--- swagger: '2.0' info: title: Cilium API description: Cilium version: v1beta1 x-schemes: - unix basePath: "/v1" produces: - application/json consumes: - application/json paths: "/cluster/nodes": get: summary: Get nodes information stored in the cilium-agent tags: - daemon parameters: - name: client-id description: | Client UUID should be used when the client wants to request a diff of nodes added and / or removed since the last time that client has made a request. in: header required: false type: integer responses: '200': description: Success schema: "$ref": "#/definitions/ClusterNodeStatus" "/healthz": get: summary: Get health of Cilium daemon description: | Returns health and status information of the Cilium daemon and related components such as the connected datastore, Kubernetes integration and Hubble. tags: - daemon parameters: - name: brief description: | Brief will return a brief representation of the Cilium status. in: header required: false type: boolean - name: require-k8s-connectivity description: | If set to true, failure of the agent to connect to the Kubernetes control plane will cause the agent's health status to also fail. in: header required: false type: boolean default: true responses: '200': description: Success schema: "$ref": "#/definitions/StatusResponse" "/config": get: summary: Get configuration of Cilium daemon description: | Returns the configuration of the Cilium daemon. tags: - daemon responses: '200': description: Success schema: "$ref": "#/definitions/DaemonConfiguration" patch: summary: Modify daemon configuration description: | Updates the daemon configuration by applying the provided ConfigurationMap and regenerates & recompiles all required datapath components. tags: - daemon parameters: - name: configuration in: body required: true schema: "$ref": "#/definitions/DaemonConfigurationSpec" responses: '200': description: Success '400': description: Bad configuration parameters schema: "$ref": "#/definitions/Error" '403': description: Forbidden '500': description: Recompilation failed x-go-name: Failure schema: "$ref": "#/definitions/Error" "/endpoint/{id}": get: summary: Get endpoint by endpoint ID description: | Returns endpoint information tags: - endpoint parameters: - "$ref": "#/parameters/endpoint-id" responses: '200': description: Success schema: "$ref": "#/definitions/Endpoint" '400': description: Invalid endpoint ID format for specified type x-go-name: Invalid schema: "$ref": "#/definitions/Error" '404': description: Endpoint not found '429': description: Rate-limiting too many requests in the given time frame put: summary: Create endpoint description: | Creates a new endpoint tags: - endpoint parameters: - "$ref": "#/parameters/endpoint-id" - "$ref": "#/parameters/endpoint-change-request" responses: '201': description: Created schema: "$ref": "#/definitions/Endpoint" '400': description: Invalid endpoint in request x-go-name: Invalid schema: "$ref": "#/definitions/Error" '403': description: Forbidden '409': description: Endpoint already exists x-go-name: Exists '500': description: Endpoint creation failed x-go-name: Failed schema: "$ref": "#/definitions/Error" '429': description: Rate-limiting too many requests in the given time frame '503': description: Service Unavailable patch: summary: Modify existing endpoint deprecated: true description: | Applies the endpoint change request to an existing endpoint tags: - endpoint parameters: - "$ref": "#/parameters/endpoint-id" - "$ref": "#/parameters/endpoint-change-request" responses: '200': description: Success '400': description: Invalid modify endpoint request x-go-name: Invalid schema: "$ref": "#/definitions/Error" '403': description: Forbidden '404': description: Endpoint does not exist '500': description: Endpoint update failed x-go-name: Failed schema: "$ref": "#/definitions/Error" '429': description: Rate-limiting too many requests in the given time frame '503': description: Service Unavailable delete: summary: Delete endpoint description: | Deletes the endpoint specified by the ID. Deletion is imminent and atomic, if the deletion request is valid and the endpoint exists, deletion will occur even if errors are encountered in the process. If errors have been encountered, the code 202 will be returned, otherwise 200 on success. All resources associated with the endpoint will be freed and the workload represented by the endpoint will be disconnected.It will no longer be able to initiate or receive communications of any sort. tags: - endpoint parameters: - "$ref": "#/parameters/endpoint-id" responses: '200': description: Success '206': description: Deleted with a number of errors encountered x-go-name: Errors schema: type: integer '400': description: | Invalid endpoint ID format for specified type. Details in error message x-go-name: Invalid schema: "$ref": "#/definitions/Error" '403': description: Forbidden '404': description: Endpoint not found '429': description: Rate-limiting too many requests in the given time frame '503': description: Service Unavailable "/endpoint": get: summary: Retrieves a list of endpoints that have metadata matching the provided parameters. description: | Retrieves a list of endpoints that have metadata matching the provided parameters, or all endpoints if no parameters provided. tags: - endpoint parameters: - "$ref": "#/parameters/labels" responses: '200': description: Success schema: type: array items: "$ref": "#/definitions/Endpoint" '404': description: Endpoints with provided parameters not found '429': description: Rate-limiting too many requests in the given time frame delete: summary: Deletes a list of endpoints description: | Deletes a list of endpoints that have endpoints matching the provided properties tags: - endpoint parameters: - "$ref": "#/parameters/endpoint-batch-delete-request" responses: '200': description: Success '206': description: Deleted with a number of errors encountered x-go-name: Errors schema: type: integer '400': description: Invalid endpoint delete request x-go-name: Invalid '404': description: No endpoints with provided parameters found '429': description: Rate-limiting too many requests in the given time frame '503': description: Service Unavailable "/endpoint/{id}/config": get: summary: Retrieve endpoint configuration description: | Retrieves the configuration of the specified endpoint. tags: - endpoint parameters: - "$ref": "#/parameters/endpoint-id" responses: '200': description: Success schema: "$ref": "#/definitions/EndpointConfigurationStatus" '404': description: Endpoint not found '429': description: Rate-limiting too many requests in the given time frame patch: summary: Modify mutable endpoint configuration description: | Update the configuration of an existing endpoint and regenerates & recompiles the corresponding programs automatically. tags: - endpoint parameters: - "$ref": "#/parameters/endpoint-id" - name: endpoint-configuration in: body required: true schema: "$ref": "#/definitions/EndpointConfigurationSpec" responses: '200': description: Success '400': description: Invalid configuration request x-go-name: Invalid '403': description: Forbidden '404': description: Endpoint not found '500': description: Update failed. Details in message. x-go-name: Failed schema: "$ref": "#/definitions/Error" '429': description: Rate-limiting too many requests in the given time frame '503': description: Service Unavailable "/endpoint/{id}/labels": get: summary: Retrieves the list of labels associated with an endpoint. tags: - endpoint parameters: - "$ref": "#/parameters/endpoint-id" responses: '200': description: Success schema: "$ref": "#/definitions/LabelConfiguration" '404': description: Endpoint not found '429': description: Rate-limiting too many requests in the given time frame patch: summary: Set label configuration of endpoint description: | Sets labels associated with an endpoint. These can be user provided or derived from the orchestration system. tags: - endpoint parameters: - "$ref": "#/parameters/endpoint-id" - name: configuration in: body required: true schema: "$ref": "#/definitions/LabelConfigurationSpec" responses: '200': description: Success '403': description: Forbidden '404': description: Endpoint not found '500': description: Error while updating labels x-go-name: UpdateFailed schema: "$ref": "#/definitions/Error" '429': description: Rate-limiting too many requests in the given time frame '503': description: Service Unavailable "/endpoint/{id}/log": get: summary: Retrieves the status logs associated with this endpoint. tags: - endpoint parameters: - "$ref": "#/parameters/endpoint-id" responses: '200': description: Success schema: "$ref": "#/definitions/EndpointStatusLog" '400': description: Invalid identity provided x-go-name: Invalid '404': description: Endpoint not found '429': description: Rate-limiting too many requests in the given time frame "/endpoint/{id}/healthz": get: summary: Retrieves the status logs associated with this endpoint. tags: - endpoint parameters: - "$ref": "#/parameters/endpoint-id" responses: '200': description: Success schema: "$ref": "#/definitions/EndpointHealth" '400': description: Invalid identity provided x-go-name: Invalid '404': description: Endpoint not found '429': description: Rate-limiting too many requests in the given time frame "/identity": get: summary: Retrieves a list of identities that have metadata matching the provided parameters. description: | Retrieves a list of identities that have metadata matching the provided parameters, or all identities if no parameters are provided. tags: - policy parameters: - "$ref": "#/parameters/labels" responses: '200': description: Success schema: type: array items: "$ref": "#/definitions/Identity" '404': description: Identities with provided parameters not found '520': description: Identity storage unreachable. Likely a network problem. x-go-name: Unreachable schema: "$ref": "#/definitions/Error" '521': description: Invalid identity format in storage x-go-name: InvalidStorageFormat schema: "$ref": "#/definitions/Error" "/identity/{id}": get: summary: Retrieve identity tags: - policy parameters: - "$ref": "#/parameters/identity-id" responses: '200': description: Success schema: "$ref": "#/definitions/Identity" '400': description: Invalid identity provided '404': description: Identity not found '520': description: Identity storage unreachable. Likely a network problem. x-go-name: Unreachable schema: "$ref": "#/definitions/Error" '521': description: Invalid identity format in storage x-go-name: InvalidStorageFormat schema: "$ref": "#/definitions/Error" "/identity/endpoints": get: summary: Retrieve identities which are being used by local endpoints tags: - policy responses: '200': description: Success schema: type: array items: "$ref": "#/definitions/IdentityEndpoints" '404': description: Set of identities which are being used by local endpoints could not be found. "/ipam": post: summary: Allocate an IP address tags: - ipam parameters: - "$ref": "#/parameters/ipam-family" - "$ref": "#/parameters/ipam-owner" - "$ref": "#/parameters/ipam-pool" - "$ref": "#/parameters/ipam-expiration" responses: '201': description: Success schema: "$ref": "#/definitions/IPAMResponse" '403': description: Forbidden '502': description: Allocation failure x-go-name: Failure schema: "$ref": "#/definitions/Error" "/ipam/{ip}": post: summary: Allocate an IP address tags: - ipam parameters: - "$ref": "#/parameters/ipam-ip" - "$ref": "#/parameters/ipam-owner" - "$ref": "#/parameters/ipam-pool" responses: '200': description: Success '400': description: Invalid IP address x-go-name: Invalid '403': description: Forbidden '409': description: IP already allocated x-go-name: Exists '500': description: IP allocation failure. Details in message. x-go-name: Failure schema: "$ref": "#/definitions/Error" '501': description: Allocation for address family disabled x-go-name: Disabled delete: summary: Release an allocated IP address tags: - ipam parameters: - "$ref": "#/parameters/ipam-ip" - "$ref": "#/parameters/ipam-pool" responses: '200': description: Success '400': description: Invalid IP address x-go-name: Invalid '403': description: Forbidden '404': description: IP address not found '500': description: Address release failure x-go-name: Failure schema: "$ref": "#/definitions/Error" '501': description: Allocation for address family disabled x-go-name: Disabled "/policy": get: summary: Retrieve entire policy tree description: | Returns the entire policy tree with all children. Deprecated: will be removed in v1.19 deprecated: true tags: - policy responses: '200': description: Success schema: "$ref": "#/definitions/Policy" '404': description: No policy rules found "/policy/selectors": get: summary: See what selectors match which identities tags: - policy responses: '200': description: Success schema: "$ref": "#/definitions/SelectorCache" "/policy/subject-selectors": get: summary: See what subject selectors match which identities on the local node tags: - policy responses: '200': description: Success schema: "$ref": "#/definitions/SelectorCache" "/lrp": get: summary: Retrieve list of all local redirect policies tags: - service responses: '200': description: Success schema: type: array items: "$ref": "#/definitions/LRPSpec" "/service": get: summary: Retrieve list of all services tags: - service responses: '200': description: Success schema: type: array items: "$ref": "#/definitions/Service" "/prefilter": get: summary: Retrieve list of CIDRs description: | Deprecated: This will be removed in the future. deprecated: true tags: - prefilter responses: '200': description: Success schema: "$ref": "#/definitions/Prefilter" '500': description: Prefilter get failed x-go-name: Failure schema: "$ref": "#/definitions/Error" patch: summary: Update list of CIDRs description: | Deprecated: This will be removed in the future. deprecated: true tags: - prefilter parameters: - "$ref": "#/parameters/prefilter-spec" responses: '200': description: Updated schema: "$ref": "#/definitions/Prefilter" '403': description: Forbidden '461': description: Invalid CIDR prefix x-go-name: InvalidCIDR schema: "$ref": "#/definitions/Error" '500': description: Prefilter update failed x-go-name: Failure schema: "$ref": "#/definitions/Error" delete: summary: Delete list of CIDRs description: | Deprecated: This will be removed in the future. deprecated: true tags: - prefilter parameters: - "$ref": "#/parameters/prefilter-spec" responses: '200': description: Deleted schema: "$ref": "#/definitions/Prefilter" '403': description: Forbidden '461': description: Invalid CIDR prefix x-go-name: InvalidCIDR schema: "$ref": "#/definitions/Error" '500': description: Prefilter delete failed x-go-name: Failure schema: "$ref": "#/definitions/Error" "/debuginfo": get: summary: Retrieve information about the agent and environment for debugging tags: - daemon responses: '200': description: Success schema: "$ref": "#/definitions/DebugInfo" '500': description: DebugInfo get failed x-go-name: Failure schema: "$ref": "#/definitions/Error" "/cgroup-dump-metadata": get: summary: Retrieve cgroup metadata for all pods tags: - daemon responses: '200': description: Success schema: "$ref": "#/definitions/CgroupDumpMetadata" '500': description: CgroupDumpMetadata get failed x-go-name: Failure schema: "$ref": "#/definitions/Error" "/map": get: summary: List all open maps tags: - daemon responses: '200': description: Success schema: "$ref": "#/definitions/BPFMapList" "/map/{name}": get: summary: Retrieve contents of BPF map tags: - daemon parameters: - "$ref": "#/parameters/map-name" responses: '200': description: Success schema: "$ref": "#/definitions/BPFMap" '404': description: Map not found "/map/{name}/events": get: summary: Retrieves the recent event logs associated with this endpoint. tags: - daemon parameters: - "$ref": "#/parameters/map-name" - "$ref": "#/parameters/follow" responses: '200': description: Success schema: type: string format: binary '404': description: Map not found "/fqdn/cache": get: summary: Retrieves the list of DNS lookups intercepted from all endpoints. description: | Retrieves the list of DNS lookups intercepted from endpoints, optionally filtered by DNS name, CIDR IP range or source. tags: - policy parameters: - "$ref": "#/parameters/matchpattern" - "$ref": "#/parameters/cidr" - "$ref": "#/parameters/source" responses: '200': description: Success schema: type: array items: "$ref": "#/definitions/DNSLookup" '400': description: Invalid request (error parsing parameters) schema: "$ref": "#/definitions/Error" '404': description: No DNS data with provided parameters found delete: summary: Deletes matching DNS lookups from the policy-generation cache. description: | Deletes matching DNS lookups from the cache, optionally restricted by DNS name. The removed IP data will no longer be used in generated policies. tags: - policy parameters: - "$ref": "#/parameters/matchpattern" responses: '200': description: Success '403': description: Forbidden '400': description: Invalid request (error parsing parameters) schema: "$ref": "#/definitions/Error" "/fqdn/cache/{id}": get: summary: Retrieves the list of DNS lookups intercepted from an endpoint. description: | Retrieves the list of DNS lookups intercepted from the specific endpoint, optionally filtered by endpoint id, DNS name, CIDR IP range or source. tags: - policy parameters: - "$ref": "#/parameters/endpoint-id" - "$ref": "#/parameters/matchpattern" - "$ref": "#/parameters/cidr" - "$ref": "#/parameters/source" responses: '200': description: Success schema: type: array items: "$ref": "#/definitions/DNSLookup" '400': description: Invalid request (error parsing parameters) schema: "$ref": "#/definitions/Error" '404': description: No DNS data with provided parameters found "/fqdn/names": get: summary: List internal DNS selector representations description: | Retrieves the list of DNS-related fields (names to poll, selectors and their corresponding regexes). tags: - policy responses: '200': description: Success schema: "$ref": "#/definitions/NameManager" '400': description: Invalid request (error parsing parameters) schema: "$ref": "#/definitions/Error" "/ip": get: summary: Lists information about known IP addresses description: | Retrieves a list of IPs with known associated information such as their identities, host addresses, Kubernetes pod names, etc. The list can optionally filtered by a CIDR IP range. tags: - policy parameters: - "$ref": "#/parameters/cidr" - "$ref": "#/parameters/labels" responses: '200': description: Success schema: type: array items: "$ref": "#/definitions/IPListEntry" '400': description: Invalid request (error parsing parameters) schema: "$ref": "#/definitions/Error" '404': description: No IP cache entries with provided parameters found "/node/ids": get: summary: List information about known node IDs description: | Retrieves a list of node IDs allocated by the agent and their associated node IP addresses. tags: - daemon responses: '200': description: Success schema: type: array items: "$ref": "#/definitions/NodeID" "/bgp/peers": get: summary: Lists operational state of BGP peers description: | Retrieves current operational state of BGP peers created by Cilium BGP virtual router. This includes session state, uptime, information per address family, etc. Deprecated: This will be removed in the future. deprecated: true tags: - bgp responses: '200': description: Success schema: type: array items: "$ref": "#/definitions/BgpPeer" '500': description: Internal Server Error schema: "$ref": "#/definitions/Error" '501': description: BGP Control Plane disabled x-go-name: Disabled schema: "$ref": "#/definitions/Error" "/bgp/routes": get: summary: Lists BGP routes from BGP Control Plane RIB. description: | Retrieves routes from BGP Control Plane RIB filtered by parameters you specify. Deprecated: This will be removed in the future. deprecated: true tags: - bgp parameters: - "$ref": "#/parameters/bgp-table-type" - "$ref": "#/parameters/bgp-afi" - "$ref": "#/parameters/bgp-safi" - "$ref": "#/parameters/bgp-router-asn" - "$ref": "#/parameters/bgp-neighbor-address" responses: '200': description: Success schema: type: array items: "$ref": "#/definitions/BgpRoute" '500': description: Internal Server Error schema: "$ref": "#/definitions/Error" '501': description: BGP Control Plane disabled x-go-name: Disabled schema: "$ref": "#/definitions/Error" "/bgp/route-policies": get: summary: Lists BGP route policies configured in BGP Control Plane. description: | Retrieves route policies from BGP Control Plane. Deprecated: This will be removed in the future. deprecated: true tags: - bgp parameters: - "$ref": "#/parameters/bgp-router-asn" responses: '200': description: Success schema: type: array items: "$ref": "#/definitions/BgpRoutePolicy" '500': description: Internal Server Error schema: "$ref": "#/definitions/Error" '501': description: BGP Control Plane disabled x-go-name: Disabled schema: "$ref": "#/definitions/Error" parameters: endpoint-id: name: id description: | String describing an endpoint with the format ``[prefix:]id``. If no prefix is specified, a prefix of ``cilium-local:`` is assumed. Not all endpoints will be addressable by all endpoint ID prefixes with the exception of the local Cilium UUID which is assigned to all endpoints. Supported endpoint id prefixes: - cilium-local: Local Cilium endpoint UUID, e.g. cilium-local:3389595 - cilium-global: Global Cilium endpoint UUID, e.g. cilium-global:cluster1:nodeX:452343 - cni-attachment-id: CNI attachment ID, e.g. cni-attachment-id:22222:eth0 - cep-name: cep name for this container if K8s is enabled, e.g. pod-name:default:foobar-net1 in: path required: true type: string endpoint-change-request: name: endpoint in: body required: true schema: "$ref": "#/definitions/EndpointChangeRequest" endpoint-batch-delete-request: name: endpoint in: body required: true schema: "$ref": "#/definitions/EndpointBatchDeleteRequest" identity-id: name: id description: | Cluster wide unique identifier of a security identity. in: path required: true type: string labels: name: labels description: | List of labels in: body required: false schema: "$ref": "#/definitions/Labels" policy-rules: name: policy description: Policy rules required: true in: body schema: type: string policy-replace: name: replace description: If true, indicates that existing rules