This is an automated email from the ASF dual-hosted git repository.
zhongxjian pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/dubbo-kubernetes.git
The following commit(s) were added to refs/heads/master by this push:
new 57b3b2fa [discovery] debug xds and proxy code logic (#805)
57b3b2fa is described below
commit 57b3b2fa75a9e76df549aea37caacbc994efcb77
Author: Jian Zhong <11...@qq.com>
AuthorDate: Fri Oct 31 02:27:48 2025 +0800
[discovery] debug xds and proxy code logic (#805)
---
Dockerfile | 10 +-
cmd/proxyless-test/main.go | 1 +
go.mod | 1 +
go.sum | 2 +
manifests/charts/base/files/crd-all.yaml | 10722 -------------------
.../dubbo-discovery/files/grpc-agent.yaml | 161 +-
.../dubbo-discovery/templates/clusterrole.yaml | 42 +
.../templates/clusterrolebinding.yaml | 13 +
.../templates/configmap-values.yaml | 11 +
.../dubbo-discovery/templates/configmap.yaml | 15 +
.../dubbo-discovery/templates/deployment.yaml | 67 +
.../templates/dubbd-injector-configmap.yaml | 17 +
.../dubbo-discovery/templates/mutatingwebhook.yaml | 144 +
.../dubbo-discovery/templates/service.yaml | 21 +
.../dubbo-discovery/templates/serviceaccount.yaml | 5 +
.../templates/validatingwebhookconfiguration.yaml | 27 +
.../dubbo-control/dubbo-discovery/values.yaml | 3 +
manifests/charts/dubbo-control/root-cert.pem | 17 +
pkg/bootstrap/config.go | 110 +-
pkg/channels/unbounded.go | 91 +
pkg/config/constants/constants.go | 18 +-
pkg/config/mesh/mesh.go | 3 +
pkg/dubbo-agent/agent.go | 148 +-
pkg/dubbo-agent/config/config.go | 10 +-
pkg/dubbo-agent/grpcxds/grpc_bootstrap.go | 112 +-
pkg/dubbo-agent/plugins.go | 7 +-
pkg/dubbo-agent/xds_proxy.go | 389 +-
pkg/dubbo-agent/xds_proxy_delta.go | 210 +
pkg/file/file.go | 12 +
pkg/jwt/jwt.go | 17 +
pkg/kube/inject/initializer.go | 44 +
pkg/kube/inject/inject.go | 117 +-
pkg/kube/inject/webhook.go | 57 +-
pkg/model/proxy.go | 78 +-
pkg/model/xds.go | 85 +-
pkg/security/security.go | 126 +-
pkg/xds/server.go | 14 +-
sail/cmd/sail-agent/app/cmd.go | 150 +-
sail/cmd/sail-agent/app/wait.go | 18 +-
sail/cmd/sail-agent/config/config.go | 12 +
sail/cmd/sail-agent/main.go | 7 +-
sail/cmd/sail-agent/options/agent.go | 10 +
sail/cmd/sail-agent/options/agent_proxy.go | 18 +-
sail/cmd/sail-agent/options/options.go | 73 +-
sail/cmd/sail-agent/options/security.go | 52 +-
sail/pkg/bootstrap/discovery.go | 41 +
sail/pkg/bootstrap/proxylessinjector.go | 9 +-
sail/pkg/bootstrap/server.go | 22 +-
sail/pkg/bootstrap/webhook.go | 1 -
sail/pkg/features/sail.go | 6 +
sail/pkg/features/tuning.go | 6 +-
sail/pkg/features/xds.go | 11 +
sail/pkg/model/context.go | 20 +-
sail/pkg/model/push_context.go | 46 +-
sail/pkg/model/service.go | 102 +
sail/pkg/model/typed_xds_cache.go | 270 +
sail/pkg/model/validation.go | 5 +
sail/pkg/model/xds_cache.go | 212 +
sail/pkg/networking/apigen/apigen.go | 20 +
sail/pkg/networking/core/cluster.go | 16 +
sail/pkg/networking/core/configgen.go | 34 +
.../networking/core/extension_config_builder.go | 12 +
sail/pkg/networking/core/httproute.go | 14 +
sail/pkg/networking/core/listener.go | 12 +
sail/pkg/networking/grpcgen/cds.go | 142 +
sail/pkg/networking/grpcgen/grpcgen.go | 21 +
sail/pkg/networking/grpcgen/lds.go | 169 +
sail/pkg/networking/grpcgen/rds.go | 40 +
sail/pkg/networking/networking.go | 29 +
sail/pkg/networking/util/util.go | 64 +-
sail/pkg/util/network/ip.go | 110 +
sail/pkg/xds/ads.go | 19 +-
sail/pkg/xds/cds.go | 45 +
sail/pkg/xds/discovery.go | 1 +
sail/pkg/xds/eds.go | 44 +-
sail/pkg/xds/lds.go | 39 +
sail/pkg/xds/rds.go | 44 +
sail/pkg/xds/statusgen.go | 27 +-
sail/pkg/xds/xdsgen.go | 22 +-
security/pkg/credentialfetcher/fetcher.go | 16 +
security/pkg/credentialfetcher/plugin/token.go | 4 +-
security/pkg/nodeagent/cache/secretcache.go | 553 +-
security/pkg/nodeagent/cafile/cafile.go | 10 +
security/pkg/nodeagent/sds/sdsservice.go | 5 -
security/pkg/nodeagent/util/util.go | 71 +
85 files changed, 4572 insertions(+), 11029 deletions(-)
diff --git a/Dockerfile b/Dockerfile
index d7f227e1..ba2c2877 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
FROM gcr.io/distroless/static:debug AS discovery
-COPY ../sail-discovery .
-ENTRYPOINT ["./sail-discovery"]
+COPY ../sail-discovery /usr/local/bin/sail-discovery
+ENTRYPOINT ["./usr/local/bin/sail-discovery"]
-FROM gcr.io/distroless/static:debug AS agent
-COPY sail-agent .
-ENTRYPOINT ["./sail-agent"]
\ No newline at end of file
+FROM gcr.io/distroless/static:debug AS proxy
+COPY ../sail-agent /usr/local/bin/sail-agent
+ENTRYPOINT ["./usr/local/bin/sail-agent"]
\ No newline at end of file
diff --git a/cmd/proxyless-test/main.go b/cmd/proxyless-test/main.go
new file mode 100644
index 00000000..0519ecba
--- /dev/null
+++ b/cmd/proxyless-test/main.go
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/go.mod b/go.mod
index ea16e464..a7d0030b 100644
--- a/go.mod
+++ b/go.mod
@@ -49,6 +49,7 @@ require (
github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.2
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0
github.com/hashicorp/go-multierror v1.1.1
+ github.com/hashicorp/golang-lru/v2 v2.0.5
github.com/heroku/color v0.0.6
github.com/moby/term v0.5.2
github.com/ory/viper v1.7.5
diff --git a/go.sum b/go.sum
index 3f4542cc..35549819 100644
--- a/go.sum
+++ b/go.sum
@@ -397,6 +397,8 @@ github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY
github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
+github.com/hashicorp/golang-lru/v2 v2.0.5 h1:wW7h1TG88eUIJ2i69gaE3uNVtEPIagzhGvHgwfx2Vm4=
+github.com/hashicorp/golang-lru/v2 v2.0.5/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
github.com/heroku/color v0.0.6 h1:UTFFMrmMLFcL3OweqP1lAdp8i1y/9oHqkeHjQ/b/Ny0=
diff --git a/manifests/charts/base/files/crd-all.yaml b/manifests/charts/base/files/crd-all.yaml
index e4fe13f6..09697dce 100644
--- a/manifests/charts/base/files/crd-all.yaml
+++ b/manifests/charts/base/files/crd-all.yaml
@@ -13,10725 +13,3 @@
# See the License for the specific language governing permissions and
# limitations under the License.
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- "helm.sh/resource-policy": keep
- labels:
- app: dubbo-sail
- chart: dubbo
- heritage: Tiller
- release: dubbo
- name: destinationrules.networking.dubbo.io
-spec:
- group: networking.dubbo.io
- names:
- categories:
- - dubbo-io
- - networking-dubbo-io
- kind: DestinationRule
- listKind: DestinationRuleList
- plural: destinationrules
- shortNames:
- - dr
- singular: destinationrule
- scope: Namespaced
- versions:
- - additionalPrinterColumns:
- - description: The name of a service from the service registry
- jsonPath: .spec.host
- name: Host
- type: string
- - description: CreationTimestamp is a timestamp representing the server time when
- this object was created. It is not guaranteed to be set in happens-before
- order across separate operations. Clients may not set this value. It is represented
- in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for
- lists. For more information, see [Kubernetes API Conventions](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata)
- jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- name: v1
- schema:
- openAPIV3Schema:
- properties:
- spec:
- description: 'Configuration affecting load balancing, outlier detection.'
- properties:
- exportTo:
- description: A list of namespaces to which this destination rule is
- exported.
- items:
- type: string
- type: array
- host:
- description: The name of a ser04vice from the service registry.
- type: string
- subsets:
- description: One or more named sets that represent individual versions
- of a service.
- items:
- properties:
- labels:
- additionalProperties:
- type: string
- description: Labels apply a filter over the endpoints of a service
- in the service registry.
- type: object
- name:
- description: Name of the subset.
- type: string
- trafficPolicy:
- description: Traffic policies that apply to this subset.
- properties:
- connectionPool:
- properties:
- http:
- description: HTTP connection pool settings.
- properties:
- h2UpgradePolicy:
- description: |-
- Specify if http1.1 connection should be upgraded to http2 for the associated destination.
-
- Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE
- enum:
- - DEFAULT
- - DO_NOT_UPGRADE
- - UPGRADE
- type: string
- http1MaxPendingRequests:
- description: Maximum number of requests that will
- be queued while waiting for a ready connection
- pool connection.
- format: int32
- type: integer
- http2MaxRequests:
- description: Maximum number of active requests to
- a destination.
- format: int32
- type: integer
- idleTimeout:
- description: The idle timeout for upstream connection
- pool connections.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- maxConcurrentStreams:
- description: The maximum number of concurrent streams
- allowed for a peer on one HTTP/2 connection.
- format: int32
- type: integer
- maxRequestsPerConnection:
- description: Maximum number of requests per connection
- to a backend.
- format: int32
- type: integer
- maxRetries:
- description: Maximum number of retries that can
- be outstanding to all hosts in a cluster at a
- given time.
- format: int32
- type: integer
- useClientProtocol:
- description: If set to true, client protocol will
- be preserved while initiating connection to backend.
- type: boolean
- type: object
- tcp:
- description: Settings common to both HTTP and TCP upstream
- connections.
- properties:
- connectTimeout:
- description: TCP connection timeout.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- idleTimeout:
- description: The idle timeout for TCP connections.
- type: string
- maxConnectionDuration:
- description: The maximum duration of a connection.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- maxConnections:
- description: Maximum number of HTTP1 /TCP connections
- to a destination host.
- format: int32
- type: integer
- tcpKeepalive:
- description: If set then set SO_KEEPALIVE on the
- socket to enable TCP Keepalives.
- properties:
- interval:
- description: The time duration between keep-alive
- probes.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- probes:
- description: Maximum number of keepalive probes
- to send without response before deciding the
- connection is dead.
- maximum: 4294967295
- minimum: 0
- type: integer
- time:
- description: The time duration a connection
- needs to be idle before keep-alive probes
- start being sent.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- type: object
- type: object
- type: object
- loadBalancer:
- description: Settings controlling the load balancer algorithms.
- oneOf:
- - not:
- anyOf:
- - required:
- - simple
- - required:
- - consistentHash
- - required:
- - simple
- - required:
- - consistentHash
- properties:
- consistentHash:
- allOf:
- - oneOf:
- - not:
- anyOf:
- - required:
- - httpHeaderName
- - required:
- - httpCookie
- - required:
- - useSourceIp
- - required:
- - httpQueryParameterName
- - required:
- - httpHeaderName
- - required:
- - httpCookie
- - required:
- - useSourceIp
- - required:
- - httpQueryParameterName
- - oneOf:
- - not:
- anyOf:
- - required:
- - ringHash
- - required:
- - maglev
- - required:
- - ringHash
- - required:
- - maglev
- properties:
- httpCookie:
- description: Hash based on HTTP cookie.
- properties:
- name:
- description: Name of the cookie.
- type: string
- path:
- description: Path to set for the cookie.
- type: string
- ttl:
- description: Lifetime of the cookie.
- type: string
- required:
- - name
- type: object
- httpHeaderName:
- description: Hash based on a specific HTTP header.
- type: string
- httpQueryParameterName:
- description: Hash based on a specific HTTP query
- parameter.
- type: string
- maglev:
- description: The Maglev load balancer implements
- consistent hashing to backend hosts.
- properties:
- tableSize:
- description: The table size for Maglev hashing.
- minimum: 0
- type: integer
- type: object
- minimumRingSize:
- description: Deprecated.
- minimum: 0
- type: integer
- ringHash:
- description: The ring/modulo hash load balancer
- implements consistent hashing to backend hosts.
- properties:
- minimumRingSize:
- description: The minimum number of virtual nodes
- to use for the hash ring.
- minimum: 0
- type: integer
- type: object
- useSourceIp:
- description: Hash based on the source IP address.
- type: boolean
- type: object
- localityLbSetting:
- properties:
- distribute:
- description: 'Optional: only one of distribute,
- failover or failoverPriority can be set.'
- items:
- properties:
- from:
- description: Originating locality, '/' separated,
- e.g.
- type: string
- to:
- additionalProperties:
- maximum: 4294967295
- minimum: 0
- type: integer
- description: Map of upstream localities to
- traffic distribution weights.
- type: object
- type: object
- type: array
- enabled:
- description: Enable locality load balancing.
- nullable: true
- type: boolean
- failover:
- description: 'Optional: only one of distribute,
- failover or failoverPriority can be set.'
- items:
- properties:
- from:
- description: Originating region.
- type: string
- to:
- description: Destination region the traffic
- will fail over to when endpoints in the
- 'from' region becomes unhealthy.
- type: string
- type: object
- type: array
- failoverPriority:
- description: failoverPriority is an ordered list
- of labels used to sort endpoints to do priority
- based load balancing.
- items:
- type: string
- type: array
- type: object
- simple:
- description: |2-
-
-
- Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST
- enum:
- - UNSPECIFIED
- - LEAST_CONN
- - RANDOM
- - PASSTHROUGH
- - ROUND_ROBIN
- - LEAST_REQUEST
- type: string
- warmup:
- description: Represents the warmup configuration of
- Service.
- properties:
- aggression:
- description: This parameter controls the speed of
- traffic increase over the warmup duration.
- format: double
- minimum: 1
- nullable: true
- type: number
- duration:
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- minimumPercent:
- format: double
- maximum: 100
- minimum: 0
- nullable: true
- type: number
- required:
- - duration
- type: object
- warmupDurationSecs:
- description: 'Deprecated: use `warmup` instead.'
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- type: object
- outlierDetection:
- properties:
- baseEjectionTime:
- description: Minimum ejection duration.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- consecutive5xxErrors:
- description: Number of 5xx errors before a host is ejected
- from the connection pool.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- consecutiveErrors:
- format: int32
- type: integer
- consecutiveGatewayErrors:
- description: Number of gateway errors before a host
- is ejected from the connection pool.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- consecutiveLocalOriginFailures:
- description: The number of consecutive locally originated
- failures before ejection occurs.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- interval:
- description: Time interval between ejection sweep analysis.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- maxEjectionPercent:
- description: Maximum % of hosts in the load balancing
- pool for the upstream service that can be ejected.
- format: int32
- type: integer
- minHealthPercent:
- description: Outlier detection will be enabled as long
- as the associated load balancing pool has at least
- `minHealthPercent` hosts in healthy mode.
- format: int32
- type: integer
- splitExternalLocalOriginErrors:
- description: Determines whether to distinguish local
- origin failures from external errors.
- type: boolean
- type: object
- portLevelSettings:
- description: Traffic policies specific to individual ports.
- items:
- properties:
- connectionPool:
- properties:
- http:
- description: HTTP connection pool settings.
- properties:
- h2UpgradePolicy:
- description: |-
- Specify if http1.1 connection should be upgraded to http2 for the associated destination.
-
- Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE
- enum:
- - DEFAULT
- - DO_NOT_UPGRADE
- - UPGRADE
- type: string
- http1MaxPendingRequests:
- description: Maximum number of requests that
- will be queued while waiting for a ready
- connection pool connection.
- format: int32
- type: integer
- http2MaxRequests:
- description: Maximum number of active requests
- to a destination.
- format: int32
- type: integer
- idleTimeout:
- description: The idle timeout for upstream
- connection pool connections.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- maxConcurrentStreams:
- description: The maximum number of concurrent
- streams allowed for a peer on one HTTP/2
- connection.
- format: int32
- type: integer
- maxRequestsPerConnection:
- description: Maximum number of requests per
- connection to a backend.
- format: int32
- type: integer
- maxRetries:
- description: Maximum number of retries that
- can be outstanding to all hosts in a cluster
- at a given time.
- format: int32
- type: integer
- useClientProtocol:
- description: If set to true, client protocol
- will be preserved while initiating connection
- to backend.
- type: boolean
- type: object
- tcp:
- description: Settings common to both HTTP and
- TCP upstream connections.
- properties:
- connectTimeout:
- description: TCP connection timeout.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- idleTimeout:
- description: The idle timeout for TCP connections.
- type: string
- maxConnectionDuration:
- description: The maximum duration of a connection.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- maxConnections:
- description: Maximum number of HTTP1 /TCP
- connections to a destination host.
- format: int32
- type: integer
- tcpKeepalive:
- description: If set then set SO_KEEPALIVE
- on the socket to enable TCP Keepalives.
- properties:
- interval:
- description: The time duration between
- keep-alive probes.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- probes:
- description: Maximum number of keepalive
- probes to send without response before
- deciding the connection is dead.
- maximum: 4294967295
- minimum: 0
- type: integer
- time:
- description: The time duration a connection
- needs to be idle before keep-alive probes
- start being sent.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- type: object
- type: object
- type: object
- loadBalancer:
- description: Settings controlling the load balancer
- algorithms.
- oneOf:
- - not:
- anyOf:
- - required:
- - simple
- - required:
- - consistentHash
- - required:
- - simple
- - required:
- - consistentHash
- properties:
- consistentHash:
- allOf:
- - oneOf:
- - not:
- anyOf:
- - required:
- - httpHeaderName
- - required:
- - httpCookie
- - required:
- - useSourceIp
- - required:
- - httpQueryParameterName
- - required:
- - httpHeaderName
- - required:
- - httpCookie
- - required:
- - useSourceIp
- - required:
- - httpQueryParameterName
- - oneOf:
- - not:
- anyOf:
- - required:
- - ringHash
- - required:
- - maglev
- - required:
- - ringHash
- - required:
- - maglev
- properties:
- httpCookie:
- description: Hash based on HTTP cookie.
- properties:
- name:
- description: Name of the cookie.
- type: string
- path:
- description: Path to set for the cookie.
- type: string
- ttl:
- description: Lifetime of the cookie.
- type: string
- required:
- - name
- type: object
- httpHeaderName:
- description: Hash based on a specific HTTP
- header.
- type: string
- httpQueryParameterName:
- description: Hash based on a specific HTTP
- query parameter.
- type: string
- maglev:
- description: The Maglev load balancer implements
- consistent hashing to backend hosts.
- properties:
- tableSize:
- description: The table size for Maglev
- hashing.
- minimum: 0
- type: integer
- type: object
- minimumRingSize:
- description: Deprecated.
- minimum: 0
- type: integer
- ringHash:
- description: The ring/modulo hash load balancer
- implements consistent hashing to backend
- hosts.
- properties:
- minimumRingSize:
- description: The minimum number of virtual
- nodes to use for the hash ring.
- minimum: 0
- type: integer
- type: object
- useSourceIp:
- description: Hash based on the source IP address.
- type: boolean
- type: object
- localityLbSetting:
- properties:
- distribute:
- description: 'Optional: only one of distribute,
- failover or failoverPriority can be set.'
- items:
- properties:
- from:
- description: Originating locality, '/'
- separated, e.g.
- type: string
- to:
- additionalProperties:
- maximum: 4294967295
- minimum: 0
- type: integer
- description: Map of upstream localities
- to traffic distribution weights.
- type: object
- type: object
- type: array
- enabled:
- description: Enable locality load balancing.
- nullable: true
- type: boolean
- failover:
- description: 'Optional: only one of distribute,
- failover or failoverPriority can be set.'
- items:
- properties:
- from:
- description: Originating region.
- type: string
- to:
- description: Destination region the
- traffic will fail over to when endpoints
- in the 'from' region becomes unhealthy.
- type: string
- type: object
- type: array
- failoverPriority:
- description: failoverPriority is an ordered
- list of labels used to sort endpoints to
- do priority based load balancing.
- items:
- type: string
- type: array
- type: object
- simple:
- description: |2-
-
-
- Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST
- enum:
- - UNSPECIFIED
- - LEAST_CONN
- - RANDOM
- - PASSTHROUGH
- - ROUND_ROBIN
- - LEAST_REQUEST
- type: string
- warmup:
- description: Represents the warmup configuration
- of Service.
- properties:
- aggression:
- description: This parameter controls the speed
- of traffic increase over the warmup duration.
- format: double
- minimum: 1
- nullable: true
- type: number
- duration:
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- minimumPercent:
- format: double
- maximum: 100
- minimum: 0
- nullable: true
- type: number
- required:
- - duration
- type: object
- warmupDurationSecs:
- description: 'Deprecated: use `warmup` instead.'
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- type: object
- outlierDetection:
- properties:
- baseEjectionTime:
- description: Minimum ejection duration.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- consecutive5xxErrors:
- description: Number of 5xx errors before a host
- is ejected from the connection pool.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- consecutiveErrors:
- format: int32
- type: integer
- consecutiveGatewayErrors:
- description: Number of gateway errors before a
- host is ejected from the connection pool.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- consecutiveLocalOriginFailures:
- description: The number of consecutive locally
- originated failures before ejection occurs.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- interval:
- description: Time interval between ejection sweep
- analysis.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- maxEjectionPercent:
- description: Maximum % of hosts in the load balancing
- pool for the upstream service that can be ejected.
- format: int32
- type: integer
- minHealthPercent:
- description: Outlier detection will be enabled
- as long as the associated load balancing pool
- has at least `minHealthPercent` hosts in healthy
- mode.
- format: int32
- type: integer
- splitExternalLocalOriginErrors:
- description: Determines whether to distinguish
- local origin failures from external errors.
- type: boolean
- type: object
- port:
- description: Specifies the number of a port on the
- destination service on which this policy is being
- applied.
- properties:
- number:
- maximum: 4294967295
- minimum: 0
- type: integer
- type: object
- tls:
- description: TLS related settings for connections
- to the upstream service.
- properties:
- caCertificates:
- description: 'OPTIONAL: The path to the file containing
- certificate authority certificates to use in
- verifying a presented server certificate.'
- type: string
- caCrl:
- description: 'OPTIONAL: The path to the file containing
- the certificate revocation list (CRL) to use
- in verifying a presented server certificate.'
- type: string
- clientCertificate:
- description: REQUIRED if mode is `MUTUAL`.
- type: string
- credentialName:
- description: The name of the secret that holds
- the TLS certs for the client including the CA
- certificates.
- type: string
- insecureSkipVerify:
- description: '`insecureSkipVerify` specifies whether
- the proxy should skip verifying the CA signature
- and SAN for the server certificate corresponding
- to the host.'
- nullable: true
- type: boolean
- mode:
- description: |-
- Indicates whether connections to this port should be secured using TLS.
-
- Valid Options: DISABLE, SIMPLE, MUTUAL, dubbo_MUTUAL
- enum:
- - DISABLE
- - SIMPLE
- - MUTUAL
- - dubbo_MUTUAL
- type: string
- privateKey:
- description: REQUIRED if mode is `MUTUAL`.
- type: string
- sni:
- description: SNI string to present to the server
- during TLS handshake.
- type: string
- subjectAltNames:
- description: A list of alternate names to verify
- the subject identity in the certificate.
- items:
- type: string
- type: array
- type: object
- type: object
- maxItems: 4096
- type: array
- proxyProtocol:
- description: The upstream PROXY protocol settings.
- properties:
- version:
- description: |-
- The PROXY protocol version to use.
-
- Valid Options: V1, V2
- enum:
- - V1
- - V2
- type: string
- type: object
- retryBudget:
- description: Specifies a limit on concurrent retries in
- relation to the number of active requests.
- properties:
- minRetryConcurrency:
- description: Specifies the minimum retry concurrency
- allowed for the retry budget.
- maximum: 4294967295
- minimum: 0
- type: integer
- percent:
- description: Specifies the limit on concurrent retries
- as a percentage of the sum of active requests and
- active pending requests.
- format: double
- maximum: 100
- minimum: 0
- nullable: true
- type: number
- type: object
- tls:
- description: TLS related settings for connections to the
- upstream service.
