hongming
549
vendor/istio.io/api/networking/v1beta1/destination_rule.gen.json
generated
vendored
Normal file
549
vendor/istio.io/api/networking/v1beta1/destination_rule.gen.json
generated
vendored
Normal file
@@ -0,0 +1,549 @@
|
||||
{
|
||||
"openapi": "3.0.0",
|
||||
"info": {
|
||||
"title": "Configuration affecting load balancing, outlier detection, etc.",
|
||||
"version": "v1beta1"
|
||||
},
|
||||
"components": {
|
||||
"schemas": {
|
||||
"istio.networking.v1beta1.DestinationRule": {
|
||||
"description": "DestinationRule defines policies that apply to traffic intended for a service after routing has occurred.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"host": {
|
||||
"description": "The name of a service from the service registry. Service names are looked up from the platform's service registry (e.g., Kubernetes services, Consul services, etc.) and from the hosts declared by [ServiceEntries](https://istio.io/docs/reference/config/networking/service-entry/#ServiceEntry). Rules defined for services that do not exist in the service registry will be ignored.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"trafficPolicy": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.TrafficPolicy"
|
||||
},
|
||||
"subsets": {
|
||||
"description": "One or more named sets that represent individual versions of a service. Traffic policies can be overridden at subset level.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.Subset"
|
||||
}
|
||||
},
|
||||
"exportTo": {
|
||||
"description": "A list of namespaces to which this destination rule is exported. The resolution of a destination rule to apply to a service occurs in the context of a hierarchy of namespaces. Exporting a destination rule allows it to be included in the resolution hierarchy for services in other namespaces. This feature provides a mechanism for service owners and mesh administrators to control the visibility of destination rules across namespace boundaries.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.TrafficPolicy": {
|
||||
"description": "Traffic policies to apply for a specific destination, across all destination ports. See DestinationRule for examples.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"loadBalancer": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.LoadBalancerSettings"
|
||||
},
|
||||
"connectionPool": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.ConnectionPoolSettings"
|
||||
},
|
||||
"outlierDetection": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.OutlierDetection"
|
||||
},
|
||||
"tls": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.ClientTLSSettings"
|
||||
},
|
||||
"portLevelSettings": {
|
||||
"description": "Traffic policies specific to individual ports. Note that port level settings will override the destination-level settings. Traffic settings specified at the destination-level will not be inherited when overridden by port-level settings, i.e. default values will be applied to fields omitted in port-level traffic policies.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.TrafficPolicy.PortTrafficPolicy"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.Subset": {
|
||||
"description": "A subset of endpoints of a service. Subsets can be used for scenarios like A/B testing, or routing to a specific version of a service. Refer to [VirtualService](https://istio.io/docs/reference/config/networking/virtual-service/#VirtualService) documentation for examples of using subsets in these scenarios. In addition, traffic policies defined at the service-level can be overridden at a subset-level. The following rule uses a round robin load balancing policy for all traffic going to a subset named testversion that is composed of endpoints (e.g., pods) with labels (version:v3).",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name of the subset. The service name and the subset name can be used for traffic splitting in a route rule.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"trafficPolicy": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.TrafficPolicy"
|
||||
},
|
||||
"labels": {
|
||||
"description": "Labels apply a filter over the endpoints of a service in the service registry. See route rules for examples of usage.",
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.LoadBalancerSettings": {
|
||||
"description": "Load balancing policies to apply for a specific destination. See Envoy's load balancing [documentation](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancing) for more details.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"localityLbSetting": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.LocalityLoadBalancerSetting"
|
||||
}
|
||||
},
|
||||
"oneOf": [
|
||||
{
|
||||
"not": {
|
||||
"anyOf": [
|
||||
{
|
||||
"required": [
|
||||
"simple"
|
||||
],
|
||||
"properties": {
|
||||
"simple": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.LoadBalancerSettings.SimpleLB"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"consistentHash"
|
||||
],
|
||||
"properties": {
|
||||
"consistentHash": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.LoadBalancerSettings.ConsistentHashLB"
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"simple"
|
||||
],
|
||||
"properties": {
|
||||
"simple": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.LoadBalancerSettings.SimpleLB"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"consistentHash"
|
||||
],
|
||||
"properties": {
|
||||
"consistentHash": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.LoadBalancerSettings.ConsistentHashLB"
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"istio.networking.v1beta1.ConnectionPoolSettings": {
|
||||
"description": "Connection pool settings for an upstream host. The settings apply to each individual host in the upstream service. See Envoy's [circuit breaker](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/circuit_breaking) for more details. Connection pool settings can be applied at the TCP level as well as at HTTP level.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"tcp": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.ConnectionPoolSettings.TCPSettings"
|
||||
},
|
||||
"http": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.ConnectionPoolSettings.HTTPSettings"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.OutlierDetection": {
|
||||
"description": "A Circuit breaker implementation that tracks the status of each individual host in the upstream service. Applicable to both HTTP and TCP services. For HTTP services, hosts that continually return 5xx errors for API calls are ejected from the pool for a pre-defined period of time. For TCP services, connection timeouts or connection failures to a given host counts as an error when measuring the consecutive errors metric. See Envoy's [outlier detection](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/outlier) for more details.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"interval": {
|
||||
"description": "Time interval between ejection sweep analysis. format: 1h/1m/1s/1ms. MUST BE \u003e=1ms. Default is 10s.",
|
||||
"type": "string"
|
||||
},
|
||||
"consecutiveErrors": {
|
||||
"description": "Number of errors before a host is ejected from the connection pool. Defaults to 5. When the upstream host is accessed over HTTP, a 502, 503, or 504 return code qualifies as an error. When the upstream host is accessed over an opaque TCP connection, connect timeouts and connection error/failure events qualify as an error. $hide_from_docs",
|
||||
"type": "integer",
|
||||
"format": "int32",
|
||||
"deprecated": true
|
||||
},
|
||||
"consecutiveGatewayErrors": {
|
||||
"description": "Number of gateway errors before a host is ejected from the connection pool. When the upstream host is accessed over HTTP, a 502, 503, or 504 return code qualifies as a gateway error. When the upstream host is accessed over an opaque TCP connection, connect timeouts and connection error/failure events qualify as a gateway error. This feature is disabled by default or when set to the value 0.",
|
||||
"type": "integer",
|
||||
"nullable": true
|
||||
},
|
||||
"consecutive5xxErrors": {
|
||||
"description": "Number of 5xx errors before a host is ejected from the connection pool. When the upstream host is accessed over an opaque TCP connection, connect timeouts, connection error/failure and request failure events qualify as a 5xx error. This feature defaults to 5 but can be disabled by setting the value to 0.",
|
||||
"type": "integer",
|
||||
"nullable": true
|
||||
},
|
||||
"baseEjectionTime": {
|
||||
"description": "Minimum ejection duration. A host will remain ejected for a period equal to the product of minimum ejection duration and the number of times the host has been ejected. This technique allows the system to automatically increase the ejection period for unhealthy upstream servers. format: 1h/1m/1s/1ms. MUST BE \u003e=1ms. Default is 30s.",
|
||||
"type": "string"
|
||||
},
|
||||
"maxEjectionPercent": {
|
||||
"description": "Maximum % of hosts in the load balancing pool for the upstream service that can be ejected. Defaults to 10%.",
|
||||
"type": "integer",
|
||||
"format": "int32"
|
||||
},
|
||||
"minHealthPercent": {
|
||||
"description": "Outlier detection will be enabled as long as the associated load balancing pool has at least min_health_percent hosts in healthy mode. When the percentage of healthy hosts in the load balancing pool drops below this threshold, outlier detection will be disabled and the proxy will load balance across all hosts in the pool (healthy and unhealthy). The threshold can be disabled by setting it to 0%. The default is 0% as it's not typically applicable in k8s environments with few pods per service.",
|
||||
"type": "integer",
|
||||
"format": "int32"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.ClientTLSSettings": {
|
||||
"description": "SSL/TLS related settings for upstream connections. See Envoy's [TLS context](https://www.envoyproxy.io/docs/envoy/latest/api-v2/api/v2/auth/cert.proto.html) for more details. These settings are common to both HTTP and TCP upstreams.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"mode": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.ClientTLSSettings.TLSmode"
|
||||
},
|
||||
"clientCertificate": {
|
||||
"description": "REQUIRED if mode is `MUTUAL`. The path to the file holding the client-side TLS certificate to use. Should be empty if mode is `ISTIO_MUTUAL`.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"privateKey": {
|
||||
"description": "REQUIRED if mode is `MUTUAL`. The path to the file holding the client's private key. Should be empty if mode is `ISTIO_MUTUAL`.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"caCertificates": {
|
||||
"description": "OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate. If omitted, the proxy will not verify the server's certificate. Should be empty if mode is `ISTIO_MUTUAL`.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"subjectAltNames": {
|
||||
"description": "A list of alternate names to verify the subject identity in the certificate. If specified, the proxy will verify that the server certificate's subject alt name matches one of the specified values. If specified, this list overrides the value of subject_alt_names from the ServiceEntry.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"sni": {
|
||||
"description": "SNI string to present to the server during TLS handshake.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.TrafficPolicy.PortTrafficPolicy": {
|
||||
"description": "Traffic policies that apply to specific ports of the service",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"loadBalancer": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.LoadBalancerSettings"
|
||||
},
|
||||
"connectionPool": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.ConnectionPoolSettings"
|
||||
},
|
||||
"outlierDetection": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.OutlierDetection"
|
||||
},
|
||||
"tls": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.ClientTLSSettings"
|
||||
},
|
||||
"port": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.PortSelector"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.PortSelector": {
|
||||
"description": "PortSelector specifies the number of a port to be used for matching or selection for final routing.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"number": {
|
||||
"description": "Valid port number",
|
||||
"type": "integer"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.LocalityLoadBalancerSetting": {
|
||||
"description": "Locality-weighted load balancing allows administrators to control the distribution of traffic to endpoints based on the localities of where the traffic originates and where it will terminate. These localities are specified using arbitrary labels that designate a hierarchy of localities in {region}/{zone}/{sub-zone} form. For additional detail refer to [Locality Weight](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/locality_weight) The following example shows how to setup locality weights mesh-wide.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"distribute": {
|
||||
"description": "Optional: only one of distribute or failover can be set. Explicitly specify loadbalancing weight across different zones and geographical locations. Refer to [Locality weighted load balancing](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/locality_weight) If empty, the locality weight is set according to the endpoints number within it.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.LocalityLoadBalancerSetting.Distribute"
|
||||
}
|
||||
},
|
||||
"failover": {
|
||||
"description": "Optional: only failover or distribute can be set. Explicitly specify the region traffic will land on when endpoints in local region becomes unhealthy. Should be used together with OutlierDetection to detect unhealthy endpoints. Note: if no OutlierDetection specified, this will not take effect.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.LocalityLoadBalancerSetting.Failover"
|
||||
}
|
||||
},
|
||||
"enabled": {
|
||||
"description": "enable locality load balancing, this is DestinationRule-level and will override mesh wide settings in entirety. e.g. true means that turn on locality load balancing for this DestinationRule no matter what mesh wide settings is.",
|
||||
"type": "boolean",
|
||||
"nullable": true
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.LoadBalancerSettings.SimpleLB": {
|
||||
"description": "Standard load balancing algorithms that require no tuning.",
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"ROUND_ROBIN",
|
||||
"LEAST_CONN",
|
||||
"RANDOM",
|
||||
"PASSTHROUGH"
|
||||
]
|
||||
},
|
||||
"istio.networking.v1beta1.LoadBalancerSettings.ConsistentHashLB": {
|
||||
"description": "Consistent Hash-based load balancing can be used to provide soft session affinity based on HTTP headers, cookies or other properties. This load balancing policy is applicable only for HTTP connections. The affinity to a particular destination host will be lost when one or more hosts are added/removed from the destination service.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"minimumRingSize": {
|
||||
"description": "The minimum number of virtual nodes to use for the hash ring. Defaults to 1024. Larger ring sizes result in more granular load distributions. If the number of hosts in the load balancing pool is larger than the ring size, each host will be assigned a single virtual node.",
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"oneOf": [
|
||||
{
|
||||
"not": {
|
||||
"anyOf": [
|
||||
{
|
||||
"required": [
|
||||
"httpHeaderName"
|
||||
],
|
||||
"properties": {
|
||||
"httpHeaderName": {
|
||||
"description": "Hash based on a specific HTTP header.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"httpCookie"
|
||||
],
|
||||
"properties": {
|
||||
"httpCookie": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.LoadBalancerSettings.ConsistentHashLB.HTTPCookie"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"useSourceIp"
|
||||
],
|
||||
"properties": {
|
||||
"useSourceIp": {
|
||||
"description": "Hash based on the source IP address.",
|
||||
"type": "boolean"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"httpQueryParameterName"
|
||||
],
|
||||
"properties": {
|
||||
"httpQueryParameterName": {
|
||||
"description": "Hash based on a specific HTTP query parameter.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"httpHeaderName"
|
||||
],
|
||||
"properties": {
|
||||
"httpHeaderName": {
|
||||
"description": "Hash based on a specific HTTP header.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"httpCookie"
|
||||
],
|
||||
"properties": {
|
||||
"httpCookie": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.LoadBalancerSettings.ConsistentHashLB.HTTPCookie"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"useSourceIp"
|
||||
],
|
||||
"properties": {
|
||||
"useSourceIp": {
|
||||
"description": "Hash based on the source IP address.",
|
||||
"type": "boolean"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"httpQueryParameterName"
|
||||
],
|
||||
"properties": {
|
||||
"httpQueryParameterName": {
|
||||
"description": "Hash based on a specific HTTP query parameter.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"istio.networking.v1beta1.LoadBalancerSettings.ConsistentHashLB.HTTPCookie": {
|
||||
"description": "Describes a HTTP cookie that will be used as the hash key for the Consistent Hash load balancer. If the cookie is not present, it will be generated.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"path": {
|
||||
"description": "Path to set for the cookie.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"name": {
|
||||
"description": "Name of the cookie.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"ttl": {
|
||||
"description": "Lifetime of the cookie.",
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.ConnectionPoolSettings.TCPSettings": {
|
||||
"description": "Settings common to both HTTP and TCP upstream connections.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"maxConnections": {
|
||||
"description": "Maximum number of HTTP1 /TCP connections to a destination host. Default 2^32-1.",
|
||||
"type": "integer",
|
||||
"format": "int32"
|
||||
},
|
||||
"connectTimeout": {
|
||||
"description": "TCP connection timeout.",
|
||||
"type": "string"
|
||||
},
|
||||
"tcpKeepalive": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.ConnectionPoolSettings.TCPSettings.TcpKeepalive"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.ConnectionPoolSettings.HTTPSettings": {
|
||||
"description": "Settings applicable to HTTP1.1/HTTP2/GRPC connections.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"http1MaxPendingRequests": {
|
||||
"description": "Maximum number of pending HTTP requests to a destination. Default 2^32-1.",
|
||||
"type": "integer",
|
||||
"format": "int32"
|
||||
},
|
||||
"http2MaxRequests": {
|
||||
"description": "Maximum number of requests to a backend. Default 2^32-1.",
|
||||
"type": "integer",
|
||||
"format": "int32"
|
||||
},
|
||||
"maxRequestsPerConnection": {
|
||||
"description": "Maximum number of requests per connection to a backend. Setting this parameter to 1 disables keep alive. Default 0, meaning \"unlimited\", up to 2^29.",
|
||||
"type": "integer",
|
||||
"format": "int32"
|
||||
},
|
||||
"maxRetries": {
|
||||
"description": "Maximum number of retries that can be outstanding to all hosts in a cluster at a given time. Defaults to 2^32-1.",
|
||||
"type": "integer",
|
||||
"format": "int32"
|
||||
},
|
||||
"idleTimeout": {
|
||||
"description": "The idle timeout for upstream connection pool connections. The idle timeout is defined as the period in which there are no active requests. If not set, the default is 1 hour. When the idle timeout is reached the connection will be closed. Note that request based timeouts mean that HTTP/2 PINGs will not keep the connection alive. Applies to both HTTP1.1 and HTTP2 connections.",
|
||||
"type": "string"
|
||||
},
|
||||
"h2UpgradePolicy": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.ConnectionPoolSettings.HTTPSettings.H2UpgradePolicy"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.ConnectionPoolSettings.TCPSettings.TcpKeepalive": {
|
||||
"description": "TCP keepalive.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"time": {
|
||||
"description": "The time duration a connection needs to be idle before keep-alive probes start being sent. Default is to use the OS level configuration (unless overridden, Linux defaults to 7200s (ie 2 hours.)",
|
||||
"type": "string"
|
||||
},
|
||||
"probes": {
|
||||
"description": "Maximum number of keepalive probes to send without response before deciding the connection is dead. Default is to use the OS level configuration (unless overridden, Linux defaults to 9.)",
|
||||
"type": "integer"
|
||||
},
|
||||
"interval": {
|
||||
"description": "The time duration between keep-alive probes. Default is to use the OS level configuration (unless overridden, Linux defaults to 75s.)",
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.ConnectionPoolSettings.HTTPSettings.H2UpgradePolicy": {
|
||||
"description": "Policy for upgrading http1.1 connections to http2.",
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"DEFAULT",
|
||||
"DO_NOT_UPGRADE",
|
||||
"UPGRADE"
|
||||
]
|
||||
},
|
||||
"istio.networking.v1beta1.ClientTLSSettings.TLSmode": {
|
||||
"description": "TLS connection mode",
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"DISABLE",
|
||||
"SIMPLE",
|
||||
"MUTUAL",
|
||||
"ISTIO_MUTUAL"
|
||||
]
|
||||
},
|
||||
"istio.networking.v1beta1.LocalityLoadBalancerSetting.Distribute": {
|
||||
"description": "Describes how traffic originating in the 'from' zone or sub-zone is distributed over a set of 'to' zones. Syntax for specifying a zone is {region}/{zone}/{sub-zone} and terminal wildcards are allowed on any segment of the specification. Examples: * - matches all localities us-west/* - all zones and sub-zones within the us-west region us-west/zone-1/* - all sub-zones within us-west/zone-1",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"from": {
|
||||
"description": "Originating locality, '/' separated, e.g. 'region/zone/sub_zone'.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"to": {
|
||||
"description": "Map of upstream localities to traffic distribution weights. The sum of all weights should be == 100. Any locality not assigned a weight will receive no traffic.",
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
"type": "integer"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.LocalityLoadBalancerSetting.Failover": {
|
||||
"description": "Specify the traffic failover policy across regions. Since zone and sub-zone failover is supported by default this only needs to be specified for regions when the operator needs to constrain traffic failover so that the default behavior of failing over to any endpoint globally does not apply. This is useful when failing over traffic across regions would not improve service health or may need to be restricted for other reasons like regulatory controls.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"from": {
|
||||
"description": "Originating region.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"to": {
|
||||
"description": "Destination region the traffic will fail over to when endpoints in the 'from' region becomes unhealthy.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
6951
vendor/istio.io/api/networking/v1beta1/destination_rule.pb.go
generated
vendored
Normal file
6951
vendor/istio.io/api/networking/v1beta1/destination_rule.pb.go
generated
vendored
Normal file
File diff suppressed because it is too large
Load Diff
1027
vendor/istio.io/api/networking/v1beta1/destination_rule.proto
generated
vendored
Normal file
1027
vendor/istio.io/api/networking/v1beta1/destination_rule.proto
generated
vendored
Normal file
File diff suppressed because it is too large
Load Diff
164
vendor/istio.io/api/networking/v1beta1/destination_rule_deepcopy.gen.go
generated
vendored
Normal file
164
vendor/istio.io/api/networking/v1beta1/destination_rule_deepcopy.gen.go
generated
vendored
Normal file
@@ -0,0 +1,164 @@
|
||||
// Code generated by protoc-gen-gogo. DO NOT EDIT.
|
||||
// source: networking/v1beta1/destination_rule.proto
|
||||
|
||||
// `DestinationRule` defines policies that apply to traffic intended for a
|
||||
// service after routing has occurred. These rules specify configuration
|
||||
// for load balancing, connection pool size from the sidecar, and outlier
|
||||
// detection settings to detect and evict unhealthy hosts from the load
|
||||
// balancing pool. For example, a simple load balancing policy for the
|
||||
// ratings service would look as follows:
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: DestinationRule
|
||||
// metadata:
|
||||
// name: bookinfo-ratings
|
||||
// spec:
|
||||
// host: ratings.prod.svc.cluster.local
|
||||
// trafficPolicy:
|
||||
// loadBalancer:
|
||||
// simple: LEAST_CONN
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: DestinationRule
|
||||
// metadata:
|
||||
// name: bookinfo-ratings
|
||||
// spec:
|
||||
// host: ratings.prod.svc.cluster.local
|
||||
// trafficPolicy:
|
||||
// loadBalancer:
|
||||
// simple: LEAST_CONN
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// Version specific policies can be specified by defining a named
|
||||
// `subset` and overriding the settings specified at the service level. The
|
||||
// following rule uses a round robin load balancing policy for all traffic
|
||||
// going to a subset named testversion that is composed of endpoints (e.g.,
|
||||
// pods) with labels (version:v3).
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: DestinationRule
|
||||
// metadata:
|
||||
// name: bookinfo-ratings
|
||||
// spec:
|
||||
// host: ratings.prod.svc.cluster.local
|
||||
// trafficPolicy:
|
||||
// loadBalancer:
|
||||
// simple: LEAST_CONN
|
||||
// subsets:
|
||||
// - name: testversion
|
||||
// labels:
|
||||
// version: v3
|
||||
// trafficPolicy:
|
||||
// loadBalancer:
|
||||
// simple: ROUND_ROBIN
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: DestinationRule
|
||||
// metadata:
|
||||
// name: bookinfo-ratings
|
||||
// spec:
|
||||
// host: ratings.prod.svc.cluster.local
|
||||
// trafficPolicy:
|
||||
// loadBalancer:
|
||||
// simple: LEAST_CONN
|
||||
// subsets:
|
||||
// - name: testversion
|
||||
// labels:
|
||||
// version: v3
|
||||
// trafficPolicy:
|
||||
// loadBalancer:
|
||||
// simple: ROUND_ROBIN
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// **Note:** Policies specified for subsets will not take effect until
|
||||
// a route rule explicitly sends traffic to this subset.
|
||||
//
|
||||
// Traffic policies can be customized to specific ports as well. The
|
||||
// following rule uses the least connection load balancing policy for all
|
||||
// traffic to port 80, while uses a round robin load balancing setting for
|
||||
// traffic to the port 9080.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: DestinationRule
|
||||
// metadata:
|
||||
// name: bookinfo-ratings-port
|
||||
// spec:
|
||||
// host: ratings.prod.svc.cluster.local
|
||||
// trafficPolicy: # Apply to all ports
|
||||
// portLevelSettings:
|
||||
// - port:
|
||||
// number: 80
|
||||
// loadBalancer:
|
||||
// simple: LEAST_CONN
|
||||
// - port:
|
||||
// number: 9080
|
||||
// loadBalancer:
|
||||
// simple: ROUND_ROBIN
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: DestinationRule
|
||||
// metadata:
|
||||
// name: bookinfo-ratings-port
|
||||
// spec:
|
||||
// host: ratings.prod.svc.cluster.local
|
||||
// trafficPolicy: # Apply to all ports
|
||||
// portLevelSettings:
|
||||
// - port:
|
||||
// number: 80
|
||||
// loadBalancer:
|
||||
// simple: LEAST_CONN
|
||||
// - port:
|
||||
// number: 9080
|
||||
// loadBalancer:
|
||||
// simple: ROUND_ROBIN
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
|
||||
package v1beta1
|
||||
|
||||
import (
|
||||
fmt "fmt"
|
||||
_ "github.com/gogo/protobuf/gogoproto"
|
||||
proto "github.com/gogo/protobuf/proto"
|
||||
_ "github.com/gogo/protobuf/types"
|
||||
_ "istio.io/gogo-genproto/googleapis/google/api"
|
||||
math "math"
|
||||
)
|
||||
|
||||
// Reference imports to suppress errors if they are not otherwise used.
|
||||
var _ = proto.Marshal
|
||||
var _ = fmt.Errorf
|
||||
var _ = math.Inf
|
||||
|
||||
// DeepCopyInto supports using DestinationRule within kubernetes types, where deepcopy-gen is used.
|
||||
func (in *DestinationRule) DeepCopyInto(out *DestinationRule) {
|
||||
p := proto.Clone(in).(*DestinationRule)
|
||||
*out = *p
|
||||
}
|
||||
341
vendor/istio.io/api/networking/v1beta1/destination_rule_json.gen.go
generated
vendored
Normal file
341
vendor/istio.io/api/networking/v1beta1/destination_rule_json.gen.go
generated
vendored
Normal file
@@ -0,0 +1,341 @@
|
||||
// Code generated by protoc-gen-gogo. DO NOT EDIT.
|
||||
// source: networking/v1beta1/destination_rule.proto
|
||||
|
||||
// `DestinationRule` defines policies that apply to traffic intended for a
|
||||
// service after routing has occurred. These rules specify configuration
|
||||
// for load balancing, connection pool size from the sidecar, and outlier
|
||||
// detection settings to detect and evict unhealthy hosts from the load
|
||||
// balancing pool. For example, a simple load balancing policy for the
|
||||
// ratings service would look as follows:
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: DestinationRule
|
||||
// metadata:
|
||||
// name: bookinfo-ratings
|
||||
// spec:
|
||||
// host: ratings.prod.svc.cluster.local
|
||||
// trafficPolicy:
|
||||
// loadBalancer:
|
||||
// simple: LEAST_CONN
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: DestinationRule
|
||||
// metadata:
|
||||
// name: bookinfo-ratings
|
||||
// spec:
|
||||
// host: ratings.prod.svc.cluster.local
|
||||
// trafficPolicy:
|
||||
// loadBalancer:
|
||||
// simple: LEAST_CONN
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// Version specific policies can be specified by defining a named
|
||||
// `subset` and overriding the settings specified at the service level. The
|
||||
// following rule uses a round robin load balancing policy for all traffic
|
||||
// going to a subset named testversion that is composed of endpoints (e.g.,
|
||||
// pods) with labels (version:v3).
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: DestinationRule
|
||||
// metadata:
|
||||
// name: bookinfo-ratings
|
||||
// spec:
|
||||
// host: ratings.prod.svc.cluster.local
|
||||
// trafficPolicy:
|
||||
// loadBalancer:
|
||||
// simple: LEAST_CONN
|
||||
// subsets:
|
||||
// - name: testversion
|
||||
// labels:
|
||||
// version: v3
|
||||
// trafficPolicy:
|
||||
// loadBalancer:
|
||||
// simple: ROUND_ROBIN
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: DestinationRule
|
||||
// metadata:
|
||||
// name: bookinfo-ratings
|
||||
// spec:
|
||||
// host: ratings.prod.svc.cluster.local
|
||||
// trafficPolicy:
|
||||
// loadBalancer:
|
||||
// simple: LEAST_CONN
|
||||
// subsets:
|
||||
// - name: testversion
|
||||
// labels:
|
||||
// version: v3
|
||||
// trafficPolicy:
|
||||
// loadBalancer:
|
||||
// simple: ROUND_ROBIN
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// **Note:** Policies specified for subsets will not take effect until
|
||||
// a route rule explicitly sends traffic to this subset.
|
||||
//
|
||||
// Traffic policies can be customized to specific ports as well. The
|
||||
// following rule uses the least connection load balancing policy for all
|
||||
// traffic to port 80, while uses a round robin load balancing setting for
|
||||
// traffic to the port 9080.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: DestinationRule
|
||||
// metadata:
|
||||
// name: bookinfo-ratings-port
|
||||
// spec:
|
||||
// host: ratings.prod.svc.cluster.local
|
||||
// trafficPolicy: # Apply to all ports
|
||||
// portLevelSettings:
|
||||
// - port:
|
||||
// number: 80
|
||||
// loadBalancer:
|
||||
// simple: LEAST_CONN
|
||||
// - port:
|
||||
// number: 9080
|
||||
// loadBalancer:
|
||||
// simple: ROUND_ROBIN
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: DestinationRule
|
||||
// metadata:
|
||||
// name: bookinfo-ratings-port
|
||||
// spec:
|
||||
// host: ratings.prod.svc.cluster.local
|
||||
// trafficPolicy: # Apply to all ports
|
||||
// portLevelSettings:
|
||||
// - port:
|
||||
// number: 80
|
||||
// loadBalancer:
|
||||
// simple: LEAST_CONN
|
||||
// - port:
|
||||
// number: 9080
|
||||
// loadBalancer:
|
||||
// simple: ROUND_ROBIN
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
|
||||
package v1beta1
|
||||
|
||||
import (
|
||||
bytes "bytes"
|
||||
fmt "fmt"
|
||||
_ "github.com/gogo/protobuf/gogoproto"
|
||||
github_com_gogo_protobuf_jsonpb "github.com/gogo/protobuf/jsonpb"
|
||||
proto "github.com/gogo/protobuf/proto"
|
||||
_ "github.com/gogo/protobuf/types"
|
||||
_ "istio.io/gogo-genproto/googleapis/google/api"
|
||||
math "math"
|
||||
)
|
||||
|
||||
// Reference imports to suppress errors if they are not otherwise used.
|
||||
var _ = proto.Marshal
|
||||
var _ = fmt.Errorf
|
||||
var _ = math.Inf
|
||||
|
||||
// MarshalJSON is a custom marshaler for DestinationRule
|
||||
func (this *DestinationRule) MarshalJSON() ([]byte, error) {
|
||||
str, err := DestinationRuleMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for DestinationRule
|
||||
func (this *DestinationRule) UnmarshalJSON(b []byte) error {
|
||||
return DestinationRuleUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for TrafficPolicy
|
||||
func (this *TrafficPolicy) MarshalJSON() ([]byte, error) {
|
||||
str, err := DestinationRuleMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for TrafficPolicy
|
||||
func (this *TrafficPolicy) UnmarshalJSON(b []byte) error {
|
||||
return DestinationRuleUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for TrafficPolicy_PortTrafficPolicy
|
||||
func (this *TrafficPolicy_PortTrafficPolicy) MarshalJSON() ([]byte, error) {
|
||||
str, err := DestinationRuleMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for TrafficPolicy_PortTrafficPolicy
|
||||
func (this *TrafficPolicy_PortTrafficPolicy) UnmarshalJSON(b []byte) error {
|
||||
return DestinationRuleUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for Subset
|
||||
func (this *Subset) MarshalJSON() ([]byte, error) {
|
||||
str, err := DestinationRuleMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for Subset
|
||||
func (this *Subset) UnmarshalJSON(b []byte) error {
|
||||
return DestinationRuleUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for LoadBalancerSettings
|
||||
func (this *LoadBalancerSettings) MarshalJSON() ([]byte, error) {
|
||||
str, err := DestinationRuleMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for LoadBalancerSettings
|
||||
func (this *LoadBalancerSettings) UnmarshalJSON(b []byte) error {
|
||||
return DestinationRuleUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for LoadBalancerSettings_ConsistentHashLB
|
||||
func (this *LoadBalancerSettings_ConsistentHashLB) MarshalJSON() ([]byte, error) {
|
||||
str, err := DestinationRuleMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for LoadBalancerSettings_ConsistentHashLB
|
||||
func (this *LoadBalancerSettings_ConsistentHashLB) UnmarshalJSON(b []byte) error {
|
||||
return DestinationRuleUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for LoadBalancerSettings_ConsistentHashLB_HTTPCookie
|
||||
func (this *LoadBalancerSettings_ConsistentHashLB_HTTPCookie) MarshalJSON() ([]byte, error) {
|
||||
str, err := DestinationRuleMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for LoadBalancerSettings_ConsistentHashLB_HTTPCookie
|
||||
func (this *LoadBalancerSettings_ConsistentHashLB_HTTPCookie) UnmarshalJSON(b []byte) error {
|
||||
return DestinationRuleUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for ConnectionPoolSettings
|
||||
func (this *ConnectionPoolSettings) MarshalJSON() ([]byte, error) {
|
||||
str, err := DestinationRuleMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for ConnectionPoolSettings
|
||||
func (this *ConnectionPoolSettings) UnmarshalJSON(b []byte) error {
|
||||
return DestinationRuleUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for ConnectionPoolSettings_TCPSettings
|
||||
func (this *ConnectionPoolSettings_TCPSettings) MarshalJSON() ([]byte, error) {
|
||||
str, err := DestinationRuleMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for ConnectionPoolSettings_TCPSettings
|
||||
func (this *ConnectionPoolSettings_TCPSettings) UnmarshalJSON(b []byte) error {
|
||||
return DestinationRuleUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for ConnectionPoolSettings_TCPSettings_TcpKeepalive
|
||||
func (this *ConnectionPoolSettings_TCPSettings_TcpKeepalive) MarshalJSON() ([]byte, error) {
|
||||
str, err := DestinationRuleMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for ConnectionPoolSettings_TCPSettings_TcpKeepalive
|
||||
func (this *ConnectionPoolSettings_TCPSettings_TcpKeepalive) UnmarshalJSON(b []byte) error {
|
||||
return DestinationRuleUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for ConnectionPoolSettings_HTTPSettings
|
||||
func (this *ConnectionPoolSettings_HTTPSettings) MarshalJSON() ([]byte, error) {
|
||||
str, err := DestinationRuleMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for ConnectionPoolSettings_HTTPSettings
|
||||
func (this *ConnectionPoolSettings_HTTPSettings) UnmarshalJSON(b []byte) error {
|
||||
return DestinationRuleUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for OutlierDetection
|
||||
func (this *OutlierDetection) MarshalJSON() ([]byte, error) {
|
||||
str, err := DestinationRuleMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for OutlierDetection
|
||||
func (this *OutlierDetection) UnmarshalJSON(b []byte) error {
|
||||
return DestinationRuleUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for ClientTLSSettings
|
||||
func (this *ClientTLSSettings) MarshalJSON() ([]byte, error) {
|
||||
str, err := DestinationRuleMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for ClientTLSSettings
|
||||
func (this *ClientTLSSettings) UnmarshalJSON(b []byte) error {
|
||||
return DestinationRuleUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for LocalityLoadBalancerSetting
|
||||
func (this *LocalityLoadBalancerSetting) MarshalJSON() ([]byte, error) {
|
||||
str, err := DestinationRuleMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for LocalityLoadBalancerSetting
|
||||
func (this *LocalityLoadBalancerSetting) UnmarshalJSON(b []byte) error {
|
||||
return DestinationRuleUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for LocalityLoadBalancerSetting_Distribute
|
||||
func (this *LocalityLoadBalancerSetting_Distribute) MarshalJSON() ([]byte, error) {
|
||||
str, err := DestinationRuleMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for LocalityLoadBalancerSetting_Distribute
|
||||
func (this *LocalityLoadBalancerSetting_Distribute) UnmarshalJSON(b []byte) error {
|
||||
return DestinationRuleUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for LocalityLoadBalancerSetting_Failover
|
||||
func (this *LocalityLoadBalancerSetting_Failover) MarshalJSON() ([]byte, error) {
|
||||
str, err := DestinationRuleMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for LocalityLoadBalancerSetting_Failover
|
||||
func (this *LocalityLoadBalancerSetting_Failover) UnmarshalJSON(b []byte) error {
|
||||
return DestinationRuleUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
var (
|
||||
DestinationRuleMarshaler = &github_com_gogo_protobuf_jsonpb.Marshaler{}
|
||||
DestinationRuleUnmarshaler = &github_com_gogo_protobuf_jsonpb.Unmarshaler{}
|
||||
)
|
||||
174
vendor/istio.io/api/networking/v1beta1/gateway.gen.json
generated
vendored
Normal file
174
vendor/istio.io/api/networking/v1beta1/gateway.gen.json
generated
vendored
Normal file
@@ -0,0 +1,174 @@
|
||||
{
|
||||
"openapi": "3.0.0",
|
||||
"info": {
|
||||
"title": "Configuration affecting edge load balancer.",
|
||||
"version": "v1beta1"
|
||||
},
|
||||
"components": {
|
||||
"schemas": {
|
||||
"istio.networking.v1beta1.Gateway": {
|
||||
"description": "Gateway describes a load balancer operating at the edge of the mesh receiving incoming or outgoing HTTP/TCP connections.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"servers": {
|
||||
"description": "A list of server specifications.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.Server"
|
||||
}
|
||||
},
|
||||
"selector": {
|
||||
"description": "One or more labels that indicate a specific set of pods/VMs on which this gateway configuration should be applied. The scope of label search is restricted to the configuration namespace in which the the resource is present. In other words, the Gateway resource must reside in the same namespace as the gateway workload instance.",
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.Server": {
|
||||
"description": "`Server` describes the properties of the proxy on a given load balancer port. For example,",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"tls": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.ServerTLSSettings"
|
||||
},
|
||||
"port": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.Port"
|
||||
},
|
||||
"bind": {
|
||||
"description": "The ip or the Unix domain socket to which the listener should be bound to. Format: `x.x.x.x` or `unix:///path/to/uds` or `unix://@foobar` (Linux abstract namespace). When using Unix domain sockets, the port number should be 0.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"hosts": {
|
||||
"description": "One or more hosts exposed by this gateway. While typically applicable to HTTP services, it can also be used for TCP services using TLS with SNI. A host is specified as a `dnsName` with an optional `namespace/` prefix. The `dnsName` should be specified using FQDN format, optionally including a wildcard character in the left-most component (e.g., `prod/*.example.com`). Set the `dnsName` to `*` to select all `VirtualService` hosts from the specified namespace (e.g.,`prod/*`).",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"defaultEndpoint": {
|
||||
"description": "The loopback IP endpoint or Unix domain socket to which traffic should be forwarded to by default. Format should be `127.0.0.1:PORT` or `unix:///path/to/socket` or `unix://@foobar` (Linux abstract namespace). NOT IMPLEMENTED. $hide_from_docs",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.Port": {
|
||||
"description": "Port describes the properties of a specific port of a service.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"number": {
|
||||
"description": "A valid non-negative integer port number.",
|
||||
"type": "integer"
|
||||
},
|
||||
"name": {
|
||||
"description": "Label assigned to the port.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"protocol": {
|
||||
"description": "The protocol exposed on the port. MUST BE one of HTTP|HTTPS|GRPC|HTTP2|MONGO|TCP|TLS. TLS implies the connection will be routed based on the SNI header to the destination without terminating the TLS connection.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.ServerTLSSettings": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"mode": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.ServerTLSSettings.TLSmode"
|
||||
},
|
||||
"privateKey": {
|
||||
"description": "REQUIRED if mode is `SIMPLE` or `MUTUAL`. The path to the file holding the server's private key.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"caCertificates": {
|
||||
"description": "REQUIRED if mode is `MUTUAL`. The path to a file containing certificate authority certificates to use in verifying a presented client side certificate.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"subjectAltNames": {
|
||||
"description": "A list of alternate names to verify the subject identity in the certificate presented by the client.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"httpsRedirect": {
|
||||
"description": "If set to true, the load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"serverCertificate": {
|
||||
"description": "REQUIRED if mode is `SIMPLE` or `MUTUAL`. The path to the file holding the server-side TLS certificate to use.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"credentialName": {
|
||||
"description": "For gateways running on Kubernetes, the name of the secret that holds the TLS certs including the CA certificates. Applicable only on Kubernetes, and only if the dynamic credential fetching feature is enabled in the proxy by setting `ISTIO_META_USER_SDS` metadata variable. The secret (of type `generic`) should contain the following keys and values: `key: \u003cprivateKey\u003e`, `cert: \u003cserverCert\u003e`, `cacert: \u003cCACertificate\u003e`.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"verifyCertificateSpki": {
|
||||
"description": "An optional list of base64-encoded SHA-256 hashes of the SKPIs of authorized client certificates. Note: When both verify_certificate_hash and verify_certificate_spki are specified, a hash matching either value will result in the certificate being accepted.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"verifyCertificateHash": {
|
||||
"description": "An optional list of hex-encoded SHA-256 hashes of the authorized client certificates. Both simple and colon separated formats are acceptable. Note: When both verify_certificate_hash and verify_certificate_spki are specified, a hash matching either value will result in the certificate being accepted.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"minProtocolVersion": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.ServerTLSSettings.TLSProtocol"
|
||||
},
|
||||
"maxProtocolVersion": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.ServerTLSSettings.TLSProtocol"
|
||||
},
|
||||
"cipherSuites": {
|
||||
"description": "Optional: If specified, only support the specified cipher list. Otherwise default to the default cipher list supported by Envoy.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.ServerTLSSettings.TLSmode": {
|
||||
"description": "TLS modes enforced by the proxy",
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"PASSTHROUGH",
|
||||
"SIMPLE",
|
||||
"MUTUAL",
|
||||
"AUTO_PASSTHROUGH",
|
||||
"ISTIO_MUTUAL"
|
||||
]
|
||||
},
|
||||
"istio.networking.v1beta1.ServerTLSSettings.TLSProtocol": {
|
||||
"description": "TLS protocol versions.",
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"TLS_AUTO",
|
||||
"TLSV1_0",
|
||||
"TLSV1_1",
|
||||
"TLSV1_2",
|
||||
"TLSV1_3"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
2629
vendor/istio.io/api/networking/v1beta1/gateway.pb.go
generated
vendored
Normal file
2629
vendor/istio.io/api/networking/v1beta1/gateway.pb.go
generated
vendored
Normal file
File diff suppressed because it is too large
Load Diff
711
vendor/istio.io/api/networking/v1beta1/gateway.proto
generated
vendored
Normal file
711
vendor/istio.io/api/networking/v1beta1/gateway.proto
generated
vendored
Normal file
@@ -0,0 +1,711 @@
|
||||
// Copyright 2020 Istio Authors
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
import "google/api/field_behavior.proto";
|
||||
|
||||
// $schema: istio.networking.v1beta1.Gateway
|
||||
// $title: Gateway
|
||||
// $description: Configuration affecting edge load balancer.
