--- # Source: consul/templates/auth-method-serviceaccount.yaml apiVersion: v1 kind: ServiceAccount metadata: name: consul-consul-auth-method namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: auth-method --- # Source: consul/templates/connect-inject-serviceaccount.yaml apiVersion: v1 kind: ServiceAccount metadata: name: consul-consul-connect-injector namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: connect-injector --- # Source: consul/templates/gateway-cleanup-serviceaccount-custom.yaml apiVersion: v1 kind: ServiceAccount metadata: name: consul-consul-gateway-cleanup-custom namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: gateway-cleanup-custom --- # Source: consul/templates/gateway-cleanup-serviceaccount.yaml apiVersion: v1 kind: ServiceAccount metadata: name: consul-consul-gateway-cleanup namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: gateway-cleanup --- # Source: consul/templates/gateway-resources-serviceaccount-custom.yaml apiVersion: v1 kind: ServiceAccount metadata: name: consul-consul-gateway-resources-custom namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: gateway-resources-custom --- # Source: consul/templates/gateway-resources-serviceaccount.yaml apiVersion: v1 kind: ServiceAccount metadata: name: consul-consul-gateway-resources namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: gateway-resources --- # Source: consul/templates/ingress-gateways-serviceaccount.yaml apiVersion: v1 kind: ServiceAccount metadata: name: consul-consul-ingress-gateway namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: ingress-gateway ingress-gateway-name: consul-consul-ingress-gateway --- # Source: consul/templates/mesh-gateway-serviceaccount.yaml apiVersion: v1 kind: ServiceAccount metadata: name: consul-consul-mesh-gateway namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: mesh-gateway --- # Source: consul/templates/server-acl-init-cleanup-serviceaccount.yaml apiVersion: v1 kind: ServiceAccount metadata: name: consul-consul-server-acl-init-cleanup namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: server-acl-init-cleanup --- # Source: consul/templates/server-acl-init-serviceaccount.yaml apiVersion: v1 kind: ServiceAccount metadata: name: consul-consul-server-acl-init namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: server-acl-init --- # Source: consul/templates/server-serviceaccount.yaml apiVersion: v1 kind: ServiceAccount metadata: name: consul-consul-server namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: server --- # Source: consul/templates/terminating-gateways-serviceaccount.yaml apiVersion: v1 kind: ServiceAccount metadata: name: consul-consul-terminating-gateway namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: terminating-gateway terminating-gateway-name: consul-consul-terminating-gateway --- # Source: consul/templates/webhook-cert-manager-serviceaccount.yaml apiVersion: v1 kind: ServiceAccount metadata: name: consul-consul-webhook-cert-manager namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: webhook-cert-manager --- # Source: consul/templates/auth-method-secret.yaml apiVersion: v1 kind: Secret metadata: name: consul-consul-auth-method namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: auth-method annotations: kubernetes.io/service-account.name: consul-consul-auth-method type: kubernetes.io/service-account-token --- # Source: consul/templates/connect-inject-configmap.yaml apiVersion: v1 kind: ConfigMap metadata: name: consul-consul-connect-inject-config namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: connect-injector data: config.json: | { "image_pull_secrets": [] } --- # Source: consul/templates/consul-helm-values-configmap.yaml apiVersion: v1 kind: ConfigMap metadata: name: helm-values namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: terminating-gateway data: values.json: | { "fullnameOverride": "", "nameOverride": "", "release": { "name": "consul", "namespace": "consul", "service": "Helm" }, "global": { "name": "", "enabled": true, "logLevel": "info", "logJSON": false, "datacenter": "dc1", "enableConsulNamespaces": false, "adminPartitions": { "enabled": false, "name": "default" }, "tls": { "enabled": true, "caCert": { "secretName": "consul-ca-cert" } }, "acls": { "manageSystemACLs": true }, "secretsBackend": { "vault": { "enabled": false, "consulCARole": "", "ca": { "secretName": "", "secretKey": "" }, "agentAnnotations": {} } }, "metrics": { "enabled": false, "enableGatewayMetrics": true }, "imageK8S": "hashicorp/consul-k8s-control-plane:2.0.0", "imageConsulDataplane": "hashicorp/consul-dataplane:2.0.0", "extraLabels": {}, "consulAPITimeout": "5s", "imagePullPolicy": "IfNotPresent", "enablePodSecurityPolicies": false, "openShiftEnabled": false }, "terminatingGateways": { "enabled": true, "logLevel": "", "defaults": { "replicas": 1, "consulNamespace": "default", "annotations": {} }, "gateways": [ { "name": "terminating-gateway", "consulNamespace": "" } ] }, "externalServers": { "enabled": false, "hosts": [], "httpsPort": 8501, "grpcPort": 8502, "tlsServerName": "", "useSystemRoots": false, "skipServerWatch": false } } --- # Source: consul/templates/gateway-resources-configmap-custom.yaml # Validation # For meshGateway.wanAddress, static must be set if source is "Static" # Configuration of Gateway Resources Job which creates managed Gateway configuration. apiVersion: v1 kind: ConfigMap metadata: name: consul-consul-gateway-resources-config-custom namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: gateway-resources-custom data: resources.json: | {"limits":{"cpu":"100m","memory":"100Mi"},"requests":{"cpu":"100m","memory":"100Mi"}} --- # Source: consul/templates/gateway-resources-configmap.yaml # Validation # For meshGateway.wanAddress, static must be set if source is "Static" # Configuration of Gateway Resources Job which creates managed Gateway configuration. apiVersion: v1 kind: ConfigMap metadata: name: consul-consul-gateway-resources-config namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: gateway-resources data: resources.json: | {"limits":{"cpu":"100m","memory":"100Mi"},"requests":{"cpu":"100m","memory":"100Mi"}} --- # Source: consul/templates/server-config-configmap.yaml # StatefulSet to run the actual Consul server cluster. apiVersion: v1 kind: ConfigMap metadata: name: consul-consul-server-config namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: server data: server.json: | { "bind_addr": "0.0.0.0", "bootstrap_expect": 3, "client_addr": "0.0.0.0", "connect": { "enabled": true }, "datacenter": "dc1", "data_dir": "/consul/data", "log_level": "INFO", "enable_debug": false, "domain": "consul", "limits": { "request_limits": { "mode": "disabled", "read_rate": -1, "write_rate": -1 } }, "ports": { "grpc": -1, "grpc_tls": 8502, "serf_lan": 8301 }, "recursors": [], "retry_join": ["consul-consul-server.consul.svc:8301"], "server": true, "leave_on_terminate": true, "autopilot": { "min_quorum": 2, "disable_upgrade_migration": true } } acl-config.json: |- { "acl": { "enabled": true, "default_policy": "deny", "down_policy": "extend-cache", "enable_token_persistence": true } } tls-config.json: |- { "tls": { "internal_rpc": { "verify_incoming": true, "verify_server_hostname": true }, "grpc": { "verify_incoming": false }, "defaults": { "verify_outgoing": true, "ca_file": "/consul/tls/ca/tls.crt", "cert_file": "/consul/tls/server/tls.crt", "key_file": "/consul/tls/server/tls.key" } }, "ports": { "http": -1, "https": 8501 } } ui-config.json: |- { "ui_config": { "enabled": true } } central-config.json: |- { "enable_central_service_config": true } --- # Source: consul/templates/server-tmp-extra-config-configmap.yaml # ConfigMap that is used as a temporary landing spot so that the container command # in the server-stateful set where it needs to be transformed. ConfigMaps create # read only volumes so it needs to be copied and transformed to the extra-config # emptyDir volume where all final extra cofngi lives for use in consul. (locality-init # also writes to extra-config volume.) apiVersion: v1 kind: ConfigMap metadata: name: consul-consul-server-tmp-extra-config namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: server data: extra-from-values.json: |- {} --- # Source: consul/templates/webhook-cert-manager-configmap.yaml apiVersion: v1 kind: ConfigMap metadata: name: consul-consul-webhook-cert-manager-config namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: webhook-cert-manager data: webhook-config.json: |- [ { "name": "consul-consul-connect-injector", "tlsAutoHosts": [ "consul-consul-connect-injector", "consul-consul-connect-injector.consul", "consul-consul-connect-injector.consul.svc", "consul-consul-connect-injector.consul.svc.cluster.local" ], "secretName": "consul-consul-connect-inject-webhook-cert", "secretNamespace": "consul" } ] --- # Source: consul/templates/crd-controlplanerequestlimits.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 labels: app: consul chart: consul-helm heritage: Helm release: consul component: crd name: controlplanerequestlimits.consul.hashicorp.com spec: group: consul.hashicorp.com names: kind: ControlPlaneRequestLimit listKind: ControlPlaneRequestLimitList plural: controlplanerequestlimits singular: controlplanerequestlimit scope: Namespaced versions: - additionalPrinterColumns: - description: The sync status of the resource with Consul jsonPath: .status.conditions[?(@.type=="Synced")].status name: Synced type: string - description: The age of the resource jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: ControlPlaneRequestLimit is the Schema for the controlplanerequestlimits API. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: ControlPlaneRequestLimitSpec defines the desired state of ControlPlaneRequestLimit. properties: acl: properties: readRate: type: number writeRate: type: number type: object catalog: properties: readRate: type: number writeRate: type: number type: object configEntry: properties: readRate: type: number writeRate: type: number type: object connectCA: properties: readRate: type: number writeRate: type: number type: object coordinate: properties: readRate: type: number writeRate: type: number type: object discoveryChain: properties: readRate: type: number writeRate: type: number type: object health: properties: readRate: type: number writeRate: type: number type: object intention: properties: readRate: type: number writeRate: type: number type: object kv: properties: readRate: type: number writeRate: type: number type: object mode: type: string preparedQuery: properties: readRate: type: number writeRate: type: number type: object readRate: type: number session: properties: readRate: type: number writeRate: type: number type: object tenancy: properties: readRate: type: number writeRate: type: number type: object txn: properties: readRate: type: number writeRate: type: number type: object writeRate: type: number type: object status: properties: conditions: description: Conditions indicate the latest available observations of a resource's current state. items: description: |- Conditions define a readiness condition for a Consul resource. See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties properties: lastTransitionTime: description: LastTransitionTime is the last time the condition transitioned from one status to another. format: date-time type: string message: description: A human readable message indicating details about the transition. type: string reason: description: The reason for the condition's last transition. type: string status: description: Status of the condition, one of True, False, Unknown. type: string type: description: Type of condition. type: string required: - status - type type: object type: array lastSyncedTime: description: LastSyncedTime is the last time the resource successfully synced with Consul. format: date-time type: string type: object type: object served: true storage: true subresources: status: {} --- # Source: consul/templates/crd-exportedservices-v1.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 labels: app: consul chart: consul-helm heritage: Helm release: consul component: crd name: exportedservices.consul.hashicorp.com spec: group: consul.hashicorp.com names: kind: ExportedServices listKind: ExportedServicesList plural: exportedservices shortNames: - exported-services singular: exportedservices scope: Namespaced versions: - additionalPrinterColumns: - description: The sync status of the resource with Consul jsonPath: .status.conditions[?(@.type=="Synced")].status name: Synced type: string - description: The last successful synced time of the resource with Consul jsonPath: .status.lastSyncedTime name: Last Synced type: date - description: The age of the resource jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: ExportedServices is the Schema for the exportedservices API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: ExportedServicesSpec defines the desired state of ExportedServices. properties: services: description: |- Services is a list of services to be exported and the list of partitions to expose them to. items: description: |- ExportedService manages the exporting of a service in the local partition to other partitions. properties: consumers: description: Consumers is a list of downstream consumers of the service to be exported. items: description: ServiceConsumer represents a downstream consumer of the service to be exported. properties: partition: description: Partition is the admin partition to export the service to. type: string peer: description: Peer is the name of the peer to export the service to. type: string samenessGroup: description: SamenessGroup is the name of the sameness group to export the service to. type: string type: object type: array name: description: Name is the name of the service to be exported. type: string namespace: description: Namespace is the namespace to export the service from. type: string type: object type: array type: object status: properties: conditions: description: Conditions indicate the latest available observations of a resource's current state. items: description: |- Conditions define a readiness condition for a Consul resource. See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties properties: lastTransitionTime: description: LastTransitionTime is the last time the condition transitioned from one status to another. format: date-time type: string message: description: A human readable message indicating details about the transition. type: string reason: description: The reason for the condition's last transition. type: string status: description: Status of the condition, one of True, False, Unknown. type: string type: description: Type of condition. type: string required: - status - type type: object type: array lastSyncedTime: description: LastSyncedTime is the last time the resource successfully synced with Consul. format: date-time type: string type: object type: object served: true storage: true subresources: status: {} --- # Source: consul/templates/crd-gatewayclassconfigs-v1.yaml # Copyright (c) HashiCorp, Inc. # SPDX-License-Identifier: MPL-2.0 apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 labels: app: consul chart: consul-helm heritage: Helm release: consul component: crd name: gatewayclassconfigs.consul.hashicorp.com spec: group: consul.hashicorp.com names: kind: GatewayClassConfig listKind: GatewayClassConfigList plural: gatewayclassconfigs singular: gatewayclassconfig scope: Cluster versions: - name: v1alpha1 schema: openAPIV3Schema: description: GatewayClassConfig defines the values that may be set on a GatewayClass for Consul API Gateway. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: Spec defines the desired state of GatewayClassConfig. properties: copyAnnotations: description: Annotation Information to copy to services or deployments properties: service: description: List of annotations to copy to the gateway service. items: type: string type: array type: object deployment: description: Deployment defines the deployment configuration for the gateway. properties: defaultInstances: default: 1 description: |- Number of gateway instances that should be deployed by default DEPRECATED: Use Gateway annotations (consul.hashicorp.com/default-replicas) instead format: int32 minimum: 1 type: integer maxInstances: default: 8 description: |- Max allowed number of gateway instances DEPRECATED: Use HPA maxReplicas instead via Gateway annotations format: int32 minimum: 1 type: integer minInstances: default: 1 description: |- Minimum allowed number of gateway instances DEPRECATED: Use HPA minReplicas instead via Gateway annotations format: int32 minimum: 1 type: integer resources: description: Resources defines the resource requirements for the gateway. properties: claims: description: |- Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. This is an alpha field and requires enabling the DynamicResourceAllocation feature gate. This field is immutable. It can only be set for containers. items: description: ResourceClaim references one entry in PodSpec.ResourceClaims. properties: name: description: |- Name must match the name of one entry in pod.spec.resourceClaims of the Pod where this field is used. It makes that resource available inside a container. type: string required: - name type: object type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map limits: additionalProperties: anyOf: - type: integer - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true description: |- Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object requests: additionalProperties: anyOf: - type: integer - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true description: |- Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object type: object type: object mapPrivilegedContainerPorts: description: The value to add to privileged ports ( ports < 1024) for gateway containers format: int32 type: integer metrics: description: Metrics defines how to configure the metrics for a gateway. properties: enabled: description: |- Enable metrics for this class of gateways. If unspecified, will inherit behavior from the global Helm configuration. type: boolean path: description: The path used for metrics. type: string port: description: The port used for metrics. format: int32 maximum: 65535 minimum: 1024 type: integer type: object nodeSelector: additionalProperties: type: string description: |- NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node's labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ type: object openshiftSCCName: description: The name of the OpenShift SecurityContextConstraints resource for this gateway class to use. type: string podSecurityPolicy: description: The name of an existing Kubernetes PodSecurityPolicy to bind to the managed ServiceAccount if ACLs are managed. type: string serviceType: description: Service Type string describes ingress methods for a service enum: - ClusterIP - NodePort - LoadBalancer type: string tolerations: description: |- Tolerations allow the scheduler to schedule nodes with matching taints. More Info: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ items: description: |- The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . properties: effect: description: |- Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. type: string key: description: |- Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys. type: string operator: description: |- Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. type: string tolerationSeconds: description: |- TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. format: int64 type: integer value: description: |- Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. type: string type: object type: array type: object type: object served: true storage: true --- # Source: consul/templates/crd-gatewayclasses-external.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/1538 gateway.networking.k8s.io/bundle-version: v0.6.2 gateway.networking.k8s.io/channel: experimental creationTimestamp: null labels: app: consul chart: consul-helm heritage: Helm release: consul name: consul-v1-gatewayclasses component: crd name: gatewayclasses.gateway.networking.k8s.io spec: group: gateway.networking.k8s.io names: categories: - gateway-api kind: GatewayClass listKind: GatewayClassList plural: gatewayclasses shortNames: - gc singular: gatewayclass scope: Cluster versions: - additionalPrinterColumns: - jsonPath: .spec.controllerName name: Controller type: string - jsonPath: .status.conditions[?(@.type=="Accepted")].status name: Accepted type: string - jsonPath: .metadata.creationTimestamp name: Age type: date - jsonPath: .spec.description name: Description priority: 1 type: string name: v1 schema: openAPIV3Schema: description: "GatewayClass describes a class of Gateways available to the user for creating Gateway resources. \n It is recommended that this resource be used as a template for Gateways. This means that a Gateway is based on the state of the GatewayClass at the time it was created and changes to the GatewayClass or associated parameters are not propagated down to existing Gateways. This recommendation is intended to limit the blast radius of changes to GatewayClass or associated parameters. If implementations choose to propagate GatewayClass changes to existing Gateways, that MUST be clearly documented by the implementation. \n Whenever one or more Gateways are using a GatewayClass, implementations MUST add the `gateway-exists-finalizer.gateway.networking.k8s.io` finalizer on the associated GatewayClass. This ensures that a GatewayClass associated with a Gateway is not deleted while in use. \n GatewayClass is a Cluster level resource." properties: apiVersion: description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' type: string kind: description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' type: string metadata: type: object spec: description: Spec defines the desired state of GatewayClass. properties: controllerName: description: "ControllerName is the name of the controller that is managing Gateways of this class. The value of this field MUST be a domain prefixed path. \n Example: \"example.net/gateway-controller\". \n This field is not mutable and cannot be empty. \n Support: Core" maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ type: string description: description: Description helps describe a GatewayClass with more details. maxLength: 64 type: string parametersRef: description: "ParametersRef is a reference to a resource that contains the configuration parameters corresponding to the GatewayClass. This is optional if the controller does not require any additional configuration. \n ParametersRef can reference a standard Kubernetes resource, i.e. ConfigMap, or an implementation-specific custom resource. The resource can be cluster-scoped or namespace-scoped. \n If the referent cannot be found, the GatewayClass's \"InvalidParameters\" status condition will be true. \n Support: Implementation-specific" properties: group: description: Group is the group of the referent. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: description: Kind is kind of the referent. maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: Name is the name of the referent. maxLength: 253 minLength: 1 type: string namespace: description: Namespace is the namespace of the referent. This field is required when referring to a Namespace-scoped resource and MUST be unset when referring to a Cluster-scoped resource. maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string required: - group - kind - name type: object required: - controllerName type: object status: default: conditions: - lastTransitionTime: "1970-01-01T00:00:00Z" message: Waiting for controller reason: Waiting status: Unknown type: Accepted description: Status defines the current state of GatewayClass. properties: conditions: default: - lastTransitionTime: "1970-01-01T00:00:00Z" message: Waiting for controller reason: Pending status: Unknown type: Accepted description: "Conditions is the current status from the controller for this GatewayClass. \n Controllers should prefer to publish conditions using values of GatewayClassConditionType for the type of each Condition." items: description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, \n \ttype FooStatus struct{ \t // Represents the observations of a foo's current state. \t // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" \t // +patchMergeKey=type \t // +patchStrategy=merge \t // +listType=map \t // +listMapKey=type \t Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n \t // other fields \t}" properties: lastTransitionTime: description: lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object maxItems: 8 type: array x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map type: object required: - spec type: object served: true storage: false subresources: status: {} - additionalPrinterColumns: - jsonPath: .spec.controllerName name: Controller type: string - jsonPath: .status.conditions[?(@.type=="Accepted")].status name: Accepted type: string - jsonPath: .metadata.creationTimestamp name: Age type: date - jsonPath: .spec.description name: Description priority: 1 type: string name: v1beta1 schema: openAPIV3Schema: description: "GatewayClass describes a class of Gateways available to the user for creating Gateway resources. \n It is recommended that this resource be used as a template for Gateways. This means that a Gateway is based on the state of the GatewayClass at the time it was created and changes to the GatewayClass or associated parameters are not propagated down to existing Gateways. This recommendation is intended to limit the blast radius of changes to GatewayClass or associated parameters. If implementations choose to propagate GatewayClass changes to existing Gateways, that MUST be clearly documented by the implementation. \n Whenever one or more Gateways are using a GatewayClass, implementations MUST add the `gateway-exists-finalizer.gateway.networking.k8s.io` finalizer on the associated GatewayClass. This ensures that a GatewayClass associated with a Gateway is not deleted while in use. \n GatewayClass is a Cluster level resource." properties: apiVersion: description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' type: string kind: description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' type: string metadata: type: object spec: description: Spec defines the desired state of GatewayClass. properties: controllerName: description: "ControllerName is the name of the controller that is managing Gateways of this class. The value of this field MUST be a domain prefixed path. \n Example: \"example.net/gateway-controller\". \n This field is not mutable and cannot be empty. \n Support: Core" maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ type: string description: description: Description helps describe a GatewayClass with more details. maxLength: 64 type: string parametersRef: description: "ParametersRef is a reference to a resource that contains the configuration parameters corresponding to the GatewayClass. This is optional if the controller does not require any additional configuration. \n ParametersRef can reference a standard Kubernetes resource, i.e. ConfigMap, or an implementation-specific custom resource. The resource can be cluster-scoped or namespace-scoped. \n If the referent cannot be found, the GatewayClass's \"InvalidParameters\" status condition will be true. \n Support: Implementation-specific" properties: group: description: Group is the group of the referent. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: description: Kind is kind of the referent. maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: Name is the name of the referent. maxLength: 253 minLength: 1 type: string namespace: description: Namespace is the namespace of the referent. This field is required when referring to a Namespace-scoped resource and MUST be unset when referring to a Cluster-scoped resource. maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string required: - group - kind - name type: object required: - controllerName type: object status: default: conditions: - lastTransitionTime: "1970-01-01T00:00:00Z" message: Waiting for controller reason: Waiting status: Unknown type: Accepted description: Status defines the current state of GatewayClass. properties: conditions: default: - lastTransitionTime: "1970-01-01T00:00:00Z" message: Waiting for controller reason: Pending status: Unknown type: Accepted description: "Conditions is the current status from the controller for this GatewayClass. \n Controllers should prefer to publish conditions using values of GatewayClassConditionType for the type of each Condition." items: description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, \n \ttype FooStatus struct{ \t // Represents the observations of a foo's current state. \t // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" \t // +patchMergeKey=type \t // +patchStrategy=merge \t // +listType=map \t // +listMapKey=type \t Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n \t // other fields \t}" properties: lastTransitionTime: description: lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object maxItems: 8 type: array x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map type: object required: - spec type: object served: true storage: true subresources: status: {} status: acceptedNames: kind: "" plural: "" conditions: [] storedVersions: [] --- # Source: consul/templates/crd-gatewaypolicies.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 labels: app: consul chart: consul-helm heritage: Helm release: consul component: crd name: gatewaypolicies.consul.hashicorp.com spec: group: consul.hashicorp.com names: kind: GatewayPolicy listKind: GatewayPolicyList plural: gatewaypolicies singular: gatewaypolicy scope: Namespaced versions: - additionalPrinterColumns: - description: The sync status of the resource with Consul jsonPath: .status.conditions[?(@.type=="Synced")].status name: Synced type: string - description: The last successful synced time of the resource with Consul jsonPath: .status.lastSyncedTime name: Last Synced type: date - description: The age of the resource jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: GatewayPolicy is the Schema for the gatewaypolicies API. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: GatewayPolicySpec defines the desired state of GatewayPolicy. properties: default: properties: jwt: description: GatewayJWTRequirement holds the list of JWT providers to be verified against. properties: providers: description: Providers is a list of providers to consider when verifying a JWT. items: description: GatewayJWTProvider holds the provider and claim verification information. properties: name: description: |- Name is the name of the JWT provider. There MUST be a corresponding "jwt-provider" config entry with this name. type: string verifyClaims: description: VerifyClaims is a list of additional claims to verify in a JWT's payload. items: description: GatewayJWTClaimVerification holds the actual claim information to be verified. properties: path: description: Path is the path to the claim in the token JSON. items: type: string type: array value: description: |- Value is the expected value at the given path: - If the type at the path is a list then we verify that this value is contained in the list. - If the type at the path is a string then we verify that this value matches. type: string required: - path - value type: object type: array required: - name type: object type: array required: - providers type: object type: object override: properties: jwt: description: GatewayJWTRequirement holds the list of JWT providers to be verified against. properties: providers: description: Providers is a list of providers to consider when verifying a JWT. items: description: GatewayJWTProvider holds the provider and claim verification information. properties: name: description: |- Name is the name of the JWT provider. There MUST be a corresponding "jwt-provider" config entry with this name. type: string verifyClaims: description: VerifyClaims is a list of additional claims to verify in a JWT's payload. items: description: GatewayJWTClaimVerification holds the actual claim information to be verified. properties: path: description: Path is the path to the claim in the token JSON. items: type: string type: array value: description: |- Value is the expected value at the given path: - If the type at the path is a list then we verify that this value is contained in the list. - If the type at the path is a string then we verify that this value matches. type: string required: - path - value type: object type: array required: - name type: object type: array required: - providers type: object type: object targetRef: description: TargetRef identifies an API object to apply policy to. properties: group: description: Group is the group of the target resource. maxLength: 253 minLength: 1 type: string kind: description: Kind is kind of the target resource. maxLength: 253 minLength: 1 type: string name: description: Name is the name of the target resource. maxLength: 253 minLength: 1 type: string namespace: description: |- Namespace is the namespace of the referent. When unspecified, the local namespace is inferred. Even when policy targets a resource in a different namespace, it may only apply to traffic originating from the same namespace as the policy. maxLength: 253 minLength: 1 type: string sectionName: description: SectionName refers to the listener targeted by this policy. maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string required: - group - kind - name type: object required: - targetRef type: object status: description: GatewayPolicyStatus defines the observed state of the gateway. properties: conditions: description: |- Conditions describe the current conditions of the Policy. Known condition types are: * "Accepted" * "ResolvedRefs" items: description: "Condition contains details for one aspect of the current state of this API Resource.\n---\nThis struct is intended for direct use as an array at the field path .status.conditions. For example,\n\n\n\ttype FooStatus struct{\n\t // Represents the observations of a foo's current state.\n\t // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t \ // other fields\n\t}" properties: lastTransitionTime: description: |- lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: |- message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: |- observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: |- reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: |- type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object maxItems: 8 type: array x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map type: object type: object served: true storage: true subresources: status: {} --- # Source: consul/templates/crd-gateways-external.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/1538 gateway.networking.k8s.io/bundle-version: v0.6.2 gateway.networking.k8s.io/channel: experimental creationTimestamp: null labels: app: consul chart: consul-helm heritage: Helm release: consul name: consul-v1-gateway component: crd name: gateways.gateway.networking.k8s.io spec: group: gateway.networking.k8s.io names: categories: - gateway-api kind: Gateway listKind: GatewayList plural: gateways shortNames: - gtw singular: gateway scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .spec.gatewayClassName name: Class type: string - jsonPath: .status.addresses[*].value name: Address type: string - jsonPath: .status.conditions[?