- properties:
- caCertificates:
- description: 'OPTIONAL: The path to the file containing
- certificate authority certificates to use in verifying
- a presented server certificate.'
- type: string
- caCrl:
- description: 'OPTIONAL: The path to the file containing
- the certificate revocation list (CRL) to use in verifying
- a presented server certificate.'
- type: string
- clientCertificate:
- description: REQUIRED if mode is `MUTUAL`.
- type: string
- credentialName:
- description: The name of the secret that holds the TLS
- certs for the client including the CA certificates.
- type: string
- insecureSkipVerify:
- description: '`insecureSkipVerify` specifies whether
- the proxy should skip verifying the CA signature and
- SAN for the server certificate corresponding to the
- host.'
- nullable: true
- type: boolean
- mode:
- description: |-
- Indicates whether connections to this port should be secured using TLS.
-
- Valid Options: DISABLE, SIMPLE, MUTUAL, dubbo_MUTUAL
- enum:
- - DISABLE
- - SIMPLE
- - MUTUAL
- - dubbo_MUTUAL
- type: string
- privateKey:
- description: REQUIRED if mode is `MUTUAL`.
- type: string
- sni:
- description: SNI string to present to the server during
- TLS handshake.
- type: string
- subjectAltNames:
- description: A list of alternate names to verify the
- subject identity in the certificate.
- items:
- type: string
- type: array
- type: object
- tunnel:
- description: Configuration of tunneling TCP over other transport
- or application layers for the host configured in the DestinationRule.
- properties:
- protocol:
- description: Specifies which protocol to use for tunneling
- the downstream connection.
- type: string
- targetHost:
- description: Specifies a host to which the downstream
- connection is tunneled.
- type: string
- targetPort:
- description: Specifies a port to which the downstream
- connection is tunneled.
- maximum: 4294967295
- minimum: 0
- type: integer
- required:
- - targetHost
- - targetPort
- type: object
- type: object
- required:
- - name
- type: object
- type: array
- trafficPolicy:
- description: Traffic policies to apply (load balancing policy, connection
- pool sizes, outlier detection).
- properties:
- connectionPool:
- properties:
- http:
- description: HTTP connection pool settings.
- properties:
- h2UpgradePolicy:
- description: |-
- Specify if http1.1 connection should be upgraded to http2 for the associated destination.
-
- Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE
- enum:
- - DEFAULT
- - DO_NOT_UPGRADE
- - UPGRADE
- type: string
- http1MaxPendingRequests:
- description: Maximum number of requests that will be queued
- while waiting for a ready connection pool connection.
- format: int32
- type: integer
- http2MaxRequests:
- description: Maximum number of active requests to a destination.
- format: int32
- type: integer
- idleTimeout:
- description: The idle timeout for upstream connection
- pool connections.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- maxConcurrentStreams:
- description: The maximum number of concurrent streams
- allowed for a peer on one HTTP/2 connection.
- format: int32
- type: integer
- maxRequestsPerConnection:
- description: Maximum number of requests per connection
- to a backend.
- format: int32
- type: integer
- maxRetries:
- description: Maximum number of retries that can be outstanding
- to all hosts in a cluster at a given time.
- format: int32
- type: integer
- useClientProtocol:
- description: If set to true, client protocol will be preserved
- while initiating connection to backend.
- type: boolean
- type: object
- tcp:
- description: Settings common to both HTTP and TCP upstream
- connections.
- properties:
- connectTimeout:
- description: TCP connection timeout.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- idleTimeout:
- description: The idle timeout for TCP connections.
- type: string
- maxConnectionDuration:
- description: The maximum duration of a connection.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- maxConnections:
- description: Maximum number of HTTP1 /TCP connections
- to a destination host.
- format: int32
- type: integer
- tcpKeepalive:
- description: If set then set SO_KEEPALIVE on the socket
- to enable TCP Keepalives.
- properties:
- interval:
- description: The time duration between keep-alive
- probes.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- probes:
- description: Maximum number of keepalive probes to
- send without response before deciding the connection
- is dead.
- maximum: 4294967295
- minimum: 0
- type: integer
- time:
- description: The time duration a connection needs
- to be idle before keep-alive probes start being
- sent.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- type: object
- type: object
- type: object
- loadBalancer:
- description: Settings controlling the load balancer algorithms.
- oneOf:
- - not:
- anyOf:
- - required:
- - simple
- - required:
- - consistentHash
- - required:
- - simple
- - required:
- - consistentHash
- properties:
- consistentHash:
- allOf:
- - oneOf:
- - not:
- anyOf:
- - required:
- - httpHeaderName
- - required:
- - httpCookie
- - required:
- - useSourceIp
- - required:
- - httpQueryParameterName
- - required:
- - httpHeaderName
- - required:
- - httpCookie
- - required:
- - useSourceIp
- - required:
- - httpQueryParameterName
- - oneOf:
- - not:
- anyOf:
- - required:
- - ringHash
- - required:
- - maglev
- - required:
- - ringHash
- - required:
- - maglev
- properties:
- httpCookie:
- description: Hash based on HTTP cookie.
- properties:
- name:
- description: Name of the cookie.
- type: string
- path:
- description: Path to set for the cookie.
- type: string
- ttl:
- description: Lifetime of the cookie.
- type: string
- required:
- - name
- type: object
- httpHeaderName:
- description: Hash based on a specific HTTP header.
- type: string
- httpQueryParameterName:
- description: Hash based on a specific HTTP query parameter.
- type: string
- maglev:
- description: The Maglev load balancer implements consistent
- hashing to backend hosts.
- properties:
- tableSize:
- description: The table size for Maglev hashing.
- minimum: 0
- type: integer
- type: object
- minimumRingSize:
- description: Deprecated.
- minimum: 0
- type: integer
- ringHash:
- description: The ring/modulo hash load balancer implements
- consistent hashing to backend hosts.
- properties:
- minimumRingSize:
- description: The minimum number of virtual nodes to
- use for the hash ring.
- minimum: 0
- type: integer
- type: object
- useSourceIp:
- description: Hash based on the source IP address.
- type: boolean
- type: object
- localityLbSetting:
- properties:
- distribute:
- description: 'Optional: only one of distribute, failover
- or failoverPriority can be set.'
- items:
- properties:
- from:
- description: Originating locality, '/' separated,
- e.g.
- type: string
- to:
- additionalProperties:
- maximum: 4294967295
- minimum: 0
- type: integer
- description: Map of upstream localities to traffic
- distribution weights.
- type: object
- type: object
- type: array
- enabled:
- description: Enable locality load balancing.
- nullable: true
- type: boolean
- failover:
- description: 'Optional: only one of distribute, failover
- or failoverPriority can be set.'
- items:
- properties:
- from:
- description: Originating region.
- type: string
- to:
- description: Destination region the traffic will
- fail over to when endpoints in the 'from' region
- becomes unhealthy.
- type: string
- type: object
- type: array
- failoverPriority:
- description: failoverPriority is an ordered list of labels
- used to sort endpoints to do priority based load balancing.
- items:
- type: string
- type: array
- type: object
- simple:
- description: |2-
-
-
- Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST
- enum:
- - UNSPECIFIED
- - LEAST_CONN
- - RANDOM
- - PASSTHROUGH
- - ROUND_ROBIN
- - LEAST_REQUEST
- type: string
- warmup:
- description: Represents the warmup configuration of Service.
- properties:
- aggression:
- description: This parameter controls the speed of traffic
- increase over the warmup duration.
- format: double
- minimum: 1
- nullable: true
- type: number
- duration:
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- minimumPercent:
- format: double
- maximum: 100
- minimum: 0
- nullable: true
- type: number
- required:
- - duration
- type: object
- warmupDurationSecs:
- description: 'Deprecated: use `warmup` instead.'
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- type: object
- outlierDetection:
- properties:
- baseEjectionTime:
- description: Minimum ejection duration.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- consecutive5xxErrors:
- description: Number of 5xx errors before a host is ejected
- from the connection pool.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- consecutiveErrors:
- format: int32
- type: integer
- consecutiveGatewayErrors:
- description: Number of gateway errors before a host is ejected
- from the connection pool.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- consecutiveLocalOriginFailures:
- description: The number of consecutive locally originated
- failures before ejection occurs.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- interval:
- description: Time interval between ejection sweep analysis.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- maxEjectionPercent:
- description: Maximum % of hosts in the load balancing pool
- for the upstream service that can be ejected.
- format: int32
- type: integer
- minHealthPercent:
- description: Outlier detection will be enabled as long as
- the associated load balancing pool has at least `minHealthPercent`
- hosts in healthy mode.
- format: int32
- type: integer
- splitExternalLocalOriginErrors:
- description: Determines whether to distinguish local origin
- failures from external errors.
- type: boolean
- type: object
- portLevelSettings:
- description: Traffic policies specific to individual ports.
- items:
- properties:
- connectionPool:
- properties:
- http:
- description: HTTP connection pool settings.
- properties:
- h2UpgradePolicy:
- description: |-
- Specify if http1.1 connection should be upgraded to http2 for the associated destination.
-
- Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE
- enum:
- - DEFAULT
- - DO_NOT_UPGRADE
- - UPGRADE
- type: string
- http1MaxPendingRequests:
- description: Maximum number of requests that will
- be queued while waiting for a ready connection
- pool connection.
- format: int32
- type: integer
- http2MaxRequests:
- description: Maximum number of active requests to
- a destination.
- format: int32
- type: integer
- idleTimeout:
- description: The idle timeout for upstream connection
- pool connections.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- maxConcurrentStreams:
- description: The maximum number of concurrent streams
- allowed for a peer on one HTTP/2 connection.
- format: int32
- type: integer
- maxRequestsPerConnection:
- description: Maximum number of requests per connection
- to a backend.
- format: int32
- type: integer
- maxRetries:
- description: Maximum number of retries that can
- be outstanding to all hosts in a cluster at a
- given time.
- format: int32
- type: integer
- useClientProtocol:
- description: If set to true, client protocol will
- be preserved while initiating connection to backend.
- type: boolean
- type: object
- tcp:
- description: Settings common to both HTTP and TCP upstream
- connections.
- properties:
- connectTimeout:
- description: TCP connection timeout.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- idleTimeout:
- description: The idle timeout for TCP connections.
- type: string
- maxConnectionDuration:
- description: The maximum duration of a connection.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- maxConnections:
- description: Maximum number of HTTP1 /TCP connections
- to a destination host.
- format: int32
- type: integer
- tcpKeepalive:
- description: If set then set SO_KEEPALIVE on the
- socket to enable TCP Keepalives.
- properties:
- interval:
- description: The time duration between keep-alive
- probes.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- probes:
- description: Maximum number of keepalive probes
- to send without response before deciding the
- connection is dead.
- maximum: 4294967295
- minimum: 0
- type: integer
- time:
- description: The time duration a connection
- needs to be idle before keep-alive probes
- start being sent.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- type: object
- type: object
- type: object
- loadBalancer:
- description: Settings controlling the load balancer algorithms.
- oneOf:
- - not:
- anyOf:
- - required:
- - simple
- - required:
- - consistentHash
- - required:
- - simple
- - required:
- - consistentHash
- properties:
- consistentHash:
- allOf:
- - oneOf:
- - not:
- anyOf:
- - required:
- - httpHeaderName
- - required:
- - httpCookie
- - required:
- - useSourceIp
- - required:
- - httpQueryParameterName
- - required:
- - httpHeaderName
- - required:
- - httpCookie
- - required:
- - useSourceIp
- - required:
- - httpQueryParameterName
- - oneOf:
- - not:
- anyOf:
- - required:
- - ringHash
- - required:
- - maglev
- - required:
- - ringHash
- - required:
- - maglev
- properties:
- httpCookie:
- description: Hash based on HTTP cookie.
- properties:
- name:
- description: Name of the cookie.
- type: string
- path:
- description: Path to set for the cookie.
- type: string
- ttl:
- description: Lifetime of the cookie.
- type: string
- required:
- - name
- type: object
- httpHeaderName:
- description: Hash based on a specific HTTP header.
- type: string
- httpQueryParameterName:
- description: Hash based on a specific HTTP query
- parameter.
- type: string
- maglev:
- description: The Maglev load balancer implements
- consistent hashing to backend hosts.
- properties:
- tableSize:
- description: The table size for Maglev hashing.
- minimum: 0
- type: integer
- type: object
- minimumRingSize:
- description: Deprecated.
- minimum: 0
- type: integer
- ringHash:
- description: The ring/modulo hash load balancer
- implements consistent hashing to backend hosts.
- properties:
- minimumRingSize:
- description: The minimum number of virtual nodes
- to use for the hash ring.
- minimum: 0
- type: integer
- type: object
- useSourceIp:
- description: Hash based on the source IP address.
- type: boolean
- type: object
- localityLbSetting:
- properties:
- distribute:
- description: 'Optional: only one of distribute,
- failover or failoverPriority can be set.'
- items:
- properties:
- from:
- description: Originating locality, '/' separated,
- e.g.
- type: string
- to:
- additionalProperties:
- maximum: 4294967295
- minimum: 0
- type: integer
- description: Map of upstream localities to
- traffic distribution weights.
- type: object
- type: object
- type: array
- enabled:
- description: Enable locality load balancing.
- nullable: true
- type: boolean
- failover:
- description: 'Optional: only one of distribute,
- failover or failoverPriority can be set.'
- items:
- properties:
- from:
- description: Originating region.
- type: string
- to:
- description: Destination region the traffic
- will fail over to when endpoints in the
- 'from' region becomes unhealthy.
- type: string
- type: object
- type: array
- failoverPriority:
- description: failoverPriority is an ordered list
- of labels used to sort endpoints to do priority
- based load balancing.
- items:
- type: string
- type: array
- type: object
- simple:
- description: |2-
-
-
- Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST
- enum:
- - UNSPECIFIED
- - LEAST_CONN
- - RANDOM
- - PASSTHROUGH
- - ROUND_ROBIN
- - LEAST_REQUEST
- type: string
- warmup:
- description: Represents the warmup configuration of
- Service.
- properties:
- aggression:
- description: This parameter controls the speed of
- traffic increase over the warmup duration.
- format: double
- minimum: 1
- nullable: true
- type: number
- duration:
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- minimumPercent:
- format: double
- maximum: 100
- minimum: 0
- nullable: true
- type: number
- required:
- - duration
- type: object
- warmupDurationSecs:
- description: 'Deprecated: use `warmup` instead.'
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- type: object
- outlierDetection:
- properties:
- baseEjectionTime:
- description: Minimum ejection duration.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- consecutive5xxErrors:
- description: Number of 5xx errors before a host is ejected
- from the connection pool.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- consecutiveErrors:
- format: int32
- type: integer
- consecutiveGatewayErrors:
- description: Number of gateway errors before a host
- is ejected from the connection pool.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- consecutiveLocalOriginFailures:
- description: The number of consecutive locally originated
- failures before ejection occurs.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- interval:
- description: Time interval between ejection sweep analysis.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- maxEjectionPercent:
- description: Maximum % of hosts in the load balancing
- pool for the upstream service that can be ejected.
- format: int32
- type: integer
- minHealthPercent:
- description: Outlier detection will be enabled as long
- as the associated load balancing pool has at least
- `minHealthPercent` hosts in healthy mode.
- format: int32
- type: integer
- splitExternalLocalOriginErrors:
- description: Determines whether to distinguish local
- origin failures from external errors.
- type: boolean
- type: object
- port:
- description: Specifies the number of a port on the destination
- service on which this policy is being applied.
- properties:
- number:
- maximum: 4294967295
- minimum: 0
- type: integer
- type: object
- tls:
- description: TLS related settings for connections to the
- upstream service.
- properties:
- caCertificates:
- description: 'OPTIONAL: The path to the file containing
- certificate authority certificates to use in verifying
- a presented server certificate.'
- type: string
- caCrl:
- description: 'OPTIONAL: The path to the file containing
- the certificate revocation list (CRL) to use in verifying
- a presented server certificate.'
- type: string
- clientCertificate:
- description: REQUIRED if mode is `MUTUAL`.
- type: string
- credentialName:
- description: The name of the secret that holds the TLS
- certs for the client including the CA certificates.
- type: string
- insecureSkipVerify:
- description: '`insecureSkipVerify` specifies whether
- the proxy should skip verifying the CA signature and
- SAN for the server certificate corresponding to the
- host.'
- nullable: true
- type: boolean
- mode:
- description: |-
- Indicates whether connections to this port should be secured using TLS.
-
- Valid Options: DISABLE, SIMPLE, MUTUAL, dubbo_MUTUAL
- enum:
- - DISABLE
- - SIMPLE
- - MUTUAL
- - dubbo_MUTUAL
- type: string
- privateKey:
- description: REQUIRED if mode is `MUTUAL`.
- type: string
- sni:
- description: SNI string to present to the server during
- TLS handshake.
- type: string
- subjectAltNames:
- description: A list of alternate names to verify the
- subject identity in the certificate.
- items:
- type: string
- type: array
- type: object
- type: object
- maxItems: 4096
- type: array
- proxyProtocol:
- description: The upstream PROXY protocol settings.
- properties:
- version:
- description: |-
- The PROXY protocol version to use.
-
- Valid Options: V1, V2
- enum:
- - V1
- - V2
- type: string
- type: object
- retryBudget:
- description: Specifies a limit on concurrent retries in relation
- to the number of active requests.
- properties:
- minRetryConcurrency:
- description: Specifies the minimum retry concurrency allowed
- for the retry budget.
- maximum: 4294967295
- minimum: 0
- type: integer
- percent:
- description: Specifies the limit on concurrent retries as
- a percentage of the sum of active requests and active pending
- requests.
- format: double
- maximum: 100
- minimum: 0
- nullable: true
- type: number
- type: object
- tls:
- description: TLS related settings for connections to the upstream
- service.
- properties:
- caCertificates:
- description: 'OPTIONAL: The path to the file containing certificate
- authority certificates to use in verifying a presented server
- certificate.'
- type: string
- caCrl:
- description: 'OPTIONAL: The path to the file containing the
- certificate revocation list (CRL) to use in verifying a
- presented server certificate.'
- type: string
- clientCertificate:
- description: REQUIRED if mode is `MUTUAL`.
- type: string
- credentialName:
- description: The name of the secret that holds the TLS certs
- for the client including the CA certificates.
- type: string
- insecureSkipVerify:
- description: '`insecureSkipVerify` specifies whether the proxy
- should skip verifying the CA signature and SAN for the server
- certificate corresponding to the host.'
- nullable: true
- type: boolean
- mode:
- description: |-
- Indicates whether connections to this port should be secured using TLS.
-
- Valid Options: DISABLE, SIMPLE, MUTUAL, dubbo_MUTUAL
- enum:
- - DISABLE
- - SIMPLE
- - MUTUAL
- - dubbo_MUTUAL
- type: string
- privateKey:
- description: REQUIRED if mode is `MUTUAL`.
- type: string
- sni:
- description: SNI string to present to the server during TLS
- handshake.
- type: string
- subjectAltNames:
- description: A list of alternate names to verify the subject
- identity in the certificate.
- items:
- type: string
- type: array
- type: object
- tunnel:
- description: Configuration of tunneling TCP over other transport
- or application layers for the host configured in the DestinationRule.
- properties:
- protocol:
- description: Specifies which protocol to use for tunneling
- the downstream connection.
- type: string
- targetHost:
- description: Specifies a host to which the downstream connection
- is tunneled.
- type: string
- targetPort:
- description: Specifies a port to which the downstream connection
- is tunneled.
- maximum: 4294967295
- minimum: 0
- type: integer
- required:
- - targetHost
- - targetPort
- type: object
- type: object
- workloadSelector:
- description: Criteria used to select the specific set of pods/VMs
- on which this `DestinationRule` configuration should be applied.
- properties:
- matchLabels:
- additionalProperties:
- maxLength: 63
- type: string
- x-kubernetes-validations:
- - message: wildcard not allowed in label value match
- rule: '!self.contains("*")'
- description: One or more labels that indicate a specific set of
- pods/VMs on which a policy should be applied.
- maxProperties: 4096
- type: object
- x-kubernetes-validations:
- - message: wildcard not allowed in label key match
- rule: self.all(key, !key.contains("*"))
- - message: key must not be empty
- rule: self.all(key, key.size() != 0)
- type: object
- required:
- - host
- type: object
- status:
- properties:
- conditions:
- description: Current service state of the resource.
- items:
- properties:
- lastProbeTime:
- description: Last time we probed the condition.
- format: date-time
- type: string
- lastTransitionTime:
- description: Last time the condition transitioned from one status
- to another.
- format: date-time
- type: string
- message:
- description: Human-readable message indicating details about
- last transition.
- type: string
- observedGeneration:
- anyOf:
- - type: integer
- - type: string
- description: Resource Generation to which the Condition refers.
- x-kubernetes-int-or-string: true
- reason:
- description: Unique, one-word, CamelCase reason for the condition's
- last transition.
- type: string
- status:
- description: Status is the status of the condition.
- type: string
- type:
- description: Type is the type of the condition.
- type: string
- type: object
- type: array
- observedGeneration:
- anyOf:
- - type: integer
- - type: string
- x-kubernetes-int-or-string: true
- validationMessages:
- description: Includes any errors or warnings detected by dubbo's analyzers.
- items:
- properties:
- documentationUrl:
- description: A url pointing to the dubbo documentation for this
- specific error type.
- type: string
- level:
- description: |-
- Represents how severe a message is.
-
- Valid Options: UNKNOWN, ERROR, WARNING, INFO
- enum:
- - UNKNOWN
- - ERROR
- - WARNING
- - INFO
- type: string
- type:
- properties:
- code:
- description: A 7 character code matching `^IST[0-9]{4}$`
- intended to uniquely identify the message type.
- type: string
- name:
- description: A human-readable name for the message type.
- type: string
- type: object
- type: object
- type: array
- type: object
- x-kubernetes-preserve-unknown-fields: true
- type: object
- served: true
- storage: true
- subresources:
- status: {}
- - additionalPrinterColumns:
- - description: The name of a service from the service registry
- jsonPath: .spec.host
- name: Host
- type: string
- - description: CreationTimestamp is a timestamp representing the server time when
- this object was created. It is not guaranteed to be set in happens-before
- order across separate operations. Clients may not set this value. It is represented
- in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for
- lists. For more information, see [Kubernetes API Conventions](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata)
- jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- name: v1alpha3
- schema:
- openAPIV3Schema:
- properties:
- spec:
- description: 'Configuration affecting load balancing, outlier detection.'
- properties:
- exportTo:
- description: A list of namespaces to which this destination rule is
- exported.
- items:
- type: string
- type: array
- host:
- description: The name of a service from the service registry.
- type: string
- subsets:
- description: One or more named sets that represent individual versions
- of a service.
- items:
- properties:
- labels:
- additionalProperties:
- type: string
- description: Labels apply a filter over the endpoints of a service
- in the service registry.
- type: object
- name:
- description: Name of the subset.
- type: string
- trafficPolicy:
- description: Traffic policies that apply to this subset.
- properties:
- connectionPool:
- properties:
- http:
- description: HTTP connection pool settings.
- properties:
- h2UpgradePolicy:
- description: |-
- Specify if http1.1 connection should be upgraded to http2 for the associated destination.
-
- Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE
- enum:
- - DEFAULT
- - DO_NOT_UPGRADE
- - UPGRADE
- type: string
- http1MaxPendingRequests:
- description: Maximum number of requests that will
- be queued while waiting for a ready connection
- pool connection.
- format: int32
- type: integer
- http2MaxRequests:
- description: Maximum number of active requests to
- a destination.
- format: int32
- type: integer
- idleTimeout:
- description: The idle timeout for upstream connection
- pool connections.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- maxConcurrentStreams:
- description: The maximum number of concurrent streams
- allowed for a peer on one HTTP/2 connection.
- format: int32
- type: integer
- maxRequestsPerConnection:
- description: Maximum number of requests per connection
- to a backend.
- format: int32
- type: integer
- maxRetries:
- description: Maximum number of retries that can
- be outstanding to all hosts in a cluster at a
- given time.
- format: int32
- type: integer
- useClientProtocol:
- description: If set to true, client protocol will
- be preserved while initiating connection to backend.
- type: boolean
- type: object
- tcp:
- description: Settings common to both HTTP and TCP upstream
- connections.
- properties:
- connectTimeout:
- description: TCP connection timeout.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- idleTimeout:
- description: The idle timeout for TCP connections.
- type: string
- maxConnectionDuration:
- description: The maximum duration of a connection.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- maxConnections:
- description: Maximum number of HTTP1 /TCP connections
- to a destination host.
- format: int32
- type: integer
- tcpKeepalive:
- description: If set then set SO_KEEPALIVE on the
- socket to enable TCP Keepalives.
- properties:
- interval:
- description: The time duration between keep-alive
- probes.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- probes:
- description: Maximum number of keepalive probes
- to send without response before deciding the
- connection is dead.
- maximum: 4294967295
- minimum: 0
- type: integer
- time:
- description: The time duration a connection
- needs to be idle before keep-alive probes
- start being sent.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- type: object
- type: object
- type: object
- loadBalancer:
- description: Settings controlling the load balancer algorithms.
