openapi: 3.1.0
info:
  title: Istio Extensions AuthorizationPolicy PeerAuthentication API
  description: The Istio Extensions API (extensions.istio.io) provides configuration resources for extending the Istio service mesh with custom functionality. The WasmPlugin resource enables deploying WebAssembly (Wasm) modules as plugins to the Envoy sidecar proxies, allowing custom processing of network traffic at various phases of the request lifecycle. These resources are defined as Kubernetes Custom Resource Definitions (CRDs) and are accessed via the Kubernetes API server.
  version: v1alpha1
  contact:
    name: Istio
    url: https://istio.io/
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
servers:
- url: https://{cluster}/apis/extensions.istio.io/v1alpha1
  description: Kubernetes API server endpoint for Istio Extensions v1alpha1
  variables:
    cluster:
      default: kubernetes.default.svc
      description: Kubernetes API server hostname
tags:
- name: PeerAuthentication
  description: Mutual TLS configuration for peer-to-peer communication
  externalDocs:
    url: https://istio.io/latest/docs/reference/config/security/peer_authentication/
paths:
  /namespaces/{namespace}/peerauthentications:
    get:
      operationId: listPeerAuthentications
      summary: Istio List PeerAuthentications
      description: List all PeerAuthentication resources in the specified namespace. A PeerAuthentication defines how traffic will be tunneled (or not) to the sidecar proxy, configuring mutual TLS mode for inbound connections.
      tags:
      - PeerAuthentication
      parameters:
      - $ref: '#/components/parameters/namespace'
      - $ref: '#/components/parameters/labelSelector'
      - $ref: '#/components/parameters/limit'
      - $ref: '#/components/parameters/continue'
      responses:
        '200':
          description: Successful response containing list of PeerAuthentications
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PeerAuthenticationList'
        '401':
          description: Unauthorized
    post:
      operationId: createPeerAuthentication
      summary: Istio Create a PeerAuthentication
      description: Create a new PeerAuthentication resource in the specified namespace.
      tags:
      - PeerAuthentication
      parameters:
      - $ref: '#/components/parameters/namespace'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PeerAuthentication'
      responses:
        '201':
          description: PeerAuthentication created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PeerAuthentication'
        '401':
          description: Unauthorized
        '409':
          description: Conflict
  /namespaces/{namespace}/peerauthentications/{name}:
    get:
      operationId: getPeerAuthentication
      summary: Istio Get a PeerAuthentication
      description: Read the specified PeerAuthentication resource.
      tags:
      - PeerAuthentication
      parameters:
      - $ref: '#/components/parameters/namespace'
      - $ref: '#/components/parameters/name'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PeerAuthentication'
        '401':
          description: Unauthorized
        '404':
          description: Not found
    put:
      operationId: replacePeerAuthentication
      summary: Istio Replace a PeerAuthentication
      description: Replace the specified PeerAuthentication resource.
      tags:
      - PeerAuthentication
      parameters:
      - $ref: '#/components/parameters/namespace'
      - $ref: '#/components/parameters/name'
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PeerAuthentication'
      responses:
        '200':
          description: PeerAuthentication replaced
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PeerAuthentication'
        '401':
          description: Unauthorized
        '404':
          description: Not found
    delete:
      operationId: deletePeerAuthentication
      summary: Istio Delete a PeerAuthentication
      description: Delete the specified PeerAuthentication resource.
      tags:
      - PeerAuthentication
      parameters:
      - $ref: '#/components/parameters/namespace'
      - $ref: '#/components/parameters/name'
      responses:
        '200':
          description: PeerAuthentication deleted
        '401':
          description: Unauthorized
        '404':
          description: Not found
components:
  parameters:
    labelSelector:
      name: labelSelector
      in: query
      description: A selector to restrict the list of returned objects by their labels
      schema:
        type: string
    continue:
      name: continue
      in: query
      description: Continue token for paginated list requests
      schema:
        type: string
    name:
      name: name
      in: path
      required: true
      description: The resource name
      schema:
        type: string
    namespace:
      name: namespace
      in: path
      required: true
      description: The Kubernetes namespace
      schema:
        type: string
    limit:
      name: limit
      in: query
      description: Maximum number of resources to return
      schema:
        type: integer
  schemas:
    PeerAuthentication:
      type: object
      properties:
        apiVersion:
          type: string
          enum:
          - security.istio.io/v1
        kind:
          type: string
          enum:
          - PeerAuthentication
        metadata:
          $ref: '#/components/schemas/ObjectMeta'
        spec:
          type: object
          properties:
            selector:
              type: object
              properties:
                matchLabels:
                  type: object
                  additionalProperties:
                    type: string
              description: Workload selector to apply the policy to specific workloads.
            mtls:
              type: object
              properties:
                mode:
                  type: string
                  enum:
                  - UNSET
                  - DISABLE
                  - PERMISSIVE
                  - STRICT
                  description: Defines the mTLS mode used for peer authentication. PERMISSIVE allows both plaintext and mTLS, STRICT requires mTLS, DISABLE turns off mTLS.
              description: Mutual TLS settings for workload-to-workload communication.
            portLevelMtls:
              type: object
              additionalProperties:
                type: object
                properties:
                  mode:
                    type: string
                    enum:
                    - UNSET
                    - DISABLE
                    - PERMISSIVE
                    - STRICT
              description: Port-specific mutual TLS settings.
    PeerAuthenticationList:
      type: object
      properties:
        apiVersion:
          type: string
        kind:
          type: string
          enum:
          - PeerAuthenticationList
        metadata:
          $ref: '#/components/schemas/ListMeta'
        items:
          type: array
          items:
            $ref: '#/components/schemas/PeerAuthentication'
    ObjectMeta:
      type: object
      properties:
        name:
          type: string
          description: Name of the resource
        namespace:
          type: string
          description: Namespace of the resource
        labels:
          type: object
          additionalProperties:
            type: string
        annotations:
          type: object
          additionalProperties:
            type: string
        creationTimestamp:
          type: string
          format: date-time
        resourceVersion:
          type: string
    ListMeta:
      type: object
      properties:
        resourceVersion:
          type: string
        continue:
          type: string
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      description: Kubernetes API server bearer token authentication
externalDocs:
  description: Istio Extensions Configuration Reference
  url: https://istio.io/latest/docs/reference/config/