with identical labels should be replaced. required: false in: query type: boolean policy-replace-with-labels: name: replace-with-labels description: If present, indicates that existing rules with the given labels should be deleted. required: false in: query type: array items: type: string pod-name: name: pod description: | K8s pod name required: true in: path type: string trace-selector: name: trace-selector description: Context to provide policy evaluation on in: body schema: "$ref": "#/definitions/TraceSelector" service-id: name: id description: ID of service required: true in: path type: integer service-address: name: address description: Service address configuration in: body schema: "$ref": "#/definitions/FrontendAddress" service-config: name: config description: Service configuration in: body required: true schema: "$ref": "#/definitions/ServiceSpec" prefilter-spec: name: prefilter-spec description: List of CIDR ranges for filter table required: true in: body schema: "$ref": "#/definitions/PrefilterSpec" ipam-ip: name: ip description: IP address in: path required: true type: string ipam-family: name: family in: query type: string enum: - ipv4 - ipv6 ipam-owner: name: owner in: query type: string ipam-pool: name: pool in: query type: string ipam-expiration: name: expiration in: header type: boolean map-name: name: name description: Name of map required: true in: path type: string follow: name: follow description: Whether to follow streamed requests required: false in: query type: boolean matchpattern: name: matchpattern description: A toFQDNs compatible matchPattern expression required: false in: query type: string cidr: name: cidr description: A CIDR range of IPs required: false in: query type: string source: name: source description: Source from which FQDN entries come from required: false in: query type: string bgp-table-type: name: table_type description: BGP Routing Information Base (RIB) table type required: true in: query type: string enum: - loc-rib - adj-rib-in - adj-rib-out bgp-afi: name: afi description: Address Family Indicator (AFI) of a BGP route required: true in: query type: string bgp-safi: name: safi description: Subsequent Address Family Indicator (SAFI) of a BGP route required: true in: query type: string bgp-router-asn: name: router_asn description: | Autonomous System Number (ASN) identifying a BGP virtual router instance. If not specified, all virtual router instances are selected. required: false in: query type: integer bgp-neighbor-address: name: neighbor description: | IP address specifying a BGP neighbor. Has to be specified only when table type is adj-rib-in or adj-rib-out. required: false in: query type: string definitions: Endpoint: description: An endpoint is a namespaced network interface to which cilium applies policies type: object properties: id: description: The cilium-agent-local ID of the endpoint type: integer spec: description: The desired configuration state of the endpoint "$ref": "#/definitions/EndpointConfigurationSpec" status: description: The desired and realized configuration state of the endpoint "$ref": "#/definitions/EndpointStatus" EndpointChangeRequest: description: | Structure which contains the mutable elements of an Endpoint. type: object required: - state properties: id: description: Local endpoint ID type: integer container-id: description: ID assigned by container runtime type: string container-netns-path: description: Path of Container Netns type: string labels: description: Labels describing the identity "$ref": "#/definitions/Labels" interface-name: description: Name of network device in host netns type: string interface-index: description: Index of network device in host netns type: integer parent-interface-index: description: >- Index of network device from which an IP was used as endpoint IP. Only relevant for ENI environments. type: integer container-interface-name: description: Name of network device in container netns type: string state: description: Current state of endpoint "$ref": "#/definitions/EndpointState" mac: description: MAC address "$ref": "#/definitions/MAC" host-mac: description: MAC address "$ref": "#/definitions/MAC" addressing: "$ref": "#/definitions/AddressPair" k8s-pod-name: description: Kubernetes pod name type: string k8s-namespace: description: Kubernetes namespace name type: string k8s-uid: description: Kubernetes pod UID type: string datapath-map-id: description: ID of datapath tail call map type: integer policy-enabled: description: Whether policy enforcement is enabled or not type: boolean pid: description: Process ID of the workload belonging to this endpoint type: integer sync-build-endpoint: description: | Whether to build an endpoint synchronously type: boolean is-secondary-interface: description: >- Whether this is a secondary pod interface type: boolean netns-cookie: description: Network namespace cookie type: string datapath-configuration: "$ref": "#/definitions/EndpointDatapathConfiguration" properties: description: >- Properties is used to store information about the endpoint at creation. Useful for tests. additionalProperties: type: object EndpointBatchDeleteRequest: description: | Properties selecting a batch of endpoints to delete. type: object properties: container-id: description: ID assigned by container runtime type: string EndpointDatapathConfiguration: description: Datapath configuration to be used for the endpoint type: object properties: require-arp-passthrough: description: Enable ARP passthrough mode type: boolean require-egress-prog: description: > Endpoint requires a host-facing egress program to be attached to implement ingress policy and reverse NAT. type: boolean external-ipam: description: > Indicates that IPAM is done external to Cilium. This will prevent the IP from being released and re-allocation of the IP address is skipped on restore. type: boolean require-routing: description: > Endpoint requires BPF routing to be enabled, when disabled, routing is delegated to Linux routing. x-go-name: RequireBPFRouting type: boolean default: true install-endpoint-route: description: > Installs a route in the Linux routing table pointing to the device of the endpoint's interface. type: boolean disable-sip-verification: description: > Disable source IP verification for the endpoint. type: boolean EndpointStatus: description: The current state and configuration of the endpoint, its policy & datapath, and subcomponents type: object required: - state properties: external-identifiers: description: Unique identifiers for this endpoint from outside cilium "$ref": "#/definitions/EndpointIdentifiers" identity: description: The security identity for this endpoint "$ref": "#/definitions/Identity" labels: description: Labels applied to this endpoint "$ref": "#/definitions/LabelConfigurationStatus" realized: description: The configuration in effect on this endpoint "$ref": "#/definitions/EndpointConfigurationSpec" networking: description: Networking properties of the endpoint "$ref": "#/definitions/EndpointNetworking" policy: description: The policy applied to this endpoint from the policy repository "$ref": "#/definitions/EndpointPolicyStatus" log: description: Most recent status log. See endpoint/{id}/log for the complete log. "$ref": "#/definitions/EndpointStatusLog" controllers: description: Status of internal controllers attached to this endpoint "$ref": "#/definitions/ControllerStatuses" state: description: Current state of endpoint "$ref": "#/definitions/EndpointState" health: description: Summary overall endpoint & subcomponent health "$ref": "#/definitions/EndpointHealth" namedPorts: description: List of named ports that can be used in Network Policy "$ref": "#/definitions/NamedPorts" EndpointState: description: State of endpoint type: string enum: - waiting-for-identity - not-ready - waiting-to-regenerate - regenerating - restoring - ready - disconnecting - disconnected - invalid EndpointHealth: description: |- Health of the endpoint +deepequal-gen=true type: object properties: overallHealth: "$ref": "#/definitions/EndpointHealthStatus" bpf: "$ref": "#/definitions/EndpointHealthStatus" policy: "$ref": "#/definitions/EndpointHealthStatus" connected: description: Is this endpoint reachable type: boolean EndpointHealthStatus: description: > A common set of statuses for endpoint health * ``OK`` = All components operational * ``Bootstrap`` = This component is being created * ``Pending`` = A change is being processed to be applied * ``Warning`` = This component is not applying up-to-date policies (but is still applying the previous version) * ``Failure`` = An error has occurred and no policy is being applied * ``Disabled`` = This endpoint is disabled and will not handle traffic type: string enum: - OK - Bootstrap - Pending - Warning - Failure - Disabled EndpointStatusLog: description: Status log of endpoint type: array items: "$ref": "#/definitions/EndpointStatusChange" EndpointStatusChange: description: |- Indication of a change of status +deepequal-gen=true type: object properties: timestamp: description: Timestamp when status change occurred type: string code: description: Code indicate type of status change type: string enum: - ok - failed message: description: Status message type: string state: "$ref": "#/definitions/EndpointState" EndpointPolicyStatus: description: Policy information of an endpoint type: object properties: spec: description: The policy that should apply to this endpoint "$ref": "#/definitions/EndpointPolicy" realized: description: The policy in the datapath for this endpoint "$ref": "#/definitions/EndpointPolicy" proxy-policy-revision: description: The policy revision currently enforced in the proxy for this endpoint type: integer proxy-statistics: description: Statistics of the proxy redirects configured for this endpoint type: array items: "$ref": "#/definitions/ProxyStatistics" EndpointPolicyEnabled: description: Whether policy enforcement is enabled (ingress, egress, both or none) type: string enum: - none - ingress - egress - both - audit-ingress - audit-egress - audit-both EndpointPolicy: description: |- Policy information of an endpoint type: object properties: policy-revision: description: The agent-local policy revision type: integer id: description: Own identity of endpoint type: integer policy-enabled: description: Whether policy enforcement is enabled (ingress, egress, both or none) "$ref": "#/definitions/EndpointPolicyEnabled" build: description: Build number of calculated policy in use type: integer allowed-ingress-identities: description: | List of identities allowed to communicate to this endpoint type: array items: type: integer denied-ingress-identities: description: | List of identities not allowed to communicate to this endpoint type: array items: type: integer allowed-egress-identities: description: | List of identities to which this endpoint is allowed to communicate type: array items: type: integer denied-egress-identities: description: | List of identities to which this endpoint is not allowed to communicate type: array items: type: integer l4: "$ref": "#/definitions/L4Policy" cidr-policy: "$ref": "#/definitions/CIDRPolicy" PolicyRule: description: |- A policy rule including the rule labels it derives from properties: rule: description: The policy rule as json type: string derived-from-rules: description: The policy rule labels identifying the policy rules this rule derives from type: array items: type: array items: type: string rules-by-selector: description: The policy rule labels identifying the policy rules this rule derives from, mapped by selector type: object additionalProperties: type: array items: type: array items: type: string L4Policy: description: |- L4 endpoint policy type: object properties: ingress: description: List of L4 ingress rules type: array items: "$ref": "#/definitions/PolicyRule" egress: description: List of L4 egress rules type: array items: "$ref": "#/definitions/PolicyRule" CIDRPolicy: description: |- CIDR endpoint policy type: object properties: ingress: description: List of CIDR ingress rules type: array items: "$ref": "#/definitions/PolicyRule" egress: description: List of CIDR egress rules type: array items: "$ref": "#/definitions/PolicyRule" Prefilter: description: Collection of endpoints to be served type: object properties: spec: "$ref": "#/definitions/PrefilterSpec" status: "$ref": "#/definitions/PrefilterStatus" PrefilterSpec: description: CIDR ranges implemented in the Prefilter type: object properties: revision: type: integer deny: type: array items: type: string PrefilterStatus: description: CIDR ranges implemented in the Prefilter type: object properties: realized: "$ref": "#/definitions/PrefilterSpec" CIDRList: description: List of CIDRs type: object properties: revision: type: integer list: type: array items: type: string DebugInfo: description: groups some debugging related information on the agent type: object properties: cilium-version: type: string kernel-version: type: string cilium-status: "$ref": "#/definitions/StatusResponse" endpoint-list: type: array items: "$ref": "#/definitions/Endpoint" service-list: type: array items: "$ref": "#/definitions/Service" policy: "$ref": "#/definitions/Policy" cilium-memory-map: type: string cilium-nodemonitor-memory-map: type: string environment-variables: type: array items: type: string subsystem: type: object additionalProperties: type: string encryption: type: object properties: wireguard: description: Status of the WireGuard agent "$ref": "#/definitions/WireguardStatus" CgroupDumpMetadata: description: cgroup full metadata type: object properties: pod-metadatas: type: array items: "$ref": "#/definitions/CgroupPodMetadata" CgroupPodMetadata: description: cgroup pod metadata type: object properties: name: type: string namespace: type: string containers: type: array items: "$ref": "#/definitions/CgroupContainerMetadata" ips: type: array items: "$ref": "#/definitions/Address" CgroupContainerMetadata: description: cgroup container metadata type: object properties: cgroup-id: type: integer format: uint64 cgroup-path: type: string IPAMResponse: description: IPAM configuration of an endpoint type: object required: - address - host-addressing properties: address: "$ref": "#/definitions/AddressPair" ipv4: "$ref": "#/definitions/IPAMAddressResponse" ipv6: "$ref": "#/definitions/IPAMAddressResponse" host-addressing: "$ref": "#/definitions/NodeAddressing" IPAMAddressResponse: description: IPAM configuration of an individual address family type: object properties: ip: description: Allocated IP for endpoint "$ref": "#/definitions/Address" gateway: description: IP of gateway "$ref": "#/definitions/Address" master-mac: description: MAC of master interface if address is a slave/secondary of a master interface "$ref": "#/definitions/MAC" expiration-uuid: type: string description: | The UUID for the expiration timer. Set when expiration has been enabled while allocating. interface-number: type: string description: | InterfaceNumber is a field for generically identifying an interface. This is only useful in ENI mode. skip-masquerade: type: boolean description: | SkipMasquerade indicates whether the datapath should avoid masquerading connections from this IP. AddressPair: description: Addressing information of an endpoint type: object properties: ipv4: description: IPv4 address type: string ipv4-expiration-uuid: description: UUID of IPv4 expiration timer type: string ipv4-pool-name: description: IPAM pool from which this IPv4 address was allocated type: string ipv6: description: IPv6 address type: string ipv6-expiration-uuid: description: UUID of IPv6 expiration timer type: string ipv6-pool-name: description: IPAM pool from which this IPv6 address was allocated type: string Address: description: IP address type: string x-go-type: type: Addr import: package: "github.com/cilium/cilium/pkg/ip" alias: iputil hints: kind: primitive noValidation: true CIDR: description: IP address prefix (CIDR) type: string x-go-type: type: Prefix import: package: "github.com/cilium/cilium/pkg/ip" alias: iputil hints: kind: primitive noValidation: true MAC: description: MAC address type: string x-go-type: type: MAC import: package: "github.com/cilium/cilium/pkg/mac" hints: kind: primitive noValidation: true ClusterNodesResponse: properties: self: description: Name of local node (if available) type: string nodes: description: List of known nodes type: array items: "$ref": "#/definitions/NodeElement" Identity: description: Security identity type: object properties: id: description: Unique identifier type: integer labels: description: Labels describing the identity "$ref": "#/definitions/Labels" labelsSHA256: description: SHA256 of labels type: string IdentityEndpoints: description: Security identities owned by endpoints on the local node type: object properties: identity: description: Security identity "$ref": "#/definitions/Identity" refCount: description: number of endpoints consuming this identity locally (should always be > 0) type: integer EndpointNetworking: description: Unique identifiers for this endpoint from outside cilium type: object properties: addressing: description: IP4/6 addresses assigned to this Endpoint type: array items: "$ref": "#/definitions/AddressPair" host-addressing: "$ref": "#/definitions/NodeAddressing" host-mac: description: MAC address "$ref": "#/definitions/MAC" mac: description: MAC address "$ref": "#/definitions/MAC" interface-name: description: Name of network device in host netns type: string interface-index: description: Index of network device in host netns type: integer container-interface-name: description: Name of network device in container netns type: string EndpointIdentifiers: description: |- Unique identifiers for this endpoint from outside cilium +deepequal-gen=true type: object properties: cni-attachment-id: description: ID assigned to this attachment by container runtime type: string # The identifiers below are retained for backwards compatibility only. # Nothing populates these anymore, but during an upgrade older agents may # still set them on the CiliumEndpoint CRD. The fields must stay in the # schema so the generated CRD keeps accepting those objects. Do not # remove. container-id: description: ID assigned by container runtime (deprecated, may not be unique) type: string container-name: description: Name assigned to container (deprecated, may not be unique) type: string docker-endpoint-id: description: Docker endpoint ID type: string docker-network-id: description: Docker network ID type: string pod-name: description: K8s pod for this endpoint (deprecated, may not be unique) type: string k8s-pod-name: description: K8s pod name for this endpoint (deprecated, may not be unique) type: string k8s-namespace: description: K8s namespace for this endpoint (deprecated, may not be unique) type: string Labels: description: Set of labels type: array items: type: string LabelConfiguration: description: Label configuration of an endpoint type: object properties: spec: description: The user provided desired configuration "$ref": "#/definitions/LabelConfigurationSpec" status: description: The current configuration "$ref": "#/definitions/LabelConfigurationStatus" LabelConfigurationSpec: description: User desired Label configuration of an endpoint type: object properties: user: description: "Custom labels in addition to orchestration system labels." "$ref": "#/definitions/Labels" LabelConfigurationStatus: description: Labels and label configuration of an endpoint type: object properties: realized: description: The current configuration "$ref": "#/definitions/LabelConfigurationSpec" security-relevant: description: "Labels derived from orchestration system that are used in computing a security identity" "$ref": "#/definitions/Labels" derived: description: "All labels derived from the orchestration system" "$ref": "#/definitions/Labels" disabled: description: "Labels derived from orchestration system which have been disabled." "$ref": "#/definitions/Labels" StatusResponse: description: |- Health and status information of daemon +k8s:deepcopy-gen=true type: object properties: cilium: description: Status of Cilium daemon "$ref": "#/definitions/Status" kvstore: description: Status of key/value datastore "$ref": "#/definitions/Status" cni-file: description: Status of the CNI configuration file "$ref": "#/definitions/Status" host-firewall: description: Status of the host firewall "$ref": "#/definitions/HostFirewall" hubble: description: Status of Hubble server "$ref": "#/definitions/HubbleStatus" hubble-metrics: description: Status of Hubble metrics server "$ref": "#/definitions/HubbleMetricsStatus" kubernetes: description: Status of Kubernetes integration "$ref": "#/definitions/K8sStatus" datapath-mode: description: Status of operational datapath mode "$ref": "#/definitions/DatapathMode" configured-datapath-mode: description: Status of configured datapath mode "$ref": "#/definitions/ConfiguredDatapathMode" attach-mode: description: Status of core datapath attachment mode "$ref": "#/definitions/AttachMode" kube-proxy-replacement: description: Status of kube-proxy replacement "$ref": "#/definitions/KubeProxyReplacement" ipam: description: Status of IP address management "$ref": "#/definitions/IPAMStatus" nodeMonitor: description: Status of the node monitor "$ref": "#/definitions/MonitorStatus" cluster: description: Status of cluster "$ref": "#/definitions/ClusterStatus" controllers: description: Status of all endpoint controllers "$ref": "#/definitions/ControllerStatuses" proxy: description: Status of proxy "$ref": "#/definitions/ProxyStatus" identity-range: description: Status of identity range of the cluster "$ref": "#/definitions/IdentityRange" ipv6-big-tcp: description: Status of IPv6 BIG TCP "$ref": "#/definitions/IPV6BigTCP" ipv4-big-tcp: description: Status of IPv4 BIG TCP "$ref": "#/definitions/IPV4BigTCP" bandwidth-manager: description: Status of bandwidth manager "$ref": "#/definitions/BandwidthManager" masquerading: description: Status of masquerading "$ref": "#/definitions/Masquerading" routing: description: Status of routing "$ref": "#/definitions/Routing" clock-source: description: Status of clock source "$ref": "#/definitions/ClockSource" srv6: description: Status of SRv6 "$ref": "#/definitions/Srv6" stale: description: List of stale