- oneOf:
- - not:
- anyOf:
- - required:
- - simple
- - required:
- - consistentHash
- - required:
- - simple
- - required:
- - consistentHash
- properties:
- consistentHash:
- allOf:
- - oneOf:
- - not:
- anyOf:
- - required:
- - httpHeaderName
- - required:
- - httpCookie
- - required:
- - useSourceIp
- - required:
- - httpQueryParameterName
- - required:
- - httpHeaderName
- - required:
- - httpCookie
- - required:
- - useSourceIp
- - required:
- - httpQueryParameterName
- - oneOf:
- - not:
- anyOf:
- - required:
- - ringHash
- - required:
- - maglev
- - required:
- - ringHash
- - required:
- - maglev
- properties:
- httpCookie:
- description: Hash based on HTTP cookie.
- properties:
- name:
- description: Name of the cookie.
- type: string
- path:
- description: Path to set for the cookie.
- type: string
- ttl:
- description: Lifetime of the cookie.
- type: string
- required:
- - name
- type: object
- httpHeaderName:
- description: Hash based on a specific HTTP header.
- type: string
- httpQueryParameterName:
- description: Hash based on a specific HTTP query
- parameter.
- type: string
- maglev:
- description: The Maglev load balancer implements
- consistent hashing to backend hosts.
- properties:
- tableSize:
- description: The table size for Maglev hashing.
- minimum: 0
- type: integer
- type: object
- minimumRingSize:
- description: Deprecated.
- minimum: 0
- type: integer
- ringHash:
- description: The ring/modulo hash load balancer
- implements consistent hashing to backend hosts.
- properties:
- minimumRingSize:
- description: The minimum number of virtual nodes
- to use for the hash ring.
- minimum: 0
- type: integer
- type: object
- useSourceIp:
- description: Hash based on the source IP address.
- type: boolean
- type: object
- localityLbSetting:
- properties:
- distribute:
- description: 'Optional: only one of distribute,
- failover or failoverPriority can be set.'
- items:
- properties:
- from:
- description: Originating locality, '/' separated,
- e.g.
- type: string
- to:
- additionalProperties:
- maximum: 4294967295
- minimum: 0
- type: integer
- description: Map of upstream localities to
- traffic distribution weights.
- type: object
- type: object
- type: array
- enabled:
- description: Enable locality load balancing.
- nullable: true
- type: boolean
- failover:
- description: 'Optional: only one of distribute,
- failover or failoverPriority can be set.'
- items:
- properties:
- from:
- description: Originating region.
- type: string
- to:
- description: Destination region the traffic
- will fail over to when endpoints in the
- 'from' region becomes unhealthy.
- type: string
- type: object
- type: array
- failoverPriority:
- description: failoverPriority is an ordered list
- of labels used to sort endpoints to do priority
- based load balancing.
- items:
- type: string
- type: array
- type: object
- simple:
- description: |2-
-
-
- Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST
- enum:
- - UNSPECIFIED
- - LEAST_CONN
- - RANDOM
- - PASSTHROUGH
- - ROUND_ROBIN
- - LEAST_REQUEST
- type: string
- warmup:
- description: Represents the warmup configuration of
- Service.
- properties:
- aggression:
- description: This parameter controls the speed of
- traffic increase over the warmup duration.
- format: double
- minimum: 1
- nullable: true
- type: number
- duration:
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- minimumPercent:
- format: double
- maximum: 100
- minimum: 0
- nullable: true
- type: number
- required:
- - duration
- type: object
- warmupDurationSecs:
- description: 'Deprecated: use `warmup` instead.'
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- type: object
- outlierDetection:
- properties:
- baseEjectionTime:
- description: Minimum ejection duration.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- consecutive5xxErrors:
- description: Number of 5xx errors before a host is ejected
- from the connection pool.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- consecutiveErrors:
- format: int32
- type: integer
- consecutiveGatewayErrors:
- description: Number of gateway errors before a host
- is ejected from the connection pool.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- consecutiveLocalOriginFailures:
- description: The number of consecutive locally originated
- failures before ejection occurs.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- interval:
- description: Time interval between ejection sweep analysis.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- maxEjectionPercent:
- description: Maximum % of hosts in the load balancing
- pool for the upstream service that can be ejected.
- format: int32
- type: integer
- minHealthPercent:
- description: Outlier detection will be enabled as long
- as the associated load balancing pool has at least
- `minHealthPercent` hosts in healthy mode.
- format: int32
- type: integer
- splitExternalLocalOriginErrors:
- description: Determines whether to distinguish local
- origin failures from external errors.
- type: boolean
- type: object
- portLevelSettings:
- description: Traffic policies specific to individual ports.
- items:
- properties:
- connectionPool:
- properties:
- http:
- description: HTTP connection pool settings.
- properties:
- h2UpgradePolicy:
- description: |-
- Specify if http1.1 connection should be upgraded to http2 for the associated destination.
-
- Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE
- enum:
- - DEFAULT
- - DO_NOT_UPGRADE
- - UPGRADE
- type: string
- http1MaxPendingRequests:
- description: Maximum number of requests that
- will be queued while waiting for a ready
- connection pool connection.
- format: int32
- type: integer
- http2MaxRequests:
- description: Maximum number of active requests
- to a destination.
- format: int32
- type: integer
- idleTimeout:
- description: The idle timeout for upstream
- connection pool connections.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- maxConcurrentStreams:
- description: The maximum number of concurrent
- streams allowed for a peer on one HTTP/2
- connection.
- format: int32
- type: integer
- maxRequestsPerConnection:
- description: Maximum number of requests per
- connection to a backend.
- format: int32
- type: integer
- maxRetries:
- description: Maximum number of retries that
- can be outstanding to all hosts in a cluster
- at a given time.
- format: int32
- type: integer
- useClientProtocol:
- description: If set to true, client protocol
- will be preserved while initiating connection
- to backend.
- type: boolean
- type: object
- tcp:
- description: Settings common to both HTTP and
- TCP upstream connections.
- properties:
- connectTimeout:
- description: TCP connection timeout.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- idleTimeout:
- description: The idle timeout for TCP connections.
- type: string
- maxConnectionDuration:
- description: The maximum duration of a connection.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- maxConnections:
- description: Maximum number of HTTP1 /TCP
- connections to a destination host.
- format: int32
- type: integer
- tcpKeepalive:
- description: If set then set SO_KEEPALIVE
- on the socket to enable TCP Keepalives.
- properties:
- interval:
- description: The time duration between
- keep-alive probes.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- probes:
- description: Maximum number of keepalive
- probes to send without response before
- deciding the connection is dead.
- maximum: 4294967295
- minimum: 0
- type: integer
- time:
- description: The time duration a connection
- needs to be idle before keep-alive probes
- start being sent.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- type: object
- type: object
- type: object
- loadBalancer:
- description: Settings controlling the load balancer
- algorithms.
- oneOf:
- - not:
- anyOf:
- - required:
- - simple
- - required:
- - consistentHash
- - required:
- - simple
- - required:
- - consistentHash
- properties:
- consistentHash:
- allOf:
- - oneOf:
- - not:
- anyOf:
- - required:
- - httpHeaderName
- - required:
- - httpCookie
- - required:
- - useSourceIp
- - required:
- - httpQueryParameterName
- - required:
- - httpHeaderName
- - required:
- - httpCookie
- - required:
- - useSourceIp
- - required:
- - httpQueryParameterName
- - oneOf:
- - not:
- anyOf:
- - required:
- - ringHash
- - required:
- - maglev
- - required:
- - ringHash
- - required:
- - maglev
- properties:
- httpCookie:
- description: Hash based on HTTP cookie.
- properties:
- name:
- description: Name of the cookie.
- type: string
- path:
- description: Path to set for the cookie.
- type: string
- ttl:
- description: Lifetime of the cookie.
- type: string
- required:
- - name
- type: object
- httpHeaderName:
- description: Hash based on a specific HTTP
- header.
- type: string
- httpQueryParameterName:
- description: Hash based on a specific HTTP
- query parameter.
- type: string
- maglev:
- description: The Maglev load balancer implements
- consistent hashing to backend hosts.
- properties:
- tableSize:
- description: The table size for Maglev
- hashing.
- minimum: 0
- type: integer
- type: object
- minimumRingSize:
- description: Deprecated.
- minimum: 0
- type: integer
- ringHash:
- description: The ring/modulo hash load balancer
- implements consistent hashing to backend
- hosts.
- properties:
- minimumRingSize:
- description: The minimum number of virtual
- nodes to use for the hash ring.
- minimum: 0
- type: integer
- type: object
- useSourceIp:
- description: Hash based on the source IP address.
- type: boolean
- type: object
- localityLbSetting:
- properties:
- distribute:
- description: 'Optional: only one of distribute,
- failover or failoverPriority can be set.'
- items:
- properties:
- from:
- description: Originating locality, '/'
- separated, e.g.
- type: string
- to:
- additionalProperties:
- maximum: 4294967295
- minimum: 0
- type: integer
- description: Map of upstream localities
- to traffic distribution weights.
- type: object
- type: object
- type: array
- enabled:
- description: Enable locality load balancing.
- nullable: true
- type: boolean
- failover:
- description: 'Optional: only one of distribute,
- failover or failoverPriority can be set.'
- items:
- properties:
- from:
- description: Originating region.
- type: string
- to:
- description: Destination region the
- traffic will fail over to when endpoints
- in the 'from' region becomes unhealthy.
- type: string
- type: object
- type: array
- failoverPriority:
- description: failoverPriority is an ordered
- list of labels used to sort endpoints to
- do priority based load balancing.
- items:
- type: string
- type: array
- type: object
- simple:
- description: |2-
-
-
- Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST
- enum:
- - UNSPECIFIED
- - LEAST_CONN
- - RANDOM
- - PASSTHROUGH
- - ROUND_ROBIN
- - LEAST_REQUEST
- type: string
- warmup:
- description: Represents the warmup configuration
- of Service.
- properties:
- aggression:
- description: This parameter controls the speed
- of traffic increase over the warmup duration.
- format: double
- minimum: 1
- nullable: true
- type: number
- duration:
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- minimumPercent:
- format: double
- maximum: 100
- minimum: 0
- nullable: true
- type: number
- required:
- - duration
- type: object
- warmupDurationSecs:
- description: 'Deprecated: use `warmup` instead.'
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- type: object
- outlierDetection:
- properties:
- baseEjectionTime:
- description: Minimum ejection duration.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- consecutive5xxErrors:
- description: Number of 5xx errors before a host
- is ejected from the connection pool.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- consecutiveErrors:
- format: int32
- type: integer
- consecutiveGatewayErrors:
- description: Number of gateway errors before a
- host is ejected from the connection pool.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- consecutiveLocalOriginFailures:
- description: The number of consecutive locally
- originated failures before ejection occurs.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- interval:
- description: Time interval between ejection sweep
- analysis.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- maxEjectionPercent:
- description: Maximum % of hosts in the load balancing
- pool for the upstream service that can be ejected.
- format: int32
- type: integer
- minHealthPercent:
- description: Outlier detection will be enabled
- as long as the associated load balancing pool
- has at least `minHealthPercent` hosts in healthy
- mode.
- format: int32
- type: integer
- splitExternalLocalOriginErrors:
- description: Determines whether to distinguish
- local origin failures from external errors.
- type: boolean
- type: object
- port:
- description: Specifies the number of a port on the
- destination service on which this policy is being
- applied.
- properties:
- number:
- maximum: 4294967295
- minimum: 0
- type: integer
- type: object
- tls:
- description: TLS related settings for connections
- to the upstream service.
- properties:
- caCertificates:
- description: 'OPTIONAL: The path to the file containing
- certificate authority certificates to use in
- verifying a presented server certificate.'
- type: string
- caCrl:
- description: 'OPTIONAL: The path to the file containing
- the certificate revocation list (CRL) to use
- in verifying a presented server certificate.'
- type: string
- clientCertificate:
- description: REQUIRED if mode is `MUTUAL`.
- type: string
- credentialName:
- description: The name of the secret that holds
- the TLS certs for the client including the CA
- certificates.
- type: string
- insecureSkipVerify:
- description: '`insecureSkipVerify` specifies whether
- the proxy should skip verifying the CA signature
- and SAN for the server certificate corresponding
- to the host.'
- nullable: true
- type: boolean
- mode:
- description: |-
- Indicates whether connections to this port should be secured using TLS.
-
- Valid Options: DISABLE, SIMPLE, MUTUAL, dubbo_MUTUAL
- enum:
- - DISABLE
- - SIMPLE
- - MUTUAL
- - dubbo_MUTUAL
- type: string
- privateKey:
- description: REQUIRED if mode is `MUTUAL`.
- type: string
- sni:
- description: SNI string to present to the server
- during TLS handshake.
- type: string
- subjectAltNames:
- description: A list of alternate names to verify
- the subject identity in the certificate.
- items:
- type: string
- type: array
- type: object
- type: object
- maxItems: 4096
- type: array
- proxyProtocol:
- description: The upstream PROXY protocol settings.
- properties:
- version:
- description: |-
- The PROXY protocol version to use.
-
- Valid Options: V1, V2
- enum:
- - V1
- - V2
- type: string
- type: object
- retryBudget:
- description: Specifies a limit on concurrent retries in
- relation to the number of active requests.
- properties:
- minRetryConcurrency:
- description: Specifies the minimum retry concurrency
- allowed for the retry budget.
- maximum: 4294967295
- minimum: 0
- type: integer
- percent:
- description: Specifies the limit on concurrent retries
- as a percentage of the sum of active requests and
- active pending requests.
- format: double
- maximum: 100
- minimum: 0
- nullable: true
- type: number
- type: object
- tls:
- description: TLS related settings for connections to the
- upstream service.
- properties:
- caCertificates:
- description: 'OPTIONAL: The path to the file containing
- certificate authority certificates to use in verifying
- a presented server certificate.'
- type: string
- caCrl:
- description: 'OPTIONAL: The path to the file containing
- the certificate revocation list (CRL) to use in verifying
- a presented server certificate.'
- type: string
- clientCertificate:
- description: REQUIRED if mode is `MUTUAL`.
- type: string
- credentialName:
- description: The name of the secret that holds the TLS
- certs for the client including the CA certificates.
- type: string
- insecureSkipVerify:
- description: '`insecureSkipVerify` specifies whether
- the proxy should skip verifying the CA signature and
- SAN for the server certificate corresponding to the
- host.'
- nullable: true
- type: boolean
- mode:
- description: |-
- Indicates whether connections to this port should be secured using TLS.
-
- Valid Options: DISABLE, SIMPLE, MUTUAL, dubbo_MUTUAL
- enum:
- - DISABLE
- - SIMPLE
- - MUTUAL
- - dubbo_MUTUAL
- type: string
- privateKey:
- description: REQUIRED if mode is `MUTUAL`.
- type: string
- sni:
- description: SNI string to present to the server during
- TLS handshake.
- type: string
- subjectAltNames:
- description: A list of alternate names to verify the
- subject identity in the certificate.
- items:
- type: string
- type: array
- type: object
- tunnel:
- description: Configuration of tunneling TCP over other transport
- or application layers for the host configured in the DestinationRule.
- properties:
- protocol:
- description: Specifies which protocol to use for tunneling
- the downstream connection.
- type: string
- targetHost:
- description: Specifies a host to which the downstream
- connection is tunneled.
- type: string
- targetPort:
- description: Specifies a port to which the downstream
- connection is tunneled.
- maximum: 4294967295
- minimum: 0
- type: integer
- required:
- - targetHost
- - targetPort
- type: object
- type: object
- required:
- - name
- type: object
- type: array
- trafficPolicy:
- description: Traffic policies to apply (load balancing policy, connection
- pool sizes, outlier detection).
- properties:
- connectionPool:
- properties:
- http:
- description: HTTP connection pool settings.
- properties:
- h2UpgradePolicy:
- description: |-
- Specify if http1.1 connection should be upgraded to http2 for the associated destination.
-
- Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE
- enum:
- - DEFAULT
- - DO_NOT_UPGRADE
- - UPGRADE
- type: string
- http1MaxPendingRequests:
- description: Maximum number of requests that will be queued
- while waiting for a ready connection pool connection.
- format: int32
- type: integer
- http2MaxRequests:
- description: Maximum number of active requests to a destination.
- format: int32
- type: integer
- idleTimeout:
- description: The idle timeout for upstream connection
- pool connections.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- maxConcurrentStreams:
- description: The maximum number of concurrent streams
- allowed for a peer on one HTTP/2 connection.
- format: int32
- type: integer
- maxRequestsPerConnection:
- description: Maximum number of requests per connection
- to a backend.
- format: int32
- type: integer
- maxRetries:
- description: Maximum number of retries that can be outstanding
- to all hosts in a cluster at a given time.
- format: int32
- type: integer
- useClientProtocol:
- description: If set to true, client protocol will be preserved
- while initiating connection to backend.
- type: boolean
- type: object
- tcp:
- description: Settings common to both HTTP and TCP upstream
- connections.
- properties:
- connectTimeout:
- description: TCP connection timeout.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- idleTimeout:
- description: The idle timeout for TCP connections.
- type: string
- maxConnectionDuration:
- description: The maximum duration of a connection.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- maxConnections:
- description: Maximum number of HTTP1 /TCP connections
- to a destination host.
- format: int32
- type: integer
- tcpKeepalive:
- description: If set then set SO_KEEPALIVE on the socket
- to enable TCP Keepalives.
- properties:
- interval:
- description: The time duration between keep-alive
- probes.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- probes:
- description: Maximum number of keepalive probes to
- send without response before deciding the connection
- is dead.
- maximum: 4294967295
- minimum: 0
- type: integer
- time:
- description: The time duration a connection needs
- to be idle before keep-alive probes start being
- sent.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- type: object
- type: object
- type: object
- loadBalancer:
- description: Settings controlling the load balancer algorithms.
- oneOf:
- - not:
- anyOf:
- - required:
- - simple
- - required:
- - consistentHash
- - required:
- - simple
- - required:
- - consistentHash
- properties:
- consistentHash:
- allOf:
- - oneOf:
- - not:
- anyOf:
- - required:
- - httpHeaderName
- - required:
- - httpCookie
- - required:
- - useSourceIp
- - required:
- - httpQueryParameterName
- - required:
- - httpHeaderName
- - required:
- - httpCookie
- - required:
- - useSourceIp
- - required:
- - httpQueryParameterName
- - oneOf:
- - not:
- anyOf:
- - required:
- - ringHash
- - required:
- - maglev
- - required:
- - ringHash
- - required:
- - maglev
- properties:
- httpCookie:
- description: Hash based on HTTP cookie.
- properties:
- name:
- description: Name of the cookie.
- type: string
- path:
- description: Path to set for the cookie.
- type: string
- ttl:
- description: Lifetime of the cookie.
- type: string
- required:
- - name
- type: object
- httpHeaderName:
- description: Hash based on a specific HTTP header.
- type: string
- httpQueryParameterName:
- description: Hash based on a specific HTTP query parameter.
- type: string
- maglev:
- description: The Maglev load balancer implements consistent
- hashing to backend hosts.
- properties:
- tableSize:
- description: The table size for Maglev hashing.
- minimum: 0
- type: integer
- type: object
- minimumRingSize:
- description: Deprecated.
- minimum: 0
- type: integer
- ringHash:
- description: The ring/modulo hash load balancer implements
- consistent hashing to backend hosts.
- properties:
- minimumRingSize:
- description: The minimum number of virtual nodes to
- use for the hash ring.
- minimum: 0
- type: integer
- type: object
- useSourceIp:
- description: Hash based on the source IP address.
- type: boolean
- type: object
- localityLbSetting:
- properties:
- distribute:
- description: 'Optional: only one of distribute, failover
- or failoverPriority can be set.'
- items:
- properties:
- from:
- description: Originating locality, '/' separated,
- e.g.
- type: string
- to:
- additionalProperties:
- maximum: 4294967295
- minimum: 0
- type: integer
- description: Map of upstream localities to traffic
- distribution weights.
- type: object
- type: object
- type: array
- enabled:
- description: Enable locality load balancing.
- nullable: true
- type: boolean
- failover:
- description: 'Optional: only one of distribute, failover
- or failoverPriority can be set.'
- items:
- properties:
- from:
- description: Originating region.
- type: string
- to:
- description: Destination region the traffic will
- fail over to when endpoints in the 'from' region
- becomes unhealthy.
- type: string
- type: object
- type: array
- failoverPriority:
- description: failoverPriority is an ordered list of labels
- used to sort endpoints to do priority based load balancing.
- items:
- type: string
- type: array
- type: object
- simple:
- description: |2-
-
-
- Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST
- enum:
- - UNSPECIFIED
- - LEAST_CONN
- - RANDOM
- - PASSTHROUGH
- - ROUND_ROBIN
- - LEAST_REQUEST
- type: string
- warmup:
- description: Represents the warmup configuration of Service.
- properties:
- aggression:
- description: This parameter controls the speed of traffic
- increase over the warmup duration.
- format: double
- minimum: 1
- nullable: true
- type: number
- duration:
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- minimumPercent:
- format: double
- maximum: 100
- minimum: 0
- nullable: true
- type: number
- required:
- - duration
- type: object
- warmupDurationSecs:
- description: 'Deprecated: use `warmup` instead.'
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- type: object
- outlierDetection:
- properties:
- baseEjectionTime:
- description: Minimum ejection duration.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- consecutive5xxErrors:
- description: Number of 5xx errors before a host is ejected
- from the connection pool.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- consecutiveErrors:
- format: int32
- type: integer
- consecutiveGatewayErrors:
- description: Number of gateway errors before a host is ejected
- from the connection pool.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- consecutiveLocalOriginFailures:
- description: The number of consecutive locally originated
- failures before ejection occurs.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- interval:
- description: Time interval between ejection sweep analysis.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- maxEjectionPercent:
- description: Maximum % of hosts in the load balancing pool
- for the upstream service that can be ejected.
- format: int32
- type: integer
- minHealthPercent:
- description: Outlier detection will be enabled as long as
- the associated load balancing pool has at least `minHealthPercent`
- hosts in healthy mode.
- format: int32
- type: integer
- splitExternalLocalOriginErrors:
- description: Determines whether to distinguish local origin
- failures from external errors.
- type: boolean
- type: object
- portLevelSettings:
- description: Traffic policies specific to individual ports.
- items:
- properties:
- connectionPool:
- properties:
- http:
- description: HTTP connection pool settings.
- properties:
- h2UpgradePolicy:
- description: |-
- Specify if http1.1 connection should be upgraded to http2 for the associated destination.
-
- Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE
- enum:
- - DEFAULT
- - DO_NOT_UPGRADE
- - UPGRADE
- type: string
- http1MaxPendingRequests:
- description: Maximum number of requests that will
- be queued while waiting for a ready connection
- pool connection.
- format: int32
- type: integer
- http2MaxRequests:
- description: Maximum number of active requests to
- a destination.
- format: int32
- type: integer
- idleTimeout:
- description: The idle timeout for upstream connection
- pool connections.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- maxConcurrentStreams:
- description: The maximum number of concurrent streams
- allowed for a peer on one HTTP/2 connection.
- format: int32
- type: integer
- maxRequestsPerConnection:
- description: Maximum number of requests per connection
- to a backend.
- format: int32
- type: integer
- maxRetries:
- description: Maximum number of retries that can
- be outstanding to all hosts in a cluster at a
- given time.
- format: int32
- type: integer
- useClientProtocol:
- description: If set to true, client protocol will
- be preserved while initiating connection to backend.
- type: boolean
- type: object
- tcp:
- description: Settings common to both HTTP and TCP upstream
- connections.
- properties:
- connectTimeout:
- description: TCP connection timeout.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- idleTimeout:
- description: The idle timeout for TCP connections.
- type: string
- maxConnectionDuration:
- description: The maximum duration of a connection.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- maxConnections:
- description: Maximum number of HTTP1 /TCP connections
- to a destination host.
- format: int32
- type: integer
- tcpKeepalive:
- description: If set then set SO_KEEPALIVE on the
- socket to enable TCP Keepalives.
- properties:
- interval:
- description: The time duration between keep-alive
- probes.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- probes:
- description: Maximum number of keepalive probes
- to send without response before deciding the
- connection is dead.
- maximum: 4294967295
- minimum: 0
- type: integer
- time:
- description: The time duration a connection
- needs to be idle before keep-alive probes
- start being sent.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- type: object
- type: object
- type: object
- loadBalancer:
- description: Settings controlling the load balancer algorithms.
- oneOf:
- - not:
- anyOf:
- - required:
- - simple
- - required:
- - consistentHash
- - required:
- - simple
- - required:
- - consistentHash
- properties:
- consistentHash:
- allOf:
- - oneOf:
- - not:
- anyOf:
- - required:
- - httpHeaderName
- - required:
- - httpCookie
- - required:
- - useSourceIp
- - required:
- - httpQueryParameterName
- - required:
- - httpHeaderName
- - required:
- - httpCookie
- - required:
- - useSourceIp
- - required:
- - httpQueryParameterName
- - oneOf:
- - not:
- anyOf:
- - required:
- - ringHash
- - required:
- - maglev
- - required:
- - ringHash
- - required:
- - maglev
- properties:
- httpCookie:
- description: Hash based on HTTP cookie.
