mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
Remove nessus app and fix envoy-gateway OCI chart bug
- Delete nessus Application CRD, manifests, and bootstrap script - Vendor envoy-gateway Helm chart (v1.6.3) locally to work around ArgoCD v3.3.3 Docker Hub OCI resolution bug - Re-enable auto-sync for envoy-gateway Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Scooby Husky
co-authored by
Claude Opus 4.6
Claude Opus 4.6
parent
d304bd257d
commit
8bde33f4d1
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,476 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.18.0
|
||||
name: backends.gateway.envoyproxy.io
|
||||
spec:
|
||||
group: gateway.envoyproxy.io
|
||||
names:
|
||||
categories:
|
||||
- envoy-gateway
|
||||
kind: Backend
|
||||
listKind: BackendList
|
||||
plural: backends
|
||||
shortNames:
|
||||
- be
|
||||
singular: backend
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .status.conditions[?(@.type=="Accepted")].reason
|
||||
name: Status
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
Backend allows the user to configure the endpoints of a backend and
|
||||
the behavior of the connection from Envoy Proxy to the backend.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec defines the desired state of Backend.
|
||||
properties:
|
||||
appProtocols:
|
||||
description: AppProtocols defines the application protocols to be
|
||||
supported when connecting to the backend.
|
||||
items:
|
||||
description: AppProtocolType defines various backend applications
|
||||
protocols supported by Envoy Gateway
|
||||
enum:
|
||||
- gateway.envoyproxy.io/h2c
|
||||
- gateway.envoyproxy.io/ws
|
||||
- gateway.envoyproxy.io/wss
|
||||
type: string
|
||||
type: array
|
||||
endpoints:
|
||||
description: Endpoints defines the endpoints to be used when connecting
|
||||
to the backend.
|
||||
items:
|
||||
description: |-
|
||||
BackendEndpoint describes a backend endpoint, which can be either a fully-qualified domain name, IP address or unix domain socket
|
||||
corresponding to Envoy's Address: https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/address.proto#config-core-v3-address
|
||||
properties:
|
||||
fqdn:
|
||||
description: FQDN defines a FQDN endpoint
|
||||
properties:
|
||||
hostname:
|
||||
description: Hostname defines the FQDN hostname of the backend
|
||||
endpoint.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
port:
|
||||
description: Port defines the port of the backend endpoint.
|
||||
format: int32
|
||||
maximum: 65535
|
||||
minimum: 0
|
||||
type: integer
|
||||
required:
|
||||
- hostname
|
||||
- port
|
||||
type: object
|
||||
hostname:
|
||||
description: Hostname defines an optional hostname for the backend
|
||||
endpoint.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
ip:
|
||||
description: IP defines an IP endpoint. Supports both IPv4 and
|
||||
IPv6 addresses.
|
||||
properties:
|
||||
address:
|
||||
description: |-
|
||||
Address defines the IP address of the backend endpoint.
|
||||
Supports both IPv4 and IPv6 addresses.
|
||||
maxLength: 45
|
||||
minLength: 3
|
||||
pattern: ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$|^(([0-9a-fA-F]{1,4}:){1,7}[0-9a-fA-F]{1,4}|::|(([0-9a-fA-F]{1,4}:){0,5})?(:[0-9a-fA-F]{1,4}){1,2})$
|
||||
type: string
|
||||
port:
|
||||
description: Port defines the port of the backend endpoint.
|
||||
format: int32
|
||||
maximum: 65535
|
||||
minimum: 0
|
||||
type: integer
|
||||
required:
|
||||
- address
|
||||
- port
|
||||
type: object
|
||||
unix:
|
||||
description: Unix defines the unix domain socket endpoint
|
||||
properties:
|
||||
path:
|
||||
description: |-
|
||||
Path defines the unix domain socket path of the backend endpoint.
|
||||
The path length must not exceed 108 characters.
|
||||
type: string
|
||||
x-kubernetes-validations:
|
||||
- message: unix domain socket path must not exceed 108 characters
|
||||
rule: size(self) <= 108
|
||||
required:
|
||||
- path
|
||||
type: object
|
||||
zone:
|
||||
description: Zone defines the service zone of the backend endpoint.
|
||||
type: string
|
||||
type: object
|
||||
x-kubernetes-validations:
|
||||
- message: one of fqdn, ip or unix must be specified
|
||||
rule: (has(self.fqdn) || has(self.ip) || has(self.unix))
|
||||
- message: only one of fqdn, ip or unix can be specified
|
||||
rule: ((has(self.fqdn) && !(has(self.ip) || has(self.unix))) ||
|
||||
(has(self.ip) && !(has(self.fqdn) || has(self.unix))) || (has(self.unix)
|
||||
&& !(has(self.ip) || has(self.fqdn))))
|
||||
maxItems: 64
|
||||
minItems: 1
|
||||
type: array
|
||||
x-kubernetes-validations:
|
||||
- message: fqdn addresses cannot be mixed with other address types
|
||||
rule: self.all(f, has(f.fqdn)) || !self.exists(f, has(f.fqdn))
|
||||
fallback:
|
||||
description: |-
|
||||
Fallback indicates whether the backend is designated as a fallback.
|
||||
It is highly recommended to configure active or passive health checks to ensure that failover can be detected
|
||||
when the active backends become unhealthy and to automatically readjust once the primary backends are healthy again.
|
||||
The overprovisioning factor is set to 1.4, meaning the fallback backends will only start receiving traffic when
|
||||
the health of the active backends falls below 72%.
|
||||
type: boolean
|
||||
tls:
|
||||
description: |-
|
||||
TLS defines the TLS settings for the backend.
|
||||
If TLS is specified here and a BackendTLSPolicy is also configured for the backend, the final TLS settings will
|
||||
be a merge of both configurations. In case of overlapping fields, the values defined in the BackendTLSPolicy will
|
||||
take precedence.