(@.type=="Programmed")].status name: Programmed type: string - jsonPath: .metadata.creationTimestamp name: Age type: date name: v1 schema: openAPIV3Schema: description: Gateway represents an instance of a service-traffic handling infrastructure by binding Listeners to a set of IP addresses. properties: apiVersion: description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' type: string kind: description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' type: string metadata: type: object spec: description: Spec defines the desired state of Gateway. properties: addresses: description: "Addresses requested for this Gateway. This is optional and behavior can depend on the implementation. If a value is set in the spec and the requested address is invalid or unavailable, the implementation MUST indicate this in the associated entry in GatewayStatus.Addresses. \n The Addresses field represents a request for the address(es) on the \"outside of the Gateway\", that traffic bound for this Gateway will use. This could be the IP address or hostname of an external load balancer or other networking infrastructure, or some other address that traffic will be sent to. \n The .listener.hostname field is used to route traffic that has already arrived at the Gateway to the correct in-cluster destination. \n If no Addresses are specified, the implementation MAY schedule the Gateway in an implementation-specific manner, assigning an appropriate set of Addresses. \n The implementation MUST bind all Listeners to every GatewayAddress that it assigns to the Gateway and add a corresponding entry in GatewayStatus.Addresses. \n Support: Extended" items: description: GatewayAddress describes an address that can be bound to a Gateway. properties: type: default: IPAddress description: Type of the address. maxLength: 253 minLength: 1 pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ type: string value: description: "Value of the address. The validity of the values will depend on the type and support by the controller. \n Examples: `1.2.3.4`, `128::1`, `my-ip-address`." maxLength: 253 minLength: 1 type: string required: - value type: object maxItems: 16 type: array gatewayClassName: description: GatewayClassName used for this Gateway. This is the name of a GatewayClass resource. maxLength: 253 minLength: 1 type: string listeners: description: "Listeners associated with this Gateway. Listeners define logical endpoints that are bound on this Gateway's addresses. At least one Listener MUST be specified. \n Each listener in a Gateway must have a unique combination of Hostname, Port, and Protocol. \n An implementation MAY group Listeners by Port and then collapse each group of Listeners into a single Listener if the implementation determines that the Listeners in the group are \"compatible\". An implementation MAY also group together and collapse compatible Listeners belonging to different Gateways. \n For example, an implementation might consider Listeners to be compatible with each other if all of the following conditions are met: \n 1. Either each Listener within the group specifies the \"HTTP\" Protocol or each Listener within the group specifies either the \"HTTPS\" or \"TLS\" Protocol. \n 2. Each Listener within the group specifies a Hostname that is unique within the group. \n 3. As a special case, one Listener within a group may omit Hostname, in which case this Listener matches when no other Listener matches. \n If the implementation does collapse compatible Listeners, the hostname provided in the incoming client request MUST be matched to a Listener to find the correct set of Routes. The incoming hostname MUST be matched using the Hostname field for each Listener in order of most to least specific. That is, exact matches must be processed before wildcard matches. \n If this field specifies multiple Listeners that have the same Port value but are not compatible, the implementation must raise a \"Conflicted\" condition in the Listener status. \n Support: Core" items: description: Listener embodies the concept of a logical endpoint where a Gateway accepts network connections. properties: allowedRoutes: default: namespaces: from: Same description: "AllowedRoutes defines the types of routes that MAY be attached to a Listener and the trusted namespaces where those Route resources MAY be present. \n Although a client request may match multiple route rules, only one rule may ultimately receive the request. Matching precedence MUST be determined in order of the following criteria: \n * The most specific match as defined by the Route type. * The oldest Route based on creation timestamp. For example, a Route with a creation timestamp of \"2020-09-08 01:02:03\" is given precedence over a Route with a creation timestamp of \"2020-09-08 01:02:04\". * If everything else is equivalent, the Route appearing first in alphabetical order (namespace/name) should be given precedence. For example, foo/bar is given precedence over foo/baz. \n All valid rules within a Route attached to this Listener should be implemented. Invalid Route rules can be ignored (sometimes that will mean the full Route). If a Route rule transitions from valid to invalid, support for that Route rule should be dropped to ensure consistency. For example, even if a filter specified by a Route rule is invalid, the rest of the rules within that Route should still be supported. \n Support: Core" properties: kinds: description: "Kinds specifies the groups and kinds of Routes that are allowed to bind to this Gateway Listener. When unspecified or empty, the kinds of Routes selected are determined using the Listener protocol. \n A RouteGroupKind MUST correspond to kinds of Routes that are compatible with the application protocol specified in the Listener's Protocol field. If an implementation does not support or recognize this resource type, it MUST set the \"ResolvedRefs\" condition to False for this Listener with the \"InvalidRouteKinds\" reason. \n Support: Core" items: description: RouteGroupKind indicates the group and kind of a Route resource. properties: group: default: gateway.networking.k8s.io description: Group is the group of the Route. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: description: Kind is the kind of the Route. maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string required: - kind type: object maxItems: 8 type: array namespaces: default: from: Same description: "Namespaces indicates namespaces from which Routes may be attached to this Listener. This is restricted to the namespace of this Gateway by default. \n Support: Core" properties: from: default: Same description: "From indicates where Routes will be selected for this Gateway. Possible values are: * All: Routes in all namespaces may be used by this Gateway. * Selector: Routes in namespaces selected by the selector may be used by this Gateway. * Same: Only Routes in the same namespace may be used by this Gateway. \n Support: Core" enum: - All - Selector - Same type: string selector: description: "Selector must be specified when From is set to \"Selector\". In that case, only Routes in Namespaces matching this Selector will be selected by this Gateway. This field is ignored for other values of \"From\". \n Support: Core" properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object type: object type: object hostname: description: "Hostname specifies the virtual hostname to match for protocol types that define this concept. When unspecified, all hostnames are matched. This field is ignored for protocols that don't require hostname based matching. \n Implementations MUST apply Hostname matching appropriately for each of the following protocols: \n * TLS: The Listener Hostname MUST match the SNI. * HTTP: The Listener Hostname MUST match the Host header of the request. * HTTPS: The Listener Hostname SHOULD match at both the TLS and HTTP protocol layers as described above. If an implementation does not ensure that both the SNI and Host header match the Listener hostname, it MUST clearly document that. \n For HTTPRoute and TLSRoute resources, there is an interaction with the `spec.hostnames` array. When both listener and route specify hostnames, there MUST be an intersection between the values for a Route to be accepted. For more information, refer to the Route specific Hostnames documentation. \n Hostnames that are prefixed with a wildcard label (`*.`) are interpreted as a suffix match. That means that a match for `*.example.com` would match both `test.example.com`, and `foo.test.example.com`, but not `example.com`. \n Support: Core" maxLength: 253 minLength: 1 pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string name: description: "Name is the name of the Listener. This name MUST be unique within a Gateway. \n Support: Core" maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string port: description: "Port is the network port. Multiple listeners may use the same port, subject to the Listener compatibility rules. \n Support: Core" format: int32 maximum: 65535 minimum: 1 type: integer protocol: description: "Protocol specifies the network protocol this listener expects to receive. \n Support: Core" maxLength: 255 minLength: 1 pattern: ^[a-zA-Z0-9]([-a-zSA-Z0-9]*[a-zA-Z0-9])?$|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9]+$ type: string tls: description: "TLS is the TLS configuration for the Listener. This field is required if the Protocol field is \"HTTPS\" or \"TLS\". It is invalid to set this field if the Protocol field is \"HTTP\", \"TCP\", or \"UDP\". \n The association of SNIs to Certificate defined in GatewayTLSConfig is defined based on the Hostname field for this listener. \n The GatewayClass MUST use the longest matching SNI out of all available certificates for any TLS handshake. \n Support: Core" properties: certificateRefs: description: "CertificateRefs contains a series of references to Kubernetes objects that contains TLS certificates and private keys. These certificates are used to establish a TLS handshake for requests that match the hostname of the associated listener. \n A single CertificateRef to a Kubernetes Secret has \"Core\" support. Implementations MAY choose to support attaching multiple certificates to a Listener, but this behavior is implementation-specific. \n References to a resource in different namespace are invalid UNLESS there is a ReferenceGrant in the target namespace that allows the certificate to be attached. If a ReferenceGrant does not allow this reference, the \"ResolvedRefs\" condition MUST be set to False for this listener with the \"RefNotPermitted\" reason. \n This field is required to have at least one element when the mode is set to \"Terminate\" (default) and is optional otherwise. \n CertificateRefs can reference to standard Kubernetes resources, i.e. Secret, or implementation-specific custom resources. \n Support: Core - A single reference to a Kubernetes Secret of type kubernetes.io/tls \n Support: Implementation-specific (More than one reference or other resource types)" items: description: "SecretObjectReference identifies an API object including its namespace, defaulting to Secret. \n The API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid. \n References to objects with invalid Group and Kind are not valid, and must be rejected by the implementation, with appropriate Conditions set on the containing object." properties: group: default: "" description: Group is the group of the referent. For example, "gateway.networking.k8s.io". When unspecified or empty string, core API group is inferred. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: default: Secret description: Kind is kind of the referent. For example "HTTPRoute" or "Service". maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: Name is the name of the referent. maxLength: 253 minLength: 1 type: string namespace: description: "Namespace is the namespace of the backend. When unspecified, the local namespace is inferred. \n Note that when a namespace is specified, a ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. \n Support: Core" maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string required: - name type: object maxItems: 64 type: array mode: default: Terminate description: "Mode defines the TLS behavior for the TLS session initiated by the client. There are two possible modes: \n - Terminate: The TLS session between the downstream client and the Gateway is terminated at the Gateway. This mode requires certificateRefs to be set and contain at least one element. - Passthrough: The TLS session is NOT terminated by the Gateway. This implies that the Gateway can't decipher the TLS stream except for the ClientHello message of the TLS protocol. CertificateRefs field is ignored in this mode. \n Support: Core" enum: - Terminate - Passthrough type: string options: additionalProperties: description: AnnotationValue is the value of an annotation in Gateway API. This is used for validation of maps such as TLS options. This roughly matches Kubernetes annotation validation, although the length validation in that case is based on the entire size of the annotations struct. maxLength: 4096 minLength: 0 type: string description: "Options are a list of key/value pairs to enable extended TLS configuration for each implementation. For example, configuring the minimum TLS version or supported cipher suites. \n A set of common keys MAY be defined by the API in the future. To avoid any ambiguity, implementation-specific definitions MUST use domain-prefixed names, such as `example.com/my-custom-option`. Un-prefixed names are reserved for key names defined by Gateway API. \n Support: Implementation-specific" maxProperties: 16 type: object type: object required: - name - port - protocol type: object maxItems: 64 minItems: 1 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map required: - gatewayClassName - listeners type: object status: default: conditions: - lastTransitionTime: "1970-01-01T00:00:00Z" message: Waiting for controller reason: NotReconciled status: Unknown type: Accepted description: Status defines the current state of Gateway. properties: addresses: description: Addresses lists the IP addresses that have actually been bound to the Gateway. These addresses may differ from the addresses in the Spec, e.g. if the Gateway automatically assigns an address from a reserved pool. items: description: GatewayAddress describes an address that can be bound to a Gateway. properties: type: default: IPAddress description: Type of the address. maxLength: 253 minLength: 1 pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ type: string value: description: "Value of the address. The validity of the values will depend on the type and support by the controller. \n Examples: `1.2.3.4`, `128::1`, `my-ip-address`." maxLength: 253 minLength: 1 type: string required: - value type: object maxItems: 16 type: array conditions: default: - lastTransitionTime: "1970-01-01T00:00:00Z" message: Waiting for controller reason: Pending status: Unknown type: Accepted - lastTransitionTime: "1970-01-01T00:00:00Z" message: Waiting for controller reason: Pending status: Unknown type: Programmed description: "Conditions describe the current conditions of the Gateway. \n Implementations should prefer to express Gateway conditions using the `GatewayConditionType` and `GatewayConditionReason` constants so that operators and tools can converge on a common vocabulary to describe Gateway state. \n Known condition types are: \n * \"Accepted\" * \"Ready\"" items: description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, \n \ttype FooStatus struct{ \t // Represents the observations of a foo's current state. \t // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" \t // +patchMergeKey=type \t // +patchStrategy=merge \t // +listType=map \t // +listMapKey=type \t Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n \t // other fields \t}" properties: lastTransitionTime: description: lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object maxItems: 8 type: array x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map listeners: description: Listeners provide status for each unique listener port defined in the Spec. items: description: ListenerStatus is the status associated with a Listener. properties: attachedRoutes: description: AttachedRoutes represents the total number of Routes that have been successfully attached to this Listener. format: int32 type: integer conditions: description: Conditions describe the current condition of this listener. items: description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, \n \ttype FooStatus struct{ \t // Represents the observations of a foo's current state. \t // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" \t // +patchMergeKey=type \t // +patchStrategy=merge \t // +listType=map \t // +listMapKey=type \t Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n \t // other fields \t}" properties: lastTransitionTime: description: lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object maxItems: 8 type: array x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map name: description: Name is the name of the Listener that this status corresponds to. maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string supportedKinds: description: "SupportedKinds is the list indicating the Kinds supported by this listener. This MUST represent the kinds an implementation supports for that Listener configuration. \n If kinds are specified in Spec that are not supported, they MUST NOT appear in this list and an implementation MUST set the \"ResolvedRefs\" condition to \"False\" with the \"InvalidRouteKinds\" reason. If both valid and invalid Route kinds are specified, the implementation MUST reference the valid Route kinds that have been specified." items: description: RouteGroupKind indicates the group and kind of a Route resource. properties: group: default: gateway.networking.k8s.io description: Group is the group of the Route. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: description: Kind is the kind of the Route. maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string required: - kind type: object maxItems: 8 type: array required: - attachedRoutes - conditions - name - supportedKinds type: object maxItems: 64 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map type: object required: - spec type: object served: true storage: false subresources: status: {} - additionalPrinterColumns: - jsonPath: .spec.gatewayClassName name: Class type: string - jsonPath: .status.addresses[*].value name: Address type: string - jsonPath: .status.conditions[?(@.type=="Programmed")].status name: Programmed type: string - jsonPath: .metadata.creationTimestamp name: Age type: date name: v1beta1 schema: openAPIV3Schema: description: Gateway represents an instance of a service-traffic handling infrastructure by binding Listeners to a set of IP addresses. properties: apiVersion: description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' type: string kind: description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' type: string metadata: type: object spec: description: Spec defines the desired state of Gateway. properties: addresses: description: "Addresses requested for this Gateway. This is optional and behavior can depend on the implementation. If a value is set in the spec and the requested address is invalid or unavailable, the implementation MUST indicate this in the associated entry in GatewayStatus.Addresses. \n The Addresses field represents a request for the address(es) on the \"outside of the Gateway\", that traffic bound for this Gateway will use. This could be the IP address or hostname of an external load balancer or other networking infrastructure, or some other address that traffic will be sent to. \n The .listener.hostname field is used to route traffic that has already arrived at the Gateway to the correct in-cluster destination. \n If no Addresses are specified, the implementation MAY schedule the Gateway in an implementation-specific manner, assigning an appropriate set of Addresses. \n The implementation MUST bind all Listeners to every GatewayAddress that it assigns to the Gateway and add a corresponding entry in GatewayStatus.Addresses. \n Support: Extended" items: description: GatewayAddress describes an address that can be bound to a Gateway. properties: type: default: IPAddress description: Type of the address. maxLength: 253 minLength: 1 pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ type: string value: description: "Value of the address. The validity of the values will depend on the type and support by the controller. \n Examples: `1.2.3.4`, `128::1`, `my-ip-address`." maxLength: 253 minLength: 1 type: string required: - value type: object maxItems: 16 type: array gatewayClassName: description: GatewayClassName used for this Gateway. This is the name of a GatewayClass resource. maxLength: 253 minLength: 1 type: string listeners: description: "Listeners associated with this Gateway. Listeners define logical endpoints that are bound on this Gateway's addresses. At least one Listener MUST be specified. \n Each listener in a Gateway must have a unique combination of Hostname, Port, and Protocol. \n An implementation MAY group Listeners by Port and then collapse each group of Listeners into a single Listener if the implementation determines that the Listeners in the group are \"compatible\". An implementation MAY also group together and collapse compatible Listeners belonging to different Gateways. \n For example, an implementation might consider Listeners to be compatible with each other if all of the following conditions are met: \n 1. Either each Listener within the group specifies the \"HTTP\" Protocol or each Listener within the group specifies either the \"HTTPS\" or \"TLS\" Protocol. \n 2. Each Listener within the group specifies a Hostname that is unique within the group. \n 3. As a special case, one Listener within a group may omit Hostname, in which case this Listener matches when no other Listener matches. \n If the implementation does collapse compatible Listeners, the hostname provided in the incoming client request MUST be matched to a Listener to find the correct set of Routes. The incoming hostname MUST be matched using the Hostname field for each Listener in order of most to least specific. That is, exact matches must be processed before wildcard matches. \n If this field specifies multiple Listeners that have the same Port value but are not compatible, the implementation must raise a \"Conflicted\" condition in the Listener status. \n Support: Core" items: description: Listener embodies the concept of a logical endpoint where a Gateway accepts network connections. properties: allowedRoutes: default: namespaces: from: Same description: "AllowedRoutes defines the types of routes that MAY be attached to a Listener and the trusted namespaces where those Route resources MAY be present. \n Although a client request may match multiple route rules, only one rule may ultimately receive the request. Matching precedence MUST be determined in order of the following criteria: \n * The most specific match as defined by the Route type. * The oldest Route based on creation timestamp. For example, a Route with a creation timestamp of \"2020-09-08 01:02:03\" is given precedence over a Route with a creation timestamp of \"2020-09-08 01:02:04\". * If everything else is equivalent, the Route appearing first in alphabetical order (namespace/name) should be given precedence. For example, foo/bar is given precedence over foo/baz. \n All valid rules within a Route attached to this Listener should be implemented. Invalid Route rules can be ignored (sometimes that will mean the full Route). If a Route rule transitions from valid to invalid, support for that Route rule should be dropped to ensure consistency. For example, even if a filter specified by a Route rule is invalid, the rest of the rules within that Route should still be supported. \n Support: Core" properties: kinds: description: "Kinds specifies the groups and kinds of Routes that are allowed to bind to this Gateway Listener. When unspecified or empty, the kinds of Routes selected are determined using the Listener protocol. \n A RouteGroupKind MUST correspond to kinds of Routes that are compatible with the application protocol specified in the Listener's Protocol field. If an implementation does not support or recognize this resource type, it MUST set the \"ResolvedRefs\" condition to False for this Listener with the \"InvalidRouteKinds\" reason. \n Support: Core" items: description: RouteGroupKind indicates the group and kind of a Route resource. properties: group: default: gateway.networking.k8s.io description: Group is the group of the Route. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: description: Kind is the kind of the Route. maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string required: - kind type: object maxItems: 8 type: array namespaces: default: from: Same description: "Namespaces indicates namespaces from which Routes may be attached to this Listener. This is restricted to the namespace of this Gateway by default. \n Support: Core" properties: from: default: Same description: "From indicates where Routes will be selected for this Gateway. Possible values are: * All: Routes in all namespaces may be used by this Gateway. * Selector: Routes in namespaces selected by the selector may be used by this Gateway. * Same: Only Routes in the same namespace may be used by this Gateway. \n Support: Core" enum: - All - Selector - Same type: string selector: description: "Selector must be specified when From is set to \"Selector\". In that case, only Routes in Namespaces matching this Selector will be selected by this Gateway. This field is ignored for other values of \"From\". \n Support: Core" properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object type: object type: object hostname: description: "Hostname specifies the virtual hostname to match for protocol types that define this concept. When unspecified, all hostnames are matched. This field is ignored for protocols that don't require hostname based matching. \n Implementations MUST apply Hostname matching appropriately for each of the following protocols: \n * TLS: The Listener Hostname MUST match the SNI. * HTTP: The Listener Hostname MUST match the Host header of the request. * HTTPS: The Listener Hostname SHOULD match at both the TLS and HTTP protocol layers as described above. If an implementation does not ensure that both the SNI and Host header match the Listener hostname, it MUST clearly document that. \n For HTTPRoute and TLSRoute resources, there is an interaction with the `spec.hostnames` array. When both listener and route specify hostnames, there MUST be an intersection between the values for a Route to be accepted. For more information, refer to the Route specific Hostnames documentation. \n Hostnames that are prefixed with a wildcard label (`*.`) are interpreted as a suffix match. That means that a match for `*.example.com` would match both `test.example.com`, and `foo.test.example.com`, but not `example.com`. \n Support: Core" maxLength: 253 minLength: 1 pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string name: description: "Name is the name of the Listener. This name MUST be unique within a Gateway. \n Support: Core" maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string port: description: "Port is the network port. Multiple listeners may use the same port, subject to the Listener compatibility rules. \n Support: Core" format: int32 maximum: 65535 minimum: 1 type: integer protocol: description: "Protocol specifies the network protocol this listener expects to receive. \n Support: Core" maxLength: 255 minLength: 1 pattern: ^[a-zA-Z0-9]([-a-zSA-Z0-9]*[a-zA-Z0-9])?$|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9]+$ type: string tls: description: "TLS is the TLS configuration for the Listener. This field is required if the Protocol field is \"HTTPS\" or \"TLS\". It is invalid to set this field if the Protocol field is \"HTTP\", \"TCP\", or \"UDP\". \n The association of SNIs to Certificate defined in GatewayTLSConfig is defined based on the Hostname field for this listener. \n The GatewayClass MUST use the longest matching SNI out of all available certificates for any TLS handshake. \n Support: Core" properties: certificateRefs: description: "CertificateRefs contains a series of references to Kubernetes objects that contains TLS certificates and private keys. These certificates are used to establish a TLS handshake for requests that match the hostname of the associated listener. \n A single CertificateRef to a Kubernetes Secret has \"Core\" support. Implementations MAY choose to support attaching multiple certificates to a Listener, but this behavior is implementation-specific. \n References to a resource in different namespace are invalid UNLESS there is a ReferenceGrant in the target namespace that allows the certificate to be attached. If a ReferenceGrant does not allow this reference, the \"ResolvedRefs\" condition MUST be set to False for this listener with the \"RefNotPermitted\" reason. \n This field is required to have at least one element when the mode is set to \"Terminate\" (default) and is optional otherwise. \n CertificateRefs can reference to standard Kubernetes resources, i.e. Secret, or implementation-specific custom resources. \n Support: Core - A single reference to a Kubernetes Secret of type kubernetes.io/tls \n Support: Implementation-specific (More than one reference or other resource types)" items: description: "SecretObjectReference identifies an API object including its namespace, defaulting to Secret. \n The API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid. \n References to objects with invalid Group and Kind are not valid, and must be rejected by the implementation, with appropriate Conditions set on the containing object." properties: group: default: "" description: Group is the group of the referent. For example, "gateway.networking.k8s.io". When unspecified or empty string, core API group is inferred. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: default: Secret description: Kind is kind of the referent. For example "HTTPRoute" or "Service". maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: Name is the name of the referent. maxLength: 253 minLength: 1 type: string namespace: description: "Namespace is the namespace of the backend. When unspecified, the local namespace is inferred. \n Note that when a namespace is specified, a ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. \n Support: Core" maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string required: - name type: object maxItems: 64 type: array mode: default: Terminate description: "Mode defines the TLS behavior for the TLS session initiated by the client. There are two possible modes: \n - Terminate: The TLS session between the downstream client and the Gateway is terminated at the Gateway. This mode requires certificateRefs to be set and contain at least one element. - Passthrough: The TLS session is NOT terminated by the Gateway. This implies that the Gateway can't decipher the TLS stream except for the ClientHello message of the TLS protocol. CertificateRefs field is ignored in this mode. \n Support: Core" enum: - Terminate - Passthrough type: string options: additionalProperties: description: AnnotationValue is the value of an annotation in Gateway API. This is used for validation of maps such as TLS options. This roughly matches Kubernetes annotation validation, although the length validation in that case is based on the entire size of the annotations struct. maxLength: 4096 minLength: 0 type: string description: "Options are a list of key/value pairs to enable extended TLS configuration for each implementation. For example, configuring the minimum TLS version or supported cipher suites. \n A set of common keys MAY be defined by the API in the future. To avoid any ambiguity, implementation-specific definitions MUST use domain-prefixed names, such as `example.com/my-custom-option`. Un-prefixed names are reserved for key names defined by Gateway API. \n Support: Implementation-specific" maxProperties: 16 type: object type: object required: - name - port - protocol type: object maxItems: 64 minItems: 1 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map required: - gatewayClassName - listeners type: object status: default: conditions: - lastTransitionTime: "1970-01-01T00:00:00Z" message: Waiting for controller reason: NotReconciled status: Unknown type: Accepted description: Status defines the current state of Gateway. properties: addresses: description: Addresses lists the IP addresses that have actually been bound to the Gateway. These addresses may differ from the addresses in the Spec, e.g. if the Gateway automatically assigns an address from a reserved pool. items: description: GatewayAddress describes an address that can be bound to a Gateway. properties: type: default: IPAddress description: Type of the address. maxLength: 253 minLength: 1 pattern: ^Hostname|IPAddress|NamedAddress|[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ type: string value: description: "Value of the address. The validity of the values will depend on the type and support by the controller. \n Examples: `1.2.3.4`, `128::1`, `my-ip-address`." maxLength: 253 minLength: 1 type: string required: - value type: object maxItems: 16 type: array conditions: default: - lastTransitionTime: "1970-01-01T00:00:00Z" message: Waiting for controller reason: Pending status: Unknown type: Accepted - lastTransitionTime: "1970-01-01T00:00:00Z" message: Waiting for controller reason: Pending status: Unknown type: Programmed description: "Conditions describe the current conditions of the Gateway. \n Implementations should prefer to express Gateway conditions using the `GatewayConditionType` and `GatewayConditionReason` constants so that operators and tools can converge on a common vocabulary to describe Gateway state. \n Known condition types are: \n * \"Accepted\" * \"Ready\"" items: description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, \n \ttype FooStatus struct{ \t // Represents the observations of a foo's current state. \t // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" \t // +patchMergeKey=type \t // +patchStrategy=merge \t // +listType=map \t // +listMapKey=type \t Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n \t // other fields \t}" properties: lastTransitionTime: description: lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object maxItems: 8 type: array x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map listeners: description: Listeners provide status for each unique listener port defined in the Spec. items: description: ListenerStatus is the status associated with a Listener. properties: attachedRoutes: description: AttachedRoutes represents the total number of Routes that have been successfully attached to this Listener. format: int32 type: integer conditions: description: Conditions describe the current condition of this listener. items: description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, \n \ttype FooStatus struct{ \t // Represents the observations of a foo's current state. \t // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" \t // +patchMergeKey=type \t // +patchStrategy=merge \t // +listType=map \t // +listMapKey=type \t Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n \t // other fields \t}" properties: lastTransitionTime: description: lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object maxItems: 8 type: array x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map name: description: Name is the name of the Listener that this status corresponds to. maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string supportedKinds: description: "SupportedKinds is the list indicating the Kinds supported by this listener. This MUST represent the kinds an implementation supports for that Listener configuration. \n If kinds are specified in Spec that are not supported, they MUST NOT appear in this list and an implementation MUST set the \"ResolvedRefs\" condition to \"False\" with the \"InvalidRouteKinds\" reason. If both valid and invalid Route kinds are specified, the implementation MUST reference the valid Route kinds that have been specified." items: description: RouteGroupKind indicates the group and kind of a Route resource. properties: group: default: gateway.networking.k8s.io description: Group is the group of the Route. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: description: Kind is the kind of the Route. maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string required: - kind type: object maxItems: 8 type: array required: - attachedRoutes - conditions - name - supportedKinds type: object maxItems: 64 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map type: object required: - spec type: object served: true storage: true subresources: status: {} status: acceptedNames: kind: "" plural: "" conditions: [] storedVersions: [] --- # Source: consul/templates/crd-httproutes-external.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/1538 gateway.networking.k8s.io/bundle-version: v0.6.2 gateway.networking.k8s.io/channel: experimental creationTimestamp: null labels: # app: consul # chart: consul-helm # heritage: Helm # release: consul name: consul-v1-httproutes component: crd name: httproutes.gateway.networking.k8s.io spec: group: gateway.networking.k8s.io names: categories: - gateway-api kind: HTTPRoute listKind: HTTPRouteList plural: httproutes singular: httproute shortNames: - httproutes scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .spec.hostnames name: Hostnames type: string - jsonPath: .metadata.creationTimestamp name: Age type: date name: v1 schema: openAPIV3Schema: description: HTTPRoute provides a way to route HTTP requests. This includes the capability to match requests by hostname, path, header, or query param. Filters can be used to specify additional processing steps. Backends specify where matching requests should be routed. properties: apiVersion: description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' type: string kind: description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' type: string metadata: type: object spec: description: Spec defines the desired state of HTTPRoute. properties: hostnames: description: "Hostnames defines a set of hostname that should match against the HTTP Host header to select a HTTPRoute to process the request. This matches the RFC 1123 definition of a hostname with 2 notable exceptions: \n 1. IPs are not allowed. 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard label must appear by itself as the first label. \n If a hostname is specified by both the Listener and HTTPRoute, there must be at least one intersecting hostname for the HTTPRoute to be attached to the Listener. For example: \n * A Listener with `test.example.com` as the hostname matches HTTPRoutes that have either not specified any hostnames, or have specified at least one of `test.example.com` or `*.example.com`. * A Listener with `*.example.com` as the hostname matches HTTPRoutes that have either not specified any hostnames or have specified at least one hostname that matches the Listener hostname. For example, `*.example.com`, `test.example.com`, and `foo.test.example.com` would all match. On the other hand, `example.com` and `test.example.net` would not match. \n Hostnames that are prefixed with a wildcard label (`*.