- properties:
- name:
- description: Name of the cookie.
- type: string
- path:
- description: Path to set for the cookie.
- type: string
- ttl:
- description: Lifetime of the cookie.
- type: string
- required:
- - name
- type: object
- httpHeaderName:
- description: Hash based on a specific HTTP header.
- type: string
- httpQueryParameterName:
- description: Hash based on a specific HTTP query
- parameter.
- type: string
- maglev:
- description: The Maglev load balancer implements
- consistent hashing to backend hosts.
- properties:
- tableSize:
- description: The table size for Maglev hashing.
- minimum: 0
- type: integer
- type: object
- minimumRingSize:
- description: Deprecated.
- minimum: 0
- type: integer
- ringHash:
- description: The ring/modulo hash load balancer
- implements consistent hashing to backend hosts.
- properties:
- minimumRingSize:
- description: The minimum number of virtual nodes
- to use for the hash ring.
- minimum: 0
- type: integer
- type: object
- useSourceIp:
- description: Hash based on the source IP address.
- type: boolean
- type: object
- localityLbSetting:
- properties:
- distribute:
- description: 'Optional: only one of distribute,
- failover or failoverPriority can be set.'
- items:
- properties:
- from:
- description: Originating locality, '/' separated,
- e.g.
- type: string
- to:
- additionalProperties:
- maximum: 4294967295
- minimum: 0
- type: integer
- description: Map of upstream localities to
- traffic distribution weights.
- type: object
- type: object
- type: array
- enabled:
- description: Enable locality load balancing.
- nullable: true
- type: boolean
- failover:
- description: 'Optional: only one of distribute,
- failover or failoverPriority can be set.'
- items:
- properties:
- from:
- description: Originating region.
- type: string
- to:
- description: Destination region the traffic
- will fail over to when endpoints in the
- 'from' region becomes unhealthy.
- type: string
- type: object
- type: array
- failoverPriority:
- description: failoverPriority is an ordered list
- of labels used to sort endpoints to do priority
- based load balancing.
- items:
- type: string
- type: array
- type: object
- simple:
- description: |2-
-
-
- Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST
- enum:
- - UNSPECIFIED
- - LEAST_CONN
- - RANDOM
- - PASSTHROUGH
- - ROUND_ROBIN
- - LEAST_REQUEST
- type: string
- warmup:
- description: Represents the warmup configuration of
- Service.
- properties:
- aggression:
- description: This parameter controls the speed of
- traffic increase over the warmup duration.
- format: double
- minimum: 1
- nullable: true
- type: number
- duration:
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- minimumPercent:
- format: double
- maximum: 100
- minimum: 0
- nullable: true
- type: number
- required:
- - duration
- type: object
- warmupDurationSecs:
- description: 'Deprecated: use `warmup` instead.'
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- type: object
- outlierDetection:
- properties:
- baseEjectionTime:
- description: Minimum ejection duration.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- consecutive5xxErrors:
- description: Number of 5xx errors before a host is ejected
- from the connection pool.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- consecutiveErrors:
- format: int32
- type: integer
- consecutiveGatewayErrors:
- description: Number of gateway errors before a host
- is ejected from the connection pool.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- consecutiveLocalOriginFailures:
- description: The number of consecutive locally originated
- failures before ejection occurs.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- interval:
- description: Time interval between ejection sweep analysis.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- maxEjectionPercent:
- description: Maximum % of hosts in the load balancing
- pool for the upstream service that can be ejected.
- format: int32
- type: integer
- minHealthPercent:
- description: Outlier detection will be enabled as long
- as the associated load balancing pool has at least
- `minHealthPercent` hosts in healthy mode.
- format: int32
- type: integer
- splitExternalLocalOriginErrors:
- description: Determines whether to distinguish local
- origin failures from external errors.
- type: boolean
- type: object
- port:
- description: Specifies the number of a port on the destination
- service on which this policy is being applied.
- properties:
- number:
- maximum: 4294967295
- minimum: 0
- type: integer
- type: object
- tls:
- description: TLS related settings for connections to the
- upstream service.
- properties:
- caCertificates:
- description: 'OPTIONAL: The path to the file containing
- certificate authority certificates to use in verifying
- a presented server certificate.'
- type: string
- caCrl:
- description: 'OPTIONAL: The path to the file containing
- the certificate revocation list (CRL) to use in verifying
- a presented server certificate.'
- type: string
- clientCertificate:
- description: REQUIRED if mode is `MUTUAL`.
- type: string
- credentialName:
- description: The name of the secret that holds the TLS
- certs for the client including the CA certificates.
- type: string
- insecureSkipVerify:
- description: '`insecureSkipVerify` specifies whether
- the proxy should skip verifying the CA signature and
- SAN for the server certificate corresponding to the
- host.'
- nullable: true
- type: boolean
- mode:
- description: |-
- Indicates whether connections to this port should be secured using TLS.
-
- Valid Options: DISABLE, SIMPLE, MUTUAL, dubbo_MUTUAL
- enum:
- - DISABLE
- - SIMPLE
- - MUTUAL
- - dubbo_MUTUAL
- type: string
- privateKey:
- description: REQUIRED if mode is `MUTUAL`.
- type: string
- sni:
- description: SNI string to present to the server during
- TLS handshake.
- type: string
- subjectAltNames:
- description: A list of alternate names to verify the
- subject identity in the certificate.
- items:
- type: string
- type: array
- type: object
- type: object
- maxItems: 4096
- type: array
- proxyProtocol:
- description: The upstream PROXY protocol settings.
- properties:
- version:
- description: |-
- The PROXY protocol version to use.
-
- Valid Options: V1, V2
- enum:
- - V1
- - V2
- type: string
- type: object
- retryBudget:
- description: Specifies a limit on concurrent retries in relation
- to the number of active requests.
- properties:
- minRetryConcurrency:
- description: Specifies the minimum retry concurrency allowed
- for the retry budget.
- maximum: 4294967295
- minimum: 0
- type: integer
- percent:
- description: Specifies the limit on concurrent retries as
- a percentage of the sum of active requests and active pending
- requests.
- format: double
- maximum: 100
- minimum: 0
- nullable: true
- type: number
- type: object
- tls:
- description: TLS related settings for connections to the upstream
- service.
- properties:
- caCertificates:
- description: 'OPTIONAL: The path to the file containing certificate
- authority certificates to use in verifying a presented server
- certificate.'
- type: string
- caCrl:
- description: 'OPTIONAL: The path to the file containing the
- certificate revocation list (CRL) to use in verifying a
- presented server certificate.'
- type: string
- clientCertificate:
- description: REQUIRED if mode is `MUTUAL`.
- type: string
- credentialName:
- description: The name of the secret that holds the TLS certs
- for the client including the CA certificates.
- type: string
- insecureSkipVerify:
- description: '`insecureSkipVerify` specifies whether the proxy
- should skip verifying the CA signature and SAN for the server
- certificate corresponding to the host.'
- nullable: true
- type: boolean
- mode:
- description: |-
- Indicates whether connections to this port should be secured using TLS.
-
- Valid Options: DISABLE, SIMPLE, MUTUAL, dubbo_MUTUAL
- enum:
- - DISABLE
- - SIMPLE
- - MUTUAL
- - dubbo_MUTUAL
- type: string
- privateKey:
- description: REQUIRED if mode is `MUTUAL`.
- type: string
- sni:
- description: SNI string to present to the server during TLS
- handshake.
- type: string
- subjectAltNames:
- description: A list of alternate names to verify the subject
- identity in the certificate.
- items:
- type: string
- type: array
- type: object
- tunnel:
- description: Configuration of tunneling TCP over other transport
- or application layers for the host configured in the DestinationRule.
- properties:
- protocol:
- description: Specifies which protocol to use for tunneling
- the downstream connection.
- type: string
- targetHost:
- description: Specifies a host to which the downstream connection
- is tunneled.
- type: string
- targetPort:
- description: Specifies a port to which the downstream connection
- is tunneled.
- maximum: 4294967295
- minimum: 0
- type: integer
- required:
- - targetHost
- - targetPort
- type: object
- type: object
- workloadSelector:
- description: Criteria used to select the specific set of pods/VMs
- on which this `DestinationRule` configuration should be applied.
- properties:
- matchLabels:
- additionalProperties:
- maxLength: 63
- type: string
- x-kubernetes-validations:
- - message: wildcard not allowed in label value match
- rule: '!self.contains("*")'
- description: One or more labels that indicate a specific set of
- pods/VMs on which a policy should be applied.
- maxProperties: 4096
- type: object
- x-kubernetes-validations:
- - message: wildcard not allowed in label key match
- rule: self.all(key, !key.contains("*"))
- - message: key must not be empty
- rule: self.all(key, key.size() != 0)
- type: object
- required:
- - host
- type: object
- status:
- properties:
- conditions:
- description: Current service state of the resource.
- items:
- properties:
- lastProbeTime:
- description: Last time we probed the condition.
- format: date-time
- type: string
- lastTransitionTime:
- description: Last time the condition transitioned from one status
- to another.
- format: date-time
- type: string
- message:
- description: Human-readable message indicating details about
- last transition.
- type: string
- observedGeneration:
- anyOf:
- - type: integer
- - type: string
- description: Resource Generation to which the Condition refers.
- x-kubernetes-int-or-string: true
- reason:
- description: Unique, one-word, CamelCase reason for the condition's
- last transition.
- type: string
- status:
- description: Status is the status of the condition.
- type: string
- type:
- description: Type is the type of the condition.
- type: string
- type: object
- type: array
- observedGeneration:
- anyOf:
- - type: integer
- - type: string
- x-kubernetes-int-or-string: true
- validationMessages:
- description: Includes any errors or warnings detected by dubbo's analyzers.
- items:
- properties:
- documentationUrl:
- description: A url pointing to the dubbo documentation for this
- specific error type.
- type: string
- level:
- description: |-
- Represents how severe a message is.
-
- Valid Options: UNKNOWN, ERROR, WARNING, INFO
- enum:
- - UNKNOWN
- - ERROR
- - WARNING
- - INFO
- type: string
- type:
- properties:
- code:
- description: A 7 character code matching `^IST[0-9]{4}$`
- intended to uniquely identify the message type.
- type: string
- name:
- description: A human-readable name for the message type.
- type: string
- type: object
- type: object
- type: array
- type: object
- x-kubernetes-preserve-unknown-fields: true
- type: object
- served: true
- storage: false
- subresources:
- status: {}
- - additionalPrinterColumns:
- - description: The name of a service from the service registry
- jsonPath: .spec.host
- name: Host
- type: string
- - description: CreationTimestamp is a timestamp representing the server time when
- this object was created. It is not guaranteed to be set in happens-before
- order across separate operations. Clients may not set this value. It is represented
- in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for
- lists. For more information, see [Kubernetes API Conventions](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#metadata)
- jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- name: v1beta1
- schema:
- openAPIV3Schema:
- properties:
- spec:
- description: 'Configuration affecting load balancing, outlier detection'
- properties:
- exportTo:
- description: A list of namespaces to which this destination rule is
- exported.
- items:
- type: string
- type: array
- host:
- description: The name of a service from the service registry.
- type: string
- subsets:
- description: One or more named sets that represent individual versions
- of a service.
- items:
- properties:
- labels:
- additionalProperties:
- type: string
- description: Labels apply a filter over the endpoints of a service
- in the service registry.
- type: object
- name:
- description: Name of the subset.
- type: string
- trafficPolicy:
- description: Traffic policies that apply to this subset.
- properties:
- connectionPool:
- properties:
- http:
- description: HTTP connection pool settings.
- properties:
- h2UpgradePolicy:
- description: |-
- Specify if http1.1 connection should be upgraded to http2 for the associated destination.
-
- Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE
- enum:
- - DEFAULT
- - DO_NOT_UPGRADE
- - UPGRADE
- type: string
- http1MaxPendingRequests:
- description: Maximum number of requests that will
- be queued while waiting for a ready connection
- pool connection.
- format: int32
- type: integer
- http2MaxRequests:
- description: Maximum number of active requests to
- a destination.
- format: int32
- type: integer
- idleTimeout:
- description: The idle timeout for upstream connection
- pool connections.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- maxConcurrentStreams:
- description: The maximum number of concurrent streams
- allowed for a peer on one HTTP/2 connection.
- format: int32
- type: integer
- maxRequestsPerConnection:
- description: Maximum number of requests per connection
- to a backend.
- format: int32
- type: integer
- maxRetries:
- description: Maximum number of retries that can
- be outstanding to all hosts in a cluster at a
- given time.
- format: int32
- type: integer
- useClientProtocol:
- description: If set to true, client protocol will
- be preserved while initiating connection to backend.
- type: boolean
- type: object
- tcp:
- description: Settings common to both HTTP and TCP upstream
- connections.
- properties:
- connectTimeout:
- description: TCP connection timeout.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- idleTimeout:
- description: The idle timeout for TCP connections.
- type: string
- maxConnectionDuration:
- description: The maximum duration of a connection.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- maxConnections:
- description: Maximum number of HTTP1 /TCP connections
- to a destination host.
- format: int32
- type: integer
- tcpKeepalive:
- description: If set then set SO_KEEPALIVE on the
- socket to enable TCP Keepalives.
- properties:
- interval:
- description: The time duration between keep-alive
- probes.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- probes:
- description: Maximum number of keepalive probes
- to send without response before deciding the
- connection is dead.
- maximum: 4294967295
- minimum: 0
- type: integer
- time:
- description: The time duration a connection
- needs to be idle before keep-alive probes
- start being sent.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- type: object
- type: object
- type: object
- loadBalancer:
- description: Settings controlling the load balancer algorithms.
- oneOf:
- - not:
- anyOf:
- - required:
- - simple
- - required:
- - consistentHash
- - required:
- - simple
- - required:
- - consistentHash
- properties:
- consistentHash:
- allOf:
- - oneOf:
- - not:
- anyOf:
- - required:
- - httpHeaderName
- - required:
- - httpCookie
- - required:
- - useSourceIp
- - required:
- - httpQueryParameterName
- - required:
- - httpHeaderName
- - required:
- - httpCookie
- - required:
- - useSourceIp
- - required:
- - httpQueryParameterName
- - oneOf:
- - not:
- anyOf:
- - required:
- - ringHash
- - required:
- - maglev
- - required:
- - ringHash
- - required:
- - maglev
- properties:
- httpCookie:
- description: Hash based on HTTP cookie.
- properties:
- name:
- description: Name of the cookie.
- type: string
- path:
- description: Path to set for the cookie.
- type: string
- ttl:
- description: Lifetime of the cookie.
- type: string
- required:
- - name
- type: object
- httpHeaderName:
- description: Hash based on a specific HTTP header.
- type: string
- httpQueryParameterName:
- description: Hash based on a specific HTTP query
- parameter.
- type: string
- maglev:
- description: The Maglev load balancer implements
- consistent hashing to backend hosts.
- properties:
- tableSize:
- description: The table size for Maglev hashing.
- minimum: 0
- type: integer
- type: object
- minimumRingSize:
- description: Deprecated.
- minimum: 0
- type: integer
- ringHash:
- description: The ring/modulo hash load balancer
- implements consistent hashing to backend hosts.
- properties:
- minimumRingSize:
- description: The minimum number of virtual nodes
- to use for the hash ring.
- minimum: 0
- type: integer
- type: object
- useSourceIp:
- description: Hash based on the source IP address.
- type: boolean
- type: object
- localityLbSetting:
- properties:
- distribute:
- description: 'Optional: only one of distribute,
- failover or failoverPriority can be set.'
- items:
- properties:
- from:
- description: Originating locality, '/' separated,
- e.g.
- type: string
- to:
- additionalProperties:
- maximum: 4294967295
- minimum: 0
- type: integer
- description: Map of upstream localities to
- traffic distribution weights.
- type: object
- type: object
- type: array
- enabled:
- description: Enable locality load balancing.
- nullable: true
- type: boolean
- failover:
- description: 'Optional: only one of distribute,
- failover or failoverPriority can be set.'
- items:
- properties:
- from:
- description: Originating region.
- type: string
- to:
- description: Destination region the traffic
- will fail over to when endpoints in the
- 'from' region becomes unhealthy.
- type: string
- type: object
- type: array
- failoverPriority:
- description: failoverPriority is an ordered list
- of labels used to sort endpoints to do priority
- based load balancing.
- items:
- type: string
- type: array
- type: object
- simple:
- description: |2-
-
-
- Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST
- enum:
- - UNSPECIFIED
- - LEAST_CONN
- - RANDOM
- - PASSTHROUGH
- - ROUND_ROBIN
- - LEAST_REQUEST
- type: string
- warmup:
- description: Represents the warmup configuration of
- Service.
- properties:
- aggression:
- description: This parameter controls the speed of
- traffic increase over the warmup duration.
- format: double
- minimum: 1
- nullable: true
- type: number
- duration:
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- minimumPercent:
- format: double
- maximum: 100
- minimum: 0
- nullable: true
- type: number
- required:
- - duration
- type: object
- warmupDurationSecs:
- description: 'Deprecated: use `warmup` instead.'
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- type: object
- outlierDetection:
- properties:
- baseEjectionTime:
- description: Minimum ejection duration.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- consecutive5xxErrors:
- description: Number of 5xx errors before a host is ejected
- from the connection pool.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- consecutiveErrors:
- format: int32
- type: integer
- consecutiveGatewayErrors:
- description: Number of gateway errors before a host
- is ejected from the connection pool.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- consecutiveLocalOriginFailures:
- description: The number of consecutive locally originated
- failures before ejection occurs.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- interval:
- description: Time interval between ejection sweep analysis.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- maxEjectionPercent:
- description: Maximum % of hosts in the load balancing
- pool for the upstream service that can be ejected.
- format: int32
- type: integer
- minHealthPercent:
- description: Outlier detection will be enabled as long
- as the associated load balancing pool has at least
- `minHealthPercent` hosts in healthy mode.
- format: int32
- type: integer
- splitExternalLocalOriginErrors:
- description: Determines whether to distinguish local
- origin failures from external errors.
- type: boolean
- type: object
- portLevelSettings:
- description: Traffic policies specific to individual ports.
- items:
- properties:
- connectionPool:
- properties:
- http:
- description: HTTP connection pool settings.
- properties:
- h2UpgradePolicy:
- description: |-
- Specify if http1.1 connection should be upgraded to http2 for the associated destination.
-
- Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE
- enum:
- - DEFAULT
- - DO_NOT_UPGRADE
- - UPGRADE
- type: string
- http1MaxPendingRequests:
- description: Maximum number of requests that
- will be queued while waiting for a ready
- connection pool connection.
- format: int32
- type: integer
- http2MaxRequests:
- description: Maximum number of active requests
- to a destination.
- format: int32
- type: integer
- idleTimeout:
- description: The idle timeout for upstream
- connection pool connections.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- maxConcurrentStreams:
- description: The maximum number of concurrent
- streams allowed for a peer on one HTTP/2
- connection.
- format: int32
- type: integer
- maxRequestsPerConnection:
- description: Maximum number of requests per
- connection to a backend.
- format: int32
- type: integer
- maxRetries:
- description: Maximum number of retries that
- can be outstanding to all hosts in a cluster
- at a given time.
- format: int32
- type: integer
- useClientProtocol:
- description: If set to true, client protocol
- will be preserved while initiating connection
- to backend.
- type: boolean
- type: object
- tcp:
- description: Settings common to both HTTP and
- TCP upstream connections.
- properties:
- connectTimeout:
- description: TCP connection timeout.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- idleTimeout:
- description: The idle timeout for TCP connections.
- type: string
- maxConnectionDuration:
- description: The maximum duration of a connection.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- maxConnections:
- description: Maximum number of HTTP1 /TCP
- connections to a destination host.
- format: int32
- type: integer
- tcpKeepalive:
- description: If set then set SO_KEEPALIVE
- on the socket to enable TCP Keepalives.
- properties:
- interval:
- description: The time duration between
- keep-alive probes.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- probes:
- description: Maximum number of keepalive
- probes to send without response before
- deciding the connection is dead.
- maximum: 4294967295
- minimum: 0
- type: integer
- time:
- description: The time duration a connection
- needs to be idle before keep-alive probes
- start being sent.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- type: object
- type: object
- type: object
- loadBalancer:
- description: Settings controlling the load balancer
- algorithms.
- oneOf:
- - not:
- anyOf:
- - required:
- - simple
- - required:
- - consistentHash
- - required:
- - simple
- - required:
- - consistentHash
- properties:
- consistentHash:
- allOf:
- - oneOf:
- - not:
- anyOf:
- - required:
- - httpHeaderName
- - required:
- - httpCookie
- - required:
- - useSourceIp
- - required:
- - httpQueryParameterName
- - required:
- - httpHeaderName
- - required:
- - httpCookie
- - required:
- - useSourceIp
- - required:
- - httpQueryParameterName
- - oneOf:
- - not:
- anyOf:
- - required:
- - ringHash
- - required:
- - maglev
- - required:
- - ringHash
- - required:
- - maglev
- properties:
- httpCookie:
- description: Hash based on HTTP cookie.
- properties:
- name:
- description: Name of the cookie.
- type: string
- path:
- description: Path to set for the cookie.
- type: string
- ttl:
- description: Lifetime of the cookie.
- type: string
- required:
- - name
- type: object
- httpHeaderName:
- description: Hash based on a specific HTTP
- header.
- type: string
- httpQueryParameterName:
- description: Hash based on a specific HTTP
- query parameter.
- type: string
- maglev:
- description: The Maglev load balancer implements
- consistent hashing to backend hosts.
- properties:
- tableSize:
- description: The table size for Maglev
- hashing.
- minimum: 0
- type: integer
- type: object
- minimumRingSize:
- description: Deprecated.
- minimum: 0
- type: integer
- ringHash:
- description: The ring/modulo hash load balancer
- implements consistent hashing to backend
- hosts.
- properties:
- minimumRingSize:
- description: The minimum number of virtual
- nodes to use for the hash ring.
- minimum: 0
- type: integer
- type: object
- useSourceIp:
- description: Hash based on the source IP address.
- type: boolean
- type: object
- localityLbSetting:
- properties:
- distribute:
- description: 'Optional: only one of distribute,
- failover or failoverPriority can be set.'
- items:
- properties:
- from:
- description: Originating locality, '/'
- separated, e.g.
- type: string
- to:
- additionalProperties:
- maximum: 4294967295
- minimum: 0
- type: integer
- description: Map of upstream localities
- to traffic distribution weights.
- type: object
- type: object
- type: array
- enabled:
- description: Enable locality load balancing.
- nullable: true
- type: boolean
- failover:
- description: 'Optional: only one of distribute,
- failover or failoverPriority can be set.'
- items:
- properties:
- from:
- description: Originating region.
- type: string
- to:
- description: Destination region the
- traffic will fail over to when endpoints
- in the 'from' region becomes unhealthy.
- type: string
- type: object
- type: array
- failoverPriority:
- description: failoverPriority is an ordered
- list of labels used to sort endpoints to
- do priority based load balancing.
- items:
- type: string
- type: array
- type: object
- simple:
- description: |2-
-
-
- Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST
- enum:
- - UNSPECIFIED
- - LEAST_CONN
- - RANDOM
- - PASSTHROUGH
- - ROUND_ROBIN
- - LEAST_REQUEST
- type: string
- warmup:
- description: Represents the warmup configuration
- of Service.
- properties:
- aggression:
- description: This parameter controls the speed
- of traffic increase over the warmup duration.
- format: double
- minimum: 1
- nullable: true
- type: number
- duration:
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- minimumPercent:
- format: double
- maximum: 100
- minimum: 0
- nullable: true
- type: number
- required:
- - duration
- type: object
- warmupDurationSecs:
- description: 'Deprecated: use `warmup` instead.'
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- type: object
- outlierDetection:
- properties:
- baseEjectionTime:
- description: Minimum ejection duration.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- consecutive5xxErrors:
- description: Number of 5xx errors before a host
- is ejected from the connection pool.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- consecutiveErrors:
- format: int32
- type: integer
- consecutiveGatewayErrors:
- description: Number of gateway errors before a
- host is ejected from the connection pool.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- consecutiveLocalOriginFailures:
- description: The number of consecutive locally
- originated failures before ejection occurs.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- interval:
- description: Time interval between ejection sweep
- analysis.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- maxEjectionPercent:
- description: Maximum % of hosts in the load balancing
- pool for the upstream service that can be ejected.
- format: int32
- type: integer
- minHealthPercent:
- description: Outlier detection will be enabled
- as long as the associated load balancing pool
- has at least `minHealthPercent` hosts in healthy
- mode.
- format: int32
- type: integer
- splitExternalLocalOriginErrors:
- description: Determines whether to distinguish
- local origin failures from external errors.
- type: boolean
- type: object
- port:
- description: Specifies the number of a port on the
- destination service on which this policy is being
- applied.