|
||||
properties:
|
||||
alpnProtocols:
|
||||
description: |-
|
||||
ALPNProtocols supplies the list of ALPN protocols that should be
|
||||
exposed by the listener or used by the proxy to connect to the backend.
|
||||
Defaults:
|
||||
1. HTTPS Routes: h2 and http/1.1 are enabled in listener context.
|
||||
2. Other Routes: ALPN is disabled.
|
||||
3. Backends: proxy uses the appropriate ALPN options for the backend protocol.
|
||||
When an empty list is provided, the ALPN TLS extension is disabled.
|
||||
|
||||
Defaults to [h2, http/1.1] if not specified.
|
||||
|
||||
Typical Supported values are:
|
||||
- http/1.0
|
||||
- http/1.1
|
||||
- h2
|
||||
items:
|
||||
description: ALPNProtocol specifies the protocol to be negotiated
|
||||
using ALPN
|
||||
type: string
|
||||
type: array
|
||||
caCertificateRefs:
|
||||
description: |-
|
||||
CACertificateRefs contains one or more references to Kubernetes objects that
|
||||
contain TLS certificates of the Certificate Authorities that can be used
|
||||
as a trust anchor to validate the certificates presented by the backend.
|
||||
|
||||
A single reference to a Kubernetes ConfigMap or a Kubernetes Secret,
|
||||
with the CA certificate in a key named `ca.crt` is currently supported.
|
||||
|
||||
If CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be
|
||||
specified. Only one of CACertificateRefs or WellKnownCACertificates may be specified,
|
||||
not both.
|
||||
items:
|
||||
description: |-
|
||||
LocalObjectReference identifies an API object within the namespace of the
|
||||
referrer.
|
||||
The API object must be valid in the cluster; the Group and Kind must
|
||||
be registered in the cluster for this reference to be valid.
|
||||
|
||||
References to objects with invalid Group and Kind are not valid, and must
|
||||
be rejected by the implementation, with appropriate Conditions set
|
||||
on the containing object.
|
||||
properties:
|
||||
group:
|
||||
description: |-
|
||||
Group is the group of the referent. For example, "gateway.networking.k8s.io".
|
||||
When unspecified or empty string, core API group is inferred.
|
||||
maxLength: 253
|
||||
pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
kind:
|
||||
description: Kind is kind of the referent. For example "HTTPRoute"
|
||||
or "Service".
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
|
||||
type: string
|
||||
name:
|
||||
description: Name is the name of the referent.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
type: string
|
||||
required:
|
||||
- group
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
maxItems: 8
|
||||
type: array
|
||||
ciphers:
|
||||
description: |-
|
||||
Ciphers specifies the set of cipher suites supported when
|
||||
negotiating TLS 1.0 - 1.2. This setting has no effect for TLS 1.3.
|
||||
In non-FIPS Envoy Proxy builds the default cipher list is:
|
||||
- [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
|
||||
- [ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]
|
||||
- ECDHE-ECDSA-AES256-GCM-SHA384
|
||||
- ECDHE-RSA-AES256-GCM-SHA384
|
||||
In builds using BoringSSL FIPS the default cipher list is:
|
||||
- ECDHE-ECDSA-AES128-GCM-SHA256
|
||||
- ECDHE-RSA-AES128-GCM-SHA256
|
||||
- ECDHE-ECDSA-AES256-GCM-SHA384
|
||||
- ECDHE-RSA-AES256-GCM-SHA384
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
clientCertificateRef:
|
||||
description: |-
|
||||
ClientCertificateRef defines the reference to a Kubernetes Secret that contains
|
||||
the client certificate and private key for Envoy to use when connecting to
|
||||
backend services and external services, such as ExtAuth, ALS, OpenTelemetry, etc.
|
||||
This secret should be located within the same namespace as the Envoy proxy resource that references it.
|
||||
properties:
|
||||
group:
|
||||
default: ""
|
||||
description: |-
|
||||
Group is the group of the referent. For example, "gateway.networking.k8s.io".
|
||||
When unspecified or empty string, core API group is inferred.
|
||||
maxLength: 253
|
||||
pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
kind:
|
||||
default: Secret
|
||||
description: Kind is kind of the referent. For example "Secret".
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
|
||||
type: string
|
||||
name:
|
||||
description: Name is the name of the referent.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace is the namespace of the referenced object. When unspecified, the local
|
||||
namespace is inferred.
|
||||
|
||||
Note that when a namespace different than the local namespace is specified,
|
||||
a ReferenceGrant object is required in the referent namespace to allow that
|
||||
namespace's owner to accept the reference. See the ReferenceGrant
|
||||
documentation for details.
|
||||
|
||||
Support: Core
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
ecdhCurves:
|
||||
description: |-
|
||||
ECDHCurves specifies the set of supported ECDH curves.
|
||||
In non-FIPS Envoy Proxy builds the default curves are:
|
||||
- X25519
|
||||
- P-256
|
||||
In builds using BoringSSL FIPS the default curve is:
|
||||
- P-256
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
insecureSkipVerify:
|
||||
default: false
|
||||
description: |-
|
||||
InsecureSkipVerify indicates whether the upstream's certificate verification
|
||||
should be skipped. Defaults to "false".
|
||||
type: boolean
|
||||
maxVersion:
|
||||
description: |-
|
||||
Max specifies the maximal TLS protocol version to allow
|
||||
The default is TLS 1.3 if this is not specified.
|
||||
enum:
|
||||
- Auto
|
||||
- "1.0"
|
||||
- "1.1"
|
||||
- "1.2"
|
||||
- "1.3"
|
||||
type: string
|
||||
minVersion:
|
||||
description: |-
|
||||
Min specifies the minimal TLS protocol version to allow.
|
||||
The default is TLS 1.2 if this is not specified.