|
||||
// $location: https://istio.io/docs/reference/config/networking/gateway.html
|
||||
// $aliases: [/docs/reference/config/networking/v1beta1/gateway]
|
||||
|
||||
// `Gateway` describes a load balancer operating at the edge of the mesh
|
||||
// receiving incoming or outgoing HTTP/TCP connections. The specification
|
||||
// describes a set of ports that should be exposed, the type of protocol to
|
||||
// use, SNI configuration for the load balancer, etc.
|
||||
//
|
||||
// For example, the following Gateway configuration sets up a proxy to act
|
||||
// as a load balancer exposing port 80 and 9080 (http), 443 (https),
|
||||
// 9443(https) and port 2379 (TCP) for ingress. The gateway will be
|
||||
// applied to the proxy running on a pod with labels `app:
|
||||
// my-gateway-controller`. While Istio will configure the proxy to listen
|
||||
// on these ports, it is the responsibility of the user to ensure that
|
||||
// external traffic to these ports are allowed into the mesh.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: Gateway
|
||||
// metadata:
|
||||
// name: my-gateway
|
||||
// namespace: some-config-namespace
|
||||
// spec:
|
||||
// selector:
|
||||
// app: my-gateway-controller
|
||||
// servers:
|
||||
// - port:
|
||||
// number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// hosts:
|
||||
// - uk.bookinfo.com
|
||||
// - eu.bookinfo.com
|
||||
// tls:
|
||||
// httpsRedirect: true # sends 301 redirect for http requests
|
||||
// - port:
|
||||
// number: 443
|
||||
// name: https-443
|
||||
// protocol: HTTPS
|
||||
// hosts:
|
||||
// - uk.bookinfo.com
|
||||
// - eu.bookinfo.com
|
||||
// tls:
|
||||
// mode: SIMPLE # enables HTTPS on this port
|
||||
// serverCertificate: /etc/certs/servercert.pem
|
||||
// privateKey: /etc/certs/privatekey.pem
|
||||
// - port:
|
||||
// number: 9443
|
||||
// name: https-9443
|
||||
// protocol: HTTPS
|
||||
// hosts:
|
||||
// - "bookinfo-namespace/*.bookinfo.com"
|
||||
// tls:
|
||||
// mode: SIMPLE # enables HTTPS on this port
|
||||
// credentialName: bookinfo-secret # fetches certs from Kubernetes secret
|
||||
// - port:
|
||||
// number: 9080
|
||||
// name: http-wildcard
|
||||
// protocol: HTTP
|
||||
// hosts:
|
||||
// - "*"
|
||||
// - port:
|
||||
// number: 2379 # to expose internal service via external port 2379
|
||||
// name: mongo
|
||||
// protocol: MONGO
|
||||
// hosts:
|
||||
// - "*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: Gateway
|
||||
// metadata:
|
||||
// name: my-gateway
|
||||
// namespace: some-config-namespace
|
||||
// spec:
|
||||
// selector:
|
||||
// app: my-gateway-controller
|
||||
// servers:
|
||||
// - port:
|
||||
// number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// hosts:
|
||||
// - uk.bookinfo.com
|
||||
// - eu.bookinfo.com
|
||||
// tls:
|
||||
// httpsRedirect: true # sends 301 redirect for http requests
|
||||
// - port:
|
||||
// number: 443
|
||||
// name: https-443
|
||||
// protocol: HTTPS
|
||||
// hosts:
|
||||
// - uk.bookinfo.com
|
||||
// - eu.bookinfo.com
|
||||
// tls:
|
||||
// mode: SIMPLE # enables HTTPS on this port
|
||||
// serverCertificate: /etc/certs/servercert.pem
|
||||
// privateKey: /etc/certs/privatekey.pem
|
||||
// - port:
|
||||
// number: 9443
|
||||
// name: https-9443
|
||||
// protocol: HTTPS
|
||||
// hosts:
|
||||
// - "bookinfo-namespace/*.bookinfo.com"
|
||||
// tls:
|
||||
// mode: SIMPLE # enables HTTPS on this port
|
||||
// credentialName: bookinfo-secret # fetches certs from Kubernetes secret
|
||||
// - port:
|
||||
// number: 9080
|
||||
// name: http-wildcard
|
||||
// protocol: HTTP
|
||||
// hosts:
|
||||
// - "*"
|
||||
// - port:
|
||||
// number: 2379 # to expose internal service via external port 2379
|
||||
// name: mongo
|
||||
// protocol: MONGO
|
||||
// hosts:
|
||||
// - "*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The Gateway specification above describes the L4-L6 properties of a load
|
||||
// balancer. A `VirtualService` can then be bound to a gateway to control
|
||||
// the forwarding of traffic arriving at a particular host or gateway port.
|
||||
//
|
||||
// For example, the following VirtualService splits traffic for
|
||||
// `https://uk.bookinfo.com/reviews`, `https://eu.bookinfo.com/reviews`,
|
||||
// `http://uk.bookinfo.com:9080/reviews`,
|
||||
// `http://eu.bookinfo.com:9080/reviews` into two versions (prod and qa) of
|
||||
// an internal reviews service on port 9080. In addition, requests
|
||||
// containing the cookie "user: dev-123" will be sent to special port 7777
|
||||
// in the qa version. The same rule is also applicable inside the mesh for
|
||||
// requests to the "reviews.prod.svc.cluster.local" service. This rule is
|
||||
// applicable across ports 443, 9080. Note that `http://uk.bookinfo.com`
|
||||
// gets redirected to `https://uk.bookinfo.com` (i.e. 80 redirects to 443).
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: VirtualService
|
||||
// metadata:
|
||||
// name: bookinfo-rule
|
||||
// namespace: bookinfo-namespace
|
||||
// spec:
|
||||
// hosts:
|
||||
// - reviews.prod.svc.cluster.local
|
||||
// - uk.bookinfo.com
|
||||
// - eu.bookinfo.com
|
||||
// gateways:
|
||||
// - some-config-namespace/my-gateway
|
||||
// - mesh # applies to all the sidecars in the mesh
|
||||
// http:
|
||||
// - match:
|
||||
// - headers:
|
||||
// cookie:
|
||||
// exact: "user=dev-123"
|
||||
// route:
|
||||
// - destination:
|
||||
// port:
|
||||
// number: 7777
|
||||
// host: reviews.qa.svc.cluster.local
|
||||
// - match:
|
||||
// - uri:
|
||||
// prefix: /reviews/
|
||||
// route:
|
||||
// - destination:
|
||||
// port:
|
||||
// number: 9080 # can be omitted if it's the only port for reviews
|
||||
// host: reviews.prod.svc.cluster.local
|
||||
// weight: 80
|
||||
// - destination:
|
||||
// host: reviews.qa.svc.cluster.local
|
||||
// weight: 20
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: VirtualService
|
||||
// metadata:
|
||||
// name: bookinfo-rule
|
||||
// namespace: bookinfo-namespace
|
||||
// spec:
|
||||
// hosts:
|
||||
// - reviews.prod.svc.cluster.local
|
||||
// - uk.bookinfo.com
|
||||
// - eu.bookinfo.com
|
||||
// gateways:
|
||||
// - some-config-namespace/my-gateway
|
||||
// - mesh # applies to all the sidecars in the mesh
|
||||
// http:
|
||||
// - match:
|
||||
// - headers:
|
||||
// cookie:
|
||||
// exact: "user=dev-123"
|
||||
// route:
|
||||
// - destination:
|
||||
// port:
|
||||
// number: 7777
|
||||
// host: reviews.qa.svc.cluster.local
|
||||
// - match:
|
||||
// - uri:
|
||||
// prefix: /reviews/
|
||||
// route:
|
||||
// - destination:
|
||||
// port:
|
||||
// number: 9080 # can be omitted if it's the only port for reviews
|
||||
// host: reviews.prod.svc.cluster.local
|
||||
// weight: 80
|
||||
// - destination:
|
||||
// host: reviews.qa.svc.cluster.local
|
||||
// weight: 20
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The following VirtualService forwards traffic arriving at (external)
|
||||
// port 27017 to internal Mongo server on port 5555. This rule is not
|
||||
// applicable internally in the mesh as the gateway list omits the
|
||||
// reserved name `mesh`.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: VirtualService
|
||||
// metadata:
|
||||
// name: bookinfo-Mongo
|
||||
// namespace: bookinfo-namespace
|
||||
// spec:
|
||||
// hosts:
|
||||
// - mongosvr.prod.svc.cluster.local # name of internal Mongo service
|
||||
// gateways:
|
||||
// - some-config-namespace/my-gateway # can omit the namespace if gateway is
|
||||
// in same
|
||||
// namespace as virtual service.
|
||||
// tcp:
|
||||
// - match:
|
||||
// - port: 27017
|
||||
// route:
|
||||
// - destination:
|
||||
// host: mongo.prod.svc.cluster.local
|
||||
// port:
|
||||
// number: 5555
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: VirtualService
|
||||
// metadata:
|
||||
// name: bookinfo-Mongo
|
||||
// namespace: bookinfo-namespace
|
||||
// spec:
|
||||
// hosts:
|
||||
// - mongosvr.prod.svc.cluster.local # name of internal Mongo service
|
||||
// gateways:
|
||||
// - some-config-namespace/my-gateway # can omit the namespace if gateway is
|
||||
// in same
|
||||
// namespace as virtual service.
|
||||
// tcp:
|
||||
// - match:
|
||||
// - port: 27017
|
||||
// route:
|
||||
// - destination:
|
||||
// host: mongo.prod.svc.cluster.local
|
||||
// port:
|
||||
// number: 5555
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// It is possible to restrict the set of virtual services that can bind to
|
||||
// a gateway server using the namespace/hostname syntax in the hosts field.
|
||||
// For example, the following Gateway allows any virtual service in the ns1
|
||||
// namespace to bind to it, while restricting only the virtual service with
|
||||
// foo.bar.com host in the ns2 namespace to bind to it.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: Gateway
|
||||
// metadata:
|
||||
// name: my-gateway
|
||||
// namespace: some-config-namespace
|
||||
// spec:
|
||||
// selector:
|
||||
// app: my-gateway-controller
|
||||
// servers:
|
||||
// - port:
|
||||
// number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// hosts:
|
||||
// - "ns1/*"
|
||||
// - "ns2/foo.bar.com"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: Gateway
|
||||
// metadata:
|
||||
// name: my-gateway
|
||||
// namespace: some-config-namespace
|
||||
// spec:
|
||||
// selector:
|
||||
// app: my-gateway-controller
|
||||
// servers:
|
||||
// - port:
|
||||
// number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// hosts:
|
||||
// - "ns1/*"
|
||||
// - "ns2/foo.bar.com"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
package istio.networking.v1beta1;
|
||||
|
||||
option go_package = "istio.io/api/networking/v1beta1";
|
||||
|
||||
// Gateway describes a load balancer operating at the edge of the mesh
|
||||
// receiving incoming or outgoing HTTP/TCP connections.
|
||||
//
|
||||
// <!-- crd generation tags
|
||||
// +cue-gen:Gateway:groupName:networking.istio.io
|
||||
// +cue-gen:Gateway:version:v1beta1
|
||||
// +cue-gen:Gateway:annotations:helm.sh/resource-policy=keep
|
||||
// +cue-gen:Gateway:labels:app=istio-pilot,chart=istio,heritage=Tiller,release=istio
|
||||
// +cue-gen:Gateway:subresource:status
|
||||
// +cue-gen:Gateway:scope:Namespaced
|
||||
// +cue-gen:Gateway:resource:categories=istio-io,networking-istio-io,shortNames=gw
|
||||
// +cue-gen:Gateway:preserveUnknownFields:false
|
||||
// -->
|
||||
//
|
||||
// <!-- go code generation tags
|
||||
// +kubetype-gen
|
||||
// +kubetype-gen:groupVersion=networking.istio.io/v1beta1
|
||||
// +genclient
|
||||
// +k8s:deepcopy-gen=true
|
||||
// -->
|
||||
message Gateway {
|
||||
// A list of server specifications.
|
||||
repeated Server servers = 1 [(google.api.field_behavior) = REQUIRED];
|
||||
|
||||
// One or more labels that indicate a specific set of pods/VMs
|
||||
// on which this gateway configuration should be applied. The scope of
|
||||
// label search is restricted to the configuration namespace in which the
|
||||
// the resource is present. In other words, the Gateway resource must
|
||||
// reside in the same namespace as the gateway workload instance.
|
||||
map<string, string> selector = 2 [(google.api.field_behavior) = REQUIRED];
|
||||
}
|
||||
|
||||
// `Server` describes the properties of the proxy on a given load balancer
|
||||
// port. For example,
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: Gateway
|
||||
// metadata:
|
||||
// name: my-ingress
|
||||
// spec:
|
||||
// selector:
|
||||
// app: my-ingress-gateway
|
||||
// servers:
|
||||
// - port:
|
||||
// number: 80
|
||||
// name: http2
|
||||
// protocol: HTTP2
|
||||
// hosts:
|
||||
// - "*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: Gateway
|
||||
// metadata:
|
||||
// name: my-ingress
|
||||
// spec:
|
||||
// selector:
|
||||
// app: my-ingress-gateway
|
||||
// servers:
|
||||
// - port:
|
||||
// number: 80
|
||||
// name: http2
|
||||
// protocol: HTTP2
|
||||
// hosts:
|
||||
// - "*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// Another example
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: Gateway
|
||||
// metadata:
|
||||
// name: my-tcp-ingress
|
||||
// spec:
|
||||
// selector:
|
||||
// app: my-tcp-ingress-gateway
|
||||
// servers:
|
||||
// - port:
|
||||
// number: 27018
|
||||
// name: mongo
|
||||
// protocol: MONGO
|
||||
// hosts:
|
||||
// - "*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: Gateway
|
||||
// metadata:
|
||||
// name: my-tcp-ingress
|
||||
// spec:
|
||||
// selector:
|
||||
// app: my-tcp-ingress-gateway
|
||||
// servers:
|
||||
// - port:
|
||||
// number: 27018
|
||||
// name: mongo
|
||||
// protocol: MONGO
|
||||
// hosts:
|
||||
// - "*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The following is an example of TLS configuration for port 443
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: Gateway
|
||||
// metadata:
|
||||
// name: my-tls-ingress
|
||||
// spec:
|
||||
// selector:
|
||||
// app: my-tls-ingress-gateway
|
||||
// servers:
|
||||
// - port:
|
||||
// number: 443
|
||||
// name: https
|
||||
// protocol: HTTPS
|
||||
// hosts:
|
||||
// - "*"
|
||||
// tls:
|
||||
// mode: SIMPLE
|
||||
// serverCertificate: /etc/certs/server.pem
|
||||
// privateKey: /etc/certs/privatekey.pem
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: Gateway
|
||||
// metadata:
|
||||
// name: my-tls-ingress
|
||||
// spec:
|
||||
// selector:
|
||||
// app: my-tls-ingress-gateway
|
||||
// servers:
|
||||
// - port:
|
||||
// number: 443
|
||||
// name: https
|
||||
// protocol: HTTPS
|
||||
// hosts:
|
||||
// - "*"
|
||||
// tls:
|
||||
// mode: SIMPLE
|
||||
// serverCertificate: /etc/certs/server.pem
|
||||
// privateKey: /etc/certs/privatekey.pem
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
message Server {
|
||||
// The Port on which the proxy should listen for incoming
|
||||
// connections.
|
||||
Port port = 1 [(google.api.field_behavior) = REQUIRED];
|
||||
|
||||
// $hide_from_docs
|
||||
// The ip or the Unix domain socket to which the listener should be bound
|
||||
// to. Format: `x.x.x.x` or `unix:///path/to/uds` or `unix://@foobar`
|
||||
// (Linux abstract namespace). When using Unix domain sockets, the port
|
||||
// number should be 0.
|
||||
string bind = 4;
|
||||
|
||||
// One or more hosts exposed by this gateway.
|
||||
// While typically applicable to
|
||||
// HTTP services, it can also be used for TCP services using TLS with SNI.
|
||||
// A host is specified as a `dnsName` with an optional `namespace/` prefix.
|
||||
// The `dnsName` should be specified using FQDN format, optionally including
|
||||
// a wildcard character in the left-most component (e.g.,
|
||||
// `prod/*.example.com`). Set the `dnsName` to `*` to select all
|
||||
// `VirtualService` hosts from the specified namespace (e.g.,`prod/*`).
|
||||
//
|
||||
// The `namespace` can be set to `*` or `.`, representing any or the current
|
||||
// namespace, respectively. For example, `*/foo.example.com` selects the
|
||||
// service from any available namespace while `./foo.example.com` only selects
|
||||
// the service from the namespace of the sidecar. The default, if no
|
||||
// `namespace/` is specified, is `*/`, that is, select services from any
|
||||
// namespace. Any associated `DestinationRule` in the selected namespace will
|
||||
// also be used.
|
||||
//
|
||||
// A `VirtualService` must be bound to the gateway and must have one or
|
||||
// more hosts that match the hosts specified in a server. The match
|
||||
// could be an exact match or a suffix match with the server's hosts. For
|
||||
// example, if the server's hosts specifies `*.example.com`, a
|
||||
// `VirtualService` with hosts `dev.example.com` or `prod.example.com` will
|
||||
// match. However, a `VirtualService` with host `example.com` or
|
||||
// `newexample.com` will not match.
|
||||
//
|
||||
// NOTE: Only virtual services exported to the gateway's namespace
|
||||
// (e.g., `exportTo` value of `*`) can be referenced.
|
||||
// Private configurations (e.g., `exportTo` set to `.`) will not be
|
||||
// available. Refer to the `exportTo` setting in `VirtualService`,
|
||||
// `DestinationRule`, and `ServiceEntry` configurations for details.
|
||||
repeated string hosts = 2 [(google.api.field_behavior) = REQUIRED];
|
||||
|
||||
// Set of TLS related options that govern the server's behavior. Use
|
||||
// these options to control if all http requests should be redirected to
|
||||
// https, and the TLS modes to use.
|
||||
ServerTLSSettings tls = 3;
|
||||
|
||||
// The loopback IP endpoint or Unix domain socket to which traffic should
|
||||
// be forwarded to by default. Format should be `127.0.0.1:PORT` or
|
||||
// `unix:///path/to/socket` or `unix://@foobar` (Linux abstract namespace).
|
||||
// NOT IMPLEMENTED.
|
||||
// $hide_from_docs
|
||||
string default_endpoint = 5;
|
||||
}
|
||||
|
||||
// Port describes the properties of a specific port of a service.
|
||||
message Port {
|
||||
// A valid non-negative integer port number.
|
||||
uint32 number = 1 [(google.api.field_behavior) = REQUIRED];
|
||||
|
||||
// The protocol exposed on the port.
|
||||
// MUST BE one of HTTP|HTTPS|GRPC|HTTP2|MONGO|TCP|TLS.
|
||||
// TLS implies the connection will be routed based on the SNI header to
|
||||
// the destination without terminating the TLS connection.
|
||||
string protocol = 2 [(google.api.field_behavior) = REQUIRED];
|
||||
|
||||
// Label assigned to the port.
|
||||
string name = 3 [(google.api.field_behavior) = REQUIRED];
|
||||
}
|
||||
|
||||
message ServerTLSSettings {
|
||||
// If set to true, the load balancer will send a 301 redirect for
|
||||
// all http connections, asking the clients to use HTTPS.
|
||||
bool https_redirect = 1;
|
||||
|
||||
// TLS modes enforced by the proxy
|
||||
enum TLSmode {
|
||||
// The SNI string presented by the client will be used as the
|
||||
// match criterion in a VirtualService TLS route to determine
|
||||
// the destination service from the service registry.
|
||||
PASSTHROUGH = 0;
|
||||
|
||||
// Secure connections with standard TLS semantics.
|
||||
SIMPLE = 1;
|
||||
|
||||
// Secure connections to the downstream using mutual TLS by
|
||||
// presenting server certificates for authentication.
|
||||
MUTUAL = 2;
|
||||
|
||||
// Similar to the passthrough mode, except servers with this TLS
|
||||
// mode do not require an associated VirtualService to map from
|
||||
// the SNI value to service in the registry. The destination
|
||||
// details such as the service/subset/port are encoded in the
|
||||
// SNI value. The proxy will forward to the upstream (Envoy)
|
||||
// cluster (a group of endpoints) specified by the SNI
|
||||
// value. This server is typically used to provide connectivity
|
||||
// between services in disparate L3 networks that otherwise do
|
||||
// not have direct connectivity between their respective
|
||||
// endpoints. Use of this mode assumes that both the source and
|
||||
// the destination are using Istio mTLS to secure traffic.
|
||||
AUTO_PASSTHROUGH = 3;
|
||||
|
||||
// Secure connections from the downstream using mutual TLS by
|
||||
// presenting server certificates for authentication. Compared
|
||||
// to Mutual mode, this mode uses certificates, representing
|
||||
// gateway workload identity, generated automatically by Istio
|
||||
// for mTLS authentication. When this mode is used, all other
|
||||
// fields in `TLSOptions` should be empty.
|
||||
ISTIO_MUTUAL = 4;
|
||||
};
|
||||
|
||||
// Optional: Indicates whether connections to this port should be
|
||||
// secured using TLS. The value of this field determines how TLS is
|
||||
// enforced.
|
||||
TLSmode mode = 2;
|
||||
|
||||
// REQUIRED if mode is `SIMPLE` or `MUTUAL`. The path to the file
|
||||
// holding the server-side TLS certificate to use.
|
||||
string server_certificate = 3;
|
||||
|
||||
// REQUIRED if mode is `SIMPLE` or `MUTUAL`. The path to the file
|
||||
// holding the server's private key.
|
||||
string private_key = 4;
|
||||
|
||||
// REQUIRED if mode is `MUTUAL`. The path to a file containing
|
||||
// certificate authority certificates to use in verifying a presented
|
||||
// client side certificate.
|
||||
string ca_certificates = 5;
|
||||
|
||||
// For gateways running on Kubernetes, the name of the secret that
|
||||
// holds the TLS certs including the CA certificates. Applicable
|
||||
// only on Kubernetes, and only if the dynamic credential fetching
|
||||
// feature is enabled in the proxy by setting
|
||||
// `ISTIO_META_USER_SDS` metadata variable. The secret (of type
|
||||
// `generic`) should contain the following keys and values: `key:
|
||||
// <privateKey>`, `cert: <serverCert>`, `cacert: <CACertificate>`.
|
||||
string credential_name = 10;
|
||||
|
||||
// A list of alternate names to verify the subject identity in the
|
||||
// certificate presented by the client.
|
||||
repeated string subject_alt_names = 6;
|
||||
|
||||
// An optional list of base64-encoded SHA-256 hashes of the SKPIs of
|
||||
// authorized client certificates.
|
||||
// Note: When both verify_certificate_hash and verify_certificate_spki
|
||||
// are specified, a hash matching either value will result in the
|
||||
// certificate being accepted.
|
||||
repeated string verify_certificate_spki = 11;
|
||||
|
||||
// An optional list of hex-encoded SHA-256 hashes of the
|
||||
// authorized client certificates. Both simple and colon separated
|
||||
// formats are acceptable.
|
||||
// Note: When both verify_certificate_hash and verify_certificate_spki
|
||||
// are specified, a hash matching either value will result in the
|
||||
// certificate being accepted.
|
||||
repeated string verify_certificate_hash = 12;
|
||||
|
||||
// TLS protocol versions.
|
||||
enum TLSProtocol {
|
||||
// Automatically choose the optimal TLS version.
|
||||
TLS_AUTO = 0;
|
||||
|
||||
// TLS version 1.0
|
||||
TLSV1_0 = 1;
|
||||
|
||||
// TLS version 1.1
|
||||
TLSV1_1 = 2;
|
||||
|
||||
// TLS version 1.2
|
||||
TLSV1_2 = 3;
|
||||
|
||||
// TLS version 1.3
|
||||
TLSV1_3 = 4;
|
||||
}
|
||||
|
||||
// Optional: Minimum TLS protocol version.
|
||||
TLSProtocol min_protocol_version = 7;
|
||||
|
||||
// Optional: Maximum TLS protocol version.
|
||||
TLSProtocol max_protocol_version = 8;
|
||||
|
||||
// Optional: If specified, only support the specified cipher list.
|
||||
// Otherwise default to the default cipher list supported by Envoy.
|
||||
repeated string cipher_suites = 9;
|
||||
}
|
||||
352
vendor/istio.io/api/networking/v1beta1/gateway_deepcopy.gen.go
generated
vendored
Normal file
352
vendor/istio.io/api/networking/v1beta1/gateway_deepcopy.gen.go
generated
vendored
Normal file
@@ -0,0 +1,352 @@
|
||||
// Code generated by protoc-gen-gogo. DO NOT EDIT.
|
||||
// source: networking/v1beta1/gateway.proto
|
||||
|
||||
// `Gateway` describes a load balancer operating at the edge of the mesh
|
||||
// receiving incoming or outgoing HTTP/TCP connections. The specification
|
||||
// describes a set of ports that should be exposed, the type of protocol to
|
||||
// use, SNI configuration for the load balancer, etc.
|
||||
//
|
||||
// For example, the following Gateway configuration sets up a proxy to act
|
||||
// as a load balancer exposing port 80 and 9080 (http), 443 (https),
|
||||
// 9443(https) and port 2379 (TCP) for ingress. The gateway will be
|
||||
// applied to the proxy running on a pod with labels `app:
|
||||
// my-gateway-controller`. While Istio will configure the proxy to listen
|
||||
// on these ports, it is the responsibility of the user to ensure that
|
||||
// external traffic to these ports are allowed into the mesh.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: Gateway
|
||||
// metadata:
|
||||
// name: my-gateway
|
||||
// namespace: some-config-namespace
|
||||
// spec:
|
||||
// selector:
|
||||
// app: my-gateway-controller
|
||||
// servers:
|
||||
// - port:
|
||||
// number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// hosts:
|
||||
// - uk.bookinfo.com
|
||||
// - eu.bookinfo.com
|
||||
// tls:
|
||||
// httpsRedirect: true # sends 301 redirect for http requests
|
||||
// - port:
|
||||
// number: 443
|
||||
// name: https-443
|
||||
// protocol: HTTPS
|
||||
// hosts:
|
||||
// - uk.bookinfo.com
|
||||
// - eu.bookinfo.com
|
||||
// tls:
|
||||
// mode: SIMPLE # enables HTTPS on this port
|
||||
// serverCertificate: /etc/certs/servercert.pem
|
||||
// privateKey: /etc/certs/privatekey.pem
|
||||
// - port:
|
||||
// number: 9443
|
||||
// name: https-9443
|
||||
// protocol: HTTPS
|
||||
// hosts:
|
||||
// - "bookinfo-namespace/*.bookinfo.com"
|
||||
// tls:
|
||||
// mode: SIMPLE # enables HTTPS on this port
|
||||
// credentialName: bookinfo-secret # fetches certs from Kubernetes secret
|
||||
// - port:
|
||||
// number: 9080
|
||||
// name: http-wildcard
|
||||
// protocol: HTTP
|
||||
// hosts:
|
||||
// - "*"
|
||||
// - port:
|
||||
// number: 2379 # to expose internal service via external port 2379
|
||||
// name: mongo
|
||||
// protocol: MONGO
|
||||
// hosts:
|
||||
// - "*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: Gateway
|
||||
// metadata:
|
||||
// name: my-gateway
|
||||
// namespace: some-config-namespace
|
||||
// spec:
|
||||
// selector:
|
||||
// app: my-gateway-controller
|
||||
// servers:
|
||||
// - port:
|
||||
// number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// hosts:
|
||||
// - uk.bookinfo.com
|
||||
// - eu.bookinfo.com
|
||||
// tls:
|
||||
// httpsRedirect: true # sends 301 redirect for http requests
|
||||
// - port:
|
||||
// number: 443
|
||||
// name: https-443
|
||||
// protocol: HTTPS
|
||||
// hosts:
|
||||
// - uk.bookinfo.com
|
||||
// - eu.bookinfo.com
|
||||
// tls:
|
||||
// mode: SIMPLE # enables HTTPS on this port
|
||||
// serverCertificate: /etc/certs/servercert.pem
|
||||
// privateKey: /etc/certs/privatekey.pem
|
||||
// - port:
|
||||
// number: 9443
|
||||
// name: https-9443
|
||||
// protocol: HTTPS
|
||||
// hosts:
|
||||
// - "bookinfo-namespace/*.bookinfo.com"
|
||||
// tls:
|
||||
// mode: SIMPLE # enables HTTPS on this port
|
||||
// credentialName: bookinfo-secret # fetches certs from Kubernetes secret
|
||||
// - port:
|
||||
// number: 9080
|
||||
// name: http-wildcard
|
||||
// protocol: HTTP
|
||||
// hosts:
|
||||
// - "*"
|
||||
// - port:
|
||||
// number: 2379 # to expose internal service via external port 2379
|
||||
// name: mongo
|
||||
// protocol: MONGO
|
||||
// hosts:
|
||||
// - "*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The Gateway specification above describes the L4-L6 properties of a load
|
||||
// balancer. A `VirtualService` can then be bound to a gateway to control
|
||||
// the forwarding of traffic arriving at a particular host or gateway port.
|
||||
//
|
||||
// For example, the following VirtualService splits traffic for
|
||||
// `https://uk.bookinfo.com/reviews`, `https://eu.bookinfo.com/reviews`,
|
||||
// `http://uk.bookinfo.com:9080/reviews`,
|
||||
// `http://eu.bookinfo.com:9080/reviews` into two versions (prod and qa) of
|
||||
// an internal reviews service on port 9080. In addition, requests
|
||||
// containing the cookie "user: dev-123" will be sent to special port 7777
|
||||
// in the qa version. The same rule is also applicable inside the mesh for
|
||||
// requests to the "reviews.prod.svc.cluster.local" service. This rule is
|
||||
// applicable across ports 443, 9080. Note that `http://uk.bookinfo.com`
|
||||
// gets redirected to `https://uk.bookinfo.com` (i.e. 80 redirects to 443).