- properties:
- number:
- maximum: 4294967295
- minimum: 0
- type: integer
- type: object
- tls:
- description: TLS related settings for connections
- to the upstream service.
- properties:
- caCertificates:
- description: 'OPTIONAL: The path to the file containing
- certificate authority certificates to use in
- verifying a presented server certificate.'
- type: string
- caCrl:
- description: 'OPTIONAL: The path to the file containing
- the certificate revocation list (CRL) to use
- in verifying a presented server certificate.'
- type: string
- clientCertificate:
- description: REQUIRED if mode is `MUTUAL`.
- type: string
- credentialName:
- description: The name of the secret that holds
- the TLS certs for the client including the CA
- certificates.
- type: string
- insecureSkipVerify:
- description: '`insecureSkipVerify` specifies whether
- the proxy should skip verifying the CA signature
- and SAN for the server certificate corresponding
- to the host.'
- nullable: true
- type: boolean
- mode:
- description: |-
- Indicates whether connections to this port should be secured using TLS.
-
- Valid Options: DISABLE, SIMPLE, MUTUAL, dubbo_MUTUAL
- enum:
- - DISABLE
- - SIMPLE
- - MUTUAL
- - dubbo_MUTUAL
- type: string
- privateKey:
- description: REQUIRED if mode is `MUTUAL`.
- type: string
- sni:
- description: SNI string to present to the server
- during TLS handshake.
- type: string
- subjectAltNames:
- description: A list of alternate names to verify
- the subject identity in the certificate.
- items:
- type: string
- type: array
- type: object
- type: object
- maxItems: 4096
- type: array
- proxyProtocol:
- description: The upstream PROXY protocol settings.
- properties:
- version:
- description: |-
- The PROXY protocol version to use.
-
- Valid Options: V1, V2
- enum:
- - V1
- - V2
- type: string
- type: object
- retryBudget:
- description: Specifies a limit on concurrent retries in
- relation to the number of active requests.
- properties:
- minRetryConcurrency:
- description: Specifies the minimum retry concurrency
- allowed for the retry budget.
- maximum: 4294967295
- minimum: 0
- type: integer
- percent:
- description: Specifies the limit on concurrent retries
- as a percentage of the sum of active requests and
- active pending requests.
- format: double
- maximum: 100
- minimum: 0
- nullable: true
- type: number
- type: object
- tls:
- description: TLS related settings for connections to the
- upstream service.
- properties:
- caCertificates:
- description: 'OPTIONAL: The path to the file containing
- certificate authority certificates to use in verifying
- a presented server certificate.'
- type: string
- caCrl:
- description: 'OPTIONAL: The path to the file containing
- the certificate revocation list (CRL) to use in verifying
- a presented server certificate.'
- type: string
- clientCertificate:
- description: REQUIRED if mode is `MUTUAL`.
- type: string
- credentialName:
- description: The name of the secret that holds the TLS
- certs for the client including the CA certificates.
- type: string
- insecureSkipVerify:
- description: '`insecureSkipVerify` specifies whether
- the proxy should skip verifying the CA signature and
- SAN for the server certificate corresponding to the
- host.'
- nullable: true
- type: boolean
- mode:
- description: |-
- Indicates whether connections to this port should be secured using TLS.
-
- Valid Options: DISABLE, SIMPLE, MUTUAL, dubbo_MUTUAL
- enum:
- - DISABLE
- - SIMPLE
- - MUTUAL
- - dubbo_MUTUAL
- type: string
- privateKey:
- description: REQUIRED if mode is `MUTUAL`.
- type: string
- sni:
- description: SNI string to present to the server during
- TLS handshake.
- type: string
- subjectAltNames:
- description: A list of alternate names to verify the
- subject identity in the certificate.
- items:
- type: string
- type: array
- type: object
- tunnel:
- description: Configuration of tunneling TCP over other transport
- or application layers for the host configured in the DestinationRule.
- properties:
- protocol:
- description: Specifies which protocol to use for tunneling
- the downstream connection.
- type: string
- targetHost:
- description: Specifies a host to which the downstream
- connection is tunneled.
- type: string
- targetPort:
- description: Specifies a port to which the downstream
- connection is tunneled.
- maximum: 4294967295
- minimum: 0
- type: integer
- required:
- - targetHost
- - targetPort
- type: object
- type: object
- required:
- - name
- type: object
- type: array
- trafficPolicy:
- description: Traffic policies to apply (load balancing policy, connection
- pool sizes, outlier detection).
- properties:
- connectionPool:
- properties:
- http:
- description: HTTP connection pool settings.
- properties:
- h2UpgradePolicy:
- description: |-
- Specify if http1.1 connection should be upgraded to http2 for the associated destination.
-
- Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE
- enum:
- - DEFAULT
- - DO_NOT_UPGRADE
- - UPGRADE
- type: string
- http1MaxPendingRequests:
- description: Maximum number of requests that will be queued
- while waiting for a ready connection pool connection.
- format: int32
- type: integer
- http2MaxRequests:
- description: Maximum number of active requests to a destination.
- format: int32
- type: integer
- idleTimeout:
- description: The idle timeout for upstream connection
- pool connections.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- maxConcurrentStreams:
- description: The maximum number of concurrent streams
- allowed for a peer on one HTTP/2 connection.
- format: int32
- type: integer
- maxRequestsPerConnection:
- description: Maximum number of requests per connection
- to a backend.
- format: int32
- type: integer
- maxRetries:
- description: Maximum number of retries that can be outstanding
- to all hosts in a cluster at a given time.
- format: int32
- type: integer
- useClientProtocol:
- description: If set to true, client protocol will be preserved
- while initiating connection to backend.
- type: boolean
- type: object
- tcp:
- description: Settings common to both HTTP and TCP upstream
- connections.
- properties:
- connectTimeout:
- description: TCP connection timeout.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- idleTimeout:
- description: The idle timeout for TCP connections.
- type: string
- maxConnectionDuration:
- description: The maximum duration of a connection.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- maxConnections:
- description: Maximum number of HTTP1 /TCP connections
- to a destination host.
- format: int32
- type: integer
- tcpKeepalive:
- description: If set then set SO_KEEPALIVE on the socket
- to enable TCP Keepalives.
- properties:
- interval:
- description: The time duration between keep-alive
- probes.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- probes:
- description: Maximum number of keepalive probes to
- send without response before deciding the connection
- is dead.
- maximum: 4294967295
- minimum: 0
- type: integer
- time:
- description: The time duration a connection needs
- to be idle before keep-alive probes start being
- sent.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- type: object
- type: object
- type: object
- loadBalancer:
- description: Settings controlling the load balancer algorithms.
- oneOf:
- - not:
- anyOf:
- - required:
- - simple
- - required:
- - consistentHash
- - required:
- - simple
- - required:
- - consistentHash
- properties:
- consistentHash:
- allOf:
- - oneOf:
- - not:
- anyOf:
- - required:
- - httpHeaderName
- - required:
- - httpCookie
- - required:
- - useSourceIp
- - required:
- - httpQueryParameterName
- - required:
- - httpHeaderName
- - required:
- - httpCookie
- - required:
- - useSourceIp
- - required:
- - httpQueryParameterName
- - oneOf:
- - not:
- anyOf:
- - required:
- - ringHash
- - required:
- - maglev
- - required:
- - ringHash
- - required:
- - maglev
- properties:
- httpCookie:
- description: Hash based on HTTP cookie.
- properties:
- name:
- description: Name of the cookie.
- type: string
- path:
- description: Path to set for the cookie.
- type: string
- ttl:
- description: Lifetime of the cookie.
- type: string
- required:
- - name
- type: object
- httpHeaderName:
- description: Hash based on a specific HTTP header.
- type: string
- httpQueryParameterName:
- description: Hash based on a specific HTTP query parameter.
- type: string
- maglev:
- description: The Maglev load balancer implements consistent
- hashing to backend hosts.
- properties:
- tableSize:
- description: The table size for Maglev hashing.
- minimum: 0
- type: integer
- type: object
- minimumRingSize:
- description: Deprecated.
- minimum: 0
- type: integer
- ringHash:
- description: The ring/modulo hash load balancer implements
- consistent hashing to backend hosts.
- properties:
- minimumRingSize:
- description: The minimum number of virtual nodes to
- use for the hash ring.
- minimum: 0
- type: integer
- type: object
- useSourceIp:
- description: Hash based on the source IP address.
- type: boolean
- type: object
- localityLbSetting:
- properties:
- distribute:
- description: 'Optional: only one of distribute, failover
- or failoverPriority can be set.'
- items:
- properties:
- from:
- description: Originating locality, '/' separated,
- e.g.
- type: string
- to:
- additionalProperties:
- maximum: 4294967295
- minimum: 0
- type: integer
- description: Map of upstream localities to traffic
- distribution weights.
- type: object
- type: object
- type: array
- enabled:
- description: Enable locality load balancing.
- nullable: true
- type: boolean
- failover:
- description: 'Optional: only one of distribute, failover
- or failoverPriority can be set.'
- items:
- properties:
- from:
- description: Originating region.
- type: string
- to:
- description: Destination region the traffic will
- fail over to when endpoints in the 'from' region
- becomes unhealthy.
- type: string
- type: object
- type: array
- failoverPriority:
- description: failoverPriority is an ordered list of labels
- used to sort endpoints to do priority based load balancing.
- items:
- type: string
- type: array
- type: object
- simple:
- description: |2-
-
-
- Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST
- enum:
- - UNSPECIFIED
- - LEAST_CONN
- - RANDOM
- - PASSTHROUGH
- - ROUND_ROBIN
- - LEAST_REQUEST
- type: string
- warmup:
- description: Represents the warmup configuration of Service.
- properties:
- aggression:
- description: This parameter controls the speed of traffic
- increase over the warmup duration.
- format: double
- minimum: 1
- nullable: true
- type: number
- duration:
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- minimumPercent:
- format: double
- maximum: 100
- minimum: 0
- nullable: true
- type: number
- required:
- - duration
- type: object
- warmupDurationSecs:
- description: 'Deprecated: use `warmup` instead.'
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- type: object
- outlierDetection:
- properties:
- baseEjectionTime:
- description: Minimum ejection duration.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- consecutive5xxErrors:
- description: Number of 5xx errors before a host is ejected
- from the connection pool.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- consecutiveErrors:
- format: int32
- type: integer
- consecutiveGatewayErrors:
- description: Number of gateway errors before a host is ejected
- from the connection pool.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- consecutiveLocalOriginFailures:
- description: The number of consecutive locally originated
- failures before ejection occurs.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- interval:
- description: Time interval between ejection sweep analysis.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- maxEjectionPercent:
- description: Maximum % of hosts in the load balancing pool
- for the upstream service that can be ejected.
- format: int32
- type: integer
- minHealthPercent:
- description: Outlier detection will be enabled as long as
- the associated load balancing pool has at least `minHealthPercent`
- hosts in healthy mode.
- format: int32
- type: integer
- splitExternalLocalOriginErrors:
- description: Determines whether to distinguish local origin
- failures from external errors.
- type: boolean
- type: object
- portLevelSettings:
- description: Traffic policies specific to individual ports.
- items:
- properties:
- connectionPool:
- properties:
- http:
- description: HTTP connection pool settings.
- properties:
- h2UpgradePolicy:
- description: |-
- Specify if http1.1 connection should be upgraded to http2 for the associated destination.
-
- Valid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE
- enum:
- - DEFAULT
- - DO_NOT_UPGRADE
- - UPGRADE
- type: string
- http1MaxPendingRequests:
- description: Maximum number of requests that will
- be queued while waiting for a ready connection
- pool connection.
- format: int32
- type: integer
- http2MaxRequests:
- description: Maximum number of active requests to
- a destination.
- format: int32
- type: integer
- idleTimeout:
- description: The idle timeout for upstream connection
- pool connections.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- maxConcurrentStreams:
- description: The maximum number of concurrent streams
- allowed for a peer on one HTTP/2 connection.
- format: int32
- type: integer
- maxRequestsPerConnection:
- description: Maximum number of requests per connection
- to a backend.
- format: int32
- type: integer
- maxRetries:
- description: Maximum number of retries that can
- be outstanding to all hosts in a cluster at a
- given time.
- format: int32
- type: integer
- useClientProtocol:
- description: If set to true, client protocol will
- be preserved while initiating connection to backend.
- type: boolean
- type: object
- tcp:
- description: Settings common to both HTTP and TCP upstream
- connections.
- properties:
- connectTimeout:
- description: TCP connection timeout.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- idleTimeout:
- description: The idle timeout for TCP connections.
- type: string
- maxConnectionDuration:
- description: The maximum duration of a connection.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- maxConnections:
- description: Maximum number of HTTP1 /TCP connections
- to a destination host.
- format: int32
- type: integer
- tcpKeepalive:
- description: If set then set SO_KEEPALIVE on the
- socket to enable TCP Keepalives.
- properties:
- interval:
- description: The time duration between keep-alive
- probes.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- probes:
- description: Maximum number of keepalive probes
- to send without response before deciding the
- connection is dead.
- maximum: 4294967295
- minimum: 0
- type: integer
- time:
- description: The time duration a connection
- needs to be idle before keep-alive probes
- start being sent.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater
- than 1ms
- rule: duration(self) >= duration('1ms')
- type: object
- type: object
- type: object
- loadBalancer:
- description: Settings controlling the load balancer algorithms.
- oneOf:
- - not:
- anyOf:
- - required:
- - simple
- - required:
- - consistentHash
- - required:
- - simple
- - required:
- - consistentHash
- properties:
- consistentHash:
- allOf:
- - oneOf:
- - not:
- anyOf:
- - required:
- - httpHeaderName
- - required:
- - httpCookie
- - required:
- - useSourceIp
- - required:
- - httpQueryParameterName
- - required:
- - httpHeaderName
- - required:
- - httpCookie
- - required:
- - useSourceIp
- - required:
- - httpQueryParameterName
- - oneOf:
- - not:
- anyOf:
- - required:
- - ringHash
- - required:
- - maglev
- - required:
- - ringHash
- - required:
- - maglev
- properties:
- httpCookie:
- description: Hash based on HTTP cookie.
- properties:
- name:
- description: Name of the cookie.
- type: string
- path:
- description: Path to set for the cookie.
- type: string
- ttl:
- description: Lifetime of the cookie.
- type: string
- required:
- - name
- type: object
- httpHeaderName:
- description: Hash based on a specific HTTP header.
- type: string
- httpQueryParameterName:
- description: Hash based on a specific HTTP query
- parameter.
- type: string
- maglev:
- description: The Maglev load balancer implements
- consistent hashing to backend hosts.
- properties:
- tableSize:
- description: The table size for Maglev hashing.
- minimum: 0
- type: integer
- type: object
- minimumRingSize:
- description: Deprecated.
- minimum: 0
- type: integer
- ringHash:
- description: The ring/modulo hash load balancer
- implements consistent hashing to backend hosts.
- properties:
- minimumRingSize:
- description: The minimum number of virtual nodes
- to use for the hash ring.
- minimum: 0
- type: integer
- type: object
- useSourceIp:
- description: Hash based on the source IP address.
- type: boolean
- type: object
- localityLbSetting:
- properties:
- distribute:
- description: 'Optional: only one of distribute,
- failover or failoverPriority can be set.'
- items:
- properties:
- from:
- description: Originating locality, '/' separated,
- e.g.
- type: string
- to:
- additionalProperties:
- maximum: 4294967295
- minimum: 0
- type: integer
- description: Map of upstream localities to
- traffic distribution weights.
- type: object
- type: object
- type: array
- enabled:
- description: Enable locality load balancing.
- nullable: true
- type: boolean
- failover:
- description: 'Optional: only one of distribute,
- failover or failoverPriority can be set.'
- items:
- properties:
- from:
- description: Originating region.
- type: string
- to:
- description: Destination region the traffic
- will fail over to when endpoints in the
- 'from' region becomes unhealthy.
- type: string
- type: object
- type: array
- failoverPriority:
- description: failoverPriority is an ordered list
- of labels used to sort endpoints to do priority
- based load balancing.
- items:
- type: string
- type: array
- type: object
- simple:
- description: |2-
-
-
- Valid Options: LEAST_CONN, RANDOM, PASSTHROUGH, ROUND_ROBIN, LEAST_REQUEST
- enum:
- - UNSPECIFIED
- - LEAST_CONN
- - RANDOM
- - PASSTHROUGH
- - ROUND_ROBIN
- - LEAST_REQUEST
- type: string
- warmup:
- description: Represents the warmup configuration of
- Service.
- properties:
- aggression:
- description: This parameter controls the speed of
- traffic increase over the warmup duration.
- format: double
- minimum: 1
- nullable: true
- type: number
- duration:
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than
- 1ms
- rule: duration(self) >= duration('1ms')
- minimumPercent:
- format: double
- maximum: 100
- minimum: 0
- nullable: true
- type: number
- required:
- - duration
- type: object
- warmupDurationSecs:
- description: 'Deprecated: use `warmup` instead.'
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- type: object
- outlierDetection:
- properties:
- baseEjectionTime:
- description: Minimum ejection duration.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- consecutive5xxErrors:
- description: Number of 5xx errors before a host is ejected
- from the connection pool.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- consecutiveErrors:
- format: int32
- type: integer
- consecutiveGatewayErrors:
- description: Number of gateway errors before a host
- is ejected from the connection pool.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- consecutiveLocalOriginFailures:
- description: The number of consecutive locally originated
- failures before ejection occurs.
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- interval:
- description: Time interval between ejection sweep analysis.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- maxEjectionPercent:
- description: Maximum % of hosts in the load balancing
- pool for the upstream service that can be ejected.
- format: int32
- type: integer
- minHealthPercent:
- description: Outlier detection will be enabled as long
- as the associated load balancing pool has at least
- `minHealthPercent` hosts in healthy mode.
- format: int32
- type: integer
- splitExternalLocalOriginErrors:
- description: Determines whether to distinguish local
- origin failures from external errors.
- type: boolean
- type: object
- port:
- description: Specifies the number of a port on the destination
- service on which this policy is being applied.
- properties:
- number:
- maximum: 4294967295
- minimum: 0
- type: integer
- type: object
- tls:
- description: TLS related settings for connections to the
- upstream service.
- properties:
- caCertificates:
- description: 'OPTIONAL: The path to the file containing
- certificate authority certificates to use in verifying
- a presented server certificate.'
- type: string
- caCrl:
- description: 'OPTIONAL: The path to the file containing
- the certificate revocation list (CRL) to use in verifying
- a presented server certificate.'
- type: string
- clientCertificate:
- description: REQUIRED if mode is `MUTUAL`.
- type: string
- credentialName:
- description: The name of the secret that holds the TLS
- certs for the client including the CA certificates.
- type: string
- insecureSkipVerify:
- description: '`insecureSkipVerify` specifies whether
- the proxy should skip verifying the CA signature and
- SAN for the server certificate corresponding to the
- host.'
- nullable: true
- type: boolean
- mode:
- description: |-
- Indicates whether connections to this port should be secured using TLS.
-
- Valid Options: DISABLE, SIMPLE, MUTUAL, dubbo_MUTUAL
- enum:
- - DISABLE
- - SIMPLE
- - MUTUAL
- - dubbo_MUTUAL
- type: string
- privateKey:
- description: REQUIRED if mode is `MUTUAL`.
- type: string
- sni:
- description: SNI string to present to the server during
- TLS handshake.
- type: string
- subjectAltNames:
- description: A list of alternate names to verify the
- subject identity in the certificate.
- items:
- type: string
- type: array
- type: object
- type: object
- maxItems: 4096
- type: array
- proxyProtocol:
- description: The upstream PROXY protocol settings.
- properties:
- version:
- description: |-
- The PROXY protocol version to use.
-
- Valid Options: V1, V2
- enum:
- - V1
- - V2
- type: string
- type: object
- retryBudget:
- description: Specifies a limit on concurrent retries in relation
- to the number of active requests.
- properties:
- minRetryConcurrency:
- description: Specifies the minimum retry concurrency allowed
- for the retry budget.
- maximum: 4294967295
- minimum: 0
- type: integer
- percent:
- description: Specifies the limit on concurrent retries as
- a percentage of the sum of active requests and active pending
- requests.
- format: double
- maximum: 100
- minimum: 0
- nullable: true
- type: number
- type: object
- tls:
- description: TLS related settings for connections to the upstream
- service.
- properties:
- caCertificates:
- description: 'OPTIONAL: The path to the file containing certificate
- authority certificates to use in verifying a presented server
- certificate.'
- type: string
- caCrl:
- description: 'OPTIONAL: The path to the file containing the
- certificate revocation list (CRL) to use in verifying a
- presented server certificate.'
- type: string
- clientCertificate:
- description: REQUIRED if mode is `MUTUAL`.
- type: string
- credentialName:
- description: The name of the secret that holds the TLS certs
- for the client including the CA certificates.
- type: string
- insecureSkipVerify:
- description: '`insecureSkipVerify` specifies whether the proxy
- should skip verifying the CA signature and SAN for the server
- certificate corresponding to the host.'
- nullable: true
- type: boolean
- mode:
- description: |-
- Indicates whether connections to this port should be secured using TLS.
-
- Valid Options: DISABLE, SIMPLE, MUTUAL, dubbo_MUTUAL
- enum:
- - DISABLE
- - SIMPLE
- - MUTUAL
- - dubbo_MUTUAL
- type: string
- privateKey:
- description: REQUIRED if mode is `MUTUAL`.
- type: string
- sni:
- description: SNI string to present to the server during TLS
- handshake.
- type: string
- subjectAltNames:
- description: A list of alternate names to verify the subject
- identity in the certificate.
- items:
- type: string
- type: array
- type: object
- tunnel:
- description: Configuration of tunneling TCP over other transport
- or application layers for the host configured in the DestinationRule.
- properties:
- protocol:
- description: Specifies which protocol to use for tunneling
- the downstream connection.
- type: string
- targetHost:
- description: Specifies a host to which the downstream connection
- is tunneled.
- type: string
- targetPort:
- description: Specifies a port to which the downstream connection
- is tunneled.
- maximum: 4294967295
- minimum: 0
- type: integer
- required:
- - targetHost
- - targetPort
- type: object
- type: object
- workloadSelector:
- description: Criteria used to select the specific set of pods/VMs
- on which this `DestinationRule` configuration should be applied.
- properties:
- matchLabels:
- additionalProperties:
- maxLength: 63
- type: string
- x-kubernetes-validations:
- - message: wildcard not allowed in label value match
- rule: '!self.contains("*")'
- description: One or more labels that indicate a specific set of
- pods/VMs on which a policy should be applied.
- maxProperties: 4096
- type: object
- x-kubernetes-validations:
- - message: wildcard not allowed in label key match
- rule: self.all(key, !key.contains("*"))
- - message: key must not be empty
- rule: self.all(key, key.size() != 0)
- type: object
- required:
- - host
- type: object
- status:
- properties:
- conditions:
- description: Current service state of the resource.
- items:
- properties:
- lastProbeTime:
- description: Last time we probed the condition.
- format: date-time
- type: string
- lastTransitionTime:
- description: Last time the condition transitioned from one status
- to another.
- format: date-time
- type: string
- message:
- description: Human-readable message indicating details about
- last transition.
- type: string
- observedGeneration:
- anyOf:
- - type: integer
- - type: string
- description: Resource Generation to which the Condition refers.
- x-kubernetes-int-or-string: true
- reason:
- description: Unique, one-word, CamelCase reason for the condition's
- last transition.
- type: string
- status:
- description: Status is the status of the condition.
- type: string
- type:
- description: Type is the type of the condition.
- type: string
- type: object
- type: array
- observedGeneration:
- anyOf:
- - type: integer
- - type: string
- x-kubernetes-int-or-string: true
- validationMessages:
- description: Includes any errors or warnings detected by dubbo's analyzers.
- items:
- properties:
- documentationUrl:
- description: A url pointing to the dubbo documentation for this
- specific error type.
- type: string
- level:
- description: |-
- Represents how severe a message is.
-
- Valid Options: UNKNOWN, ERROR, WARNING, INFO
- enum:
- - UNKNOWN
- - ERROR
- - WARNING
- - INFO
- type: string
- type:
- properties:
- code:
- description: A 7 character code matching `^IST[0-9]{4}$`
- intended to uniquely identify the message type.
- type: string
- name:
- description: A human-readable name for the message type.
- type: string
- type: object
- type: object
- type: array
- type: object
- x-kubernetes-preserve-unknown-fields: true
- type: object
- served: true
- storage: false
- subresources:
- status: {}
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- "helm.sh/resource-policy": keep
- labels:
- app: dubbo-sail
- chart: dubbo
- heritage: Tiller
- dubbo: security
- release: dubbo
- name: authorizationpolicies.security.dubbo.io
-spec:
- group: security.dubbo.io
- names:
- categories:
- - dubbo-io
- - security-dubbo-io
- kind: AuthorizationPolicy
- listKind: AuthorizationPolicyList
- plural: authorizationpolicies
- shortNames:
- - ap
- singular: authorizationpolicy
- scope: Namespaced
- versions:
- - additionalPrinterColumns:
- - description: The operation to take.