|
||||
enum:
|
||||
- Auto
|
||||
- "1.0"
|
||||
- "1.1"
|
||||
- "1.2"
|
||||
- "1.3"
|
||||
type: string
|
||||
signatureAlgorithms:
|
||||
description: |-
|
||||
SignatureAlgorithms specifies which signature algorithms the listener should
|
||||
support.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
sni:
|
||||
description: |-
|
||||
SNI is specifies the SNI value used when establishing an upstream TLS connection to the backend.
|
||||
|
||||
Envoy Gateway will use the HTTP host header value for SNI, when all resources referenced in BackendRefs are:
|
||||
1. Backend resources that do not set SNI, or
|
||||
2. Service/ServiceImport resources that do not have a BackendTLSPolicy attached to them
|
||||
|
||||
When a BackendTLSPolicy attaches to a Backend resource, the BackendTLSPolicy's Hostname value takes precedence
|
||||
over this value.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
wellKnownCACertificates:
|
||||
description: |-
|
||||
WellKnownCACertificates specifies whether system CA certificates may be used in
|
||||
the TLS handshake between the gateway and backend pod.
|
||||
|
||||
If WellKnownCACertificates is unspecified or empty (""), then CACertificateRefs
|
||||
must be specified with at least one entry for a valid configuration. Only one of
|
||||
CACertificateRefs or WellKnownCACertificates may be specified, not both.
|
||||
enum:
|
||||
- System
|
||||
type: string
|
||||
type: object
|
||||
x-kubernetes-validations:
|
||||
- message: must not contain both CACertificateRefs and WellKnownCACertificates
|
||||
rule: '!(has(self.caCertificateRefs) && size(self.caCertificateRefs)
|
||||
> 0 && has(self.wellKnownCACertificates) && self.wellKnownCACertificates
|
||||
!= "")'
|
||||
- message: must not contain either CACertificateRefs or WellKnownCACertificates
|
||||
when InsecureSkipVerify is enabled
|
||||
rule: '!((has(self.insecureSkipVerify) && self.insecureSkipVerify)
|
||||
&& ((has(self.caCertificateRefs) && size(self.caCertificateRefs)
|
||||
> 0) || (has(self.wellKnownCACertificates) && self.wellKnownCACertificates
|
||||
!= "")))'
|
||||
- message: setting ciphers has no effect if the minimum possible TLS
|
||||
version is 1.3
|
||||
rule: 'has(self.minVersion) && self.minVersion == ''1.3'' ? !has(self.ciphers)
|
||||
: true'
|
||||
- message: minVersion must be smaller or equal to maxVersion
|
||||
rule: 'has(self.minVersion) && has(self.maxVersion) ? {"Auto":0,"1.0":1,"1.1":2,"1.2":3,"1.3":4}[self.minVersion]
|
||||
<= {"1.0":1,"1.1":2,"1.2":3,"1.3":4,"Auto":5}[self.maxVersion]
|
||||
: !has(self.minVersion) && has(self.maxVersion) ? 3 <= {"1.0":1,"1.1":2,"1.2":3,"1.3":4,"Auto":5}[self.maxVersion]
|
||||
: true'
|
||||
type:
|
||||
default: Endpoints
|
||||
description: Type defines the type of the backend. Defaults to "Endpoints"
|
||||
enum:
|
||||
- Endpoints
|
||||
- DynamicResolver
|
||||
type: string
|
||||
type: object
|
||||
x-kubernetes-validations:
|
||||
- message: DynamicResolver type cannot have endpoints specified
|
||||
rule: self.type != 'DynamicResolver' || !has(self.endpoints)
|
||||
status:
|
||||
description: Status defines the current status of Backend.
|
||||
properties:
|
||||
conditions:
|
||||
description: Conditions describe the current conditions of the Backend.
|
||||
items:
|
||||
description: Condition contains details for one aspect of the current
|
||||
state of this API Resource.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False, Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
maxItems: 8
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- type
|
||||
x-kubernetes-list-type: map
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
+2767
File diff suppressed because it is too large
Load Diff
+1721
File diff suppressed because it is too large
Load Diff
+2125
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,507 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.18.0
|
||||
name: envoypatchpolicies.gateway.envoyproxy.io
|
||||
spec:
|
||||
group: gateway.envoyproxy.io
|
||||
names:
|
||||
categories:
|
||||
- envoy-gateway
|
||||
kind: EnvoyPatchPolicy
|
||||
listKind: EnvoyPatchPolicyList
|
||||
plural: envoypatchpolicies
|
||||
shortNames:
|
||||
- epp
|
||||
singular: envoypatchpolicy
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .status.conditions[?(@.type=="Programmed")].reason
|
||||
name: Status
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
EnvoyPatchPolicy allows the user to modify the generated Envoy xDS
|
||||
resources by Envoy Gateway using this patch API
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec defines the desired state of EnvoyPatchPolicy.
|
||||
properties:
|
||||
jsonPatches:
|
||||
description: JSONPatch defines the JSONPatch configuration.
|
||||
items:
|
||||
description: |-
|
||||
EnvoyJSONPatchConfig defines the configuration for patching a Envoy xDS Resource
|
||||
using JSONPatch semantic
|
||||
properties:
|
||||
name:
|
||||
description: Name is the name of the resource
|
||||
type: string
|
||||
operation:
|
||||
description: Patch defines the JSON Patch Operation
|
||||
properties:
|
||||
from:
|
||||
description: |-
|
||||
From is the source location of the value to be copied or moved. Only valid
|
||||
for move or copy operations
|
||||
Refer to https://datatracker.ietf.org/doc/html/rfc6901 for more details.
|
||||
type: string
|
||||
jsonPath:
|
||||
description: |-
|
||||
JSONPath is a JSONPath expression. Refer to https://datatracker.ietf.org/doc/rfc9535/ for more details.
|
||||
It produces one or more JSONPointer expressions based on the given JSON document.
|
||||
If no JSONPointer is found, it will result in an error.
