174 lines
8.0 KiB
JSON
174 lines
8.0 KiB
JSON
{
|
|
"openapi": "3.0.0",
|
|
"info": {
|
|
"title": "Configuration affecting edge load balancer.",
|
|
"version": "v1beta1"
|
|
},
|
|
"components": {
|
|
"schemas": {
|
|
"istio.networking.v1beta1.Gateway": {
|
|
"description": "Gateway describes a load balancer operating at the edge of the mesh receiving incoming or outgoing HTTP/TCP connections.",
|
|
"type": "object",
|
|
"properties": {
|
|
"servers": {
|
|
"description": "A list of server specifications.",
|
|
"type": "array",
|
|
"items": {
|
|
"$ref": "#/components/schemas/istio.networking.v1beta1.Server"
|
|
}
|
|
},
|
|
"selector": {
|
|
"description": "One or more labels that indicate a specific set of pods/VMs on which this gateway configuration should be applied. The scope of label search is restricted to the configuration namespace in which the the resource is present. In other words, the Gateway resource must reside in the same namespace as the gateway workload instance.",
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"type": "string",
|
|
"format": "string"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"istio.networking.v1beta1.Server": {
|
|
"description": "`Server` describes the properties of the proxy on a given load balancer port. For example,",
|
|
"type": "object",
|
|
"properties": {
|
|
"tls": {
|
|
"$ref": "#/components/schemas/istio.networking.v1beta1.ServerTLSSettings"
|
|
},
|
|
"port": {
|
|
"$ref": "#/components/schemas/istio.networking.v1beta1.Port"
|
|
},
|
|
"bind": {
|
|
"description": "The ip or the Unix domain socket to which the listener should be bound to. Format: `x.x.x.x` or `unix:///path/to/uds` or `unix://@foobar` (Linux abstract namespace). When using Unix domain sockets, the port number should be 0.",
|
|
"type": "string",
|
|
"format": "string"
|
|
},
|
|
"hosts": {
|
|
"description": "One or more hosts exposed by this gateway. While typically applicable to HTTP services, it can also be used for TCP services using TLS with SNI. A host is specified as a `dnsName` with an optional `namespace/` prefix. The `dnsName` should be specified using FQDN format, optionally including a wildcard character in the left-most component (e.g., `prod/*.example.com`). Set the `dnsName` to `*` to select all `VirtualService` hosts from the specified namespace (e.g.,`prod/*`).",
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string",
|
|
"format": "string"
|
|
}
|
|
},
|
|
"defaultEndpoint": {
|
|
"description": "The loopback IP endpoint or Unix domain socket to which traffic should be forwarded to by default. Format should be `127.0.0.1:PORT` or `unix:///path/to/socket` or `unix://@foobar` (Linux abstract namespace). NOT IMPLEMENTED. $hide_from_docs",
|
|
"type": "string",
|
|
"format": "string"
|
|
}
|
|
}
|
|
},
|
|
"istio.networking.v1beta1.Port": {
|
|
"description": "Port describes the properties of a specific port of a service.",
|
|
"type": "object",
|
|
"properties": {
|
|
"number": {
|
|
"description": "A valid non-negative integer port number.",
|
|
"type": "integer"
|
|
},
|
|
"name": {
|
|
"description": "Label assigned to the port.",
|
|
"type": "string",
|
|
"format": "string"
|
|
},
|
|
"protocol": {
|
|
"description": "The protocol exposed on the port. MUST BE one of HTTP|HTTPS|GRPC|HTTP2|MONGO|TCP|TLS. TLS implies the connection will be routed based on the SNI header to the destination without terminating the TLS connection.",
|
|
"type": "string",
|
|
"format": "string"
|
|
}
|
|
}
|
|
},
|
|
"istio.networking.v1beta1.ServerTLSSettings": {
|
|
"type": "object",
|
|
"properties": {
|
|
"mode": {
|
|
"$ref": "#/components/schemas/istio.networking.v1beta1.ServerTLSSettings.TLSmode"
|
|
},
|
|
"privateKey": {
|
|
"description": "REQUIRED if mode is `SIMPLE` or `MUTUAL`. The path to the file holding the server's private key.",
|
|
"type": "string",
|
|
"format": "string"
|
|
},
|
|
"caCertificates": {
|
|
"description": "REQUIRED if mode is `MUTUAL`. The path to a file containing certificate authority certificates to use in verifying a presented client side certificate.",
|
|
"type": "string",
|
|
"format": "string"
|
|
},
|
|
"subjectAltNames": {
|
|
"description": "A list of alternate names to verify the subject identity in the certificate presented by the client.",
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string",
|
|
"format": "string"
|
|
}
|
|
},
|
|
"httpsRedirect": {
|
|
"description": "If set to true, the load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS.",
|
|
"type": "boolean"
|
|
},
|
|
"serverCertificate": {
|
|
"description": "REQUIRED if mode is `SIMPLE` or `MUTUAL`. The path to the file holding the server-side TLS certificate to use.",
|
|
"type": "string",
|
|
"format": "string"
|
|
},
|
|
"credentialName": {
|
|
"description": "For gateways running on Kubernetes, the name of the secret that holds the TLS certs including the CA certificates. Applicable only on Kubernetes, and only if the dynamic credential fetching feature is enabled in the proxy by setting `ISTIO_META_USER_SDS` metadata variable. The secret (of type `generic`) should contain the following keys and values: `key: \u003cprivateKey\u003e`, `cert: \u003cserverCert\u003e`, `cacert: \u003cCACertificate\u003e`.",
|
|
"type": "string",
|
|
"format": "string"
|
|
},
|
|
"verifyCertificateSpki": {
|
|
"description": "An optional list of base64-encoded SHA-256 hashes of the SKPIs of authorized client certificates. Note: When both verify_certificate_hash and verify_certificate_spki are specified, a hash matching either value will result in the certificate being accepted.",
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string",
|
|
"format": "string"
|
|
}
|
|
},
|
|
"verifyCertificateHash": {
|
|
"description": "An optional list of hex-encoded SHA-256 hashes of the authorized client certificates. Both simple and colon separated formats are acceptable. Note: When both verify_certificate_hash and verify_certificate_spki are specified, a hash matching either value will result in the certificate being accepted.",
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string",
|
|
"format": "string"
|
|
}
|
|
},
|
|
"minProtocolVersion": {
|
|
"$ref": "#/components/schemas/istio.networking.v1beta1.ServerTLSSettings.TLSProtocol"
|
|
},
|
|
"maxProtocolVersion": {
|
|
"$ref": "#/components/schemas/istio.networking.v1beta1.ServerTLSSettings.TLSProtocol"
|
|
},
|
|
"cipherSuites": {
|
|
"description": "Optional: If specified, only support the specified cipher list. Otherwise default to the default cipher list supported by Envoy.",
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string",
|
|
"format": "string"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"istio.networking.v1beta1.ServerTLSSettings.TLSmode": {
|
|
"description": "TLS modes enforced by the proxy",
|
|
"type": "string",
|
|
"enum": [
|
|
"PASSTHROUGH",
|
|
"SIMPLE",
|
|
"MUTUAL",
|
|
"AUTO_PASSTHROUGH",
|
|
"ISTIO_MUTUAL"
|
|
]
|
|
},
|
|
"istio.networking.v1beta1.ServerTLSSettings.TLSProtocol": {
|
|
"description": "TLS protocol versions.",
|
|
"type": "string",
|
|
"enum": [
|
|
"TLS_AUTO",
|
|
"TLSV1_0",
|
|
"TLSV1_1",
|
|
"TLSV1_2",
|
|
"TLSV1_3"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
} |