`) are interpreted as a suffix match. That means that a match for `*.example.com` would match both `test.example.com`, and `foo.test.example.com`, but not `example.com`. \n If both the Listener and HTTPRoute have specified hostnames, any HTTPRoute hostnames that do not match the Listener hostname MUST be ignored. For example, if a Listener specified `*.example.com`, and the HTTPRoute specified `test.example.com` and `test.example.net`, `test.example.net` must not be considered for a match. \n If both the Listener and HTTPRoute have specified hostnames, and none match with the criteria above, then the HTTPRoute is not accepted. The implementation must raise an 'Accepted' Condition with a status of `False` in the corresponding RouteParentStatus. \n In the event that multiple HTTPRoutes specify intersecting hostnames (e.g. overlapping wildcard matching and exact matching hostnames), precedence must be given to rules from the HTTPRoute with the largest number of: \n * Characters in a matching non-wildcard hostname. * Characters in a matching hostname. \n If ties exist across multiple Routes, the matching precedence rules for HTTPRouteMatches takes over. \n Support: Core" items: description: "Hostname is the fully qualified domain name of a network host. This matches the RFC 1123 definition of a hostname with 2 notable exceptions: \n 1. IPs are not allowed. 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard label must appear by itself as the first label. \n Hostname can be \"precise\" which is a domain name without the terminating dot of a network host (e.g. \"foo.example.com\") or \"wildcard\", which is a domain name prefixed with a single wildcard label (e.g. `*.example.com`). \n Note that as per RFC1035 and RFC1123, a *label* must consist of lower case alphanumeric characters or '-', and must start and end with an alphanumeric character. No other punctuation is allowed." maxLength: 253 minLength: 1 pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string maxItems: 16 type: array parentRefs: description: "ParentRefs references the resources (usually Gateways) that a Route wants to be attached to. Note that the referenced parent resource needs to allow this for the attachment to be complete. For Gateways, that means the Gateway needs to allow attachment from Routes of this kind and namespace. \n The only kind of parent resource with \"Core\" support is Gateway. This API may be extended in the future to support additional kinds of parent resources such as one of the route kinds. \n It is invalid to reference an identical parent more than once. It is valid to reference multiple distinct sections within the same parent resource, such as 2 Listeners within a Gateway. \n It is possible to separately reference multiple distinct objects that may be collapsed by an implementation. For example, some implementations may choose to merge compatible Gateway Listeners together. If that is the case, the list of routes attached to those resources should also be merged. \n Note that for ParentRefs that cross namespace boundaries, there are specific rules. Cross-namespace references are only valid if they are explicitly allowed by something in the namespace they are referring to. For example, Gateway has the AllowedRoutes field, and ReferenceGrant provides a generic way to enable any other kind of cross-namespace reference." items: description: "ParentReference identifies an API object (usually a Gateway) that can be considered a parent of this resource (usually a route). The only kind of parent resource with \"Core\" support is Gateway. This API may be extended in the future to support additional kinds of parent resources, such as HTTPRoute. \n The API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid." properties: group: default: gateway.networking.k8s.io description: "Group is the group of the referent. When unspecified, \"gateway.networking.k8s.io\" is inferred. To set the core API group (such as for a \"Service\" kind referent), Group must be explicitly set to \"\" (empty string). \n Support: Core" maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: default: Gateway description: "Kind is kind of the referent. \n Support: Core (Gateway) \n Support: Implementation-specific (Other Resources)" maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: "Name is the name of the referent. \n Support: Core" maxLength: 253 minLength: 1 type: string namespace: description: "Namespace is the namespace of the referent. When unspecified, this refers to the local namespace of the Route. \n Note that there are specific rules for ParentRefs which cross namespace boundaries. Cross-namespace references are only valid if they are explicitly allowed by something in the namespace they are referring to. For example: Gateway has the AllowedRoutes field, and ReferenceGrant provides a generic way to enable any other kind of cross-namespace reference. \n Support: Core" maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string port: description: "Port is the network port this Route targets. It can be interpreted differently based on the type of parent resource. \n When the parent resource is a Gateway, this targets all listeners listening on the specified port that also support this kind of Route(and select this Route). It's not recommended to set `Port` unless the networking behaviors specified in a Route must apply to a specific port as opposed to a listener(s) whose port(s) may be changed. When both Port and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support other parent resources. Implementations supporting other types of parent resources MUST clearly document how/if Port is interpreted. \n For the purpose of status, an attachment is considered successful as long as the parent resource accepts it partially. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Extended \n " format: int32 maximum: 65535 minimum: 1 type: integer sectionName: description: "SectionName is the name of a section within the target resource. In the following resources, SectionName is interpreted as the following: \n * Gateway: Listener Name. When both Port (experimental) and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support attaching Routes to other resources. If that is the case, they MUST clearly document how SectionName is interpreted. \n When unspecified (empty string), this will reference the entire resource. For the purpose of status, an attachment is considered successful if at least one section in the parent resource accepts it. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Core" maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string required: - name type: object maxItems: 32 type: array rules: default: - matches: - path: type: PathPrefix value: / description: Rules are a list of HTTP matchers, filters and actions. items: description: HTTPRouteRule defines semantics for matching an HTTP request based on conditions (matches), processing it (filters), and forwarding the request to an API object (backendRefs). properties: backendRefs: description: "BackendRefs defines the backend(s) where matching requests should be sent. \n Failure behavior here depends on how many BackendRefs are specified and how many are invalid. \n If *all* entries in BackendRefs are invalid, and there are also no filters specified in this route rule, *all* traffic which matches this rule MUST receive a 500 status code. \n See the HTTPBackendRef definition for the rules about what makes a single HTTPBackendRef invalid. \n When a HTTPBackendRef is invalid, 500 status codes MUST be returned for requests that would have otherwise been routed to an invalid backend. If multiple backends are specified, and some are invalid, the proportion of requests that would otherwise have been routed to an invalid backend MUST receive a 500 status code. \n For example, if two backends are specified with equal weights, and one is invalid, 50 percent of traffic must receive a 500. Implementations may choose how that 50 percent is determined. \n Support: Core for Kubernetes Service \n Support: Implementation-specific for any other resource \n Support for weight: Core" items: description: HTTPBackendRef defines how a HTTPRoute should forward an HTTP request. properties: filters: description: "Filters defined at this level should be executed if and only if the request is being forwarded to the backend defined here. \n Support: Implementation-specific (For broader support of filters, use the Filters field in HTTPRouteRule.)" items: description: HTTPRouteFilter defines processing steps that must be completed during the request or response lifecycle. HTTPRouteFilters are meant as an extension point to express processing that may be done in Gateway implementations. Some examples include request or response modification, implementing authentication strategies, rate-limiting, and traffic shaping. API guarantee/conformance is defined based on the type of the filter. properties: extensionRef: description: "ExtensionRef is an optional, implementation-specific extension to the \"filter\" behavior. For example, resource \"myroutefilter\" in group \"networking.example.net\"). ExtensionRef MUST NOT be used for core and extended filters. \n Support: Implementation-specific" properties: group: description: Group is the group of the referent. For example, "gateway.networking.k8s.io". When unspecified or empty string, core API group is inferred. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: description: Kind is kind of the referent. For example "HTTPRoute" or "Service". maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: Name is the name of the referent. maxLength: 253 minLength: 1 type: string required: - group - kind - name type: object requestHeaderModifier: description: "RequestHeaderModifier defines a schema for a filter that modifies request headers. \n Support: Core" properties: add: description: "Add adds the given header(s) (name, value) to the request before the action. It appends to any existing values associated with the header name. \n Input: GET /foo HTTP/1.1 my-header: foo \n Config: add: - name: \"my-header\" value: \"bar,baz\" \n Output: GET /foo HTTP/1.1 my-header: foo,bar,baz" items: description: HTTPHeader represents an HTTP Header name and value as defined by RFC 7230. properties: name: description: "Name is the name of the HTTP Header to be matched. Name matching MUST be case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). \n If multiple entries specify equivalent header names, the first entry with an equivalent name MUST be considered for a match. Subsequent entries with an equivalent header name MUST be ignored. Due to the case-insensitivity of header names, \"foo\" and \"Foo\" are considered equivalent." maxLength: 256 minLength: 1 pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ type: string value: description: Value is the value of HTTP Header to be matched. maxLength: 4096 minLength: 1 type: string required: - name - value type: object maxItems: 16 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map remove: description: "Remove the given header(s) from the HTTP request before the action. The value of Remove is a list of HTTP header names. Note that the header names are case-insensitive (see https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). \n Input: GET /foo HTTP/1.1 my-header1: foo my-header2: bar my-header3: baz \n Config: remove: [\"my-header1\", \"my-header3\"] \n Output: GET /foo HTTP/1.1 my-header2: bar" items: type: string maxItems: 16 type: array set: description: "Set overwrites the request with the given header (name, value) before the action. \n Input: GET /foo HTTP/1.1 my-header: foo \n Config: set: - name: \"my-header\" value: \"bar\" \n Output: GET /foo HTTP/1.1 my-header: bar" items: description: HTTPHeader represents an HTTP Header name and value as defined by RFC 7230. properties: name: description: "Name is the name of the HTTP Header to be matched. Name matching MUST be case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). \n If multiple entries specify equivalent header names, the first entry with an equivalent name MUST be considered for a match. Subsequent entries with an equivalent header name MUST be ignored. Due to the case-insensitivity of header names, \"foo\" and \"Foo\" are considered equivalent." maxLength: 256 minLength: 1 pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ type: string value: description: Value is the value of HTTP Header to be matched. maxLength: 4096 minLength: 1 type: string required: - name - value type: object maxItems: 16 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map type: object requestMirror: description: "RequestMirror defines a schema for a filter that mirrors requests. Requests are sent to the specified destination, but responses from that destination are ignored. \n Support: Extended" properties: backendRef: description: "BackendRef references a resource where mirrored requests are sent. \n If the referent cannot be found, this BackendRef is invalid and must be dropped from the Gateway. The controller must ensure the \"ResolvedRefs\" condition on the Route status is set to `status: False` and not configure this backend in the underlying implementation. \n If there is a cross-namespace reference to an *existing* object that is not allowed by a ReferenceGrant, the controller must ensure the \"ResolvedRefs\" condition on the Route is set to `status: False`, with the \"RefNotPermitted\" reason and not configure this backend in the underlying implementation. \n In either error case, the Message of the `ResolvedRefs` Condition should be used to provide more detail about the problem. \n Support: Extended for Kubernetes Service \n Support: Implementation-specific for any other resource" properties: group: default: "" description: Group is the group of the referent. For example, "gateway.networking.k8s.io". When unspecified or empty string, core API group is inferred. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: default: Service description: Kind is kind of the referent. For example "HTTPRoute" or "Service". Defaults to "Service" when not specified. maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: Name is the name of the referent. maxLength: 253 minLength: 1 type: string namespace: description: "Namespace is the namespace of the backend. When unspecified, the local namespace is inferred. \n Note that when a namespace is specified, a ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. \n Support: Core" maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string port: description: Port specifies the destination port number to use for this resource. Port is required when the referent is a Kubernetes Service. In this case, the port number is the service port number, not the target port. For other resources, destination port might be derived from the referent resource or this field. format: int32 maximum: 65535 minimum: 1 type: integer required: - name type: object required: - backendRef type: object requestRedirect: description: "RequestRedirect defines a schema for a filter that responds to the request with an HTTP redirection. \n Support: Core" properties: hostname: description: "Hostname is the hostname to be used in the value of the `Location` header in the response. When empty, the hostname of the request is used. \n Support: Core" maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string path: description: "Path defines parameters used to modify the path of the incoming request. The modified path is then used to construct the `Location` header. When empty, the request path is used as-is. \n Support: Extended \n " properties: replaceFullPath: description: "ReplaceFullPath specifies the value with which to replace the full path of a request during a rewrite or redirect. \n " maxLength: 1024 type: string replacePrefixMatch: description: "ReplacePrefixMatch specifies the value with which to replace the prefix match of a request during a rewrite or redirect. For example, a request to \"/foo/bar\" with a prefix match of \"/foo\" would be modified to \"/bar\". \n Note that this matches the behavior of the PathPrefix match type. This matches full path elements. A path element refers to the list of labels in the path split by the `/` separator. When specified, a trailing `/` is ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all match the prefix `/abc`, but the path `/abcd` would not. \n " maxLength: 1024 type: string type: description: "Type defines the type of path modifier. Additional types may be added in a future release of the API. \n Note that values may be added to this enum, implementations must ensure that unknown values will not cause a crash. \n Unknown values here must result in the implementation setting the Accepted Condition for the Route to `status: False`, with a Reason of `UnsupportedValue`. \n " enum: - ReplaceFullPath - ReplacePrefixMatch type: string required: - type type: object port: description: "Port is the port to be used in the value of the `Location` header in the response. When empty, port (if specified) of the request is used. \n Support: Extended" format: int32 maximum: 65535 minimum: 1 type: integer scheme: description: "Scheme is the scheme to be used in the value of the `Location` header in the response. When empty, the scheme of the request is used. \n Note that values may be added to this enum, implementations must ensure that unknown values will not cause a crash. \n Unknown values here must result in the implementation setting the Accepted Condition for the Route to `status: False`, with a Reason of `UnsupportedValue`. \n Support: Extended" enum: - http - https type: string statusCode: default: 302 description: "StatusCode is the HTTP status code to be used in response. \n Note that values may be added to this enum, implementations must ensure that unknown values will not cause a crash. \n Unknown values here must result in the implementation setting the Accepted Condition for the Route to `status: False`, with a Reason of `UnsupportedValue`. \n Support: Core" enum: - 301 - 302 type: integer type: object responseHeaderModifier: description: "ResponseHeaderModifier defines a schema for a filter that modifies response headers. \n Support: Extended \n " properties: add: description: "Add adds the given header(s) (name, value) to the request before the action. It appends to any existing values associated with the header name. \n Input: GET /foo HTTP/1.1 my-header: foo \n Config: add: - name: \"my-header\" value: \"bar,baz\" \n Output: GET /foo HTTP/1.1 my-header: foo,bar,baz" items: description: HTTPHeader represents an HTTP Header name and value as defined by RFC 7230. properties: name: description: "Name is the name of the HTTP Header to be matched. Name matching MUST be case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). \n If multiple entries specify equivalent header names, the first entry with an equivalent name MUST be considered for a match. Subsequent entries with an equivalent header name MUST be ignored. Due to the case-insensitivity of header names, \"foo\" and \"Foo\" are considered equivalent." maxLength: 256 minLength: 1 pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ type: string value: description: Value is the value of HTTP Header to be matched. maxLength: 4096 minLength: 1 type: string required: - name - value type: object maxItems: 16 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map remove: description: "Remove the given header(s) from the HTTP request before the action. The value of Remove is a list of HTTP header names. Note that the header names are case-insensitive (see https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). \n Input: GET /foo HTTP/1.1 my-header1: foo my-header2: bar my-header3: baz \n Config: remove: [\"my-header1\", \"my-header3\"] \n Output: GET /foo HTTP/1.1 my-header2: bar" items: type: string maxItems: 16 type: array set: description: "Set overwrites the request with the given header (name, value) before the action. \n Input: GET /foo HTTP/1.1 my-header: foo \n Config: set: - name: \"my-header\" value: \"bar\" \n Output: GET /foo HTTP/1.1 my-header: bar" items: description: HTTPHeader represents an HTTP Header name and value as defined by RFC 7230. properties: name: description: "Name is the name of the HTTP Header to be matched. Name matching MUST be case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). \n If multiple entries specify equivalent header names, the first entry with an equivalent name MUST be considered for a match. Subsequent entries with an equivalent header name MUST be ignored. Due to the case-insensitivity of header names, \"foo\" and \"Foo\" are considered equivalent." maxLength: 256 minLength: 1 pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ type: string value: description: Value is the value of HTTP Header to be matched. maxLength: 4096 minLength: 1 type: string required: - name - value type: object maxItems: 16 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map type: object type: description: "Type identifies the type of filter to apply. As with other API fields, types are classified into three conformance levels: \n - Core: Filter types and their corresponding configuration defined by \"Support: Core\" in this package, e.g. \"RequestHeaderModifier\". All implementations must support core filters. \n - Extended: Filter types and their corresponding configuration defined by \"Support: Extended\" in this package, e.g. \"RequestMirror\". Implementers are encouraged to support extended filters. \n - Implementation-specific: Filters that are defined and supported by specific vendors. In the future, filters showing convergence in behavior across multiple implementations will be considered for inclusion in extended or core conformance levels. Filter-specific configuration for such filters is specified using the ExtensionRef field. `Type` should be set to \"ExtensionRef\" for custom filters. \n Implementers are encouraged to define custom implementation types to extend the core API with implementation-specific behavior. \n If a reference to a custom filter type cannot be resolved, the filter MUST NOT be skipped. Instead, requests that would have been processed by that filter MUST receive a HTTP error response. \n Note that values may be added to this enum, implementations must ensure that unknown values will not cause a crash. \n Unknown values here must result in the implementation setting the Accepted Condition for the Route to `status: False`, with a Reason of `UnsupportedValue`. \n " enum: - RequestHeaderModifier - ResponseHeaderModifier - RequestMirror - RequestRedirect - URLRewrite - ExtensionRef type: string urlRewrite: description: "URLRewrite defines a schema for a filter that modifies a request during forwarding. \n Support: Extended \n " properties: hostname: description: "Hostname is the value to be used to replace the Host header value during forwarding. \n Support: Extended \n " maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string path: description: "Path defines a path rewrite. \n Support: Extended \n " properties: replaceFullPath: description: "ReplaceFullPath specifies the value with which to replace the full path of a request during a rewrite or redirect. \n " maxLength: 1024 type: string replacePrefixMatch: description: "ReplacePrefixMatch specifies the value with which to replace the prefix match of a request during a rewrite or redirect. For example, a request to \"/foo/bar\" with a prefix match of \"/foo\" would be modified to \"/bar\". \n Note that this matches the behavior of the PathPrefix match type. This matches full path elements. A path element refers to the list of labels in the path split by the `/` separator. When specified, a trailing `/` is ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all match the prefix `/abc`, but the path `/abcd` would not. \n " maxLength: 1024 type: string type: description: "Type defines the type of path modifier. Additional types may be added in a future release of the API. \n Note that values may be added to this enum, implementations must ensure that unknown values will not cause a crash. \n Unknown values here must result in the implementation setting the Accepted Condition for the Route to `status: False`, with a Reason of `UnsupportedValue`. \n " enum: - ReplaceFullPath - ReplacePrefixMatch type: string required: - type type: object type: object required: - type type: object maxItems: 16 type: array group: default: "" description: Group is the group of the referent. For example, "gateway.networking.k8s.io". When unspecified or empty string, core API group is inferred. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: default: Service description: Kind is kind of the referent. For example "HTTPRoute" or "Service". Defaults to "Service" when not specified. maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: Name is the name of the referent. maxLength: 253 minLength: 1 type: string namespace: description: "Namespace is the namespace of the backend. When unspecified, the local namespace is inferred. \n Note that when a namespace is specified, a ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. \n Support: Core" maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string port: description: Port specifies the destination port number to use for this resource. Port is required when the referent is a Kubernetes Service. In this case, the port number is the service port number, not the target port. For other resources, destination port might be derived from the referent resource or this field. format: int32 maximum: 65535 minimum: 1 type: integer weight: default: 1 description: "Weight specifies the proportion of requests forwarded to the referenced backend. This is computed as weight/(sum of all weights in this BackendRefs list). For non-zero values, there may be some epsilon from the exact proportion defined here depending on the precision an implementation supports. Weight is not a percentage and the sum of weights does not need to equal 100. \n If only one backend is specified and it has a weight greater than 0, 100% of the traffic is forwarded to that backend. If weight is set to 0, no traffic should be forwarded for this entry. If unspecified, weight defaults to 1. \n Support for this field varies based on the context where used." format: int32 maximum: 1000000 minimum: 0 type: integer required: - name type: object maxItems: 16 type: array filters: description: "Filters define the filters that are applied to requests that match this rule. \n The effects of ordering of multiple behaviors are currently unspecified. This can change in the future based on feedback during the alpha stage. \n Conformance-levels at this level are defined based on the type of filter: \n - ALL core filters MUST be supported by all implementations. - Implementers are encouraged to support extended filters. - Implementation-specific custom filters have no API guarantees across implementations. \n Specifying a core filter multiple times has unspecified or implementation-specific conformance. \n All filters are expected to be compatible with each other except for the URLRewrite and RequestRedirect filters, which may not be combined. If an implementation can not support other combinations of filters, they must clearly document that limitation. In all cases where incompatible or unsupported filters are specified, implementations MUST add a warning condition to status. \n Support: Core" items: description: HTTPRouteFilter defines processing steps that must be completed during the request or response lifecycle. HTTPRouteFilters are meant as an extension point to express processing that may be done in Gateway implementations. Some examples include request or response modification, implementing authentication strategies, rate-limiting, and traffic shaping. API guarantee/conformance is defined based on the type of the filter. properties: extensionRef: description: "ExtensionRef is an optional, implementation-specific extension to the \"filter\" behavior. For example, resource \"myroutefilter\" in group \"networking.example.net\"). ExtensionRef MUST NOT be used for core and extended filters. \n Support: Implementation-specific" properties: group: description: Group is the group of the referent. For example, "gateway.networking.k8s.io". When unspecified or empty string, core API group is inferred. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: description: Kind is kind of the referent. For example "HTTPRoute" or "Service". maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: Name is the name of the referent. maxLength: 253 minLength: 1 type: string required: - group - kind - name type: object requestHeaderModifier: description: "RequestHeaderModifier defines a schema for a filter that modifies request headers. \n Support: Core" properties: add: description: "Add adds the given header(s) (name, value) to the request before the action. It appends to any existing values associated with the header name. \n Input: GET /foo HTTP/1.1 my-header: foo \n Config: add: - name: \"my-header\" value: \"bar,baz\" \n Output: GET /foo HTTP/1.1 my-header: foo,bar,baz" items: description: HTTPHeader represents an HTTP Header name and value as defined by RFC 7230. properties: name: description: "Name is the name of the HTTP Header to be matched. Name matching MUST be case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). \n If multiple entries specify equivalent header names, the first entry with an equivalent name MUST be considered for a match. Subsequent entries with an equivalent header name MUST be ignored. Due to the case-insensitivity of header names, \"foo\" and \"Foo\" are considered equivalent." maxLength: 256 minLength: 1 pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ type: string value: description: Value is the value of HTTP Header to be matched. maxLength: 4096 minLength: 1 type: string required: - name - value type: object maxItems: 16 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map remove: description: "Remove the given header(s) from the HTTP request before the action. The value of Remove is a list of HTTP header names. Note that the header names are case-insensitive (see https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). \n Input: GET /foo HTTP/1.1 my-header1: foo my-header2: bar my-header3: baz \n Config: remove: [\"my-header1\", \"my-header3\"] \n Output: GET /foo HTTP/1.1 my-header2: bar" items: type: string maxItems: 16 type: array set: description: "Set overwrites the request with the given header (name, value) before the action. \n Input: GET /foo HTTP/1.1 my-header: foo \n Config: set: - name: \"my-header\" value: \"bar\" \n Output: GET /foo HTTP/1.1 my-header: bar" items: description: HTTPHeader represents an HTTP Header name and value as defined by RFC 7230. properties: name: description: "Name is the name of the HTTP Header to be matched. Name matching MUST be case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). \n If multiple entries specify equivalent header names, the first entry with an equivalent name MUST be considered for a match. Subsequent entries with an equivalent header name MUST be ignored. Due to the case-insensitivity of header names, \"foo\" and \"Foo\" are considered equivalent." maxLength: 256 minLength: 1 pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ type: string value: description: Value is the value of HTTP Header to be matched. maxLength: 4096 minLength: 1 type: string required: - name - value type: object maxItems: 16 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map type: object requestMirror: description: "RequestMirror defines a schema for a filter that mirrors requests. Requests are sent to the specified destination, but responses from that destination are ignored. \n Support: Extended" properties: backendRef: description: "BackendRef references a resource where mirrored requests are sent. \n If the referent cannot be found, this BackendRef is invalid and must be dropped from the Gateway. The controller must ensure the \"ResolvedRefs\" condition on the Route status is set to `status: False` and not configure this backend in the underlying implementation. \n If there is a cross-namespace reference to an *existing* object that is not allowed by a ReferenceGrant, the controller must ensure the \"ResolvedRefs\" condition on the Route is set to `status: False`, with the \"RefNotPermitted\" reason and not configure this backend in the underlying implementation. \n In either error case, the Message of the `ResolvedRefs` Condition should be used to provide more detail about the problem. \n Support: Extended for Kubernetes Service \n Support: Implementation-specific for any other resource" properties: group: default: "" description: Group is the group of the referent. For example, "gateway.networking.k8s.io". When unspecified or empty string, core API group is inferred. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: default: Service description: Kind is kind of the referent. For example "HTTPRoute" or "Service". Defaults to "Service" when not specified. maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: Name is the name of the referent. maxLength: 253 minLength: 1 type: string namespace: description: "Namespace is the namespace of the backend. When unspecified, the local namespace is inferred. \n Note that when a namespace is specified, a ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. \n Support: Core" maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string port: description: Port specifies the destination port number to use for this resource. Port is required when the referent is a Kubernetes Service. In this case, the port number is the service port number, not the target port. For other resources, destination port might be derived from the referent resource or this field. format: int32 maximum: 65535 minimum: 1 type: integer required: - name type: object required: - backendRef type: object requestRedirect: description: "RequestRedirect defines a schema for a filter that responds to the request with an HTTP redirection. \n Support: Core" properties: hostname: description: "Hostname is the hostname to be used in the value of the `Location` header in the response. When empty, the hostname of the request is used. \n Support: Core" maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string path: description: "Path defines parameters used to modify the path of the incoming request. The modified path is then used to construct the `Location` header. When empty, the request path is used as-is. \n Support: Extended \n " properties: replaceFullPath: description: "ReplaceFullPath specifies the value with which to replace the full path of a request during a rewrite or redirect. \n " maxLength: 1024 type: string replacePrefixMatch: description: "ReplacePrefixMatch specifies the value with which to replace the prefix match of a request during a rewrite or redirect. For example, a request to \"/foo/bar\" with a prefix match of \"/foo\" would be modified to \"/bar\". \n Note that this matches the behavior of the PathPrefix match type. This matches full path elements. A path element refers to the list of labels in the path split by the `/` separator. When specified, a trailing `/` is ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all match the prefix `/abc`, but the path `/abcd` would not. \n " maxLength: 1024 type: string type: description: "Type defines the type of path modifier. Additional types may be added in a future release of the API. \n Note that values may be added to this enum, implementations must ensure that unknown values will not cause a crash. \n Unknown values here must result in the implementation setting the Accepted Condition for the Route to `status: False`, with a Reason of `UnsupportedValue`. \n " enum: - ReplaceFullPath - ReplacePrefixMatch type: string required: - type type: object port: description: "Port is the port to be used in the value of the `Location` header in the response. When empty, port (if specified) of the request is used. \n Support: Extended" format: int32 maximum: 65535 minimum: 1 type: integer scheme: description: "Scheme is the scheme to be used in the value of the `Location` header in the response. When empty, the scheme of the request is used. \n Note that values may be added to this enum, implementations must ensure that unknown values will not cause a crash. \n Unknown values here must result in the implementation setting the Accepted Condition for the Route to `status: False`, with a Reason of `UnsupportedValue`. \n Support: Extended" enum: - http - https type: string statusCode: default: 302 description: "StatusCode is the HTTP status code to be used in response. \n Note that values may be added to this enum, implementations must ensure that unknown values will not cause a crash. \n Unknown values here must result in the implementation setting the Accepted Condition for the Route to `status: False`, with a Reason of `UnsupportedValue`. \n Support: Core" enum: - 301 - 302 type: integer type: object responseHeaderModifier: description: "ResponseHeaderModifier defines a schema for a filter that modifies response headers. \n Support: Extended \n " properties: add: description: "Add adds the given header(s) (name, value) to the request before the action. It appends to any existing values associated with the header name. \n Input: GET /foo HTTP/1.1 my-header: foo \n Config: add: - name: \"my-header\" value: \"bar,baz\" \n Output: GET /foo HTTP/1.1 my-header: foo,bar,baz" items: description: HTTPHeader represents an HTTP Header name and value as defined by RFC 7230. properties: name: description: "Name is the name of the HTTP Header to be matched. Name matching MUST be case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). \n If multiple entries specify equivalent header names, the first entry with an equivalent name MUST be considered for a match. Subsequent entries with an equivalent header name MUST be ignored. Due to the case-insensitivity of header names, \"foo\" and \"Foo\" are considered equivalent." maxLength: 256 minLength: 1 pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ type: string value: description: Value is the value of HTTP Header to be matched. maxLength: 4096 minLength: 1 type: string required: - name - value type: object maxItems: 16 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map remove: description: "Remove the given header(s) from the HTTP request before the action. The value of Remove is a list of HTTP header names. Note that the header names are case-insensitive (see https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). \n Input: GET /foo HTTP/1.1 my-header1: foo my-header2: bar my-header3: baz \n Config: remove: [\"my-header1\", \"my-header3\"] \n Output: GET /foo HTTP/1.1 my-header2: bar" items: type: string maxItems: 16 type: array set: description: "Set overwrites the request with the given header (name, value) before the action. \n Input: GET /foo HTTP/1.1 my-header: foo \n Config: set: - name: \"my-header\" value: \"bar\" \n Output: GET /foo HTTP/1.1 my-header: bar" items: description: HTTPHeader represents an HTTP Header name and value as defined by RFC 7230. properties: name: description: "Name is the name of the HTTP Header to be matched. Name matching MUST be case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). \n If multiple entries specify equivalent header names, the first entry with an equivalent name MUST be considered for a match. Subsequent entries with an equivalent header name MUST be ignored. Due to the case-insensitivity of header names, \"foo\" and \"Foo\" are considered equivalent." maxLength: 256 minLength: 1 pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ type: string value: description: Value is the value of HTTP Header to be matched. maxLength: 4096 minLength: 1 type: string required: - name - value type: object maxItems: 16 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map type: object type: description: "Type identifies the type of filter to apply. As with other API fields, types are classified into three conformance levels: \n - Core: Filter types and their corresponding configuration defined by \"Support: Core\" in this package, e.g. \"RequestHeaderModifier\". All implementations must support core filters. \n - Extended: Filter types and their corresponding configuration defined by \"Support: Extended\" in this package, e.g. \"RequestMirror\". Implementers are encouraged to support extended filters. \n - Implementation-specific: Filters that are defined and supported by specific vendors. In the future, filters showing convergence in behavior across multiple implementations will be considered for inclusion in extended or core conformance levels. Filter-specific configuration for such filters is specified using the ExtensionRef field. `Type` should be set to \"ExtensionRef\" for custom filters. \n Implementers are encouraged to define custom implementation types to extend the core API with implementation-specific behavior. \n If a reference to a custom filter type cannot be resolved, the filter MUST NOT be skipped. Instead, requests that would have been processed by that filter MUST receive a HTTP error response. \n Note that values may be added to this enum, implementations must ensure that unknown values will not cause a crash. \n Unknown values here must result in the implementation setting the Accepted Condition for the Route to `status: False`, with a Reason of `UnsupportedValue`. \n " enum: - RequestHeaderModifier - ResponseHeaderModifier - RequestMirror - RequestRedirect - URLRewrite - ExtensionRef type: string urlRewrite: description: "URLRewrite defines a schema for a filter that modifies a request during forwarding. \n Support: Extended \n " properties: hostname: description: "Hostname is the value to be used to replace the Host header value during forwarding. \n Support: Extended \n " maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string path: description: "Path defines a path rewrite. \n Support: Extended \n " properties: replaceFullPath: description: "ReplaceFullPath specifies the value with which to replace the full path of a request during a rewrite or redirect. \n " maxLength: 1024 type: string replacePrefixMatch: description: "ReplacePrefixMatch specifies the value with which to replace the prefix match of a request during a rewrite or redirect. For example, a request to \"/foo/bar\" with a prefix match of \"/foo\" would be modified to \"/bar\". \n Note that this matches the behavior of the PathPrefix match type. This matches full path elements. A path element refers to the list of labels in the path split by the `/` separator. When specified, a trailing `/` is ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all match the prefix `/abc`, but the path `/abcd` would not. \n " maxLength: 1024 type: string type: description: "Type defines the type of path modifier. Additional types may be added in a future release of the API. \n Note that values may be added to this enum, implementations must ensure that unknown values will not cause a crash. \n Unknown values here must result in the implementation setting the Accepted Condition for the Route to `status: False`, with a Reason of `UnsupportedValue`. \n " enum: - ReplaceFullPath - ReplacePrefixMatch type: string required: - type type: object type: object required: - type type: object maxItems: 16 type: array matches: default: - path: type: PathPrefix value: / description: "Matches define conditions used for matching the rule against incoming HTTP requests. Each match is independent, i.e. this rule will be matched if **any** one of the matches is satisfied. \n For example, take the following matches configuration: \n ``` matches: - path: value: \"/foo\" headers: - name: \"version\" value: \"v2\" - path: value: \"/v2/foo\" ``` \n For a request to match against this rule, a request must satisfy EITHER of the two conditions: \n - path prefixed with `/foo` AND contains the header `version: v2` - path prefix of `/v2/foo` \n See the documentation for HTTPRouteMatch on how to specify multiple match conditions that should be ANDed together. \n If no matches are specified, the default is a prefix path match on \"/\", which has the effect of matching every HTTP request. \n Proxy or Load Balancer routing configuration generated from HTTPRoutes MUST prioritize matches based on the following criteria, continuing on ties. Across all rules specified on applicable Routes, precedence must be given to the match with the largest number of: \n * Characters in a matching path. * Header matches. * Query param matches. \n If ties still exist across multiple Routes, matching precedence MUST be determined in order of the following criteria, continuing on ties: \n * The oldest Route based on creation timestamp. * The Route appearing first in alphabetical order by \"{namespace}/{name}\". \n If ties still exist within an HTTPRoute, matching precedence MUST be granted to the FIRST matching rule (in list order) with a match meeting the above criteria. \n When no rules matching a request have been successfully attached to the parent a request is coming from, a HTTP 404 status code MUST be returned." items: description: "HTTPRouteMatch defines the predicate used to match requests to a given action. Multiple match types are ANDed together, i.e. the match will evaluate to true only if all conditions are satisfied. \n For example, the match below will match a HTTP request only if its path starts with `/foo` AND it contains the `version: v1` header: \n ``` match: \n \tpath: \t value: \"/foo\" \theaders: \t- name: \"version\" \t value \"v1\" \n ```" properties: headers: description: Headers specifies HTTP request header matchers. Multiple match values are ANDed together, meaning, a request must match all the specified headers to select the route. items: description: HTTPHeaderMatch describes how to select a HTTP route by matching HTTP request headers. properties: name: description: "Name is the name of the HTTP Header to be matched. Name matching MUST be case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). \n If multiple entries specify equivalent header names, only the first entry with an equivalent name MUST be considered for a match. Subsequent entries with an equivalent header name MUST be ignored. Due to the case-insensitivity of header names, \"foo\" and \"Foo\" are considered equivalent. \n When a header is repeated in an HTTP request, it is implementation-specific behavior as to how this is represented. Generally, proxies should follow the guidance from the RFC: https://www.rfc-editor.org/rfc/rfc7230.html#section-3.2.2 regarding processing a repeated header, with special handling for \"Set-Cookie\"." maxLength: 256 minLength: 1 pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ type: string type: default: Exact description: "Type specifies how to match against the value of the header. \n Support: Core (Exact) \n Support: Implementation-specific (RegularExpression) \n Since RegularExpression HeaderMatchType has implementation-specific conformance, implementations can support POSIX, PCRE or any other dialects of regular expressions. Please read the implementation's documentation to determine the supported dialect." enum: - Exact - RegularExpression type: string value: description: Value is the value of HTTP Header to be matched. maxLength: 4096 minLength: 1 type: string required: - name - value type: object maxItems: 16 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map method: description: "Method specifies HTTP method matcher. When specified, this route will be matched only if the request has the specified method. \n Support: Extended" enum: - GET - HEAD - POST - PUT - DELETE - CONNECT - OPTIONS - TRACE - PATCH type: string path: default: type: PathPrefix value: / description: Path specifies a HTTP request path matcher. If this field is not specified, a default prefix match on the "/" path is provided. properties: type: default: PathPrefix description: "Type specifies how to match against the path Value. \n Support: Core (Exact, PathPrefix) \n Support: Implementation-specific (RegularExpression)" enum: - Exact - PathPrefix - RegularExpression type: string value: default: / description: Value of the HTTP path to match against. maxLength: 1024 type: string type: object queryParams: description: "QueryParams specifies HTTP query parameter matchers. Multiple match values are ANDed together, meaning, a request must match all the specified query parameters to select the route. \n Support: Extended" items: description: HTTPQueryParamMatch describes how to select a HTTP route by matching HTTP query parameters. properties: name: description: "Name is the name of the HTTP query param to be matched. This must be an exact string match. (See https://tools.ietf.org/html/rfc7230#section-2.7.3). \n If multiple entries specify equivalent query param names, only the first entry with an equivalent name MUST be considered for a match. Subsequent entries with an equivalent query param name MUST be ignored. \n If a query param is repeated in an HTTP request, the behavior is purposely left undefined, since different data planes have different capabilities. However, it is *recommended* that implementations should match against the first value of the param if the data plane supports it, as this behavior is expected in other load balancing contexts outside of the Gateway API. \n Users SHOULD NOT route traffic based on repeated query params to guard themselves against potential differences in the implementations." maxLength: 256 minLength: 1 type: string type: default: Exact description: "Type specifies how to match against the value of the query parameter. \n Support: Extended (Exact) \n Support: Implementation-specific (RegularExpression) \n Since RegularExpression QueryParamMatchType has Implementation-specific conformance, implementations can support POSIX, PCRE or any other dialects of regular expressions. Please read the implementation's documentation to determine the supported dialect." enum: - Exact - RegularExpression type: string value: description: Value is the value of HTTP query param to be matched. maxLength: 1024 minLength: 1 type: string required: - name - value type: object maxItems: 16 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map type: object maxItems: 8 type: array type: object maxItems: 16 type: array type: object status: description: Status defines the current state of HTTPRoute. properties: parents: description: "Parents is a list of parent resources (usually Gateways) that are associated with the route, and the status of the route with respect to each parent. When this route attaches to a parent, the controller that manages the parent must add an entry to this list when the controller first sees the route and should update the entry as appropriate when the route or gateway is modified. \n Note that parent references that cannot be resolved by an implementation of this API will not be added to this list. Implementations of this API can only populate Route status for the Gateways/parent resources they are responsible for. \n A maximum of 32 Gateways will be represented in this list. An empty list means the route has not been attached to any Gateway." items: description: RouteParentStatus describes the status of a route with respect to an associated Parent. properties: conditions: description: "Conditions describes the status of the route with respect to the Gateway. Note that the route's availability is also subject to the Gateway's own status conditions and listener status. \n If the Route's ParentRef specifies an existing Gateway that supports Routes of this kind AND that Gateway's controller has sufficient access, then that Gateway's controller MUST set the \"Accepted\" condition on the Route, to indicate whether the route has been accepted or rejected by the Gateway, and why. \n A Route MUST be considered \"Accepted\" if at least one of the Route's rules is implemented by the Gateway. \n There are a number of cases where the \"Accepted\" condition may not be set due to lack of controller visibility, that includes when: \n * The Route refers to a non-existent parent. * The Route is of a type that the controller does not support. * The Route is in a namespace the controller does not have access to." items: description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, \n \ttype FooStatus struct{ \t // Represents the observations of a foo's current state. \t // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" \t // +patchMergeKey=type \t // +patchStrategy=merge \t // +listType=map \t // +listMapKey=type \t Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n \t // other fields \t}" properties: lastTransitionTime: description: lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object maxItems: 8 minItems: 1 type: array x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map controllerName: description: "ControllerName is a domain/path string that indicates the name of the controller that wrote this status. This corresponds with the controllerName field on GatewayClass. \n Example: \"example.net/gateway-controller\". \n The format of this field is DOMAIN \"/\" PATH, where DOMAIN and PATH are valid Kubernetes names (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names). \n Controllers MUST populate this field when writing status. Controllers should ensure that entries to status populated with their ControllerName are cleaned up when they are no longer necessary." maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ type: string parentRef: description: ParentRef corresponds with a ParentRef in the spec that this RouteParentStatus struct describes the status of. properties: group: default: gateway.networking.k8s.io description: "Group is the group of the referent. When unspecified, \"gateway.networking.k8s.io\" is inferred. To set the core API group (such as for a \"Service\" kind referent), Group must be explicitly set to \"\" (empty string). \n Support: Core" maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: default: Gateway description: "Kind is kind of the referent. \n Support: Core (Gateway) \n Support: Implementation-specific (Other Resources)" maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: "Name is the name of the referent. \n Support: Core" maxLength: 253 minLength: 1 type: string namespace: description: "Namespace is the namespace of the referent. When unspecified, this refers to the local namespace of the Route. \n Note that there are specific rules for ParentRefs which cross namespace boundaries. Cross-namespace references are only valid if they are explicitly allowed by something in the namespace they are referring to. For example: Gateway has the AllowedRoutes field, and ReferenceGrant provides a generic way to enable any other kind of cross-namespace reference. \n Support: Core" maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string port: description: "Port is the network port this Route targets. It can be interpreted differently based on the type of parent resource. \n When the parent resource is a Gateway, this targets all listeners listening on the specified port that also support this kind of Route(and select this Route). It's not recommended to set `Port` unless the networking behaviors specified in a Route must apply to a specific port as opposed to a listener(s) whose port(s) may be changed. When both Port and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support other parent resources. Implementations supporting other types of parent resources MUST clearly document how/if Port is interpreted. \n For the purpose of status, an attachment is considered successful as long as the parent resource accepts it partially. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Extended \n " format: int32 maximum: 65535 minimum: 1 type: integer sectionName: description: "SectionName is the name of a section within the target resource. In the following resources, SectionName is interpreted as the following: \n * Gateway: Listener Name. When both Port (experimental) and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support attaching Routes to other resources. If that is the case, they MUST clearly document how SectionName is interpreted. \n When unspecified (empty string), this will reference the entire resource. For the purpose of status, an attachment is considered successful if at least one section in the parent resource accepts it. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Core" maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string required: - name type: object required: - controllerName - parentRef type: object maxItems: 32 type: array required: - parents type: object required: - spec type: object served: true storage: false subresources: status: {} - additionalPrinterColumns: - jsonPath: .spec.hostnames name: Hostnames type: string - jsonPath: .metadata.creationTimestamp name: Age type: date name: v1beta1 schema: openAPIV3Schema: description: HTTPRoute provides a way to route HTTP requests. This includes the capability to match requests by hostname, path, header, or query param. Filters can be used to specify additional processing steps. Backends specify where matching requests should be routed. properties: apiVersion: description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' type: string kind: description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' type: string metadata: type: object spec: description: Spec defines the desired state of HTTPRoute. properties: hostnames: description: "Hostnames defines a set of hostname that should match against the HTTP Host header to select a HTTPRoute to process the request. This matches the RFC 1123 definition of a hostname with 2 notable exceptions: \n 1. IPs are not allowed. 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard label must appear by itself as the first label. \n If a hostname is specified by both the Listener and HTTPRoute, there must be at least one intersecting hostname for the HTTPRoute to be attached to the Listener. For example: \n * A Listener with `test.example.com` as the hostname matches HTTPRoutes that have either not specified any hostnames, or have specified at least one of `test.example.com` or `*.example.com`. * A Listener with `*.example.com` as the hostname matches HTTPRoutes that have either not specified any hostnames or have specified at least one hostname that matches the Listener hostname. For example, `*.example.com`, `test.example.com`, and `foo.test.example.com` would all match. On the other hand, `example.com` and `test.example.net` would not match. \n Hostnames that are prefixed with a wildcard label (`*.`) are interpreted as a suffix match. That means that a match for `*.example.com` would match both `test.example.com`, and `foo.test.example.com`, but not `example.com`. \n If both the Listener and HTTPRoute have specified hostnames, any HTTPRoute hostnames that do not match the Listener hostname MUST be ignored. For example, if a Listener specified `*.example.com`, and the HTTPRoute specified `test.example.com` and `test.example.net`, `test.example.net` must not be considered for a match. \n If both the Listener and HTTPRoute have specified hostnames, and none match with the criteria above, then the HTTPRoute is not accepted. The implementation must raise an 'Accepted' Condition with a status of `False` in the corresponding RouteParentStatus. \n In the event that multiple HTTPRoutes specify intersecting hostnames (e.g. overlapping wildcard matching and exact matching hostnames), precedence must be given to rules from the HTTPRoute with the largest number of: \n * Characters in a matching non-wildcard hostname. * Characters in a matching hostname. \n If ties exist across multiple Routes, the matching precedence rules for HTTPRouteMatches takes over. \n Support: Core" items: description: "Hostname is the fully qualified domain name of a network host. This matches the RFC 1123 definition of a hostname with 2 notable exceptions: \n 1. IPs are not allowed. 2. A hostname may be prefixed with a wildcard label (`*.`). The wildcard label must appear by itself as the first label. \n Hostname can be \"precise\" which is a domain name without the terminating dot of a network host (e.g. \"foo.example.com\") or \"wildcard\", which is a domain name prefixed with a single wildcard label (e.g. `*.example.com`). \n Note that as per RFC1035 and RFC1123, a *label* must consist of lower case alphanumeric characters or '-', and must start and end with an alphanumeric character. No other punctuation is allowed." maxLength: 253 minLength: 1 pattern: ^(\*\.)?[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string maxItems: 16 type: array parentRefs: description: "ParentRefs references the resources (usually Gateways) that a Route wants to be attached to. Note that the referenced parent resource needs to allow this for the attachment to be complete. For Gateways, that means the Gateway needs to allow attachment from Routes of this kind and namespace. \n The only kind of parent resource with \"Core\" support is Gateway. This API may be extended in the future to support additional kinds of parent resources such as one of the route kinds. \n It is invalid to reference an identical parent more than once. It is valid to reference multiple distinct sections within the same parent resource, such as 2 Listeners within a Gateway. \n It is possible to separately reference multiple distinct objects that may be collapsed by an implementation. For example, some implementations may choose to merge compatible Gateway Listeners together. If that is the case, the list of routes attached to those resources should also be merged. \n Note that for ParentRefs that cross namespace boundaries, there are specific rules. Cross-namespace references are only valid if they are explicitly allowed by something in the namespace they are referring to. For example, Gateway has the AllowedRoutes field, and ReferenceGrant provides a generic way to enable any other kind of cross-namespace reference." items: description: "ParentReference identifies an API object (usually a Gateway) that can be considered a parent of this resource (usually a route). The only kind of parent resource with \"Core\" support is Gateway. This API may be extended in the future to support additional kinds of parent resources, such as HTTPRoute. \n The API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid." properties: group: default: gateway.networking.k8s.io description: "Group is the group of the referent. When unspecified, \"gateway.networking.k8s.io\" is inferred. To set the core API group (such as for a \"Service\" kind referent), Group must be explicitly set to \"\" (empty string). \n Support: Core" maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: default: Gateway description: "Kind is kind of the referent. \n Support: Core (Gateway) \n Support: Implementation-specific (Other Resources)" maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: "Name is the name of the referent. \n Support: Core" maxLength: 253 minLength: 1 type: string namespace: description: "Namespace is the namespace of the referent. When unspecified, this refers to the local namespace of the Route. \n Note that there are specific rules for ParentRefs which cross namespace boundaries. Cross-namespace references are only valid if they are explicitly allowed by something in the namespace they are referring to. For example: Gateway has the AllowedRoutes field, and ReferenceGrant provides a generic way to enable any other kind of cross-namespace reference. \n Support: Core" maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string port: description: "Port is the network port this Route targets. It can be interpreted differently based on the type of parent resource. \n When the parent resource is a Gateway, this targets all listeners listening on the specified port that also support this kind of Route(and select this Route). It's not recommended to set `Port` unless the networking behaviors specified in a Route must apply to a specific port as opposed to a listener(s) whose port(s) may be changed. When both Port and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support other parent resources. Implementations supporting other types of parent resources MUST clearly document how/if Port is interpreted. \n For the purpose of status, an attachment is considered successful as long as the parent resource accepts it partially. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Extended \n " format: int32 maximum: 65535 minimum: 1 type: integer sectionName: description: "SectionName is the name of a section within the target resource. In the following resources, SectionName is interpreted as the following: \n * Gateway: Listener Name. When both Port (experimental) and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support attaching Routes to other resources. If that is the case, they MUST clearly document how SectionName is interpreted. \n When unspecified (empty string), this will reference the entire resource. For the purpose of status, an attachment is considered successful if at least one section in the parent resource accepts it. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Core" maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string required: - name type: object maxItems: 32 type: array rules: default: - matches: - path: type: PathPrefix value: / description: Rules are a list of HTTP matchers, filters and actions. items: description: HTTPRouteRule defines semantics for matching an HTTP request based on conditions (matches), processing it (filters), and forwarding the request to an API object (backendRefs). properties: backendRefs: description: "BackendRefs defines the backend(s) where matching requests should be sent. \n Failure behavior here depends on how many BackendRefs are specified and how many are invalid. \n If *all* entries in BackendRefs are invalid, and there are also no filters specified in this route rule, *all* traffic which matches this rule MUST receive a 500 status code. \n See the HTTPBackendRef definition for the rules about what makes a single HTTPBackendRef invalid. \n When a HTTPBackendRef is invalid, 500 status codes MUST be returned for requests that would have otherwise been routed to an invalid backend. If multiple backends are specified, and some are invalid, the proportion of requests that would otherwise have been routed to an invalid backend MUST receive a 500 status code. \n For example, if two backends are specified with equal weights, and one is invalid, 50 percent of traffic must receive a 500. Implementations may choose how that 50 percent is determined. \n Support: Core for Kubernetes Service \n Support: Implementation-specific for any other resource \n Support for weight: Core" items: description: HTTPBackendRef defines how a HTTPRoute should forward an HTTP request. properties: filters: description: "Filters defined at this level should be executed if and only if the request is being forwarded to the backend defined here. \n Support: Implementation-specific (For broader support of filters, use the Filters field in HTTPRouteRule.)" items: description: HTTPRouteFilter defines processing steps that must be completed during the request or response lifecycle. HTTPRouteFilters are meant as an extension point to express processing that may be done in Gateway implementations. Some examples include request or response modification, implementing authentication strategies, rate-limiting, and traffic shaping. API guarantee/conformance is defined based on the type of the filter. properties: extensionRef: description: "ExtensionRef is an optional, implementation-specific extension to the \"filter\" behavior. For example, resource \"myroutefilter\" in group \"networking.example.net\"). ExtensionRef MUST NOT be used for core and extended filters. \n Support: Implementation-specific" properties: group: description: Group is the group of the referent. For example, "gateway.networking.k8s.io". When unspecified or empty string, core API group is inferred. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: description: Kind is kind of the referent. For example "HTTPRoute" or "Service". maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: Name is the name of the referent. maxLength: 253 minLength: 1 type: string required: - group - kind - name type: object requestHeaderModifier: description: "RequestHeaderModifier defines a schema for a filter that modifies request headers. \n Support: Core" properties: add: description: "Add adds the given header(s) (name, value) to the request before the action. It appends to any existing values associated with the header name. \n Input: GET /foo HTTP/1.1 my-header: foo \n Config: add: - name: \"my-header\" value: \"bar,baz\" \n Output: GET /foo HTTP/1.1 my-header: foo,bar,baz" items: description: HTTPHeader represents an HTTP Header name and value as defined by RFC 7230. properties: name: description: "Name is the name of the HTTP Header to be matched. Name matching MUST be case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). \n If multiple entries specify equivalent header names, the first entry with an equivalent name MUST be considered for a match. Subsequent entries with an equivalent header name MUST be ignored. Due to the case-insensitivity of header names, \"foo\" and \"Foo\" are considered equivalent." maxLength: 256 minLength: 1 pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ type: string value: description: Value is the value of HTTP Header to be matched. maxLength: 4096 minLength: 1 type: string required: - name - value type: object maxItems: 16 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map remove: description: "Remove the given header(s) from the HTTP request before the action. The value of Remove is a list of HTTP header names. Note that the header names are case-insensitive (see https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). \n Input: GET /foo HTTP/1.1 my-header1: foo my-header2: bar my-header3: baz \n Config: remove: [\"my-header1\", \"my-header3\"] \n Output: GET /foo HTTP/1.1 my-header2: bar" items: type: string maxItems: 16 type: array set: description: "Set overwrites the request with the given header (name, value) before the action. \n Input: GET /foo HTTP/1.1 my-header: foo \n Config: set: - name: \"my-header\" value: \"bar\" \n Output: GET /foo HTTP/1.1 my-header: bar" items: description: HTTPHeader represents an HTTP Header name and value as defined by RFC 7230. properties: name: description: "Name is the name of the HTTP Header to be matched. Name matching MUST be case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). \n If multiple entries specify equivalent header names, the first entry with an equivalent name MUST be considered for a match. Subsequent entries with an equivalent header name MUST be ignored. Due to the case-insensitivity of header names, \"foo\" and \"Foo\" are considered equivalent." maxLength: 256 minLength: 1 pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ type: string value: description: Value is the value of HTTP Header to be matched. maxLength: 4096 minLength: 1 type: string required: - name - value type: object maxItems: 16 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map type: object requestMirror: description: "RequestMirror defines a schema for a filter that mirrors requests. Requests are sent to the specified destination, but responses from that destination are ignored. \n Support: Extended" properties: backendRef: description: "BackendRef references a resource where mirrored requests are sent. \n If the referent cannot be found, this BackendRef is invalid and must be dropped from the Gateway. The controller must ensure the \"ResolvedRefs\" condition on the Route status is set to `status: False` and not configure this backend in the underlying implementation. \n If there is a cross-namespace reference to an *existing* object that is not allowed by a ReferenceGrant, the controller must ensure the \"ResolvedRefs\" condition on the Route is set to `status: False`, with the \"RefNotPermitted\" reason and not configure this backend in the underlying implementation. \n In either error case, the Message of the `ResolvedRefs` Condition should be used to provide more detail about the problem. \n Support: Extended for Kubernetes Service \n Support: Implementation-specific for any other resource" properties: group: default: "" description: Group is the group of the referent. For example, "gateway.networking.k8s.io". When unspecified or empty string, core API group is inferred. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: default: Service description: Kind is kind of the referent. For example "HTTPRoute" or "Service". Defaults to "Service" when not specified. maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: Name is the name of the referent. maxLength: 253 minLength: 1 type: string namespace: description: "Namespace is the namespace of the backend. When unspecified, the local namespace is inferred. \n Note that when a namespace is specified, a ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. \n Support: Core" maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string port: description: Port specifies the destination port number to use for this resource. Port is required when the referent is a Kubernetes Service. In this case, the port number is the service port number, not the target port. For other resources, destination port might be derived from the referent resource or this field. format: int32 maximum: 65535 minimum: 1 type: integer required: - name type: object required: - backendRef type: object requestRedirect: description: "RequestRedirect defines a schema for a filter that responds to the request with an HTTP redirection. \n Support: Core" properties: hostname: description: "Hostname is the hostname to be used in the value of the `Location` header in the response. When empty, the hostname of the request is used. \n Support: Core" maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string path: description: "Path defines parameters used to modify the path of the incoming request. The modified path is then used to construct the `Location` header. When empty, the request path is used as-is. \n Support: Extended \n " properties: replaceFullPath: description: "ReplaceFullPath specifies the value with which to replace the full path of a request during a rewrite or redirect. \n " maxLength: 1024 type: string replacePrefixMatch: description: "ReplacePrefixMatch specifies the value with which to replace the prefix match of a request during a rewrite or redirect. For example, a request to \"/foo/bar\" with a prefix match of \"/foo\" would be modified to \"/bar\". \n Note that this matches the behavior of the PathPrefix match type. This matches full path elements. A path element refers to the list of labels in the path split by the `/` separator. When specified, a trailing `/` is ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all match the prefix `/abc`, but the path `/abcd` would not. \n " maxLength: 1024 type: string type: description: "Type defines the type of path modifier. Additional types may be added in a future release of the API. \n Note that values may be added to this enum, implementations must ensure that unknown values will not cause a crash. \n Unknown values here must result in the implementation setting the Accepted Condition for the Route to `status: False`, with a Reason of `UnsupportedValue`. \n " enum: - ReplaceFullPath - ReplacePrefixMatch type: string required: - type type: object port: description: "Port is the port to be used in the value of the `Location` header in the response. When empty, port (if specified) of the request is used. \n Support: Extended" format: int32 maximum: 65535 minimum: 1 type: integer scheme: description: "Scheme is the scheme to be used in the value of the `Location` header in the response. When empty, the scheme of the request is used. \n Note that values may be added to this enum, implementations must ensure that unknown values will not cause a crash. \n Unknown values here must result in the implementation setting the Accepted Condition for the Route to `status: False`, with a Reason of `UnsupportedValue`. \n Support: Extended" enum: - http - https type: string statusCode: default: 302 description: "StatusCode is the HTTP status code to be used in response. \n Note that values may be added to this enum, implementations must ensure that unknown values will not cause a crash. \n Unknown values here must result in the implementation setting the Accepted Condition for the Route to `status: False`, with a Reason of `UnsupportedValue`. \n Support: Core" enum: - 301 - 302 type: integer type: object responseHeaderModifier: description: "ResponseHeaderModifier defines a schema for a filter that modifies response headers. \n Support: Extended \n " properties: add: description: "Add adds the given header(s) (name, value) to the request before the action. It appends to any existing values associated with the header name. \n Input: GET /foo HTTP/1.1 my-header: foo \n Config: add: - name: \"my-header\" value: \"bar,baz\" \n Output: GET /foo HTTP/1.1 my-header: foo,bar,baz" items: description: HTTPHeader represents an HTTP Header name and value as defined by RFC 7230. properties: name: description: "Name is the name of the HTTP Header to be matched. Name matching MUST be case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). \n If multiple entries specify equivalent header names, the first entry with an equivalent name MUST be considered for a match. Subsequent entries with an equivalent header name MUST be ignored. Due to the case-insensitivity of header names, \"foo\" and \"Foo\" are considered equivalent." maxLength: 256 minLength: 1 pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ type: string value: description: Value is the value of HTTP Header to be matched. maxLength: 4096 minLength: 1 type: string required: - name - value type: object maxItems: 16 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map remove: description: "Remove the given header(s) from the HTTP request before the action. The value of Remove is a list of HTTP header names. Note that the header names are case-insensitive (see https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). \n Input: GET /foo HTTP/1.1 my-header1: foo my-header2: bar my-header3: baz \n Config: remove: [\"my-header1\", \"my-header3\"] \n Output: GET /foo HTTP/1.1 my-header2: bar" items: type: string maxItems: 16 type: array set: description: "Set overwrites the request with the given header (name, value) before the action. \n Input: GET /foo HTTP/1.1 my-header: foo \n Config: set: - name: \"my-header\" value: \"bar\" \n Output: GET /foo HTTP/1.1 my-header: bar" items: description: HTTPHeader represents an HTTP Header name and value as defined by RFC 7230. properties: name: description: "Name is the name of the HTTP Header to be matched. Name matching MUST be case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). \n If multiple entries specify equivalent header names, the first entry with an equivalent name MUST be considered for a match. Subsequent entries with an equivalent header name MUST be ignored. Due to the case-insensitivity of header names, \"foo\" and \"Foo\" are considered equivalent." maxLength: 256 minLength: 1 pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ type: string value: description: Value is the value of HTTP Header to be matched. maxLength: 4096 minLength: 1 type: string required: - name - value type: object maxItems: 16 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map type: object type: description: "Type identifies the type of filter to apply. As with other API fields, types are classified into three conformance levels: \n - Core: Filter types and their corresponding configuration defined by \"Support: Core\" in this package, e.g. \"RequestHeaderModifier\". All implementations must support core filters. \n - Extended: Filter types and their corresponding configuration defined by \"Support: Extended\" in this package, e.g. \"RequestMirror\". Implementers are encouraged to support extended filters. \n - Implementation-specific: Filters that are defined and supported by specific vendors. In the future, filters showing convergence in behavior across multiple implementations will be considered for inclusion in extended or core conformance levels. Filter-specific configuration for such filters is specified using the ExtensionRef field. `Type` should be set to \"ExtensionRef\" for custom filters. \n Implementers are encouraged to define custom implementation types to extend the core API with implementation-specific behavior. \n If a reference to a custom filter type cannot be resolved, the filter MUST NOT be skipped. Instead, requests that would have been processed by that filter MUST receive a HTTP error response. \n Note that values may be added to this enum, implementations must ensure that unknown values will not cause a crash. \n Unknown values here must result in the implementation setting the Accepted Condition for the Route to `status: False`, with a Reason of `UnsupportedValue`. \n " enum: - RequestHeaderModifier - ResponseHeaderModifier - RequestMirror - RequestRedirect - URLRewrite - ExtensionRef type: string urlRewrite: description: "URLRewrite defines a schema for a filter that modifies a request during forwarding. \n Support: Extended \n " properties: hostname: description: "Hostname is the value to be used to replace the Host header value during forwarding. \n Support: Extended \n " maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string path: description: "Path defines a path rewrite. \n Support: Extended \n " properties: replaceFullPath: description: "ReplaceFullPath specifies the value with which to replace the full path of a request during a rewrite or redirect. \n " maxLength: 1024 type: string replacePrefixMatch: description: "ReplacePrefixMatch specifies the value with which to replace the prefix match of a request during a rewrite or redirect. For example, a request to \"/foo/bar\" with a prefix match of \"/foo\" would be modified to \"/bar\". \n Note that this matches the behavior of the PathPrefix match type. This matches full path elements. A path element refers to the list of labels in the path split by the `/` separator. When specified, a trailing `/` is ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all match the prefix `/abc`, but the path `/abcd` would not. \n " maxLength: 1024 type: string type: description: "Type defines the type of path modifier. Additional types may be added in a future release of the API. \n Note that values may be added to this enum, implementations must ensure that unknown values will not cause a crash. \n Unknown values here must result in the implementation setting the Accepted Condition for the Route to `status: False`, with a Reason of `UnsupportedValue`. \n " enum: - ReplaceFullPath - ReplacePrefixMatch type: string required: - type type: object type: object required: - type type: object maxItems: 16 type: array group: default: "" description: Group is the group of the referent. For example, "gateway.networking.k8s.io". When unspecified or empty string, core API group is inferred. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: default: Service description: Kind is kind of the referent. For example "HTTPRoute" or "Service". Defaults to "Service" when not specified. maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: Name is the name of the referent. maxLength: 253 minLength: 1 type: string namespace: description: "Namespace is the namespace of the backend. When unspecified, the local namespace is inferred. \n Note that when a namespace is specified, a ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. \n Support: Core" maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string port: description: Port specifies the destination port number to use for this resource. Port is required when the referent is a Kubernetes Service. In this case, the port number is the service port number, not the target port. For other resources, destination port might be derived from the referent resource or this field. format: int32 maximum: 65535 minimum: 1 type: integer weight: default: 1 description: "Weight specifies the proportion of requests forwarded to the referenced backend. This is computed as weight/(sum of all weights in this BackendRefs list). For non-zero values, there may be some epsilon from the exact proportion defined here depending on the precision an implementation supports. Weight is not a percentage and the sum of weights does not need to equal 100. \n If only one backend is specified and it has a weight greater than 0, 100% of the traffic is forwarded to that backend. If weight is set to 0, no traffic should be forwarded for this entry. If unspecified, weight defaults to 1. \n Support for this field varies based on the context where used." format: int32 maximum: 1000000 minimum: 0 type: integer required: - name type: object maxItems: 16 type: array filters: description: "Filters define the filters that are applied to requests that match this rule. \n The effects of ordering of multiple behaviors are currently unspecified. This can change in the future based on feedback during the alpha stage. \n Conformance-levels at this level are defined based on the type of filter: \n - ALL core filters MUST be supported by all implementations. - Implementers are encouraged to support extended filters. - Implementation-specific custom filters have no API guarantees across implementations. \n Specifying a core filter multiple times has unspecified or implementation-specific conformance. \n All filters are expected to be compatible with each other except for the URLRewrite and RequestRedirect filters, which may not be combined. If an implementation can not support other combinations of filters, they must clearly document that limitation. In all cases where incompatible or unsupported filters are specified, implementations MUST add a warning condition to status. \n Support: Core" items: description: HTTPRouteFilter defines processing steps that must be completed during the request or response lifecycle. HTTPRouteFilters are meant as an extension point to express processing that may be done in Gateway implementations. Some examples include request or response modification, implementing authentication strategies, rate-limiting, and traffic shaping. API guarantee/conformance is defined based on the type of the filter. properties: extensionRef: description: "ExtensionRef is an optional, implementation-specific extension to the \"filter\" behavior. For example, resource \"myroutefilter\" in group \"networking.example.net\"). ExtensionRef MUST NOT be used for core and extended filters. \n Support: Implementation-specific" properties: group: description: Group is the group of the referent. For example, "gateway.networking.k8s.io". When unspecified or empty string, core API group is inferred. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: description: Kind is kind of the referent. For example "HTTPRoute" or "Service". maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: Name is the name of the referent. maxLength: 253 minLength: 1 type: string required: - group - kind - name type: object requestHeaderModifier: description: "RequestHeaderModifier defines a schema for a filter that modifies request headers. \n Support: Core" properties: add: description: "Add adds the given header(s) (name, value) to the request before the action. It appends to any existing values associated with the header name. \n Input: GET /foo HTTP/1.1 my-header: foo \n Config: add: - name: \"my-header\" value: \"bar,baz\" \n Output: GET /foo HTTP/1.1 my-header: foo,bar,baz" items: description: HTTPHeader represents an HTTP Header name and value as defined by RFC 7230. properties: name: description: "Name is the name of the HTTP Header to be matched. Name matching MUST be case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). \n If multiple entries specify equivalent header names, the first entry with an equivalent name MUST be considered for a match. Subsequent entries with an equivalent header name MUST be ignored. Due to the case-insensitivity of header names, \"foo\" and \"Foo\" are considered equivalent." maxLength: 256 minLength: 1 pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ type: string value: description: Value is the value of HTTP Header to be matched. maxLength: 4096 minLength: 1 type: string required: - name - value type: object maxItems: 16 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map remove: description: "Remove the given header(s) from the HTTP request before the action. The value of Remove is a list of HTTP header names. Note that the header names are case-insensitive (see https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). \n Input: GET /foo HTTP/1.1 my-header1: foo my-header2: bar my-header3: baz \n Config: remove: [\"my-header1\", \"my-header3\"] \n Output: GET /foo HTTP/1.1 my-header2: bar" items: type: string maxItems: 16 type: array set: description: "Set overwrites the request with the given header (name, value) before the action. \n Input: GET /foo HTTP/1.1 my-header: foo \n Config: set: - name: \"my-header\" value: \"bar\" \n Output: GET /foo HTTP/1.1 my-header: bar" items: description: HTTPHeader represents an HTTP Header name and value as defined by RFC 7230. properties: name: description: "Name is the name of the HTTP Header to be matched. Name matching MUST be case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). \n If multiple entries specify equivalent header names, the first entry with an equivalent name MUST be considered for a match. Subsequent entries with an equivalent header name MUST be ignored. Due to the case-insensitivity of header names, \"foo\" and \"Foo\" are considered equivalent." maxLength: 256 minLength: 1 pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ type: string value: description: Value is the value of HTTP Header to be matched. maxLength: 4096 minLength: 1 type: string required: - name - value type: object maxItems: 16 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map type: object requestMirror: description: "RequestMirror defines a schema for a filter that mirrors requests. Requests are sent to the specified destination, but responses from that destination are ignored. \n Support: Extended" properties: backendRef: description: "BackendRef references a resource where mirrored requests are sent. \n If the referent cannot be found, this BackendRef is invalid and must be dropped from the Gateway. The controller must ensure the \"ResolvedRefs\" condition on the Route status is set to `status: False` and not configure this backend in the underlying implementation. \n If there is a cross-namespace reference to an *existing* object that is not allowed by a ReferenceGrant, the controller must ensure the \"ResolvedRefs\" condition on the Route is set to `status: False`, with the \"RefNotPermitted\" reason and not configure this backend in the underlying implementation. \n In either error case, the Message of the `ResolvedRefs` Condition should be used to provide more detail about the problem. \n Support: Extended for Kubernetes Service \n Support: Implementation-specific for any other resource" properties: group: default: "" description: Group is the group of the referent. For example, "gateway.networking.k8s.io". When unspecified or empty string, core API group is inferred. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: default: Service description: Kind is kind of the referent. For example "HTTPRoute" or "Service". Defaults to "Service" when not specified. maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: Name is the name of the referent. maxLength: 253 minLength: 1 type: string namespace: description: "Namespace is the namespace of the backend. When unspecified, the local namespace is inferred. \n Note that when a namespace is specified, a ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. \n Support: Core" maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string port: description: Port specifies the destination port number to use for this resource. Port is required when the referent is a Kubernetes Service. In this case, the port number is the service port number, not the target port. For other resources, destination port might be derived from the referent resource or this field. format: int32 maximum: 65535 minimum: 1 type: integer required: - name type: object required: - backendRef type: object requestRedirect: description: "RequestRedirect defines a schema for a filter that responds to the request with an HTTP redirection. \n Support: Core" properties: hostname: description: "Hostname is the hostname to be used in the value of the `Location` header in the response. When empty, the hostname of the request is used. \n Support: Core" maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string path: description: "Path defines parameters used to modify the path of the incoming request. The modified path is then used to construct the `Location` header. When empty, the request path is used as-is. \n Support: Extended \n " properties: replaceFullPath: description: "ReplaceFullPath specifies the value with which to replace the full path of a request during a rewrite or redirect. \n " maxLength: 1024 type: string replacePrefixMatch: description: "ReplacePrefixMatch specifies the value with which to replace the prefix match of a request during a rewrite or redirect. For example, a request to \"/foo/bar\" with a prefix match of \"/foo\" would be modified to \"/bar\". \n Note that this matches the behavior of the PathPrefix match type. This matches full path elements. A path element refers to the list of labels in the path split by the `/` separator. When specified, a trailing `/` is ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all match the prefix `/abc`, but the path `/abcd` would not. \n " maxLength: 1024 type: string type: description: "Type defines the type of path modifier. Additional types may be added in a future release of the API. \n Note that values may be added to this enum, implementations must ensure that unknown values will not cause a crash. \n Unknown values here must result in the implementation setting the Accepted Condition for the Route to `status: False`, with a Reason of `UnsupportedValue`. \n " enum: - ReplaceFullPath - ReplacePrefixMatch type: string required: - type type: object port: description: "Port is the port to be used in the value of the `Location` header in the response. When empty, port (if specified) of the request is used. \n Support: Extended" format: int32 maximum: 65535 minimum: 1 type: integer scheme: description: "Scheme is the scheme to be used in the value of the `Location` header in the response. When empty, the scheme of the request is used. \n Note that values may be added to this enum, implementations must ensure that unknown values will not cause a crash. \n Unknown values here must result in the implementation setting the Accepted Condition for the Route to `status: False`, with a Reason of `UnsupportedValue`. \n Support: Extended" enum: - http - https type: string statusCode: default: 302 description: "StatusCode is the HTTP status code to be used in response. \n Note that values may be added to this enum, implementations must ensure that unknown values will not cause a crash. \n Unknown values here must result in the implementation setting the Accepted Condition for the Route to `status: False`, with a Reason of `UnsupportedValue`. \n Support: Core" enum: - 301 - 302 type: integer type: object responseHeaderModifier: description: "ResponseHeaderModifier defines a schema for a filter that modifies response headers. \n Support: Extended \n " properties: add: description: "Add adds the given header(s) (name, value) to the request before the action. It appends to any existing values associated with the header name. \n Input: GET /foo HTTP/1.1 my-header: foo \n Config: add: - name: \"my-header\" value: \"bar,baz\" \n Output: GET /foo HTTP/1.1 my-header: foo,bar,baz" items: description: HTTPHeader represents an HTTP Header name and value as defined by RFC 7230. properties: name: description: "Name is the name of the HTTP Header to be matched. Name matching MUST be case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). \n If multiple entries specify equivalent header names, the first entry with an equivalent name MUST be considered for a match. Subsequent entries with an equivalent header name MUST be ignored. Due to the case-insensitivity of header names, \"foo\" and \"Foo\" are considered equivalent." maxLength: 256 minLength: 1 pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ type: string value: description: Value is the value of HTTP Header to be matched. maxLength: 4096 minLength: 1 type: string required: - name - value type: object maxItems: 16 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map remove: description: "Remove the given header(s) from the HTTP request before the action. The value of Remove is a list of HTTP header names. Note that the header names are case-insensitive (see https://datatracker.ietf.org/doc/html/rfc2616#section-4.2). \n Input: GET /foo HTTP/1.1 my-header1: foo my-header2: bar my-header3: baz \n Config: remove: [\"my-header1\", \"my-header3\"] \n Output: GET /foo HTTP/1.1 my-header2: bar" items: type: string maxItems: 16 type: array set: description: "Set overwrites the request with the given header (name, value) before the action. \n Input: GET /foo HTTP/1.1 my-header: foo \n Config: set: - name: \"my-header\" value: \"bar\" \n Output: GET /foo HTTP/1.1 my-header: bar" items: description: HTTPHeader represents an HTTP Header name and value as defined by RFC 7230. properties: name: description: "Name is the name of the HTTP Header to be matched. Name matching MUST be case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). \n If multiple entries specify equivalent header names, the first entry with an equivalent name MUST be considered for a match. Subsequent entries with an equivalent header name MUST be ignored. Due to the case-insensitivity of header names, \"foo\" and \"Foo\" are considered equivalent." maxLength: 256 minLength: 1 pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ type: string value: description: Value is the value of HTTP Header to be matched. maxLength: 4096 minLength: 1 type: string required: - name - value type: object maxItems: 16 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map type: object type: description: "Type identifies the type of filter to apply. As with other API fields, types are classified into three conformance levels: \n - Core: Filter types and their corresponding configuration defined by \"Support: Core\" in this package, e.g. \"RequestHeaderModifier\". All implementations must support core filters. \n - Extended: Filter types and their corresponding configuration defined by \"Support: Extended\" in this package, e.g. \"RequestMirror\". Implementers are encouraged to support extended filters. \n - Implementation-specific: Filters that are defined and supported by specific vendors. In the future, filters showing convergence in behavior across multiple implementations will be considered for inclusion in extended or core conformance levels. Filter-specific configuration for such filters is specified using the ExtensionRef field. `Type` should be set to \"ExtensionRef\" for custom filters. \n Implementers are encouraged to define custom implementation types to extend the core API with implementation-specific behavior. \n If a reference to a custom filter type cannot be resolved, the filter MUST NOT be skipped. Instead, requests that would have been processed by that filter MUST receive a HTTP error response. \n Note that values may be added to this enum, implementations must ensure that unknown values will not cause a crash. \n Unknown values here must result in the implementation setting the Accepted Condition for the Route to `status: False`, with a Reason of `UnsupportedValue`. \n " enum: - RequestHeaderModifier - ResponseHeaderModifier - RequestMirror - RequestRedirect - URLRewrite - ExtensionRef type: string urlRewrite: description: "URLRewrite defines a schema for a filter that modifies a request during forwarding. \n Support: Extended \n " properties: hostname: description: "Hostname is the value to be used to replace the Host header value during forwarding. \n Support: Extended \n " maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string path: description: "Path defines a path rewrite. \n Support: Extended \n " properties: replaceFullPath: description: "ReplaceFullPath specifies the value with which to replace the full path of a request during a rewrite or redirect. \n " maxLength: 1024 type: string replacePrefixMatch: description: "ReplacePrefixMatch specifies the value with which to replace the prefix match of a request during a rewrite or redirect. For example, a request to \"/foo/bar\" with a prefix match of \"/foo\" would be modified to \"/bar\". \n Note that this matches the behavior of the PathPrefix match type. This matches full path elements. A path element refers to the list of labels in the path split by the `/` separator. When specified, a trailing `/` is ignored. For example, the paths `/abc`, `/abc/`, and `/abc/def` would all match the prefix `/abc`, but the path `/abcd` would not. \n " maxLength: 1024 type: string type: description: "Type defines the type of path modifier. Additional types may be added in a future release of the API. \n Note that values may be added to this enum, implementations must ensure that unknown values will not cause a crash. \n Unknown values here must result in the implementation setting the Accepted Condition for the Route to `status: False`, with a Reason of `UnsupportedValue`. \n " enum: - ReplaceFullPath - ReplacePrefixMatch type: string required: - type type: object type: object required: - type type: object maxItems: 16 type: array matches: default: - path: type: PathPrefix value: / description: "Matches define conditions used for matching the rule against incoming HTTP requests. Each match is independent, i.e. this rule will be matched if **any** one of the matches is satisfied. \n For example, take the following matches configuration: \n ``` matches: - path: value: \"/foo\" headers: - name: \"version\" value: \"v2\" - path: value: \"/v2/foo\" ``` \n For a request to match against this rule, a request must satisfy EITHER of the two conditions: \n - path prefixed with `/foo` AND contains the header `version: v2` - path prefix of `/v2/foo` \n See the documentation for HTTPRouteMatch on how to specify multiple match conditions that should be ANDed together. \n If no matches are specified, the default is a prefix path match on \"/\", which has the effect of matching every HTTP request. \n Proxy or Load Balancer routing configuration generated from HTTPRoutes MUST prioritize matches based on the following criteria, continuing on ties. Across all rules specified on applicable Routes, precedence must be given to the match with the largest number of: \n * Characters in a matching path. * Header matches. * Query param matches. \n If ties still exist across multiple Routes, matching precedence MUST be determined in order of the following criteria, continuing on ties: \n * The oldest Route based on creation timestamp. * The Route appearing first in alphabetical order by \"{namespace}/{name}\". \n If ties still exist within an HTTPRoute, matching precedence MUST be granted to the FIRST matching rule (in list order) with a match meeting the above criteria. \n When no rules matching a request have been successfully attached to the parent a request is coming from, a HTTP 404 status code MUST be returned." items: description: "HTTPRouteMatch defines the predicate used to match requests to a given action. Multiple match types are ANDed together, i.e. the match will evaluate to true only if all conditions are satisfied. \n For example, the match below will match a HTTP request only if its path starts with `/foo` AND it contains the `version: v1` header: \n ``` match: \n \tpath: \t value: \"/foo\" \theaders: \t- name: \"version\" \t value \"v1\" \n ```" properties: headers: description: Headers specifies HTTP request header matchers. Multiple match values are ANDed together, meaning, a request must match all the specified headers to select the route. items: description: HTTPHeaderMatch describes how to select a HTTP route by matching HTTP request headers. properties: name: description: "Name is the name of the HTTP Header to be matched. Name matching MUST be case insensitive. (See https://tools.ietf.org/html/rfc7230#section-3.2). \n If multiple entries specify equivalent header names, only the first entry with an equivalent name MUST be considered for a match. Subsequent entries with an equivalent header name MUST be ignored. Due to the case-insensitivity of header names, \"foo\" and \"Foo\" are considered equivalent. \n When a header is repeated in an HTTP request, it is implementation-specific behavior as to how this is represented. Generally, proxies should follow the guidance from the RFC: https://www.rfc-editor.org/rfc/rfc7230.html#section-3.2.2 regarding processing a repeated header, with special handling for \"Set-Cookie\"." maxLength: 256 minLength: 1 pattern: ^[A-Za-z0-9!#$%&'*+\-.^_\x60|~]+$ type: string type: default: Exact description: "Type specifies how to match against the value of the header. \n Support: Core (Exact) \n Support: Implementation-specific (RegularExpression) \n Since RegularExpression HeaderMatchType has implementation-specific conformance, implementations can support POSIX, PCRE or any other dialects of regular expressions. Please read the implementation's documentation to determine the supported dialect." enum: - Exact - RegularExpression type: string value: description: Value is the value of HTTP Header to be matched. maxLength: 4096 minLength: 1 type: string required: - name - value type: object maxItems: 16 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map method: description: "Method specifies HTTP method matcher. When specified, this route will be matched only if the request has the specified method. \n Support: Extended" enum: - GET - HEAD - POST - PUT - DELETE - CONNECT - OPTIONS - TRACE - PATCH type: string path: default: type: PathPrefix value: / description: Path specifies a HTTP request path matcher. If this field is not specified, a default prefix match on the "/" path is provided. properties: type: default: PathPrefix description: "Type specifies how to match against the path Value. \n Support: Core (Exact, PathPrefix) \n Support: Implementation-specific (RegularExpression)" enum: - Exact - PathPrefix - RegularExpression type: string value: default: / description: Value of the HTTP path to match against. maxLength: 1024 type: string type: object queryParams: description: "QueryParams specifies HTTP query parameter matchers. Multiple match values are ANDed together, meaning, a request must match all the specified query parameters to select the route. \n Support: Extended" items: description: HTTPQueryParamMatch describes how to select a HTTP route by matching HTTP query parameters. properties: name: description: "Name is the name of the HTTP query param to be matched. This must be an exact string match. (See https://tools.ietf.org/html/rfc7230#section-2.7.3). \n If multiple entries specify equivalent query param names, only the first entry with an equivalent name MUST be considered for a match. Subsequent entries with an equivalent query param name MUST be ignored. \n If a query param is repeated in an HTTP request, the behavior is purposely left undefined, since different data planes have different capabilities. However, it is *recommended* that implementations should match against the first value of the param if the data plane supports it, as this behavior is expected in other load balancing contexts outside of the Gateway API. \n Users SHOULD NOT route traffic based on repeated query params to guard themselves against potential differences in the implementations." maxLength: 256 minLength: 1 type: string type: default: Exact description: "Type specifies how to match against the value of the query parameter. \n Support: Extended (Exact) \n Support: Implementation-specific (RegularExpression) \n Since RegularExpression QueryParamMatchType has Implementation-specific conformance, implementations can support POSIX, PCRE or any other dialects of regular expressions. Please read the implementation's documentation to determine the supported dialect." enum: - Exact - RegularExpression type: string value: description: Value is the value of HTTP query param to be matched. maxLength: 1024 minLength: 1 type: string required: - name - value type: object maxItems: 16 type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map type: object maxItems: 8 type: array type: object maxItems: 16 type: array type: object status: description: Status defines the current state of HTTPRoute. properties: parents: description: "Parents is a list of parent resources (usually Gateways) that are associated with the route, and the status of the route with respect to each parent. When this route attaches to a parent, the controller that manages the parent must add an entry to this list when the controller first sees the route and should update the entry as appropriate when the route or gateway is modified. \n Note that parent references that cannot be resolved by an implementation of this API will not be added to this list. Implementations of this API can only populate Route status for the Gateways/parent resources they are responsible for. \n A maximum of 32 Gateways will be represented in this list. An empty list means the route has not been attached to any Gateway." items: description: RouteParentStatus describes the status of a route with respect to an associated Parent. properties: conditions: description: "Conditions describes the status of the route with respect to the Gateway. Note that the route's availability is also subject to the Gateway's own status conditions and listener status. \n If the Route's ParentRef specifies an existing Gateway that supports Routes of this kind AND that Gateway's controller has sufficient access, then that Gateway's controller MUST set the \"Accepted\" condition on the Route, to indicate whether the route has been accepted or rejected by the Gateway, and why. \n A Route MUST be considered \"Accepted\" if at least one of the Route's rules is implemented by the Gateway. \n There are a number of cases where the \"Accepted\" condition may not be set due to lack of controller visibility, that includes when: \n * The Route refers to a non-existent parent. * The Route is of a type that the controller does not support. * The Route is in a namespace the controller does not have access to." items: description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, \n \ttype FooStatus struct{ \t // Represents the observations of a foo's current state. \t // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" \t // +patchMergeKey=type \t // +patchStrategy=merge \t // +listType=map \t // +listMapKey=type \t Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n \t // other fields \t}" properties: lastTransitionTime: description: lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object maxItems: 8 minItems: 1 type: array x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map controllerName: description: "ControllerName is a domain/path string that indicates the name of the controller that wrote this status. This corresponds with the controllerName field on GatewayClass. \n Example: \"example.net/gateway-controller\". \n The format of this field is DOMAIN \"/\" PATH, where DOMAIN and PATH are valid Kubernetes names (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names). \n Controllers MUST populate this field when writing status. Controllers should ensure that entries to status populated with their ControllerName are cleaned up when they are no longer necessary." maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ type: string parentRef: description: ParentRef corresponds with a ParentRef in the spec that this RouteParentStatus struct describes the status of. properties: group: default: gateway.networking.k8s.io description: "Group is the group of the referent. When unspecified, \"gateway.networking.k8s.io\" is inferred. To set the core API group (such as for a \"Service\" kind referent), Group must be explicitly set to \"\" (empty string). \n Support: Core" maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: default: Gateway description: "Kind is kind of the referent. \n Support: Core (Gateway) \n Support: Implementation-specific (Other Resources)" maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: "Name is the name of the referent. \n Support: Core" maxLength: 253 minLength: 1 type: string namespace: description: "Namespace is the namespace of the referent. When unspecified, this refers to the local namespace of the Route. \n Note that there are specific rules for ParentRefs which cross namespace boundaries. Cross-namespace references are only valid if they are explicitly allowed by something in the namespace they are referring to. For example: Gateway has the AllowedRoutes field, and ReferenceGrant provides a generic way to enable any other kind of cross-namespace reference. \n Support: Core" maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string port: description: "Port is the network port this Route targets. It can be interpreted differently based on the type of parent resource. \n When the parent resource is a Gateway, this targets all listeners listening on the specified port that also support this kind of Route(and select this Route). It's not recommended to set `Port` unless the networking behaviors specified in a Route must apply to a specific port as opposed to a listener(s) whose port(s) may be changed. When both Port and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support other parent resources. Implementations supporting other types of parent resources MUST clearly document how/if Port is interpreted. \n For the purpose of status, an attachment is considered successful as long as the parent resource accepts it partially. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Extended \n " format: int32 maximum: 65535 minimum: 1 type: integer sectionName: description: "SectionName is the name of a section within the target resource. In the following resources, SectionName is interpreted as the following: \n * Gateway: Listener Name. When both Port (experimental) and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support attaching Routes to other resources. If that is the case, they MUST clearly document how SectionName is interpreted. \n When unspecified (empty string), this will reference the entire resource. For the purpose of status, an attachment is considered successful if at least one section in the parent resource accepts it. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Core" maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string required: - name type: object required: - controllerName - parentRef type: object maxItems: 32 type: array required: - parents type: object required: - spec type: object served: true storage: true subresources: status: {} status: acceptedNames: kind: "" plural: "" conditions: [] storedVersions: [] --- # Source: consul/templates/crd-ingressgateways.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 labels: app: consul chart: consul-helm heritage: Helm release: consul component: crd name: ingressgateways.consul.hashicorp.com spec: group: consul.hashicorp.com names: kind: IngressGateway listKind: IngressGatewayList plural: ingressgateways shortNames: - ingress-gateway singular: ingressgateway scope: Namespaced versions: - additionalPrinterColumns: - description: The sync status of the resource with Consul jsonPath: .status.conditions[?(@.type=="Synced")].status name: Synced type: string - description: The last successful synced time of the resource with Consul jsonPath: .status.lastSyncedTime name: Last Synced type: date - description: The age of the resource jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: IngressGateway is the Schema for the ingressgateways API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: IngressGatewaySpec defines the desired state of IngressGateway. properties: defaults: description: Defaults is default configuration for all upstream services properties: maxConcurrentRequests: description: |- The maximum number of concurrent requests that will be allowed at a single point in time. Use this to limit HTTP/2 traffic, since HTTP/2 has many requests per connection. format: int32 type: integer maxConnections: description: |- The maximum number of connections a service instance will be allowed to establish against the given upstream. Use this to limit HTTP/1.1 traffic, since HTTP/1.1 has a request per connection. format: int32 type: integer maxPendingRequests: description: |- The maximum number of requests that will be queued while waiting for a connection to be established. format: int32 type: integer passiveHealthCheck: description: |- PassiveHealthCheck configuration determines how upstream proxy instances will be monitored for removal from the load balancing pool. properties: baseEjectionTime: description: |- The base time that a host is ejected for. The real time is equal to the base time multiplied by the number of times the host has been ejected and is capped by max_ejection_time (Default 300s). Defaults to 30s. type: string enforcingConsecutive5xx: description: |- EnforcingConsecutive5xx is the % chance that a host will be actually ejected when an outlier status is detected through consecutive 5xx. This setting can be used to disable ejection or to ramp it up slowly. Ex. Setting this to 10 will make it a 10% chance that the host will be ejected. format: int32 type: integer interval: description: |- Interval between health check analysis sweeps. Each sweep may remove hosts or return hosts to the pool. Ex. setting this to "10s" will set the interval to 10 seconds. type: string maxEjectionPercent: description: |- The maximum % of an upstream cluster that can be ejected due to outlier detection. Defaults to 10% but will eject at least one host regardless of the value. format: int32 type: integer maxFailures: description: |- MaxFailures is the count of consecutive failures that results in a host being removed from the pool. format: int32 type: integer type: object type: object listeners: description: |- Listeners declares what ports the ingress gateway should listen on, and what services to associated to those ports. items: description: IngressListener manages the configuration for a listener on a specific port. properties: port: description: Port declares the port on which the ingress gateway should listen for traffic. type: integer protocol: description: |- Protocol declares what type of traffic this listener is expected to receive. Depending on the protocol, a listener might support multiplexing services over a single port, or additional discovery chain features. The current supported values are: (tcp | http | http2 | grpc). type: string services: description: |- Services declares the set of services to which the listener forwards traffic. For "tcp" protocol listeners, only a single service is allowed. For "http" listeners, multiple services can be declared. items: description: |- IngressService manages configuration for services that are exposed to ingress traffic. properties: hosts: description: |- Hosts is a list of hostnames which should be associated to this service on the defined listener. Only allowed on layer 7 protocols, this will be used to route traffic to the service by matching the Host header of the HTTP request. If a host is provided for a service that also has a wildcard specifier defined, the host will override the wildcard-specifier-provided ".*" domain for that listener. This cannot be specified when using the wildcard specifier, "*", or when using a "tcp" listener. items: type: string type: array maxConcurrentRequests: description: |- The maximum number of concurrent requests that will be allowed at a single point in time. Use this to limit HTTP/2 traffic, since HTTP/2 has many requests per connection. format: int32 type: integer maxConnections: description: |- The maximum number of connections a service instance will be allowed to establish against the given upstream. Use this to limit HTTP/1.1 traffic, since HTTP/1.1 has a request per connection. format: int32 type: integer maxPendingRequests: description: |- The maximum number of requests that will be queued while waiting for a connection to be established. format: int32 type: integer name: description: |- Name declares the service to which traffic should be forwarded. This can either be a specific service, or the wildcard specifier, "*". If the wildcard specifier is provided, the listener must be of "http" protocol and means that the listener will forward traffic to all services. A name can be specified on multiple listeners, and will be exposed on both of the listeners. type: string namespace: description: |- Namespace is the namespace where the service is located. Namespacing is a Consul Enterprise feature. type: string partition: description: |- Partition is the admin-partition where the service is located. Partitioning is a Consul Enterprise feature. type: string passiveHealthCheck: description: |- PassiveHealthCheck configuration determines how upstream proxy instances will be monitored for removal from the load balancing pool. properties: baseEjectionTime: description: |- The base time that a host is ejected for. The real time is equal to the base time multiplied by the number of times the host has been ejected and is capped by max_ejection_time (Default 300s). Defaults to 30s. type: string enforcingConsecutive5xx: description: |- EnforcingConsecutive5xx is the % chance that a host will be actually ejected when an outlier status is detected through consecutive 5xx. This setting can be used to disable ejection or to ramp it up slowly. Ex. Setting this to 10 will make it a 10% chance that the host will be ejected. format: int32 type: integer interval: description: |- Interval between health check analysis sweeps. Each sweep may remove hosts or return hosts to the pool. Ex. setting this to "10s" will set the interval to 10 seconds. type: string maxEjectionPercent: description: |- The maximum % of an upstream cluster that can be ejected due to outlier detection. Defaults to 10% but will eject at least one host regardless of the value. format: int32 type: integer maxFailures: description: |- MaxFailures is the count of consecutive failures that results in a host being removed from the pool. format: int32 type: integer type: object requestHeaders: description: Allow HTTP header manipulation to be configured. properties: add: additionalProperties: type: string description: |- Add is a set of name -> value pairs that should be appended to the request or response (i.e. allowing duplicates if the same header already exists). type: object remove: description: |- Remove is the set of header names that should be stripped from the request or response. items: type: string type: array set: additionalProperties: type: string description: |- Set is a set of name -> value pairs that should be added to the request or response, overwriting any existing header values of the same name. type: object type: object responseHeaders: description: |- HTTPHeaderModifiers is a set of rules for HTTP header modification that should be performed by proxies as the request passes through them. It can operate on either request or response headers depending on the context in which it is used. properties: add: additionalProperties: type: string description: |- Add is a set of name -> value pairs that should be appended to the request or response (i.e. allowing duplicates if the same header already exists). type: object remove: description: |- Remove is the set of header names that should be stripped from the request or response. items: type: string type: array set: additionalProperties: type: string description: |- Set is a set of name -> value pairs that should be added to the request or response, overwriting any existing header values of the same name. type: object type: object tls: description: TLS allows specifying some TLS configuration per listener. properties: sds: description: SDS allows configuring TLS certificate from an SDS service. properties: certResource: description: CertResource is the SDS resource name to request when fetching the certificate from the SDS service. type: string clusterName: description: |- ClusterName is the SDS cluster name to connect to, to retrieve certificates. This cluster must be specified in the Gateway's bootstrap configuration. type: string type: object type: object type: object type: array tls: description: TLS config for this listener. properties: cipherSuites: description: |- Define a subset of cipher suites to restrict Only applicable to connections negotiated via TLS 1.2 or earlier. items: type: string type: array enabled: description: Indicates that TLS should be enabled for this gateway service. type: boolean sds: description: SDS allows configuring TLS certificate from an SDS service. properties: certResource: description: CertResource is the SDS resource name to request when fetching the certificate from the SDS service. type: string clusterName: description: |- ClusterName is the SDS cluster name to connect to, to retrieve certificates. This cluster must be specified in the Gateway's bootstrap configuration. type: string type: object tlsMaxVersion: description: |- TLSMaxVersion sets the default maximum TLS version supported. Must be greater than or equal to `TLSMinVersion`. One of `TLS_AUTO`, `TLSv1_0`, `TLSv1_1`, `TLSv1_2`, or `TLSv1_3`. If unspecified, Envoy will default to TLS 1.3 as a max version for incoming connections. type: string tlsMinVersion: description: |- TLSMinVersion sets the default minimum TLS version supported. One of `TLS_AUTO`, `TLSv1_0`, `TLSv1_1`, `TLSv1_2`, or `TLSv1_3`. If unspecified, Envoy v1.22.0 and newer will default to TLS 1.2 as a min version, while older releases of Envoy default to TLS 1.0. type: string required: - enabled type: object type: object type: array tls: description: TLS holds the TLS configuration for this gateway. properties: cipherSuites: description: |- Define a subset of cipher suites to restrict Only applicable to connections negotiated via TLS 1.2 or earlier. items: type: string type: array enabled: description: Indicates that TLS should be enabled for this gateway service. type: boolean sds: description: SDS allows configuring TLS certificate from an SDS service. properties: certResource: description: CertResource is the SDS resource name to request when fetching the certificate from the SDS service. type: string clusterName: description: |- ClusterName is the SDS cluster name to connect to, to retrieve certificates. This cluster must be specified in the Gateway's bootstrap configuration. type: string type: object tlsMaxVersion: description: |- TLSMaxVersion sets the default maximum TLS version supported. Must be greater than or equal to `TLSMinVersion`. One of `TLS_AUTO`, `TLSv1_0`, `TLSv1_1`, `TLSv1_2`, or `TLSv1_3`. If unspecified, Envoy will default to TLS 1.3 as a max version for incoming connections. type: string tlsMinVersion: description: |- TLSMinVersion sets the default minimum TLS version supported. One of `TLS_AUTO`, `TLSv1_0`, `TLSv1_1`, `TLSv1_2`, or `TLSv1_3`. If unspecified, Envoy v1.22.0 and newer will default to TLS 1.2 as a min version, while older releases of Envoy default to TLS 1.0. type: string required: - enabled type: object type: object status: properties: conditions: description: Conditions indicate the latest available observations of a resource's current state. items: description: |- Conditions define a readiness condition for a Consul resource. See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties properties: lastTransitionTime: description: LastTransitionTime is the last time the condition transitioned from one status to another. format: date-time type: string message: description: A human readable message indicating details about the transition. type: string reason: description: The reason for the condition's last transition. type: string status: description: Status of the condition, one of True, False, Unknown. type: string type: description: Type of condition. type: string required: - status - type type: object type: array lastSyncedTime: description: LastSyncedTime is the last time the resource successfully synced with Consul. format: date-time type: string type: object type: object served: true storage: true subresources: status: {} --- # Source: consul/templates/crd-jwtproviders.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 labels: app: consul chart: consul-helm heritage: Helm release: consul component: crd name: jwtproviders.consul.hashicorp.com spec: group: consul.hashicorp.com names: kind: JWTProvider listKind: JWTProviderList plural: jwtproviders singular: jwtprovider scope: Namespaced versions: - name: v1alpha1 schema: openAPIV3Schema: description: JWTProvider is the Schema for the jwtproviders API. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: JWTProviderSpec defines the desired state of JWTProvider properties: audiences: description: |- Audiences is the set of audiences the JWT is allowed to access. If specified, all JWTs verified with this provider must address at least one of these to be considered valid. items: type: string type: array cacheConfig: description: |- CacheConfig defines configuration for caching the validation result for previously seen JWTs. Caching results can speed up verification when individual tokens are expected to be handled multiple times. properties: size: description: |- Size specifies the maximum number of JWT verification results to cache. Defaults to 0, meaning that JWT caching is disabled. type: integer type: object clockSkewSeconds: description: |- ClockSkewSeconds specifies the maximum allowable time difference from clock skew when validating the "exp" (Expiration) and "nbf" (Not Before) claims. Default value is 30 seconds. type: integer forwarding: description: Forwarding defines rules for forwarding verified JWTs to the backend. properties: headerName: description: |- HeaderName is a header name to use when forwarding a verified JWT to the backend. The verified JWT could have been extracted from any location (query param, header, or cookie). The header value will be base64-URL-encoded, and will not be padded unless PadForwardPayloadHeader is true. type: string padForwardPayloadHeader: description: |- PadForwardPayloadHeader determines whether padding should be added to the base64 encoded token forwarded with ForwardPayloadHeader. Default value is false. type: boolean type: object issuer: description: |- Issuer is the entity that must have issued the JWT. This value must match the "iss" claim of the token. type: string jsonWebKeySet: description: |- JSONWebKeySet defines a JSON Web Key Set, its location on disk, or the means with which to fetch a key set from a remote server. properties: local: description: Local specifies a local source for the key set. properties: filename: description: |- Filename configures a location on disk where the JWKS can be found. If specified, the file must be present on the disk of ALL proxies with intentions referencing this provider. type: string jwks: description: JWKS contains a base64 encoded JWKS. type: string type: object remote: description: Remote specifies how to fetch a key set from a remote server. properties: cacheDuration: description: |- CacheDuration is the duration after which cached keys should be expired. Default value is 5 minutes. type: string fetchAsynchronously: description: |- FetchAsynchronously indicates that the JWKS should be fetched when a client request arrives. Client requests will be paused until the JWKS is fetched. If false, the proxy listener will wait for the JWKS to be fetched before being activated. Default value is false. type: boolean useSNI: description: |- UseSNI determines whether the hostname should be set in SNI header for TLS connection. Default value is false. type: boolean jwksCluster: description: JWKSCluster defines how the specified Remote JWKS URI is to be fetched. properties: connectTimeout: description: |- The timeout for new network connections to hosts in the cluster. If not set, a default value of 5s will be used. type: string discoveryType: description: |- DiscoveryType refers to the service discovery type to use for resolving the cluster. This defaults to STRICT_DNS. Other options include STATIC, LOGICAL_DNS, EDS or ORIGINAL_DST. type: string tlsCertificates: description: |- TLSCertificates refers to the data containing certificate authority certificates to use in verifying a presented peer certificate. If not specified and a peer certificate is presented it will not be verified. Must be either CaCertificateProviderInstance or TrustedCA. properties: caCertificateProviderInstance: description: CaCertificateProviderInstance Certificate provider instance for fetching TLS certificates. properties: certificateName: description: |- CertificateName is used to specify certificate instances or types. For example, "ROOTCA" to specify a root-certificate (validation context) or "example.com" to specify a certificate for a particular domain. The default value is the empty string. type: string instanceName: description: |- InstanceName refers to the certificate provider instance name. The default value is "default". type: string type: object trustedCA: description: |- TrustedCA defines TLS certificate data containing certificate authority certificates to use in verifying a presented peer certificate. Exactly one of Filename, EnvironmentVariable, InlineString or InlineBytes must be specified. properties: environmentVariable: type: string filename: type: string inlineBytes: format: byte type: string inlineString: type: string type: object type: object type: object requestTimeoutMs: description: |- RequestTimeoutMs is the number of milliseconds to time out when making a request for the JWKS. type: integer retryPolicy: description: |- RetryPolicy defines a retry policy for fetching JWKS. There is no retry by default. properties: numRetries: description: |- NumRetries is the number of times to retry fetching the JWKS. The retry strategy uses jittered exponential backoff with a base interval of 1s and max of 10s. Default value is 0. type: integer retryPolicyBackOff: description: |- Retry's backoff policy. Defaults to Envoy's backoff policy. properties: baseInterval: description: |- BaseInterval to be used for the next back off computation. The default value from envoy is 1s. type: string maxInterval: description: |- MaxInternal to be used to specify the maximum interval between retries. Optional but should be greater or equal to BaseInterval. Defaults to 10 times BaseInterval. type: string type: object type: object uri: description: URI is the URI of the server to query for the JWKS. type: string type: object type: object locations: description: |- Locations where the JWT will be present in requests. Envoy will check all of these locations to extract a JWT. If no locations are specified Envoy will default to: 1. Authorization header with Bearer schema: "Authorization: Bearer " 2. accessToken query parameter. items: description: |- JWTLocation is a location where the JWT could be present in requests. Only one of Header, QueryParam, or Cookie can be specified. properties: cookie: description: Cookie defines how to extract a JWT from an HTTP request cookie. properties: name: description: Name is the name of the cookie containing the token. type: string type: object header: description: Header defines how to extract a JWT from an HTTP request header. properties: forward: description: |- Forward defines whether the header with the JWT should be forwarded after the token has been verified. If false, the header will not be forwarded to the backend. Default value is false. type: boolean name: description: Name is the name of the header containing the token. type: string valuePrefix: description: |- ValuePrefix is an optional prefix that precedes the token in the header value. For example, "Bearer " is a standard value prefix for a header named "Authorization", but the prefix is not part of the token itself: "Authorization: Bearer " type: string type: object queryParam: description: |- QueryParam defines how to extract a JWT from an HTTP request query parameter. properties: name: description: Name is the name of the query param containing the token. type: string type: object type: object type: array type: object status: properties: conditions: description: Conditions indicate the latest available observations of a resource's current state. items: description: |- Conditions define a readiness condition for a Consul resource. See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties properties: lastTransitionTime: description: LastTransitionTime is the last time the condition transitioned from one status to another. format: date-time type: string message: description: A human readable message indicating details about the transition. type: string reason: description: The reason for the condition's last transition. type: string status: description: Status of the condition, one of True, False, Unknown. type: string type: description: Type of condition. type: string required: - status - type type: object type: array lastSyncedTime: description: LastSyncedTime is the last time the resource successfully synced with Consul. format: date-time type: string type: object type: object served: true storage: true subresources: status: {} --- # Source: consul/templates/crd-meshes.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 labels: app: consul chart: consul-helm heritage: Helm release: consul component: crd name: meshes.consul.hashicorp.com spec: group: consul.hashicorp.com names: kind: Mesh listKind: MeshList plural: meshes singular: mesh scope: Namespaced versions: - additionalPrinterColumns: - description: The sync status of the resource with Consul jsonPath: .status.conditions[?(@.type=="Synced")].status name: Synced type: string - description: The last successful synced time of the resource with Consul jsonPath: .status.lastSyncedTime name: Last Synced type: date - description: The age of the resource jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: Mesh is the Schema for the mesh API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: MeshSpec defines the desired state of Mesh. properties: allowEnablingPermissiveMutualTLS: description: |- AllowEnablingPermissiveMutualTLS must be true in order to allow setting MutualTLSMode=permissive in either service-defaults or proxy-defaults. type: boolean http: description: HTTP defines the HTTP configuration for the service mesh. properties: incoming: description: Incoming configures settings for incoming HTTP traffic to mesh proxies. properties: requestNormalization: description: |- RequestNormalizationMeshConfig contains options pertaining to the normalization of HTTP requests processed by mesh proxies. properties: headersWithUnderscoresAction: description: |- HeadersWithUnderscoresAction sets the value of the \`headers_with_underscores_action\` option in the Envoy listener's \`HttpConnectionManager\` under \`common_http_protocol_options\`. The default value of this option is empty, which is equivalent to \`ALLOW\`. Refer to the Envoy documentation for more information on available options. type: string insecureDisablePathNormalization: description: |- InsecureDisablePathNormalization sets the value of the \`normalize_path\` option in the Envoy listener's `HttpConnectionManager`. The default value is \`false\`. When set to \`true\` in Consul, \`normalize_path\` is set to \`false\` for the Envoy proxy. This parameter disables the normalization of request URL paths according to RFC 3986, conversion of \`\\\` to \`/\`, and decoding non-reserved %-encoded characters. When using L7 intentions with path match rules, we recommend enabling path normalization in order to avoid match rule circumvention with non-normalized path values. type: boolean mergeSlashes: description: |- MergeSlashes sets the value of the \`merge_slashes\` option in the Envoy listener's \`HttpConnectionManager\`. The default value is \`false\`. This option controls the normalization of request URL paths by merging consecutive \`/\` characters. This normalization is not part of RFC 3986. When using L7 intentions with path match rules, we recommend enabling this setting to avoid match rule circumvention through non-normalized path values, unless legitimate service traffic depends on allowing for repeat \`/\` characters, or upstream services are configured to differentiate between single and multiple slashes. type: boolean pathWithEscapedSlashesAction: description: |- PathWithEscapedSlashesAction sets the value of the \`path_with_escaped_slashes_action\` option in the Envoy listener's \`HttpConnectionManager\`. The default value of this option is empty, which is equivalent to \`IMPLEMENTATION_SPECIFIC_DEFAULT\`. This parameter controls the action taken in response to request URL paths with escaped slashes in the path. When using L7 intentions with path match rules, we recommend enabling this setting to avoid match rule circumvention through non-normalized path values, unless legitimate service traffic depends on allowing for escaped \`/\` or \`\\\` characters, or upstream services are configured to differentiate between escaped and unescaped slashes. Refer to the Envoy documentation for more information on available options. type: string type: object type: object sanitizeXForwardedClientCert: type: boolean type: object peering: description: Peering defines the peering configuration for the service mesh. properties: peerThroughMeshGateways: description: |- PeerThroughMeshGateways determines whether peering traffic between control planes should flow through mesh gateways. If enabled, Consul servers will advertise mesh gateway addresses as their own. Additionally, mesh gateways will configure themselves to expose the local servers using a peering-specific SNI. type: boolean type: object tls: description: TLS defines the TLS configuration for the service mesh. properties: incoming: description: |- Incoming defines the TLS configuration for inbound mTLS connections targeting the public listener on Connect and TerminatingGateway proxy kinds. properties: cipherSuites: description: |- CipherSuites sets the default list of TLS cipher suites to support when negotiating connections using TLS 1.2 or earlier. If unspecified, Envoy will use a default server cipher list. The list of supported cipher suites can be seen in https://github.com/hashicorp/consul/blob/v1.11.2/types/tls.go#L154-L169 and is dependent on underlying support in Envoy. Future releases of Envoy may remove currently-supported but insecure cipher suites, and future releases of Consul may add new supported cipher suites if any are added to Envoy. items: type: string type: array tlsMaxVersion: description: |- TLSMaxVersion sets the default maximum TLS version supported. Must be greater than or equal to `TLSMinVersion`. One of `TLS_AUTO`, `TLSv1_0`, `TLSv1_1`, `TLSv1_2`, or `TLSv1_3`. If unspecified, Envoy will default to TLS 1.3 as a max version for incoming connections. type: string tlsMinVersion: description: |- TLSMinVersion sets the default minimum TLS version supported. One of `TLS_AUTO`, `TLSv1_0`, `TLSv1_1`, `TLSv1_2`, or `TLSv1_3`. If unspecified, Envoy v1.22.0 and newer will default to TLS 1.2 as a min version, while older releases of Envoy default to TLS 1.0. type: string type: object outgoing: description: |- Outgoing defines the TLS configuration for outbound mTLS connections dialing upstreams from Connect and IngressGateway proxy kinds. properties: cipherSuites: description: |- CipherSuites sets the default list of TLS cipher suites to support when negotiating connections using TLS 1.2 or earlier. If unspecified, Envoy will use a default server cipher list. The list of supported cipher suites can be seen in https://github.com/hashicorp/consul/blob/v1.11.2/types/tls.go#L154-L169 and is dependent on underlying support in Envoy. Future releases of Envoy may remove currently-supported but insecure cipher suites, and future releases of Consul may add new supported cipher suites if any are added to Envoy. items: type: string type: array tlsMaxVersion: description: |- TLSMaxVersion sets the default maximum TLS version supported. Must be greater than or equal to `TLSMinVersion`. One of `TLS_AUTO`, `TLSv1_0`, `TLSv1_1`, `TLSv1_2`, or `TLSv1_3`. If unspecified, Envoy will default to TLS 1.3 as a max version for incoming connections. type: string tlsMinVersion: description: |- TLSMinVersion sets the default minimum TLS version supported. One of `TLS_AUTO`, `TLSv1_0`, `TLSv1_1`, `TLSv1_2`, or `TLSv1_3`. If unspecified, Envoy v1.22.0 and newer will default to TLS 1.2 as a min version, while older releases of Envoy default to TLS 1.0. type: string type: object type: object transparentProxy: description: TransparentProxy controls the configuration specific to proxies in "transparent" mode. Added in v1.10.0. properties: meshDestinationsOnly: description: |- MeshDestinationsOnly determines whether sidecar proxies operating in "transparent" mode can proxy traffic to IP addresses not registered in Consul's catalog. If enabled, traffic will only be proxied to upstreams with service registrations in the catalog. type: boolean type: object validateClusters: description: |- ValidateClusters controls whether the clusters the route table refers to are validated. The default value is false. When set to false and a route refers to a cluster that does not exist, the route table loads and routing to a non-existent cluster results in a 404. When set to true and the route is set to a cluster that do not exist, the route table will not load. For more information, refer to [HTTP route configuration in the Envoy docs](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route.proto#envoy-v3-api-field-config-route-v3-routeconfiguration-validate-clusters) for more details. type: boolean type: object status: properties: conditions: description: Conditions indicate the latest available observations of a resource's current state. items: description: |- Conditions define a readiness condition for a Consul resource. See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties properties: lastTransitionTime: description: LastTransitionTime is the last time the condition transitioned from one status to another. format: date-time type: string message: description: A human readable message indicating details about the transition. type: string reason: description: The reason for the condition's last transition. type: string status: description: Status of the condition, one of True, False, Unknown. type: string type: description: Type of condition. type: string required: - status - type type: object type: array lastSyncedTime: description: LastSyncedTime is the last time the resource successfully synced with Consul. format: date-time type: string type: object type: object served: true storage: true subresources: status: {} --- # Source: consul/templates/crd-meshservices.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 labels: app: consul chart: consul-helm heritage: Helm release: consul component: crd name: meshservices.consul.hashicorp.com spec: group: consul.hashicorp.com names: kind: MeshService listKind: MeshServiceList plural: meshservices singular: meshservice scope: Namespaced versions: - name: v1alpha1 schema: openAPIV3Schema: description: MeshService holds a reference to an externally managed Consul Service Mesh service. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: Spec defines the desired state of MeshService. properties: name: description: Name holds the service name for a Consul service. type: string peer: description: |- Peer optionally specifies the name of the peer exporting the Consul service. If not specified, the Consul service is assumed to be in the local datacenter. type: string type: object type: object served: true storage: true --- # Source: consul/templates/crd-proxydefaults.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 labels: app: consul chart: consul-helm heritage: Helm release: consul component: crd name: proxydefaults.consul.hashicorp.com spec: group: consul.hashicorp.com names: kind: ProxyDefaults listKind: ProxyDefaultsList plural: proxydefaults shortNames: - proxy-defaults singular: proxydefaults scope: Namespaced versions: - additionalPrinterColumns: - description: The sync status of the resource with Consul jsonPath: .status.conditions[?