|
||||
If the 'Path' property is also set, it will be appended to the resulting JSONPointer expressions from the JSONPath evaluation.
|
||||
This is useful when creating a property that does not yet exist in the JSON document.
|
||||
The final JSONPointer expressions specifies the locations in the target document/field where the operation will be applied.
|
||||
type: string
|
||||
op:
|
||||
description: Op is the type of operation to perform
|
||||
enum:
|
||||
- add
|
||||
- remove
|
||||
- replace
|
||||
- move
|
||||
- copy
|
||||
- test
|
||||
type: string
|
||||
path:
|
||||
description: |-
|
||||
Path is a JSONPointer expression. Refer to https://datatracker.ietf.org/doc/html/rfc6901 for more details.
|
||||
It specifies the location of the target document/field where the operation will be performed
|
||||
type: string
|
||||
value:
|
||||
description: |-
|
||||
Value is the new value of the path location. The value is only used by
|
||||
the `add` and `replace` operations.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
required:
|
||||
- op
|
||||
type: object
|
||||
type:
|
||||
description: Type is the typed URL of the Envoy xDS Resource
|
||||
enum:
|
||||
- type.googleapis.com/envoy.config.listener.v3.Listener
|
||||
- type.googleapis.com/envoy.config.route.v3.RouteConfiguration
|
||||
- type.googleapis.com/envoy.config.cluster.v3.Cluster
|
||||
- type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment
|
||||
- type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- operation
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
priority:
|
||||
description: |-
|
||||
Priority of the EnvoyPatchPolicy.
|
||||
If multiple EnvoyPatchPolicies are applied to the same
|
||||
TargetRef, they will be applied in the ascending order of
|
||||
the priority i.e. int32.min has the highest priority and
|
||||
int32.max has the lowest priority.
|
||||
Defaults to 0.
|
||||
format: int32
|
||||
type: integer
|
||||
targetRef:
|
||||
description: |-
|
||||
TargetRef is the name of the Gateway API resource this policy
|
||||
is being attached to.
|
||||
By default, attaching to Gateway is supported and
|
||||
when mergeGateways is enabled it should attach to GatewayClass.
|
||||
This Policy and the TargetRef MUST be in the same namespace
|
||||
for this Policy to have effect and be applied to the Gateway
|
||||
TargetRef
|
||||
properties:
|
||||
group:
|
||||
description: Group is the group of the target resource.
|
||||
maxLength: 253
|
||||
pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
kind:
|
||||
description: Kind is kind of the target resource.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
|
||||
type: string
|
||||
name:
|
||||
description: Name is the name of the target resource.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
type: string
|
||||
required:
|
||||
- group
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
type:
|
||||
description: |-
|
||||
Type decides the type of patch.
|
||||
Valid EnvoyPatchType values are "JSONPatch".
|
||||
enum:
|
||||
- JSONPatch
|
||||
type: string
|
||||
required:
|
||||
- targetRef
|
||||
- type
|
||||
type: object
|
||||
status:
|
||||
description: Status defines the current status of EnvoyPatchPolicy.
|
||||
properties:
|
||||
ancestors:
|
||||
description: |-
|
||||
Ancestors is a list of ancestor resources (usually Gateways) that are
|
||||
associated with the policy, and the status of the policy with respect to
|
||||
each ancestor. When this policy attaches to a parent, the controller that
|
||||
manages the parent and the ancestors MUST add an entry to this list when
|
||||
the controller first sees the policy and SHOULD update the entry as
|
||||
appropriate when the relevant ancestor is modified.
|
||||
|
||||
Note that choosing the relevant ancestor is left to the Policy designers;
|
||||
an important part of Policy design is designing the right object level at
|
||||
which to namespace this status.
|
||||
|
||||
Note also that implementations MUST ONLY populate ancestor status for
|
||||
the Ancestor resources they are responsible for. Implementations MUST
|
||||
use the ControllerName field to uniquely identify the entries in this list
|
||||
that they are responsible for.
|
||||
|
||||
Note that to achieve this, the list of PolicyAncestorStatus structs
|
||||
MUST be treated as a map with a composite key, made up of the AncestorRef
|
||||
and ControllerName fields combined.
|
||||
|
||||
A maximum of 16 ancestors will be represented in this list. An empty list
|
||||
means the Policy is not relevant for any ancestors.
|
||||
|
||||
If this slice is full, implementations MUST NOT add further entries.
|
||||
Instead they MUST consider the policy unimplementable and signal that
|
||||
on any related resources such as the ancestor that would be referenced
|
||||
here. For example, if this list was full on BackendTLSPolicy, no
|
||||
additional Gateways would be able to reference the Service targeted by
|
||||
the BackendTLSPolicy.
|
||||
items:
|
||||
description: |-
|
||||
PolicyAncestorStatus describes the status of a route with respect to an
|
||||
associated Ancestor.
|
||||
|
||||
Ancestors refer to objects that are either the Target of a policy or above it
|
||||
in terms of object hierarchy. For example, if a policy targets a Service, the
|
||||
Policy's Ancestors are, in order, the Service, the HTTPRoute, the Gateway, and
|
||||
the GatewayClass. Almost always, in this hierarchy, the Gateway will be the most
|
||||
useful object to place Policy status on, so we recommend that implementations
|
||||
SHOULD use Gateway as the PolicyAncestorStatus object unless the designers
|
||||
have a _very_ good reason otherwise.
|
||||
|
||||
In the context of policy attachment, the Ancestor is used to distinguish which
|
||||
resource results in a distinct application of this policy. For example, if a policy
|
||||
targets a Service, it may have a distinct result per attached Gateway.
|
||||
|
||||
Policies targeting the same resource may have different effects depending on the
|
||||
ancestors of those resources. For example, different Gateways targeting the same
|
||||
Service may have different capabilities, especially if they have different underlying
|
||||
implementations.