- jsonPath: .spec.action
- name: Action
- type: string
- - description: 'CreationTimestamp is a timestamp representing the server time
- when this object was created. It is not guaranteed to be set in happens-before
- order across separate operations. Clients may not set this value. It is represented
- in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for
- lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata'
- jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- name: v1
- schema:
- openAPIV3Schema:
- properties:
- spec:
- description: 'Configuration for access control on workloads.'
- oneOf:
- - not:
- anyOf:
- - required:
- - provider
- - required:
- - provider
- properties:
- action:
- description: |-
- Optional.
-
- Valid Options: ALLOW, DENY, AUDIT, CUSTOM
- enum:
- - ALLOW
- - DENY
- - AUDIT
- - CUSTOM
- type: string
- provider:
- description: Specifies detailed configuration of the CUSTOM action.
- properties:
- name:
- description: Specifies the name of the extension provider.
- type: string
- type: object
- rules:
- description: Optional.
- items:
- properties:
- from:
- description: Optional.
- items:
- properties:
- source:
- description: Source specifies the source of a request.
- properties:
- ipBlocks:
- description: Optional.
- items:
- type: string
- type: array
- namespaces:
- description: Optional.
- items:
- type: string
- type: array
- notIpBlocks:
- description: Optional.
- items:
- type: string
- type: array
- notNamespaces:
- description: Optional.
- items:
- type: string
- type: array
- notPrincipals:
- description: Optional.
- items:
- type: string
- type: array
- notRemoteIpBlocks:
- description: Optional.
- items:
- type: string
- type: array
- notRequestPrincipals:
- description: Optional.
- items:
- type: string
- type: array
- notServiceAccounts:
- description: Optional.
- items:
- maxLength: 320
- type: string
- maxItems: 16
- type: array
- principals:
- description: Optional.
- items:
- type: string
- type: array
- remoteIpBlocks:
- description: Optional.
- items:
- type: string
- type: array
- requestPrincipals:
- description: Optional.
- items:
- type: string
- type: array
- serviceAccounts:
- description: Optional.
- items:
- maxLength: 320
- type: string
- maxItems: 16
- type: array
- type: object
- x-kubernetes-validations:
- - message: Cannot set serviceAccounts with namespaces
- or principals
- rule: |-
- (has(self.serviceAccounts) || has(self.notServiceAccounts)) ? (!has(self.principals) &&
- !has(self.notPrincipals) && !has(self.namespaces) && !has(self.notNamespaces)) : true
- type: object
- maxItems: 512
- type: array
- to:
- description: Optional.
- items:
- properties:
- operation:
- description: Operation specifies the operation of a request.
- properties:
- hosts:
- description: Optional.
- items:
- type: string
- type: array
- methods:
- description: Optional.
- items:
- type: string
- type: array
- notHosts:
- description: Optional.
- items:
- type: string
- type: array
- notMethods:
- description: Optional.
- items:
- type: string
- type: array
- notPaths:
- description: Optional.
- items:
- type: string
- type: array
- notPorts:
- description: Optional.
- items:
- type: string
- type: array
- paths:
- description: Optional.
- items:
- type: string
- type: array
- ports:
- description: Optional.
- items:
- type: string
- type: array
- type: object
- type: object
- type: array
- when:
- description: Optional.
- items:
- properties:
- key:
- description: The name of an dubbo attribute.
- type: string
- notValues:
- description: Optional.
- items:
- type: string
- type: array
- values:
- description: Optional.
- items:
- type: string
- type: array
- required:
- - key
- type: object
- type: array
- type: object
- maxItems: 512
- type: array
- selector:
- description: Optional.
- properties:
- matchLabels:
- additionalProperties:
- maxLength: 63
- type: string
- x-kubernetes-validations:
- - message: wildcard not allowed in label value match
- rule: '!self.contains("*")'
- description: One or more labels that indicate a specific set of
- pods/VMs on which a policy should be applied.
- maxProperties: 4096
- type: object
- x-kubernetes-validations:
- - message: wildcard not allowed in label key match
- rule: self.all(key, !key.contains("*"))
- - message: key must not be empty
- rule: self.all(key, key.size() != 0)
- type: object
- targetRef:
- properties:
- group:
- description: group is the group of the target resource.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: kind is kind of the target resource.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: name is the name of the target resource.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: namespace is the namespace of the referent.
- type: string
- x-kubernetes-validations:
- - message: cross namespace referencing is not currently supported
- rule: self.size() == 0
- required:
- - kind
- - name
- type: object
- targetRefs:
- description: Optional.
- items:
- properties:
- group:
- description: group is the group of the target resource.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: kind is kind of the target resource.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: name is the name of the target resource.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: namespace is the namespace of the referent.
- type: string
- x-kubernetes-validations:
- - message: cross namespace referencing is not currently supported
- rule: self.size() == 0
- required:
- - kind
- - name
- type: object
- maxItems: 16
- type: array
- type: object
- x-kubernetes-validations:
- - message: only one of targetRefs or selector can be set
- rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0)
- + (has(self.targetRefs) ? 1 : 0) <= 1'
- status:
- properties:
- conditions:
- description: Current service state of the resource.
- items:
- properties:
- lastProbeTime:
- description: Last time we probed the condition.
- format: date-time
- type: string
- lastTransitionTime:
- description: Last time the condition transitioned from one status
- to another.
- format: date-time
- type: string
- message:
- description: Human-readable message indicating details about
- last transition.
- type: string
- observedGeneration:
- anyOf:
- - type: integer
- - type: string
- description: Resource Generation to which the Condition refers.
- x-kubernetes-int-or-string: true
- reason:
- description: Unique, one-word, CamelCase reason for the condition's
- last transition.
- type: string
- status:
- description: Status is the status of the condition.
- type: string
- type:
- description: Type is the type of the condition.
- type: string
- type: object
- type: array
- observedGeneration:
- anyOf:
- - type: integer
- - type: string
- x-kubernetes-int-or-string: true
- validationMessages:
- description: Includes any errors or warnings detected by dubbo's analyzers.
- items:
- properties:
- documentationUrl:
- description: A url pointing to the dubbo documentation for this
- specific error type.
- type: string
- level:
- description: |-
- Represents how severe a message is.
-
- Valid Options: UNKNOWN, ERROR, WARNING, INFO
- enum:
- - UNKNOWN
- - ERROR
- - WARNING
- - INFO
- type: string
- type:
- properties:
- code:
- description: A 7 character code matching `^IST[0-9]{4}$`
- intended to uniquely identify the message type.
- type: string
- name:
- description: A human-readable name for the message type.
- type: string
- type: object
- type: object
- type: array
- type: object
- x-kubernetes-preserve-unknown-fields: true
- type: object
- served: true
- storage: false
- subresources:
- status: {}
- - additionalPrinterColumns:
- - description: The operation to take.
- jsonPath: .spec.action
- name: Action
- type: string
- - description: 'CreationTimestamp is a timestamp representing the server time
- when this object was created. It is not guaranteed to be set in happens-before
- order across separate operations. Clients may not set this value. It is represented
- in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for
- lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata'
- jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- name: v1beta1
- schema:
- openAPIV3Schema:
- properties:
- spec:
- description: 'Configuration for access control on workloads.'
- oneOf:
- - not:
- anyOf:
- - required:
- - provider
- - required:
- - provider
- properties:
- action:
- description: |-
- Optional.
-
- Valid Options: ALLOW, DENY, AUDIT, CUSTOM
- enum:
- - ALLOW
- - DENY
- - AUDIT
- - CUSTOM
- type: string
- provider:
- description: Specifies detailed configuration of the CUSTOM action.
- properties:
- name:
- description: Specifies the name of the extension provider.
- type: string
- type: object
- rules:
- description: Optional.
- items:
- properties:
- from:
- description: Optional.
- items:
- properties:
- source:
- description: Source specifies the source of a request.
- properties:
- ipBlocks:
- description: Optional.
- items:
- type: string
- type: array
- namespaces:
- description: Optional.
- items:
- type: string
- type: array
- notIpBlocks:
- description: Optional.
- items:
- type: string
- type: array
- notNamespaces:
- description: Optional.
- items:
- type: string
- type: array
- notPrincipals:
- description: Optional.
- items:
- type: string
- type: array
- notRemoteIpBlocks:
- description: Optional.
- items:
- type: string
- type: array
- notRequestPrincipals:
- description: Optional.
- items:
- type: string
- type: array
- notServiceAccounts:
- description: Optional.
- items:
- maxLength: 320
- type: string
- maxItems: 16
- type: array
- principals:
- description: Optional.
- items:
- type: string
- type: array
- remoteIpBlocks:
- description: Optional.
- items:
- type: string
- type: array
- requestPrincipals:
- description: Optional.
- items:
- type: string
- type: array
- serviceAccounts:
- description: Optional.
- items:
- maxLength: 320
- type: string
- maxItems: 16
- type: array
- type: object
- x-kubernetes-validations:
- - message: Cannot set serviceAccounts with namespaces
- or principals
- rule: |-
- (has(self.serviceAccounts) || has(self.notServiceAccounts)) ? (!has(self.principals) &&
- !has(self.notPrincipals) && !has(self.namespaces) && !has(self.notNamespaces)) : true
- type: object
- maxItems: 512
- type: array
- to:
- description: Optional.
- items:
- properties:
- operation:
- description: Operation specifies the operation of a request.
- properties:
- hosts:
- description: Optional.
- items:
- type: string
- type: array
- methods:
- description: Optional.
- items:
- type: string
- type: array
- notHosts:
- description: Optional.
- items:
- type: string
- type: array
- notMethods:
- description: Optional.
- items:
- type: string
- type: array
- notPaths:
- description: Optional.
- items:
- type: string
- type: array
- notPorts:
- description: Optional.
- items:
- type: string
- type: array
- paths:
- description: Optional.
- items:
- type: string
- type: array
- ports:
- description: Optional.
- items:
- type: string
- type: array
- type: object
- type: object
- type: array
- when:
- description: Optional.
- items:
- properties:
- key:
- description: The name of an dubbo attribute.
- type: string
- notValues:
- description: Optional.
- items:
- type: string
- type: array
- values:
- description: Optional.
- items:
- type: string
- type: array
- required:
- - key
- type: object
- type: array
- type: object
- maxItems: 512
- type: array
- selector:
- description: Optional.
- properties:
- matchLabels:
- additionalProperties:
- maxLength: 63
- type: string
- x-kubernetes-validations:
- - message: wildcard not allowed in label value match
- rule: '!self.contains("*")'
- description: One or more labels that indicate a specific set of
- pods/VMs on which a policy should be applied.
- maxProperties: 4096
- type: object
- x-kubernetes-validations:
- - message: wildcard not allowed in label key match
- rule: self.all(key, !key.contains("*"))
- - message: key must not be empty
- rule: self.all(key, key.size() != 0)
- type: object
- targetRef:
- properties:
- group:
- description: group is the group of the target resource.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: kind is kind of the target resource.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: name is the name of the target resource.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: namespace is the namespace of the referent.
- type: string
- x-kubernetes-validations:
- - message: cross namespace referencing is not currently supported
- rule: self.size() == 0
- required:
- - kind
- - name
- type: object
- targetRefs:
- description: Optional.
- items:
- properties:
- group:
- description: group is the group of the target resource.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: kind is kind of the target resource.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: name is the name of the target resource.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: namespace is the namespace of the referent.
- type: string
- x-kubernetes-validations:
- - message: cross namespace referencing is not currently supported
- rule: self.size() == 0
- required:
- - kind
- - name
- type: object
- maxItems: 16
- type: array
- type: object
- x-kubernetes-validations:
- - message: only one of targetRefs or selector can be set
- rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0)
- + (has(self.targetRefs) ? 1 : 0) <= 1'
- status:
- properties:
- conditions:
- description: Current service state of the resource.
- items:
- properties:
- lastProbeTime:
- description: Last time we probed the condition.
- format: date-time
- type: string
- lastTransitionTime:
- description: Last time the condition transitioned from one status
- to another.
- format: date-time
- type: string
- message:
- description: Human-readable message indicating details about
- last transition.
- type: string
- observedGeneration:
- anyOf:
- - type: integer
- - type: string
- description: Resource Generation to which the Condition refers.
- x-kubernetes-int-or-string: true
- reason:
- description: Unique, one-word, CamelCase reason for the condition's
- last transition.
- type: string
- status:
- description: Status is the status of the condition.
- type: string
- type:
- description: Type is the type of the condition.
- type: string
- type: object
- type: array
- observedGeneration:
- anyOf:
- - type: integer
- - type: string
- x-kubernetes-int-or-string: true
- validationMessages:
- description: Includes any errors or warnings detected by dubbo's analyzers.
- items:
- properties:
- documentationUrl:
- description: A url pointing to the dubbo documentation for this
- specific error type.
- type: string
- level:
- description: |-
- Represents how severe a message is.
-
- Valid Options: UNKNOWN, ERROR, WARNING, INFO
- enum:
- - UNKNOWN
- - ERROR
- - WARNING
- - INFO
- type: string
- type:
- properties:
- code:
- description: A 7 character code matching `^IST[0-9]{4}$`
- intended to uniquely identify the message type.
- type: string
- name:
- description: A human-readable name for the message type.
- type: string
- type: object
- type: object
- type: array
- type: object
- x-kubernetes-preserve-unknown-fields: true
- type: object
- served: true
- storage: true
- subresources:
- status: {}
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- "helm.sh/resource-policy": keep
- labels:
- app: dubbo-sail
- chart: dubbo
- heritage: Tiller
- dubbo: security
- release: dubbo
- name: peerauthentications.security.dubbo.io
-spec:
- group: security.dubbo.io
- names:
- categories:
- - dubbo-io
- - security-dubbo-io
- kind: PeerAuthentication
- listKind: PeerAuthenticationList
- plural: peerauthentications
- shortNames:
- - pa
- singular: peerauthentication
- scope: Namespaced
- versions:
- - additionalPrinterColumns:
- - description: Defines the mTLS mode used for peer authentication.
- jsonPath: .spec.mtls.mode
- name: Mode
- type: string
- - description: 'CreationTimestamp is a timestamp representing the server time
- when this object was created. It is not guaranteed to be set in happens-before
- order across separate operations. Clients may not set this value. It is represented
- in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for
- lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata'
- jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- name: v1
- schema:
- openAPIV3Schema:
- properties:
- spec:
- description: 'Peer authentication configuration for workloads.'
- properties:
- mtls:
- description: Mutual TLS settings for workload.
- properties:
- mode:
- description: |-
- Defines the mTLS mode used for peer authentication.
-
- Valid Options: DISABLE, PERMISSIVE, STRICT
- enum:
- - UNSET
- - DISABLE
- - PERMISSIVE
- - STRICT
- type: string
- type: object
- portLevelMtls:
- additionalProperties:
- properties:
- mode:
- description: |-
- Defines the mTLS mode used for peer authentication.
-
- Valid Options: DISABLE, PERMISSIVE, STRICT
- enum:
- - UNSET
- - DISABLE
- - PERMISSIVE
- - STRICT
- type: string
- type: object
- description: Port specific mutual TLS settings.
- minProperties: 1
- type: object
- x-kubernetes-validations:
- - message: port must be between 1-65535
- rule: self.all(key, 0 < int(key) && int(key) <= 65535)
- selector:
- description: The selector determines the workloads to apply the PeerAuthentication
- on.
- properties:
- matchLabels:
- additionalProperties:
- maxLength: 63
- type: string
- x-kubernetes-validations:
- - message: wildcard not allowed in label value match
- rule: '!self.contains("*")'
- description: One or more labels that indicate a specific set of
- pods/VMs on which a policy should be applied.
- maxProperties: 4096
- type: object
- x-kubernetes-validations:
- - message: wildcard not allowed in label key match
- rule: self.all(key, !key.contains("*"))
- - message: key must not be empty
- rule: self.all(key, key.size() != 0)
- type: object
- type: object
- x-kubernetes-validations:
- - message: portLevelMtls requires selector
- rule: 'has(self.portLevelMtls) ? (((has(self.selector) && has(self.selector.matchLabels))
- ? self.selector.matchLabels : {}).size() > 0) : true'
- status:
- properties:
- conditions:
- description: Current service state of the resource.
- items:
- properties:
- lastProbeTime:
- description: Last time we probed the condition.
- format: date-time
- type: string
- lastTransitionTime:
- description: Last time the condition transitioned from one status
- to another.
- format: date-time
- type: string
- message:
- description: Human-readable message indicating details about
- last transition.
- type: string
- observedGeneration:
- anyOf:
- - type: integer
- - type: string
- description: Resource Generation to which the Condition refers.
- x-kubernetes-int-or-string: true
- reason:
- description: Unique, one-word, CamelCase reason for the condition's
- last transition.
- type: string
- status:
- description: Status is the status of the condition.
- type: string
- type:
- description: Type is the type of the condition.
- type: string
- type: object
- type: array
- observedGeneration:
- anyOf:
- - type: integer
- - type: string
- x-kubernetes-int-or-string: true
- validationMessages:
- description: Includes any errors or warnings detected by dubbo's analyzers.
- items:
- properties:
- documentationUrl:
- description: A url pointing to the dubbo documentation for this
- specific error type.
- type: string
- level:
- description: |-
- Represents how severe a message is.
-
- Valid Options: UNKNOWN, ERROR, WARNING, INFO
- enum:
- - UNKNOWN
- - ERROR
- - WARNING
- - INFO
- type: string
- type:
- properties:
- code:
- description: A 7 character code matching `^IST[0-9]{4}$`
- intended to uniquely identify the message type.
- type: string
- name:
- description: A human-readable name for the message type.
- type: string
- type: object
- type: object
- type: array
- type: object
- x-kubernetes-preserve-unknown-fields: true
- type: object
- served: true
- storage: false
- subresources:
- status: {}
- - additionalPrinterColumns:
- - description: Defines the mTLS mode used for peer authentication.
- jsonPath: .spec.mtls.mode
- name: Mode
- type: string
- - description: 'CreationTimestamp is a timestamp representing the server time
- when this object was created. It is not guaranteed to be set in happens-before
- order across separate operations. Clients may not set this value. It is represented
- in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for
- lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata'
- jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- name: v1beta1
- schema:
- openAPIV3Schema:
- properties:
- spec:
- description: 'Peer authentication configuration for workloads.'
- properties:
- mtls:
- description: Mutual TLS settings for workload.
- properties:
- mode:
- description: |-
- Defines the mTLS mode used for peer authentication.
-
- Valid Options: DISABLE, PERMISSIVE, STRICT
- enum:
- - UNSET
- - DISABLE
- - PERMISSIVE
- - STRICT
- type: string
- type: object
- portLevelMtls:
- additionalProperties:
- properties:
- mode:
- description: |-
- Defines the mTLS mode used for peer authentication.
-
- Valid Options: DISABLE, PERMISSIVE, STRICT
- enum:
- - UNSET
- - DISABLE
- - PERMISSIVE
- - STRICT
- type: string
- type: object
- description: Port specific mutual TLS settings.
- minProperties: 1
- type: object
- x-kubernetes-validations:
- - message: port must be between 1-65535
- rule: self.all(key, 0 < int(key) && int(key) <= 65535)
- selector:
- description: The selector determines the workloads to apply the PeerAuthentication
- on.
- properties:
- matchLabels:
- additionalProperties:
- maxLength: 63
- type: string
- x-kubernetes-validations:
- - message: wildcard not allowed in label value match
- rule: '!self.contains("*")'
- description: One or more labels that indicate a specific set of
- pods/VMs on which a policy should be applied.
- maxProperties: 4096
- type: object
- x-kubernetes-validations:
- - message: wildcard not allowed in label key match
- rule: self.all(key, !key.contains("*"))
- - message: key must not be empty
- rule: self.all(key, key.size() != 0)
- type: object
- type: object
- x-kubernetes-validations:
- - message: portLevelMtls requires selector
- rule: 'has(self.portLevelMtls) ? (((has(self.selector) && has(self.selector.matchLabels))
- ? self.selector.matchLabels : {}).size() > 0) : true'
- status:
- properties:
- conditions:
- description: Current service state of the resource.
- items:
- properties:
- lastProbeTime:
- description: Last time we probed the condition.
- format: date-time
- type: string
- lastTransitionTime:
- description: Last time the condition transitioned from one status
- to another.
- format: date-time
- type: string
- message:
- description: Human-readable message indicating details about
- last transition.
- type: string
- observedGeneration:
- anyOf:
- - type: integer
- - type: string
- description: Resource Generation to which the Condition refers.
- x-kubernetes-int-or-string: true
- reason:
- description: Unique, one-word, CamelCase reason for the condition's
- last transition.
- type: string
- status:
- description: Status is the status of the condition.
- type: string
- type:
- description: Type is the type of the condition.
- type: string
- type: object
- type: array
- observedGeneration:
- anyOf:
- - type: integer
- - type: string
- x-kubernetes-int-or-string: true
- validationMessages:
- description: Includes any errors or warnings detected by dubbo's analyzers.
- items:
- properties:
- documentationUrl:
- description: A url pointing to the dubbo documentation for this
- specific error type.
- type: string
- level:
- description: |-
- Represents how severe a message is.
-
- Valid Options: UNKNOWN, ERROR, WARNING, INFO
- enum:
- - UNKNOWN
- - ERROR
- - WARNING
- - INFO
- type: string
- type:
- properties:
- code:
- description: A 7 character code matching `^IST[0-9]{4}$`
- intended to uniquely identify the message type.
- type: string
- name:
- description: A human-readable name for the message type.
- type: string
- type: object
- type: object
- type: array
- type: object
- x-kubernetes-preserve-unknown-fields: true
- type: object
- served: true
- storage: true
- subresources:
- status: {}
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- "helm.sh/resource-policy": keep
- labels:
- app: dubbo-sail
- chart: dubbo
- heritage: Tiller
- dubbo: security
- release: dubbo
- name: requestauthentications.security.dubbo.io
-spec:
- group: security.dubbo.io
- names:
- categories:
- - dubbo-io
- - security-dubbo-io
- kind: RequestAuthentication
- listKind: RequestAuthenticationList
- plural: requestauthentications
- shortNames:
- - ra
- singular: requestauthentication
- scope: Namespaced
- versions:
- - name: v1
- schema:
- openAPIV3Schema:
- properties:
- spec:
- description: 'Request authentication configuration for workloads.'
- properties:
- jwtRules:
- description: Define the list of JWTs that can be validated at the
- selected workloads' proxy.
- items:
- properties:
- audiences:
- description: The list of JWT [audiences](https://tools.ietf.org/html/rfc7519#section-4.1.3)
- that are allowed to access.
- items:
- minLength: 1
- type: string
- type: array
- forwardOriginalToken:
- description: If set to true, the original token will be kept
- for the upstream request.
- type: boolean
- fromCookies:
- description: List of cookie names from which JWT is expected.
- items:
- minLength: 1
- type: string
- type: array
- fromHeaders:
- description: List of header locations from which JWT is expected.
- items:
- properties:
- name:
- description: The HTTP header name.
- minLength: 1
- type: string
- prefix:
- description: The prefix that should be stripped before
- decoding the token.
- type: string
- required:
- - name
- type: object
- type: array
- fromParams:
- description: List of query parameters from which JWT is expected.
- items:
- minLength: 1
- type: string
- type: array
- issuer:
- description: Identifies the issuer that issued the JWT.
- minLength: 1
- type: string
- jwks:
- description: JSON Web Key Set of public keys to validate signature
- of the JWT.
- type: string
- jwks_uri:
- description: URL of the provider's public key set to validate
- signature of the JWT.
- maxLength: 2048
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: url must have scheme http:// or https://
- rule: url(self).getScheme() in ["http", "https"]
- jwksUri:
- description: URL of the provider's public key set to validate
- signature of the JWT.
- maxLength: 2048
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: url must have scheme http:// or https://
- rule: url(self).getScheme() in ["http", "https"]
- outputClaimToHeaders:
- description: This field specifies a list of operations to copy
- the claim to HTTP headers on a successfully verified token.
- items:
- properties:
- claim:
- description: The name of the claim to be copied from.
- minLength: 1
- type: string
- header:
- description: The name of the header to be created.
- minLength: 1
- pattern: ^[-_A-Za-z0-9]+$
- type: string
- required:
- - header
- - claim
- type: object
- type: array
- outputPayloadToHeader:
- description: This field specifies the header name to output
- a successfully verified JWT payload to the backend.
- type: string
- timeout:
- description: The maximum amount of time that the resolver, determined
- by the sail_JWT_ENABLE_REMOTE_JWKS environment variable,
- will spend waiting for the JWKS to be fetched.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- type: object
- x-kubernetes-validations:
- - message: only one of jwks or jwksUri can be set
- rule: '(has(self.jwksUri) ? 1 : 0) + (has(self.jwks_uri) ? 1 :
- 0) + (has(self.jwks) ? 1 : 0) <= 1'
- maxItems: 4096
- type: array
- selector:
- description: Optional.
