--- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.18.0 name: backends.gateway.envoyproxy.io spec: group: gateway.envoyproxy.io names: categories: - envoy-gateway kind: Backend listKind: BackendList plural: backends shortNames: - be singular: backend scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .status.conditions[?(@.type=="Accepted")].reason name: Status type: string - jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: |- Backend allows the user to configure the endpoints of a backend and the behavior of the connection from Envoy Proxy to the backend. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: Spec defines the desired state of Backend. properties: appProtocols: description: AppProtocols defines the application protocols to be supported when connecting to the backend. items: description: AppProtocolType defines various backend applications protocols supported by Envoy Gateway enum: - gateway.envoyproxy.io/h2c - gateway.envoyproxy.io/ws - gateway.envoyproxy.io/wss type: string type: array endpoints: description: Endpoints defines the endpoints to be used when connecting to the backend. items: description: |- BackendEndpoint describes a backend endpoint, which can be either a fully-qualified domain name, IP address or unix domain socket corresponding to Envoy's Address: https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/address.proto#config-core-v3-address properties: fqdn: description: FQDN defines a FQDN endpoint properties: hostname: description: Hostname defines the FQDN hostname of the backend endpoint. maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string port: description: Port defines the port of the backend endpoint. format: int32 maximum: 65535 minimum: 0 type: integer required: - hostname - port type: object hostname: description: Hostname defines an optional hostname for the backend endpoint. maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string ip: description: IP defines an IP endpoint. Supports both IPv4 and IPv6 addresses. properties: address: description: |- Address defines the IP address of the backend endpoint. Supports both IPv4 and IPv6 addresses. maxLength: 45 minLength: 3 pattern: ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$|^(([0-9a-fA-F]{1,4}:){1,7}[0-9a-fA-F]{1,4}|::|(([0-9a-fA-F]{1,4}:){0,5})?(:[0-9a-fA-F]{1,4}){1,2})$ type: string port: description: Port defines the port of the backend endpoint. format: int32 maximum: 65535 minimum: 0 type: integer required: - address - port type: object unix: description: Unix defines the unix domain socket endpoint properties: path: description: |- Path defines the unix domain socket path of the backend endpoint. The path length must not exceed 108 characters. type: string x-kubernetes-validations: - message: unix domain socket path must not exceed 108 characters rule: size(self) <= 108 required: - path type: object zone: description: Zone defines the service zone of the backend endpoint. type: string type: object x-kubernetes-validations: - message: one of fqdn, ip or unix must be specified rule: (has(self.fqdn) || has(self.ip) || has(self.unix)) - message: only one of fqdn, ip or unix can be specified rule: ((has(self.fqdn) && !(has(self.ip) || has(self.unix))) || (has(self.ip) && !(has(self.fqdn) || has(self.unix))) || (has(self.unix) && !(has(self.ip) || has(self.fqdn)))) maxItems: 64 minItems: 1 type: array x-kubernetes-validations: - message: fqdn addresses cannot be mixed with other address types rule: self.all(f, has(f.fqdn)) || !self.exists(f, has(f.fqdn)) fallback: description: |- Fallback indicates whether the backend is designated as a fallback. It is highly recommended to configure active or passive health checks to ensure that failover can be detected when the active backends become unhealthy and to automatically readjust once the primary backends are healthy again. The overprovisioning factor is set to 1.4, meaning the fallback backends will only start receiving traffic when the health of the active backends falls below 72%. type: boolean tls: description: |- TLS defines the TLS settings for the backend. If TLS is specified here and a BackendTLSPolicy is also configured for the backend, the final TLS settings will be a merge of both configurations. In case of overlapping fields, the values defined in the BackendTLSPolicy will take precedence. properties: alpnProtocols: description: |- ALPNProtocols supplies the list of ALPN protocols that should be exposed by the listener or used by the proxy to connect to the backend. Defaults: 1. HTTPS Routes: h2 and http/1.1 are enabled in listener context. 2. Other Routes: ALPN is disabled. 3. Backends: proxy uses the appropriate ALPN options for the backend protocol. When an empty list is provided, the ALPN TLS extension is disabled. Defaults to [h2, http/1.1] if not specified. Typical Supported values are: - http/1.0 - http/1.1 - h2 items: description: ALPNProtocol specifies the protocol to be negotiated using ALPN type: string type: array caCertificateRefs: description: |- CACertificateRefs contains one or more references to Kubernetes objects that contain TLS certificates of the Certificate Authorities that can be used as a trust anchor to validate the certificates presented by the backend. A single reference to a Kubernetes ConfigMap or a Kubernetes Secret, with the CA certificate in a key named `ca.crt` is currently supported. If CACertificateRefs is empty or unspecified, then WellKnownCACertificates must be specified. Only one of CACertificateRefs or WellKnownCACertificates may be specified, not both. items: description: |- LocalObjectReference identifies an API object within the namespace of the referrer. The API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid. References to objects with invalid Group and Kind are not valid, and must be rejected by the implementation, with appropriate Conditions set on the containing object. properties: group: description: |- Group is the group of the referent. For example, "gateway.networking.k8s.io". When unspecified or empty string, core API group is inferred. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: description: Kind is kind of the referent. For example "HTTPRoute" or "Service". maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: Name is the name of the referent. maxLength: 253 minLength: 1 type: string required: - group - kind - name type: object maxItems: 8 type: array ciphers: description: |- Ciphers specifies the set of cipher suites supported when negotiating TLS 1.0 - 1.2. This setting has no effect for TLS 1.3. In non-FIPS Envoy Proxy builds the default cipher list is: - [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305] - [ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305] - ECDHE-ECDSA-AES256-GCM-SHA384 - ECDHE-RSA-AES256-GCM-SHA384 In builds using BoringSSL FIPS the default cipher list is: - ECDHE-ECDSA-AES128-GCM-SHA256 - ECDHE-RSA-AES128-GCM-SHA256 - ECDHE-ECDSA-AES256-GCM-SHA384 - ECDHE-RSA-AES256-GCM-SHA384 items: type: string type: array clientCertificateRef: description: |- ClientCertificateRef defines the reference to a Kubernetes Secret that contains the client certificate and private key for Envoy to use when connecting to backend services and external services, such as ExtAuth, ALS, OpenTelemetry, etc. This secret should be located within the same namespace as the Envoy proxy resource that references it. properties: group: default: "" description: |- Group is the group of the referent. For example, "gateway.networking.k8s.io". When unspecified or empty string, core API group is inferred. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: default: Secret description: Kind is kind of the referent. For example "Secret". maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: Name is the name of the referent. maxLength: 253 minLength: 1 type: string namespace: description: |- Namespace is the namespace of the referenced object. When unspecified, the local namespace is inferred. Note that when a namespace different than the local namespace is specified, a ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. Support: Core maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string required: - name type: object ecdhCurves: description: |- ECDHCurves specifies the set of supported ECDH curves. In non-FIPS Envoy Proxy builds the default curves are: - X25519 - P-256 In builds using BoringSSL FIPS the default curve is: - P-256 items: type: string type: array insecureSkipVerify: default: false description: |- InsecureSkipVerify indicates whether the upstream's certificate verification should be skipped. Defaults to "false". type: boolean maxVersion: description: |- Max specifies the maximal TLS protocol version to allow The default is TLS 1.3 if this is not specified. enum: - Auto - "1.0" - "1.1" - "1.2" - "1.3" type: string minVersion: description: |- Min specifies the minimal TLS protocol version to allow. The default is TLS 1.2 if this is not specified. enum: - Auto - "1.0" - "1.1" - "1.2" - "1.3" type: string signatureAlgorithms: description: |- SignatureAlgorithms specifies which signature algorithms the listener should support. items: type: string type: array sni: description: |- SNI is specifies the SNI value used when establishing an upstream TLS connection to the backend. Envoy Gateway will use the HTTP host header value for SNI, when all resources referenced in BackendRefs are: 1. Backend resources that do not set SNI, or 2. Service/ServiceImport resources that do not have a BackendTLSPolicy attached to them When a BackendTLSPolicy attaches to a Backend resource, the BackendTLSPolicy's Hostname value takes precedence over this value. maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string wellKnownCACertificates: description: |- WellKnownCACertificates specifies whether system CA certificates may be used in the TLS handshake between the gateway and backend pod. If WellKnownCACertificates is unspecified or empty (""), then CACertificateRefs must be specified with at least one entry for a valid configuration. Only one of CACertificateRefs or WellKnownCACertificates may be specified, not both. enum: - System type: string type: object x-kubernetes-validations: - message: must not contain both CACertificateRefs and WellKnownCACertificates rule: '!(has(self.caCertificateRefs) && size(self.caCertificateRefs) > 0 && has(self.wellKnownCACertificates) && self.wellKnownCACertificates != "")' - message: must not contain either CACertificateRefs or WellKnownCACertificates when InsecureSkipVerify is enabled rule: '!((has(self.insecureSkipVerify) && self.insecureSkipVerify) && ((has(self.caCertificateRefs) && size(self.caCertificateRefs) > 0) || (has(self.wellKnownCACertificates) && self.wellKnownCACertificates != "")))' - message: setting ciphers has no effect if the minimum possible TLS version is 1.3 rule: 'has(self.minVersion) && self.minVersion == ''1.3'' ? !has(self.ciphers) : true' - message: minVersion must be smaller or equal to maxVersion rule: 'has(self.minVersion) && has(self.maxVersion) ? {"Auto":0,"1.0":1,"1.1":2,"1.2":3,"1.3":4}[self.minVersion] <= {"1.0":1,"1.1":2,"1.2":3,"1.3":4,"Auto":5}[self.maxVersion] : !has(self.minVersion) && has(self.maxVersion) ? 3 <= {"1.0":1,"1.1":2,"1.2":3,"1.3":4,"Auto":5}[self.maxVersion] : true' type: default: Endpoints description: Type defines the type of the backend. Defaults to "Endpoints" enum: - Endpoints - DynamicResolver type: string type: object x-kubernetes-validations: - message: DynamicResolver type cannot have endpoints specified rule: self.type != 'DynamicResolver' || !has(self.endpoints) status: description: Status defines the current status of Backend. properties: conditions: description: Conditions describe the current conditions of the Backend. items: description: Condition contains details for one aspect of the current state of this API Resource. properties: lastTransitionTime: description: |- lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: |- message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: |- observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: |- reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object maxItems: 8 type: array x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map type: object required: - spec type: object served: true storage: true subresources: status: {}