|
||||
|
||||
For example, in BackendTLSPolicy, the Policy attaches to a Service that is
|
||||
used as a backend in a HTTPRoute that is itself attached to a Gateway.
|
||||
In this case, the relevant object for status is the Gateway, and that is the
|
||||
ancestor object referred to in this status.
|
||||
|
||||
Note that a parent is also an ancestor, so for objects where the parent is the
|
||||
relevant object for status, this struct SHOULD still be used.
|
||||
|
||||
This struct is intended to be used in a slice that's effectively a map,
|
||||
with a composite key made up of the AncestorRef and the ControllerName.
|
||||
properties:
|
||||
ancestorRef:
|
||||
description: |-
|
||||
AncestorRef corresponds with a ParentRef in the spec that this
|
||||
PolicyAncestorStatus struct describes the status of.
|
||||
properties:
|
||||
group:
|
||||
default: gateway.networking.k8s.io
|
||||
description: |-
|
||||
Group is the group of the referent.
|
||||
When unspecified, "gateway.networking.k8s.io" is inferred.
|
||||
To set the core API group (such as for a "Service" kind referent),
|
||||
Group must be explicitly set to "" (empty string).
|
||||
|
||||
Support: Core
|
||||
maxLength: 253
|
||||
pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
kind:
|
||||
default: Gateway
|
||||
description: |-
|
||||
Kind is kind of the referent.
|
||||
|
||||
There are two kinds of parent resources with "Core" support:
|
||||
|
||||
* Gateway (Gateway conformance profile)
|
||||
* Service (Mesh conformance profile, ClusterIP Services only)
|
||||
|
||||
Support for other resources is Implementation-Specific.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
|
||||
type: string
|
||||
name:
|
||||
description: |-
|
||||
Name is the name of the referent.
|
||||
|
||||
Support: Core
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace is the namespace of the referent. When unspecified, this refers
|
||||
to the local namespace of the Route.
|
||||
|
||||
Note that there are specific rules for ParentRefs which cross namespace
|
||||
boundaries. Cross-namespace references are only valid if they are explicitly
|
||||
allowed by something in the namespace they are referring to. For example:
|
||||
Gateway has the AllowedRoutes field, and ReferenceGrant provides a
|
||||
generic way to enable any other kind of cross-namespace reference.
|
||||
|
||||
<gateway:experimental:description>
|
||||
ParentRefs from a Route to a Service in the same namespace are "producer"
|
||||
routes, which apply default routing rules to inbound connections from
|
||||
any namespace to the Service.
|
||||
|
||||
ParentRefs from a Route to a Service in a different namespace are
|
||||
"consumer" routes, and these routing rules are only applied to outbound
|
||||
connections originating from the same namespace as the Route, for which
|
||||
the intended destination of the connections are a Service targeted as a
|
||||
ParentRef of the Route.
|
||||
</gateway:experimental:description>
|
||||
|
||||
Support: Core
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
port:
|
||||
description: |-
|
||||
Port is the network port this Route targets. It can be interpreted
|
||||
differently based on the type of parent resource.
|
||||
|
||||
When the parent resource is a Gateway, this targets all listeners
|
||||
listening on the specified port that also support this kind of Route(and
|
||||
select this Route). It's not recommended to set `Port` unless the
|
||||
networking behaviors specified in a Route must apply to a specific port
|
||||
as opposed to a listener(s) whose port(s) may be changed. When both Port
|
||||
and SectionName are specified, the name and port of the selected listener
|
||||
must match both specified values.
|
||||
|
||||
<gateway:experimental:description>
|
||||
When the parent resource is a Service, this targets a specific port in the
|
||||
Service spec. When both Port (experimental) and SectionName are specified,
|
||||
the name and port of the selected port must match both specified values.
|
||||
</gateway:experimental:description>
|
||||
|
||||
Implementations MAY choose to support other parent resources.
|
||||
Implementations supporting other types of parent resources MUST clearly
|
||||
document how/if Port is interpreted.
|
||||
|
||||
For the purpose of status, an attachment is considered successful as
|
||||
long as the parent resource accepts it partially. For example, Gateway
|
||||
listeners can restrict which Routes can attach to them by Route kind,
|
||||
namespace, or hostname. If 1 of 2 Gateway listeners accept attachment
|
||||
from the referencing Route, the Route MUST be considered successfully
|
||||
attached. If no Gateway listeners accept attachment from this Route,
|
||||
the Route MUST be considered detached from the Gateway.
|
||||
|
||||
Support: Extended
|
||||
format: int32
|
||||
maximum: 65535
|
||||
minimum: 1
|
||||
type: integer
|
||||
sectionName:
|
||||
description: |-
|
||||
SectionName is the name of a section within the target resource. In the
|
||||
following resources, SectionName is interpreted as the following:
|
||||
|
||||
* Gateway: Listener name. When both Port (experimental) and SectionName
|
||||
are specified, the name and port of the selected listener must match
|
||||
both specified values.
|
||||
* Service: Port name. When both Port (experimental) and SectionName
|
||||
are specified, the name and port of the selected listener must match
|
||||
both specified values.
|
||||
|
||||
Implementations MAY choose to support attaching Routes to other resources.
|
||||
If that is the case, they MUST clearly document how SectionName is
|
||||
interpreted.
|
||||
|
||||
When unspecified (empty string), this will reference the entire resource.
|
||||
For the purpose of status, an attachment is considered successful if at
|
||||
least one section in the parent resource accepts it. For example, Gateway
|
||||
listeners can restrict which Routes can attach to them by Route kind,
|
||||
namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from
|
||||
the referencing Route, the Route MUST be considered successfully
|
||||
attached. If no Gateway listeners accept attachment from this Route, the
|
||||
Route MUST be considered detached from the Gateway.
|
||||
|
||||
Support: Core
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
conditions:
|
||||
description: |-
|
||||
Conditions describes the status of the Policy with respect to the given Ancestor.