information in the status type: object additionalProperties: description: Timestamp when the probe was started type: string format: date-time client-id: description: | When supported by the API, this client ID should be used by the client when making another request to the server. See for example "/cluster/nodes". type: integer cluster-mesh: description: Status of ClusterMesh "$ref": "#/definitions/ClusterMeshStatus" bpf-maps: description: Status of BPF maps "$ref": "#/definitions/BPFMapStatus" encryption: description: Status of transparent encryption "$ref": "#/definitions/EncryptionStatus" cni-chaining: description: Status of CNI chaining "$ref": "#/definitions/CNIChainingStatus" Status: description: Status of an individual component type: object properties: state: type: string description: State the component is in enum: - Ok - Warning - Failure - Disabled msg: type: string description: Human readable status/error/warning message HostFirewall: description: |- Status of the host firewall +k8s:deepcopy-gen=true type: object properties: mode: type: string enum: - Disabled - Enabled devices: type: array items: type: string HubbleStatus: description: |- Status of the Hubble server +k8s:deepcopy-gen=true type: object properties: state: type: string description: State the component is in enum: - Ok - Warning - Failure - Disabled msg: type: string description: Human readable status/error/warning message observer: type: object description: |- Status of the Hubble observer +k8s:deepcopy-gen=true properties: max-flows: type: integer description: Maximum number of flows this Hubble observer is able to store current-flows: type: integer description: Current number of flows this Hubble observer stores seen-flows: type: integer description: Total number of flows this Hubble observer has seen uptime: type: string format: duration description: Uptime of this Hubble observer instance HubbleMetricsStatus: description: |- Status of the Hubble metrics server +k8s:deepcopy-gen=true type: object properties: state: type: string description: State the component is in enum: - Ok - Warning - Failure - Disabled msg: type: string description: Human readable status/error/warning message K8sStatus: description: |- Status of Kubernetes integration +k8s:deepcopy-gen=true type: object properties: state: type: string description: State the component is in enum: - Ok - Warning - Failure - Disabled k8s-api-versions: type: array items: type: string msg: type: string description: Human readable status/error/warning message KubeProxyReplacement: description: |- Status of kube-proxy replacement +k8s:deepcopy-gen=true type: object properties: mode: type: string enum: - 'True' - 'False' devices: type: array items: type: string deviceList: description: |- +k8s:deepcopy-gen=true type: array items: description: |- +k8s:deepcopy-gen=true type: object properties: name: type: string ip: description: |- +k8s:deepcopy-gen=true type: array items: type: string directRoutingDevice: type: string features: description: |- +k8s:deepcopy-gen=true type: object properties: nodePort: type: object properties: enabled: type: boolean mode: type: string enum: - SNAT - DSR - Hybrid dsrMode: type: string enum: - IP Option/Extension - IPIP - Geneve algorithm: type: string enum: - Random - Maglev acceleration: type: string enum: - None - Native - Generic - Best-Effort portMin: type: integer portMax: type: integer lutSize: type: integer hostPort: type: object properties: enabled: type: boolean externalIPs: type: object properties: enabled: type: boolean hostReachableServices: description: |- +k8s:deepcopy-gen=true type: object properties: enabled: type: boolean protocols: type: array items: type: string socketLB: type: object properties: enabled: type: boolean sessionAffinity: type: object properties: enabled: type: boolean gracefulTermination: description: Deprecated type: object properties: enabled: type: boolean nat46X64: description: |- +k8s:deepcopy-gen=true type: object properties: enabled: type: boolean service: type: object properties: enabled: type: boolean gateway: description: |- +k8s:deepcopy-gen=true type: object properties: enabled: type: boolean prefixes: type: array items: "$ref": "#/definitions/CIDR" socketLBTracing: type: object properties: enabled: type: boolean bpfSocketLBHostnsOnly: description: flag bpf-lb-sock-hostns-only type: boolean annotations: type: array items: type: string AllocationMap: description: | Map of allocated IPs type: object additionalProperties: type: string IPAMStatus: description: |- Status of IP address management +k8s:deepcopy-gen=true properties: allocations: "$ref": "#/definitions/AllocationMap" ipv4: type: array items: type: string ipv6: type: array items: type: string status: type: string ClusterStatus: description: |- Status of cluster +k8s:deepcopy-gen=true properties: ciliumHealth: description: Status of local cilium-health daemon "$ref": "#/definitions/Status" self: description: Name of local node (if available) type: string nodes: description: List of known nodes type: array items: "$ref": "#/definitions/NodeElement" ClusterNodeStatus: description: Status of cluster properties: self: description: Name of local node (if available) type: string nodes-added: description: List of known nodes type: array items: "$ref": "#/definitions/NodeElement" nodes-removed: description: List of known nodes type: array items: "$ref": "#/definitions/NodeElement" client-id: description: ID that should be used by the client to receive a diff from the previous request type: integer ClusterMeshStatus: description: |- Status of ClusterMesh +k8s:deepcopy-gen=true properties: clusters: description: List of remote clusters type: array items: "$ref": "#/definitions/RemoteCluster" RemoteCluster: description: |- Status of remote cluster +k8s:deepcopy-gen=true properties: name: description: Name of the cluster type: string ready: description: Indicates readiness of the remote cluster type: boolean connected: description: Indicates whether the connection to the remote kvstore is established type: boolean synced: description: Synchronization status about each resource type "$ref": "#/definitions/RemoteClusterSynced" config: description: Cluster configuration exposed by the remote cluster "$ref": "#/definitions/RemoteClusterConfig" num-nodes: description: Number of nodes in the cluster type: integer num-shared-services: description: Number of services in the cluster type: integer num-endpoint-slices: description: Number of endpoint slices in the cluster type: integer num-service-exports: description: Number of MCS-API service exports in the cluster type: integer num-identities: description: Number of identities in the cluster type: integer num-endpoints: description: Number of endpoints in the cluster type: integer status: description: Status of the control plane type: string num-failures: description: Number of failures reaching the cluster type: integer last-failure: description: Time of last failure that occurred while attempting to reach the cluster type: string format: date-time RemoteClusterSynced: description: |- Status of the synchronization with the remote cluster, about each resource type. A given resource is considered to be synchronized if the initial list of entries has been completely received from the remote cluster, and new events are currently being watched. +k8s:deepcopy-gen=true properties: nodes: description: Nodes synchronization status type: boolean services: description: Services synchronization status type: boolean endpoint-slices: description: Endpoint slices synchronization status (null means that the component is not watching endpoint slices) type: boolean x-nullable: true service-exports: description: MCS-API service exports synchronization status (null means that the component is not watching service exports) type: boolean x-nullable: true endpoints: description: Endpoints synchronization status type: boolean identities: description: Identities synchronization status type: boolean RemoteClusterConfig: description: |- Cluster configuration exposed by the remote cluster +k8s:deepcopy-gen=true properties: required: description: Whether the configuration is required to be present type: boolean retrieved: description: Whether the configuration has been correctly retrieved type: boolean cluster-id: description: The Cluster ID advertised by the remote cluster type: integer kvstoremesh: description: Whether the remote cluster information is locally cached by kvstoremesh type: boolean sync-canaries: description: Whether the remote cluster supports per-prefix "synced" canaries type: boolean service-exports-enabled: description: Whether or not MCS-API ServiceExports is enabled by the cluster (null means unsupported). type: boolean x-nullable: true endpoint-slices-export-mode: description: EndpointSlices export mode advertised by the remote cluster type: string enum: - services-and-endpointslices - endpointslices-only MonitorStatus: description: Status of the node monitor properties: cpus: description: Number of CPUs to listen on for events. type: integer npages: description: Number of pages used for the perf ring buffer. type: integer pagesize: description: Pages size used for the perf ring buffer. type: integer lost: description: Number of samples lost by perf. type: integer unknown: description: Number of unknown samples. type: integer KVstoreConfiguration: description: Configuration used for the kvstore properties: type: description: Type of kvstore type: string options: description: Configuration options type: object additionalProperties: type: string DaemonConfiguration: description: | Response to a daemon configuration request. type: object properties: spec: description: Changeable configuration "$ref": "#/definitions/DaemonConfigurationSpec" status: description: | Current daemon configuration related status.Contains the addressing information, k8s, node monitor and immutable and mutable configuration settings. "$ref": "#/definitions/DaemonConfigurationStatus" DaemonConfigurationSpec: description: The controllable configuration of the daemon. type: object properties: options: description: Changeable configuration "$ref": "#/definitions/ConfigurationMap" policy-enforcement: description: "The policy-enforcement mode" type: string enum: - default - always - never DaemonConfigurationStatus: description: | Response to a daemon configuration request. Contains the addressing information, k8s, node monitor and immutable and mutable configuration settings. type: object properties: realized: description: Currently applied configuration "$ref": "#/definitions/DaemonConfigurationSpec" immutable: description: Immutable configuration (read-only) "$ref": "#/definitions/ConfigurationMap" addressing: "$ref": "#/definitions/NodeAddressing" k8s-endpoint: type: string k8s-configuration: type: string nodeMonitor: description: Status of the node monitor "$ref": "#/definitions/MonitorStatus" kvstoreConfiguration: "$ref": "#/definitions/KVstoreConfiguration" deviceMTU: description: MTU on workload facing devices type: integer routeMTU: description: MTU for network facing routes type: integer enableRouteMTUForCNIChaining: description: Enable route MTU for pod netns when CNI chaining is used type: boolean packetizationLayerPMTUDMode: description: Specifies what mode PLPMTUD probing on the pod netns should be set to (if empty will do nothing). type: string datapathMode: "$ref": "#/definitions/DatapathMode" configuredDatapathMode: "$ref": "#/definitions/ConfiguredDatapathMode" ipam-mode: description: Configured IPAM mode type: string masquerade: type: boolean masqueradeProtocols: description: Status of masquerading feature type: object properties: ipv4: description: Status of masquerading for IPv4 traffic type: boolean ipv6: description: Status of masquerading for IPv6 traffic type: boolean installUplinkRoutesForDelegatedIPAM: description: | Install ingress/egress routes through uplink on host for Pods when working with delegated IPAM plugin. type: boolean daemonConfigurationMap: description: Config map which contains all the active daemon configurations additionalProperties: type: object GSOMaxSize: description: Maximum IPv6 GSO size on workload facing devices type: integer GROMaxSize: description: Maximum IPv6 GRO size on workload facing devices type: integer GSOIPv4MaxSize: description: Maximum IPv4 GSO size on workload facing devices type: integer GROIPv4MaxSize: description: Maximum IPv4 GRO size on workload facing devices type: integer deviceHeadroom: description: Headroom buffer margin on workload facing devices type: integer deviceTailroom: description: Tailroom buffer margin on workload facing devices type: integer ipLocalReservedPorts: description: Comma-separated list of IP ports should be reserved in the workload network namespace type: string enableBBRHostNamespaceOnly: description: True if BBR is enabled only in the host network namespace type: boolean DatapathMode: description: Operational datapath mode type: string enum: - veth - netkit - netkit-l2 ConfiguredDatapathMode: description: Configured datapath mode type: string enum: - auto - veth - netkit - netkit-l2 AttachMode: description: Core datapath attachment mode type: string enum: - tc - tcx EndpointConfigurationSpec: description: An endpoint's configuration type: object properties: options: description: Changeable configuration "$ref": "#/definitions/ConfigurationMap" label-configuration: description: the endpoint's labels "$ref": "#/definitions/LabelConfigurationSpec" EndpointConfigurationStatus: description: An endpoint's configuration type: object properties: realized: description: currently applied changeable configuration "$ref": "#/definitions/EndpointConfigurationSpec" immutable: description: Immutable configuration (read-only) "$ref": "#/definitions/ConfigurationMap" error: description: Most recent error, if applicable "$ref": "#/definitions/Error" ConfigurationMap: description: | Map of configuration key/value pairs. type: object additionalProperties: type: string NodeElement: description: |- Known node in the cluster +k8s:deepcopy-gen=true properties: name: type: string description: | Name of the node including the cluster association. This is typically /. primary-address: description: Primary address used for intra-cluster communication "$ref": "#/definitions/NodeAddressing" secondary-addresses: description: Alternative addresses assigned to the node type: array items: "$ref": "#/definitions/NodeAddressingElement" health-endpoint-address: description: Address used for probing cluster connectivity "$ref": "#/definitions/NodeAddressing" ingress-address: description: Source address for Ingress listener "$ref": "#/definitions/NodeAddressing" source: description: Source of the node configuration type: string NodeAddressing: description: |- Addressing information of a node for all address families +k8s:deepcopy-gen=true type: object properties: ipv6: "$ref": "#/definitions/NodeAddressingElement" ipv4: "$ref": "#/definitions/NodeAddressingElement" NodeAddressingElement: description: |- Addressing information +k8s:deepcopy-gen=true type: object properties: enabled: description: True if address family is enabled type: boolean ip: description: IP address of node "$ref": "#/definitions/Address" alloc-range: description: Address pool to be used for local endpoints "$ref": "#/definitions/CIDR" address-type: description: Node address type, one of HostName, ExternalIP or InternalIP type: string Policy: description: | Policy definition Deprecated, will be removed in v1.19. type: object properties: revision: description: | Revision number of the policy. Incremented each time the policy is changed in the agent's repository type: integer policy: description: Policy definition as JSON. type: string PolicyTraceResult: description: Response to a policy resolution process type: object properties: verdict: type: string log: type: string Port: description: |- Layer 4 port / protocol pair +deepequal-gen=true type: object properties: protocol: description: Layer 4 protocol type: string enum: - TCP - UDP - SCTP - ICMP - ICMPV6 - ANY port: description: Layer 4 port number type: integer format: uint16 name: description: Optional layer 4 port name type: string SelectorCache: description: cache of which identities match selectors in the policy repository type: array items: "$ref": "#/definitions/SelectorIdentityMapping" SelectorIdentityMapping: description: mapping of selector to identities which match it type: object properties: selector: description: string form of selector type: string labels: description: Labels is a list of labels of the policy rules currently using this selector "$ref": "#/definitions/LabelArrayList" identities: description: identities mapping to this selector type: array items: type: integer users: description: number of users of this selector in the cache type: integer Srv6: description: |- Status of the SRv6 type: object properties: enabled: type: boolean srv6EncapMode: type: string enum: - SRH - Reduced TraceSelector: description: Context describing a pair of source and destination identity type: object properties: from: "$ref": "#/definitions/TraceFrom" to: "$ref": "#/definitions/TraceTo" verbose: description: | Enable verbose tracing. type: boolean TraceFrom: type: object properties: labels: "$ref": "#/definitions/Labels" TraceTo: type: object properties: labels: "$ref": "#/definitions/Labels" dports: description: | List of Layer 4 port and protocol pairs which will be used in communication from the source identity to the destination identity. type: array items: "$ref": "#/definitions/Port" FrontendAddress: description: | Layer 4 address. The protocol is currently ignored, all services will behave as if protocol any is specified. To restrict to a particular protocol, use policy. type: object properties: ip: description: Layer 3 address type: string protocol: description: Layer 4 protocol type: string enum: - tcp - udp - any scope: description: Load balancing scope for frontend address type: string enum: - external - internal port: description: Layer 4 port number type: integer format: uint16 BackendAddress: description: Service backend address type: object required: - ip properties: ip: description: Layer 3 address type: string protocol: description: Layer 4 protocol (TCP, UDP, etc) type: string port: description: Layer 4 port number type: integer format: uint16 nodeName: description: Optional name of the node on which this backend runs type: string state: description: State of the backend for load-balancing service traffic type: string enum: - active - terminating - terminating-not-serving - quarantined - maintenance preferred: description: |- Indicator if this backend is preferred in the context of clustermesh service affinity. The value is set based on related annotation of global service. Applicable for active state only. type: boolean weight: description: Backend weight type: integer format: uint16 x-nullable: true zone: description: Optional name of the zone in which this backend runs type: string LRPBackend: description: Pod backend of an LRP type: object properties: pod-id: description: Namespace and name of the backend pod type: string backend-address: "$ref": "#/definitions/BackendAddress" FrontendMapping: description: Mapping of frontend to backend pods of an LRP type: object properties: frontend-address: "$ref": "#/definitions/FrontendAddress" backends: description: Pod backends of an LRP type: array items: "$ref": "#/definitions/LRPBackend" LRPSpec: description: Configuration of an LRP type: object properties: uid: description: Unique identification type: string name: description: LRP service name type: string namespace: description: LRP service namespace type: string frontend-type: description: LRP frontend type type: string lrp-type: description: LRP config type type: string service-id: description: matching k8s service namespace and name type: string frontend-mappings: description: mapping of frontends to pod backends type: array items: "$ref": "#/definitions/FrontendMapping" Service: description: Collection of endpoints to be served type: object properties: spec: "$ref": "#/definitions/ServiceSpec" status: "$ref": "#/definitions/ServiceStatus" ServiceSpec: description: Configuration of a service type: object required: - frontend-address properties: id: description: Unique identification type: integer frontend-address: description: Frontend address "$ref": "#/definitions/FrontendAddress" backend-addresses: description: List of backend addresses type: array items: "$ref": "#/definitions/BackendAddress" flags: description: Optional service configuration flags type: object properties: type: description: Service type type: string enum: - ClusterIP - NodePort - ExternalIPs - HostPort - LoadBalancer - LocalRedirect trafficPolicy: description: Service external traffic policy (deprecated in favor of extTrafficPolicy) type: string enum: - Cluster - Local extTrafficPolicy: description: Service external traffic policy type: string enum: - Cluster - Local intTrafficPolicy: description: Service internal traffic policy type: string enum: - Cluster - Local natPolicy: description: Service protocol NAT policy type: string enum: - None - Nat46 - Nat64 healthCheckNodePort: description: Service health check node port type: integer format: uint16 name: description: Service name (e.g. Kubernetes service name) type: string namespace: description: Service namespace (e.g. Kubernetes namespace) type: string cluster: description: Service cluster type: string updateServices: description: | Update all services selecting the backends with their given states (id and frontend are ignored) type: boolean ServiceStatus: description: Configuration of a service type: object properties: realized: "$ref": "#/definitions/ServiceSpec" StateDBQuery: description: StateDB query type: object properties: table: description: Name of the table to query type: string index: description: Index to query against type: string lowerbound: description: LowerBound prefix search or full-matching Get type: boolean key: description: Key to query with. Base64 encoded. type: string ProxyStatus: description: |- Status of proxy +k8s:deepcopy-gen=true type: object properties: port-range: description: Port range used for proxying type: string ip: description: IP address that the proxy