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: VirtualService
|
||||
// metadata:
|
||||
// name: bookinfo-rule
|
||||
// namespace: bookinfo-namespace
|
||||
// spec:
|
||||
// hosts:
|
||||
// - reviews.prod.svc.cluster.local
|
||||
// - uk.bookinfo.com
|
||||
// - eu.bookinfo.com
|
||||
// gateways:
|
||||
// - some-config-namespace/my-gateway
|
||||
// - mesh # applies to all the sidecars in the mesh
|
||||
// http:
|
||||
// - match:
|
||||
// - headers:
|
||||
// cookie:
|
||||
// exact: "user=dev-123"
|
||||
// route:
|
||||
// - destination:
|
||||
// port:
|
||||
// number: 7777
|
||||
// host: reviews.qa.svc.cluster.local
|
||||
// - match:
|
||||
// - uri:
|
||||
// prefix: /reviews/
|
||||
// route:
|
||||
// - destination:
|
||||
// port:
|
||||
// number: 9080 # can be omitted if it's the only port for reviews
|
||||
// host: reviews.prod.svc.cluster.local
|
||||
// weight: 80
|
||||
// - destination:
|
||||
// host: reviews.qa.svc.cluster.local
|
||||
// weight: 20
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: VirtualService
|
||||
// metadata:
|
||||
// name: bookinfo-rule
|
||||
// namespace: bookinfo-namespace
|
||||
// spec:
|
||||
// hosts:
|
||||
// - reviews.prod.svc.cluster.local
|
||||
// - uk.bookinfo.com
|
||||
// - eu.bookinfo.com
|
||||
// gateways:
|
||||
// - some-config-namespace/my-gateway
|
||||
// - mesh # applies to all the sidecars in the mesh
|
||||
// http:
|
||||
// - match:
|
||||
// - headers:
|
||||
// cookie:
|
||||
// exact: "user=dev-123"
|
||||
// route:
|
||||
// - destination:
|
||||
// port:
|
||||
// number: 7777
|
||||
// host: reviews.qa.svc.cluster.local
|
||||
// - match:
|
||||
// - uri:
|
||||
// prefix: /reviews/
|
||||
// route:
|
||||
// - destination:
|
||||
// port:
|
||||
// number: 9080 # can be omitted if it's the only port for reviews
|
||||
// host: reviews.prod.svc.cluster.local
|
||||
// weight: 80
|
||||
// - destination:
|
||||
// host: reviews.qa.svc.cluster.local
|
||||
// weight: 20
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The following VirtualService forwards traffic arriving at (external)
|
||||
// port 27017 to internal Mongo server on port 5555. This rule is not
|
||||
// applicable internally in the mesh as the gateway list omits the
|
||||
// reserved name `mesh`.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: VirtualService
|
||||
// metadata:
|
||||
// name: bookinfo-Mongo
|
||||
// namespace: bookinfo-namespace
|
||||
// spec:
|
||||
// hosts:
|
||||
// - mongosvr.prod.svc.cluster.local # name of internal Mongo service
|
||||
// gateways:
|
||||
// - some-config-namespace/my-gateway # can omit the namespace if gateway is
|
||||
// in same
|
||||
// namespace as virtual service.
|
||||
// tcp:
|
||||
// - match:
|
||||
// - port: 27017
|
||||
// route:
|
||||
// - destination:
|
||||
// host: mongo.prod.svc.cluster.local
|
||||
// port:
|
||||
// number: 5555
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: VirtualService
|
||||
// metadata:
|
||||
// name: bookinfo-Mongo
|
||||
// namespace: bookinfo-namespace
|
||||
// spec:
|
||||
// hosts:
|
||||
// - mongosvr.prod.svc.cluster.local # name of internal Mongo service
|
||||
// gateways:
|
||||
// - some-config-namespace/my-gateway # can omit the namespace if gateway is
|
||||
// in same
|
||||
// namespace as virtual service.
|
||||
// tcp:
|
||||
// - match:
|
||||
// - port: 27017
|
||||
// route:
|
||||
// - destination:
|
||||
// host: mongo.prod.svc.cluster.local
|
||||
// port:
|
||||
// number: 5555
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// It is possible to restrict the set of virtual services that can bind to
|
||||
// a gateway server using the namespace/hostname syntax in the hosts field.
|
||||
// For example, the following Gateway allows any virtual service in the ns1
|
||||
// namespace to bind to it, while restricting only the virtual service with
|
||||
// foo.bar.com host in the ns2 namespace to bind to it.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: Gateway
|
||||
// metadata:
|
||||
// name: my-gateway
|
||||
// namespace: some-config-namespace
|
||||
// spec:
|
||||
// selector:
|
||||
// app: my-gateway-controller
|
||||
// servers:
|
||||
// - port:
|
||||
// number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// hosts:
|
||||
// - "ns1/*"
|
||||
// - "ns2/foo.bar.com"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: Gateway
|
||||
// metadata:
|
||||
// name: my-gateway
|
||||
// namespace: some-config-namespace
|
||||
// spec:
|
||||
// selector:
|
||||
// app: my-gateway-controller
|
||||
// servers:
|
||||
// - port:
|
||||
// number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// hosts:
|
||||
// - "ns1/*"
|
||||
// - "ns2/foo.bar.com"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
|
||||
package v1beta1
|
||||
|
||||
import (
|
||||
fmt "fmt"
|
||||
proto "github.com/gogo/protobuf/proto"
|
||||
_ "istio.io/gogo-genproto/googleapis/google/api"
|
||||
math "math"
|
||||
)
|
||||
|
||||
// Reference imports to suppress errors if they are not otherwise used.
|
||||
var _ = proto.Marshal
|
||||
var _ = fmt.Errorf
|
||||
var _ = math.Inf
|
||||
|
||||
// DeepCopyInto supports using Gateway within kubernetes types, where deepcopy-gen is used.
|
||||
func (in *Gateway) DeepCopyInto(out *Gateway) {
|
||||
p := proto.Clone(in).(*Gateway)
|
||||
*out = *p
|
||||
}
|
||||
397
vendor/istio.io/api/networking/v1beta1/gateway_json.gen.go
generated
vendored
Normal file
397
vendor/istio.io/api/networking/v1beta1/gateway_json.gen.go
generated
vendored
Normal file
@@ -0,0 +1,397 @@
|
||||
// Code generated by protoc-gen-gogo. DO NOT EDIT.
|
||||
// source: networking/v1beta1/gateway.proto
|
||||
|
||||
// `Gateway` describes a load balancer operating at the edge of the mesh
|
||||
// receiving incoming or outgoing HTTP/TCP connections. The specification
|
||||
// describes a set of ports that should be exposed, the type of protocol to
|
||||
// use, SNI configuration for the load balancer, etc.
|
||||
//
|
||||
// For example, the following Gateway configuration sets up a proxy to act
|
||||
// as a load balancer exposing port 80 and 9080 (http), 443 (https),
|
||||
// 9443(https) and port 2379 (TCP) for ingress. The gateway will be
|
||||
// applied to the proxy running on a pod with labels `app:
|
||||
// my-gateway-controller`. While Istio will configure the proxy to listen
|
||||
// on these ports, it is the responsibility of the user to ensure that
|
||||
// external traffic to these ports are allowed into the mesh.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: Gateway
|
||||
// metadata:
|
||||
// name: my-gateway
|
||||
// namespace: some-config-namespace
|
||||
// spec:
|
||||
// selector:
|
||||
// app: my-gateway-controller
|
||||
// servers:
|
||||
// - port:
|
||||
// number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// hosts:
|
||||
// - uk.bookinfo.com
|
||||
// - eu.bookinfo.com
|
||||
// tls:
|
||||
// httpsRedirect: true # sends 301 redirect for http requests
|
||||
// - port:
|
||||
// number: 443
|
||||
// name: https-443
|
||||
// protocol: HTTPS
|
||||
// hosts:
|
||||
// - uk.bookinfo.com
|
||||
// - eu.bookinfo.com
|
||||
// tls:
|
||||
// mode: SIMPLE # enables HTTPS on this port
|
||||
// serverCertificate: /etc/certs/servercert.pem
|
||||
// privateKey: /etc/certs/privatekey.pem
|
||||
// - port:
|
||||
// number: 9443
|
||||
// name: https-9443
|
||||
// protocol: HTTPS
|
||||
// hosts:
|
||||
// - "bookinfo-namespace/*.bookinfo.com"
|
||||
// tls:
|
||||
// mode: SIMPLE # enables HTTPS on this port
|
||||
// credentialName: bookinfo-secret # fetches certs from Kubernetes secret
|
||||
// - port:
|
||||
// number: 9080
|
||||
// name: http-wildcard
|
||||
// protocol: HTTP
|
||||
// hosts:
|
||||
// - "*"
|
||||
// - port:
|
||||
// number: 2379 # to expose internal service via external port 2379
|
||||
// name: mongo
|
||||
// protocol: MONGO
|
||||
// hosts:
|
||||
// - "*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: Gateway
|
||||
// metadata:
|
||||
// name: my-gateway
|
||||
// namespace: some-config-namespace
|
||||
// spec:
|
||||
// selector:
|
||||
// app: my-gateway-controller
|
||||
// servers:
|
||||
// - port:
|
||||
// number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// hosts:
|
||||
// - uk.bookinfo.com
|
||||
// - eu.bookinfo.com
|
||||
// tls:
|
||||
// httpsRedirect: true # sends 301 redirect for http requests
|
||||
// - port:
|
||||
// number: 443
|
||||
// name: https-443
|
||||
// protocol: HTTPS
|
||||
// hosts:
|
||||
// - uk.bookinfo.com
|
||||
// - eu.bookinfo.com
|
||||
// tls:
|
||||
// mode: SIMPLE # enables HTTPS on this port
|
||||
// serverCertificate: /etc/certs/servercert.pem
|
||||
// privateKey: /etc/certs/privatekey.pem
|
||||
// - port:
|
||||
// number: 9443
|
||||
// name: https-9443
|
||||
// protocol: HTTPS
|
||||
// hosts:
|
||||
// - "bookinfo-namespace/*.bookinfo.com"
|
||||
// tls:
|
||||
// mode: SIMPLE # enables HTTPS on this port
|
||||
// credentialName: bookinfo-secret # fetches certs from Kubernetes secret
|
||||
// - port:
|
||||
// number: 9080
|
||||
// name: http-wildcard
|
||||
// protocol: HTTP
|
||||
// hosts:
|
||||
// - "*"
|
||||
// - port:
|
||||
// number: 2379 # to expose internal service via external port 2379
|
||||
// name: mongo
|
||||
// protocol: MONGO
|
||||
// hosts:
|
||||
// - "*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The Gateway specification above describes the L4-L6 properties of a load
|
||||
// balancer. A `VirtualService` can then be bound to a gateway to control
|
||||
// the forwarding of traffic arriving at a particular host or gateway port.
|
||||
//
|
||||
// For example, the following VirtualService splits traffic for
|
||||
// `https://uk.bookinfo.com/reviews`, `https://eu.bookinfo.com/reviews`,
|
||||
// `http://uk.bookinfo.com:9080/reviews`,
|
||||
// `http://eu.bookinfo.com:9080/reviews` into two versions (prod and qa) of
|
||||
// an internal reviews service on port 9080. In addition, requests
|
||||
// containing the cookie "user: dev-123" will be sent to special port 7777
|
||||
// in the qa version. The same rule is also applicable inside the mesh for
|
||||
// requests to the "reviews.prod.svc.cluster.local" service. This rule is
|
||||
// applicable across ports 443, 9080. Note that `http://uk.bookinfo.com`
|
||||
// gets redirected to `https://uk.bookinfo.com` (i.e. 80 redirects to 443).
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: VirtualService
|
||||
// metadata:
|
||||
// name: bookinfo-rule
|
||||
// namespace: bookinfo-namespace
|
||||
// spec:
|
||||
// hosts:
|
||||
// - reviews.prod.svc.cluster.local
|
||||
// - uk.bookinfo.com
|
||||
// - eu.bookinfo.com
|
||||
// gateways:
|
||||
// - some-config-namespace/my-gateway
|
||||
// - mesh # applies to all the sidecars in the mesh
|
||||
// http:
|
||||
// - match:
|
||||
// - headers:
|
||||
// cookie:
|
||||
// exact: "user=dev-123"
|
||||
// route:
|
||||
// - destination:
|
||||
// port:
|
||||
// number: 7777
|
||||
// host: reviews.qa.svc.cluster.local
|
||||
// - match:
|
||||
// - uri:
|
||||
// prefix: /reviews/
|
||||
// route:
|
||||
// - destination:
|
||||
// port:
|
||||
// number: 9080 # can be omitted if it's the only port for reviews
|
||||
// host: reviews.prod.svc.cluster.local
|
||||
// weight: 80
|
||||
// - destination:
|
||||
// host: reviews.qa.svc.cluster.local
|
||||
// weight: 20
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: VirtualService
|
||||
// metadata:
|
||||
// name: bookinfo-rule
|
||||
// namespace: bookinfo-namespace
|
||||
// spec:
|
||||
// hosts:
|
||||
// - reviews.prod.svc.cluster.local
|
||||
// - uk.bookinfo.com
|
||||
// - eu.bookinfo.com
|
||||
// gateways:
|
||||
// - some-config-namespace/my-gateway
|
||||
// - mesh # applies to all the sidecars in the mesh
|
||||
// http:
|
||||
// - match:
|
||||
// - headers:
|
||||
// cookie:
|
||||
// exact: "user=dev-123"
|
||||
// route:
|
||||
// - destination:
|
||||
// port:
|
||||
// number: 7777
|
||||
// host: reviews.qa.svc.cluster.local
|
||||
// - match:
|
||||
// - uri:
|
||||
// prefix: /reviews/
|
||||
// route:
|
||||
// - destination:
|
||||
// port:
|
||||
// number: 9080 # can be omitted if it's the only port for reviews
|
||||
// host: reviews.prod.svc.cluster.local
|
||||
// weight: 80
|
||||
// - destination:
|
||||
// host: reviews.qa.svc.cluster.local
|
||||
// weight: 20
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The following VirtualService forwards traffic arriving at (external)
|
||||
// port 27017 to internal Mongo server on port 5555. This rule is not
|
||||
// applicable internally in the mesh as the gateway list omits the
|
||||
// reserved name `mesh`.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: VirtualService
|
||||
// metadata:
|
||||
// name: bookinfo-Mongo
|
||||
// namespace: bookinfo-namespace
|
||||
// spec:
|
||||
// hosts:
|
||||
// - mongosvr.prod.svc.cluster.local # name of internal Mongo service
|
||||
// gateways:
|
||||
// - some-config-namespace/my-gateway # can omit the namespace if gateway is
|
||||
// in same
|
||||
// namespace as virtual service.
|
||||
// tcp:
|
||||
// - match:
|
||||
// - port: 27017
|
||||
// route:
|
||||
// - destination:
|
||||
// host: mongo.prod.svc.cluster.local
|
||||
// port:
|
||||
// number: 5555
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: VirtualService
|
||||
// metadata:
|
||||
// name: bookinfo-Mongo
|
||||
// namespace: bookinfo-namespace
|
||||
// spec:
|
||||
// hosts:
|
||||
// - mongosvr.prod.svc.cluster.local # name of internal Mongo service
|
||||
// gateways:
|
||||
// - some-config-namespace/my-gateway # can omit the namespace if gateway is
|
||||
// in same
|
||||
// namespace as virtual service.
|
||||
// tcp:
|
||||
// - match:
|
||||
// - port: 27017
|
||||
// route:
|
||||
// - destination:
|
||||
// host: mongo.prod.svc.cluster.local
|
||||
// port:
|
||||
// number: 5555
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// It is possible to restrict the set of virtual services that can bind to
|
||||
// a gateway server using the namespace/hostname syntax in the hosts field.
|
||||
// For example, the following Gateway allows any virtual service in the ns1
|
||||
// namespace to bind to it, while restricting only the virtual service with
|
||||
// foo.bar.com host in the ns2 namespace to bind to it.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: Gateway
|
||||
// metadata:
|
||||
// name: my-gateway
|
||||
// namespace: some-config-namespace
|
||||
// spec:
|
||||
// selector:
|
||||
// app: my-gateway-controller
|
||||
// servers:
|
||||
// - port:
|
||||
// number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// hosts:
|
||||
// - "ns1/*"
|
||||
// - "ns2/foo.bar.com"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: Gateway
|
||||
// metadata:
|
||||
// name: my-gateway
|
||||
// namespace: some-config-namespace
|
||||
// spec:
|
||||
// selector:
|
||||
// app: my-gateway-controller
|
||||
// servers:
|
||||
// - port:
|
||||
// number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// hosts:
|
||||
// - "ns1/*"
|
||||
// - "ns2/foo.bar.com"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
|
||||
package v1beta1
|
||||
|
||||
import (
|
||||
bytes "bytes"
|
||||
fmt "fmt"
|
||||
github_com_gogo_protobuf_jsonpb "github.com/gogo/protobuf/jsonpb"
|
||||
proto "github.com/gogo/protobuf/proto"
|
||||
_ "istio.io/gogo-genproto/googleapis/google/api"
|
||||
math "math"
|
||||
)
|
||||
|
||||
// Reference imports to suppress errors if they are not otherwise used.
|
||||
var _ = proto.Marshal
|
||||
var _ = fmt.Errorf
|
||||
var _ = math.Inf
|
||||
|
||||
// MarshalJSON is a custom marshaler for Gateway
|
||||
func (this *Gateway) MarshalJSON() ([]byte, error) {
|
||||
str, err := GatewayMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for Gateway
|
||||
func (this *Gateway) UnmarshalJSON(b []byte) error {
|
||||
return GatewayUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for Server
|
||||
func (this *Server) MarshalJSON() ([]byte, error) {
|
||||
str, err := GatewayMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for Server
|
||||
func (this *Server) UnmarshalJSON(b []byte) error {
|
||||
return GatewayUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for Port
|
||||
func (this *Port) MarshalJSON() ([]byte, error) {
|
||||
str, err := GatewayMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for Port
|
||||
func (this *Port) UnmarshalJSON(b []byte) error {
|
||||
return GatewayUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for ServerTLSSettings
|
||||
func (this *ServerTLSSettings) MarshalJSON() ([]byte, error) {
|
||||
str, err := GatewayMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for ServerTLSSettings
|
||||
func (this *ServerTLSSettings) UnmarshalJSON(b []byte) error {
|
||||
return GatewayUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
var (
|
||||
GatewayMarshaler = &github_com_gogo_protobuf_jsonpb.Marshaler{}
|
||||
GatewayUnmarshaler = &github_com_gogo_protobuf_jsonpb.Unmarshaler{}
|
||||
)
|
||||
168
vendor/istio.io/api/networking/v1beta1/service_entry.gen.json
generated
vendored
Normal file
168
vendor/istio.io/api/networking/v1beta1/service_entry.gen.json
generated
vendored
Normal file
@@ -0,0 +1,168 @@
|
||||
{
|
||||
"openapi": "3.0.0",
|
||||
"info": {
|
||||
"title": "Configuration affecting service registry.",
|
||||
"version": "v1beta1"
|
||||
},
|
||||
"components": {
|
||||
"schemas": {
|
||||
"istio.networking.v1beta1.Port": {
|
||||
"description": "Port describes the properties of a specific port of a service.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"number": {
|
||||
"description": "A valid non-negative integer port number.",
|
||||
"type": "integer"
|
||||
},
|
||||
"name": {
|
||||
"description": "Label assigned to the port.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"protocol": {
|
||||
"description": "The protocol exposed on the port. MUST BE one of HTTP|HTTPS|GRPC|HTTP2|MONGO|TCP|TLS. TLS implies the connection will be routed based on the SNI header to the destination without terminating the TLS connection.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.ServiceEntry": {
|
||||
"description": "ServiceEntry enables adding additional entries into Istio's internal service registry.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"exportTo": {
|
||||
"description": "A list of namespaces to which this service is exported. Exporting a service allows it to be used by sidecars, gateways and virtual services defined in other namespaces. This feature provides a mechanism for service owners and mesh administrators to control the visibility of services across namespace boundaries.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"subjectAltNames": {
|
||||
"description": "If specified, the proxy will verify that the server certificate's subject alternate name matches one of the specified values.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"hosts": {
|
||||
"description": "The hosts associated with the ServiceEntry. Could be a DNS name with wildcard prefix.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"addresses": {
|
||||
"description": "The virtual IP addresses associated with the service. Could be CIDR prefix. For HTTP traffic, generated route configurations will include http route domains for both the `addresses` and `hosts` field values and the destination will be identified based on the HTTP Host/Authority header. If one or more IP addresses are specified, the incoming traffic will be identified as belonging to this service if the destination IP matches the IP/CIDRs specified in the addresses field. If the Addresses field is empty, traffic will be identified solely based on the destination port. In such scenarios, the port on which the service is being accessed must not be shared by any other service in the mesh. In other words, the sidecar will behave as a simple TCP proxy, forwarding incoming traffic on a specified port to the specified destination endpoint IP/host. Unix domain socket addresses are not supported in this field.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"ports": {
|
||||
"description": "The ports associated with the external service. If the Endpoints are Unix domain socket addresses, there must be exactly one port.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.Port"
|
||||
}
|
||||
},
|
||||
"location": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.ServiceEntry.Location"
|
||||
},
|
||||
"resolution": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.ServiceEntry.Resolution"
|
||||
},
|
||||
"endpoints": {
|
||||
"description": "One or more endpoints associated with the service. Only one of `endpoints` or `workloadSelector` can be specified.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.WorkloadEntry"
|
||||
}
|
||||
},
|
||||
"workloadSelector": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.WorkloadSelector"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.ServiceEntry.Location": {
|
||||
"description": "Location specifies whether the service is part of Istio mesh or outside the mesh. Location determines the behavior of several features, such as service-to-service mTLS authentication, policy enforcement, etc. When communicating with services outside the mesh, Istio's mTLS authentication is disabled, and policy enforcement is performed on the client-side as opposed to server-side.",
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"MESH_EXTERNAL",
|
||||
"MESH_INTERNAL"
|
||||
]
|
||||
},
|
||||
"istio.networking.v1beta1.ServiceEntry.Resolution": {
|
||||
"description": "Resolution determines how the proxy will resolve the IP addresses of the network endpoints associated with the service, so that it can route to one of them. The resolution mode specified here has no impact on how the application resolves the IP address associated with the service. The application may still have to use DNS to resolve the service to an IP so that the outbound traffic can be captured by the Proxy. Alternatively, for HTTP services, the application could directly communicate with the proxy (e.g., by setting HTTP_PROXY) to talk to these services.",
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"NONE",
|
||||
"STATIC",
|
||||
"DNS"
|
||||
]
|
||||
},
|
||||
"istio.networking.v1beta1.WorkloadEntry": {
|
||||
"description": "WorkloadEntry enables specifying the properties of a single non-Kubernetes workload such a VM or a bare metal services that can be referred to by service entries.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"labels": {
|
||||
"description": "One or more labels associated with the endpoint.",
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"ports": {
|
||||
"description": "Set of ports associated with the endpoint. The ports must be associated with a port name that was declared as part of the service. Do not use for `unix://` addresses.",
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"weight": {
|
||||
"description": "The load balancing weight associated with the endpoint. Endpoints with higher weights will receive proportionally higher traffic.",
|
||||
"type": "integer"
|
||||
},
|
||||
"address": {
|
||||
"description": "Address associated with the network endpoint without the port. Domain names can be used if and only if the resolution is set to DNS, and must be fully-qualified without wildcards. Use the form unix:///absolute/path/to/socket for Unix domain socket endpoints.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"network": {
|
||||
"description": "Network enables Istio to group endpoints resident in the same L3 domain/network. All endpoints in the same network are assumed to be directly reachable from one another. When endpoints in different networks cannot reach each other directly, an Istio Gateway can be used to establish connectivity (usually using the `AUTO_PASSTHROUGH` mode in a Gateway Server). This is an advanced configuration used typically for spanning an Istio mesh over multiple clusters.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"locality": {
|
||||
"description": "The locality associated with the endpoint. A locality corresponds to a failure domain (e.g., country/region/zone). Arbitrary failure domain hierarchies can be represented by separating each encapsulating failure domain by /. For example, the locality of an an endpoint in US, in US-East-1 region, within availability zone az-1, in data center rack r11 can be represented as us/us-east-1/az-1/r11. Istio will configure the sidecar to route to endpoints within the same locality as the sidecar. If none of the endpoints in the locality are available, endpoints parent locality (but within the same network ID) will be chosen. For example, if there are two endpoints in same network (networkID \"n1\"), say e1 with locality us/us-east-1/az-1/r11 and e2 with locality us/us-east-1/az-2/r12, a sidecar from us/us-east-1/az-1/r11 locality will prefer e1 from the same locality over e2 from a different locality. Endpoint e2 could be the IP associated with a gateway (that bridges networks n1 and n2), or the IP associated with a standard service endpoint.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"serviceAccount": {
|
||||
"description": "The service account associated with the workload if a sidecar is present in the workload. The service account must be present in the same namespace as the configuration ( WorkloadEntry or a ServiceEntry)",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.WorkloadSelector": {
|
||||
"description": "`WorkloadSelector` specifies the criteria used to determine if the `Gateway`, `Sidecar`, or `EnvoyFilter` configuration can be applied to a proxy. The matching criteria includes the metadata associated with a proxy, workload instance info such as labels attached to the pod/VM, or any other info that the proxy provides to Istio during the initial handshake. If multiple conditions are specified, all conditions need to match in order for the workload instance to be selected. Currently, only label based selection mechanism is supported.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"labels": {
|
||||
"description": "One or more labels that indicate a specific set of pods/VMs on which this `Sidecar` configuration should be applied. The scope of label search is restricted to the configuration namespace in which the the resource is present.",
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
1748
vendor/istio.io/api/networking/v1beta1/service_entry.pb.go
generated
vendored
Normal file
1748
vendor/istio.io/api/networking/v1beta1/service_entry.pb.go
generated
vendored
Normal file
File diff suppressed because it is too large
Load Diff
956
vendor/istio.io/api/networking/v1beta1/service_entry.proto
generated
vendored
Normal file
956
vendor/istio.io/api/networking/v1beta1/service_entry.proto
generated
vendored
Normal file
@@ -0,0 +1,956 @@
|
||||
// Copyright 2020 Istio Authors
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
import "google/api/field_behavior.proto";
|
||||
import "networking/v1beta1/gateway.proto";
|
||||
import "networking/v1beta1/sidecar.proto";
|
||||
import "networking/v1beta1/workload_entry.proto";
|
||||
|
||||
// $schema: istio.networking.v1beta1.ServiceEntry
|
||||
// $title: Service Entry
|
||||
// $description: Configuration affecting service registry.
|
||||
// $location: https://istio.io/docs/reference/config/networking/service-entry.html
|
||||
// $aliases: [/docs/reference/config/networking/v1beta1/service-entry]
|
||||
|
||||
// `ServiceEntry` enables adding additional entries into Istio's
|
||||
// internal service registry, so that auto-discovered services in the
|
||||
// mesh can access/route to these manually specified services. A
|
||||
// service entry describes the properties of a service (DNS name,
|
||||
// VIPs, ports, protocols, endpoints). These services could be
|
||||
// external to the mesh (e.g., web APIs) or mesh-internal services
|
||||
// that are not part of the platform's service registry (e.g., a set
|
||||
// of VMs talking to services in Kubernetes). In addition, the
|
||||
// endpoints of a service entry can also be dynamically selected by
|
||||
// using the `workloadSelector` field. These endpoints can be VM
|
||||
// workloads declared using the `WorkloadEntry` object or Kubernetes
|
||||
// pods. The ability to select both pods and VMs under a single
|
||||
// service allows for migration of services from VMs to Kubernetes
|
||||
// without having to change the existing DNS names associated with the
|
||||
// services.
|
||||
//
|
||||
// The following example declares a few external APIs accessed by internal
|
||||
// applications over HTTPS. The sidecar inspects the SNI value in the
|
||||
// ClientHello message to route to the appropriate external service.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-https
|
||||
// spec:
|
||||
// hosts:
|
||||
// - api.dropboxapi.com
|
||||
// - www.googleapis.com
|
||||
// - api.facebook.com
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 443
|
||||
// name: https
|
||||
// protocol: TLS
|
||||
// resolution: DNS
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-https
|
||||
// spec:
|
||||
// hosts:
|
||||
// - api.dropboxapi.com
|
||||
// - www.googleapis.com
|
||||
// - api.facebook.com
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 443
|
||||
// name: https
|
||||
// protocol: TLS
|
||||
// resolution: DNS
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The following configuration adds a set of MongoDB instances running on
|
||||
// unmanaged VMs to Istio's registry, so that these services can be treated
|
||||
// as any other service in the mesh. The associated DestinationRule is used
|
||||
// to initiate mTLS connections to the database instances.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-mongocluster
|
||||
// spec:
|
||||
// hosts:
|
||||
// - mymongodb.somedomain # not used
|
||||
// addresses:
|
||||
// - 192.192.192.192/24 # VIPs
|
||||
// ports:
|
||||
// - number: 27018
|
||||
// name: mongodb
|
||||
// protocol: MONGO
|
||||
// location: MESH_INTERNAL
|
||||
// resolution: STATIC
|
||||
// endpoints:
|
||||
// - address: 2.2.2.2
|
||||
// - address: 3.3.3.3
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-mongocluster
|
||||
// spec:
|
||||
// hosts:
|
||||
// - mymongodb.somedomain # not used
|
||||
// addresses:
|
||||
// - 192.192.192.192/24 # VIPs
|
||||
// ports:
|
||||
// - number: 27018
|
||||
// name: mongodb
|
||||
// protocol: MONGO
|
||||
// location: MESH_INTERNAL
|
||||
// resolution: STATIC
|
||||
// endpoints:
|
||||
// - address: 2.2.2.2
|
||||
// - address: 3.3.3.3
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// and the associated DestinationRule
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: DestinationRule
|
||||
// metadata:
|
||||
// name: mtls-mongocluster
|
||||
// spec:
|
||||
// host: mymongodb.somedomain
|
||||
// trafficPolicy:
|
||||
// tls:
|
||||
// mode: MUTUAL
|
||||
// clientCertificate: /etc/certs/myclientcert.pem
|
||||
// privateKey: /etc/certs/client_private_key.pem
|
||||
// caCertificates: /etc/certs/rootcacerts.pem
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: DestinationRule
|
||||
// metadata:
|
||||
// name: mtls-mongocluster
|
||||
// spec:
|
||||
// host: mymongodb.somedomain
|
||||
// trafficPolicy:
|
||||
// tls:
|
||||
// mode: MUTUAL
|
||||
// clientCertificate: /etc/certs/myclientcert.pem
|
||||
// privateKey: /etc/certs/client_private_key.pem
|
||||
// caCertificates: /etc/certs/rootcacerts.pem
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The following example uses a combination of service entry and TLS
|
||||
// routing in a virtual service to steer traffic based on the SNI value to
|
||||
// an internal egress firewall.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-redirect
|
||||
// spec:
|
||||
// hosts:
|
||||
// - wikipedia.org
|
||||
// - "*.wikipedia.org"
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 443
|
||||
// name: https
|
||||
// protocol: TLS
|
||||
// resolution: NONE
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-redirect
|
||||
// spec:
|
||||
// hosts:
|
||||
// - wikipedia.org
|
||||
// - "*.wikipedia.org"
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 443
|
||||
// name: https
|
||||
// protocol: TLS
|
||||
// resolution: NONE
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// And the associated VirtualService to route based on the SNI value.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: VirtualService
|
||||
// metadata:
|
||||
// name: tls-routing
|
||||
// spec:
|
||||
// hosts:
|
||||
// - wikipedia.org
|
||||
// - "*.wikipedia.org"
|
||||
// tls:
|
||||
// - match:
|
||||
// - sniHosts:
|
||||
// - wikipedia.org
|
||||
// - "*.wikipedia.org"
|
||||
// route:
|
||||
// - destination:
|
||||
// host: internal-egress-firewall.ns1.svc.cluster.local
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: VirtualService
|
||||
// metadata:
|
||||
// name: tls-routing
|
||||
// spec:
|
||||
// hosts:
|
||||
// - wikipedia.org
|
||||
// - "*.wikipedia.org"
|
||||
// tls:
|
||||
// - match:
|
||||
// - sniHosts:
|
||||
// - wikipedia.org
|
||||
// - "*.wikipedia.org"
|
||||
// route:
|
||||
// - destination:
|
||||
// host: internal-egress-firewall.ns1.svc.cluster.local
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The virtual service with TLS match serves to override the default SNI
|
||||
// match. In the absence of a virtual service, traffic will be forwarded to
|
||||
// the wikipedia domains.
|
||||
//
|
||||
// The following example demonstrates the use of a dedicated egress gateway
|
||||
// through which all external service traffic is forwarded.
|
||||
// The 'exportTo' field allows for control over the visibility of a service
|
||||
// declaration to other namespaces in the mesh. By default, a service is exported
|
||||
// to all namespaces. The following example restricts the visibility to the
|
||||
// current namespace, represented by ".", so that it cannot be used by other
|
||||
// namespaces.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-httpbin
|
||||
// namespace : egress
|
||||
// spec:
|
||||
// hosts:
|
||||
// - httpbin.com
|
||||
// exportTo:
|
||||
// - "."
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: DNS
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-httpbin
|
||||
// namespace : egress
|
||||
// spec:
|
||||
// hosts:
|
||||
// - httpbin.com
|
||||
// exportTo:
|
||||
// - "."