|
||||
|
||||
<gateway:util:excludeFromCRD>
|
||||
|
||||
Notes for implementors:
|
||||
|
||||
Conditions are a listType `map`, which means that they function like a
|
||||
map with a key of the `type` field _in the k8s apiserver_.
|
||||
|
||||
This means that implementations must obey some rules when updating this
|
||||
section.
|
||||
|
||||
* Implementations MUST perform a read-modify-write cycle on this field
|
||||
before modifying it. That is, when modifying this field, implementations
|
||||
must be confident they have fetched the most recent version of this field,
|
||||
and ensure that changes they make are on that recent version.
|
||||
* Implementations MUST NOT remove or reorder Conditions that they are not
|
||||
directly responsible for. For example, if an implementation sees a Condition
|
||||
with type `special.io/SomeField`, it MUST NOT remove, change or update that
|
||||
Condition.
|
||||
* Implementations MUST always _merge_ changes into Conditions of the same Type,
|
||||
rather than creating more than one Condition of the same Type.
|
||||
* Implementations MUST always update the `observedGeneration` field of the
|
||||
Condition to the `metadata.generation` of the Gateway at the time of update creation.
|
||||
* If the `observedGeneration` of a Condition is _greater than_ the value the
|
||||
implementation knows about, then it MUST NOT perform the update on that Condition,
|
||||
but must wait for a future reconciliation and status update. (The assumption is that
|
||||
the implementation's copy of the object is stale and an update will be re-triggered
|
||||
if relevant.)
|
||||
|
||||
</gateway:util:excludeFromCRD>
|
||||
items:
|
||||
description: Condition contains details for one aspect of
|
||||
the current state of this API Resource.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
description: |-
|
||||
lastTransitionTime is the last time the condition transitioned from one status to another.
|
||||
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
description: |-
|
||||
message is a human readable message indicating details about the transition.
|
||||
This may be an empty string.
|
||||
maxLength: 32768
|
||||
type: string
|
||||
observedGeneration:
|
||||
description: |-
|
||||
observedGeneration represents the .metadata.generation that the condition was set based upon.
|
||||
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
|
||||
with respect to the current state of the instance.
|
||||
format: int64
|
||||
minimum: 0
|
||||
type: integer
|
||||
reason:
|
||||
description: |-
|
||||
reason contains a programmatic identifier indicating the reason for the condition's last transition.
|
||||
Producers of specific condition types may define expected values and meanings for this field,
|
||||
and whether the values are considered a guaranteed API.
|
||||
The value should be a CamelCase string.
|
||||
This field may not be empty.
|
||||
maxLength: 1024
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
|
||||
type: string
|
||||
status:
|
||||
description: status of the condition, one of True, False,
|
||||
Unknown.
|
||||
enum:
|
||||
- "True"
|
||||
- "False"
|
||||
- Unknown
|
||||
type: string
|
||||
type:
|
||||
description: type of condition in CamelCase or in foo.example.com/CamelCase.
|
||||
maxLength: 316
|
||||
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
|
||||
type: string
|
||||
required:
|
||||
- lastTransitionTime
|
||||
- message
|
||||
- reason
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
maxItems: 8
|
||||
minItems: 1
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- type
|
||||
x-kubernetes-list-type: map
|
||||
controllerName:
|
||||
description: |-
|
||||
ControllerName is a domain/path string that indicates the name of the
|
||||
controller that wrote this status. This corresponds with the
|
||||
controllerName field on GatewayClass.
|
||||
|
||||
Example: "example.net/gateway-controller".
|
||||
|
||||
The format of this field is DOMAIN "/" PATH, where DOMAIN and PATH are
|
||||
valid Kubernetes names
|
||||
(https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names).
|
||||
|
||||
Controllers MUST populate this field when writing status. Controllers should ensure that
|
||||
entries to status populated with their ControllerName are cleaned up when they are no
|
||||
longer necessary.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$
|
||||
type: string
|
||||
required:
|
||||
- ancestorRef
|
||||
- conditions
|
||||
- controllerName
|
||||
type: object
|
||||
maxItems: 16
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- ancestors
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,426 @@
|
||||
---
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.18.0
|
||||
name: httproutefilters.gateway.envoyproxy.io
|
||||
spec:
|
||||
group: gateway.envoyproxy.io
|
||||
names:
|
||||
categories:
|
||||
- envoy-gateway
|
||||
kind: HTTPRouteFilter
|
||||
listKind: HTTPRouteFilterList
|
||||
plural: httproutefilters
|
||||
shortNames:
|
||||
- hrf
|
||||
singular: httproutefilter
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
HTTPRouteFilter is a custom Envoy Gateway HTTPRouteFilter which provides extended
|
||||
traffic processing options such as path regex rewrite, direct response and more.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: Spec defines the desired state of HTTPRouteFilter.
|
||||
properties:
|
||||
credentialInjection:
|
||||
description: |-
|
||||
HTTPCredentialInjectionFilter defines the configuration to inject credentials into the request.
|
||||
This is useful when the backend service requires credentials in the request, and the original
|
||||
request does not contain them. The filter can inject credentials into the request before forwarding
|
||||
it to the backend service.
|
||||
properties:
|
||||
credential:
|
||||
description: Credential is the credential to be injected.
|
||||
properties:
|
||||
valueRef:
|
||||
description: |-
|
||||
ValueRef is a reference to the secret containing the credentials to be injected.
|
||||
This is an Opaque secret. The credential should be stored in the key
|
||||
"credential", and the value should be the credential to be injected.
|
||||
For example, for basic authentication, the value should be "Basic <base64 encoded username:password>".
|
||||
for bearer token, the value should be "Bearer <token>".
|
||||
Note: The secret must be in the same namespace as the HTTPRouteFilter.
|
||||
properties:
|
||||
group:
|
||||
default: ""
|
||||
description: |-
|
||||
Group is the group of the referent. For example, "gateway.networking.k8s.io".
|
||||
When unspecified or empty string, core API group is inferred.
|
||||
maxLength: 253
|
||||
pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
kind:
|
||||
default: Secret
|
||||
description: Kind is kind of the referent. For example
|
||||
"Secret".