- properties:
- matchLabels:
- additionalProperties:
- maxLength: 63
- type: string
- x-kubernetes-validations:
- - message: wildcard not allowed in label value match
- rule: '!self.contains("*")'
- description: One or more labels that indicate a specific set of
- pods/VMs on which a policy should be applied.
- maxProperties: 4096
- type: object
- x-kubernetes-validations:
- - message: wildcard not allowed in label key match
- rule: self.all(key, !key.contains("*"))
- - message: key must not be empty
- rule: self.all(key, key.size() != 0)
- type: object
- targetRef:
- properties:
- group:
- description: group is the group of the target resource.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: kind is kind of the target resource.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: name is the name of the target resource.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: namespace is the namespace of the referent.
- type: string
- x-kubernetes-validations:
- - message: cross namespace referencing is not currently supported
- rule: self.size() == 0
- required:
- - kind
- - name
- type: object
- targetRefs:
- description: Optional.
- items:
- properties:
- group:
- description: group is the group of the target resource.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: kind is kind of the target resource.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: name is the name of the target resource.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: namespace is the namespace of the referent.
- type: string
- x-kubernetes-validations:
- - message: cross namespace referencing is not currently supported
- rule: self.size() == 0
- required:
- - kind
- - name
- type: object
- maxItems: 16
- type: array
- type: object
- x-kubernetes-validations:
- - message: only one of targetRefs or selector can be set
- rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0)
- + (has(self.targetRefs) ? 1 : 0) <= 1'
- status:
- properties:
- conditions:
- description: Current service state of the resource.
- items:
- properties:
- lastProbeTime:
- description: Last time we probed the condition.
- format: date-time
- type: string
- lastTransitionTime:
- description: Last time the condition transitioned from one status
- to another.
- format: date-time
- type: string
- message:
- description: Human-readable message indicating details about
- last transition.
- type: string
- observedGeneration:
- anyOf:
- - type: integer
- - type: string
- description: Resource Generation to which the Condition refers.
- x-kubernetes-int-or-string: true
- reason:
- description: Unique, one-word, CamelCase reason for the condition's
- last transition.
- type: string
- status:
- description: Status is the status of the condition.
- type: string
- type:
- description: Type is the type of the condition.
- type: string
- type: object
- type: array
- observedGeneration:
- anyOf:
- - type: integer
- - type: string
- x-kubernetes-int-or-string: true
- validationMessages:
- description: Includes any errors or warnings detected by dubbo's analyzers.
- items:
- properties:
- documentationUrl:
- description: A url pointing to the dubbo documentation for this
- specific error type.
- type: string
- level:
- description: |-
- Represents how severe a message is.
-
- Valid Options: UNKNOWN, ERROR, WARNING, INFO
- enum:
- - UNKNOWN
- - ERROR
- - WARNING
- - INFO
- type: string
- type:
- properties:
- code:
- description: A 7 character code matching `^IST[0-9]{4}$`
- intended to uniquely identify the message type.
- type: string
- name:
- description: A human-readable name for the message type.
- type: string
- type: object
- type: object
- type: array
- type: object
- x-kubernetes-preserve-unknown-fields: true
- type: object
- served: true
- storage: false
- subresources:
- status: {}
- - name: v1beta1
- schema:
- openAPIV3Schema:
- properties:
- spec:
- description: 'Request authentication configuration for workloads.'
- properties:
- jwtRules:
- description: Define the list of JWTs that can be validated at the
- selected workloads' proxy.
- items:
- properties:
- audiences:
- description: The list of JWT [audiences](https://tools.ietf.org/html/rfc7519#section-4.1.3)
- that are allowed to access.
- items:
- minLength: 1
- type: string
- type: array
- forwardOriginalToken:
- description: If set to true, the original token will be kept
- for the upstream request.
- type: boolean
- fromCookies:
- description: List of cookie names from which JWT is expected.
- items:
- minLength: 1
- type: string
- type: array
- fromHeaders:
- description: List of header locations from which JWT is expected.
- items:
- properties:
- name:
- description: The HTTP header name.
- minLength: 1
- type: string
- prefix:
- description: The prefix that should be stripped before
- decoding the token.
- type: string
- required:
- - name
- type: object
- type: array
- fromParams:
- description: List of query parameters from which JWT is expected.
- items:
- minLength: 1
- type: string
- type: array
- issuer:
- description: Identifies the issuer that issued the JWT.
- minLength: 1
- type: string
- jwks:
- description: JSON Web Key Set of public keys to validate signature
- of the JWT.
- type: string
- jwks_uri:
- description: URL of the provider's public key set to validate
- signature of the JWT.
- maxLength: 2048
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: url must have scheme http:// or https://
- rule: url(self).getScheme() in ["http", "https"]
- jwksUri:
- description: URL of the provider's public key set to validate
- signature of the JWT.
- maxLength: 2048
- minLength: 1
- type: string
- x-kubernetes-validations:
- - message: url must have scheme http:// or https://
- rule: url(self).getScheme() in ["http", "https"]
- outputClaimToHeaders:
- description: This field specifies a list of operations to copy
- the claim to HTTP headers on a successfully verified token.
- items:
- properties:
- claim:
- description: The name of the claim to be copied from.
- minLength: 1
- type: string
- header:
- description: The name of the header to be created.
- minLength: 1
- pattern: ^[-_A-Za-z0-9]+$
- type: string
- required:
- - header
- - claim
- type: object
- type: array
- outputPayloadToHeader:
- description: This field specifies the header name to output
- a successfully verified JWT payload to the backend.
- type: string
- timeout:
- description: The maximum amount of time that the resolver, determined
- by the sail_JWT_ENABLE_REMOTE_JWKS environment variable,
- will spend waiting for the JWKS to be fetched.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- type: object
- x-kubernetes-validations:
- - message: only one of jwks or jwksUri can be set
- rule: '(has(self.jwksUri) ? 1 : 0) + (has(self.jwks_uri) ? 1 :
- 0) + (has(self.jwks) ? 1 : 0) <= 1'
- maxItems: 4096
- type: array
- selector:
- description: Optional.
- properties:
- matchLabels:
- additionalProperties:
- maxLength: 63
- type: string
- x-kubernetes-validations:
- - message: wildcard not allowed in label value match
- rule: '!self.contains("*")'
- description: One or more labels that indicate a specific set of
- pods/VMs on which a policy should be applied.
- maxProperties: 4096
- type: object
- x-kubernetes-validations:
- - message: wildcard not allowed in label key match
- rule: self.all(key, !key.contains("*"))
- - message: key must not be empty
- rule: self.all(key, key.size() != 0)
- type: object
- targetRef:
- properties:
- group:
- description: group is the group of the target resource.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: kind is kind of the target resource.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: name is the name of the target resource.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: namespace is the namespace of the referent.
- type: string
- x-kubernetes-validations:
- - message: cross namespace referencing is not currently supported
- rule: self.size() == 0
- required:
- - kind
- - name
- type: object
- targetRefs:
- description: Optional.
- items:
- properties:
- group:
- description: group is the group of the target resource.
- maxLength: 253
- pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
- type: string
- kind:
- description: kind is kind of the target resource.
- maxLength: 63
- minLength: 1
- pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
- type: string
- name:
- description: name is the name of the target resource.
- maxLength: 253
- minLength: 1
- type: string
- namespace:
- description: namespace is the namespace of the referent.
- type: string
- x-kubernetes-validations:
- - message: cross namespace referencing is not currently supported
- rule: self.size() == 0
- required:
- - kind
- - name
- type: object
- maxItems: 16
- type: array
- type: object
- x-kubernetes-validations:
- - message: only one of targetRefs or selector can be set
- rule: '(has(self.selector) ? 1 : 0) + (has(self.targetRef) ? 1 : 0)
- + (has(self.targetRefs) ? 1 : 0) <= 1'
- status:
- properties:
- conditions:
- description: Current service state of the resource.
- items:
- properties:
- lastProbeTime:
- description: Last time we probed the condition.
- format: date-time
- type: string
- lastTransitionTime:
- description: Last time the condition transitioned from one status
- to another.
- format: date-time
- type: string
- message:
- description: Human-readable message indicating details about
- last transition.
- type: string
- observedGeneration:
- anyOf:
- - type: integer
- - type: string
- description: Resource Generation to which the Condition refers.
- x-kubernetes-int-or-string: true
- reason:
- description: Unique, one-word, CamelCase reason for the condition's
- last transition.
- type: string
- status:
- description: Status is the status of the condition.
- type: string
- type:
- description: Type is the type of the condition.
- type: string
- type: object
- type: array
- observedGeneration:
- anyOf:
- - type: integer
- - type: string
- x-kubernetes-int-or-string: true
- validationMessages:
- description: Includes any errors or warnings detected by dubbo's analyzers.
- items:
- properties:
- documentationUrl:
- description: A url pointing to the dubbo documentation for this
- specific error type.
- type: string
- level:
- description: |-
- Represents how severe a message is.
-
- Valid Options: UNKNOWN, ERROR, WARNING, INFO
- enum:
- - UNKNOWN
- - ERROR
- - WARNING
- - INFO
- type: string
- type:
- properties:
- code:
- description: A 7 character code matching `^IST[0-9]{4}$`
- intended to uniquely identify the message type.
- type: string
- name:
- description: A human-readable name for the message type.
- type: string
- type: object
- type: object
- type: array
- type: object
- x-kubernetes-preserve-unknown-fields: true
- type: object
- served: true
- storage: true
- subresources:
- status: {}
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
- annotations:
- "helm.sh/resource-policy": keep
- labels:
- app: dubbo-sail
- chart: dubbo
- heritage: Tiller
- release: dubbo
- name: virtualservices.networking.dubbo.io
-spec:
- group: networking.dubbo.io
- names:
- categories:
- - dubbo-io
- - networking-dubbo-io
- kind: VirtualService
- listKind: VirtualServiceList
- plural: virtualservices
- shortNames:
- - vs
- singular: virtualservice
- scope: Namespaced
- versions:
- - additionalPrinterColumns:
- - description: The names of gateways and sidecars that should apply these routes
- jsonPath: .spec.gateways
- name: Gateways
- type: string
- - description: The destination hosts to which traffic is being sent
- jsonPath: .spec.hosts
- name: Hosts
- type: string
- - description: 'CreationTimestamp is a timestamp representing the server time
- when this object was created. It is not guaranteed to be set in happens-before
- order across separate operations. Clients may not set this value. It is represented
- in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for
- lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata'
- jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- name: v1
- schema:
- openAPIV3Schema:
- properties:
- spec:
- description: 'Configuration affecting label/content routing, sni routing.'
- properties:
- exportTo:
- description: A list of namespaces to which this virtual service is
- exported.
- items:
- type: string
- type: array
- gateways:
- description: The names of gateways and sidecars that should apply
- these routes.
- items:
- type: string
- type: array
- hosts:
- description: The destination hosts to which traffic is being sent.
- items:
- type: string
- type: array
- http:
- description: An ordered list of route rules for HTTP traffic.
- items:
- properties:
- corsPolicy:
- description: Cross-Origin Resource Sharing policy (CORS).
- properties:
- allowCredentials:
- description: Indicates whether the caller is allowed to
- send the actual request (not the preflight) using credentials.
- nullable: true
- type: boolean
- allowHeaders:
- description: List of HTTP headers that can be used when
- requesting the resource.
- items:
- type: string
- type: array
- allowMethods:
- description: List of HTTP methods allowed to access the
- resource.
- items:
- type: string
- type: array
- allowOrigin:
- items:
- type: string
- type: array
- allowOrigins:
- description: String patterns that match allowed origins.
- items:
- oneOf:
- - not:
- anyOf:
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- properties:
- exact:
- type: string
- prefix:
- type: string
- regex:
- description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
- type: string
- type: object
- type: array
- exposeHeaders:
- description: A list of HTTP headers that the browsers are
- allowed to access.
- items:
- type: string
- type: array
- maxAge:
- description: Specifies how long the results of a preflight
- request can be cached.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- unmatchedPreflights:
- description: |-
- Indicates whether preflight requests not matching the configured allowed origin shouldn't be forwarded to the upstream.
-
- Valid Options: FORWARD, IGNORE
- enum:
- - UNSPECIFIED
- - FORWARD
- - IGNORE
- type: string
- type: object
- delegate:
- description: Delegate is used to specify the particular VirtualService
- which can be used to define delegate HTTPRoute.
- properties:
- name:
- description: Name specifies the name of the delegate VirtualService.
- type: string
- namespace:
- description: Namespace specifies the namespace where the
- delegate VirtualService resides.
- type: string
- type: object
- directResponse:
- description: A HTTP rule can either return a direct_response,
- redirect or forward (default) traffic.
- properties:
- body:
- description: Specifies the content of the response body.
- oneOf:
- - not:
- anyOf:
- - required:
- - string
- - required:
- - bytes
- - required:
- - string
- - required:
- - bytes
- properties:
- bytes:
- description: response body as base64 encoded bytes.
- format: binary
- type: string
- string:
- type: string
- type: object
- status:
- description: Specifies the HTTP response status to be returned.
- maximum: 4294967295
- minimum: 0
- type: integer
- required:
- - status
- type: object
- fault:
- description: Fault injection policy to apply on HTTP traffic
- at the client side.
- properties:
- abort:
- description: Abort Http request attempts and return error
- codes back to downstream service, giving the impression
- that the upstream service is faulty.
- oneOf:
- - not:
- anyOf:
- - required:
- - httpStatus
- - required:
- - grpcStatus
- - required:
- - http2Error
- - required:
- - httpStatus
- - required:
- - grpcStatus
- - required:
- - http2Error
- properties:
- grpcStatus:
- description: GRPC status code to use to abort the request.
- type: string
- http2Error:
- type: string
- httpStatus:
- description: HTTP status code to use to abort the Http
- request.
- format: int32
- type: integer
- percentage:
- description: Percentage of requests to be aborted with
- the error code provided.
- properties:
- value:
- format: double
- type: number
- type: object
- type: object
- delay:
- description: Delay requests before forwarding, emulating
- various failures such as network issues, overloaded upstream
- service, etc.
- oneOf:
- - not:
- anyOf:
- - required:
- - fixedDelay
- - required:
- - exponentialDelay
- - required:
- - fixedDelay
- - required:
- - exponentialDelay
- properties:
- exponentialDelay:
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- fixedDelay:
- description: Add a fixed delay before forwarding the
- request.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- percent:
- description: Percentage of requests on which the delay
- will be injected (0-100).
- format: int32
- type: integer
- percentage:
- description: Percentage of requests on which the delay
- will be injected.
- properties:
- value:
- format: double
- type: number
- type: object
- type: object
- type: object
- headers:
- properties:
- request:
- properties:
- add:
- additionalProperties:
- type: string
- type: object
- remove:
- items:
- type: string
- type: array
- set:
- additionalProperties:
- type: string
- type: object
- type: object
- response:
- properties:
- add:
- additionalProperties:
- type: string
- type: object
- remove:
- items:
- type: string
- type: array
- set:
- additionalProperties:
- type: string
- type: object
- type: object
- type: object
- match:
- description: Match conditions to be satisfied for the rule to
- be activated.
- items:
- properties:
- authority:
- description: 'HTTP Authority values are case-sensitive
- and formatted as follows: - `exact: "value"` for exact
- string match - `prefix: "value"` for prefix-based match
- - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
- oneOf:
- - not:
- anyOf:
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- properties:
- exact:
- type: string
- prefix:
- type: string
- regex:
- description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
- type: string
- type: object
- gateways:
- description: Names of gateways where the rule should be
- applied.
- items:
- type: string
- type: array
- headers:
- additionalProperties:
- oneOf:
- - not:
- anyOf:
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- properties:
- exact:
- type: string
- prefix:
- type: string
- regex:
- description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
- type: string
- type: object
- description: The header keys must be lowercase and use
- hyphen as the separator, e.g.
- type: object
- ignoreUriCase:
- description: Flag to specify whether the URI matching
- should be case-insensitive.
- type: boolean
- method:
- description: 'HTTP Method values are case-sensitive and
- formatted as follows: - `exact: "value"` for exact string
- match - `prefix: "value"` for prefix-based match - `regex:
- "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
- oneOf:
- - not:
- anyOf:
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- properties:
- exact:
- type: string
- prefix:
- type: string
- regex:
- description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
- type: string
- type: object
- name:
- description: The name assigned to a match.
- type: string
- port:
- description: Specifies the ports on the host that is being
- addressed.
- maximum: 4294967295
- minimum: 0
- type: integer
- queryParams:
- additionalProperties:
- oneOf:
- - not:
- anyOf:
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- properties:
- exact:
- type: string
- prefix:
- type: string
- regex:
- description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
- type: string
- type: object
- description: Query parameters for matching.
- type: object
- scheme:
- description: 'URI Scheme values are case-sensitive and
- formatted as follows: - `exact: "value"` for exact string
- match - `prefix: "value"` for prefix-based match - `regex:
- "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
- oneOf:
- - not:
- anyOf:
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- properties:
- exact:
- type: string
- prefix:
- type: string
- regex:
- description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
- type: string
- type: object
- sourceLabels:
- additionalProperties:
- type: string
- description: One or more labels that constrain the applicability
- of a rule to source (client) workloads with the given
- labels.
- type: object
- sourceNamespace:
- description: Source namespace constraining the applicability
- of a rule to workloads in that namespace.
- type: string
- statPrefix:
- description: The human readable prefix to use when emitting
- statistics for this route.
- type: string
- uri:
- description: 'URI to match values are case-sensitive and
- formatted as follows: - `exact: "value"` for exact string
- match - `prefix: "value"` for prefix-based match - `regex:
- "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
- oneOf:
- - not:
- anyOf:
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- properties:
- exact:
- type: string
- prefix:
- type: string
- regex:
- description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
- type: string
- type: object
- withoutHeaders:
- additionalProperties:
- oneOf:
- - not:
- anyOf:
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- properties:
- exact:
- type: string
- prefix:
- type: string
- regex:
- description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
- type: string
- type: object
- description: withoutHeader has the same syntax with the
- header, but has opposite meaning.
- type: object
- type: object
- type: array
- mirror:
- description: Mirror HTTP traffic to a another destination in
- addition to forwarding the requests to the intended destination.
- properties:
- host:
- description: The name of a service from the service registry.
- type: string
- port:
- description: Specifies the port on the host that is being
- addressed.
- properties:
- number:
- maximum: 4294967295
- minimum: 0
- type: integer
- type: object
- subset:
- description: The name of a subset within the service.
- type: string
- required:
- - host
- type: object
- mirror_percent:
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- mirrorPercent:
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- mirrorPercentage:
- description: Percentage of the traffic to be mirrored by the
- `mirror` field.
- properties:
- value:
- format: double
- type: number
- type: object
- mirrors:
- description: Specifies the destinations to mirror HTTP traffic
- in addition to the original destination.
- items:
- properties:
- destination:
- description: Destination specifies the target of the mirror
- operation.
- properties:
- host:
- description: The name of a service from the service
- registry.
- type: string
- port:
- description: Specifies the port on the host that is
- being addressed.
- properties:
- number:
- maximum: 4294967295
- minimum: 0
- type: integer
- type: object
- subset:
- description: The name of a subset within the service.
- type: string
- required:
- - host
- type: object
- percentage:
- description: Percentage of the traffic to be mirrored
- by the `destination` field.
- properties:
- value:
- format: double
- type: number
- type: object
- required:
- - destination
- type: object
- type: array
- name:
- description: The name assigned to the route for debugging purposes.
- type: string
- redirect:
- description: A HTTP rule can either return a direct_response,
- redirect or forward (default) traffic.
- oneOf:
- - not:
- anyOf:
- - required:
- - port
- - required:
- - derivePort
- - required:
- - port
- - required:
- - derivePort
- properties:
- authority:
- description: On a redirect, overwrite the Authority/Host
- portion of the URL with this value.
- type: string
- derivePort:
- description: |-
- On a redirect, dynamically set the port: * FROM_PROTOCOL_DEFAULT: automatically set to 80 for HTTP and 443 for HTTPS.
-
- Valid Options: FROM_PROTOCOL_DEFAULT, FROM_REQUEST_PORT
- enum:
- - FROM_PROTOCOL_DEFAULT
- - FROM_REQUEST_PORT
- type: string
- port:
- description: On a redirect, overwrite the port portion of
- the URL with this value.
- maximum: 4294967295
- minimum: 0
- type: integer
- redirectCode:
- description: On a redirect, Specifies the HTTP status code
- to use in the redirect response.
- maximum: 4294967295
- minimum: 0
- type: integer
- scheme:
- description: On a redirect, overwrite the scheme portion
- of the URL with this value.
- type: string
- uri:
- description: On a redirect, overwrite the Path portion of
- the URL with this value.
- type: string
- type: object
- retries:
- description: Retry policy for HTTP requests.
- properties:
- attempts:
- description: Number of retries to be allowed for a given
- request.
- format: int32
- type: integer
- backoff:
- description: Specifies the minimum duration between retry
- attempts.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- perTryTimeout:
- description: Timeout per attempt for a given request, including
- the initial call and any retries.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- retryIgnorePreviousHosts:
- description: Flag to specify whether the retries should
- ignore previously tried hosts during retry.
- nullable: true
- type: boolean
- retryOn:
- description: Specifies the conditions under which retry
- takes place.
- type: string
- retryRemoteLocalities:
- description: Flag to specify whether the retries should
- retry to other localities.
- nullable: true
- type: boolean
- type: object
- rewrite:
- description: Rewrite HTTP URIs and Authority headers.
- properties:
- authority:
- description: rewrite the Authority/Host header with this
- value.
- type: string
- uri:
- description: rewrite the path (or the prefix) portion of
- the URI with this value.
- type: string
- uriRegexRewrite:
- description: rewrite the path portion of the URI with the
- specified regex.
- properties:
- match:
- description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
- type: string
- rewrite:
- description: The string that should replace into matching
- portions of original URI.
- type: string
- type: object
- type: object
- route:
- description: A HTTP rule can either return a direct_response,
- redirect or forward (default) traffic.
- items:
- properties:
- destination:
- description: Destination uniquely identifies the instances
- of a service to which the request/connection should
- be forwarded to.
- properties:
- host:
- description: The name of a service from the service
- registry.
- type: string
- port:
- description: Specifies the port on the host that is
- being addressed.
- properties:
- number:
- maximum: 4294967295
- minimum: 0
- type: integer
- type: object
- subset:
- description: The name of a subset within the service.
- type: string
- required:
- - host
- type: object
- headers:
- properties:
- request:
- properties:
- add:
- additionalProperties:
- type: string
- type: object
- remove:
- items:
- type: string
- type: array
- set:
- additionalProperties:
- type: string
- type: object
- type: object
- response:
- properties:
- add:
- additionalProperties:
- type: string
- type: object
- remove:
- items:
- type: string
- type: array
- set:
- additionalProperties:
- type: string
- type: object
- type: object
- type: object
- weight:
- description: Weight specifies the relative proportion
- of traffic to be forwarded to the destination.
- format: int32
- type: integer
- required:
- - destination
- type: object
- type: array
- timeout:
- description: Timeout for HTTP requests, default is disabled.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- type: object
- type: array
- tcp:
- description: An ordered list of route rules for opaque TCP traffic.
- items:
- properties:
- match:
- description: Match conditions to be satisfied for the rule to
- be activated.
- items:
- properties:
- destinationSubnets:
- description: IPv4 or IPv6 ip addresses of destination
- with optional subnet.
- items:
- type: string
- type: array
- gateways:
- description: Names of gateways where the rule should be
- applied.
- items:
- type: string
- type: array
- port:
- description: Specifies the port on the host that is being
- addressed.
- maximum: 4294967295
- minimum: 0
- type: integer
- sourceLabels:
- additionalProperties:
- type: string
- description: One or more labels that constrain the applicability
- of a rule to workloads with the given labels.
- type: object
- sourceNamespace:
- description: Source namespace constraining the applicability
- of a rule to workloads in that namespace.
- type: string
- sourceSubnet:
- type: string
- type: object
- type: array
- route:
- description: The destination to which the connection should
- be forwarded to.
- items:
- properties:
- destination:
- description: Destination uniquely identifies the instances
- of a service to which the request/connection should
- be forwarded to.
- properties:
- host:
- description: The name of a service from the service
- registry.
- type: string
- port:
- description: Specifies the port on the host that is
- being addressed.
- properties:
- number:
- maximum: 4294967295
- minimum: 0
- type: integer
- type: object
- subset:
- description: The name of a subset within the service.
- type: string
- required:
- - host
- type: object
- weight:
- description: Weight specifies the relative proportion
- of traffic to be forwarded to the destination.
- format: int32
- type: integer
- required:
- - destination
- type: object
- type: array
- type: object
- type: array
- tls:
- description: An ordered list of route rule for non-terminated TLS
- & HTTPS traffic.
- items:
- properties:
- match:
- description: Match conditions to be satisfied for the rule to
- be activated.
- items:
- properties:
- destinationSubnets:
- description: IPv4 or IPv6 ip addresses of destination
- with optional subnet.
- items:
- type: string
- type: array
- gateways:
- description: Names of gateways where the rule should be
- applied.