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: DNS
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// Define a gateway to handle all egress traffic.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: Gateway
|
||||
// metadata:
|
||||
// name: istio-egressgateway
|
||||
// namespace: istio-system
|
||||
// spec:
|
||||
// selector:
|
||||
// istio: egressgateway
|
||||
// servers:
|
||||
// - port:
|
||||
// number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// hosts:
|
||||
// - "*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: Gateway
|
||||
// metadata:
|
||||
// name: istio-egressgateway
|
||||
// namespace: istio-system
|
||||
// spec:
|
||||
// selector:
|
||||
// istio: egressgateway
|
||||
// servers:
|
||||
// - port:
|
||||
// number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// hosts:
|
||||
// - "*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// And the associated `VirtualService` to route from the sidecar to the
|
||||
// gateway service (`istio-egressgateway.istio-system.svc.cluster.local`), as
|
||||
// well as route from the gateway to the external service. Note that the
|
||||
// virtual service is exported to all namespaces enabling them to route traffic
|
||||
// through the gateway to the external service. Forcing traffic to go through
|
||||
// a managed middle proxy like this is a common practice.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: VirtualService
|
||||
// metadata:
|
||||
// name: gateway-routing
|
||||
// namespace: egress
|
||||
// spec:
|
||||
// hosts:
|
||||
// - httpbin.com
|
||||
// exportTo:
|
||||
// - "*"
|
||||
// gateways:
|
||||
// - mesh
|
||||
// - istio-egressgateway
|
||||
// http:
|
||||
// - match:
|
||||
// - port: 80
|
||||
// gateways:
|
||||
// - mesh
|
||||
// route:
|
||||
// - destination:
|
||||
// host: istio-egressgateway.istio-system.svc.cluster.local
|
||||
// - match:
|
||||
// - port: 80
|
||||
// gateways:
|
||||
// - istio-egressgateway
|
||||
// route:
|
||||
// - destination:
|
||||
// host: httpbin.com
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: VirtualService
|
||||
// metadata:
|
||||
// name: gateway-routing
|
||||
// namespace: egress
|
||||
// spec:
|
||||
// hosts:
|
||||
// - httpbin.com
|
||||
// exportTo:
|
||||
// - "*"
|
||||
// gateways:
|
||||
// - mesh
|
||||
// - istio-egressgateway
|
||||
// http:
|
||||
// - match:
|
||||
// - port: 80
|
||||
// gateways:
|
||||
// - mesh
|
||||
// route:
|
||||
// - destination:
|
||||
// host: istio-egressgateway.istio-system.svc.cluster.local
|
||||
// - match:
|
||||
// - port: 80
|
||||
// gateways:
|
||||
// - istio-egressgateway
|
||||
// route:
|
||||
// - destination:
|
||||
// host: httpbin.com
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The following example demonstrates the use of wildcards in the hosts for
|
||||
// external services. If the connection has to be routed to the IP address
|
||||
// requested by the application (i.e. application resolves DNS and attempts
|
||||
// to connect to a specific IP), the discovery mode must be set to `NONE`.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-wildcard-example
|
||||
// spec:
|
||||
// hosts:
|
||||
// - "*.bar.com"
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: NONE
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-wildcard-example
|
||||
// spec:
|
||||
// hosts:
|
||||
// - "*.bar.com"
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: NONE
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The following example demonstrates a service that is available via a
|
||||
// Unix Domain Socket on the host of the client. The resolution must be
|
||||
// set to STATIC to use Unix address endpoints.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: unix-domain-socket-example
|
||||
// spec:
|
||||
// hosts:
|
||||
// - "example.unix.local"
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: STATIC
|
||||
// endpoints:
|
||||
// - address: unix:///var/run/example/socket
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: unix-domain-socket-example
|
||||
// spec:
|
||||
// hosts:
|
||||
// - "example.unix.local"
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: STATIC
|
||||
// endpoints:
|
||||
// - address: unix:///var/run/example/socket
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// For HTTP-based services, it is possible to create a `VirtualService`
|
||||
// backed by multiple DNS addressable endpoints. In such a scenario, the
|
||||
// application can use the `HTTP_PROXY` environment variable to transparently
|
||||
// reroute API calls for the `VirtualService` to a chosen backend. For
|
||||
// example, the following configuration creates a non-existent external
|
||||
// service called foo.bar.com backed by three domains: us.foo.bar.com:8080,
|
||||
// uk.foo.bar.com:9080, and in.foo.bar.com:7080
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-dns
|
||||
// spec:
|
||||
// hosts:
|
||||
// - foo.bar.com
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: DNS
|
||||
// endpoints:
|
||||
// - address: us.foo.bar.com
|
||||
// ports:
|
||||
// http: 8080
|
||||
// - address: uk.foo.bar.com
|
||||
// ports:
|
||||
// http: 9080
|
||||
// - address: in.foo.bar.com
|
||||
// ports:
|
||||
// http: 7080
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-dns
|
||||
// spec:
|
||||
// hosts:
|
||||
// - foo.bar.com
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: DNS
|
||||
// endpoints:
|
||||
// - address: us.foo.bar.com
|
||||
// ports:
|
||||
// http: 8080
|
||||
// - address: uk.foo.bar.com
|
||||
// ports:
|
||||
// http: 9080
|
||||
// - address: in.foo.bar.com
|
||||
// ports:
|
||||
// http: 7080
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// With `HTTP_PROXY=http://localhost/`, calls from the application to
|
||||
// `http://foo.bar.com` will be load balanced across the three domains
|
||||
// specified above. In other words, a call to `http://foo.bar.com/baz` would
|
||||
// be translated to `http://uk.foo.bar.com/baz`.
|
||||
//
|
||||
// The following example illustrates the usage of a `ServiceEntry`
|
||||
// containing a subject alternate name
|
||||
// whose format conforms to the [SPIFFE standard](https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md):
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: httpbin
|
||||
// namespace : httpbin-ns
|
||||
// spec:
|
||||
// hosts:
|
||||
// - httpbin.com
|
||||
// location: MESH_INTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: STATIC
|
||||
// endpoints:
|
||||
// - address: 2.2.2.2
|
||||
// - address: 3.3.3.3
|
||||
// subjectAltNames:
|
||||
// - "spiffe://cluster.local/ns/httpbin-ns/sa/httpbin-service-account"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: httpbin
|
||||
// namespace : httpbin-ns
|
||||
// spec:
|
||||
// hosts:
|
||||
// - httpbin.com
|
||||
// location: MESH_INTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: STATIC
|
||||
// endpoints:
|
||||
// - address: 2.2.2.2
|
||||
// - address: 3.3.3.3
|
||||
// subjectAltNames:
|
||||
// - "spiffe://cluster.local/ns/httpbin-ns/sa/httpbin-service-account"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The following example demonstrates the use of `ServiceEntry` with a
|
||||
// `workloadSelector` to handle the migration of a service
|
||||
// `details.bookinfo.com` from VMs to Kubernetes. The service has two
|
||||
// VM-based instances with sidecars as well as a set of Kubernetes
|
||||
// pods managed by a standard deployment object. Consumers of this
|
||||
// service in the mesh will be automatically load balanced across the
|
||||
// VMs and Kubernetes. VM for the `details.bookinfo.com`
|
||||
// service. This VM has sidecar installed and bootstrapped using the
|
||||
// `details-legacy` service account. The sidecar receives HTTP traffic
|
||||
// on port 80 (wrapped in istio mutual TLS) and forwards it to the
|
||||
// application on the localhost on the same port.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: WorkloadEntry
|
||||
// metadata:
|
||||
// name: details-vm-1
|
||||
// spec:
|
||||
// serviceAccount: details
|
||||
// address: 2.2.2.2
|
||||
// labels:
|
||||
// app: details
|
||||
// instance-id: vm1
|
||||
// ---
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: WorkloadEntry
|
||||
// metadata:
|
||||
// name: details-vm-2
|
||||
// spec:
|
||||
// serviceAccount: details
|
||||
// address: 3.3.3.3
|
||||
// labels:
|
||||
// app: details
|
||||
// instance-id: vm2
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: WorkloadEntry
|
||||
// metadata:
|
||||
// name: details-vm-1
|
||||
// spec:
|
||||
// serviceAccount: details
|
||||
// address: 2.2.2.2
|
||||
// labels:
|
||||
// app: details
|
||||
// instance-id: vm1
|
||||
// ---
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: WorkloadEntry
|
||||
// metadata:
|
||||
// name: details-vm-2
|
||||
// spec:
|
||||
// serviceAccount: details
|
||||
// address: 3.3.3.3
|
||||
// labels:
|
||||
// app: details
|
||||
// instance-id: vm2
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// Assuming there is also a Kubernetes deployment with pod labels
|
||||
// `app: details` using the same service account `details`, the
|
||||
// following service entry declares a service spanning both VMs and
|
||||
// Kubernetes:
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// hosts:
|
||||
// - details.bookinfo.com
|
||||
// location: MESH_INTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: STATIC
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: details
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// hosts:
|
||||
// - details.bookinfo.com
|
||||
// location: MESH_INTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: STATIC
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: details
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
package istio.networking.v1beta1;
|
||||
|
||||
option go_package = "istio.io/api/networking/v1beta1";
|
||||
|
||||
// ServiceEntry enables adding additional entries into Istio's internal
|
||||
// service registry.
|
||||
//
|
||||
// <!-- crd generation tags
|
||||
// +cue-gen:ServiceEntry:groupName:networking.istio.io
|
||||
// +cue-gen:ServiceEntry:version:v1beta1
|
||||
// +cue-gen:ServiceEntry:annotations:helm.sh/resource-policy=keep
|
||||
// +cue-gen:ServiceEntry:labels:app=istio-pilot,chart=istio,heritage=Tiller,release=istio
|
||||
// +cue-gen:ServiceEntry:subresource:status
|
||||
// +cue-gen:ServiceEntry:scope:Namespaced
|
||||
// +cue-gen:ServiceEntry:resource:categories=istio-io,networking-istio-io,shortNames=se,plural=serviceentries
|
||||
// +cue-gen:ServiceEntry:printerColumn:name=Hosts,type=string,JSONPath=.spec.hosts,description="The hosts associated with the ServiceEntry"
|
||||
// +cue-gen:ServiceEntry:printerColumn:name=Location,type=string,JSONPath=.spec.location,description="Whether the service is external to the
|
||||
// mesh or part of the mesh (MESH_EXTERNAL or MESH_INTERNAL)"
|
||||
// +cue-gen:ServiceEntry:printerColumn:name=Resolution,type=string,JSONPath=.spec.resolution,description="Service discovery mode for the hosts
|
||||
// (NONE, STATIC, or DNS)"
|
||||
// +cue-gen:ServiceEntry:printerColumn:name=Age,type=date,JSONPath=.metadata.creationTimestamp,description="CreationTimestamp is a timestamp
|
||||
// representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations.
|
||||
// Clients may not set this value. It is represented in RFC3339 form and is in UTC.
|
||||
// Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata"
|
||||
// +cue-gen:ServiceEntry:preserveUnknownFields:false
|
||||
// -->
|
||||
//
|
||||
// <!-- go code generation tags
|
||||
// +kubetype-gen
|
||||
// +kubetype-gen:groupVersion=networking.istio.io/v1beta1
|
||||
// +genclient
|
||||
// +k8s:deepcopy-gen=true
|
||||
// -->
|
||||
message ServiceEntry {
|
||||
// The hosts associated with the ServiceEntry. Could be a DNS
|
||||
// name with wildcard prefix.
|
||||
//
|
||||
// 1. The hosts field is used to select matching hosts in VirtualServices and DestinationRules.
|
||||
// 2. For HTTP traffic the HTTP Host/Authority header will be matched against the hosts field.
|
||||
// 3. For HTTPs or TLS traffic containing Server Name Indication (SNI), the SNI value
|
||||
// will be matched against the hosts field.
|
||||
//
|
||||
// **NOTE 1:** When resolution is set to type DNS and no endpoints
|
||||
// are specified, the host field will be used as the DNS name of the
|
||||
// endpoint to route traffic to.
|
||||
//
|
||||
// **NOTE 2:** If the hostname matches with the name of a service
|
||||
// from another service registry such as Kubernetes that also
|
||||
// supplies its own set of endpoints, the ServiceEntry will be
|
||||
// treated as a decorator of the existing Kubernetes
|
||||
// service. Properties in the service entry will be added to the
|
||||
// Kubernetes service if applicable. Currently, the only the
|
||||
// following additional properties will be considered by `istiod`:
|
||||
//
|
||||
// 1. subjectAltNames: In addition to verifying the SANs of the
|
||||
// service accounts associated with the pods of the service, the
|
||||
// SANs specified here will also be verified.
|
||||
//
|
||||
repeated string hosts = 1 [(google.api.field_behavior) = REQUIRED];
|
||||
|
||||
// The virtual IP addresses associated with the service. Could be CIDR
|
||||
// prefix. For HTTP traffic, generated route configurations will include http route
|
||||
// domains for both the `addresses` and `hosts` field values and the destination will
|
||||
// be identified based on the HTTP Host/Authority header.
|
||||
// If one or more IP addresses are specified,
|
||||
// the incoming traffic will be identified as belonging to this service
|
||||
// if the destination IP matches the IP/CIDRs specified in the addresses
|
||||
// field. If the Addresses field is empty, traffic will be identified
|
||||
// solely based on the destination port. In such scenarios, the port on
|
||||
// which the service is being accessed must not be shared by any other
|
||||
// service in the mesh. In other words, the sidecar will behave as a
|
||||
// simple TCP proxy, forwarding incoming traffic on a specified port to
|
||||
// the specified destination endpoint IP/host. Unix domain socket
|
||||
// addresses are not supported in this field.
|
||||
repeated string addresses = 2;
|
||||
|
||||
// The ports associated with the external service. If the
|
||||
// Endpoints are Unix domain socket addresses, there must be exactly one
|
||||
// port.
|
||||
repeated Port ports = 3 [(google.api.field_behavior) = REQUIRED];
|
||||
|
||||
// Location specifies whether the service is part of Istio mesh or
|
||||
// outside the mesh. Location determines the behavior of several
|
||||
// features, such as service-to-service mTLS authentication, policy
|
||||
// enforcement, etc. When communicating with services outside the mesh,
|
||||
// Istio's mTLS authentication is disabled, and policy enforcement is
|
||||
// performed on the client-side as opposed to server-side.
|
||||
enum Location {
|
||||
// Signifies that the service is external to the mesh. Typically used
|
||||
// to indicate external services consumed through APIs.
|
||||
MESH_EXTERNAL = 0;
|
||||
|
||||
// Signifies that the service is part of the mesh. Typically used to
|
||||
// indicate services added explicitly as part of expanding the service
|
||||
// mesh to include unmanaged infrastructure (e.g., VMs added to a
|
||||
// Kubernetes based service mesh).
|
||||
MESH_INTERNAL = 1;
|
||||
};
|
||||
|
||||
// Specify whether the service should be considered external to the mesh
|
||||
// or part of the mesh.
|
||||
Location location = 4;
|
||||
|
||||
// Resolution determines how the proxy will resolve the IP addresses of
|
||||
// the network endpoints associated with the service, so that it can
|
||||
// route to one of them. The resolution mode specified here has no impact
|
||||
// on how the application resolves the IP address associated with the
|
||||
// service. The application may still have to use DNS to resolve the
|
||||
// service to an IP so that the outbound traffic can be captured by the
|
||||
// Proxy. Alternatively, for HTTP services, the application could
|
||||
// directly communicate with the proxy (e.g., by setting HTTP_PROXY) to
|
||||
// talk to these services.
|
||||
enum Resolution {
|
||||
// Assume that incoming connections have already been resolved (to a
|
||||
// specific destination IP address). Such connections are typically
|
||||
// routed via the proxy using mechanisms such as IP table REDIRECT/
|
||||
// eBPF. After performing any routing related transformations, the
|
||||
// proxy will forward the connection to the IP address to which the
|
||||
// connection was bound.
|
||||
NONE = 0;
|
||||
|
||||
// Use the static IP addresses specified in endpoints (see below) as the
|
||||
// backing instances associated with the service.
|
||||
STATIC = 1;
|
||||
|
||||
// Attempt to resolve the IP address by querying the ambient DNS,
|
||||
// during request processing. If no endpoints are specified, the proxy
|
||||
// will resolve the DNS address specified in the hosts field, if
|
||||
// wildcards are not used. If endpoints are specified, the DNS
|
||||
// addresses specified in the endpoints will be resolved to determine
|
||||
// the destination IP address. DNS resolution cannot be used with Unix
|
||||
// domain socket endpoints.
|
||||
DNS = 2;
|
||||
};
|
||||
|
||||
// Service discovery mode for the hosts. Care must be taken
|
||||
// when setting the resolution mode to NONE for a TCP port without
|
||||
// accompanying IP addresses. In such cases, traffic to any IP on
|
||||
// said port will be allowed (i.e. `0.0.0.0:<port>`).
|
||||
Resolution resolution = 5 [(google.api.field_behavior) = REQUIRED];
|
||||
|
||||
// One or more endpoints associated with the service. Only one of
|
||||
// `endpoints` or `workloadSelector` can be specified.
|
||||
repeated WorkloadEntry endpoints = 6;
|
||||
|
||||
// Applicable only for MESH_INTERNAL services. Only one of
|
||||
// `endpoints` or `workloadSelector` can be specified. Selects one
|
||||
// or more Kubernetes pods or VM workloads (specified using
|
||||
// `WorkloadEntry`) based on their labels. The `WorkloadEntry` object
|
||||
// representing the VMs should be defined in the same namespace as
|
||||
// the ServiceEntry.
|
||||
WorkloadSelector workload_selector = 9;
|
||||
|
||||
// A list of namespaces to which this service is exported. Exporting a service
|
||||
// allows it to be used by sidecars, gateways and virtual services defined in
|
||||
// other namespaces. This feature provides a mechanism for service owners
|
||||
// and mesh administrators to control the visibility of services across
|
||||
// namespace boundaries.
|
||||
//
|
||||
// If no namespaces are specified then the service is exported to all
|
||||
// namespaces by default.
|
||||
//
|
||||
// The value "." is reserved and defines an export to the same namespace that
|
||||
// the service is declared in. Similarly the value "*" is reserved and
|
||||
// defines an export to all namespaces.
|
||||
//
|
||||
// For a Kubernetes Service, the equivalent effect can be achieved by setting
|
||||
// the annotation "networking.istio.io/exportTo" to a comma-separated list
|
||||
// of namespace names.
|
||||
//
|
||||
// NOTE: in the current release, the `exportTo` value is restricted to
|
||||
// "." or "*" (i.e., the current namespace or all namespaces).
|
||||
repeated string export_to = 7;
|
||||
|
||||
// If specified, the proxy will verify that the server certificate's
|
||||
// subject alternate name matches one of the specified values.
|
||||
//
|
||||
// NOTE: When using the workloadEntry with workloadSelectors, the
|
||||
// service account specified in the workloadEntry will also be used
|
||||
// to derive the additional subject alternate names that should be
|
||||
// verified.
|
||||
repeated string subject_alt_names = 8;
|
||||
}
|
||||
769
vendor/istio.io/api/networking/v1beta1/service_entry_deepcopy.gen.go
generated
vendored
Normal file
769
vendor/istio.io/api/networking/v1beta1/service_entry_deepcopy.gen.go
generated
vendored
Normal file
@@ -0,0 +1,769 @@
|
||||
// Code generated by protoc-gen-gogo. DO NOT EDIT.
|
||||
// source: networking/v1beta1/service_entry.proto
|
||||
|
||||
// `ServiceEntry` enables adding additional entries into Istio's
|
||||
// internal service registry, so that auto-discovered services in the
|
||||
// mesh can access/route to these manually specified services. A
|
||||
// service entry describes the properties of a service (DNS name,
|
||||
// VIPs, ports, protocols, endpoints). These services could be
|
||||
// external to the mesh (e.g., web APIs) or mesh-internal services
|
||||
// that are not part of the platform's service registry (e.g., a set
|
||||
// of VMs talking to services in Kubernetes). In addition, the
|
||||
// endpoints of a service entry can also be dynamically selected by
|
||||
// using the `workloadSelector` field. These endpoints can be VM
|
||||
// workloads declared using the `WorkloadEntry` object or Kubernetes
|
||||
// pods. The ability to select both pods and VMs under a single
|
||||
// service allows for migration of services from VMs to Kubernetes
|
||||
// without having to change the existing DNS names associated with the
|
||||
// services.
|
||||
//
|
||||
// The following example declares a few external APIs accessed by internal
|
||||
// applications over HTTPS. The sidecar inspects the SNI value in the
|
||||
// ClientHello message to route to the appropriate external service.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-https
|
||||
// spec:
|
||||
// hosts:
|
||||
// - api.dropboxapi.com
|
||||
// - www.googleapis.com
|
||||
// - api.facebook.com
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 443
|
||||
// name: https
|
||||
// protocol: TLS
|
||||
// resolution: DNS
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-https
|
||||
// spec:
|
||||
// hosts:
|
||||
// - api.dropboxapi.com
|
||||
// - www.googleapis.com
|
||||
// - api.facebook.com
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 443
|
||||
// name: https
|
||||
// protocol: TLS
|
||||
// resolution: DNS
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The following configuration adds a set of MongoDB instances running on
|
||||
// unmanaged VMs to Istio's registry, so that these services can be treated
|
||||
// as any other service in the mesh. The associated DestinationRule is used
|
||||
// to initiate mTLS connections to the database instances.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-mongocluster
|
||||
// spec:
|
||||
// hosts:
|
||||
// - mymongodb.somedomain # not used
|
||||
// addresses:
|
||||
// - 192.192.192.192/24 # VIPs
|
||||
// ports:
|
||||
// - number: 27018
|
||||
// name: mongodb
|
||||
// protocol: MONGO
|
||||
// location: MESH_INTERNAL
|
||||
// resolution: STATIC
|
||||
// endpoints:
|
||||
// - address: 2.2.2.2
|
||||
// - address: 3.3.3.3
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-mongocluster
|
||||
// spec:
|
||||
// hosts:
|
||||
// - mymongodb.somedomain # not used
|
||||
// addresses:
|
||||
// - 192.192.192.192/24 # VIPs
|
||||
// ports:
|
||||
// - number: 27018
|
||||
// name: mongodb
|
||||
// protocol: MONGO
|
||||
// location: MESH_INTERNAL
|
||||
// resolution: STATIC
|
||||
// endpoints:
|
||||
// - address: 2.2.2.2
|
||||
// - address: 3.3.3.3
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// and the associated DestinationRule
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: DestinationRule
|
||||
// metadata:
|
||||
// name: mtls-mongocluster
|
||||
// spec:
|
||||
// host: mymongodb.somedomain
|
||||
// trafficPolicy:
|
||||
// tls:
|
||||
// mode: MUTUAL
|
||||
// clientCertificate: /etc/certs/myclientcert.pem
|
||||
// privateKey: /etc/certs/client_private_key.pem
|
||||
// caCertificates: /etc/certs/rootcacerts.pem
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: DestinationRule
|
||||
// metadata:
|
||||
// name: mtls-mongocluster
|
||||
// spec:
|
||||
// host: mymongodb.somedomain
|
||||
// trafficPolicy:
|
||||
// tls:
|
||||
// mode: MUTUAL
|
||||
// clientCertificate: /etc/certs/myclientcert.pem
|
||||
// privateKey: /etc/certs/client_private_key.pem
|
||||
// caCertificates: /etc/certs/rootcacerts.pem
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The following example uses a combination of service entry and TLS
|
||||
// routing in a virtual service to steer traffic based on the SNI value to
|
||||
// an internal egress firewall.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-redirect
|
||||
// spec:
|
||||
// hosts:
|
||||
// - wikipedia.org
|
||||
// - "*.wikipedia.org"
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 443
|
||||
// name: https
|
||||
// protocol: TLS
|
||||
// resolution: NONE
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-redirect
|
||||
// spec:
|
||||
// hosts:
|
||||
// - wikipedia.org
|
||||
// - "*.wikipedia.org"
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 443
|
||||
// name: https
|
||||
// protocol: TLS
|
||||
// resolution: NONE
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// And the associated VirtualService to route based on the SNI value.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: VirtualService
|
||||
// metadata:
|
||||
// name: tls-routing
|
||||
// spec:
|
||||
// hosts:
|
||||
// - wikipedia.org
|
||||
// - "*.wikipedia.org"
|
||||
// tls:
|
||||
// - match:
|
||||
// - sniHosts:
|
||||
// - wikipedia.org
|
||||
// - "*.wikipedia.org"
|
||||
// route:
|
||||
// - destination:
|
||||
// host: internal-egress-firewall.ns1.svc.cluster.local
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: VirtualService
|
||||
// metadata:
|
||||
// name: tls-routing
|
||||
// spec:
|
||||
// hosts:
|
||||
// - wikipedia.org
|
||||
// - "*.wikipedia.org"
|
||||
// tls:
|
||||
// - match:
|
||||
// - sniHosts:
|
||||
// - wikipedia.org
|
||||
// - "*.wikipedia.org"
|
||||
// route:
|
||||
// - destination:
|
||||
// host: internal-egress-firewall.ns1.svc.cluster.local
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The virtual service with TLS match serves to override the default SNI
|
||||
// match. In the absence of a virtual service, traffic will be forwarded to
|
||||
// the wikipedia domains.
|
||||
//
|
||||
// The following example demonstrates the use of a dedicated egress gateway
|
||||
// through which all external service traffic is forwarded.
|
||||
// The 'exportTo' field allows for control over the visibility of a service
|
||||
// declaration to other namespaces in the mesh. By default, a service is exported
|
||||
// to all namespaces. The following example restricts the visibility to the
|
||||
// current namespace, represented by ".", so that it cannot be used by other
|
||||
// namespaces.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-httpbin
|
||||
// namespace : egress
|
||||
// spec:
|
||||
// hosts:
|
||||
// - httpbin.com
|
||||
// exportTo:
|
||||
// - "."
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: DNS
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-httpbin
|
||||
// namespace : egress
|
||||
// spec:
|
||||
// hosts:
|
||||
// - httpbin.com
|
||||
// exportTo:
|
||||
// - "."
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: DNS
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// Define a gateway to handle all egress traffic.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: Gateway
|
||||
// metadata:
|
||||
// name: istio-egressgateway
|
||||
// namespace: istio-system
|
||||
// spec:
|
||||
// selector:
|
||||
// istio: egressgateway
|
||||
// servers:
|
||||
// - port:
|
||||
// number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// hosts:
|
||||
// - "*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: Gateway
|
||||
// metadata:
|
||||
// name: istio-egressgateway
|
||||
// namespace: istio-system
|
||||
// spec:
|
||||
// selector:
|
||||
// istio: egressgateway
|
||||
// servers:
|
||||
// - port:
|
||||
// number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// hosts:
|
||||
// - "*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// And the associated `VirtualService` to route from the sidecar to the
|
||||
// gateway service (`istio-egressgateway.istio-system.svc.cluster.local`), as
|
||||
// well as route from the gateway to the external service. Note that the
|
||||
// virtual service is exported to all namespaces enabling them to route traffic
|
||||
// through the gateway to the external service. Forcing traffic to go through
|
||||
// a managed middle proxy like this is a common practice.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: VirtualService
|
||||
// metadata:
|
||||
// name: gateway-routing
|
||||
// namespace: egress
|
||||
// spec:
|
||||
// hosts:
|
||||
// - httpbin.com
|
||||
// exportTo:
|
||||
// - "*"
|
||||
// gateways:
|
||||
// - mesh
|
||||
// - istio-egressgateway
|
||||
// http:
|
||||
// - match:
|
||||
// - port: 80
|
||||
// gateways:
|
||||
// - mesh
|
||||
// route:
|
||||
// - destination:
|
||||
// host: istio-egressgateway.istio-system.svc.cluster.local
|
||||
// - match:
|
||||
// - port: 80
|
||||
// gateways:
|
||||
// - istio-egressgateway
|
||||
// route:
|
||||
// - destination:
|
||||
// host: httpbin.com
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: VirtualService
|
||||
// metadata:
|
||||
// name: gateway-routing
|
||||
// namespace: egress
|
||||
// spec:
|
||||
// hosts:
|
||||
// - httpbin.com
|
||||
// exportTo:
|
||||
// - "*"
|
||||
// gateways:
|
||||
// - mesh
|
||||
// - istio-egressgateway
|
||||
// http:
|
||||
// - match:
|
||||
// - port: 80
|
||||
// gateways:
|
||||
// - mesh
|
||||
// route:
|
||||
// - destination:
|
||||
// host: istio-egressgateway.istio-system.svc.cluster.local
|
||||
// - match:
|
||||
// - port: 80
|
||||
// gateways:
|
||||
// - istio-egressgateway
|
||||
// route:
|
||||
// - destination:
|
||||
// host: httpbin.com
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The following example demonstrates the use of wildcards in the hosts for
|
||||
// external services. If the connection has to be routed to the IP address
|
||||
// requested by the application (i.e. application resolves DNS and attempts
|
||||
// to connect to a specific IP), the discovery mode must be set to `NONE`.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-wildcard-example
|
||||
// spec:
|
||||
// hosts:
|
||||
// - "*.bar.com"
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: NONE
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-wildcard-example
|
||||
// spec:
|
||||
// hosts:
|
||||
// - "*.bar.com"
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: NONE
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The following example demonstrates a service that is available via a
|
||||
// Unix Domain Socket on the host of the client. The resolution must be
|
||||
// set to STATIC to use Unix address endpoints.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: unix-domain-socket-example
|
||||
// spec:
|
||||
// hosts:
|
||||
// - "example.unix.local"
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: STATIC
|
||||
// endpoints:
|
||||
// - address: unix:///var/run/example/socket
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: unix-domain-socket-example
|
||||
// spec:
|
||||
// hosts:
|
||||
// - "example.unix.local"
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: STATIC
|
||||
// endpoints:
|
||||
// - address: unix:///var/run/example/socket
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// For HTTP-based services, it is possible to create a `VirtualService`
|
||||
// backed by multiple DNS addressable endpoints. In such a scenario, the
|
||||
// application can use the `HTTP_PROXY` environment variable to transparently
|
||||
// reroute API calls for the `VirtualService` to a chosen backend. For
|
||||
// example, the following configuration creates a non-existent external
|
||||
// service called foo.bar.com backed by three domains: us.foo.bar.com:8080,
|
||||
// uk.foo.bar.com:9080, and in.foo.bar.com:7080
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-dns
|
||||
// spec:
|
||||
// hosts:
|
||||
// - foo.bar.com
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: DNS
|
||||
// endpoints:
|
||||
// - address: us.foo.bar.com
|
||||
// ports:
|
||||
// http: 8080
|
||||
// - address: uk.foo.bar.com
|
||||
// ports:
|
||||
// http: 9080
|
||||
// - address: in.foo.bar.com
|
||||
// ports:
|
||||
// http: 7080
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-dns
|
||||
// spec:
|
||||
// hosts:
|
||||
// - foo.bar.com
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: DNS
|
||||
// endpoints:
|
||||
// - address: us.foo.bar.com
|
||||
// ports:
|
||||
// http: 8080
|
||||
// - address: uk.foo.bar.com
|
||||
// ports:
|
||||
// http: 9080
|
||||
// - address: in.foo.bar.com
|
||||
// ports:
|
||||
// http: 7080
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// With `HTTP_PROXY=http://localhost/`, calls from the application to
|
||||
// `http://foo.bar.com` will be load balanced across the three domains
|
||||
// specified above. In other words, a call to `http://foo.bar.com/baz` would
|
||||
// be translated to `http://uk.foo.bar.com/baz`.
|
||||
//
|
||||
// The following example illustrates the usage of a `ServiceEntry`
|
||||
// containing a subject alternate name
|
||||
// whose format conforms to the [SPIFFE standard](https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md):
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: httpbin
|
||||
// namespace : httpbin-ns
|
||||
// spec:
|
||||
// hosts:
|
||||
// - httpbin.com
|
||||
// location: MESH_INTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: STATIC
|
||||
// endpoints:
|
||||
// - address: 2.2.2.2
|
||||
// - address: 3.3.3.3
|
||||
// subjectAltNames:
|
||||
// - "spiffe://cluster.local/ns/httpbin-ns/sa/httpbin-service-account"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: httpbin
|
||||
// namespace : httpbin-ns
|
||||
// spec:
|
||||
// hosts:
|
||||
// - httpbin.com
|
||||
// location: MESH_INTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: STATIC
|
||||
// endpoints:
|
||||
// - address: 2.2.2.2
|
||||
// - address: 3.3.3.3
|
||||
// subjectAltNames:
|
||||
// - "spiffe://cluster.local/ns/httpbin-ns/sa/httpbin-service-account"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The following example demonstrates the use of `ServiceEntry` with a
|
||||
// `workloadSelector` to handle the migration of a service
|
||||
// `details.bookinfo.com` from VMs to Kubernetes. The service has two
|
||||
// VM-based instances with sidecars as well as a set of Kubernetes
|
||||
// pods managed by a standard deployment object. Consumers of this
|
||||
// service in the mesh will be automatically load balanced across the
|
||||
// VMs and Kubernetes. VM for the `details.bookinfo.com`
|
||||
// service. This VM has sidecar installed and bootstrapped using the
|
||||
// `details-legacy` service account. The sidecar receives HTTP traffic
|
||||
// on port 80 (wrapped in istio mutual TLS) and forwards it to the
|
||||
// application on the localhost on the same port.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: WorkloadEntry
|
||||
// metadata:
|
||||
// name: details-vm-1
|
||||
// spec:
|
||||
// serviceAccount: details
|
||||
// address: 2.2.2.2
|
||||
// labels:
|
||||
// app: details
|
||||
// instance-id: vm1
|
||||
// ---
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: WorkloadEntry
|
||||
// metadata:
|
||||
// name: details-vm-2
|
||||
// spec:
|
||||
// serviceAccount: details
|
||||
// address: 3.3.3.3
|
||||
// labels:
|
||||
// app: details
|
||||
// instance-id: vm2
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: WorkloadEntry
|
||||
// metadata:
|
||||
// name: details-vm-1
|
||||
// spec:
|
||||
// serviceAccount: details
|
||||
// address: 2.2.2.2
|
||||
// labels:
|
||||
// app: details
|
||||
// instance-id: vm1
|
||||
// ---
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: WorkloadEntry
|
||||
// metadata:
|
||||
// name: details-vm-2
|
||||
// spec:
|
||||
// serviceAccount: details
|
||||
// address: 3.3.3.3
|
||||
// labels:
|
||||
// app: details
|
||||
// instance-id: vm2
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// Assuming there is also a Kubernetes deployment with pod labels
|
||||
// `app: details` using the same service account `details`, the
|
||||
// following service entry declares a service spanning both VMs and
|
||||
// Kubernetes:
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// hosts:
|
||||
// - details.bookinfo.com
|
||||
// location: MESH_INTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: STATIC
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: details
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// hosts:
|
||||
// - details.bookinfo.com
|
||||
// location: MESH_INTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: STATIC
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: details
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
|
||||
package v1beta1
|
||||
|
||||
import (
|
||||
fmt "fmt"
|
||||
proto "github.com/gogo/protobuf/proto"
|
||||
_ "istio.io/gogo-genproto/googleapis/google/api"
|
||||
math "math"
|
||||
)
|
||||
|
||||
// Reference imports to suppress errors if they are not otherwise used.
|
||||
var _ = proto.Marshal
|
||||
var _ = fmt.Errorf
|
||||
var _ = math.Inf
|
||||
|
||||
// DeepCopyInto supports using ServiceEntry within kubernetes types, where deepcopy-gen is used.
|
||||
func (in *ServiceEntry) DeepCopyInto(out *ServiceEntry) {
|
||||
p := proto.Clone(in).(*ServiceEntry)
|
||||
*out = *p
|
||||
}
|
||||
781
vendor/istio.io/api/networking/v1beta1/service_entry_json.gen.go
generated
vendored
Normal file
781
vendor/istio.io/api/networking/v1beta1/service_entry_json.gen.go
generated
vendored
Normal file
@@ -0,0 +1,781 @@
|
||||
// Code generated by protoc-gen-gogo. DO NOT EDIT.
|
||||
// source: networking/v1beta1/service_entry.proto
|
||||
|
||||
// `ServiceEntry` enables adding additional entries into Istio's
|
||||
// internal service registry, so that auto-discovered services in the
|
||||
// mesh can access/route to these manually specified services. A
|
||||
// service entry describes the properties of a service (DNS name,
|
||||
// VIPs, ports, protocols, endpoints). These services could be
|
||||
// external to the mesh (e.g., web APIs) or mesh-internal services
|
||||
// that are not part of the platform's service registry (e.g., a set
|
||||
// of VMs talking to services in Kubernetes). In addition, the
|
||||
// endpoints of a service entry can also be dynamically selected by
|
||||
// using the `workloadSelector` field. These endpoints can be VM
|
||||
// workloads declared using the `WorkloadEntry` object or Kubernetes
|
||||
// pods. The ability to select both pods and VMs under a single
|
||||
// service allows for migration of services from VMs to Kubernetes
|
||||
// without having to change the existing DNS names associated with the
|
||||
// services.
|
||||
//
|
||||
// The following example declares a few external APIs accessed by internal
|
||||
// applications over HTTPS. The sidecar inspects the SNI value in the
|
||||
// ClientHello message to route to the appropriate external service.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-https
|
||||
// spec:
|
||||
// hosts:
|
||||
// - api.dropboxapi.com
|
||||
// - www.googleapis.com
|
||||
// - api.facebook.com
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 443
|
||||
// name: https
|
||||
// protocol: TLS
|
||||
// resolution: DNS
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-https
|
||||
// spec:
|
||||
// hosts:
|
||||
// - api.dropboxapi.com
|
||||
// - www.googleapis.com
|
||||
// - api.facebook.com
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 443
|
||||
// name: https
|
||||
// protocol: TLS
|
||||
// resolution: DNS
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The following configuration adds a set of MongoDB instances running on
|
||||
// unmanaged VMs to Istio's registry, so that these services can be treated
|
||||
// as any other service in the mesh. The associated DestinationRule is used
|
||||
// to initiate mTLS connections to the database instances.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-mongocluster
|
||||
// spec:
|
||||
// hosts:
|
||||
// - mymongodb.somedomain # not used
|
||||
// addresses:
|
||||
// - 192.192.192.192/24 # VIPs
|
||||
// ports:
|
||||
// - number: 27018
|
||||
// name: mongodb
|
||||
// protocol: MONGO
|
||||
// location: MESH_INTERNAL
|
||||
// resolution: STATIC
|
||||
// endpoints:
|
||||
// - address: 2.2.2.2
|
||||
// - address: 3.3.3.3
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-mongocluster
|
||||
// spec:
|
||||
// hosts:
|
||||
// - mymongodb.somedomain # not used
|
||||
// addresses:
|
||||
// - 192.192.192.192/24 # VIPs
|
||||
// ports:
|
||||
// - number: 27018
|
||||
// name: mongodb
|
||||
// protocol: MONGO
|
||||
// location: MESH_INTERNAL
|
||||
// resolution: STATIC
|
||||
// endpoints:
|
||||
// - address: 2.2.2.2
|
||||
// - address: 3.3.3.3
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// and the associated DestinationRule
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: DestinationRule
|
||||
// metadata:
|
||||
// name: mtls-mongocluster
|
||||
// spec:
|
||||
// host: mymongodb.somedomain
|
||||
// trafficPolicy:
|
||||
// tls:
|
||||
// mode: MUTUAL
|
||||
// clientCertificate: /etc/certs/myclientcert.pem
|
||||
// privateKey: /etc/certs/client_private_key.pem
|
||||
// caCertificates: /etc/certs/rootcacerts.pem
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: DestinationRule
|
||||
// metadata:
|
||||
// name: mtls-mongocluster
|
||||
// spec:
|
||||
// host: mymongodb.somedomain
|
||||
// trafficPolicy:
|
||||
// tls:
|
||||
// mode: MUTUAL
|
||||
// clientCertificate: /etc/certs/myclientcert.pem
|
||||
// privateKey: /etc/certs/client_private_key.pem
|
||||
// caCertificates: /etc/certs/rootcacerts.pem
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The following example uses a combination of service entry and TLS
|
||||
// routing in a virtual service to steer traffic based on the SNI value to
|
||||
// an internal egress firewall.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-redirect
|
||||
// spec:
|
||||
// hosts:
|
||||
// - wikipedia.org
|
||||
// - "*.wikipedia.org"
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 443
|
||||
// name: https
|
||||
// protocol: TLS
|
||||
// resolution: NONE
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-redirect
|
||||
// spec:
|
||||
// hosts:
|
||||
// - wikipedia.org
|
||||
// - "*.wikipedia.org"
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 443
|
||||
// name: https
|
||||
// protocol: TLS
|
||||
// resolution: NONE
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// And the associated VirtualService to route based on the SNI value.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: VirtualService
|
||||
// metadata:
|
||||
// name: tls-routing
|
||||
// spec:
|
||||
// hosts:
|
||||
// - wikipedia.org
|
||||
// - "*.wikipedia.org"
|
||||
// tls:
|
||||
// - match:
|
||||
// - sniHosts:
|
||||
// - wikipedia.org
|
||||
// - "*.wikipedia.org"
|
||||
// route:
|
||||
// - destination:
|
||||
// host: internal-egress-firewall.ns1.svc.cluster.local
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: VirtualService
|
||||
// metadata:
|
||||
// name: tls-routing
|
||||
// spec:
|
||||
// hosts:
|
||||
// - wikipedia.org
|
||||
// - "*.wikipedia.org"
|
||||
// tls:
|
||||
// - match:
|
||||
// - sniHosts:
|
||||
// - wikipedia.org
|
||||
// - "*.wikipedia.org"
|
||||
// route:
|
||||
// - destination:
|
||||
// host: internal-egress-firewall.ns1.svc.cluster.local
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The virtual service with TLS match serves to override the default SNI
|
||||
// match. In the absence of a virtual service, traffic will be forwarded to
|
||||
// the wikipedia domains.
|
||||
//
|
||||
// The following example demonstrates the use of a dedicated egress gateway
|
||||
// through which all external service traffic is forwarded.
|
||||
// The 'exportTo' field allows for control over the visibility of a service
|
||||
// declaration to other namespaces in the mesh. By default, a service is exported
|
||||
// to all namespaces. The following example restricts the visibility to the
|
||||
// current namespace, represented by ".", so that it cannot be used by other
|
||||
// namespaces.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-httpbin
|
||||
// namespace : egress
|
||||
// spec:
|
||||
// hosts:
|
||||
// - httpbin.com
|
||||
// exportTo:
|
||||
// - "."