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
|
||||
type: string
|
||||
name:
|
||||
description: Name is the name of the referent.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace is the namespace of the referenced object. When unspecified, the local
|
||||
namespace is inferred.
|
||||
|
||||
Note that when a namespace different than the local namespace is specified,
|
||||
a ReferenceGrant object is required in the referent namespace to allow that
|
||||
namespace's owner to accept the reference. See the ReferenceGrant
|
||||
documentation for details.
|
||||
|
||||
Support: Core
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
required:
|
||||
- valueRef
|
||||
type: object
|
||||
header:
|
||||
description: |-
|
||||
Header is the name of the header where the credentials are injected.
|
||||
If not specified, the credentials are injected into the Authorization header.
|
||||
type: string
|
||||
overwrite:
|
||||
description: |-
|
||||
Whether to overwrite the value or not if the injected headers already exist.
|
||||
If not specified, the default value is false.
|
||||
type: boolean
|
||||
required:
|
||||
- credential
|
||||
type: object
|
||||
directResponse:
|
||||
description: HTTPDirectResponseFilter defines the configuration to
|
||||
return a fixed response.
|
||||
properties:
|
||||
body:
|
||||
description: Body of the direct response.
|
||||
properties:
|
||||
inline:
|
||||
description: Inline contains the value as an inline string.
|
||||
type: string
|
||||
type:
|
||||
allOf:
|
||||
- enum:
|
||||
- Inline
|
||||
- ValueRef
|
||||
- enum:
|
||||
- Inline
|
||||
- ValueRef
|
||||
default: Inline
|
||||
description: |-
|
||||
Type is the type of method to use to read the body value.
|
||||
Valid values are Inline and ValueRef, default is Inline.
|
||||
type: string
|
||||
valueRef:
|
||||
description: |-
|
||||
ValueRef contains the contents of the body
|
||||
specified as a local object reference.
|
||||
Only a reference to ConfigMap is supported.
|
||||
|
||||
The value of key `response.body` in the ConfigMap will be used as the response body.
|
||||
If the key is not found, the first value in the ConfigMap will be used.
|
||||
properties:
|
||||
group:
|
||||
description: |-
|
||||
Group is the group of the referent. For example, "gateway.networking.k8s.io".
|
||||
When unspecified or empty string, core API group is inferred.
|
||||
maxLength: 253
|
||||
pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
kind:
|
||||
description: Kind is kind of the referent. For example
|
||||
"HTTPRoute" or "Service".
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
|
||||
type: string
|
||||
name:
|
||||
description: Name is the name of the referent.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
type: string
|
||||
required:
|
||||
- group
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
required:
|
||||
- type
|
||||
type: object
|
||||
x-kubernetes-validations:
|
||||
- message: inline must be set for type Inline
|
||||
rule: '(!has(self.type) || self.type == ''Inline'')? has(self.inline)
|
||||
: true'
|
||||
- message: valueRef must be set for type ValueRef
|
||||
rule: '(has(self.type) && self.type == ''ValueRef'')? has(self.valueRef)
|
||||
: true'
|
||||
- message: only ConfigMap is supported for ValueRef
|
||||
rule: 'has(self.valueRef) ? self.valueRef.kind == ''ConfigMap''
|
||||
: true'
|
||||
contentType:
|
||||
description: Content Type of the direct response. This will be
|
||||
set in the Content-Type header.
|
||||
type: string
|
||||
header:
|
||||
description: Header defines the headers of the direct response.
|
||||
properties:
|
||||
add:
|
||||
description: |-
|
||||
Add adds the given header(s) (name, value) to the request
|
||||
before the action. It appends to any existing values associated
|
||||
with the header name.
|
||||
|
||||
Input:
|
||||
GET /foo HTTP/1.1
|
||||
my-header: foo
|
||||
|
||||
Config:
|
||||
add:
|
||||
- name: "my-header"
|
||||
value: "bar,baz"
|
||||
|
||||
Output:
|
||||
GET /foo HTTP/1.1
|
||||
my-header: foo,bar,baz
|
||||
items:
|
||||
description: HTTPHeader represents an HTTP Header name and
|
||||
value as defined by RFC 7230.
|
||||
properties:
|
||||
name:
|
||||
description: |-
|
||||
Name is the name of the HTTP Header to be matched. Name matching MUST be
|
||||
case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
|
||||
|
||||
If multiple entries specify equivalent header names, the first entry with
|
||||
an equivalent name MUST be considered for a match. Subsequent entries
|
||||
with an equivalent header name MUST be ignored. Due to the
|
||||
case-insensitivity of header names, "foo" and "Foo" are considered
|
||||
equivalent.
|
||||
maxLength: 256
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
|
||||
type: string
|
||||
value:
|
||||
description: Value is the value of HTTP Header to be
|
||||
matched.
|
||||
maxLength: 4096
|
||||
minLength: 1
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- value
|
||||
type: object
|
||||
maxItems: 16
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- name
|
||||
x-kubernetes-list-type: map
|
||||
remove:
|
||||
description: |-
|
||||
Remove the given header(s) from the HTTP request before the action. The
|
||||
value of Remove is a list of HTTP header names. Note that the header
|
||||
names are case-insensitive (see
|
||||
https://datatracker.ietf.org/doc/html/rfc2616#section-4.2).