(@.type=="Synced")].status name: Synced type: string - description: The last successful synced time of the resource with Consul jsonPath: .status.lastSyncedTime name: Last Synced type: date - description: The age of the resource jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: ProxyDefaults is the Schema for the proxydefaults API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: ProxyDefaultsSpec defines the desired state of ProxyDefaults. properties: accessLogs: description: AccessLogs controls all envoy instances' access logging configuration. properties: disableListenerLogs: description: |- DisableListenerLogs turns off just listener logs for connections rejected by Envoy because they don't have a matching listener filter. type: boolean enabled: description: Enabled turns on all access logging type: boolean jsonFormat: description: |- JSONFormat is a JSON-formatted string of an Envoy access log format dictionary. See for more info on formatting: https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#format-dictionaries Defining JSONFormat and TextFormat is invalid. type: string path: description: Path is the output file to write logs for file-type logging type: string textFormat: description: |- TextFormat is a representation of Envoy access logs format. See for more info on formatting: https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#format-strings Defining JSONFormat and TextFormat is invalid. type: string type: description: |- Type selects the output for logs one of "file", "stderr". "stdout" type: string type: object config: description: |- Config is an arbitrary map of configuration values used by Connect proxies. Any values that your proxy allows can be configured globally here. Supports JSON config values. See https://www.consul.io/docs/connect/proxies/envoy#configuration-formatting type: object x-kubernetes-preserve-unknown-fields: true envoyExtensions: description: EnvoyExtensions are a list of extensions to modify Envoy proxy configuration. items: description: EnvoyExtension has configuration for an extension that patches Envoy resources. properties: arguments: type: object x-kubernetes-preserve-unknown-fields: true name: type: string required: type: boolean type: object type: array expose: description: Expose controls the default expose path configuration for Envoy. properties: checks: description: |- Checks defines whether paths associated with Consul checks will be exposed. This flag triggers exposing all HTTP and GRPC check paths registered for the service. type: boolean paths: description: Paths is the list of paths exposed through the proxy. items: properties: listenerPort: description: ListenerPort defines the port of the proxy's listener for exposed paths. type: integer localPathPort: description: LocalPathPort is the port that the service is listening on for the given path. type: integer path: description: Path is the path to expose through the proxy, ie. "/metrics". type: string protocol: description: |- Protocol describes the upstream's service protocol. Valid values are "http" and "http2", defaults to "http". type: string type: object type: array type: object failoverPolicy: description: FailoverPolicy specifies the exact mechanism used for failover. properties: mode: description: |- Mode specifies the type of failover that will be performed. Valid values are "sequential", "" (equivalent to "sequential") and "order-by-locality". type: string regions: description: |- Regions is the ordered list of the regions of the failover targets. Valid values can be "us-west-1", "us-west-2", and so on. items: type: string type: array type: object meshGateway: description: MeshGateway controls the default mesh gateway configuration for this service. properties: mode: description: |- Mode is the mode that should be used for the upstream connection. One of none, local, or remote. type: string type: object mode: description: |- Mode can be one of "direct" or "transparent". "transparent" represents that inbound and outbound application traffic is being captured and redirected through the proxy. This mode does not enable the traffic redirection itself. Instead it signals Consul to configure Envoy as if traffic is already being redirected. "direct" represents that the proxy's listeners must be dialed directly by the local application and other proxies. Note: This cannot be set using the CRD and should be set using annotations on the services that are part of the mesh. type: string mutualTLSMode: description: |- MutualTLSMode controls whether mutual TLS is required for all incoming connections when transparent proxy is enabled. This can be set to "permissive" or "strict". "strict" is the default which requires mutual TLS for incoming connections. In the insecure "permissive" mode, connections to the sidecar proxy public listener port require mutual TLS, but connections to the service port do not require mutual TLS and are proxied to the application unmodified. Note: Intentions are not enforced for non-mTLS connections. To keep your services secure, we recommend using "strict" mode whenever possible and enabling "permissive" mode only when necessary. type: string prioritizeByLocality: description: |- PrioritizeByLocality controls whether the locality of services within the local partition will be used to prioritize connectivity. properties: mode: description: |- Mode specifies the type of prioritization that will be performed when selecting nodes in the local partition. Valid values are: "" (default "none"), "none", and "failover". type: string type: object transparentProxy: description: |- TransparentProxy controls configuration specific to proxies in transparent mode. Note: This cannot be set using the CRD and should be set using annotations on the services that are part of the mesh. properties: dialedDirectly: description: |- DialedDirectly indicates whether transparent proxies can dial this proxy instance directly. The discovery chain is not considered when dialing a service instance directly. This setting is useful when addressing stateful services, such as a database cluster with a leader node. type: boolean outboundListenerPort: description: |- OutboundListenerPort is the port of the listener where outbound application traffic is being redirected to. type: integer type: object type: object status: properties: conditions: description: Conditions indicate the latest available observations of a resource's current state. items: description: |- Conditions define a readiness condition for a Consul resource. See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties properties: lastTransitionTime: description: LastTransitionTime is the last time the condition transitioned from one status to another. format: date-time type: string message: description: A human readable message indicating details about the transition. type: string reason: description: The reason for the condition's last transition. type: string status: description: Status of the condition, one of True, False, Unknown. type: string type: description: Type of condition. type: string required: - status - type type: object type: array lastSyncedTime: description: LastSyncedTime is the last time the resource successfully synced with Consul. format: date-time type: string type: object type: object served: true storage: true subresources: status: {} --- # Source: consul/templates/crd-ratelimits.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 labels: app: consul chart: consul-helm heritage: Helm release: consul component: crd name: ratelimits.consul.hashicorp.com spec: group: consul.hashicorp.com names: kind: RateLimit listKind: RateLimitList plural: ratelimits singular: ratelimit scope: Cluster versions: - additionalPrinterColumns: - description: The sync status of the resource with Consul jsonPath: .status.conditions[?(@.type=="Synced")].status name: Synced type: string - description: The last successful synced time of the resource with Consul jsonPath: .status.lastSyncedTime name: Last Synced type: date - description: The age of the resource jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: RateLimit is the Schema for the ratelimits API. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: RateLimitSpec defines the desired state of RateLimit. properties: config: description: Config holds the global rate limit configuration. properties: readRate: description: ReadRate is the rate limit for read operations. If nil, defaults to unlimited. type: number writeRate: description: WriteRate is the rate limit for write operations. If nil, defaults to unlimited. type: number priority: description: Priority enables stricter rate limiting in emergency situations. type: boolean excludeEndpoints: description: ExcludeEndpoints lists RPC methods that should bypass rate limiting. items: type: string type: array type: object required: - config type: object status: properties: conditions: description: Conditions indicate the latest available observations of a resource's current state. items: description: |- Conditions define a readiness condition for a Consul resource. See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties properties: lastTransitionTime: description: LastTransitionTime is the last time the condition transitioned from one status to another. format: date-time type: string message: description: A human readable message indicating details about the transition. type: string reason: description: The reason for the condition's last transition. type: string status: description: Status of the condition, one of True, False, Unknown. type: string type: description: Type of condition. type: string required: - status - type type: object type: array lastSyncedTime: description: LastSyncedTime is the last time the resource successfully synced with Consul. format: date-time type: string type: object type: object served: true storage: true subresources: status: {} --- # Source: consul/templates/crd-referencegrants-external.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/1538 gateway.networking.k8s.io/bundle-version: v0.6.2 gateway.networking.k8s.io/channel: experimental creationTimestamp: null labels: # app: consul # chart: consul-helm # heritage: Helm # release: consul name: consul-v1-refrencegrantss component: crd name: referencegrants.gateway.networking.k8s.io spec: group: gateway.networking.k8s.io names: categories: - gateway-api kind: ReferenceGrant listKind: ReferenceGrantList plural: referencegrants shortNames: - refgrant singular: referencegrant scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha2 schema: openAPIV3Schema: description: "ReferenceGrant identifies kinds of resources in other namespaces that are trusted to reference the specified kinds of resources in the same namespace as the policy. \n Each ReferenceGrant can be used to represent a unique trust relationship. Additional Reference Grants can be used to add to the set of trusted sources of inbound references for the namespace they are defined within. \n All cross-namespace references in Gateway API (with the exception of cross-namespace Gateway-route attachment) require a ReferenceGrant. \n ReferenceGrant is a form of runtime verification allowing users to assert which cross-namespace object references are permitted. Implementations that support ReferenceGrant MUST NOT permit cross-namespace references which have no grant, and MUST respond to the removal of a grant by revoking the access that the grant allowed. \n Support: Core" properties: apiVersion: description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' type: string kind: description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' type: string metadata: type: object spec: description: Spec defines the desired state of ReferenceGrant. properties: from: description: "From describes the trusted namespaces and kinds that can reference the resources described in \"To\". Each entry in this list MUST be considered to be an additional place that references can be valid from, or to put this another way, entries MUST be combined using OR. \n Support: Core" items: description: ReferenceGrantFrom describes trusted namespaces and kinds. properties: group: description: "Group is the group of the referent. When empty, the Kubernetes core API group is inferred. \n Support: Core" maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: description: "Kind is the kind of the referent. Although implementations may support additional resources, the following types are part of the \"Core\" support level for this field. \n When used to permit a SecretObjectReference: \n * Gateway \n When used to permit a BackendObjectReference: \n * GRPCRoute * HTTPRoute * TCPRoute * TLSRoute * UDPRoute" maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string namespace: description: "Namespace is the namespace of the referent. \n Support: Core" maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string required: - group - kind - namespace type: object maxItems: 16 minItems: 1 type: array to: description: "To describes the resources that may be referenced by the resources described in \"From\". Each entry in this list MUST be considered to be an additional place that references can be valid to, or to put this another way, entries MUST be combined using OR. \n Support: Core" items: description: ReferenceGrantTo describes what Kinds are allowed as targets of the references. properties: group: description: "Group is the group of the referent. When empty, the Kubernetes core API group is inferred. \n Support: Core" maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: description: "Kind is the kind of the referent. Although implementations may support additional resources, the following types are part of the \"Core\" support level for this field: \n * Secret when used to permit a SecretObjectReference * Service when used to permit a BackendObjectReference" maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: Name is the name of the referent. When unspecified, this policy refers to all resources of the specified Group and Kind in the local namespace. maxLength: 253 minLength: 1 type: string required: - group - kind type: object maxItems: 16 minItems: 1 type: array required: - from - to type: object type: object served: true storage: false subresources: {} - additionalPrinterColumns: - jsonPath: .metadata.creationTimestamp name: Age type: date name: v1beta1 schema: openAPIV3Schema: description: "ReferenceGrant identifies kinds of resources in other namespaces that are trusted to reference the specified kinds of resources in the same namespace as the policy. \n Each ReferenceGrant can be used to represent a unique trust relationship. Additional Reference Grants can be used to add to the set of trusted sources of inbound references for the namespace they are defined within. \n All cross-namespace references in Gateway API (with the exception of cross-namespace Gateway-route attachment) require a ReferenceGrant. \n ReferenceGrant is a form of runtime verification allowing users to assert which cross-namespace object references are permitted. Implementations that support ReferenceGrant MUST NOT permit cross-namespace references which have no grant, and MUST respond to the removal of a grant by revoking the access that the grant allowed. \n Support: Core" properties: apiVersion: description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' type: string kind: description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' type: string metadata: type: object spec: description: Spec defines the desired state of ReferenceGrant. properties: from: description: "From describes the trusted namespaces and kinds that can reference the resources described in \"To\". Each entry in this list MUST be considered to be an additional place that references can be valid from, or to put this another way, entries MUST be combined using OR. \n Support: Core" items: description: ReferenceGrantFrom describes trusted namespaces and kinds. properties: group: description: "Group is the group of the referent. When empty, the Kubernetes core API group is inferred. \n Support: Core" maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: description: "Kind is the kind of the referent. Although implementations may support additional resources, the following types are part of the \"Core\" support level for this field. \n When used to permit a SecretObjectReference: \n * Gateway \n When used to permit a BackendObjectReference: \n * GRPCRoute * HTTPRoute * TCPRoute * TLSRoute * UDPRoute" maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string namespace: description: "Namespace is the namespace of the referent. \n Support: Core" maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string required: - group - kind - namespace type: object maxItems: 16 minItems: 1 type: array to: description: "To describes the resources that may be referenced by the resources described in \"From\". Each entry in this list MUST be considered to be an additional place that references can be valid to, or to put this another way, entries MUST be combined using OR. \n Support: Core" items: description: ReferenceGrantTo describes what Kinds are allowed as targets of the references. properties: group: description: "Group is the group of the referent. When empty, the Kubernetes core API group is inferred. \n Support: Core" maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: description: "Kind is the kind of the referent. Although implementations may support additional resources, the following types are part of the \"Core\" support level for this field: \n * Secret when used to permit a SecretObjectReference * Service when used to permit a BackendObjectReference" maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: Name is the name of the referent. When unspecified, this policy refers to all resources of the specified Group and Kind in the local namespace. maxLength: 253 minLength: 1 type: string required: - group - kind type: object maxItems: 16 minItems: 1 type: array required: - from - to type: object type: object served: true storage: true subresources: {} status: acceptedNames: kind: "" plural: "" conditions: [] storedVersions: [] --- # Source: consul/templates/crd-registrations.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 labels: app: consul chart: consul-helm heritage: Helm release: consul component: crd name: registrations.consul.hashicorp.com spec: group: consul.hashicorp.com names: kind: Registration listKind: RegistrationList plural: registrations singular: registration scope: Cluster versions: - name: v1alpha1 schema: openAPIV3Schema: description: Registration defines the resource for working with service registrations. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: Spec defines the desired state of Registration. properties: address: type: string check: description: HealthCheck is used to represent a single check. properties: checkId: type: string definition: description: |- HealthCheckDefinition is used to store the details about a health check's execution. properties: body: type: string deregisterCriticalServiceAfterDuration: type: string grpc: type: string grpcUseTLS: type: boolean header: additionalProperties: items: type: string type: array type: object http: type: string intervalDuration: type: string method: type: string osService: type: string tcp: type: string tcpUseTLS: type: boolean timeoutDuration: type: string tlsServerName: type: string tlsSkipVerify: type: boolean udp: type: string required: - intervalDuration type: object exposedPort: type: integer name: type: string namespace: type: string node: type: string notes: type: string output: type: string partition: type: string serviceId: type: string serviceName: type: string status: type: string type: type: string required: - checkId - definition - name - serviceId - serviceName - status type: object datacenter: type: string id: type: string locality: properties: region: type: string zone: type: string type: object node: type: string nodeMeta: additionalProperties: type: string type: object partition: type: string service: properties: address: type: string enableTagOverride: type: boolean id: type: string locality: properties: region: type: string zone: type: string type: object meta: additionalProperties: type: string type: object name: type: string namespace: type: string partition: type: string port: type: integer socketPath: type: string taggedAddresses: additionalProperties: properties: address: type: string port: type: integer required: - address - port type: object type: object tags: items: type: string type: array weights: properties: passing: type: integer warning: type: integer required: - passing - warning type: object required: - name - port type: object skipNodeUpdate: type: boolean taggedAddresses: additionalProperties: type: string type: object type: object status: description: RegistrationStatus defines the observed state of Registration. properties: conditions: description: Conditions indicate the latest available observations of a resource's current state. items: description: |- Conditions define a readiness condition for a Consul resource. See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties properties: lastTransitionTime: description: LastTransitionTime is the last time the condition transitioned from one status to another. format: date-time type: string message: description: A human readable message indicating details about the transition. type: string reason: description: The reason for the condition's last transition. type: string status: description: Status of the condition, one of True, False, Unknown. type: string type: description: Type of condition. type: string required: - status - type type: object type: array lastSyncedTime: description: LastSyncedTime is the last time the resource successfully synced with Consul. format: date-time type: string type: object type: object served: true storage: true subresources: status: {} --- # Source: consul/templates/crd-routeauthfilters.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 labels: app: consul chart: consul-helm heritage: Helm release: consul component: crd name: routeauthfilters.consul.hashicorp.com spec: group: consul.hashicorp.com names: kind: RouteAuthFilter listKind: RouteAuthFilterList plural: routeauthfilters singular: routeauthfilter scope: Namespaced versions: - additionalPrinterColumns: - description: The sync status of the resource with Consul jsonPath: .status.conditions[?(@.type=="Synced")].status name: Synced type: string - description: The last successful synced time of the resource with Consul jsonPath: .status.lastSyncedTime name: Last Synced type: date - description: The age of the resource jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: RouteAuthFilter is the Schema for the routeauthfilters API. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: RouteAuthFilterSpec defines the desired state of RouteAuthFilter. properties: jwt: description: This re-uses the JWT requirement type from Gateway Policy Types. properties: providers: description: Providers is a list of providers to consider when verifying a JWT. items: description: GatewayJWTProvider holds the provider and claim verification information. properties: name: description: |- Name is the name of the JWT provider. There MUST be a corresponding "jwt-provider" config entry with this name. type: string verifyClaims: description: VerifyClaims is a list of additional claims to verify in a JWT's payload. items: description: GatewayJWTClaimVerification holds the actual claim information to be verified. properties: path: description: Path is the path to the claim in the token JSON. items: type: string type: array value: description: |- Value is the expected value at the given path: - If the type at the path is a list then we verify that this value is contained in the list. - If the type at the path is a string then we verify that this value matches. type: string required: - path - value type: object type: array required: - name type: object type: array required: - providers type: object type: object status: description: RouteAuthFilterStatus defines the observed state of the gateway. properties: conditions: default: - lastTransitionTime: "1970-01-01T00:00:00Z" message: Waiting for controller reason: Pending status: Unknown type: Accepted - lastTransitionTime: "1970-01-01T00:00:00Z" message: Waiting for controller reason: Pending status: Unknown type: ResolvedRefs description: |- Conditions describe the current conditions of the Filter. Known condition types are: * "Accepted" * "ResolvedRefs" items: description: "Condition contains details for one aspect of the current state of this API Resource.\n---\nThis struct is intended for direct use as an array at the field path .status.conditions. For example,\n\n\n\ttype FooStatus struct{\n\t // Represents the observations of a foo's current state.\n\t // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t \ // other fields\n\t}" properties: lastTransitionTime: description: |- lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: |- message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: |- observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: |- reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: |- type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object maxItems: 8 type: array x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map type: object type: object served: true storage: true subresources: status: {} --- # Source: consul/templates/crd-routeretryfilters.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 labels: app: consul chart: consul-helm heritage: Helm release: consul component: crd name: routeretryfilters.consul.hashicorp.com spec: group: consul.hashicorp.com names: kind: RouteRetryFilter listKind: RouteRetryFilterList plural: routeretryfilters singular: routeretryfilter scope: Namespaced versions: - additionalPrinterColumns: - description: The sync status of the resource with Consul jsonPath: .status.conditions[?(@.type=="Synced")].status name: Synced type: string - description: The last successful synced time of the resource with Consul jsonPath: .status.lastSyncedTime name: Last Synced type: date - description: The age of the resource jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: RouteRetryFilter is the Schema for the routeretryfilters API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: RouteRetryFilterSpec defines the desired state of RouteRetryFilter. properties: numRetries: format: int32 minimum: 0 type: integer retryOn: items: type: string type: array retryOnConnectFailure: type: boolean retryOnStatusCodes: items: format: int32 type: integer type: array type: object status: properties: conditions: description: Conditions indicate the latest available observations of a resource's current state. items: description: |- Conditions define a readiness condition for a Consul resource. See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties properties: lastTransitionTime: description: LastTransitionTime is the last time the condition transitioned from one status to another. format: date-time type: string message: description: A human readable message indicating details about the transition. type: string reason: description: The reason for the condition's last transition. type: string status: description: Status of the condition, one of True, False, Unknown. type: string type: description: Type of condition. type: string required: - status - type type: object type: array lastSyncedTime: description: LastSyncedTime is the last time the resource successfully synced with Consul. format: date-time type: string type: object type: object served: true storage: true subresources: status: {} --- # Source: consul/templates/crd-routetimeoutfilters.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 labels: app: consul chart: consul-helm heritage: Helm release: consul component: crd name: routetimeoutfilters.consul.hashicorp.com spec: group: consul.hashicorp.com names: kind: RouteTimeoutFilter listKind: RouteTimeoutFilterList plural: routetimeoutfilters singular: routetimeoutfilter scope: Namespaced versions: - additionalPrinterColumns: - description: The sync status of the resource with Consul jsonPath: .status.conditions[?(@.type=="Synced")].status name: Synced type: string - description: The last successful synced time of the resource with Consul jsonPath: .status.lastSyncedTime name: Last Synced type: date - description: The age of the resource jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: RouteTimeoutFilter is the Schema for the httproutetimeoutfilters API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: RouteTimeoutFilterSpec defines the desired state of RouteTimeoutFilter. properties: idleTimeout: format: duration type: string requestTimeout: format: duration type: string type: object status: properties: conditions: description: Conditions indicate the latest available observations of a resource's current state. items: description: |- Conditions define a readiness condition for a Consul resource. See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties properties: lastTransitionTime: description: LastTransitionTime is the last time the condition transitioned from one status to another. format: date-time type: string message: description: A human readable message indicating details about the transition. type: string reason: description: The reason for the condition's last transition. type: string status: description: Status of the condition, one of True, False, Unknown. type: string type: description: Type of condition. type: string required: - status - type type: object type: array lastSyncedTime: description: LastSyncedTime is the last time the resource successfully synced with Consul. format: date-time type: string type: object type: object served: true storage: true subresources: status: {} --- # Source: consul/templates/crd-routetlssdsfilters.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 labels: app: consul chart: consul-helm heritage: Helm release: consul component: crd name: routetlssdsfilters.consul.hashicorp.com spec: group: consul.hashicorp.com names: kind: RouteTLSSDSFilter listKind: RouteTLSSDSFilterList plural: routetlssdsfilters singular: routetlssdsfilter scope: Namespaced versions: - additionalPrinterColumns: - description: The sync status of the resource with Consul jsonPath: .status.conditions[?(@.type=="Synced")].status name: Synced type: string - description: The last successful synced time of the resource with Consul jsonPath: .status.lastSyncedTime name: Last Synced type: date - description: The age of the resource jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: RouteTLSSDSFilter configures route/backend TLS SDS settings for API Gateway HTTPRoute backend refs. properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: RouteTLSSDSFilterSpec defines the desired state of RouteTLSSDSFilter. properties: sds: description: SDS allows configuring TLS certificate from an SDS service. properties: certResource: description: CertResource is the SDS resource name to request when fetching the certificate from the SDS service. type: string clusterName: description: ClusterName is the SDS cluster name to connect to, to retrieve certificates. type: string type: object type: object status: properties: conditions: description: Conditions indicate the latest available observations of a resource's current state. items: description: |- Conditions define a readiness condition for a Consul resource. See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties properties: lastTransitionTime: description: LastTransitionTime is the last time the condition transitioned from one status to another. format: date-time type: string message: description: A human readable message indicating details about the transition. type: string reason: description: The reason for the condition's last transition. type: string status: description: Status of the condition, one of True, False, Unknown. type: string type: description: Type of condition. type: string required: - status - type type: object type: array lastSyncedTime: description: LastSyncedTime is the last time the resource successfully synced with Consul. format: date-time type: string type: object type: object served: true storage: true subresources: status: {} --- # Source: consul/templates/crd-samenessgroups.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 labels: app: consul chart: consul-helm heritage: Helm release: consul component: crd name: samenessgroups.consul.hashicorp.com spec: group: consul.hashicorp.com names: kind: SamenessGroup listKind: SamenessGroupList plural: samenessgroups shortNames: - sameness-group singular: samenessgroup scope: Namespaced versions: - additionalPrinterColumns: - description: The sync status of the resource with Consul jsonPath: .status.conditions[?(@.type=="Synced")].status name: Synced type: string - description: The last successful synced time of the resource with Consul jsonPath: .status.lastSyncedTime name: Last Synced type: date - description: The age of the resource jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: SamenessGroup is the Schema for the samenessgroups API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: SamenessGroupSpec defines the desired state of SamenessGroup. properties: defaultForFailover: description: |- DefaultForFailover indicates that upstream requests to members of the given sameness group will implicitly failover between members of this sameness group. When DefaultForFailover is true, the local partition must be a member of the sameness group or IncludeLocal must be set to true. type: boolean includeLocal: description: |- IncludeLocal is used to include the local partition as the first member of the sameness group. The local partition can only be a member of a single sameness group. type: boolean members: description: |- Members are the partitions and peers that are part of the sameness group. If a member of a sameness group does not exist, it will be ignored. items: properties: partition: description: |- The partitions and peers that are part of the sameness group. A sameness group member cannot define both peer and partition at the same time. type: string peer: type: string type: object type: array type: object status: properties: conditions: description: Conditions indicate the latest available observations of a resource's current state. items: description: |- Conditions define a readiness condition for a Consul resource. See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties properties: lastTransitionTime: description: LastTransitionTime is the last time the condition transitioned from one status to another. format: date-time type: string message: description: A human readable message indicating details about the transition. type: string reason: description: The reason for the condition's last transition. type: string status: description: Status of the condition, one of True, False, Unknown. type: string type: description: Type of condition. type: string required: - status - type type: object type: array lastSyncedTime: description: LastSyncedTime is the last time the resource successfully synced with Consul. format: date-time type: string type: object type: object served: true storage: true subresources: status: {} --- # Source: consul/templates/crd-servicedefaults.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 labels: app: consul chart: consul-helm heritage: Helm release: consul component: crd name: servicedefaults.consul.hashicorp.com spec: group: consul.hashicorp.com names: kind: ServiceDefaults listKind: ServiceDefaultsList plural: servicedefaults shortNames: - service-defaults singular: servicedefaults scope: Namespaced versions: - additionalPrinterColumns: - description: The sync status of the resource with Consul jsonPath: .status.conditions[?