- items:
- type: string
- type: array
- port:
- description: Specifies the port on the host that is being
- addressed.
- maximum: 4294967295
- minimum: 0
- type: integer
- sniHosts:
- description: SNI (server name indicator) to match on.
- items:
- type: string
- type: array
- sourceLabels:
- additionalProperties:
- type: string
- description: One or more labels that constrain the applicability
- of a rule to workloads with the given labels.
- type: object
- sourceNamespace:
- description: Source namespace constraining the applicability
- of a rule to workloads in that namespace.
- type: string
- required:
- - sniHosts
- type: object
- type: array
- route:
- description: The destination to which the connection should
- be forwarded to.
- items:
- properties:
- destination:
- description: Destination uniquely identifies the instances
- of a service to which the request/connection should
- be forwarded to.
- properties:
- host:
- description: The name of a service from the service
- registry.
- type: string
- port:
- description: Specifies the port on the host that is
- being addressed.
- properties:
- number:
- maximum: 4294967295
- minimum: 0
- type: integer
- type: object
- subset:
- description: The name of a subset within the service.
- type: string
- required:
- - host
- type: object
- weight:
- description: Weight specifies the relative proportion
- of traffic to be forwarded to the destination.
- format: int32
- type: integer
- required:
- - destination
- type: object
- type: array
- required:
- - match
- type: object
- type: array
- type: object
- status:
- properties:
- conditions:
- description: Current service state of the resource.
- items:
- properties:
- lastProbeTime:
- description: Last time we probed the condition.
- format: date-time
- type: string
- lastTransitionTime:
- description: Last time the condition transitioned from one status
- to another.
- format: date-time
- type: string
- message:
- description: Human-readable message indicating details about
- last transition.
- type: string
- observedGeneration:
- anyOf:
- - type: integer
- - type: string
- description: Resource Generation to which the Condition refers.
- x-kubernetes-int-or-string: true
- reason:
- description: Unique, one-word, CamelCase reason for the condition's
- last transition.
- type: string
- status:
- description: Status is the status of the condition.
- type: string
- type:
- description: Type is the type of the condition.
- type: string
- type: object
- type: array
- observedGeneration:
- anyOf:
- - type: integer
- - type: string
- x-kubernetes-int-or-string: true
- validationMessages:
- description: Includes any errors or warnings detected by dubbo's analyzers.
- items:
- properties:
- documentationUrl:
- description: A url pointing to the dubbo documentation for this
- specific error type.
- type: string
- level:
- description: |-
- Represents how severe a message is.
-
- Valid Options: UNKNOWN, ERROR, WARNING, INFO
- enum:
- - UNKNOWN
- - ERROR
- - WARNING
- - INFO
- type: string
- type:
- properties:
- code:
- description: A 7 character code matching `^IST[0-9]{4}$`
- intended to uniquely identify the message type.
- type: string
- name:
- description: A human-readable name for the message type.
- type: string
- type: object
- type: object
- type: array
- type: object
- x-kubernetes-preserve-unknown-fields: true
- type: object
- served: true
- storage: true
- subresources:
- status: {}
- - additionalPrinterColumns:
- - description: The names of gateways and sidecars that should apply these routes
- jsonPath: .spec.gateways
- name: Gateways
- type: string
- - description: The destination hosts to which traffic is being sent
- jsonPath: .spec.hosts
- name: Hosts
- type: string
- - description: 'CreationTimestamp is a timestamp representing the server time
- when this object was created. It is not guaranteed to be set in happens-before
- order across separate operations. Clients may not set this value. It is represented
- in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for
- lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata'
- jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- name: v1alpha3
- schema:
- openAPIV3Schema:
- properties:
- spec:
- description: 'Configuration affecting label/content routing, sni routing.'
- properties:
- exportTo:
- description: A list of namespaces to which this virtual service is
- exported.
- items:
- type: string
- type: array
- gateways:
- description: The names of gateways and sidecars that should apply
- these routes.
- items:
- type: string
- type: array
- hosts:
- description: The destination hosts to which traffic is being sent.
- items:
- type: string
- type: array
- http:
- description: An ordered list of route rules for HTTP traffic.
- items:
- properties:
- corsPolicy:
- description: Cross-Origin Resource Sharing policy (CORS).
- properties:
- allowCredentials:
- description: Indicates whether the caller is allowed to
- send the actual request (not the preflight) using credentials.
- nullable: true
- type: boolean
- allowHeaders:
- description: List of HTTP headers that can be used when
- requesting the resource.
- items:
- type: string
- type: array
- allowMethods:
- description: List of HTTP methods allowed to access the
- resource.
- items:
- type: string
- type: array
- allowOrigin:
- items:
- type: string
- type: array
- allowOrigins:
- description: String patterns that match allowed origins.
- items:
- oneOf:
- - not:
- anyOf:
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- properties:
- exact:
- type: string
- prefix:
- type: string
- regex:
- description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
- type: string
- type: object
- type: array
- exposeHeaders:
- description: A list of HTTP headers that the browsers are
- allowed to access.
- items:
- type: string
- type: array
- maxAge:
- description: Specifies how long the results of a preflight
- request can be cached.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- unmatchedPreflights:
- description: |-
- Indicates whether preflight requests not matching the configured allowed origin shouldn't be forwarded to the upstream.
-
- Valid Options: FORWARD, IGNORE
- enum:
- - UNSPECIFIED
- - FORWARD
- - IGNORE
- type: string
- type: object
- delegate:
- description: Delegate is used to specify the particular VirtualService
- which can be used to define delegate HTTPRoute.
- properties:
- name:
- description: Name specifies the name of the delegate VirtualService.
- type: string
- namespace:
- description: Namespace specifies the namespace where the
- delegate VirtualService resides.
- type: string
- type: object
- directResponse:
- description: A HTTP rule can either return a direct_response,
- redirect or forward (default) traffic.
- properties:
- body:
- description: Specifies the content of the response body.
- oneOf:
- - not:
- anyOf:
- - required:
- - string
- - required:
- - bytes
- - required:
- - string
- - required:
- - bytes
- properties:
- bytes:
- description: response body as base64 encoded bytes.
- format: binary
- type: string
- string:
- type: string
- type: object
- status:
- description: Specifies the HTTP response status to be returned.
- maximum: 4294967295
- minimum: 0
- type: integer
- required:
- - status
- type: object
- fault:
- description: Fault injection policy to apply on HTTP traffic
- at the client side.
- properties:
- abort:
- description: Abort Http request attempts and return error
- codes back to downstream service, giving the impression
- that the upstream service is faulty.
- oneOf:
- - not:
- anyOf:
- - required:
- - httpStatus
- - required:
- - grpcStatus
- - required:
- - http2Error
- - required:
- - httpStatus
- - required:
- - grpcStatus
- - required:
- - http2Error
- properties:
- grpcStatus:
- description: GRPC status code to use to abort the request.
- type: string
- http2Error:
- type: string
- httpStatus:
- description: HTTP status code to use to abort the Http
- request.
- format: int32
- type: integer
- percentage:
- description: Percentage of requests to be aborted with
- the error code provided.
- properties:
- value:
- format: double
- type: number
- type: object
- type: object
- delay:
- description: Delay requests before forwarding, emulating
- various failures such as network issues, overloaded upstream
- service, etc.
- oneOf:
- - not:
- anyOf:
- - required:
- - fixedDelay
- - required:
- - exponentialDelay
- - required:
- - fixedDelay
- - required:
- - exponentialDelay
- properties:
- exponentialDelay:
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- fixedDelay:
- description: Add a fixed delay before forwarding the
- request.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- percent:
- description: Percentage of requests on which the delay
- will be injected (0-100).
- format: int32
- type: integer
- percentage:
- description: Percentage of requests on which the delay
- will be injected.
- properties:
- value:
- format: double
- type: number
- type: object
- type: object
- type: object
- headers:
- properties:
- request:
- properties:
- add:
- additionalProperties:
- type: string
- type: object
- remove:
- items:
- type: string
- type: array
- set:
- additionalProperties:
- type: string
- type: object
- type: object
- response:
- properties:
- add:
- additionalProperties:
- type: string
- type: object
- remove:
- items:
- type: string
- type: array
- set:
- additionalProperties:
- type: string
- type: object
- type: object
- type: object
- match:
- description: Match conditions to be satisfied for the rule to
- be activated.
- items:
- properties:
- authority:
- description: 'HTTP Authority values are case-sensitive
- and formatted as follows: - `exact: "value"` for exact
- string match - `prefix: "value"` for prefix-based match
- - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
- oneOf:
- - not:
- anyOf:
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- properties:
- exact:
- type: string
- prefix:
- type: string
- regex:
- description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
- type: string
- type: object
- gateways:
- description: Names of gateways where the rule should be
- applied.
- items:
- type: string
- type: array
- headers:
- additionalProperties:
- oneOf:
- - not:
- anyOf:
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- properties:
- exact:
- type: string
- prefix:
- type: string
- regex:
- description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
- type: string
- type: object
- description: The header keys must be lowercase and use
- hyphen as the separator, e.g.
- type: object
- ignoreUriCase:
- description: Flag to specify whether the URI matching
- should be case-insensitive.
- type: boolean
- method:
- description: 'HTTP Method values are case-sensitive and
- formatted as follows: - `exact: "value"` for exact string
- match - `prefix: "value"` for prefix-based match - `regex:
- "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
- oneOf:
- - not:
- anyOf:
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- properties:
- exact:
- type: string
- prefix:
- type: string
- regex:
- description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
- type: string
- type: object
- name:
- description: The name assigned to a match.
- type: string
- port:
- description: Specifies the ports on the host that is being
- addressed.
- maximum: 4294967295
- minimum: 0
- type: integer
- queryParams:
- additionalProperties:
- oneOf:
- - not:
- anyOf:
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- properties:
- exact:
- type: string
- prefix:
- type: string
- regex:
- description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
- type: string
- type: object
- description: Query parameters for matching.
- type: object
- scheme:
- description: 'URI Scheme values are case-sensitive and
- formatted as follows: - `exact: "value"` for exact string
- match - `prefix: "value"` for prefix-based match - `regex:
- "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
- oneOf:
- - not:
- anyOf:
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- properties:
- exact:
- type: string
- prefix:
- type: string
- regex:
- description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
- type: string
- type: object
- sourceLabels:
- additionalProperties:
- type: string
- description: One or more labels that constrain the applicability
- of a rule to source (client) workloads with the given
- labels.
- type: object
- sourceNamespace:
- description: Source namespace constraining the applicability
- of a rule to workloads in that namespace.
- type: string
- statPrefix:
- description: The human readable prefix to use when emitting
- statistics for this route.
- type: string
- uri:
- description: 'URI to match values are case-sensitive and
- formatted as follows: - `exact: "value"` for exact string
- match - `prefix: "value"` for prefix-based match - `regex:
- "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
- oneOf:
- - not:
- anyOf:
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- properties:
- exact:
- type: string
- prefix:
- type: string
- regex:
- description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
- type: string
- type: object
- withoutHeaders:
- additionalProperties:
- oneOf:
- - not:
- anyOf:
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- properties:
- exact:
- type: string
- prefix:
- type: string
- regex:
- description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
- type: string
- type: object
- description: withoutHeader has the same syntax with the
- header, but has opposite meaning.
- type: object
- type: object
- type: array
- mirror:
- description: Mirror HTTP traffic to a another destination in
- addition to forwarding the requests to the intended destination.
- properties:
- host:
- description: The name of a service from the service registry.
- type: string
- port:
- description: Specifies the port on the host that is being
- addressed.
- properties:
- number:
- maximum: 4294967295
- minimum: 0
- type: integer
- type: object
- subset:
- description: The name of a subset within the service.
- type: string
- required:
- - host
- type: object
- mirror_percent:
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- mirrorPercent:
- maximum: 4294967295
- minimum: 0
- nullable: true
- type: integer
- mirrorPercentage:
- description: Percentage of the traffic to be mirrored by the
- `mirror` field.
- properties:
- value:
- format: double
- type: number
- type: object
- mirrors:
- description: Specifies the destinations to mirror HTTP traffic
- in addition to the original destination.
- items:
- properties:
- destination:
- description: Destination specifies the target of the mirror
- operation.
- properties:
- host:
- description: The name of a service from the service
- registry.
- type: string
- port:
- description: Specifies the port on the host that is
- being addressed.
- properties:
- number:
- maximum: 4294967295
- minimum: 0
- type: integer
- type: object
- subset:
- description: The name of a subset within the service.
- type: string
- required:
- - host
- type: object
- percentage:
- description: Percentage of the traffic to be mirrored
- by the `destination` field.
- properties:
- value:
- format: double
- type: number
- type: object
- required:
- - destination
- type: object
- type: array
- name:
- description: The name assigned to the route for debugging purposes.
- type: string
- redirect:
- description: A HTTP rule can either return a direct_response,
- redirect or forward (default) traffic.
- oneOf:
- - not:
- anyOf:
- - required:
- - port
- - required:
- - derivePort
- - required:
- - port
- - required:
- - derivePort
- properties:
- authority:
- description: On a redirect, overwrite the Authority/Host
- portion of the URL with this value.
- type: string
- derivePort:
- description: |-
- On a redirect, dynamically set the port: * FROM_PROTOCOL_DEFAULT: automatically set to 80 for HTTP and 443 for HTTPS.
-
- Valid Options: FROM_PROTOCOL_DEFAULT, FROM_REQUEST_PORT
- enum:
- - FROM_PROTOCOL_DEFAULT
- - FROM_REQUEST_PORT
- type: string
- port:
- description: On a redirect, overwrite the port portion of
- the URL with this value.
- maximum: 4294967295
- minimum: 0
- type: integer
- redirectCode:
- description: On a redirect, Specifies the HTTP status code
- to use in the redirect response.
- maximum: 4294967295
- minimum: 0
- type: integer
- scheme:
- description: On a redirect, overwrite the scheme portion
- of the URL with this value.
- type: string
- uri:
- description: On a redirect, overwrite the Path portion of
- the URL with this value.
- type: string
- type: object
- retries:
- description: Retry policy for HTTP requests.
- properties:
- attempts:
- description: Number of retries to be allowed for a given
- request.
- format: int32
- type: integer
- backoff:
- description: Specifies the minimum duration between retry
- attempts.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- perTryTimeout:
- description: Timeout per attempt for a given request, including
- the initial call and any retries.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- retryIgnorePreviousHosts:
- description: Flag to specify whether the retries should
- ignore previously tried hosts during retry.
- nullable: true
- type: boolean
- retryOn:
- description: Specifies the conditions under which retry
- takes place.
- type: string
- retryRemoteLocalities:
- description: Flag to specify whether the retries should
- retry to other localities.
- nullable: true
- type: boolean
- type: object
- rewrite:
- description: Rewrite HTTP URIs and Authority headers.
- properties:
- authority:
- description: rewrite the Authority/Host header with this
- value.
- type: string
- uri:
- description: rewrite the path (or the prefix) portion of
- the URI with this value.
- type: string
- uriRegexRewrite:
- description: rewrite the path portion of the URI with the
- specified regex.
- properties:
- match:
- description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
- type: string
- rewrite:
- description: The string that should replace into matching
- portions of original URI.
- type: string
- type: object
- type: object
- route:
- description: A HTTP rule can either return a direct_response,
- redirect or forward (default) traffic.
- items:
- properties:
- destination:
- description: Destination uniquely identifies the instances
- of a service to which the request/connection should
- be forwarded to.
- properties:
- host:
- description: The name of a service from the service
- registry.
- type: string
- port:
- description: Specifies the port on the host that is
- being addressed.
- properties:
- number:
- maximum: 4294967295
- minimum: 0
- type: integer
- type: object
- subset:
- description: The name of a subset within the service.
- type: string
- required:
- - host
- type: object
- headers:
- properties:
- request:
- properties:
- add:
- additionalProperties:
- type: string
- type: object
- remove:
- items:
- type: string
- type: array
- set:
- additionalProperties:
- type: string
- type: object
- type: object
- response:
- properties:
- add:
- additionalProperties:
- type: string
- type: object
- remove:
- items:
- type: string
- type: array
- set:
- additionalProperties:
- type: string
- type: object
- type: object
- type: object
- weight:
- description: Weight specifies the relative proportion
- of traffic to be forwarded to the destination.
- format: int32
- type: integer
- required:
- - destination
- type: object
- type: array
- timeout:
- description: Timeout for HTTP requests, default is disabled.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- type: object
- type: array
- tcp:
- description: An ordered list of route rules for opaque TCP traffic.
- items:
- properties:
- match:
- description: Match conditions to be satisfied for the rule to
- be activated.
- items:
- properties:
- destinationSubnets:
- description: IPv4 or IPv6 ip addresses of destination
- with optional subnet.
- items:
- type: string
- type: array
- gateways:
- description: Names of gateways where the rule should be
- applied.
- items:
- type: string
- type: array
- port:
- description: Specifies the port on the host that is being
- addressed.
- maximum: 4294967295
- minimum: 0
- type: integer
- sourceLabels:
- additionalProperties:
- type: string
- description: One or more labels that constrain the applicability
- of a rule to workloads with the given labels.
- type: object
- sourceNamespace:
- description: Source namespace constraining the applicability
- of a rule to workloads in that namespace.
- type: string
- sourceSubnet:
- type: string
- type: object
- type: array
- route:
- description: The destination to which the connection should
- be forwarded to.
- items:
- properties:
- destination:
- description: Destination uniquely identifies the instances
- of a service to which the request/connection should
- be forwarded to.
- properties:
- host:
- description: The name of a service from the service
- registry.
- type: string
- port:
- description: Specifies the port on the host that is
- being addressed.
- properties:
- number:
- maximum: 4294967295
- minimum: 0
- type: integer
- type: object
- subset:
- description: The name of a subset within the service.
- type: string
- required:
- - host
- type: object
- weight:
- description: Weight specifies the relative proportion
- of traffic to be forwarded to the destination.
- format: int32
- type: integer
- required:
- - destination
- type: object
- type: array
- type: object
- type: array
- tls:
- description: An ordered list of route rule for non-terminated TLS
- & HTTPS traffic.
- items:
- properties:
- match:
- description: Match conditions to be satisfied for the rule to
- be activated.
- items:
- properties:
- destinationSubnets:
- description: IPv4 or IPv6 ip addresses of destination
- with optional subnet.
- items:
- type: string
- type: array
- gateways:
- description: Names of gateways where the rule should be
- applied.
- items:
- type: string
- type: array
- port:
- description: Specifies the port on the host that is being
- addressed.
- maximum: 4294967295
- minimum: 0
- type: integer
- sniHosts:
- description: SNI (server name indicator) to match on.
- items:
- type: string
- type: array
- sourceLabels:
- additionalProperties:
- type: string
- description: One or more labels that constrain the applicability
- of a rule to workloads with the given labels.
- type: object
- sourceNamespace:
- description: Source namespace constraining the applicability
- of a rule to workloads in that namespace.
- type: string
- required:
- - sniHosts
- type: object
- type: array
- route:
- description: The destination to which the connection should
- be forwarded to.
- items:
- properties:
- destination:
- description: Destination uniquely identifies the instances
- of a service to which the request/connection should
- be forwarded to.
- properties:
- host:
- description: The name of a service from the service
- registry.
- type: string
- port:
- description: Specifies the port on the host that is
- being addressed.
- properties:
- number:
- maximum: 4294967295
- minimum: 0
- type: integer
- type: object
- subset:
- description: The name of a subset within the service.
- type: string
- required:
- - host
- type: object
- weight:
- description: Weight specifies the relative proportion
- of traffic to be forwarded to the destination.
- format: int32
- type: integer
- required:
- - destination
- type: object
- type: array
- required:
- - match
- type: object
- type: array
- type: object
- status:
- properties:
- conditions:
- description: Current service state of the resource.
- items:
- properties:
- lastProbeTime:
- description: Last time we probed the condition.
- format: date-time
- type: string
- lastTransitionTime:
- description: Last time the condition transitioned from one status
- to another.
- format: date-time
- type: string
- message:
- description: Human-readable message indicating details about
- last transition.
- type: string
- observedGeneration:
- anyOf:
- - type: integer
- - type: string
- description: Resource Generation to which the Condition refers.
- x-kubernetes-int-or-string: true
- reason:
- description: Unique, one-word, CamelCase reason for the condition's
- last transition.
- type: string
- status:
- description: Status is the status of the condition.
- type: string
- type:
- description: Type is the type of the condition.
- type: string
- type: object
- type: array
- observedGeneration:
- anyOf:
- - type: integer
- - type: string
- x-kubernetes-int-or-string: true
- validationMessages:
- description: Includes any errors or warnings detected by dubbo's analyzers.
- items:
- properties:
- documentationUrl:
- description: A url pointing to the dubbo documentation for this
- specific error type.
- type: string
- level:
- description: |-
- Represents how severe a message is.
-
- Valid Options: UNKNOWN, ERROR, WARNING, INFO
- enum:
- - UNKNOWN
- - ERROR
- - WARNING
- - INFO
- type: string
- type:
- properties:
- code:
- description: A 7 character code matching `^IST[0-9]{4}$`
- intended to uniquely identify the message type.
- type: string
- name:
- description: A human-readable name for the message type.
- type: string
- type: object
- type: object
- type: array
- type: object
- x-kubernetes-preserve-unknown-fields: true
- type: object
- served: true
- storage: false
- subresources:
- status: {}
- - additionalPrinterColumns:
- - description: The names of gateways and sidecars that should apply these routes
- jsonPath: .spec.gateways
- name: Gateways
- type: string
- - description: The destination hosts to which traffic is being sent
- jsonPath: .spec.hosts
- name: Hosts
- type: string
- - description: 'CreationTimestamp is a timestamp representing the server time
- when this object was created. It is not guaranteed to be set in happens-before
- order across separate operations. Clients may not set this value. It is represented
- in RFC3339 form and is in UTC. Populated by the system. Read-only. Null for
- lists. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#metadata'
- jsonPath: .metadata.creationTimestamp
- name: Age
- type: date
- name: v1beta1
- schema:
- openAPIV3Schema:
- properties:
- spec:
- description: 'Configuration affecting label/content routing, sni routing.'
- properties:
- exportTo:
- description: A list of namespaces to which this virtual service is
- exported.
- items:
- type: string
- type: array
- gateways:
- description: The names of gateways and sidecars that should apply
- these routes.
- items:
- type: string
- type: array
- hosts:
- description: The destination hosts to which traffic is being sent.
- items:
- type: string
- type: array
- http:
- description: An ordered list of route rules for HTTP traffic.
- items:
- properties:
- corsPolicy:
- description: Cross-Origin Resource Sharing policy (CORS).
- properties:
- allowCredentials:
- description: Indicates whether the caller is allowed to
- send the actual request (not the preflight) using credentials.
- nullable: true
- type: boolean
- allowHeaders:
- description: List of HTTP headers that can be used when
- requesting the resource.
- items:
- type: string
- type: array
- allowMethods:
- description: List of HTTP methods allowed to access the
- resource.
- items:
- type: string
- type: array
- allowOrigin:
- items:
- type: string
- type: array
- allowOrigins:
- description: String patterns that match allowed origins.
- items:
- oneOf:
- - not:
- anyOf:
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- - required:
- - exact
- - required:
- - prefix
- - required:
- - regex
- properties:
- exact:
- type: string
- prefix:
- type: string
- regex:
- description: '[RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax).'
- type: string
- type: object
- type: array
- exposeHeaders:
- description: A list of HTTP headers that the browsers are
- allowed to access.
- items:
- type: string
- type: array
- maxAge:
- description: Specifies how long the results of a preflight
- request can be cached.
- type: string
- x-kubernetes-validations:
- - message: must be a valid duration greater than 1ms
- rule: duration(self) >= duration('1ms')
- unmatchedPreflights:
- description: |-
- Indicates whether preflight requests not matching the configured allowed origin shouldn't be forwarded to the upstream.
-
- Valid Options: FORWARD, IGNORE
- enum:
- - UNSPECIFIED
- - FORWARD
- - IGNORE
- type: string
- type: object
- delegate:
- description: Delegate is used to specify the particular VirtualService
- which can be used to define delegate HTTPRoute.
- properties:
- name:
- description: Name specifies the name of the delegate VirtualService.
- type: string
- namespace:
- description: Namespace specifies the namespace where the
- delegate VirtualService resides.
- type: string
- type: object
- directResponse:
- description: A HTTP rule can either return a direct_response,
- redirect or forward (default) traffic.
- properties:
- body:
- description: Specifies the content of the response body.
- oneOf:
- - not:
- anyOf:
- - required:
- - string
- - required:
- - bytes
- - required:
- - string
- - required:
- - bytes
- properties:
- bytes:
- description: response body as base64 encoded bytes.
- format: binary
- type: string
- string:
- type: string
- type: object
- status:
- description: Specifies the HTTP response status to be returned.
- maximum: 4294967295
- minimum: 0
- type: integer
- required:
- - status
- type: object
- fault:
- description: Fault injection policy to apply on HTTP traffic
- at the client side.
- properties:
- abort:
- description: Abort Http request attempts and return error
... 7285 lines suppressed ...