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: DNS
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-httpbin
|
||||
// namespace : egress
|
||||
// spec:
|
||||
// hosts:
|
||||
// - httpbin.com
|
||||
// exportTo:
|
||||
// - "."
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: DNS
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// Define a gateway to handle all egress traffic.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: Gateway
|
||||
// metadata:
|
||||
// name: istio-egressgateway
|
||||
// namespace: istio-system
|
||||
// spec:
|
||||
// selector:
|
||||
// istio: egressgateway
|
||||
// servers:
|
||||
// - port:
|
||||
// number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// hosts:
|
||||
// - "*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: Gateway
|
||||
// metadata:
|
||||
// name: istio-egressgateway
|
||||
// namespace: istio-system
|
||||
// spec:
|
||||
// selector:
|
||||
// istio: egressgateway
|
||||
// servers:
|
||||
// - port:
|
||||
// number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// hosts:
|
||||
// - "*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// And the associated `VirtualService` to route from the sidecar to the
|
||||
// gateway service (`istio-egressgateway.istio-system.svc.cluster.local`), as
|
||||
// well as route from the gateway to the external service. Note that the
|
||||
// virtual service is exported to all namespaces enabling them to route traffic
|
||||
// through the gateway to the external service. Forcing traffic to go through
|
||||
// a managed middle proxy like this is a common practice.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: VirtualService
|
||||
// metadata:
|
||||
// name: gateway-routing
|
||||
// namespace: egress
|
||||
// spec:
|
||||
// hosts:
|
||||
// - httpbin.com
|
||||
// exportTo:
|
||||
// - "*"
|
||||
// gateways:
|
||||
// - mesh
|
||||
// - istio-egressgateway
|
||||
// http:
|
||||
// - match:
|
||||
// - port: 80
|
||||
// gateways:
|
||||
// - mesh
|
||||
// route:
|
||||
// - destination:
|
||||
// host: istio-egressgateway.istio-system.svc.cluster.local
|
||||
// - match:
|
||||
// - port: 80
|
||||
// gateways:
|
||||
// - istio-egressgateway
|
||||
// route:
|
||||
// - destination:
|
||||
// host: httpbin.com
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: VirtualService
|
||||
// metadata:
|
||||
// name: gateway-routing
|
||||
// namespace: egress
|
||||
// spec:
|
||||
// hosts:
|
||||
// - httpbin.com
|
||||
// exportTo:
|
||||
// - "*"
|
||||
// gateways:
|
||||
// - mesh
|
||||
// - istio-egressgateway
|
||||
// http:
|
||||
// - match:
|
||||
// - port: 80
|
||||
// gateways:
|
||||
// - mesh
|
||||
// route:
|
||||
// - destination:
|
||||
// host: istio-egressgateway.istio-system.svc.cluster.local
|
||||
// - match:
|
||||
// - port: 80
|
||||
// gateways:
|
||||
// - istio-egressgateway
|
||||
// route:
|
||||
// - destination:
|
||||
// host: httpbin.com
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The following example demonstrates the use of wildcards in the hosts for
|
||||
// external services. If the connection has to be routed to the IP address
|
||||
// requested by the application (i.e. application resolves DNS and attempts
|
||||
// to connect to a specific IP), the discovery mode must be set to `NONE`.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-wildcard-example
|
||||
// spec:
|
||||
// hosts:
|
||||
// - "*.bar.com"
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: NONE
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-wildcard-example
|
||||
// spec:
|
||||
// hosts:
|
||||
// - "*.bar.com"
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: NONE
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The following example demonstrates a service that is available via a
|
||||
// Unix Domain Socket on the host of the client. The resolution must be
|
||||
// set to STATIC to use Unix address endpoints.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: unix-domain-socket-example
|
||||
// spec:
|
||||
// hosts:
|
||||
// - "example.unix.local"
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: STATIC
|
||||
// endpoints:
|
||||
// - address: unix:///var/run/example/socket
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: unix-domain-socket-example
|
||||
// spec:
|
||||
// hosts:
|
||||
// - "example.unix.local"
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: STATIC
|
||||
// endpoints:
|
||||
// - address: unix:///var/run/example/socket
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// For HTTP-based services, it is possible to create a `VirtualService`
|
||||
// backed by multiple DNS addressable endpoints. In such a scenario, the
|
||||
// application can use the `HTTP_PROXY` environment variable to transparently
|
||||
// reroute API calls for the `VirtualService` to a chosen backend. For
|
||||
// example, the following configuration creates a non-existent external
|
||||
// service called foo.bar.com backed by three domains: us.foo.bar.com:8080,
|
||||
// uk.foo.bar.com:9080, and in.foo.bar.com:7080
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-dns
|
||||
// spec:
|
||||
// hosts:
|
||||
// - foo.bar.com
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: DNS
|
||||
// endpoints:
|
||||
// - address: us.foo.bar.com
|
||||
// ports:
|
||||
// http: 8080
|
||||
// - address: uk.foo.bar.com
|
||||
// ports:
|
||||
// http: 9080
|
||||
// - address: in.foo.bar.com
|
||||
// ports:
|
||||
// http: 7080
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-dns
|
||||
// spec:
|
||||
// hosts:
|
||||
// - foo.bar.com
|
||||
// location: MESH_EXTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: DNS
|
||||
// endpoints:
|
||||
// - address: us.foo.bar.com
|
||||
// ports:
|
||||
// http: 8080
|
||||
// - address: uk.foo.bar.com
|
||||
// ports:
|
||||
// http: 9080
|
||||
// - address: in.foo.bar.com
|
||||
// ports:
|
||||
// http: 7080
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// With `HTTP_PROXY=http://localhost/`, calls from the application to
|
||||
// `http://foo.bar.com` will be load balanced across the three domains
|
||||
// specified above. In other words, a call to `http://foo.bar.com/baz` would
|
||||
// be translated to `http://uk.foo.bar.com/baz`.
|
||||
//
|
||||
// The following example illustrates the usage of a `ServiceEntry`
|
||||
// containing a subject alternate name
|
||||
// whose format conforms to the [SPIFFE standard](https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE-ID.md):
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: httpbin
|
||||
// namespace : httpbin-ns
|
||||
// spec:
|
||||
// hosts:
|
||||
// - httpbin.com
|
||||
// location: MESH_INTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: STATIC
|
||||
// endpoints:
|
||||
// - address: 2.2.2.2
|
||||
// - address: 3.3.3.3
|
||||
// subjectAltNames:
|
||||
// - "spiffe://cluster.local/ns/httpbin-ns/sa/httpbin-service-account"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: httpbin
|
||||
// namespace : httpbin-ns
|
||||
// spec:
|
||||
// hosts:
|
||||
// - httpbin.com
|
||||
// location: MESH_INTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: STATIC
|
||||
// endpoints:
|
||||
// - address: 2.2.2.2
|
||||
// - address: 3.3.3.3
|
||||
// subjectAltNames:
|
||||
// - "spiffe://cluster.local/ns/httpbin-ns/sa/httpbin-service-account"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The following example demonstrates the use of `ServiceEntry` with a
|
||||
// `workloadSelector` to handle the migration of a service
|
||||
// `details.bookinfo.com` from VMs to Kubernetes. The service has two
|
||||
// VM-based instances with sidecars as well as a set of Kubernetes
|
||||
// pods managed by a standard deployment object. Consumers of this
|
||||
// service in the mesh will be automatically load balanced across the
|
||||
// VMs and Kubernetes. VM for the `details.bookinfo.com`
|
||||
// service. This VM has sidecar installed and bootstrapped using the
|
||||
// `details-legacy` service account. The sidecar receives HTTP traffic
|
||||
// on port 80 (wrapped in istio mutual TLS) and forwards it to the
|
||||
// application on the localhost on the same port.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: WorkloadEntry
|
||||
// metadata:
|
||||
// name: details-vm-1
|
||||
// spec:
|
||||
// serviceAccount: details
|
||||
// address: 2.2.2.2
|
||||
// labels:
|
||||
// app: details
|
||||
// instance-id: vm1
|
||||
// ---
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: WorkloadEntry
|
||||
// metadata:
|
||||
// name: details-vm-2
|
||||
// spec:
|
||||
// serviceAccount: details
|
||||
// address: 3.3.3.3
|
||||
// labels:
|
||||
// app: details
|
||||
// instance-id: vm2
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: WorkloadEntry
|
||||
// metadata:
|
||||
// name: details-vm-1
|
||||
// spec:
|
||||
// serviceAccount: details
|
||||
// address: 2.2.2.2
|
||||
// labels:
|
||||
// app: details
|
||||
// instance-id: vm1
|
||||
// ---
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: WorkloadEntry
|
||||
// metadata:
|
||||
// name: details-vm-2
|
||||
// spec:
|
||||
// serviceAccount: details
|
||||
// address: 3.3.3.3
|
||||
// labels:
|
||||
// app: details
|
||||
// instance-id: vm2
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// Assuming there is also a Kubernetes deployment with pod labels
|
||||
// `app: details` using the same service account `details`, the
|
||||
// following service entry declares a service spanning both VMs and
|
||||
// Kubernetes:
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// hosts:
|
||||
// - details.bookinfo.com
|
||||
// location: MESH_INTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: STATIC
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: details
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// hosts:
|
||||
// - details.bookinfo.com
|
||||
// location: MESH_INTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: STATIC
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: details
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
|
||||
package v1beta1
|
||||
|
||||
import (
|
||||
bytes "bytes"
|
||||
fmt "fmt"
|
||||
github_com_gogo_protobuf_jsonpb "github.com/gogo/protobuf/jsonpb"
|
||||
proto "github.com/gogo/protobuf/proto"
|
||||
_ "istio.io/gogo-genproto/googleapis/google/api"
|
||||
math "math"
|
||||
)
|
||||
|
||||
// Reference imports to suppress errors if they are not otherwise used.
|
||||
var _ = proto.Marshal
|
||||
var _ = fmt.Errorf
|
||||
var _ = math.Inf
|
||||
|
||||
// MarshalJSON is a custom marshaler for ServiceEntry
|
||||
func (this *ServiceEntry) MarshalJSON() ([]byte, error) {
|
||||
str, err := ServiceEntryMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for ServiceEntry
|
||||
func (this *ServiceEntry) UnmarshalJSON(b []byte) error {
|
||||
return ServiceEntryUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
var (
|
||||
ServiceEntryMarshaler = &github_com_gogo_protobuf_jsonpb.Marshaler{}
|
||||
ServiceEntryUnmarshaler = &github_com_gogo_protobuf_jsonpb.Unmarshaler{}
|
||||
)
|
||||
335
vendor/istio.io/api/networking/v1beta1/sidecar.gen.json
generated
vendored
Normal file
335
vendor/istio.io/api/networking/v1beta1/sidecar.gen.json
generated
vendored
Normal file
@@ -0,0 +1,335 @@
|
||||
{
|
||||
"openapi": "3.0.0",
|
||||
"info": {
|
||||
"title": "Configuration affecting network reachability of a sidecar.",
|
||||
"version": "v1beta1"
|
||||
},
|
||||
"components": {
|
||||
"schemas": {
|
||||
"istio.networking.v1beta1.ClientTLSSettings": {
|
||||
"description": "SSL/TLS related settings for upstream connections. See Envoy's [TLS context](https://www.envoyproxy.io/docs/envoy/latest/api-v2/api/v2/auth/cert.proto.html) for more details. These settings are common to both HTTP and TCP upstreams.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"mode": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.ClientTLSSettings.TLSmode"
|
||||
},
|
||||
"clientCertificate": {
|
||||
"description": "REQUIRED if mode is `MUTUAL`. The path to the file holding the client-side TLS certificate to use. Should be empty if mode is `ISTIO_MUTUAL`.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"privateKey": {
|
||||
"description": "REQUIRED if mode is `MUTUAL`. The path to the file holding the client's private key. Should be empty if mode is `ISTIO_MUTUAL`.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"caCertificates": {
|
||||
"description": "OPTIONAL: The path to the file containing certificate authority certificates to use in verifying a presented server certificate. If omitted, the proxy will not verify the server's certificate. Should be empty if mode is `ISTIO_MUTUAL`.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"subjectAltNames": {
|
||||
"description": "A list of alternate names to verify the subject identity in the certificate. If specified, the proxy will verify that the server certificate's subject alt name matches one of the specified values. If specified, this list overrides the value of subject_alt_names from the ServiceEntry.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"sni": {
|
||||
"description": "SNI string to present to the server during TLS handshake.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.PortSelector": {
|
||||
"description": "PortSelector specifies the number of a port to be used for matching or selection for final routing.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"number": {
|
||||
"description": "Valid port number",
|
||||
"type": "integer"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.ClientTLSSettings.TLSmode": {
|
||||
"description": "TLS connection mode",
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"DISABLE",
|
||||
"SIMPLE",
|
||||
"MUTUAL",
|
||||
"ISTIO_MUTUAL"
|
||||
]
|
||||
},
|
||||
"istio.networking.v1beta1.Port": {
|
||||
"description": "Port describes the properties of a specific port of a service.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"number": {
|
||||
"description": "A valid non-negative integer port number.",
|
||||
"type": "integer"
|
||||
},
|
||||
"name": {
|
||||
"description": "Label assigned to the port.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"protocol": {
|
||||
"description": "The protocol exposed on the port. MUST BE one of HTTP|HTTPS|GRPC|HTTP2|MONGO|TCP|TLS. TLS implies the connection will be routed based on the SNI header to the destination without terminating the TLS connection.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.ServerTLSSettings": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"mode": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.ServerTLSSettings.TLSmode"
|
||||
},
|
||||
"privateKey": {
|
||||
"description": "REQUIRED if mode is `SIMPLE` or `MUTUAL`. The path to the file holding the server's private key.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"caCertificates": {
|
||||
"description": "REQUIRED if mode is `MUTUAL`. The path to a file containing certificate authority certificates to use in verifying a presented client side certificate.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"subjectAltNames": {
|
||||
"description": "A list of alternate names to verify the subject identity in the certificate presented by the client.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"httpsRedirect": {
|
||||
"description": "If set to true, the load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"serverCertificate": {
|
||||
"description": "REQUIRED if mode is `SIMPLE` or `MUTUAL`. The path to the file holding the server-side TLS certificate to use.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"credentialName": {
|
||||
"description": "For gateways running on Kubernetes, the name of the secret that holds the TLS certs including the CA certificates. Applicable only on Kubernetes, and only if the dynamic credential fetching feature is enabled in the proxy by setting `ISTIO_META_USER_SDS` metadata variable. The secret (of type `generic`) should contain the following keys and values: `key: \u003cprivateKey\u003e`, `cert: \u003cserverCert\u003e`, `cacert: \u003cCACertificate\u003e`.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"verifyCertificateSpki": {
|
||||
"description": "An optional list of base64-encoded SHA-256 hashes of the SKPIs of authorized client certificates. Note: When both verify_certificate_hash and verify_certificate_spki are specified, a hash matching either value will result in the certificate being accepted.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"verifyCertificateHash": {
|
||||
"description": "An optional list of hex-encoded SHA-256 hashes of the authorized client certificates. Both simple and colon separated formats are acceptable. Note: When both verify_certificate_hash and verify_certificate_spki are specified, a hash matching either value will result in the certificate being accepted.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"minProtocolVersion": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.ServerTLSSettings.TLSProtocol"
|
||||
},
|
||||
"maxProtocolVersion": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.ServerTLSSettings.TLSProtocol"
|
||||
},
|
||||
"cipherSuites": {
|
||||
"description": "Optional: If specified, only support the specified cipher list. Otherwise default to the default cipher list supported by Envoy.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.ServerTLSSettings.TLSmode": {
|
||||
"description": "TLS modes enforced by the proxy",
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"PASSTHROUGH",
|
||||
"SIMPLE",
|
||||
"MUTUAL",
|
||||
"AUTO_PASSTHROUGH",
|
||||
"ISTIO_MUTUAL"
|
||||
]
|
||||
},
|
||||
"istio.networking.v1beta1.ServerTLSSettings.TLSProtocol": {
|
||||
"description": "TLS protocol versions.",
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"TLS_AUTO",
|
||||
"TLSV1_0",
|
||||
"TLSV1_1",
|
||||
"TLSV1_2",
|
||||
"TLSV1_3"
|
||||
]
|
||||
},
|
||||
"istio.networking.v1beta1.WorkloadSelector": {
|
||||
"description": "`WorkloadSelector` specifies the criteria used to determine if the `Gateway`, `Sidecar`, or `EnvoyFilter` configuration can be applied to a proxy. The matching criteria includes the metadata associated with a proxy, workload instance info such as labels attached to the pod/VM, or any other info that the proxy provides to Istio during the initial handshake. If multiple conditions are specified, all conditions need to match in order for the workload instance to be selected. Currently, only label based selection mechanism is supported.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"labels": {
|
||||
"description": "One or more labels that indicate a specific set of pods/VMs on which this `Sidecar` configuration should be applied. The scope of label search is restricted to the configuration namespace in which the the resource is present.",
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.Sidecar": {
|
||||
"description": "`Sidecar` describes the configuration of the sidecar proxy that mediates inbound and outbound communication of the workload instance to which it is attached.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"workloadSelector": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.WorkloadSelector"
|
||||
},
|
||||
"ingress": {
|
||||
"description": "Ingress specifies the configuration of the sidecar for processing inbound traffic to the attached workload instance. If omitted, Istio will automatically configure the sidecar based on the information about the workload obtained from the orchestration platform (e.g., exposed ports, services, etc.). If specified, inbound ports are configured if and only if the workload instance is associated with a service.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.IstioIngressListener"
|
||||
}
|
||||
},
|
||||
"egress": {
|
||||
"description": "Egress specifies the configuration of the sidecar for processing outbound traffic from the attached workload instance to other services in the mesh. If not specified, inherits the system detected defaults from the namespace-wide or the global default Sidecar.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.IstioEgressListener"
|
||||
}
|
||||
},
|
||||
"outboundTrafficPolicy": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.OutboundTrafficPolicy"
|
||||
},
|
||||
"localhost": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.Localhost"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.IstioIngressListener": {
|
||||
"description": "`IstioIngressListener` specifies the properties of an inbound traffic listener on the sidecar proxy attached to a workload instance.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"port": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.Port"
|
||||
},
|
||||
"bind": {
|
||||
"description": "The IP to which the listener should be bound. Must be in the format `x.x.x.x`. Unix domain socket addresses are not allowed in the bind field for ingress listeners. If omitted, Istio will automatically configure the defaults based on imported services and the workload instances to which this configuration is applied to.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"defaultEndpoint": {
|
||||
"description": "The loopback IP endpoint or Unix domain socket to which traffic should be forwarded to. This configuration can be used to redirect traffic arriving at the bind `IP:Port` on the sidecar to a `localhost:port` or Unix domain socket where the application workload instance is listening for connections. Format should be `127.0.0.1:PORT` or `unix:///path/to/socket`",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"captureMode": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.CaptureMode"
|
||||
},
|
||||
"localhostClientTls": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.ClientTLSSettings"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.IstioEgressListener": {
|
||||
"description": "`IstioEgressListener` specifies the properties of an outbound traffic listener on the sidecar proxy attached to a workload instance.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"port": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.Port"
|
||||
},
|
||||
"bind": {
|
||||
"description": "The IP or the Unix domain socket to which the listener should be bound to. Port MUST be specified if bind is not empty. Format: `x.x.x.x` or `unix:///path/to/uds` or `unix://@foobar` (Linux abstract namespace). If omitted, Istio will automatically configure the defaults based on imported services, the workload instances to which this configuration is applied to and the captureMode. If captureMode is `NONE`, bind will default to 127.0.0.1.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"hosts": {
|
||||
"description": "One or more service hosts exposed by the listener in `namespace/dnsName` format. Services in the specified namespace matching `dnsName` will be exposed. The corresponding service can be a service in the service registry (e.g., a Kubernetes or cloud foundry service) or a service specified using a `ServiceEntry` or `VirtualService` configuration. Any associated `DestinationRule` in the same namespace will also be used.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"captureMode": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.CaptureMode"
|
||||
},
|
||||
"localhostServerTls": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.ServerTLSSettings"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.OutboundTrafficPolicy": {
|
||||
"description": "`OutboundTrafficPolicy` sets the default behavior of the sidecar for handling outbound traffic from the application. If your application uses one or more external services that are not known apriori, setting the policy to `ALLOW_ANY` will cause the sidecars to route any unknown traffic originating from the application to its requested destination. Users are strongly encouraged to use `ServiceEntry` configurations to explicitly declare any external dependencies, instead of using `ALLOW_ANY`, so that traffic to these services can be monitored.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"mode": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.OutboundTrafficPolicy.Mode"
|
||||
},
|
||||
"egressProxy": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.Destination"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.Localhost": {
|
||||
"description": "`Localhost` describes the sidecar settings related to the communication between the sidecar and the workload it is attached to in a Kubernetes Pod or a VM. These settings apply by default to all ingress and egress listeners in a sidecar unless overridden.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"clientTls": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.ClientTLSSettings"
|
||||
},
|
||||
"serverTls": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.ServerTLSSettings"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.CaptureMode": {
|
||||
"description": "`CaptureMode` describes how traffic to a listener is expected to be captured. Applicable only when the listener is bound to an IP.",
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"DEFAULT",
|
||||
"IPTABLES",
|
||||
"NONE"
|
||||
]
|
||||
},
|
||||
"istio.networking.v1beta1.OutboundTrafficPolicy.Mode": {
|
||||
"type": "string",
|
||||
"enum": [
|
||||
"REGISTRY_ONLY",
|
||||
"ALLOW_ANY"
|
||||
]
|
||||
},
|
||||
"istio.networking.v1beta1.Destination": {
|
||||
"description": "Destination indicates the network addressable service to which the request/connection will be sent after processing a routing rule. The destination.host should unambiguously refer to a service in the service registry. Istio's service registry is composed of all the services found in the platform's service registry (e.g., Kubernetes services, Consul services), as well as services declared through the [ServiceEntry](https://istio.io/docs/reference/config/networking/service-entry/#ServiceEntry) resource.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"host": {
|
||||
"description": "The name of a service from the service registry. Service names are looked up from the platform's service registry (e.g., Kubernetes services, Consul services, etc.) and from the hosts declared by [ServiceEntry](https://istio.io/docs/reference/config/networking/service-entry/#ServiceEntry). Traffic forwarded to destinations that are not found in either of the two, will be dropped.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"port": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.PortSelector"
|
||||
},
|
||||
"subset": {
|
||||
"description": "The name of a subset within the service. Applicable only to services within the mesh. The subset must be defined in a corresponding DestinationRule.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
2900
vendor/istio.io/api/networking/v1beta1/sidecar.pb.go
generated
vendored
Normal file
2900
vendor/istio.io/api/networking/v1beta1/sidecar.pb.go
generated
vendored
Normal file
File diff suppressed because it is too large
Load Diff
737
vendor/istio.io/api/networking/v1beta1/sidecar.proto
generated
vendored
Normal file
737
vendor/istio.io/api/networking/v1beta1/sidecar.proto
generated
vendored
Normal file
@@ -0,0 +1,737 @@
|
||||
// Copyright 2020 Istio Authors
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
import "google/api/field_behavior.proto";
|
||||
import "networking/v1beta1/gateway.proto";
|
||||
import "networking/v1beta1/virtual_service.proto";
|
||||
import "networking/v1beta1/destination_rule.proto";
|
||||
|
||||
// $schema: istio.networking.v1beta1.Sidecar
|
||||
// $title: Sidecar
|
||||
// $description: Configuration affecting network reachability of a sidecar.
|
||||
// $location: https://istio.io/docs/reference/config/networking/sidecar.html
|
||||
// $aliases: [/docs/reference/config/networking/v1beta1/sidecar]
|
||||
|
||||
// `Sidecar` describes the configuration of the sidecar proxy that mediates
|
||||
// inbound and outbound communication to the workload instance it is attached to. By
|
||||
// default, Istio will program all sidecar proxies in the mesh with the
|
||||
// necessary configuration required to reach every workload instance in the mesh, as
|
||||
// well as accept traffic on all the ports associated with the
|
||||
// workload. The `Sidecar` configuration provides a way to fine tune the set of
|
||||
// ports, protocols that the proxy will accept when forwarding traffic to
|
||||
// and from the workload. In addition, it is possible to restrict the set
|
||||
// of services that the proxy can reach when forwarding outbound traffic
|
||||
// from workload instances.
|
||||
//
|
||||
// Services and configuration in a mesh are organized into one or more
|
||||
// namespaces (e.g., a Kubernetes namespace or a CF org/space). A `Sidecar`
|
||||
// configuration in a namespace will apply to one or more workload instances in the same
|
||||
// namespace, selected using the `workloadSelector` field. In the absence of a
|
||||
// `workloadSelector`, it will apply to all workload instances in the same
|
||||
// namespace. When determining the `Sidecar` configuration to be applied to a
|
||||
// workload instance, preference will be given to the resource with a
|
||||
// `workloadSelector` that selects this workload instance, over a `Sidecar` configuration
|
||||
// without any `workloadSelector`.
|
||||
//
|
||||
// **NOTE 1**: *_Each namespace can have only one `Sidecar`
|
||||
// configuration without any `workloadSelector`_ that specifies the
|
||||
// default for all pods in that namespace*. It is recommended to use
|
||||
// the name `default` for the namespace-wide sidecar. The behavior of
|
||||
// the system is undefined if more than one selector-less `Sidecar`
|
||||
// configurations exist in a given namespace. The behavior of the
|
||||
// system is undefined if two or more `Sidecar` configurations with a
|
||||
// `workloadSelector` select the same workload instance.
|
||||
//
|
||||
// **NOTE 2**: *_A `Sidecar` configuration in the `MeshConfig`
|
||||
// [root namespace](https://istio.io/docs/reference/config/istio.mesh.v1alpha1/#MeshConfig)
|
||||
// will be applied by default to all namespaces without a `Sidecar`
|
||||
// configuration_*. This global default `Sidecar` configuration should not have
|
||||
// any `workloadSelector`.
|
||||
//
|
||||
// The example below declares a global default `Sidecar` configuration
|
||||
// in the root namespace called `istio-config`, that configures
|
||||
// sidecars in all namespaces to allow egress traffic only to other
|
||||
// workloads in the same namespace as well as to services in the
|
||||
// `istio-system` namespace.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: default
|
||||
// namespace: istio-config
|
||||
// spec:
|
||||
// egress:
|
||||
// - hosts:
|
||||
// - "./*"
|
||||
// - "istio-system/*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: default
|
||||
// namespace: istio-config
|
||||
// spec:
|
||||
// egress:
|
||||
// - hosts:
|
||||
// - "./*"
|
||||
// - "istio-system/*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The example below declares a `Sidecar` configuration in the
|
||||
// `prod-us1` namespace that overrides the global default defined
|
||||
// above, and configures the sidecars in the namespace to allow egress
|
||||
// traffic to public services in the `prod-us1`, `prod-apis`, and the
|
||||
// `istio-system` namespaces.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: default
|
||||
// namespace: prod-us1
|
||||
// spec:
|
||||
// egress:
|
||||
// - hosts:
|
||||
// - "prod-us1/*"
|
||||
// - "prod-apis/*"
|
||||
// - "istio-system/*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: default
|
||||
// namespace: prod-us1
|
||||
// spec:
|
||||
// egress:
|
||||
// - hosts:
|
||||
// - "prod-us1/*"
|
||||
// - "prod-apis/*"
|
||||
// - "istio-system/*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The following example declares a `Sidecar` configuration in the
|
||||
// `prod-us1` namespace for all pods with labels `app: ratings`
|
||||
// belonging to the `ratings.prod-us1` service. The workload accepts
|
||||
// inbound HTTP traffic on port 9080. The traffic is then forwarded to
|
||||
// the attached workload instance listening on a Unix domain
|
||||
// socket. In the egress direction, in addition to the `istio-system`
|
||||
// namespace, the sidecar proxies only HTTP traffic bound for port
|
||||
// 9080 for services in the `prod-us1` namespace.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: ratings
|
||||
// namespace: prod-us1
|
||||
// spec:
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: ratings
|
||||
// ingress:
|
||||
// - port:
|
||||
// number: 9080
|
||||
// protocol: HTTP
|
||||
// name: somename
|
||||
// defaultEndpoint: unix:///var/run/someuds.sock
|
||||
// egress:
|
||||
// - port:
|
||||
// number: 9080
|
||||
// protocol: HTTP
|
||||
// name: egresshttp
|
||||
// hosts:
|
||||
// - "prod-us1/*"
|
||||
// - hosts:
|
||||
// - "istio-system/*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: ratings
|
||||
// namespace: prod-us1
|
||||
// spec:
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: ratings
|
||||
// ingress:
|
||||
// - port:
|
||||
// number: 9080
|
||||
// protocol: HTTP
|
||||
// name: somename
|
||||
// defaultEndpoint: unix:///var/run/someuds.sock
|
||||
// egress:
|
||||
// - port:
|
||||
// number: 9080
|
||||
// protocol: HTTP
|
||||
// name: egresshttp
|
||||
// hosts:
|
||||
// - "prod-us1/*"
|
||||
// - hosts:
|
||||
// - "istio-system/*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// If the workload is deployed without IPTables-based traffic capture,
|
||||
// the `Sidecar` configuration is the only way to configure the ports
|
||||
// on the proxy attached to the workload instance. The following
|
||||
// example declares a `Sidecar` configuration in the `prod-us1`
|
||||
// namespace for all pods with labels `app: productpage` belonging to
|
||||
// the `productpage.prod-us1` service. Assuming that these pods are
|
||||
// deployed without IPtable rules (i.e. the `istio-init` container)
|
||||
// and the proxy metadata `ISTIO_META_INTERCEPTION_MODE` is set to
|
||||
// `NONE`, the specification, below, allows such pods to receive HTTP
|
||||
// traffic on port 9080 (wrapped inside Istio mutual TLS) and forward
|
||||
// it to the application listening on `127.0.0.1:8080`. It also allows
|
||||
// the application to communicate with a backing MySQL database on
|
||||
// `127.0.0.1:3306`, that then gets proxied to the externally hosted
|
||||
// MySQL service at `mysql.foo.com:3306`.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: no-ip-tables
|
||||
// namespace: prod-us1
|
||||
// spec:
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: productpage
|
||||
// ingress:
|
||||
// - port:
|
||||
// number: 9080 # binds to proxy_instance_ip:9080 (0.0.0.0:9080, if no unicast IP is available for the instance)
|
||||
// protocol: HTTP
|
||||
// name: somename
|
||||
// defaultEndpoint: 127.0.0.1:8080
|
||||
// captureMode: NONE # not needed if metadata is set for entire proxy
|
||||
// egress:
|
||||
// - port:
|
||||
// number: 3306
|
||||
// protocol: MYSQL
|
||||
// name: egressmysql
|
||||
// captureMode: NONE # not needed if metadata is set for entire proxy
|
||||
// bind: 127.0.0.1
|
||||
// hosts:
|
||||
// - "*/mysql.foo.com"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: no-ip-tables
|
||||
// namespace: prod-us1
|
||||
// spec:
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: productpage
|
||||
// ingress:
|
||||
// - port:
|
||||
// number: 9080 # binds to proxy_instance_ip:9080 (0.0.0.0:9080, if no unicast IP is available for the instance)
|
||||
// protocol: HTTP
|
||||
// name: somename
|
||||
// defaultEndpoint: 127.0.0.1:8080
|
||||
// captureMode: NONE # not needed if metadata is set for entire proxy
|
||||
// egress:
|
||||
// - port:
|
||||
// number: 3306
|
||||
// protocol: MYSQL
|
||||
// name: egressmysql
|
||||
// captureMode: NONE # not needed if metadata is set for entire proxy
|
||||
// bind: 127.0.0.1
|
||||
// hosts:
|
||||
// - "*/mysql.foo.com"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// And the associated service entry for routing to `mysql.foo.com:3306`
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-mysql
|
||||
// namespace: ns1
|
||||
// spec:
|
||||
// hosts:
|
||||
// - mysql.foo.com
|
||||
// ports:
|
||||
// - number: 3306
|
||||
// name: mysql
|
||||
// protocol: MYSQL
|
||||
// location: MESH_EXTERNAL
|
||||
// resolution: DNS
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-mysql
|
||||
// namespace: ns1
|
||||
// spec:
|
||||
// hosts:
|
||||
// - mysql.foo.com
|
||||
// ports:
|
||||
// - number: 3306
|
||||
// name: mysql
|
||||
// protocol: MYSQL
|
||||
// location: MESH_EXTERNAL
|
||||
// resolution: DNS
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// It is also possible to mix and match traffic capture modes in a single
|
||||
// proxy. For example, consider a setup where internal services are on the
|
||||
// `192.168.0.0/16` subnet. So, IP tables are setup on the VM to capture all
|
||||
// outbound traffic on `192.168.0.0/16` subnet. Assume that the VM has an
|
||||
// additional network interface on `172.16.0.0/16` subnet for inbound
|
||||
// traffic. The following `Sidecar` configuration allows the VM to expose a
|
||||
// listener on `172.16.1.32:80` (the VM's IP) for traffic arriving from the
|
||||
// `172.16.0.0/16` subnet.
|
||||
//
|
||||
// **NOTE**: The `ISTIO_META_INTERCEPTION_MODE` metadata on the
|
||||
// proxy in the VM should contain `REDIRECT` or `TPROXY` as its value,
|
||||
// implying that IP tables based traffic capture is active.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: partial-ip-tables
|
||||
// namespace: prod-us1
|
||||
// spec:
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: productpage
|
||||
// ingress:
|
||||
// - bind: 172.16.1.32
|
||||
// port:
|
||||
// number: 80 # binds to 172.16.1.32:80
|
||||
// protocol: HTTP
|
||||
// name: somename
|
||||
// defaultEndpoint: 127.0.0.1:8080
|
||||
// captureMode: NONE
|
||||
// egress:
|
||||
// # use the system detected defaults
|
||||
// # sets up configuration to handle outbound traffic to services
|
||||
// # in 192.168.0.0/16 subnet, based on information provided by the
|
||||
// # service registry
|
||||
// - captureMode: IPTABLES
|
||||
// hosts:
|
||||
// - "*/*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: partial-ip-tables
|
||||
// namespace: prod-us1
|
||||
// spec:
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: productpage
|
||||
// ingress:
|
||||
// - bind: 172.16.1.32
|
||||
// port:
|
||||
// number: 80 # binds to 172.16.1.32:80
|
||||
// protocol: HTTP
|
||||
// name: somename
|
||||
// defaultEndpoint: 127.0.0.1:8080
|
||||
// captureMode: NONE
|
||||
// egress:
|
||||
// # use the system detected defaults
|
||||
// # sets up configuration to handle outbound traffic to services
|
||||
// # in 192.168.0.0/16 subnet, based on information provided by the
|
||||
// # service registry
|
||||
// - captureMode: IPTABLES
|
||||
// hosts:
|
||||
// - "*/*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
package istio.networking.v1beta1;
|
||||
|
||||
option go_package = "istio.io/api/networking/v1beta1";
|
||||
|
||||
// `Sidecar` describes the configuration of the sidecar proxy that mediates
|
||||
// inbound and outbound communication of the workload instance to which it is
|
||||
// attached.
|
||||
//
|
||||
// <!-- crd generation tags
|
||||
// +cue-gen:Sidecar:groupName:networking.istio.io
|
||||
// +cue-gen:Sidecar:version:v1beta1
|
||||
// +cue-gen:Sidecar:annotations:helm.sh/resource-policy=keep
|
||||
// +cue-gen:Sidecar:labels:app=istio-pilot,chart=istio,heritage=Tiller,release=istio
|
||||
// +cue-gen:Sidecar:subresource:status
|
||||
// +cue-gen:Sidecar:scope:Namespaced
|
||||
// +cue-gen:Sidecar:resource:categories=istio-io,networking-istio-io
|
||||
// +cue-gen:Sidecar:preserveUnknownFields:false
|
||||
// -->
|
||||
//
|
||||
// <!-- go code generation tags
|
||||
// +kubetype-gen
|
||||
// +kubetype-gen:groupVersion=networking.istio.io/v1beta1
|
||||
// +genclient
|
||||
// +k8s:deepcopy-gen=true
|
||||
// -->
|
||||
message Sidecar {
|
||||
// Criteria used to select the specific set of pods/VMs on which this
|
||||
// `Sidecar` configuration should be applied. If omitted, the `Sidecar`
|
||||
// configuration will be applied to all workload instances in the same namespace.
