to the header value properties: text: type: string type: object type: object type: array headersToRemove: items: type: string type: array ignoreErrorOnParse: description: |- If set to true, Envoy will not throw an exception in case the body parsing fails. type: boolean mergeExtractorsToBody: description: |- Merge all defined extractors to the request/response body. If you want to nest elements inside the body, use dot separator in the extractor name. type: object parseBodyBehavior: enum: - ParseAsJson - DontParse type: string passthrough: description: |- This will cause the transformation filter not to buffer the body. Use this setting if the response body is large and you don't need to transform nor extract information from it. type: object type: object type: object type: object type: object status: properties: common: description: The state and workspace conditions of the applied resource. properties: State: properties: approval: description: |- Whether the resource has been accepted as valid and processed in the Gloo Mesh config translation. enum: - PENDING - ACCEPTED - INVALID - WARNING - FAILED - UNLICENSED type: string message: description: Additional information about the current state of the resource. type: string observedGeneration: description: |- The most recent generation observed in the object's metadata. If the `observedGeneration` does not match `metadata.generation`, Gloo Mesh has not processed the most recent version of this object. format: int64 type: integer type: object workspaceConditions: additionalProperties: maximum: 4294967295 minimum: 0 type: integer description: |- A map of ApprovalState to the number of workspaces in this condition, e.g., "Accepted" -> 2 "Pending" -> 1 type: object type: object numSelectedRoutes: description: The number of routes selected by the policy. maximum: 4294967295 minimum: 0 type: integer type: object type: object served: true storage: true subresources: status: {} ---