listens on type: string total-redirects: description: Total number of ports configured to redirect to proxies type: integer total-ports: description: Total number of listening proxy ports type: integer redirects: description: Detailed description of configured redirects type: array items: "$ref": "#/definitions/ProxyRedirect" envoy-deployment-mode: description: Deployment mode of Envoy L7 proxy type: string enum: - embedded - external IdentityRange: description: |- Status of identity range of the cluster properties: min-identity: description: Minimum identity of the cluster type: integer max-identity: description: Maximum identity of the cluster type: integer ProxyRedirect: description: Configured proxy redirection state type: object properties: name: description: Name of the proxy redirect type: string proxy: description: Name of the proxy this redirect points to type: string proxy-port: description: Host port that this redirect points to type: integer ProxyStatistics: description: |- Statistics of a set of proxy redirects for an endpoint +k8s:deepcopy-gen=true type: object properties: protocol: description: Name of the L7 protocol type: string port: description: The port subject to the redirect type: integer allocated-proxy-port: description: The port the proxy is listening on type: integer location: description: Location of where the redirect is installed type: string enum: - ingress - egress statistics: description: Statistics of this set of proxy redirect "$ref": "#/definitions/RequestResponseStatistics" RequestResponseStatistics: description: |- Statistics of a proxy redirect +k8s:deepcopy-gen=true type: object properties: requests: "$ref": "#/definitions/MessageForwardingStatistics" responses: "$ref": "#/definitions/MessageForwardingStatistics" MessageForwardingStatistics: description: Statistics of a message forwarding entity type: object properties: received: description: Number of messages received type: integer denied: description: Number of messages denied type: integer error: description: Number of errors while parsing messages type: integer forwarded: description: Number of messages forwarded type: integer IPV6BigTCP: description: |- Status of IPv6 BIG TCP type: object properties: enabled: description: Is IPv6 BIG TCP enabled type: boolean maxGRO: description: Maximum IPv6 GRO size type: integer maxGSO: description: Maximum IPv6 GSO size type: integer IPV4BigTCP: description: |- Status of IPv4 BIG TCP type: object properties: enabled: description: Is IPv4 BIG TCP enabled type: boolean maxGRO: description: Maximum IPv4 GRO size type: integer maxGSO: description: Maximum IPv4 GSO size type: integer BandwidthManager: description: |- Status of bandwidth manager +k8s:deepcopy-gen=true type: object properties: enabled: description: Is bandwidth manager enabled type: boolean devices: type: array items: type: string congestionControl: type: string enum: - cubic - bbr Masquerading: description: |- Status of masquerading +k8s:deepcopy-gen=true type: object properties: enabled: type: boolean enabledProtocols: description: Is masquerading enabled type: object properties: ipv4: description: Is masquerading enabled for IPv4 traffic type: boolean ipv6: description: Is masquerading enabled for IPv6 traffic type: boolean mode: type: string enum: - BPF - iptables ip-masq-agent: description: Is BPF ip-masq-agent enabled type: boolean snat-exclusion-cidr: description: |- This field is obsolete, please use snat-exclusion-cidr-v4 or snat-exclusion-cidr-v6. "$ref": "#/definitions/CIDR" snat-exclusion-cidr-v4: description: |- SnatExclusionCIDRv4 exempts SNAT from being performed on any packet sent to an IPv4 address that belongs to this CIDR. "$ref": "#/definitions/CIDR" snat-exclusion-cidr-v6: description: |- SnatExclusionCIDRv6 exempts SNAT from being performed on any packet sent to an IPv6 address that belongs to this CIDR. For IPv6 we only do masquerading in iptables mode. "$ref": "#/definitions/CIDR" ClockSource: description: |- Status of BPF clock source type: object properties: mode: description: Datapath clock source type: string enum: - ktime - jiffies hertz: description: Kernel Hz type: integer Routing: description: |- Status of routing type: object properties: inter-host-routing-mode: description: Datapath routing mode for cross-cluster connectivity type: string enum: - Native - Tunnel intra-host-routing-mode: description: Datapath routing mode for connectivity within the host type: string enum: - BPF - Legacy tunnel-protocol: description: Tunnel protocol in use for cross-cluster connectivity type: string ControllerStatuses: description: Collection of controller statuses type: array items: "$ref": "#/definitions/ControllerStatus" ControllerStatus: description: |- Status of a controller +k8s:deepcopy-gen=true type: object properties: name: description: Name of controller type: string uuid: description: UUID of controller type: string format: uuid configuration: description: |- Configuration of controller +deepequal-gen=true +k8s:deepcopy-gen=true type: object properties: interval: description: Regular synchronization interval type: string format: duration error-retry-base: description: Base error retry back-off time type: string format: duration error-retry: description: Retry on error type: boolean status: description: |- Current status of controller +k8s:deepcopy-gen=true type: object properties: success-count: description: Total number of successful runs type: integer last-success-timestamp: description: Timestamp of last success type: string format: date-time failure-count: description: Total number of failed runs type: integer last-failure-timestamp: description: Timestamp of last error type: string format: date-time consecutive-failure-count: description: Number of consecutive errors since last success type: integer last-failure-msg: description: Error message of last failed run type: string MapEvent: description: Event on Map type: object properties: timestamp: description: Timestamp when the event occurred type: string format: date-time key: description: Map key on which the event occurred type: string value: description: Map value on which the event occurred type: string action: description: Action type for event type: string enum: - update - delete desired-action: description: Desired action to be performed after this event type: string enum: - ok - insert - delete last-error: description: Last error seen while performing desired action type: string BPFMapList: description: List of BPF Maps type: object properties: maps: description: Array of open BPF map lists type: array items: "$ref": "#/definitions/BPFMap" BPFMap: description: BPF map definition and content type: object properties: path: description: Path to BPF map type: string cache: description: Contents of cache type: array items: "$ref": "#/definitions/BPFMapEntry" BPFMapEntry: description: BPF map cache entry type: object properties: key: description: Key of map entry type: string value: description: Value of map entry type: string desired-action: description: Desired action to be performed type: string enum: - ok - insert - delete last-error: description: Last error seen while performing desired action type: string BPFMapProperties: description: BPF map properties type: object properties: name: description: Name of the BPF map type: string size: description: Size of the BPF map type: integer BPFMapStatus: description: | BPF map status +k8s:deepcopy-gen=true type: object properties: dynamic-size-ratio: description: Ratio of total system memory to use for dynamic sizing of BPF maps type: number maps: description: BPF maps type: array items: "$ref": "#/definitions/BPFMapProperties" Metric: description: Metric information type: object properties: name: description: Name of the metric type: string value: description: Value of the metric type: number labels: description: Labels of the metric type: object additionalProperties: type: string Error: type: string NameManager: description: Internal state about DNS names in relation to policy subsystem type: object properties: DNSPollNames: description: Names to poll for DNS Poller type: array items: type: string FQDNPolicySelectors: description: Mapping of FQDNSelectors to corresponding regular expressions type: array items: "$ref": "#/definitions/SelectorEntry" SelectorEntry: description: Mapping of FQDNSelector to corresponding regular expression type: object properties: selectorString: description: FQDNSelector in string representation type: string regexString: description: String representation of regular expression form of FQDNSelector type: string DNSLookup: description: An IP -> DNS mapping, with metadata type: object properties: ips: description: IP addresses returned in this lookup type: array items: type: string fqdn: description: DNS name type: string ttl: description: The TTL in the DNS response type: integer lookup-time: description: The absolute time when this data was received type: string format: date-time expiration-time: description: The absolute time when this data will expire in this cache type: string format: date-time endpoint-id: description: The endpoint that made this lookup, or 0 for the agent itself. type: integer source: description: The reason this FQDN IP association exists. Either a DNS lookup or an ongoing connection to an IP that was created by a DNS lookup. type: string NodeID: description: Node ID with associated node IP addresses type: object required: - id - ips properties: id: description: ID allocated by the agent for the node type: integer ips: description: IP addresses of the node associated with the ID in the agent type: array items: type: string IPListEntry: description: IP entry with metadata type: object required: - identity properties: cidr: description: Key of the entry in the form of a CIDR range "$ref": "#/definitions/CIDR" identity: description: Numerical identity assigned to the IP type: integer hostIP: description: IP address of the host "$ref": "#/definitions/Address" encryptKey: description: The context ID for the encryption session type: integer metadata: "$ref": "#/definitions/IPListEntryMetadata" IPListEntryMetadata: description: Additional metadata assigned to an IP list entry type: object properties: source: description: Source of the IP entry and its metadata type: string example: k8s namespace: description: Namespace of the IP (e.g. Kubernetes namespace) type: string name: description: Name assigned to the IP (e.g. Kubernetes pod name) type: string NamedPorts: description: |- List of named Layer 4 port and protocol pairs which will be used in Network Policy specs. +deepequal-gen=true +k8s:deepcopy-gen=true type: array items: "$ref": "#/definitions/Port" EncryptionStatus: description: |- Status of transparent encryption +k8s:deepcopy-gen=true properties: mode: type: string enum: - Disabled - IPsec - Wireguard - Ztunnel msg: type: string description: Human readable error/warning message ipsec: description: Status of the IPsec agent "$ref": "#/definitions/IPsecStatus" wireguard: description: Status of the WireGuard agent "$ref": "#/definitions/WireguardStatus" CNIChainingStatus: description: |- Status of CNI chaining properties: mode: type: string enum: - none - aws-cni - flannel - generic-veth - portmap IPsecStatus: description: |- Status of the IPsec agent +k8s:deepcopy-gen=true properties: decrypt-interfaces: description: IPsec decryption interfaces type: array items: type: string max-seq-number: description: IPsec max sequence number type: string keys-in-use: description: IPsec keys in use type: integer error-count: description: IPsec error count type: integer xfrm-errors: description: IPsec XFRM errors type: object additionalProperties: type: integer WireguardStatus: description: |- Status of the WireGuard agent +k8s:deepcopy-gen=true properties: node-encryption: description: Node Encryption status type: string node-encrypt-opt-out-labels: description: Label selector for nodes which will opt-out of node-to-node encryption type: string interfaces: description: WireGuard interfaces managed by this Cilium instance type: array items: "$ref": "#/definitions/WireguardInterface" WireguardInterface: description: |- Status of a WireGuard interface +k8s:deepcopy-gen=true properties: name: description: Name of the interface type: string public-key: description: Public key of this interface type: string listen-port: description: Port on which the WireGuard endpoint is exposed type: integer peer-count: description: Number of peers configured on this interface type: integer peers: description: Optional list of WireGuard peers type: array items: "$ref": "#/definitions/WireguardPeer" WireguardPeer: description: |- Status of a WireGuard peer +k8s:deepcopy-gen=true properties: public-key: description: Public key of this peer type: string endpoint: description: Endpoint on which we are connected to this peer type: string last-handshake-time: description: Timestamp of the last handshake with this peer type: string format: date-time transfer-tx: description: Number of sent bytes type: integer transfer-rx: description: Number of received bytes type: integer allowed-ips: description: List of IPs which may be routed through this peer type: array items: type: string BgpPeer: description: |- State of a BGP Peer Deprecated: This will be removed in the future. +k8s:deepcopy-gen=true properties: name: description: Name of peer type: string local-asn: description: Local AS Number type: integer peer-asn: description: Peer AS Number type: integer peer-address: description: IP Address of peer type: string tcp-password-enabled: description: Set when a TCP password is configured for communications with this peer type: boolean ebgp-multihop-ttl: description: | Time To Live (TTL) value used in BGP packets sent to the eBGP neighbor. 1 implies that eBGP multi-hop feature is disabled (only a single hop is allowed). type: integer peer-port: description: TCP port number of peer type: integer minimum: 1 maximum: 65535 session-state: description: | BGP peer operational state as described here https://www.rfc-editor.org/rfc/rfc4271#section-8.2.2 type: string uptime-nanoseconds: description: BGP peer connection uptime in nano seconds. type: integer graceful-restart: description: Graceful restart capability "$ref": "#/definitions/BgpGracefulRestart" families: description: BGP peer address family state type: array items: "$ref": "#/definitions/BgpPeerFamilies" connect-retry-time-seconds: description: Initial value for the BGP ConnectRetryTimer (RFC 4271, Section 8) in seconds type: integer configured-hold-time-seconds: description: | Configured initial value for the BGP HoldTimer (RFC 4271, Section 4.2) in seconds. The configured value will be used for negotiation with the peer during the BGP session establishment. type: integer applied-hold-time-seconds: description: | Applied initial value for the BGP HoldTimer (RFC 4271, Section 4.2) in seconds. The applied value holds the value that is in effect on the current BGP session. type: integer configured-keep-alive-time-seconds: description: | Configured initial value for the BGP KeepaliveTimer (RFC 4271, Section 8) in seconds. The applied value may be different than the configured value, as it depends on the negotiated hold time interval. type: integer applied-keep-alive-time-seconds: description: | Applied initial value for the BGP KeepaliveTimer (RFC 4271, Section 8) in seconds. The applied value holds the value that is in effect on the current BGP session. type: integer local-capabilities: description: Capabilities announced by the local peer type: array items: "$ref": "#/definitions/BgpCapabilities" remote-capabilities: description: Capabilities announced by the remote peer type: array items: "$ref": "#/definitions/BgpCapabilities" BgpPeerFamilies: description: |- BGP AFI SAFI state of the peer properties: afi: description: BGP address family indicator type: string safi: description: BGP subsequent address family indicator type: string received: description: Number of routes received from the peer of this address family type: integer accepted: description: Number of routes accepted from the peer of this address family type: integer advertised: description: Number of routes advertised of this address family to the peer type: integer BgpGracefulRestart: description: |- BGP graceful restart parameters negotiated with the peer. properties: enabled: description: |- When set, graceful restart capability is negotiated for all AFI/SAFIs of this peer. type: boolean restart-time-seconds: description: |- This is the time advertised to peer for the BGP session to be re-established after a restart. After this period, peer will remove stale routes. (RFC 4724 section 4.2) type: integer BgpRoute: description: | Single BGP route retrieved from the RIB of underlying router Deprecated: This will be removed in the future. properties: router-asn: description: Autonomous System Number (ASN) identifying a BGP virtual router instance type: integer neighbor: description: IP address specifying a BGP neighbor if the source table type is adj-rib-in or adj-rib-out type: string prefix: description: IP prefix of the route type: string paths: description: List of routing paths leading towards the prefix type: array items: "$ref": "#/definitions/BgpPath" BgpPath: description: Single BGP routing Path containing BGP Network Layer Reachability Information (NLRI) and path attributes properties: family: description: Address Family Indicator (AFI) and Subsequent Address Family Indicator (SAFI) of the path "$ref": "#/definitions/BgpFamily" nlri: description: Network Layer Reachability Information of the path "$ref": "#/definitions/BgpNlri" path-attributes: description: List of BGP path attributes specific for the path type: array items: "$ref": "#/definitions/BgpPathAttribute" age-nanoseconds: description: Age of the path (time since its creation) in nanoseconds type: integer best: description: True value flags the best path towards the destination prefix type: boolean stale: description: True value marks the path as stale type: boolean BgpFamily: description: Address Family Indicator (AFI) and Subsequent Address Family Indicator (SAFI) of the path properties: afi: description: Address Family Indicator (AFI) of the path type: string safi: description: Subsequent Address Family Indicator (SAFI) of the path type: string BgpNlri: description: Network Layer Reachability Information (NLRI) of the path properties: base64: description: Base64-encoded NLRI in the BGP UPDATE message format type: string BgpPathAttribute: description: Single BGP path attribute specific for the path properties: base64: description: Base64-encoded BGP path attribute in the BGP UPDATE message format type: string BgpRoutePolicy: description: | Single BGP route policy retrieved from the underlying router Deprecated: This will be removed in the future. properties: router-asn: description: Autonomous System Number (ASN) identifying a BGP virtual router instance type: integer name: description: Name of the route policy type: string type: description: Type of the route policy type: string enum: - export - import statements: description: List of the route policy statements type: array items: "$ref": "#/definitions/BgpRoutePolicyStatement" BgpRoutePolicyStatement: description: Single BGP route policy statement properties: match-neighbors: description: Matches BGP neighbor IP address with the provided match rules "$ref": "#/definitions/BgpRoutePolicyNeighborMatch" match-families: description: Matches any of the provided address families. If empty matches all address families. type: array items: "$ref": "#/definitions/BgpFamily" match-prefixes: description: Matches CIDR prefix with the provided match rules "$ref": "#/definitions/BgpRoutePolicyPrefixMatch" route-action: description: RIB processing action taken on the matched route type: string enum: - none - accept - reject add-communities: description: List of BGP standard community values to be added to the matched route type: array items: type: string add-large-communities: description: List of BGP large community values to be added to the matched route type: array items: type: string set-local-preference: description: BGP local preference value to be set on the matched route type: integer nexthop: description: BGP nexthop action "$ref": "#/definitions/BgpRoutePolicyNexthopAction" BgpRoutePolicyNexthopAction: description: BGP nexthop action properties: self: description: Set nexthop to the IP address of itself type: boolean unchanged: description: Don't change nexthop type: boolean BgpRoutePolicyNeighborMatch: description: Matches a neighbor in a BGP route policy properties: type: description: Defines matching logic in case of multiple neighbors "$ref": "#/definitions/BgpRoutePolicyMatchType" neighbors: description: Neighbor IP addresses to match with type: array items: type: string BgpRoutePolicyPrefixMatch: description: Matches a CIDR prefix in a BGP route policy properties: type: description: Defines matching logic in case of multiple prefixes "$ref": "#/definitions/BgpRoutePolicyMatchType" prefixes: description: Prefixes to match with type: array items: "$ref": "#/definitions/BgpRoutePolicyPrefix" BgpRoutePolicyPrefix: description: Matches a CIDR prefix in a BGP route policy properties: cidr: description: CIDR prefix to match with type: string prefix-len-min: description: Minimal prefix length that will match if it falls under CIDR type: integer prefix-len-max: description: Maximal prefix length that will match if it falls under CIDR type: integer BgpRoutePolicyMatchType: description: Defines BGP route policy matching logic in case of multiple match elements. type: string enum: - any - all - invert BgpCapabilities: description: Represents the BGP capabilities. properties: capabilities: description: Base64-encoded BGP capabilities details type: string Label: description: Label is Cilium's representation of a label type: object properties: key: type: string value: type: string source: description: Source can be one of the above values (e.g. LabelSourceK8s) type: string LabelArray: description: LabelArray is an array of labels forming a set type: array items: "$ref": "#/definitions/Label" LabelArrayList: description: LabelArrayList is an array of LabelArrays forming a set type: array items: "$ref": "#/definitions/LabelArray"