|
||||
WorkloadSelector workload_selector = 1;
|
||||
|
||||
// Ingress specifies the configuration of the sidecar for processing
|
||||
// inbound traffic to the attached workload instance. If omitted, Istio will
|
||||
// automatically configure the sidecar based on the information about the workload
|
||||
// obtained from the orchestration platform (e.g., exposed ports, services,
|
||||
// etc.). If specified, inbound ports are configured if and only if the
|
||||
// workload instance is associated with a service.
|
||||
repeated IstioIngressListener ingress = 2;
|
||||
|
||||
// Egress specifies the configuration of the sidecar for processing
|
||||
// outbound traffic from the attached workload instance to other
|
||||
// services in the mesh. If not specified, inherits the system
|
||||
// detected defaults from the namespace-wide or the global default Sidecar.
|
||||
repeated IstioEgressListener egress = 3;
|
||||
|
||||
// Configuration for the outbound traffic policy. If your
|
||||
// application uses one or more external services that are not known
|
||||
// apriori, setting the policy to `ALLOW_ANY` will cause the
|
||||
// sidecars to route any unknown traffic originating from the
|
||||
// application to its requested destination. If not specified,
|
||||
// inherits the system detected defaults from the namespace-wide or
|
||||
// the global default Sidecar.
|
||||
OutboundTrafficPolicy outbound_traffic_policy = 4;
|
||||
|
||||
// $hide_from_docs
|
||||
// `Localhost` describes the sidecar settings related to the
|
||||
// communication between the sidecar and the workload it is attached to
|
||||
// in a Kubernetes Pod or a VM. These settings apply to all ingress
|
||||
// and egress listeners in a sidecar unless overridden. There are no
|
||||
// built in defaults for this setting. If not specified, the
|
||||
// features will be disabled.
|
||||
Localhost localhost = 6;
|
||||
}
|
||||
|
||||
// `IstioIngressListener` specifies the properties of an inbound
|
||||
// traffic listener on the sidecar proxy attached to a workload instance.
|
||||
message IstioIngressListener {
|
||||
// The port associated with the listener.
|
||||
Port port = 1 [(google.api.field_behavior) = REQUIRED];
|
||||
|
||||
// The IP to which the listener should be bound. Must be in the
|
||||
// format `x.x.x.x`. Unix domain socket addresses are not allowed in
|
||||
// the bind field for ingress listeners. If omitted, Istio will
|
||||
// automatically configure the defaults based on imported services
|
||||
// and the workload instances to which this configuration is applied
|
||||
// to.
|
||||
string bind = 2;
|
||||
|
||||
// The captureMode option dictates how traffic to the listener is
|
||||
// expected to be captured (or not).
|
||||
CaptureMode capture_mode = 3;
|
||||
|
||||
// The loopback IP endpoint or Unix domain socket to which
|
||||
// traffic should be forwarded to. This configuration can be used to
|
||||
// redirect traffic arriving at the bind `IP:Port` on the sidecar to a `localhost:port`
|
||||
// or Unix domain socket where the application workload instance is listening for
|
||||
// connections. Format should be `127.0.0.1:PORT` or `unix:///path/to/socket`
|
||||
string default_endpoint = 4 [(google.api.field_behavior) = REQUIRED];
|
||||
|
||||
// $hide_from_docs
|
||||
// TLS settings to be used by the sidecar (client) when forwarding
|
||||
// traffic from the sidecar to the workload (server) on the
|
||||
// localhost. Overrides the `localhost` level `clientTls` settings.
|
||||
//
|
||||
// **NOTE**: DISABLE, SIMPLE and MUTUAL are the only valid TLS modes.
|
||||
ClientTLSSettings localhost_client_tls = 6;
|
||||
}
|
||||
|
||||
// `IstioEgressListener` specifies the properties of an outbound traffic
|
||||
// listener on the sidecar proxy attached to a workload instance.
|
||||
message IstioEgressListener {
|
||||
// The port associated with the listener. If using Unix domain socket,
|
||||
// use 0 as the port number, with a valid protocol. The port if
|
||||
// specified, will be used as the default destination port associated
|
||||
// with the imported hosts. If the port is omitted, Istio will infer the
|
||||
// listener ports based on the imported hosts. Note that when multiple
|
||||
// egress listeners are specified, where one or more listeners have
|
||||
// specific ports while others have no port, the hosts exposed on a
|
||||
// listener port will be based on the listener with the most specific
|
||||
// port.
|
||||
Port port = 1;
|
||||
|
||||
// The IP or the Unix domain socket to which the listener should be bound
|
||||
// to. Port MUST be specified if bind is not empty. Format: `x.x.x.x` or
|
||||
// `unix:///path/to/uds` or `unix://@foobar` (Linux abstract namespace). If
|
||||
// omitted, Istio will automatically configure the defaults based on imported
|
||||
// services, the workload instances to which this configuration is applied to and
|
||||
// the captureMode. If captureMode is `NONE`, bind will default to
|
||||
// 127.0.0.1.
|
||||
string bind = 2;
|
||||
|
||||
// When the bind address is an IP, the captureMode option dictates
|
||||
// how traffic to the listener is expected to be captured (or not).
|
||||
// captureMode must be DEFAULT or `NONE` for Unix domain socket binds.
|
||||
CaptureMode capture_mode = 3;
|
||||
|
||||
// One or more service hosts exposed by the listener
|
||||
// in `namespace/dnsName` format. Services in the specified namespace
|
||||
// matching `dnsName` will be exposed.
|
||||
// The corresponding service can be a service in the service registry
|
||||
// (e.g., a Kubernetes or cloud foundry service) or a service specified
|
||||
// using a `ServiceEntry` or `VirtualService` configuration. Any
|
||||
// associated `DestinationRule` in the same namespace will also be used.
|
||||
//
|
||||
// The `dnsName` should be specified using FQDN format, optionally including
|
||||
// a wildcard character in the left-most component (e.g., `prod/*.example.com`).
|
||||
// Set the `dnsName` to `*` to select all services from the specified namespace
|
||||
// (e.g., `prod/*`).
|
||||
//
|
||||
// The `namespace` can be set to `*`, `.`, or `~`, representing any, the current,
|
||||
// or no namespace, respectively. For example, `*/foo.example.com` selects the
|
||||
// service from any available namespace while `./foo.example.com` only selects
|
||||
// the service from the namespace of the sidecar. If a host is set to `*/*`,
|
||||
// Istio will configure the sidecar to be able to reach every service in the
|
||||
// mesh that is exported to the sidecar's namespace. The value `~/*` can be used
|
||||
// to completely trim the configuration for sidecars that simply receive traffic
|
||||
// and respond, but make no outbound connections of their own.
|
||||
//
|
||||
// NOTE: Only services and configuration artifacts exported to the sidecar's
|
||||
// namespace (e.g., `exportTo` value of `*`) can be referenced.
|
||||
// Private configurations (e.g., `exportTo` set to `.`) will
|
||||
// not be available. Refer to the `exportTo` setting in `VirtualService`,
|
||||
// `DestinationRule`, and `ServiceEntry` configurations for details.
|
||||
//
|
||||
// **WARNING:** The list of egress hosts in a `Sidecar` must also include
|
||||
// the Mixer control plane services if they are enabled. Envoy will not
|
||||
// be able to reach them otherwise. For example, add host
|
||||
// `istio-system/istio-telemetry.istio-system.svc.cluster.local` if telemetry
|
||||
// is enabled, `istio-system/istio-policy.istio-system.svc.cluster.local` if
|
||||
// policy is enabled, or add `istio-system/*` to allow all services in the
|
||||
// `istio-system` namespace. This requirement is temporary and will be removed
|
||||
// in a future Istio release.
|
||||
repeated string hosts = 4 [(google.api.field_behavior) = REQUIRED];
|
||||
|
||||
// $hide_from_docs
|
||||
// TLS settings to be used by the sidecar (server) when receiving
|
||||
// traffic from the workload (client) on the
|
||||
// localhost. Overrides the `localhost` level `serverTls` settings.
|
||||
//
|
||||
// **NOTE**: SIMPLE and MUTUAL are the only valid TLS
|
||||
// modes. `httpsRedirect` and `credentialName` (for fetching
|
||||
// certificates from Kubernetes secrets) are not valid. All
|
||||
// certificates must be mounted as files inside the sidecar
|
||||
// container.
|
||||
ServerTLSSettings localhost_server_tls = 5;
|
||||
}
|
||||
|
||||
// `WorkloadSelector` specifies the criteria used to determine if the `Gateway`,
|
||||
// `Sidecar`, or `EnvoyFilter` configuration can be applied to a proxy. The matching criteria
|
||||
// includes the metadata associated with a proxy, workload instance info such as
|
||||
// labels attached to the pod/VM, or any other info that the proxy provides
|
||||
// to Istio during the initial handshake. If multiple conditions are
|
||||
// specified, all conditions need to match in order for the workload instance to be
|
||||
// selected. Currently, only label based selection mechanism is supported.
|
||||
message WorkloadSelector {
|
||||
// One or more labels that indicate a specific set of pods/VMs
|
||||
// on which this `Sidecar` configuration should be applied. The scope of
|
||||
// label search is restricted to the configuration namespace in which the
|
||||
// the resource is present.
|
||||
map<string, string> labels = 1 [(google.api.field_behavior) = REQUIRED];
|
||||
|
||||
// $hide_from_docs
|
||||
// other forms of identification supplied by the proxy
|
||||
// when connecting to Pilot, such as X509 fields, tenant IDs, JWT,
|
||||
// etc. This has nothing to do with the request level authN etc.
|
||||
}
|
||||
|
||||
// `OutboundTrafficPolicy` sets the default behavior of the sidecar for
|
||||
// handling outbound traffic from the application.
|
||||
// If your application uses one or more external
|
||||
// services that are not known apriori, setting the policy to `ALLOW_ANY`
|
||||
// will cause the sidecars to route any unknown traffic originating from
|
||||
// the application to its requested destination. Users are strongly
|
||||
// encouraged to use `ServiceEntry` configurations to explicitly declare any external
|
||||
// dependencies, instead of using `ALLOW_ANY`, so that traffic to these
|
||||
// services can be monitored.
|
||||
message OutboundTrafficPolicy {
|
||||
enum Mode {
|
||||
// Outbound traffic will be restricted to services defined in the
|
||||
// service registry as well as those defined through `ServiceEntry` configurations.
|
||||
REGISTRY_ONLY = 0;
|
||||
// Outbound traffic to unknown destinations will be allowed, in case
|
||||
// there are no services or `ServiceEntry` configurations for the destination port.
|
||||
ALLOW_ANY = 1;
|
||||
}
|
||||
Mode mode = 1;
|
||||
|
||||
// Specifies the details of the egress proxy to which unknown
|
||||
// traffic should be forwarded to from the sidecar. Valid only if
|
||||
// the mode is set to ALLOW_ANY. If not specified when the mode is
|
||||
// ALLOW_ANY, the sidecar will send the unknown traffic directly to
|
||||
// the IP requested by the application.
|
||||
//
|
||||
// ** NOTE 1**: The specified egress host must be imported in the
|
||||
// egress section for the traffic forwarding to work.
|
||||
//
|
||||
// ** NOTE 2**: An Envoy based egress gateway is unlikely to be able
|
||||
// to handle plain text TCP connections forwarded from the sidecar.
|
||||
// Envoy's dynamic forward proxy can handle only HTTP and TLS
|
||||
// connections.
|
||||
// $hide_from_docs
|
||||
istio.networking.v1beta1.Destination egress_proxy = 2;
|
||||
}
|
||||
|
||||
|
||||
// `CaptureMode` describes how traffic to a listener is expected to be
|
||||
// captured. Applicable only when the listener is bound to an IP.
|
||||
enum CaptureMode {
|
||||
// The default capture mode defined by the environment.
|
||||
DEFAULT = 0;
|
||||
|
||||
// Capture traffic using IPtables redirection.
|
||||
IPTABLES = 1;
|
||||
|
||||
// No traffic capture. When used in an egress listener, the application is
|
||||
// expected to explicitly communicate with the listener port or Unix
|
||||
// domain socket. When used in an ingress listener, care needs to be taken
|
||||
// to ensure that the listener port is not in use by other processes on
|
||||
// the host.
|
||||
NONE = 2;
|
||||
}
|
||||
|
||||
// $hide_from_docs
|
||||
// `Localhost` describes the sidecar settings related to the
|
||||
// communication between the sidecar and the workload it is attached
|
||||
// to in a Kubernetes Pod or a VM. These settings apply by default to all
|
||||
// ingress and egress listeners in a sidecar unless overridden.
|
||||
//
|
||||
// The following example configures the sidecars on pods of the
|
||||
// reviews service to use TLS for traffic to/from the sidecar to the
|
||||
// workload in the same pod, assuming the appropriate
|
||||
// certificates are mounted in the sidecar.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: reviews-localhost-tls
|
||||
// namespace: prod-us1
|
||||
// spec:
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: reviews
|
||||
// localhost:
|
||||
// clientTls:
|
||||
// mode: SIMPLE
|
||||
// caCertificates: /etc/legacy/ca.pem
|
||||
// serverTls:
|
||||
// mode: SIMPLE
|
||||
// serverCertificate: /etc/legacy/server.pem
|
||||
// privateKey: /etc/legacy/private.pem
|
||||
// egress:
|
||||
// - hosts:
|
||||
// - "./"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: reviews-localhost-tls
|
||||
// namespace: prod-us1
|
||||
// spec:
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: reviews
|
||||
// localhost:
|
||||
// clientTls:
|
||||
// mode: SIMPLE
|
||||
// caCertificates: /etc/legacy/ca.pem
|
||||
// serverTls:
|
||||
// mode: SIMPLE
|
||||
// serverCertificate: /etc/legacy/server.pem
|
||||
// privateKey: /etc/legacy/private.pem
|
||||
// egress:
|
||||
// - hosts:
|
||||
// - "./"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
message Localhost {
|
||||
// TLS settings to be used by the sidecar (client) when forwarding
|
||||
// traffic from the sidecar to the workload it is attached to
|
||||
// (server) on the localhost.
|
||||
//
|
||||
// **NOTE**: DISABLE, SIMPLE and MUTUAL are the only valid TLS modes.
|
||||
ClientTLSSettings client_tls = 1;
|
||||
|
||||
// TLS settings to be used by the sidecar (server) when receiving
|
||||
// traffic from the workload (client) on the localhost.
|
||||
//
|
||||
// **NOTE**: SIMPLE and MUTUAL are the only valid TLS
|
||||
// modes. `httpsRedirect` and `credentialName` (for fetching
|
||||
// certificates from Kubernetes secrets) are not valid. All
|
||||
// certificates must be mounted as files inside the sidecar
|
||||
// container.
|
||||
ServerTLSSettings server_tls = 2;
|
||||
}
|
||||
400
vendor/istio.io/api/networking/v1beta1/sidecar_deepcopy.gen.go
generated
vendored
Normal file
400
vendor/istio.io/api/networking/v1beta1/sidecar_deepcopy.gen.go
generated
vendored
Normal file
@@ -0,0 +1,400 @@
|
||||
// Code generated by protoc-gen-gogo. DO NOT EDIT.
|
||||
// source: networking/v1beta1/sidecar.proto
|
||||
|
||||
// `Sidecar` describes the configuration of the sidecar proxy that mediates
|
||||
// inbound and outbound communication to the workload instance it is attached to. By
|
||||
// default, Istio will program all sidecar proxies in the mesh with the
|
||||
// necessary configuration required to reach every workload instance in the mesh, as
|
||||
// well as accept traffic on all the ports associated with the
|
||||
// workload. The `Sidecar` configuration provides a way to fine tune the set of
|
||||
// ports, protocols that the proxy will accept when forwarding traffic to
|
||||
// and from the workload. In addition, it is possible to restrict the set
|
||||
// of services that the proxy can reach when forwarding outbound traffic
|
||||
// from workload instances.
|
||||
//
|
||||
// Services and configuration in a mesh are organized into one or more
|
||||
// namespaces (e.g., a Kubernetes namespace or a CF org/space). A `Sidecar`
|
||||
// configuration in a namespace will apply to one or more workload instances in the same
|
||||
// namespace, selected using the `workloadSelector` field. In the absence of a
|
||||
// `workloadSelector`, it will apply to all workload instances in the same
|
||||
// namespace. When determining the `Sidecar` configuration to be applied to a
|
||||
// workload instance, preference will be given to the resource with a
|
||||
// `workloadSelector` that selects this workload instance, over a `Sidecar` configuration
|
||||
// without any `workloadSelector`.
|
||||
//
|
||||
// **NOTE 1**: *_Each namespace can have only one `Sidecar`
|
||||
// configuration without any `workloadSelector`_ that specifies the
|
||||
// default for all pods in that namespace*. It is recommended to use
|
||||
// the name `default` for the namespace-wide sidecar. The behavior of
|
||||
// the system is undefined if more than one selector-less `Sidecar`
|
||||
// configurations exist in a given namespace. The behavior of the
|
||||
// system is undefined if two or more `Sidecar` configurations with a
|
||||
// `workloadSelector` select the same workload instance.
|
||||
//
|
||||
// **NOTE 2**: *_A `Sidecar` configuration in the `MeshConfig`
|
||||
// [root namespace](https://istio.io/docs/reference/config/istio.mesh.v1alpha1/#MeshConfig)
|
||||
// will be applied by default to all namespaces without a `Sidecar`
|
||||
// configuration_*. This global default `Sidecar` configuration should not have
|
||||
// any `workloadSelector`.
|
||||
//
|
||||
// The example below declares a global default `Sidecar` configuration
|
||||
// in the root namespace called `istio-config`, that configures
|
||||
// sidecars in all namespaces to allow egress traffic only to other
|
||||
// workloads in the same namespace as well as to services in the
|
||||
// `istio-system` namespace.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: default
|
||||
// namespace: istio-config
|
||||
// spec:
|
||||
// egress:
|
||||
// - hosts:
|
||||
// - "./*"
|
||||
// - "istio-system/*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: default
|
||||
// namespace: istio-config
|
||||
// spec:
|
||||
// egress:
|
||||
// - hosts:
|
||||
// - "./*"
|
||||
// - "istio-system/*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The example below declares a `Sidecar` configuration in the
|
||||
// `prod-us1` namespace that overrides the global default defined
|
||||
// above, and configures the sidecars in the namespace to allow egress
|
||||
// traffic to public services in the `prod-us1`, `prod-apis`, and the
|
||||
// `istio-system` namespaces.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: default
|
||||
// namespace: prod-us1
|
||||
// spec:
|
||||
// egress:
|
||||
// - hosts:
|
||||
// - "prod-us1/*"
|
||||
// - "prod-apis/*"
|
||||
// - "istio-system/*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: default
|
||||
// namespace: prod-us1
|
||||
// spec:
|
||||
// egress:
|
||||
// - hosts:
|
||||
// - "prod-us1/*"
|
||||
// - "prod-apis/*"
|
||||
// - "istio-system/*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The following example declares a `Sidecar` configuration in the
|
||||
// `prod-us1` namespace for all pods with labels `app: ratings`
|
||||
// belonging to the `ratings.prod-us1` service. The workload accepts
|
||||
// inbound HTTP traffic on port 9080. The traffic is then forwarded to
|
||||
// the attached workload instance listening on a Unix domain
|
||||
// socket. In the egress direction, in addition to the `istio-system`
|
||||
// namespace, the sidecar proxies only HTTP traffic bound for port
|
||||
// 9080 for services in the `prod-us1` namespace.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: ratings
|
||||
// namespace: prod-us1
|
||||
// spec:
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: ratings
|
||||
// ingress:
|
||||
// - port:
|
||||
// number: 9080
|
||||
// protocol: HTTP
|
||||
// name: somename
|
||||
// defaultEndpoint: unix:///var/run/someuds.sock
|
||||
// egress:
|
||||
// - port:
|
||||
// number: 9080
|
||||
// protocol: HTTP
|
||||
// name: egresshttp
|
||||
// hosts:
|
||||
// - "prod-us1/*"
|
||||
// - hosts:
|
||||
// - "istio-system/*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: ratings
|
||||
// namespace: prod-us1
|
||||
// spec:
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: ratings
|
||||
// ingress:
|
||||
// - port:
|
||||
// number: 9080
|
||||
// protocol: HTTP
|
||||
// name: somename
|
||||
// defaultEndpoint: unix:///var/run/someuds.sock
|
||||
// egress:
|
||||
// - port:
|
||||
// number: 9080
|
||||
// protocol: HTTP
|
||||
// name: egresshttp
|
||||
// hosts:
|
||||
// - "prod-us1/*"
|
||||
// - hosts:
|
||||
// - "istio-system/*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// If the workload is deployed without IPTables-based traffic capture,
|
||||
// the `Sidecar` configuration is the only way to configure the ports
|
||||
// on the proxy attached to the workload instance. The following
|
||||
// example declares a `Sidecar` configuration in the `prod-us1`
|
||||
// namespace for all pods with labels `app: productpage` belonging to
|
||||
// the `productpage.prod-us1` service. Assuming that these pods are
|
||||
// deployed without IPtable rules (i.e. the `istio-init` container)
|
||||
// and the proxy metadata `ISTIO_META_INTERCEPTION_MODE` is set to
|
||||
// `NONE`, the specification, below, allows such pods to receive HTTP
|
||||
// traffic on port 9080 (wrapped inside Istio mutual TLS) and forward
|
||||
// it to the application listening on `127.0.0.1:8080`. It also allows
|
||||
// the application to communicate with a backing MySQL database on
|
||||
// `127.0.0.1:3306`, that then gets proxied to the externally hosted
|
||||
// MySQL service at `mysql.foo.com:3306`.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: no-ip-tables
|
||||
// namespace: prod-us1
|
||||
// spec:
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: productpage
|
||||
// ingress:
|
||||
// - port:
|
||||
// number: 9080 # binds to proxy_instance_ip:9080 (0.0.0.0:9080, if no unicast IP is available for the instance)
|
||||
// protocol: HTTP
|
||||
// name: somename
|
||||
// defaultEndpoint: 127.0.0.1:8080
|
||||
// captureMode: NONE # not needed if metadata is set for entire proxy
|
||||
// egress:
|
||||
// - port:
|
||||
// number: 3306
|
||||
// protocol: MYSQL
|
||||
// name: egressmysql
|
||||
// captureMode: NONE # not needed if metadata is set for entire proxy
|
||||
// bind: 127.0.0.1
|
||||
// hosts:
|
||||
// - "*/mysql.foo.com"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: no-ip-tables
|
||||
// namespace: prod-us1
|
||||
// spec:
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: productpage
|
||||
// ingress:
|
||||
// - port:
|
||||
// number: 9080 # binds to proxy_instance_ip:9080 (0.0.0.0:9080, if no unicast IP is available for the instance)
|
||||
// protocol: HTTP
|
||||
// name: somename
|
||||
// defaultEndpoint: 127.0.0.1:8080
|
||||
// captureMode: NONE # not needed if metadata is set for entire proxy
|
||||
// egress:
|
||||
// - port:
|
||||
// number: 3306
|
||||
// protocol: MYSQL
|
||||
// name: egressmysql
|
||||
// captureMode: NONE # not needed if metadata is set for entire proxy
|
||||
// bind: 127.0.0.1
|
||||
// hosts:
|
||||
// - "*/mysql.foo.com"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// And the associated service entry for routing to `mysql.foo.com:3306`
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-mysql
|
||||
// namespace: ns1
|
||||
// spec:
|
||||
// hosts:
|
||||
// - mysql.foo.com
|
||||
// ports:
|
||||
// - number: 3306
|
||||
// name: mysql
|
||||
// protocol: MYSQL
|
||||
// location: MESH_EXTERNAL
|
||||
// resolution: DNS
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-mysql
|
||||
// namespace: ns1
|
||||
// spec:
|
||||
// hosts:
|
||||
// - mysql.foo.com
|
||||
// ports:
|
||||
// - number: 3306
|
||||
// name: mysql
|
||||
// protocol: MYSQL
|
||||
// location: MESH_EXTERNAL
|
||||
// resolution: DNS
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// It is also possible to mix and match traffic capture modes in a single
|
||||
// proxy. For example, consider a setup where internal services are on the
|
||||
// `192.168.0.0/16` subnet. So, IP tables are setup on the VM to capture all
|
||||
// outbound traffic on `192.168.0.0/16` subnet. Assume that the VM has an
|
||||
// additional network interface on `172.16.0.0/16` subnet for inbound
|
||||
// traffic. The following `Sidecar` configuration allows the VM to expose a
|
||||
// listener on `172.16.1.32:80` (the VM's IP) for traffic arriving from the
|
||||
// `172.16.0.0/16` subnet.
|
||||
//
|
||||
// **NOTE**: The `ISTIO_META_INTERCEPTION_MODE` metadata on the
|
||||
// proxy in the VM should contain `REDIRECT` or `TPROXY` as its value,
|
||||
// implying that IP tables based traffic capture is active.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: partial-ip-tables
|
||||
// namespace: prod-us1
|
||||
// spec:
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: productpage
|
||||
// ingress:
|
||||
// - bind: 172.16.1.32
|
||||
// port:
|
||||
// number: 80 # binds to 172.16.1.32:80
|
||||
// protocol: HTTP
|
||||
// name: somename
|
||||
// defaultEndpoint: 127.0.0.1:8080
|
||||
// captureMode: NONE
|
||||
// egress:
|
||||
// # use the system detected defaults
|
||||
// # sets up configuration to handle outbound traffic to services
|
||||
// # in 192.168.0.0/16 subnet, based on information provided by the
|
||||
// # service registry
|
||||
// - captureMode: IPTABLES
|
||||
// hosts:
|
||||
// - "*/*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: partial-ip-tables
|
||||
// namespace: prod-us1
|
||||
// spec:
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: productpage
|
||||
// ingress:
|
||||
// - bind: 172.16.1.32
|
||||
// port:
|
||||
// number: 80 # binds to 172.16.1.32:80
|
||||
// protocol: HTTP
|
||||
// name: somename
|
||||
// defaultEndpoint: 127.0.0.1:8080
|
||||
// captureMode: NONE
|
||||
// egress:
|
||||
// # use the system detected defaults
|
||||
// # sets up configuration to handle outbound traffic to services
|
||||
// # in 192.168.0.0/16 subnet, based on information provided by the
|
||||
// # service registry
|
||||
// - captureMode: IPTABLES
|
||||
// hosts:
|
||||
// - "*/*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
|
||||
package v1beta1
|
||||
|
||||
import (
|
||||
fmt "fmt"
|
||||
proto "github.com/gogo/protobuf/proto"
|
||||
_ "istio.io/gogo-genproto/googleapis/google/api"
|
||||
math "math"
|
||||
)
|
||||
|
||||
// Reference imports to suppress errors if they are not otherwise used.
|
||||
var _ = proto.Marshal
|
||||
var _ = fmt.Errorf
|
||||
var _ = math.Inf
|
||||
|
||||
// DeepCopyInto supports using Sidecar within kubernetes types, where deepcopy-gen is used.
|
||||
func (in *Sidecar) DeepCopyInto(out *Sidecar) {
|
||||
p := proto.Clone(in).(*Sidecar)
|
||||
*out = *p
|
||||
}
|
||||
467
vendor/istio.io/api/networking/v1beta1/sidecar_json.gen.go
generated
vendored
Normal file
467
vendor/istio.io/api/networking/v1beta1/sidecar_json.gen.go
generated
vendored
Normal file
@@ -0,0 +1,467 @@
|
||||
// Code generated by protoc-gen-gogo. DO NOT EDIT.
|
||||
// source: networking/v1beta1/sidecar.proto
|
||||
|
||||
// `Sidecar` describes the configuration of the sidecar proxy that mediates
|
||||
// inbound and outbound communication to the workload instance it is attached to. By
|
||||
// default, Istio will program all sidecar proxies in the mesh with the
|
||||
// necessary configuration required to reach every workload instance in the mesh, as
|
||||
// well as accept traffic on all the ports associated with the
|
||||
// workload. The `Sidecar` configuration provides a way to fine tune the set of
|
||||
// ports, protocols that the proxy will accept when forwarding traffic to
|
||||
// and from the workload. In addition, it is possible to restrict the set
|
||||
// of services that the proxy can reach when forwarding outbound traffic
|
||||
// from workload instances.
|
||||
//
|
||||
// Services and configuration in a mesh are organized into one or more
|
||||
// namespaces (e.g., a Kubernetes namespace or a CF org/space). A `Sidecar`
|
||||
// configuration in a namespace will apply to one or more workload instances in the same
|
||||
// namespace, selected using the `workloadSelector` field. In the absence of a
|
||||
// `workloadSelector`, it will apply to all workload instances in the same
|
||||
// namespace. When determining the `Sidecar` configuration to be applied to a
|
||||
// workload instance, preference will be given to the resource with a
|
||||
// `workloadSelector` that selects this workload instance, over a `Sidecar` configuration
|
||||
// without any `workloadSelector`.
|
||||
//
|
||||
// **NOTE 1**: *_Each namespace can have only one `Sidecar`
|
||||
// configuration without any `workloadSelector`_ that specifies the
|
||||
// default for all pods in that namespace*. It is recommended to use
|
||||
// the name `default` for the namespace-wide sidecar. The behavior of
|
||||
// the system is undefined if more than one selector-less `Sidecar`
|
||||
// configurations exist in a given namespace. The behavior of the
|
||||
// system is undefined if two or more `Sidecar` configurations with a
|
||||
// `workloadSelector` select the same workload instance.
|
||||
//
|
||||
// **NOTE 2**: *_A `Sidecar` configuration in the `MeshConfig`
|
||||
// [root namespace](https://istio.io/docs/reference/config/istio.mesh.v1alpha1/#MeshConfig)
|
||||
// will be applied by default to all namespaces without a `Sidecar`
|
||||
// configuration_*. This global default `Sidecar` configuration should not have
|
||||
// any `workloadSelector`.
|
||||
//
|
||||
// The example below declares a global default `Sidecar` configuration
|
||||
// in the root namespace called `istio-config`, that configures
|
||||
// sidecars in all namespaces to allow egress traffic only to other
|
||||
// workloads in the same namespace as well as to services in the
|
||||
// `istio-system` namespace.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: default
|
||||
// namespace: istio-config
|
||||
// spec:
|
||||
// egress:
|
||||
// - hosts:
|
||||
// - "./*"
|
||||
// - "istio-system/*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: default
|
||||
// namespace: istio-config
|
||||
// spec:
|
||||
// egress:
|
||||
// - hosts:
|
||||
// - "./*"
|
||||
// - "istio-system/*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The example below declares a `Sidecar` configuration in the
|
||||
// `prod-us1` namespace that overrides the global default defined
|
||||
// above, and configures the sidecars in the namespace to allow egress
|
||||
// traffic to public services in the `prod-us1`, `prod-apis`, and the
|
||||
// `istio-system` namespaces.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: default
|
||||
// namespace: prod-us1
|
||||
// spec:
|
||||
// egress:
|
||||
// - hosts:
|
||||
// - "prod-us1/*"
|
||||
// - "prod-apis/*"
|
||||
// - "istio-system/*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: default
|
||||
// namespace: prod-us1
|
||||
// spec:
|
||||
// egress:
|
||||
// - hosts:
|
||||
// - "prod-us1/*"
|
||||
// - "prod-apis/*"
|
||||
// - "istio-system/*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// The following example declares a `Sidecar` configuration in the
|
||||
// `prod-us1` namespace for all pods with labels `app: ratings`
|
||||
// belonging to the `ratings.prod-us1` service. The workload accepts
|
||||
// inbound HTTP traffic on port 9080. The traffic is then forwarded to
|
||||
// the attached workload instance listening on a Unix domain
|
||||
// socket. In the egress direction, in addition to the `istio-system`
|
||||
// namespace, the sidecar proxies only HTTP traffic bound for port
|
||||
// 9080 for services in the `prod-us1` namespace.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: ratings
|
||||
// namespace: prod-us1
|
||||
// spec:
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: ratings
|
||||
// ingress:
|
||||
// - port:
|
||||
// number: 9080
|
||||
// protocol: HTTP
|
||||
// name: somename
|
||||
// defaultEndpoint: unix:///var/run/someuds.sock
|
||||
// egress:
|
||||
// - port:
|
||||
// number: 9080
|
||||
// protocol: HTTP
|
||||
// name: egresshttp
|
||||
// hosts:
|
||||
// - "prod-us1/*"
|
||||
// - hosts:
|
||||
// - "istio-system/*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: ratings
|
||||
// namespace: prod-us1
|
||||
// spec:
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: ratings
|
||||
// ingress:
|
||||
// - port:
|
||||
// number: 9080
|
||||
// protocol: HTTP
|
||||
// name: somename
|
||||
// defaultEndpoint: unix:///var/run/someuds.sock
|
||||
// egress:
|
||||
// - port:
|
||||
// number: 9080
|
||||
// protocol: HTTP
|
||||
// name: egresshttp
|
||||
// hosts:
|
||||
// - "prod-us1/*"
|
||||
// - hosts:
|
||||
// - "istio-system/*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// If the workload is deployed without IPTables-based traffic capture,
|
||||
// the `Sidecar` configuration is the only way to configure the ports
|
||||
// on the proxy attached to the workload instance. The following
|
||||
// example declares a `Sidecar` configuration in the `prod-us1`
|
||||
// namespace for all pods with labels `app: productpage` belonging to
|
||||
// the `productpage.prod-us1` service. Assuming that these pods are
|
||||
// deployed without IPtable rules (i.e. the `istio-init` container)
|
||||
// and the proxy metadata `ISTIO_META_INTERCEPTION_MODE` is set to
|
||||
// `NONE`, the specification, below, allows such pods to receive HTTP
|
||||
// traffic on port 9080 (wrapped inside Istio mutual TLS) and forward
|
||||
// it to the application listening on `127.0.0.1:8080`. It also allows
|
||||
// the application to communicate with a backing MySQL database on
|
||||
// `127.0.0.1:3306`, that then gets proxied to the externally hosted
|
||||
// MySQL service at `mysql.foo.com:3306`.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: no-ip-tables
|
||||
// namespace: prod-us1
|
||||
// spec:
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: productpage
|
||||
// ingress:
|
||||
// - port:
|
||||
// number: 9080 # binds to proxy_instance_ip:9080 (0.0.0.0:9080, if no unicast IP is available for the instance)
|
||||
// protocol: HTTP
|
||||
// name: somename
|
||||
// defaultEndpoint: 127.0.0.1:8080
|
||||
// captureMode: NONE # not needed if metadata is set for entire proxy
|
||||
// egress:
|
||||
// - port:
|
||||
// number: 3306
|
||||
// protocol: MYSQL
|
||||
// name: egressmysql
|
||||
// captureMode: NONE # not needed if metadata is set for entire proxy
|
||||
// bind: 127.0.0.1
|
||||
// hosts:
|
||||
// - "*/mysql.foo.com"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: no-ip-tables
|
||||
// namespace: prod-us1
|
||||
// spec:
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: productpage
|
||||
// ingress:
|
||||
// - port:
|
||||
// number: 9080 # binds to proxy_instance_ip:9080 (0.0.0.0:9080, if no unicast IP is available for the instance)
|
||||
// protocol: HTTP
|
||||
// name: somename
|
||||
// defaultEndpoint: 127.0.0.1:8080
|
||||
// captureMode: NONE # not needed if metadata is set for entire proxy
|
||||
// egress:
|
||||
// - port:
|
||||
// number: 3306
|
||||
// protocol: MYSQL
|
||||
// name: egressmysql
|
||||
// captureMode: NONE # not needed if metadata is set for entire proxy
|
||||
// bind: 127.0.0.1
|
||||
// hosts:
|
||||
// - "*/mysql.foo.com"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// And the associated service entry for routing to `mysql.foo.com:3306`
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-mysql
|
||||
// namespace: ns1
|
||||
// spec:
|
||||
// hosts:
|
||||
// - mysql.foo.com
|
||||
// ports:
|
||||
// - number: 3306
|
||||
// name: mysql
|
||||
// protocol: MYSQL
|
||||
// location: MESH_EXTERNAL
|
||||
// resolution: DNS
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: external-svc-mysql
|
||||
// namespace: ns1
|
||||
// spec:
|
||||
// hosts:
|
||||
// - mysql.foo.com
|
||||
// ports:
|
||||
// - number: 3306
|
||||
// name: mysql
|
||||
// protocol: MYSQL
|
||||
// location: MESH_EXTERNAL
|
||||
// resolution: DNS
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// It is also possible to mix and match traffic capture modes in a single
|
||||
// proxy. For example, consider a setup where internal services are on the
|
||||
// `192.168.0.0/16` subnet. So, IP tables are setup on the VM to capture all
|
||||
// outbound traffic on `192.168.0.0/16` subnet. Assume that the VM has an
|
||||
// additional network interface on `172.16.0.0/16` subnet for inbound
|
||||
// traffic. The following `Sidecar` configuration allows the VM to expose a
|
||||
// listener on `172.16.1.32:80` (the VM's IP) for traffic arriving from the
|
||||
// `172.16.0.0/16` subnet.