|
||||
|
||||
Input:
|
||||
GET /foo HTTP/1.1
|
||||
my-header1: foo
|
||||
my-header2: bar
|
||||
my-header3: baz
|
||||
|
||||
Config:
|
||||
remove: ["my-header1", "my-header3"]
|
||||
|
||||
Output:
|
||||
GET /foo HTTP/1.1
|
||||
my-header2: bar
|
||||
items:
|
||||
type: string
|
||||
maxItems: 16
|
||||
type: array
|
||||
x-kubernetes-list-type: set
|
||||
set:
|
||||
description: |-
|
||||
Set overwrites the request with the given header (name, value)
|
||||
before the action.
|
||||
|
||||
Input:
|
||||
GET /foo HTTP/1.1
|
||||
my-header: foo
|
||||
|
||||
Config:
|
||||
set:
|
||||
- name: "my-header"
|
||||
value: "bar"
|
||||
|
||||
Output:
|
||||
GET /foo HTTP/1.1
|
||||
my-header: bar
|
||||
items:
|
||||
description: HTTPHeader represents an HTTP Header name and
|
||||
value as defined by RFC 7230.
|
||||
properties:
|
||||
name:
|
||||
description: |-
|
||||
Name is the name of the HTTP Header to be matched. Name matching MUST be
|
||||
case-insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2).
|
||||
|
||||
If multiple entries specify equivalent header names, the first entry with
|
||||
an equivalent name MUST be considered for a match. Subsequent entries
|
||||
with an equivalent header name MUST be ignored. Due to the
|
||||
case-insensitivity of header names, "foo" and "Foo" are considered
|
||||
equivalent.
|
||||
maxLength: 256
|
||||
minLength: 1
|
||||
pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$
|
||||
type: string
|
||||
value:
|
||||
description: Value is the value of HTTP Header to be
|
||||
matched.
|
||||
maxLength: 4096
|
||||
minLength: 1
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- value
|
||||
type: object
|
||||
maxItems: 16
|
||||
type: array
|
||||
x-kubernetes-list-map-keys:
|
||||
- name
|
||||
x-kubernetes-list-type: map
|
||||
type: object
|
||||
x-kubernetes-validations:
|
||||
- message: header.remove is not supported for DirectResponse
|
||||
rule: '!has(self.remove) || size(self.remove) == 0'
|
||||
statusCode:
|
||||
description: |-
|
||||
Status Code of the HTTP response
|
||||
If unset, defaults to 200.
|
||||
type: integer
|
||||
type: object
|
||||
urlRewrite:
|
||||
description: HTTPURLRewriteFilter define rewrites of HTTP URL components
|
||||
such as path and host
|
||||
properties:
|
||||
hostname:
|
||||
description: |-
|
||||
Hostname is the value to be used to replace the Host header value during
|
||||
forwarding.
|
||||
properties:
|
||||
header:
|
||||
description: Header is the name of the header whose value
|
||||
would be used to rewrite the Host header
|
||||
type: string
|
||||
type:
|
||||
description: HTTPPathModifierType defines the type of Hostname
|
||||
rewrite.
|
||||
enum:
|
||||
- Header
|
||||
- Backend
|
||||
type: string
|
||||
required:
|
||||
- type
|
||||
type: object
|
||||
x-kubernetes-validations:
|
||||
- message: header must be nil if the type is not Header
|
||||
rule: '!(has(self.header) && self.type != ''Header'')'
|
||||
- message: header must be specified for Header type
|
||||
rule: '!(!has(self.header) && self.type == ''Header'')'
|
||||
path:
|
||||
description: Path defines a path rewrite.
|
||||
properties:
|
||||
replaceRegexMatch:
|
||||
description: |-
|
||||
ReplaceRegexMatch defines a path regex rewrite. The path portions matched by the regex pattern are replaced by the defined substitution.
|
||||
https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v3-api-field-config-route-v3-routeaction-regex-rewrite
|
||||
Some examples:
|
||||
(1) replaceRegexMatch:
|
||||
pattern: ^/service/([^/]+)(/.*)$
|
||||
substitution: \2/instance/\1
|
||||
Would transform /service/foo/v1/api into /v1/api/instance/foo.
|
||||
(2) replaceRegexMatch:
|
||||
pattern: one
|
||||
substitution: two
|
||||
Would transform /xxx/one/yyy/one/zzz into /xxx/two/yyy/two/zzz.
|
||||
(3) replaceRegexMatch:
|
||||
pattern: ^(.*?)one(.*)$
|
||||
substitution: \1two\2
|
||||
Would transform /xxx/one/yyy/one/zzz into /xxx/two/yyy/one/zzz.
|
||||
(3) replaceRegexMatch:
|
||||
pattern: (?i)/xxx/
|
||||
substitution: /yyy/
|
||||
Would transform path /aaa/XxX/bbb into /aaa/yyy/bbb (case-insensitive).
|
||||
properties:
|
||||
pattern:
|
||||
description: |-
|
||||
Pattern matches a regular expression against the value of the HTTP Path.The regex string must
|
||||
adhere to the syntax documented in https://github.com/google/re2/wiki/Syntax.
|
||||
minLength: 1
|
||||
type: string
|
||||
substitution:
|
||||
description: |-
|
||||
Substitution is an expression that replaces the matched portion.The expression may include numbered
|
||||
capture groups that adhere to syntax documented in https://github.com/google/re2/wiki/Syntax.
|
||||
type: string
|
||||
required:
|
||||
- pattern
|
||||
- substitution
|
||||
type: object
|
||||
type:
|
||||
description: HTTPPathModifierType defines the type of path
|
||||
redirect or rewrite.
|
||||
enum:
|
||||
- ReplaceRegexMatch
|
||||
type: string
|
||||
required:
|
||||
- type
|
||||
type: object
|
||||
x-kubernetes-validations:
|
||||
- message: If HTTPPathModifier type is ReplaceRegexMatch, replaceRegexMatch
|
||||
field needs to be set.
|
||||
rule: 'self.type == ''ReplaceRegexMatch'' ? has(self.replaceRegexMatch)
|
||||
: !has(self.replaceRegexMatch)'
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- spec
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user