|
||||
//
|
||||
// **NOTE**: The `ISTIO_META_INTERCEPTION_MODE` metadata on the
|
||||
// proxy in the VM should contain `REDIRECT` or `TPROXY` as its value,
|
||||
// implying that IP tables based traffic capture is active.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: partial-ip-tables
|
||||
// namespace: prod-us1
|
||||
// spec:
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: productpage
|
||||
// ingress:
|
||||
// - bind: 172.16.1.32
|
||||
// port:
|
||||
// number: 80 # binds to 172.16.1.32:80
|
||||
// protocol: HTTP
|
||||
// name: somename
|
||||
// defaultEndpoint: 127.0.0.1:8080
|
||||
// captureMode: NONE
|
||||
// egress:
|
||||
// # use the system detected defaults
|
||||
// # sets up configuration to handle outbound traffic to services
|
||||
// # in 192.168.0.0/16 subnet, based on information provided by the
|
||||
// # service registry
|
||||
// - captureMode: IPTABLES
|
||||
// hosts:
|
||||
// - "*/*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: Sidecar
|
||||
// metadata:
|
||||
// name: partial-ip-tables
|
||||
// namespace: prod-us1
|
||||
// spec:
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: productpage
|
||||
// ingress:
|
||||
// - bind: 172.16.1.32
|
||||
// port:
|
||||
// number: 80 # binds to 172.16.1.32:80
|
||||
// protocol: HTTP
|
||||
// name: somename
|
||||
// defaultEndpoint: 127.0.0.1:8080
|
||||
// captureMode: NONE
|
||||
// egress:
|
||||
// # use the system detected defaults
|
||||
// # sets up configuration to handle outbound traffic to services
|
||||
// # in 192.168.0.0/16 subnet, based on information provided by the
|
||||
// # service registry
|
||||
// - captureMode: IPTABLES
|
||||
// hosts:
|
||||
// - "*/*"
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
|
||||
package v1beta1
|
||||
|
||||
import (
|
||||
bytes "bytes"
|
||||
fmt "fmt"
|
||||
github_com_gogo_protobuf_jsonpb "github.com/gogo/protobuf/jsonpb"
|
||||
proto "github.com/gogo/protobuf/proto"
|
||||
_ "istio.io/gogo-genproto/googleapis/google/api"
|
||||
math "math"
|
||||
)
|
||||
|
||||
// Reference imports to suppress errors if they are not otherwise used.
|
||||
var _ = proto.Marshal
|
||||
var _ = fmt.Errorf
|
||||
var _ = math.Inf
|
||||
|
||||
// MarshalJSON is a custom marshaler for Sidecar
|
||||
func (this *Sidecar) MarshalJSON() ([]byte, error) {
|
||||
str, err := SidecarMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for Sidecar
|
||||
func (this *Sidecar) UnmarshalJSON(b []byte) error {
|
||||
return SidecarUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for IstioIngressListener
|
||||
func (this *IstioIngressListener) MarshalJSON() ([]byte, error) {
|
||||
str, err := SidecarMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for IstioIngressListener
|
||||
func (this *IstioIngressListener) UnmarshalJSON(b []byte) error {
|
||||
return SidecarUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for IstioEgressListener
|
||||
func (this *IstioEgressListener) MarshalJSON() ([]byte, error) {
|
||||
str, err := SidecarMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for IstioEgressListener
|
||||
func (this *IstioEgressListener) UnmarshalJSON(b []byte) error {
|
||||
return SidecarUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for WorkloadSelector
|
||||
func (this *WorkloadSelector) MarshalJSON() ([]byte, error) {
|
||||
str, err := SidecarMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for WorkloadSelector
|
||||
func (this *WorkloadSelector) UnmarshalJSON(b []byte) error {
|
||||
return SidecarUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for OutboundTrafficPolicy
|
||||
func (this *OutboundTrafficPolicy) MarshalJSON() ([]byte, error) {
|
||||
str, err := SidecarMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for OutboundTrafficPolicy
|
||||
func (this *OutboundTrafficPolicy) UnmarshalJSON(b []byte) error {
|
||||
return SidecarUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for Localhost
|
||||
func (this *Localhost) MarshalJSON() ([]byte, error) {
|
||||
str, err := SidecarMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for Localhost
|
||||
func (this *Localhost) UnmarshalJSON(b []byte) error {
|
||||
return SidecarUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
var (
|
||||
SidecarMarshaler = &github_com_gogo_protobuf_jsonpb.Marshaler{}
|
||||
SidecarUnmarshaler = &github_com_gogo_protobuf_jsonpb.Unmarshaler{}
|
||||
)
|
||||
818
vendor/istio.io/api/networking/v1beta1/virtual_service.gen.json
generated
vendored
Normal file
818
vendor/istio.io/api/networking/v1beta1/virtual_service.gen.json
generated
vendored
Normal file
@@ -0,0 +1,818 @@
|
||||
{
|
||||
"openapi": "3.0.0",
|
||||
"info": {
|
||||
"title": "Configuration affecting label/content routing, sni routing, etc.",
|
||||
"version": "v1beta1"
|
||||
},
|
||||
"components": {
|
||||
"schemas": {
|
||||
"istio.networking.v1beta1.PortSelector": {
|
||||
"description": "PortSelector specifies the number of a port to be used for matching or selection for final routing.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"number": {
|
||||
"description": "Valid port number",
|
||||
"type": "integer"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.Destination": {
|
||||
"description": "Destination indicates the network addressable service to which the request/connection will be sent after processing a routing rule. The destination.host should unambiguously refer to a service in the service registry. Istio's service registry is composed of all the services found in the platform's service registry (e.g., Kubernetes services, Consul services), as well as services declared through the [ServiceEntry](https://istio.io/docs/reference/config/networking/service-entry/#ServiceEntry) resource.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"host": {
|
||||
"description": "The name of a service from the service registry. Service names are looked up from the platform's service registry (e.g., Kubernetes services, Consul services, etc.) and from the hosts declared by [ServiceEntry](https://istio.io/docs/reference/config/networking/service-entry/#ServiceEntry). Traffic forwarded to destinations that are not found in either of the two, will be dropped.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"port": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.PortSelector"
|
||||
},
|
||||
"subset": {
|
||||
"description": "The name of a subset within the service. Applicable only to services within the mesh. The subset must be defined in a corresponding DestinationRule.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.VirtualService": {
|
||||
"description": "Configuration affecting traffic routing.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"exportTo": {
|
||||
"description": "A list of namespaces to which this virtual service is exported. Exporting a virtual service allows it to be used by sidecars and gateways defined in other namespaces. This feature provides a mechanism for service owners and mesh administrators to control the visibility of virtual services across namespace boundaries.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"tls": {
|
||||
"description": "An ordered list of route rule for non-terminated TLS \u0026 HTTPS traffic. Routing is typically performed using the SNI value presented by the ClientHello message. TLS routes will be applied to platform service ports named 'https-*', 'tls-*', unterminated gateway ports using HTTPS/TLS protocols (i.e. with \"passthrough\" TLS mode) and service entry ports using HTTPS/TLS protocols. The first rule matching an incoming request is used. NOTE: Traffic 'https-*' or 'tls-*' ports without associated virtual service will be treated as opaque TCP traffic.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.TLSRoute"
|
||||
}
|
||||
},
|
||||
"tcp": {
|
||||
"description": "An ordered list of route rules for opaque TCP traffic. TCP routes will be applied to any port that is not a HTTP or TLS port. The first rule matching an incoming request is used.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.TCPRoute"
|
||||
}
|
||||
},
|
||||
"http": {
|
||||
"description": "An ordered list of route rules for HTTP traffic. HTTP routes will be applied to platform service ports named 'http-*'/'http2-*'/'grpc-*', gateway ports with protocol HTTP/HTTP2/GRPC/ TLS-terminated-HTTPS and service entry ports using HTTP/HTTP2/GRPC protocols. The first rule matching an incoming request is used.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.HTTPRoute"
|
||||
}
|
||||
},
|
||||
"hosts": {
|
||||
"description": "The destination hosts to which traffic is being sent. Could be a DNS name with wildcard prefix or an IP address. Depending on the platform, short-names can also be used instead of a FQDN (i.e. has no dots in the name). In such a scenario, the FQDN of the host would be derived based on the underlying platform.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"gateways": {
|
||||
"description": "The names of gateways and sidecars that should apply these routes. Gateways in other namespaces may be referred to by `\u003cgateway namespace\u003e/\u003cgateway name\u003e`; specifying a gateway with no namespace qualifier is the same as specifying the VirtualService's namespace. A single VirtualService is used for sidecars inside the mesh as well as for one or more gateways. The selection condition imposed by this field can be overridden using the source field in the match conditions of protocol-specific routes. The reserved word `mesh` is used to imply all the sidecars in the mesh. When this field is omitted, the default gateway (`mesh`) will be used, which would apply the rule to all sidecars in the mesh. If a list of gateway names is provided, the rules will apply only to the gateways. To apply the rules to both gateways and sidecars, specify `mesh` as one of the gateway names.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.HTTPRoute": {
|
||||
"description": "Describes match conditions and actions for routing HTTP/1.1, HTTP2, and gRPC traffic. See VirtualService for usage examples.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "The name assigned to the route for debugging purposes. The route's name will be concatenated with the match's name and will be logged in the access logs for requests matching this route/match.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"match": {
|
||||
"description": "Match conditions to be satisfied for the rule to be activated. All conditions inside a single match block have AND semantics, while the list of match blocks have OR semantics. The rule is matched if any one of the match blocks succeed.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.HTTPMatchRequest"
|
||||
}
|
||||
},
|
||||
"route": {
|
||||
"description": "A HTTP rule can either redirect or forward (default) traffic. The forwarding target can be one of several versions of a service (see glossary in beginning of document). Weights associated with the service version determine the proportion of traffic it receives.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.HTTPRouteDestination"
|
||||
}
|
||||
},
|
||||
"redirect": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.HTTPRedirect"
|
||||
},
|
||||
"delegate": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.Delegate"
|
||||
},
|
||||
"rewrite": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.HTTPRewrite"
|
||||
},
|
||||
"timeout": {
|
||||
"description": "Timeout for HTTP requests.",
|
||||
"type": "string"
|
||||
},
|
||||
"retries": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.HTTPRetry"
|
||||
},
|
||||
"fault": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.HTTPFaultInjection"
|
||||
},
|
||||
"mirror": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.Destination"
|
||||
},
|
||||
"mirrorPercent": {
|
||||
"description": "Percentage of the traffic to be mirrored by the `mirror` field. Use of integer `mirror_percent` value is deprecated. Use the double `mirror_percentage` field instead",
|
||||
"type": "integer",
|
||||
"deprecated": true,
|
||||
"nullable": true
|
||||
},
|
||||
"mirrorPercentage": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.Percent"
|
||||
},
|
||||
"corsPolicy": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.CorsPolicy"
|
||||
},
|
||||
"headers": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.Headers"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.TLSRoute": {
|
||||
"description": "Describes match conditions and actions for routing unterminated TLS traffic (TLS/HTTPS) The following routing rule forwards unterminated TLS traffic arriving at port 443 of gateway called \"mygateway\" to internal services in the mesh based on the SNI value.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"match": {
|
||||
"description": "Match conditions to be satisfied for the rule to be activated. All conditions inside a single match block have AND semantics, while the list of match blocks have OR semantics. The rule is matched if any one of the match blocks succeed.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.TLSMatchAttributes"
|
||||
}
|
||||
},
|
||||
"route": {
|
||||
"description": "The destination to which the connection should be forwarded to.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.RouteDestination"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.TCPRoute": {
|
||||
"description": "Describes match conditions and actions for routing TCP traffic. The following routing rule forwards traffic arriving at port 27017 for mongo.prod.svc.cluster.local to another Mongo server on port 5555.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"match": {
|
||||
"description": "Match conditions to be satisfied for the rule to be activated. All conditions inside a single match block have AND semantics, while the list of match blocks have OR semantics. The rule is matched if any one of the match blocks succeed.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.L4MatchAttributes"
|
||||
}
|
||||
},
|
||||
"route": {
|
||||
"description": "The destination to which the connection should be forwarded to.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.RouteDestination"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.HTTPMatchRequest": {
|
||||
"description": "HttpMatchRequest specifies a set of criterion to be met in order for the rule to be applied to the HTTP request. For example, the following restricts the rule to match only requests where the URL path starts with /ratings/v2/ and the request contains a custom `end-user` header with value `jason`.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "The name assigned to a match. The match's name will be concatenated with the parent route's name and will be logged in the access logs for requests matching this route.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"method": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.StringMatch"
|
||||
},
|
||||
"port": {
|
||||
"description": "Specifies the ports on the host that is being addressed. Many services only expose a single port or label ports with the protocols they support, in these cases it is not required to explicitly select the port.",
|
||||
"type": "integer"
|
||||
},
|
||||
"gateways": {
|
||||
"description": "Names of gateways where the rule should be applied. Gateway names in the top-level `gateways` field of the VirtualService (if any) are overridden. The gateway match is independent of sourceLabels.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"headers": {
|
||||
"description": "The header keys must be lowercase and use hyphen as the separator, e.g. _x-request-id_.",
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.StringMatch"
|
||||
}
|
||||
},
|
||||
"uri": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.StringMatch"
|
||||
},
|
||||
"scheme": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.StringMatch"
|
||||
},
|
||||
"authority": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.StringMatch"
|
||||
},
|
||||
"sourceLabels": {
|
||||
"description": "One or more labels that constrain the applicability of a rule to workloads with the given labels. If the VirtualService has a list of gateways specified in the top-level `gateways` field, it must include the reserved gateway `mesh` for this field to be applicable.",
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"queryParams": {
|
||||
"description": "Query parameters for matching.",
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.StringMatch"
|
||||
}
|
||||
},
|
||||
"ignoreUriCase": {
|
||||
"description": "Flag to specify whether the URI matching should be case-insensitive.",
|
||||
"type": "boolean"
|
||||
},
|
||||
"withoutHeaders": {
|
||||
"description": "withoutHeader has the same syntax with the header, but has opposite meaning. If a header is matched with a matching rule among withoutHeader, the traffic becomes not matched one.",
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.StringMatch"
|
||||
}
|
||||
},
|
||||
"sourceNamespace": {
|
||||
"description": "Source namespace constraining the applicability of a rule to workloads in that namespace. If the VirtualService has a list of gateways specified in the top-level `gateways` field, it must include the reserved gateway `mesh` for this field to be applicable.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.HTTPRouteDestination": {
|
||||
"description": "Each routing rule is associated with one or more service versions (see glossary in beginning of document). Weights associated with the version determine the proportion of traffic it receives. For example, the following rule will route 25% of traffic for the \"reviews\" service to instances with the \"v2\" tag and the remaining traffic (i.e., 75%) to \"v1\".",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"headers": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.Headers"
|
||||
},
|
||||
"destination": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.Destination"
|
||||
},
|
||||
"weight": {
|
||||
"description": "The proportion of traffic to be forwarded to the service version. (0-100). Sum of weights across destinations SHOULD BE == 100. If there is only one destination in a rule, the weight value is assumed to be 100.",
|
||||
"type": "integer",
|
||||
"format": "int32"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.HTTPRedirect": {
|
||||
"description": "HTTPRedirect can be used to send a 301 redirect response to the caller, where the Authority/Host and the URI in the response can be swapped with the specified values. For example, the following rule redirects requests for /v1/getProductRatings API on the ratings service to /v1/bookRatings provided by the bookratings service.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"uri": {
|
||||
"description": "On a redirect, overwrite the Path portion of the URL with this value. Note that the entire path will be replaced, irrespective of the request URI being matched as an exact path or prefix.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"authority": {
|
||||
"description": "On a redirect, overwrite the Authority/Host portion of the URL with this value.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"redirectCode": {
|
||||
"description": "On a redirect, Specifies the HTTP status code to use in the redirect response. The default response code is MOVED_PERMANENTLY (301).",
|
||||
"type": "integer"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.Delegate": {
|
||||
"description": "Describes the delegate VirtualService. The following routing rules forward the traffic to `/productpage` by a delegate VirtualService named `productpage`, forward the traffic to `/reviews` by a delegate VirtualService named `reviews`.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"name": {
|
||||
"description": "Name specifies the name of the delegate VirtualService.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"namespace": {
|
||||
"description": "Namespace specifies the namespace where the delegate VirtualService resides. By default, it is same to the root's.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.HTTPRewrite": {
|
||||
"description": "HTTPRewrite can be used to rewrite specific parts of a HTTP request before forwarding the request to the destination. Rewrite primitive can be used only with HTTPRouteDestination. The following example demonstrates how to rewrite the URL prefix for api call (/ratings) to ratings service before making the actual API call.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"uri": {
|
||||
"description": "rewrite the path (or the prefix) portion of the URI with this value. If the original URI was matched based on prefix, the value provided in this field will replace the corresponding matched prefix.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"authority": {
|
||||
"description": "rewrite the Authority/Host header with this value.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.HTTPRetry": {
|
||||
"description": "Describes the retry policy to use when a HTTP request fails. For example, the following rule sets the maximum number of retries to 3 when calling ratings:v1 service, with a 2s timeout per retry attempt.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"attempts": {
|
||||
"description": "Number of retries for a given request. The interval between retries will be determined automatically (25ms+). Actual number of retries attempted depends on the request `timeout` of the [HTTP route](https://istio.io/docs/reference/config/networking/virtual-service/#HTTPRoute).",
|
||||
"type": "integer",
|
||||
"format": "int32"
|
||||
},
|
||||
"perTryTimeout": {
|
||||
"description": "Timeout per retry attempt for a given request. format: 1h/1m/1s/1ms. MUST BE \u003e=1ms.",
|
||||
"type": "string"
|
||||
},
|
||||
"retryOn": {
|
||||
"description": "Specifies the conditions under which retry takes place. One or more policies can be specified using a ‘,’ delimited list. See the [retry policies](https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#x-envoy-retry-on) and [gRPC retry policies](https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#x-envoy-retry-grpc-on) for more details.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"retryRemoteLocalities": {
|
||||
"description": "Flag to specify whether the retries should retry to other localities. See the [retry plugin configuration](https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/http/http_connection_management#retry-plugin-configuration) for more details.",
|
||||
"type": "boolean",
|
||||
"nullable": true
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.HTTPFaultInjection": {
|
||||
"description": "HTTPFaultInjection can be used to specify one or more faults to inject while forwarding HTTP requests to the destination specified in a route. Fault specification is part of a VirtualService rule. Faults include aborting the Http request from downstream service, and/or delaying proxying of requests. A fault rule MUST HAVE delay or abort or both.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"delay": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.HTTPFaultInjection.Delay"
|
||||
},
|
||||
"abort": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.HTTPFaultInjection.Abort"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.Percent": {
|
||||
"description": "Percent specifies a percentage in the range of [0.0, 100.0].",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"value": {
|
||||
"type": "number",
|
||||
"format": "double"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.CorsPolicy": {
|
||||
"description": "Describes the Cross-Origin Resource Sharing (CORS) policy, for a given service. Refer to [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS) for further details about cross origin resource sharing. For example, the following rule restricts cross origin requests to those originating from example.com domain using HTTP POST/GET, and sets the `Access-Control-Allow-Credentials` header to false. In addition, it only exposes `X-Foo-bar` header and sets an expiry period of 1 day.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"allowOrigin": {
|
||||
"description": "The list of origins that are allowed to perform CORS requests. The content will be serialized into the Access-Control-Allow-Origin header. Wildcard * will allow all origins. $hide_from_docs",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"deprecated": true
|
||||
},
|
||||
"allowOrigins": {
|
||||
"description": "String patterns that match allowed origins. An origin is allowed if any of the string matchers match. If a match is found, then the outgoing Access-Control-Allow-Origin would be set to the origin as provided by the client.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.StringMatch"
|
||||
}
|
||||
},
|
||||
"allowMethods": {
|
||||
"description": "List of HTTP methods allowed to access the resource. The content will be serialized into the Access-Control-Allow-Methods header.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"allowHeaders": {
|
||||
"description": "List of HTTP headers that can be used when requesting the resource. Serialized to Access-Control-Allow-Headers header.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"exposeHeaders": {
|
||||
"description": "A white list of HTTP headers that the browsers are allowed to access. Serialized into Access-Control-Expose-Headers header.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"maxAge": {
|
||||
"description": "Specifies how long the results of a preflight request can be cached. Translates to the `Access-Control-Max-Age` header.",
|
||||
"type": "string"
|
||||
},
|
||||
"allowCredentials": {
|
||||
"description": "Indicates whether the caller is allowed to send the actual request (not the preflight) using credentials. Translates to `Access-Control-Allow-Credentials` header.",
|
||||
"type": "boolean",
|
||||
"nullable": true
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.Headers": {
|
||||
"description": "Message headers can be manipulated when Envoy forwards requests to, or responses from, a destination service. Header manipulation rules can be specified for a specific route destination or for all destinations. The following VirtualService adds a `test` header with the value `true` to requests that are routed to any `reviews` service destination. It also romoves the `foo` response header, but only from responses coming from the `v1` subset (version) of the `reviews` service.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"response": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.Headers.HeaderOperations"
|
||||
},
|
||||
"request": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.Headers.HeaderOperations"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.Headers.HeaderOperations": {
|
||||
"description": "HeaderOperations Describes the header manipulations to apply",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"set": {
|
||||
"description": "Overwrite the headers specified by key with the given values",
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"add": {
|
||||
"description": "Append the given values to the headers specified by keys (will create a comma-separated list of values)",
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"remove": {
|
||||
"description": "Remove a the specified headers",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.TLSMatchAttributes": {
|
||||
"description": "TLS connection match attributes.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"port": {
|
||||
"description": "Specifies the port on the host that is being addressed. Many services only expose a single port or label ports with the protocols they support, in these cases it is not required to explicitly select the port.",
|
||||
"type": "integer"
|
||||
},
|
||||
"gateways": {
|
||||
"description": "Names of gateways where the rule should be applied. Gateway names in the top-level `gateways` field of the VirtualService (if any) are overridden. The gateway match is independent of sourceLabels.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"sourceLabels": {
|
||||
"description": "One or more labels that constrain the applicability of a rule to workloads with the given labels. If the VirtualService has a list of gateways specified in the top-level `gateways` field, it should include the reserved gateway `mesh` in order for this field to be applicable.",
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"sourceNamespace": {
|
||||
"description": "Source namespace constraining the applicability of a rule to workloads in that namespace. If the VirtualService has a list of gateways specified in the top-level `gateways` field, it must include the reserved gateway `mesh` for this field to be applicable.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"destinationSubnets": {
|
||||
"description": "IPv4 or IPv6 ip addresses of destination with optional subnet. E.g., a.b.c.d/xx form or just a.b.c.d.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"sniHosts": {
|
||||
"description": "SNI (server name indicator) to match on. Wildcard prefixes can be used in the SNI value, e.g., *.com will match foo.example.com as well as example.com. An SNI value must be a subset (i.e., fall within the domain) of the corresponding virtual serivce's hosts.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.RouteDestination": {
|
||||
"description": "L4 routing rule weighted destination.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"destination": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.Destination"
|
||||
},
|
||||
"weight": {
|
||||
"description": "The proportion of traffic to be forwarded to the service version. If there is only one destination in a rule, all traffic will be routed to it irrespective of the weight.",
|
||||
"type": "integer",
|
||||
"format": "int32"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.L4MatchAttributes": {
|
||||
"description": "L4 connection match attributes. Note that L4 connection matching support is incomplete.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"port": {
|
||||
"description": "Specifies the port on the host that is being addressed. Many services only expose a single port or label ports with the protocols they support, in these cases it is not required to explicitly select the port.",
|
||||
"type": "integer"
|
||||
},
|
||||
"gateways": {
|
||||
"description": "Names of gateways where the rule should be applied. Gateway names in the top-level `gateways` field of the VirtualService (if any) are overridden. The gateway match is independent of sourceLabels.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"sourceLabels": {
|
||||
"description": "One or more labels that constrain the applicability of a rule to workloads with the given labels. If the VirtualService has a list of gateways specified in the top-level `gateways` field, it should include the reserved gateway `mesh` in order for this field to be applicable.",
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"sourceNamespace": {
|
||||
"description": "Source namespace constraining the applicability of a rule to workloads in that namespace. If the VirtualService has a list of gateways specified in the top-level `gateways` field, it must include the reserved gateway `mesh` for this field to be applicable.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"destinationSubnets": {
|
||||
"description": "IPv4 or IPv6 ip addresses of destination with optional subnet. E.g., a.b.c.d/xx form or just a.b.c.d.",
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"sourceSubnet": {
|
||||
"description": "IPv4 or IPv6 ip address of source with optional subnet. E.g., a.b.c.d/xx form or just a.b.c.d $hide_from_docs",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
"istio.networking.v1beta1.StringMatch": {
|
||||
"description": "Describes how to match a given string in HTTP headers. Match is case-sensitive.",
|
||||
"type": "object",
|
||||
"oneOf": [
|
||||
{
|
||||
"not": {
|
||||
"anyOf": [
|
||||
{
|
||||
"required": [
|
||||
"exact"
|
||||
],
|
||||
"properties": {
|
||||
"exact": {
|
||||
"description": "exact string match",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"prefix"
|
||||
],
|
||||
"properties": {
|
||||
"prefix": {
|
||||
"description": "prefix-based match",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"regex"
|
||||
],
|
||||
"properties": {
|
||||
"regex": {
|
||||
"description": "RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"exact"
|
||||
],
|
||||
"properties": {
|
||||
"exact": {
|
||||
"description": "exact string match",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"prefix"
|
||||
],
|
||||
"properties": {
|
||||
"prefix": {
|
||||
"description": "prefix-based match",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"regex"
|
||||
],
|
||||
"properties": {
|
||||
"regex": {
|
||||
"description": "RE2 style regex-based match (https://github.com/google/re2/wiki/Syntax).",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"istio.networking.v1beta1.HTTPFaultInjection.Delay": {
|
||||
"description": "Delay specification is used to inject latency into the request forwarding path. The following example will introduce a 5 second delay in 1 out of every 1000 requests to the \"v1\" version of the \"reviews\" service from all pods with label env: prod",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"percent": {
|
||||
"description": "Percentage of requests on which the delay will be injected (0-100). Use of integer `percent` value is deprecated. Use the double `percentage` field instead.",
|
||||
"type": "integer",
|
||||
"format": "int32",
|
||||
"deprecated": true
|
||||
},
|
||||
"percentage": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.Percent"
|
||||
}
|
||||
},
|
||||
"oneOf": [
|
||||
{
|
||||
"not": {
|
||||
"anyOf": [
|
||||
{
|
||||
"required": [
|
||||
"fixedDelay"
|
||||
],
|
||||
"properties": {
|
||||
"fixedDelay": {
|
||||
"description": "Add a fixed delay before forwarding the request. Format: 1h/1m/1s/1ms. MUST be \u003e=1ms.",
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"exponentialDelay"
|
||||
],
|
||||
"properties": {
|
||||
"exponentialDelay": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"fixedDelay"
|
||||
],
|
||||
"properties": {
|
||||
"fixedDelay": {
|
||||
"description": "Add a fixed delay before forwarding the request. Format: 1h/1m/1s/1ms. MUST be \u003e=1ms.",
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"exponentialDelay"
|
||||
],
|
||||
"properties": {
|
||||
"exponentialDelay": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"istio.networking.v1beta1.HTTPFaultInjection.Abort": {
|
||||
"description": "Abort specification is used to prematurely abort a request with a pre-specified error code. The following example will return an HTTP 400 error code for 1 out of every 1000 requests to the \"ratings\" service \"v1\".",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"percentage": {
|
||||
"$ref": "#/components/schemas/istio.networking.v1beta1.Percent"
|
||||
}
|
||||
},
|
||||
"oneOf": [
|
||||
{
|
||||
"not": {
|
||||
"anyOf": [
|
||||
{
|
||||
"required": [
|
||||
"httpStatus"
|
||||
],
|
||||
"properties": {
|
||||
"httpStatus": {
|
||||
"description": "HTTP status code to use to abort the Http request.",
|
||||
"type": "integer",
|
||||
"format": "int32"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"grpcStatus"
|
||||
],
|
||||
"properties": {
|
||||
"grpcStatus": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"http2Error"
|
||||
],
|
||||
"properties": {
|
||||
"http2Error": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"httpStatus"
|
||||
],
|
||||
"properties": {
|
||||
"httpStatus": {
|
||||
"description": "HTTP status code to use to abort the Http request.",
|
||||
"type": "integer",
|
||||
"format": "int32"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"grpcStatus"
|
||||
],
|
||||
"properties": {
|
||||
"grpcStatus": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"required": [
|
||||
"http2Error"
|
||||
],
|
||||
"properties": {
|
||||
"http2Error": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
11186
vendor/istio.io/api/networking/v1beta1/virtual_service.pb.go
generated
vendored
Normal file
11186
vendor/istio.io/api/networking/v1beta1/virtual_service.pb.go
generated
vendored
Normal file
File diff suppressed because it is too large
Load Diff
1838
vendor/istio.io/api/networking/v1beta1/virtual_service.proto
generated
vendored
Normal file
1838
vendor/istio.io/api/networking/v1beta1/virtual_service.proto
generated
vendored
Normal file
File diff suppressed because it is too large
Load Diff
171
vendor/istio.io/api/networking/v1beta1/virtual_service_deepcopy.gen.go
generated
vendored
Normal file
171
vendor/istio.io/api/networking/v1beta1/virtual_service_deepcopy.gen.go
generated
vendored
Normal file
@@ -0,0 +1,171 @@
|
||||
// Code generated by protoc-gen-gogo. DO NOT EDIT.
|
||||
// source: networking/v1beta1/virtual_service.proto
|
||||
|
||||
// Configuration affecting traffic routing. Here are a few terms useful to define
|
||||
// in the context of traffic routing.
|
||||
//
|
||||
// `Service` a unit of application behavior bound to a unique name in a
|
||||
// service registry. Services consist of multiple network *endpoints*
|
||||
// implemented by workload instances running on pods, containers, VMs etc.
|
||||
//
|
||||
// `Service versions (a.k.a. subsets)` - In a continuous deployment
|
||||
// scenario, for a given service, there can be distinct subsets of
|
||||
// instances running different variants of the application binary. These
|
||||
// variants are not necessarily different API versions. They could be
|
||||
// iterative changes to the same service, deployed in different
|
||||
// environments (prod, staging, dev, etc.). Common scenarios where this
|
||||
// occurs include A/B testing, canary rollouts, etc. The choice of a
|
||||
// particular version can be decided based on various criterion (headers,
|
||||
// url, etc.) and/or by weights assigned to each version. Each service has
|
||||
// a default version consisting of all its instances.
|
||||
//
|
||||
// `Source` - A downstream client calling a service.
|
||||
//
|
||||
// `Host` - The address used by a client when attempting to connect to a
|
||||
// service.
|
||||
//
|
||||
// `Access model` - Applications address only the destination service
|
||||
// (Host) without knowledge of individual service versions (subsets). The
|
||||
// actual choice of the version is determined by the proxy/sidecar, enabling the
|
||||
// application code to decouple itself from the evolution of dependent
|
||||
// services.
|
||||
//
|
||||
// A `VirtualService` defines a set of traffic routing rules to apply when a host is
|
||||
// addressed. Each routing rule defines matching criteria for traffic of a specific
|
||||
// protocol. If the traffic is matched, then it is sent to a named destination service
|
||||
// (or subset/version of it) defined in the registry.
|
||||
//
|
||||
// The source of traffic can also be matched in a routing rule. This allows routing
|
||||
// to be customized for specific client contexts.
|
||||
//
|
||||
// The following example on Kubernetes, routes all HTTP traffic by default to
|
||||
// pods of the reviews service with label "version: v1". In addition,
|
||||
// HTTP requests with path starting with /wpcatalog/ or /consumercatalog/ will
|
||||
// be rewritten to /newcatalog and sent to pods with label "version: v2".
|
||||
//
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: VirtualService
|
||||
// metadata:
|
||||
// name: reviews-route
|
||||
// spec:
|
||||
// hosts:
|
||||
// - reviews.prod.svc.cluster.local
|
||||
// http:
|
||||
// - name: "reviews-v2-routes"
|
||||
// match:
|
||||
// - uri:
|
||||
// prefix: "/wpcatalog"
|
||||
// - uri:
|
||||
// prefix: "/consumercatalog"
|
||||
// rewrite:
|
||||
// uri: "/newcatalog"
|
||||
// route:
|
||||
// - destination:
|
||||
// host: reviews.prod.svc.cluster.local
|
||||
// subset: v2
|
||||
// - name: "reviews-v1-route"
|
||||
// route:
|
||||
// - destination:
|
||||
// host: reviews.prod.svc.cluster.local
|
||||
// subset: v1
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: VirtualService
|
||||
// metadata:
|
||||
// name: reviews-route
|
||||
// spec:
|
||||
// hosts:
|
||||
// - reviews.prod.svc.cluster.local
|
||||
// http:
|
||||
// - name: "reviews-v2-routes"
|
||||
// match:
|
||||
// - uri:
|
||||
// prefix: "/wpcatalog"
|
||||
// - uri:
|
||||
// prefix: "/consumercatalog"
|
||||
// rewrite:
|
||||
// uri: "/newcatalog"
|
||||
// route:
|
||||
// - destination:
|
||||
// host: reviews.prod.svc.cluster.local
|
||||
// subset: v2
|
||||
// - name: "reviews-v1-route"
|
||||
// route:
|
||||
// - destination:
|
||||
// host: reviews.prod.svc.cluster.local
|
||||
// subset: v1
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// A subset/version of a route destination is identified with a reference
|
||||
// to a named service subset which must be declared in a corresponding
|
||||
// `DestinationRule`.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: DestinationRule
|
||||
// metadata:
|
||||
// name: reviews-destination
|
||||
// spec:
|
||||
// host: reviews.prod.svc.cluster.local
|
||||
// subsets:
|
||||
// - name: v1
|
||||
// labels:
|
||||
// version: v1
|
||||
// - name: v2
|
||||
// labels:
|
||||
// version: v2
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: DestinationRule
|
||||
// metadata:
|
||||
// name: reviews-destination
|
||||
// spec:
|
||||
// host: reviews.prod.svc.cluster.local
|
||||
// subsets:
|
||||
// - name: v1
|
||||
// labels:
|
||||
// version: v1
|
||||
// - name: v2
|
||||
// labels:
|
||||
// version: v2
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
|
||||
package v1beta1
|
||||
|
||||
import (
|
||||
fmt "fmt"
|
||||
proto "github.com/gogo/protobuf/proto"
|
||||
_ "github.com/gogo/protobuf/types"
|
||||
_ "istio.io/gogo-genproto/googleapis/google/api"
|
||||
math "math"
|
||||
)
|
||||
|
||||
// Reference imports to suppress errors if they are not otherwise used.
|
||||
var _ = proto.Marshal
|
||||
var _ = fmt.Errorf
|
||||
var _ = math.Inf
|
||||
|
||||
// DeepCopyInto supports using VirtualService within kubernetes types, where deepcopy-gen is used.
|
||||
func (in *VirtualService) DeepCopyInto(out *VirtualService) {
|
||||
p := proto.Clone(in).(*VirtualService)
|
||||
*out = *p
|
||||
}
|
||||
425
vendor/istio.io/api/networking/v1beta1/virtual_service_json.gen.go
generated
vendored
Normal file
425
vendor/istio.io/api/networking/v1beta1/virtual_service_json.gen.go
generated
vendored
Normal file
@@ -0,0 +1,425 @@
|
||||
// Code generated by protoc-gen-gogo. DO NOT EDIT.
|
||||
// source: networking/v1beta1/virtual_service.proto
|
||||
|
||||
// Configuration affecting traffic routing. Here are a few terms useful to define
|
||||
// in the context of traffic routing.
|
||||
//
|
||||
// `Service` a unit of application behavior bound to a unique name in a
|
||||
// service registry. Services consist of multiple network *endpoints*
|
||||
// implemented by workload instances running on pods, containers, VMs etc.
|
||||
//
|
||||
// `Service versions (a.k.a. subsets)` - In a continuous deployment
|
||||
// scenario, for a given service, there can be distinct subsets of
|
||||
// instances running different variants of the application binary. These
|
||||
// variants are not necessarily different API versions. They could be
|
||||
// iterative changes to the same service, deployed in different
|
||||
// environments (prod, staging, dev, etc.). Common scenarios where this
|
||||
// occurs include A/B testing, canary rollouts, etc. The choice of a
|
||||
// particular version can be decided based on various criterion (headers,
|
||||
// url, etc.) and/or by weights assigned to each version. Each service has
|
||||
// a default version consisting of all its instances.
|
||||
//
|
||||
// `Source` - A downstream client calling a service.
|
||||
//
|
||||
// `Host` - The address used by a client when attempting to connect to a
|
||||
// service.
|
||||
//
|
||||
// `Access model` - Applications address only the destination service
|
||||
// (Host) without knowledge of individual service versions (subsets). The
|
||||
// actual choice of the version is determined by the proxy/sidecar, enabling the
|
||||
// application code to decouple itself from the evolution of dependent
|
||||
// services.
|
||||
//
|
||||
// A `VirtualService` defines a set of traffic routing rules to apply when a host is
|
||||
// addressed. Each routing rule defines matching criteria for traffic of a specific
|
||||
// protocol. If the traffic is matched, then it is sent to a named destination service
|
||||
// (or subset/version of it) defined in the registry.
|
||||
//
|
||||
// The source of traffic can also be matched in a routing rule. This allows routing
|
||||
// to be customized for specific client contexts.
|
||||
//
|
||||
// The following example on Kubernetes, routes all HTTP traffic by default to
|
||||
// pods of the reviews service with label "version: v1". In addition,
|
||||
// HTTP requests with path starting with /wpcatalog/ or /consumercatalog/ will
|
||||
// be rewritten to /newcatalog and sent to pods with label "version: v2".
|
||||
//
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: VirtualService
|
||||
// metadata:
|
||||
// name: reviews-route
|
||||
// spec:
|
||||
// hosts:
|
||||
// - reviews.prod.svc.cluster.local
|
||||
// http:
|
||||
// - name: "reviews-v2-routes"
|
||||
// match:
|
||||
// - uri:
|
||||
// prefix: "/wpcatalog"
|
||||
// - uri:
|
||||
// prefix: "/consumercatalog"
|
||||
// rewrite:
|
||||
// uri: "/newcatalog"
|
||||
// route:
|
||||
// - destination:
|
||||
// host: reviews.prod.svc.cluster.local
|
||||
// subset: v2
|
||||
// - name: "reviews-v1-route"
|
||||
// route:
|
||||
// - destination:
|
||||
// host: reviews.prod.svc.cluster.local
|
||||
// subset: v1
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: VirtualService
|
||||
// metadata:
|
||||
// name: reviews-route
|
||||
// spec:
|
||||
// hosts:
|
||||
// - reviews.prod.svc.cluster.local
|
||||
// http:
|
||||
// - name: "reviews-v2-routes"
|
||||
// match:
|
||||
// - uri:
|
||||
// prefix: "/wpcatalog"
|
||||
// - uri:
|
||||
// prefix: "/consumercatalog"
|
||||
// rewrite:
|
||||
// uri: "/newcatalog"
|
||||
// route:
|
||||
// - destination:
|
||||
// host: reviews.prod.svc.cluster.local
|
||||
// subset: v2
|
||||
// - name: "reviews-v1-route"
|
||||
// route:
|
||||
// - destination:
|
||||
// host: reviews.prod.svc.cluster.local
|
||||
// subset: v1
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// A subset/version of a route destination is identified with a reference
|
||||
// to a named service subset which must be declared in a corresponding
|
||||
// `DestinationRule`.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: DestinationRule
|
||||
// metadata:
|
||||
// name: reviews-destination
|
||||
// spec:
|
||||
// host: reviews.prod.svc.cluster.local
|
||||
// subsets:
|
||||
// - name: v1
|
||||
// labels:
|
||||
// version: v1
|
||||
// - name: v2
|
||||
// labels:
|
||||
// version: v2
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: DestinationRule
|
||||
// metadata:
|
||||
// name: reviews-destination
|
||||
// spec:
|
||||
// host: reviews.prod.svc.cluster.local
|
||||
// subsets:
|
||||
// - name: v1
|
||||
// labels:
|
||||
// version: v1
|
||||
// - name: v2
|
||||
// labels:
|
||||
// version: v2
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
|
||||
package v1beta1
|
||||
|
||||
import (
|
||||
bytes "bytes"
|
||||
fmt "fmt"
|
||||
github_com_gogo_protobuf_jsonpb "github.com/gogo/protobuf/jsonpb"
|
||||
proto "github.com/gogo/protobuf/proto"
|
||||
_ "github.com/gogo/protobuf/types"
|
||||
_ "istio.io/gogo-genproto/googleapis/google/api"
|
||||
math "math"
|
||||
)
|
||||
|
||||
// Reference imports to suppress errors if they are not otherwise used.
|
||||
var _ = proto.Marshal
|
||||
var _ = fmt.Errorf
|
||||
var _ = math.Inf
|
||||
|
||||
// MarshalJSON is a custom marshaler for VirtualService
|
||||
func (this *VirtualService) MarshalJSON() ([]byte, error) {
|
||||
str, err := VirtualServiceMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for VirtualService
|
||||
func (this *VirtualService) UnmarshalJSON(b []byte) error {
|
||||
return VirtualServiceUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for Destination
|
||||
func (this *Destination) MarshalJSON() ([]byte, error) {
|
||||
str, err := VirtualServiceMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for Destination
|
||||
func (this *Destination) UnmarshalJSON(b []byte) error {
|
||||
return VirtualServiceUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for HTTPRoute
|
||||
func (this *HTTPRoute) MarshalJSON() ([]byte, error) {
|
||||
str, err := VirtualServiceMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for HTTPRoute
|
||||
func (this *HTTPRoute) UnmarshalJSON(b []byte) error {
|
||||
return VirtualServiceUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for Delegate
|
||||
func (this *Delegate) MarshalJSON() ([]byte, error) {
|
||||
str, err := VirtualServiceMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for Delegate
|
||||
func (this *Delegate) UnmarshalJSON(b []byte) error {
|
||||
return VirtualServiceUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for Headers
|
||||
func (this *Headers) MarshalJSON() ([]byte, error) {
|
||||
str, err := VirtualServiceMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for Headers
|
||||
func (this *Headers) UnmarshalJSON(b []byte) error {
|
||||
return VirtualServiceUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for Headers_HeaderOperations
|
||||
func (this *Headers_HeaderOperations) MarshalJSON() ([]byte, error) {
|
||||
str, err := VirtualServiceMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for Headers_HeaderOperations
|
||||
func (this *Headers_HeaderOperations) UnmarshalJSON(b []byte) error {
|
||||
return VirtualServiceUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for TLSRoute
|
||||
func (this *TLSRoute) MarshalJSON() ([]byte, error) {
|
||||
str, err := VirtualServiceMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for TLSRoute
|
||||
func (this *TLSRoute) UnmarshalJSON(b []byte) error {
|
||||
return VirtualServiceUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for TCPRoute
|
||||
func (this *TCPRoute) MarshalJSON() ([]byte, error) {
|
||||
str, err := VirtualServiceMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for TCPRoute
|
||||
func (this *TCPRoute) UnmarshalJSON(b []byte) error {
|
||||
return VirtualServiceUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for HTTPMatchRequest
|
||||
func (this *HTTPMatchRequest) MarshalJSON() ([]byte, error) {
|
||||
str, err := VirtualServiceMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for HTTPMatchRequest
|
||||
func (this *HTTPMatchRequest) UnmarshalJSON(b []byte) error {
|
||||
return VirtualServiceUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for HTTPRouteDestination
|
||||
func (this *HTTPRouteDestination) MarshalJSON() ([]byte, error) {
|
||||
str, err := VirtualServiceMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for HTTPRouteDestination
|
||||
func (this *HTTPRouteDestination) UnmarshalJSON(b []byte) error {
|
||||
return VirtualServiceUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for RouteDestination
|
||||
func (this *RouteDestination) MarshalJSON() ([]byte, error) {
|
||||
str, err := VirtualServiceMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for RouteDestination
|
||||
func (this *RouteDestination) UnmarshalJSON(b []byte) error {
|
||||
return VirtualServiceUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for L4MatchAttributes
|
||||
func (this *L4MatchAttributes) MarshalJSON() ([]byte, error) {
|
||||
str, err := VirtualServiceMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for L4MatchAttributes
|
||||
func (this *L4MatchAttributes) UnmarshalJSON(b []byte) error {
|
||||
return VirtualServiceUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for TLSMatchAttributes
|
||||
func (this *TLSMatchAttributes) MarshalJSON() ([]byte, error) {
|
||||
str, err := VirtualServiceMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for TLSMatchAttributes
|
||||
func (this *TLSMatchAttributes) UnmarshalJSON(b []byte) error {
|
||||
return VirtualServiceUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for HTTPRedirect
|
||||
func (this *HTTPRedirect) MarshalJSON() ([]byte, error) {
|
||||
str, err := VirtualServiceMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for HTTPRedirect
|
||||
func (this *HTTPRedirect) UnmarshalJSON(b []byte) error {
|
||||
return VirtualServiceUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for HTTPRewrite
|
||||
func (this *HTTPRewrite) MarshalJSON() ([]byte, error) {
|
||||
str, err := VirtualServiceMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for HTTPRewrite
|
||||
func (this *HTTPRewrite) UnmarshalJSON(b []byte) error {
|
||||
return VirtualServiceUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for StringMatch
|
||||
func (this *StringMatch) MarshalJSON() ([]byte, error) {
|
||||
str, err := VirtualServiceMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for StringMatch
|
||||
func (this *StringMatch) UnmarshalJSON(b []byte) error {
|
||||
return VirtualServiceUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for HTTPRetry
|
||||
func (this *HTTPRetry) MarshalJSON() ([]byte, error) {
|
||||
str, err := VirtualServiceMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for HTTPRetry
|
||||
func (this *HTTPRetry) UnmarshalJSON(b []byte) error {
|
||||
return VirtualServiceUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for CorsPolicy
|
||||
func (this *CorsPolicy) MarshalJSON() ([]byte, error) {
|
||||
str, err := VirtualServiceMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for CorsPolicy
|
||||
func (this *CorsPolicy) UnmarshalJSON(b []byte) error {
|
||||
return VirtualServiceUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for HTTPFaultInjection
|
||||
func (this *HTTPFaultInjection) MarshalJSON() ([]byte, error) {
|
||||
str, err := VirtualServiceMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for HTTPFaultInjection
|
||||
func (this *HTTPFaultInjection) UnmarshalJSON(b []byte) error {
|
||||
return VirtualServiceUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for HTTPFaultInjection_Delay
|
||||
func (this *HTTPFaultInjection_Delay) MarshalJSON() ([]byte, error) {
|
||||
str, err := VirtualServiceMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for HTTPFaultInjection_Delay
|
||||
func (this *HTTPFaultInjection_Delay) UnmarshalJSON(b []byte) error {
|
||||
return VirtualServiceUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for HTTPFaultInjection_Abort
|
||||
func (this *HTTPFaultInjection_Abort) MarshalJSON() ([]byte, error) {
|
||||
str, err := VirtualServiceMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for HTTPFaultInjection_Abort
|
||||
func (this *HTTPFaultInjection_Abort) UnmarshalJSON(b []byte) error {
|
||||
return VirtualServiceUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for PortSelector
|
||||
func (this *PortSelector) MarshalJSON() ([]byte, error) {
|
||||
str, err := VirtualServiceMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for PortSelector
|
||||
func (this *PortSelector) UnmarshalJSON(b []byte) error {
|
||||
return VirtualServiceUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
// MarshalJSON is a custom marshaler for Percent
|
||||
func (this *Percent) MarshalJSON() ([]byte, error) {
|
||||
str, err := VirtualServiceMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for Percent
|
||||
func (this *Percent) UnmarshalJSON(b []byte) error {
|
||||
return VirtualServiceUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
var (
|
||||
VirtualServiceMarshaler = &github_com_gogo_protobuf_jsonpb.Marshaler{}
|
||||
VirtualServiceUnmarshaler = &github_com_gogo_protobuf_jsonpb.Unmarshaler{}
|
||||
)
|
||||
56
vendor/istio.io/api/networking/v1beta1/workload_entry.gen.json
generated
vendored
Normal file
56
vendor/istio.io/api/networking/v1beta1/workload_entry.gen.json
generated
vendored
Normal file
@@ -0,0 +1,56 @@
|
||||
{
|
||||
"openapi": "3.0.0",
|
||||
"info": {
|
||||
"title": "Configuration affecting VMs onboarded into the mesh.",
|
||||
"version": "v1beta1"
|
||||
},
|
||||
"components": {
|
||||
"schemas": {
|
||||
"istio.networking.v1beta1.WorkloadEntry": {
|
||||
"description": "WorkloadEntry enables specifying the properties of a single non-Kubernetes workload such a VM or a bare metal services that can be referred to by service entries.",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"labels": {
|
||||
"description": "One or more labels associated with the endpoint.",
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
},
|
||||
"ports": {
|
||||
"description": "Set of ports associated with the endpoint. The ports must be associated with a port name that was declared as part of the service. Do not use for `unix://` addresses.",
|
||||
"type": "object",
|
||||
"additionalProperties": {
|
||||
"type": "integer"
|
||||
}
|
||||
},
|
||||
"weight": {
|
||||
"description": "The load balancing weight associated with the endpoint. Endpoints with higher weights will receive proportionally higher traffic.",
|
||||
"type": "integer"
|
||||
},
|
||||
"address": {
|
||||
"description": "Address associated with the network endpoint without the port. Domain names can be used if and only if the resolution is set to DNS, and must be fully-qualified without wildcards. Use the form unix:///absolute/path/to/socket for Unix domain socket endpoints.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"network": {
|
||||
"description": "Network enables Istio to group endpoints resident in the same L3 domain/network. All endpoints in the same network are assumed to be directly reachable from one another. When endpoints in different networks cannot reach each other directly, an Istio Gateway can be used to establish connectivity (usually using the `AUTO_PASSTHROUGH` mode in a Gateway Server). This is an advanced configuration used typically for spanning an Istio mesh over multiple clusters.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"locality": {
|
||||
"description": "The locality associated with the endpoint. A locality corresponds to a failure domain (e.g., country/region/zone). Arbitrary failure domain hierarchies can be represented by separating each encapsulating failure domain by /. For example, the locality of an an endpoint in US, in US-East-1 region, within availability zone az-1, in data center rack r11 can be represented as us/us-east-1/az-1/r11. Istio will configure the sidecar to route to endpoints within the same locality as the sidecar. If none of the endpoints in the locality are available, endpoints parent locality (but within the same network ID) will be chosen. For example, if there are two endpoints in same network (networkID \"n1\"), say e1 with locality us/us-east-1/az-1/r11 and e2 with locality us/us-east-1/az-2/r12, a sidecar from us/us-east-1/az-1/r11 locality will prefer e1 from the same locality over e2 from a different locality. Endpoint e2 could be the IP associated with a gateway (that bridges networks n1 and n2), or the IP associated with a standard service endpoint.",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
},
|
||||
"serviceAccount": {
|
||||
"description": "The service account associated with the workload if a sidecar is present in the workload. The service account must be present in the same namespace as the configuration ( WorkloadEntry or a ServiceEntry)",
|
||||
"type": "string",
|
||||
"format": "string"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
1136
vendor/istio.io/api/networking/v1beta1/workload_entry.pb.go
generated
vendored
Normal file
1136
vendor/istio.io/api/networking/v1beta1/workload_entry.pb.go
generated
vendored
Normal file
File diff suppressed because it is too large
Load Diff
312
vendor/istio.io/api/networking/v1beta1/workload_entry.proto
generated
vendored
Normal file
312
vendor/istio.io/api/networking/v1beta1/workload_entry.proto
generated
vendored
Normal file
@@ -0,0 +1,312 @@
|
||||
// Copyright 2020 Istio Authors
|
||||
//
|
||||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||||
// you may not use this file except in compliance with the License.
|
||||
// You may obtain a copy of the License at
|
||||
//
|
||||
// http://www.apache.org/licenses/LICENSE-2.0
|
||||
//
|
||||
// Unless required by applicable law or agreed to in writing, software
|
||||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
// See the License for the specific language governing permissions and
|
||||
// limitations under the License.
|
||||
|
||||
syntax = "proto3";
|
||||
|
||||
import "google/api/field_behavior.proto";
|
||||
|
||||
// $schema: istio.networking.v1beta1.WorkloadEntry
|
||||
// $title: Workload Entry
|
||||
// $description: Configuration affecting VMs onboarded into the mesh.
|
||||
// $location: https://istio.io/docs/reference/config/networking/workload-entry.html
|
||||
// $aliases: [/docs/reference/config/networking/v1beta1/workload-entry]
|
||||
|
||||
// `WorkloadEntry` enables operators to describe the properties of a
|
||||
// single non-Kubernetes workload such as a VM or a bare metal server
|
||||
// as it is are onboarded into the mesh. A `WorkloadEntry` must be
|
||||
// accompanied by an Istio `ServiceEntry` that selects the workload
|
||||
// through the appropriate labels and provides the service definition
|
||||
// for a `MESH_INTERNAL` service (hostnames, port properties, etc.). A
|
||||
// `ServiceEntry` object can select multiple workload entries as well
|
||||
// as Kubernetes pods based on the label selector specified in the
|
||||
// service entry.
|
||||
//
|
||||
// When a workload connects to `istiod`, the status field in the
|
||||
// custom resource will be updated to indicate the health of the
|
||||
// workload along with other details, similar to how Kubernetes
|
||||
// updates the status of a pod.
|
||||
//
|
||||
// The following example declares a workload entry representing a
|
||||
// VM for the `details.bookinfo.com` service. This VM has
|
||||
// sidecar installed and bootstrapped using the `details-legacy`
|
||||
// service account. The sidecar receives HTTP traffic on port 80
|
||||
// (wrapped in istio mutual TLS) and forwards it to the application on
|
||||
// the localhost on the same port.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: WorkloadEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// # use of the service account indicates that the workload has a
|
||||
// # sidecar proxy bootstrapped with this service account. Pods with
|
||||
// # sidecars will automatically communicate with the workload using
|
||||
// # istio mutual TLS.
|
||||
// serviceAccount: details-legacy
|
||||
// address: 2.2.2.2
|
||||
// labels:
|
||||
// app: details-legacy
|
||||
// instance-id: vm1
|
||||
// # ports if not specified will be the same as service ports
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: WorkloadEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// # use of the service account indicates that the workload has a
|
||||
// # sidecar proxy bootstrapped with this service account. Pods with
|
||||
// # sidecars will automatically communicate with the workload using
|
||||
// # istio mutual TLS.
|
||||
// serviceAccount: details-legacy
|
||||
// address: 2.2.2.2
|
||||
// labels:
|
||||
// app: details-legacy
|
||||
// instance-id: vm1
|
||||
// # ports if not specified will be the same as service ports
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// and the associated service entry
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// hosts:
|
||||
// - details.bookinfo.com
|
||||
// location: MESH_INTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: STATIC
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: details-legacy
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// hosts:
|
||||
// - details.bookinfo.com
|
||||
// location: MESH_INTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: STATIC
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: details-legacy
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
//
|
||||
// The following example declares the same VM workload using
|
||||
// its fully qualified DNS name. The service entry's resolution
|
||||
// mode should be changed to DNS to indicate that the client-side
|
||||
// sidecars should dynamically resolve the DNS name at runtime before
|
||||
// forwarding the request.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: WorkloadEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// # use of the service account indicates that the workload has a
|
||||
// # sidecar proxy bootstrapped with this service account. Pods with
|
||||
// # sidecars will automatically communicate with the workload using
|
||||
// # istio mutual TLS.
|
||||
// serviceAccount: details-legacy
|
||||
// address: vm1.vpc01.corp.net
|
||||
// labels:
|
||||
// app: details-legacy
|
||||
// instance-id: vm1
|
||||
// # ports if not specified will be the same as service ports
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: WorkloadEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// # use of the service account indicates that the workload has a
|
||||
// # sidecar proxy bootstrapped with this service account. Pods with
|
||||
// # sidecars will automatically communicate with the workload using
|
||||
// # istio mutual TLS.
|
||||
// serviceAccount: details-legacy
|
||||
// address: vm1.vpc01.corp.net
|
||||
// labels:
|
||||
// app: details-legacy
|
||||
// instance-id: vm1
|
||||
// # ports if not specified will be the same as service ports
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// and the associated service entry
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// hosts:
|
||||
// - details.bookinfo.com
|
||||
// location: MESH_INTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: DNS
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: details-legacy
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// hosts:
|
||||
// - details.bookinfo.com
|
||||
// location: MESH_INTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: DNS
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: details-legacy
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
package istio.networking.v1beta1;
|
||||
|
||||
option go_package = "istio.io/api/networking/v1beta1";
|
||||
|
||||
// WorkloadEntry enables specifying the properties of a single non-Kubernetes workload such a VM or a bare metal services that can be referred to by service entries.
|
||||
//
|
||||
// <!-- crd generation tags
|
||||
// +cue-gen:WorkloadEntry:groupName:networking.istio.io
|
||||
// +cue-gen:WorkloadEntry:version:v1beta1
|
||||
// +cue-gen:WorkloadEntry:annotations:helm.sh/resource-policy=keep
|
||||
// +cue-gen:WorkloadEntry:labels:app=istio-pilot,chart=istio,heritage=Tiller,release=istio
|
||||
// +cue-gen:WorkloadEntry:subresource:status
|
||||
// +cue-gen:WorkloadEntry:scope:Namespaced
|
||||
// +cue-gen:WorkloadEntry:resource:categories=istio-io,networking-istio-io,shortNames=we,plural=workloadentries
|
||||
// +cue-gen:WorkloadEntry:printerColumn:name=Age,type=date,JSONPath=.metadata.creationTimestamp,description="CreationTimestamp is a timestamp
|
||||
// representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations.
|
||||
// Clients may not set this value. It is represented in RFC3339 form and is in UTC.
|
||||
// Populated by the system. Read-only. Null for lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata"
|
||||
// +cue-gen:WorkloadEntry:printerColumn:name=Address,type=string,JSONPath=.spec.address,description="Address associated with the network endpoint."
|
||||
// +cue-gen:WorkloadEntry:preserveUnknownFields:false
|
||||
// -->
|
||||
//
|
||||
// <!-- go code generation tags
|
||||
// +kubetype-gen
|
||||
// +kubetype-gen:groupVersion=networking.istio.io/v1beta1
|
||||
// +genclient
|
||||
// +k8s:deepcopy-gen=true
|
||||
// -->
|
||||
message WorkloadEntry {
|
||||
// Address associated with the network endpoint without the
|
||||
// port. Domain names can be used if and only if the resolution is set
|
||||
// to DNS, and must be fully-qualified without wildcards. Use the form
|
||||
// unix:///absolute/path/to/socket for Unix domain socket endpoints.
|
||||
string address = 1 [(google.api.field_behavior) = REQUIRED];
|
||||
|
||||
// Set of ports associated with the endpoint. The ports must be
|
||||
// associated with a port name that was declared as part of the
|
||||
// service. Do not use for `unix://` addresses.
|
||||
map<string, uint32> ports = 2;
|
||||
|
||||
// One or more labels associated with the endpoint.
|
||||
map<string, string> labels = 3;
|
||||
|
||||
// Network enables Istio to group endpoints resident in the same L3
|
||||
// domain/network. All endpoints in the same network are assumed to be
|
||||
// directly reachable from one another. When endpoints in different
|
||||
// networks cannot reach each other directly, an Istio Gateway can be
|
||||
// used to establish connectivity (usually using the
|
||||
// `AUTO_PASSTHROUGH` mode in a Gateway Server). This is
|
||||
// an advanced configuration used typically for spanning an Istio mesh
|
||||
// over multiple clusters.
|
||||
string network = 4;
|
||||
|
||||
// The locality associated with the endpoint. A locality corresponds
|
||||
// to a failure domain (e.g., country/region/zone). Arbitrary failure
|
||||
// domain hierarchies can be represented by separating each
|
||||
// encapsulating failure domain by /. For example, the locality of an
|
||||
// an endpoint in US, in US-East-1 region, within availability zone
|
||||
// az-1, in data center rack r11 can be represented as
|
||||
// us/us-east-1/az-1/r11. Istio will configure the sidecar to route to
|
||||
// endpoints within the same locality as the sidecar. If none of the
|
||||
// endpoints in the locality are available, endpoints parent locality
|
||||
// (but within the same network ID) will be chosen. For example, if
|
||||
// there are two endpoints in same network (networkID "n1"), say e1
|
||||
// with locality us/us-east-1/az-1/r11 and e2 with locality
|
||||
// us/us-east-1/az-2/r12, a sidecar from us/us-east-1/az-1/r11 locality
|
||||
// will prefer e1 from the same locality over e2 from a different
|
||||
// locality. Endpoint e2 could be the IP associated with a gateway
|
||||
// (that bridges networks n1 and n2), or the IP associated with a
|
||||
// standard service endpoint.
|
||||
string locality = 5;
|
||||
|
||||
// The load balancing weight associated with the endpoint. Endpoints
|
||||
// with higher weights will receive proportionally higher traffic.
|
||||
uint32 weight = 6;
|
||||
|
||||
// The service account associated with the workload if a sidecar
|
||||
// is present in the workload. The service account must be present
|
||||
// in the same namespace as the configuration ( WorkloadEntry or a
|
||||
// ServiceEntry)
|
||||
string service_account = 7;
|
||||
};
|
||||
|
||||
228
vendor/istio.io/api/networking/v1beta1/workload_entry_deepcopy.gen.go
generated
vendored
Normal file
228
vendor/istio.io/api/networking/v1beta1/workload_entry_deepcopy.gen.go
generated
vendored
Normal file
@@ -0,0 +1,228 @@
|
||||
// Code generated by protoc-gen-gogo. DO NOT EDIT.
|
||||
// source: networking/v1beta1/workload_entry.proto
|
||||
|
||||
// `WorkloadEntry` enables operators to describe the properties of a
|
||||
// single non-Kubernetes workload such as a VM or a bare metal server
|
||||
// as it is are onboarded into the mesh. A `WorkloadEntry` must be
|
||||
// accompanied by an Istio `ServiceEntry` that selects the workload
|
||||
// through the appropriate labels and provides the service definition
|
||||
// for a `MESH_INTERNAL` service (hostnames, port properties, etc.). A
|
||||
// `ServiceEntry` object can select multiple workload entries as well
|
||||
// as Kubernetes pods based on the label selector specified in the
|
||||
// service entry.
|
||||
//
|
||||
// When a workload connects to `istiod`, the status field in the
|
||||
// custom resource will be updated to indicate the health of the
|
||||
// workload along with other details, similar to how Kubernetes
|
||||
// updates the status of a pod.
|
||||
//
|
||||
// The following example declares a workload entry representing a
|
||||
// VM for the `details.bookinfo.com` service. This VM has
|
||||
// sidecar installed and bootstrapped using the `details-legacy`
|
||||
// service account. The sidecar receives HTTP traffic on port 80
|
||||
// (wrapped in istio mutual TLS) and forwards it to the application on
|
||||
// the localhost on the same port.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: WorkloadEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// # use of the service account indicates that the workload has a
|
||||
// # sidecar proxy bootstrapped with this service account. Pods with
|
||||
// # sidecars will automatically communicate with the workload using
|
||||
// # istio mutual TLS.
|
||||
// serviceAccount: details-legacy
|
||||
// address: 2.2.2.2
|
||||
// labels:
|
||||
// app: details-legacy
|
||||
// instance-id: vm1
|
||||
// # ports if not specified will be the same as service ports
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: WorkloadEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// # use of the service account indicates that the workload has a
|
||||
// # sidecar proxy bootstrapped with this service account. Pods with
|
||||
// # sidecars will automatically communicate with the workload using
|
||||
// # istio mutual TLS.
|
||||
// serviceAccount: details-legacy
|
||||
// address: 2.2.2.2
|
||||
// labels:
|
||||
// app: details-legacy
|
||||
// instance-id: vm1
|
||||
// # ports if not specified will be the same as service ports
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// and the associated service entry
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// hosts:
|
||||
// - details.bookinfo.com
|
||||
// location: MESH_INTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: STATIC
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: details-legacy
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// hosts:
|
||||
// - details.bookinfo.com
|
||||
// location: MESH_INTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: STATIC
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: details-legacy
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
//
|
||||
// The following example declares the same VM workload using
|
||||
// its fully qualified DNS name. The service entry's resolution
|
||||
// mode should be changed to DNS to indicate that the client-side
|
||||
// sidecars should dynamically resolve the DNS name at runtime before
|
||||
// forwarding the request.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: WorkloadEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// # use of the service account indicates that the workload has a
|
||||
// # sidecar proxy bootstrapped with this service account. Pods with
|
||||
// # sidecars will automatically communicate with the workload using
|
||||
// # istio mutual TLS.
|
||||
// serviceAccount: details-legacy
|
||||
// address: vm1.vpc01.corp.net
|
||||
// labels:
|
||||
// app: details-legacy
|
||||
// instance-id: vm1
|
||||
// # ports if not specified will be the same as service ports
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: WorkloadEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// # use of the service account indicates that the workload has a
|
||||
// # sidecar proxy bootstrapped with this service account. Pods with
|
||||
// # sidecars will automatically communicate with the workload using
|
||||
// # istio mutual TLS.
|
||||
// serviceAccount: details-legacy
|
||||
// address: vm1.vpc01.corp.net
|
||||
// labels:
|
||||
// app: details-legacy
|
||||
// instance-id: vm1
|
||||
// # ports if not specified will be the same as service ports
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// and the associated service entry
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// hosts:
|
||||
// - details.bookinfo.com
|
||||
// location: MESH_INTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: DNS
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: details-legacy
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// hosts:
|
||||
// - details.bookinfo.com
|
||||
// location: MESH_INTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: DNS
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: details-legacy
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
|
||||
package v1beta1
|
||||
|
||||
import (
|
||||
fmt "fmt"
|
||||
proto "github.com/gogo/protobuf/proto"
|
||||
_ "istio.io/gogo-genproto/googleapis/google/api"
|
||||
math "math"
|
||||
)
|
||||
|
||||
// Reference imports to suppress errors if they are not otherwise used.
|
||||
var _ = proto.Marshal
|
||||
var _ = fmt.Errorf
|
||||
var _ = math.Inf
|
||||
|
||||
// DeepCopyInto supports using WorkloadEntry within kubernetes types, where deepcopy-gen is used.
|
||||
func (in *WorkloadEntry) DeepCopyInto(out *WorkloadEntry) {
|
||||
p := proto.Clone(in).(*WorkloadEntry)
|
||||
*out = *p
|
||||
}
|
||||
240
vendor/istio.io/api/networking/v1beta1/workload_entry_json.gen.go
generated
vendored
Normal file
240
vendor/istio.io/api/networking/v1beta1/workload_entry_json.gen.go
generated
vendored
Normal file
@@ -0,0 +1,240 @@
|
||||
// Code generated by protoc-gen-gogo. DO NOT EDIT.
|
||||
// source: networking/v1beta1/workload_entry.proto
|
||||
|
||||
// `WorkloadEntry` enables operators to describe the properties of a
|
||||
// single non-Kubernetes workload such as a VM or a bare metal server
|
||||
// as it is are onboarded into the mesh. A `WorkloadEntry` must be
|
||||
// accompanied by an Istio `ServiceEntry` that selects the workload
|
||||
// through the appropriate labels and provides the service definition
|
||||
// for a `MESH_INTERNAL` service (hostnames, port properties, etc.). A
|
||||
// `ServiceEntry` object can select multiple workload entries as well
|
||||
// as Kubernetes pods based on the label selector specified in the
|
||||
// service entry.
|
||||
//
|
||||
// When a workload connects to `istiod`, the status field in the
|
||||
// custom resource will be updated to indicate the health of the
|
||||
// workload along with other details, similar to how Kubernetes
|
||||
// updates the status of a pod.
|
||||
//
|
||||
// The following example declares a workload entry representing a
|
||||
// VM for the `details.bookinfo.com` service. This VM has
|
||||
// sidecar installed and bootstrapped using the `details-legacy`
|
||||
// service account. The sidecar receives HTTP traffic on port 80
|
||||
// (wrapped in istio mutual TLS) and forwards it to the application on
|
||||
// the localhost on the same port.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: WorkloadEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// # use of the service account indicates that the workload has a
|
||||
// # sidecar proxy bootstrapped with this service account. Pods with
|
||||
// # sidecars will automatically communicate with the workload using
|
||||
// # istio mutual TLS.
|
||||
// serviceAccount: details-legacy
|
||||
// address: 2.2.2.2
|
||||
// labels:
|
||||
// app: details-legacy
|
||||
// instance-id: vm1
|
||||
// # ports if not specified will be the same as service ports
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: WorkloadEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// # use of the service account indicates that the workload has a
|
||||
// # sidecar proxy bootstrapped with this service account. Pods with
|
||||
// # sidecars will automatically communicate with the workload using
|
||||
// # istio mutual TLS.
|
||||
// serviceAccount: details-legacy
|
||||
// address: 2.2.2.2
|
||||
// labels:
|
||||
// app: details-legacy
|
||||
// instance-id: vm1
|
||||
// # ports if not specified will be the same as service ports
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// and the associated service entry
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// hosts:
|
||||
// - details.bookinfo.com
|
||||
// location: MESH_INTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: STATIC
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: details-legacy
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// hosts:
|
||||
// - details.bookinfo.com
|
||||
// location: MESH_INTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: STATIC
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: details-legacy
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
//
|
||||
// The following example declares the same VM workload using
|
||||
// its fully qualified DNS name. The service entry's resolution
|
||||
// mode should be changed to DNS to indicate that the client-side
|
||||
// sidecars should dynamically resolve the DNS name at runtime before
|
||||
// forwarding the request.
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: WorkloadEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// # use of the service account indicates that the workload has a
|
||||
// # sidecar proxy bootstrapped with this service account. Pods with
|
||||
// # sidecars will automatically communicate with the workload using
|
||||
// # istio mutual TLS.
|
||||
// serviceAccount: details-legacy
|
||||
// address: vm1.vpc01.corp.net
|
||||
// labels:
|
||||
// app: details-legacy
|
||||
// instance-id: vm1
|
||||
// # ports if not specified will be the same as service ports
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: WorkloadEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// # use of the service account indicates that the workload has a
|
||||
// # sidecar proxy bootstrapped with this service account. Pods with
|
||||
// # sidecars will automatically communicate with the workload using
|
||||
// # istio mutual TLS.
|
||||
// serviceAccount: details-legacy
|
||||
// address: vm1.vpc01.corp.net
|
||||
// labels:
|
||||
// app: details-legacy
|
||||
// instance-id: vm1
|
||||
// # ports if not specified will be the same as service ports
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
// and the associated service entry
|
||||
//
|
||||
// {{<tabset category-name="example">}}
|
||||
// {{<tab name="v1alpha3" category-value="v1alpha3">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1alpha3
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// hosts:
|
||||
// - details.bookinfo.com
|
||||
// location: MESH_INTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: DNS
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: details-legacy
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
//
|
||||
// {{<tab name="v1beta1" category-value="v1beta1">}}
|
||||
// ```yaml
|
||||
// apiVersion: networking.istio.io/v1beta1
|
||||
// kind: ServiceEntry
|
||||
// metadata:
|
||||
// name: details-svc
|
||||
// spec:
|
||||
// hosts:
|
||||
// - details.bookinfo.com
|
||||
// location: MESH_INTERNAL
|
||||
// ports:
|
||||
// - number: 80
|
||||
// name: http
|
||||
// protocol: HTTP
|
||||
// resolution: DNS
|
||||
// workloadSelector:
|
||||
// labels:
|
||||
// app: details-legacy
|
||||
// ```
|
||||
// {{</tab>}}
|
||||
// {{</tabset>}}
|
||||
//
|
||||
|
||||
package v1beta1
|
||||
|
||||
import (
|
||||
bytes "bytes"
|
||||
fmt "fmt"
|
||||
github_com_gogo_protobuf_jsonpb "github.com/gogo/protobuf/jsonpb"
|
||||
proto "github.com/gogo/protobuf/proto"
|
||||
_ "istio.io/gogo-genproto/googleapis/google/api"
|
||||
math "math"
|
||||
)
|
||||
|
||||
// Reference imports to suppress errors if they are not otherwise used.
|
||||
var _ = proto.Marshal
|
||||
var _ = fmt.Errorf
|
||||
var _ = math.Inf
|
||||
|
||||
// MarshalJSON is a custom marshaler for WorkloadEntry
|
||||
func (this *WorkloadEntry) MarshalJSON() ([]byte, error) {
|
||||
str, err := WorkloadEntryMarshaler.MarshalToString(this)
|
||||
return []byte(str), err
|
||||
}
|
||||
|
||||
// UnmarshalJSON is a custom unmarshaler for WorkloadEntry
|
||||
func (this *WorkloadEntry) UnmarshalJSON(b []byte) error {
|
||||
return WorkloadEntryUnmarshaler.Unmarshal(bytes.NewReader(b), this)
|
||||
}
|
||||
|
||||
var (
|
||||
WorkloadEntryMarshaler = &github_com_gogo_protobuf_jsonpb.Marshaler{}
|
||||
WorkloadEntryUnmarshaler = &github_com_gogo_protobuf_jsonpb.Unmarshaler{}
|
||||
)
|
||||
Reference in New Issue
Block a user