(@.type=="Synced")].status name: Synced type: string - description: The last successful synced time of the resource with Consul jsonPath: .status.lastSyncedTime name: Last Synced type: date - description: The age of the resource jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: ServiceDefaults is the Schema for the servicedefaults API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: ServiceDefaultsSpec defines the desired state of ServiceDefaults. properties: balanceInboundConnections: description: |- BalanceInboundConnections sets the strategy for allocating inbound connections to the service across proxy threads. The only supported value is exact_balance. By default, no connection balancing is used. Refer to the Envoy Connection Balance config for details. type: string destination: description: |- Destination is an address(es)/port combination that represents an endpoint outside the mesh. This is only valid when the mesh is configured in "transparent" mode. Destinations live outside of Consul's catalog, and because of this, they do not require an artificial node to be created. properties: addresses: description: |- Addresses is a list of IPs and/or hostnames that can be dialed and routed through a terminating gateway. items: type: string type: array port: description: |- Port is the port that can be dialed on any of the addresses in this Destination. format: int32 type: integer type: object envoyExtensions: description: EnvoyExtensions are a list of extensions to modify Envoy proxy configuration. items: description: EnvoyExtension has configuration for an extension that patches Envoy resources. properties: arguments: type: object x-kubernetes-preserve-unknown-fields: true name: type: string required: type: boolean type: object type: array expose: description: Expose controls the default expose path configuration for Envoy. properties: checks: description: |- Checks defines whether paths associated with Consul checks will be exposed. This flag triggers exposing all HTTP and GRPC check paths registered for the service. type: boolean paths: description: Paths is the list of paths exposed through the proxy. items: properties: listenerPort: description: ListenerPort defines the port of the proxy's listener for exposed paths. type: integer localPathPort: description: LocalPathPort is the port that the service is listening on for the given path. type: integer path: description: Path is the path to expose through the proxy, ie. "/metrics". type: string protocol: description: |- Protocol describes the upstream's service protocol. Valid values are "http" and "http2", defaults to "http". type: string type: object type: array type: object externalSNI: description: |- ExternalSNI is an optional setting that allows for the TLS SNI value to be changed to a non-connect value when federating with an external system. type: string localConnectTimeoutMs: description: |- LocalConnectTimeoutMs is the number of milliseconds allowed to make connections to the local application instance before timing out. Defaults to 5000. type: integer localRequestTimeoutMs: description: |- LocalRequestTimeoutMs is the timeout for HTTP requests to the local application instance in milliseconds. Applies to HTTP-based protocols only. If not specified, inherits the Envoy default for route timeouts (15s). type: integer maxInboundConnections: description: |- MaxInboundConnections is the maximum number of concurrent inbound connections to each service instance. Defaults to 0 (using consul's default) if not set. type: integer meshGateway: description: MeshGateway controls the default mesh gateway configuration for this service. properties: mode: description: |- Mode is the mode that should be used for the upstream connection. One of none, local, or remote. type: string type: object mode: description: |- Mode can be one of "direct" or "transparent". "transparent" represents that inbound and outbound application traffic is being captured and redirected through the proxy. This mode does not enable the traffic redirection itself. Instead it signals Consul to configure Envoy as if traffic is already being redirected. "direct" represents that the proxy's listeners must be dialed directly by the local application and other proxies. Note: This cannot be set using the CRD and should be set using annotations on the services that are part of the mesh. type: string mutualTLSMode: description: |- MutualTLSMode controls whether mutual TLS is required for all incoming connections when transparent proxy is enabled. This can be set to "permissive" or "strict". "strict" is the default which requires mutual TLS for incoming connections. In the insecure "permissive" mode, connections to the sidecar proxy public listener port require mutual TLS, but connections to the service port do not require mutual TLS and are proxied to the application unmodified. Note: Intentions are not enforced for non-mTLS connections. To keep your services secure, we recommend using "strict" mode whenever possible and enabling "permissive" mode only when necessary. type: string protocol: description: |- Protocol sets the protocol of the service. This is used by Connect proxies for things like observability features and to unlock usage of the service-splitter and service-router config entries for a service. type: string rateLimits: description: |- RateLimits is rate limiting configuration that is applied to inbound traffic for a service. Rate limiting is a Consul enterprise feature. properties: instanceLevel: description: |- InstanceLevel represents rate limit configuration that is applied per service instance. properties: requestsMaxBurst: description: |- RequestsMaxBurst is the maximum number of requests that can be sent in a burst. Should be equal to or greater than RequestsPerSecond. If unset, defaults to RequestsPerSecond. Internally, this is the maximum size of the token bucket used for rate limiting. type: integer requestsPerSecond: description: |- RequestsPerSecond is the average number of requests per second that can be made without being throttled. This field is required if RequestsMaxBurst is set. The allowed number of requests may exceed RequestsPerSecond up to the value specified in RequestsMaxBurst. Internally, this is the refill rate of the token bucket used for rate limiting. type: integer routes: description: |- Routes is a list of rate limits applied to specific routes. For a given request, the first matching route will be applied, if any. Overrides any top-level configuration. items: properties: pathExact: description: Exact path to match. Exactly one of PathExact, PathPrefix, or PathRegex must be specified. type: string pathPrefix: description: Prefix to match. Exactly one of PathExact, PathPrefix, or PathRegex must be specified. type: string pathRegex: description: Regex to match. Exactly one of PathExact, PathPrefix, or PathRegex must be specified. type: string requestsMaxBurst: description: |- RequestsMaxBurst is the maximum number of requests that can be sent in a burst. Should be equal to or greater than RequestsPerSecond. If unset, defaults to RequestsPerSecond. Internally, this is the maximum size of the token bucket used for rate limiting. type: integer requestsPerSecond: description: |- RequestsPerSecond is the average number of requests per second that can be made without being throttled. This field is required if RequestsMaxBurst is set. The allowed number of requests may exceed RequestsPerSecond up to the value specified in RequestsMaxBurst. Internally, this is the refill rate of the token bucket used for rate limiting. type: integer type: object type: array type: object type: object transparentProxy: description: |- TransparentProxy controls configuration specific to proxies in transparent mode. Note: This cannot be set using the CRD and should be set using annotations on the services that are part of the mesh. properties: dialedDirectly: description: |- DialedDirectly indicates whether transparent proxies can dial this proxy instance directly. The discovery chain is not considered when dialing a service instance directly. This setting is useful when addressing stateful services, such as a database cluster with a leader node. type: boolean outboundListenerPort: description: |- OutboundListenerPort is the port of the listener where outbound application traffic is being redirected to. type: integer type: object upstreamConfig: description: |- UpstreamConfig controls default configuration settings that apply across all upstreams, and per-upstream configuration overrides. Note that per-upstream configuration applies across all federated datacenters to the pairing of source and upstream destination services. properties: defaults: description: |- Defaults contains default configuration for all upstreams of a given service. The name field must be empty. properties: connectTimeoutMs: description: |- ConnectTimeoutMs is the number of milliseconds to timeout making a new connection to this upstream. Defaults to 5000 (5 seconds) if not set. type: integer envoyClusterJSON: description: |- EnvoyClusterJSON is a complete override ("escape hatch") for the upstream's cluster. The Connect client TLS certificate and context will be injected overriding any TLS settings present. Note: This escape hatch is NOT compatible with the discovery chain and will be ignored if a discovery chain is active. type: string envoyListenerJSON: description: |- EnvoyListenerJSON is a complete override ("escape hatch") for the upstream's listener. Note: This escape hatch is NOT compatible with the discovery chain and will be ignored if a discovery chain is active. type: string limits: description: |- Limits are the set of limits that are applied to the proxy for a specific upstream of a service instance. properties: maxConcurrentRequests: description: |- MaxConcurrentRequests is the maximum number of in-flight requests that will be allowed to the upstream cluster at a point in time. This is mostly applicable to HTTP/2 clusters since all HTTP/1.1 requests are limited by MaxConnections. type: integer maxConnections: description: |- MaxConnections is the maximum number of connections the local proxy can make to the upstream service. type: integer maxPendingRequests: description: |- MaxPendingRequests is the maximum number of requests that will be queued waiting for an available connection. This is mostly applicable to HTTP/1.1 clusters since all HTTP/2 requests are streamed over a single connection. type: integer type: object meshGateway: description: MeshGatewayConfig controls how Mesh Gateways are configured and used. properties: mode: description: |- Mode is the mode that should be used for the upstream connection. One of none, local, or remote. type: string type: object name: description: Name is only accepted within service ServiceDefaultsSpec.UpstreamConfig.Overrides config entry. type: string namespace: description: Namespace is only accepted within service ServiceDefaultsSpec.UpstreamConfig.Overrides config entry. type: string partition: description: Partition is only accepted within service ServiceDefaultsSpec.UpstreamConfig.Overrides config entry. type: string passiveHealthCheck: description: |- PassiveHealthCheck configuration determines how upstream proxy instances will be monitored for removal from the load balancing pool. properties: baseEjectionTime: description: |- The base time that a host is ejected for. The real time is equal to the base time multiplied by the number of times the host has been ejected and is capped by max_ejection_time (Default 300s). Defaults to 30s. type: string enforcingConsecutive5xx: description: |- EnforcingConsecutive5xx is the % chance that a host will be actually ejected when an outlier status is detected through consecutive 5xx. This setting can be used to disable ejection or to ramp it up slowly. Ex. Setting this to 10 will make it a 10% chance that the host will be ejected. format: int32 type: integer interval: description: |- Interval between health check analysis sweeps. Each sweep may remove hosts or return hosts to the pool. Ex. setting this to "10s" will set the interval to 10 seconds. type: string maxEjectionPercent: description: |- The maximum % of an upstream cluster that can be ejected due to outlier detection. Defaults to 10% but will eject at least one host regardless of the value. format: int32 type: integer maxFailures: description: |- MaxFailures is the count of consecutive failures that results in a host being removed from the pool. format: int32 type: integer type: object peer: description: Peer is only accepted within service ServiceDefaultsSpec.UpstreamConfig.Overrides config entry. type: string protocol: description: |- Protocol describes the upstream's service protocol. Valid values are "tcp", "http" and "grpc". Anything else is treated as tcp. This enables protocol aware features like per-request metrics and connection pooling, tracing, routing etc. type: string type: object overrides: description: |- Overrides is a slice of per-service configuration. The name field is required. items: properties: connectTimeoutMs: description: |- ConnectTimeoutMs is the number of milliseconds to timeout making a new connection to this upstream. Defaults to 5000 (5 seconds) if not set. type: integer envoyClusterJSON: description: |- EnvoyClusterJSON is a complete override ("escape hatch") for the upstream's cluster. The Connect client TLS certificate and context will be injected overriding any TLS settings present. Note: This escape hatch is NOT compatible with the discovery chain and will be ignored if a discovery chain is active. type: string envoyListenerJSON: description: |- EnvoyListenerJSON is a complete override ("escape hatch") for the upstream's listener. Note: This escape hatch is NOT compatible with the discovery chain and will be ignored if a discovery chain is active. type: string limits: description: |- Limits are the set of limits that are applied to the proxy for a specific upstream of a service instance. properties: maxConcurrentRequests: description: |- MaxConcurrentRequests is the maximum number of in-flight requests that will be allowed to the upstream cluster at a point in time. This is mostly applicable to HTTP/2 clusters since all HTTP/1.1 requests are limited by MaxConnections. type: integer maxConnections: description: |- MaxConnections is the maximum number of connections the local proxy can make to the upstream service. type: integer maxPendingRequests: description: |- MaxPendingRequests is the maximum number of requests that will be queued waiting for an available connection. This is mostly applicable to HTTP/1.1 clusters since all HTTP/2 requests are streamed over a single connection. type: integer type: object meshGateway: description: MeshGatewayConfig controls how Mesh Gateways are configured and used. properties: mode: description: |- Mode is the mode that should be used for the upstream connection. One of none, local, or remote. type: string type: object name: description: Name is only accepted within service ServiceDefaultsSpec.UpstreamConfig.Overrides config entry. type: string namespace: description: Namespace is only accepted within service ServiceDefaultsSpec.UpstreamConfig.Overrides config entry. type: string partition: description: Partition is only accepted within service ServiceDefaultsSpec.UpstreamConfig.Overrides config entry. type: string passiveHealthCheck: description: |- PassiveHealthCheck configuration determines how upstream proxy instances will be monitored for removal from the load balancing pool. properties: baseEjectionTime: description: |- The base time that a host is ejected for. The real time is equal to the base time multiplied by the number of times the host has been ejected and is capped by max_ejection_time (Default 300s). Defaults to 30s. type: string enforcingConsecutive5xx: description: |- EnforcingConsecutive5xx is the % chance that a host will be actually ejected when an outlier status is detected through consecutive 5xx. This setting can be used to disable ejection or to ramp it up slowly. Ex. Setting this to 10 will make it a 10% chance that the host will be ejected. format: int32 type: integer interval: description: |- Interval between health check analysis sweeps. Each sweep may remove hosts or return hosts to the pool. Ex. setting this to "10s" will set the interval to 10 seconds. type: string maxEjectionPercent: description: |- The maximum % of an upstream cluster that can be ejected due to outlier detection. Defaults to 10% but will eject at least one host regardless of the value. format: int32 type: integer maxFailures: description: |- MaxFailures is the count of consecutive failures that results in a host being removed from the pool. format: int32 type: integer type: object peer: description: Peer is only accepted within service ServiceDefaultsSpec.UpstreamConfig.Overrides config entry. type: string protocol: description: |- Protocol describes the upstream's service protocol. Valid values are "tcp", "http" and "grpc". Anything else is treated as tcp. This enables protocol aware features like per-request metrics and connection pooling, tracing, routing etc. type: string type: object type: array type: object type: object status: properties: conditions: description: Conditions indicate the latest available observations of a resource's current state. items: description: |- Conditions define a readiness condition for a Consul resource. See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties properties: lastTransitionTime: description: LastTransitionTime is the last time the condition transitioned from one status to another. format: date-time type: string message: description: A human readable message indicating details about the transition. type: string reason: description: The reason for the condition's last transition. type: string status: description: Status of the condition, one of True, False, Unknown. type: string type: description: Type of condition. type: string required: - status - type type: object type: array lastSyncedTime: description: LastSyncedTime is the last time the resource successfully synced with Consul. format: date-time type: string type: object type: object served: true storage: true subresources: status: {} --- # Source: consul/templates/crd-serviceintentions.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 labels: app: consul chart: consul-helm heritage: Helm release: consul component: crd name: serviceintentions.consul.hashicorp.com spec: group: consul.hashicorp.com names: kind: ServiceIntentions listKind: ServiceIntentionsList plural: serviceintentions shortNames: - service-intentions singular: serviceintentions scope: Namespaced versions: - additionalPrinterColumns: - description: The sync status of the resource with Consul jsonPath: .status.conditions[?(@.type=="Synced")].status name: Synced type: string - description: The last successful synced time of the resource with Consul jsonPath: .status.lastSyncedTime name: Last Synced type: date - description: The age of the resource jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: ServiceIntentions is the Schema for the serviceintentions API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: ServiceIntentionsSpec defines the desired state of ServiceIntentions. properties: destination: description: Destination is the intention destination that will have the authorization granted to. properties: name: description: |- Name is the destination of all intentions defined in this config entry. This may be set to the wildcard character (*) to match all services that don't otherwise have intentions defined. type: string namespace: description: |- Namespace specifies the namespace the config entry will apply to. This may be set to the wildcard character (*) to match all services in all namespaces that don't otherwise have intentions defined. type: string type: object jwt: description: JWT specifies the configuration to validate a JSON Web Token for all incoming requests. properties: providers: description: Providers is a list of providers to consider when verifying a JWT. items: properties: name: description: |- Name is the name of the JWT provider. There MUST be a corresponding "jwt-provider" config entry with this name. type: string verifyClaims: description: VerifyClaims is a list of additional claims to verify in a JWT's payload. items: properties: path: description: Path is the path to the claim in the token JSON. items: type: string type: array value: description: |- Value is the expected value at the given path. If the type at the path is a list then we verify that this value is contained in the list. If the type at the path is a string then we verify that this value matches. type: string type: object type: array type: object type: array type: object sources: description: |- Sources is the list of all intention sources and the authorization granted to those sources. The order of this list does not matter, but out of convenience Consul will always store this reverse sorted by intention precedence, as that is the order that they will be evaluated at enforcement time. items: properties: action: description: |- Action is required for an L4 intention, and should be set to one of "allow" or "deny" for the action that should be taken if this intention matches a request. type: string description: description: Description for the intention. This is not used by Consul, but is presented in API responses to assist tooling. type: string name: description: |- Name is the source of the intention. This is the name of a Consul service. The service doesn't need to be registered. type: string namespace: description: Namespace is the namespace for the Name parameter. type: string partition: description: Partition is the Admin Partition for the Name parameter. type: string peer: description: Peer is the peer name for the Name parameter. type: string permissions: description: |- Permissions is the list of all additional L7 attributes that extend the intention match criteria. Permission precedence is applied top to bottom. For any given request the first permission to match in the list is terminal and stops further evaluation. As with L4 intentions, traffic that fails to match any of the provided permissions in this intention will be subject to the default intention behavior is defined by the default ACL policy. This should be omitted for an L4 intention as it is mutually exclusive with the Action field. items: properties: action: description: |- Action is one of "allow" or "deny" for the action that should be taken if this permission matches a request. type: string http: description: HTTP is a set of HTTP-specific authorization criteria. properties: header: description: |- Header is a set of criteria that can match on HTTP request headers. If more than one is configured all must match for the overall match to apply. items: properties: contains: description: Contains matches if the header with the given name contains this value. type: string exact: description: Exact matches if the header with the given name is this value. type: string ignoreCase: description: IgnoreCase ignores the case of the header value when matching with exact, prefix, suffix, or contains. type: boolean invert: description: Invert inverts the logic of the match. type: boolean name: description: Name is the name of the header to match. type: string prefix: description: Prefix matches if the header with the given name has this prefix. type: string present: description: Present matches if the header with the given name is present with any value. type: boolean regex: description: Regex matches if the header with the given name matches this pattern. type: string suffix: description: Suffix matches if the header with the given name has this suffix. type: string type: object type: array methods: description: |- Methods is a list of HTTP methods for which this match applies. If unspecified all HTTP methods are matched. If provided the names must be a valid method. items: type: string type: array pathExact: description: PathExact is the exact path to match on the HTTP request path. type: string pathPrefix: description: PathPrefix is the path prefix to match on the HTTP request path. type: string pathRegex: description: PathRegex is the regular expression to match on the HTTP request path. type: string type: object jwt: description: JWT specifies configuration to validate a JSON Web Token for incoming requests. properties: providers: description: Providers is a list of providers to consider when verifying a JWT. items: properties: name: description: |- Name is the name of the JWT provider. There MUST be a corresponding "jwt-provider" config entry with this name. type: string verifyClaims: description: VerifyClaims is a list of additional claims to verify in a JWT's payload. items: properties: path: description: Path is the path to the claim in the token JSON. items: type: string type: array value: description: |- Value is the expected value at the given path. If the type at the path is a list then we verify that this value is contained in the list. If the type at the path is a string then we verify that this value matches. type: string type: object type: array type: object type: array type: object type: object type: array samenessGroup: description: SamenessGroup is the name of the sameness group, if applicable. type: string type: object type: array type: object status: properties: conditions: description: Conditions indicate the latest available observations of a resource's current state. items: description: |- Conditions define a readiness condition for a Consul resource. See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties properties: lastTransitionTime: description: LastTransitionTime is the last time the condition transitioned from one status to another. format: date-time type: string message: description: A human readable message indicating details about the transition. type: string reason: description: The reason for the condition's last transition. type: string status: description: Status of the condition, one of True, False, Unknown. type: string type: description: Type of condition. type: string required: - status - type type: object type: array lastSyncedTime: description: LastSyncedTime is the last time the resource successfully synced with Consul. format: date-time type: string type: object type: object served: true storage: true subresources: status: {} --- # Source: consul/templates/crd-serviceresolvers.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 labels: app: consul chart: consul-helm heritage: Helm release: consul component: crd name: serviceresolvers.consul.hashicorp.com spec: group: consul.hashicorp.com names: kind: ServiceResolver listKind: ServiceResolverList plural: serviceresolvers shortNames: - service-resolver singular: serviceresolver scope: Namespaced versions: - additionalPrinterColumns: - description: The sync status of the resource with Consul jsonPath: .status.conditions[?(@.type=="Synced")].status name: Synced type: string - description: The last successful synced time of the resource with Consul jsonPath: .status.lastSyncedTime name: Last Synced type: date - description: The age of the resource jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: ServiceResolver is the Schema for the serviceresolvers API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: ServiceResolverSpec defines the desired state of ServiceResolver. properties: connectTimeout: description: |- ConnectTimeout is the timeout for establishing new network connections to this service. type: string defaultSubset: description: |- DefaultSubset is the subset to use when no explicit subset is requested. If empty the unnamed subset is used. type: string failover: additionalProperties: properties: datacenters: description: Datacenters is a fixed list of datacenters to try during failover. items: type: string type: array namespace: description: |- Namespace is the namespace to resolve the requested service from to form the failover group of instances. If empty the current namespace is used. type: string policy: description: Policy specifies the exact mechanism used for failover. properties: mode: description: |- Mode specifies the type of failover that will be performed. Valid values are "sequential", "" (equivalent to "sequential") and "order-by-locality". type: string regions: description: |- Regions is the ordered list of the regions of the failover targets. Valid values can be "us-west-1", "us-west-2", and so on. items: type: string type: array type: object samenessGroup: description: SamenessGroup is the name of the sameness group to try during failover. type: string service: description: |- Service is the service to resolve instead of the default as the failover group of instances during failover. type: string serviceSubset: description: |- ServiceSubset is the named subset of the requested service to resolve as the failover group of instances. If empty the default subset for the requested service is used. type: string targets: description: Targets specifies a fixed list of failover targets to try during failover. items: properties: datacenter: description: Datacenter specifies the datacenter to try during failover. type: string namespace: description: Namespace specifies the namespace to try during failover. type: string partition: description: Partition specifies the partition to try during failover. type: string peer: description: Peer specifies the name of the cluster peer to try during failover. type: string service: description: Service specifies the name of the service to try during failover. type: string serviceSubset: description: ServiceSubset specifies the service subset to try during failover. type: string type: object type: array type: object description: |- Failover controls when and how to reroute traffic to an alternate pool of service instances. The map is keyed by the service subset it applies to and the special string "*" is a wildcard that applies to any subset not otherwise specified here. type: object loadBalancer: description: |- LoadBalancer determines the load balancing policy and configuration for services issuing requests to this upstream service. properties: hashPolicies: description: |- HashPolicies is a list of hash policies to use for hashing load balancing algorithms. Hash policies are evaluated individually and combined such that identical lists result in the same hash. If no hash policies are present, or none are successfully evaluated, then a random backend host will be selected. items: properties: cookieConfig: description: CookieConfig contains configuration for the "cookie" hash policy type. properties: path: description: Path is the path to set for the cookie. type: string session: description: Session determines whether to generate a session cookie with no expiration. type: boolean ttl: description: TTL is the ttl for generated cookies. Cannot be specified for session cookies. type: string type: object field: description: |- Field is the attribute type to hash on. Must be one of "header", "cookie", or "query_parameter". Cannot be specified along with sourceIP. type: string fieldValue: description: |- FieldValue is the value to hash. ie. header name, cookie name, URL query parameter name Cannot be specified along with sourceIP. type: string sourceIP: description: |- SourceIP determines whether the hash should be of the source IP rather than of a field and field value. Cannot be specified along with field or fieldValue. type: boolean terminal: description: |- Terminal will short circuit the computation of the hash when multiple hash policies are present. If a hash is computed when a Terminal policy is evaluated, then that hash will be used and subsequent hash policies will be ignored. type: boolean type: object type: array leastRequestConfig: description: LeastRequestConfig contains configuration for the "leastRequest" policy type. properties: choiceCount: description: ChoiceCount determines the number of random healthy hosts from which to select the one with the least requests. format: int32 type: integer type: object policy: description: Policy is the load balancing policy used to select a host. type: string ringHashConfig: description: RingHashConfig contains configuration for the "ringHash" policy type. properties: maximumRingSize: description: MaximumRingSize determines the maximum number of entries in the hash ring. format: int64 type: integer minimumRingSize: description: MinimumRingSize determines the minimum number of entries in the hash ring. format: int64 type: integer type: object type: object prioritizeByLocality: description: |- PrioritizeByLocality controls whether the locality of services within the local partition will be used to prioritize connectivity. properties: mode: description: |- Mode specifies the type of prioritization that will be performed when selecting nodes in the local partition. Valid values are: "" (default "none"), "none", and "failover". type: string type: object redirect: description: |- Redirect when configured, all attempts to resolve the service this resolver defines will be substituted for the supplied redirect EXCEPT when the redirect has already been applied. When substituting the supplied redirect, all other fields besides Kind, Name, and Redirect will be ignored. properties: datacenter: description: |- Datacenter is the datacenter to resolve the service from instead of the current one. type: string namespace: description: |- Namespace is the Consul namespace to resolve the service from instead of the current namespace. If empty the current namespace is assumed. type: string partition: description: |- Partition is the Consul partition to resolve the service from instead of the current partition. If empty the current partition is assumed. type: string peer: description: |- Peer is the name of the cluster peer to resolve the service from instead of the current one. type: string samenessGroup: description: SamenessGroup is the name of the sameness group to resolve the service from instead of the current one. type: string service: description: Service is a service to resolve instead of the current service. type: string serviceSubset: description: |- ServiceSubset is a named subset of the given service to resolve instead of one defined as that service's DefaultSubset If empty the default subset is used. type: string type: object requestTimeout: description: |- RequestTimeout is the timeout for receiving an HTTP response from this service before the connection is terminated. type: string subsets: additionalProperties: properties: filter: description: |- Filter is the filter expression to be used for selecting instances of the requested service. If empty all healthy instances are returned. This expression can filter on the same selectors as the Health API endpoint. type: string onlyPassing: description: |- OnlyPassing specifies the behavior of the resolver's health check interpretation. If this is set to false, instances with checks in the passing as well as the warning states will be considered healthy. If this is set to true, only instances with checks in the passing state will be considered healthy. type: boolean type: object description: |- Subsets is map of subset name to subset definition for all usable named subsets of this service. The map key is the name of the subset and all names must be valid DNS subdomain elements. This may be empty, in which case only the unnamed default subset will be usable. type: object type: object status: properties: conditions: description: Conditions indicate the latest available observations of a resource's current state. items: description: |- Conditions define a readiness condition for a Consul resource. See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties properties: lastTransitionTime: description: LastTransitionTime is the last time the condition transitioned from one status to another. format: date-time type: string message: description: A human readable message indicating details about the transition. type: string reason: description: The reason for the condition's last transition. type: string status: description: Status of the condition, one of True, False, Unknown. type: string type: description: Type of condition. type: string required: - status - type type: object type: array lastSyncedTime: description: LastSyncedTime is the last time the resource successfully synced with Consul. format: date-time type: string type: object type: object served: true storage: true subresources: status: {} --- # Source: consul/templates/crd-servicerouters.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 labels: app: consul chart: consul-helm heritage: Helm release: consul component: crd name: servicerouters.consul.hashicorp.com spec: group: consul.hashicorp.com names: kind: ServiceRouter listKind: ServiceRouterList plural: servicerouters shortNames: - service-router singular: servicerouter scope: Namespaced versions: - additionalPrinterColumns: - description: The sync status of the resource with Consul jsonPath: .status.conditions[?(@.type=="Synced")].status name: Synced type: string - description: The last successful synced time of the resource with Consul jsonPath: .status.lastSyncedTime name: Last Synced type: date - description: The age of the resource jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: ServiceRouter is the Schema for the servicerouters API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: ServiceRouterSpec defines the desired state of ServiceRouter. properties: routes: description: |- Routes are the list of routes to consider when processing L7 requests. The first route to match in the list is terminal and stops further evaluation. Traffic that fails to match any of the provided routes will be routed to the default service. items: properties: destination: description: Destination controls how to proxy the matching request(s) to a service. properties: idleTimeout: description: |- IdleTimeout is total amount of time permitted for the request stream to be idle. type: string namespace: description: |- Namespace is the Consul namespace to resolve the service from instead of the current namespace. If empty the current namespace is assumed. type: string numRetries: description: NumRetries is the number of times to retry the request when a retryable result occurs format: int32 type: integer partition: description: |- Partition is the Consul partition to resolve the service from instead of the current partition. If empty the current partition is assumed. type: string prefixRewrite: description: |- PrefixRewrite defines how to rewrite the HTTP request path before proxying it to its final destination. This requires that either match.http.pathPrefix or match.http.pathExact be configured on this route. type: string requestHeaders: description: Allow HTTP header manipulation to be configured. properties: add: additionalProperties: type: string description: |- Add is a set of name -> value pairs that should be appended to the request or response (i.e. allowing duplicates if the same header already exists). type: object remove: description: |- Remove is the set of header names that should be stripped from the request or response. items: type: string type: array set: additionalProperties: type: string description: |- Set is a set of name -> value pairs that should be added to the request or response, overwriting any existing header values of the same name. type: object type: object requestTimeout: description: |- RequestTimeout is the total amount of time permitted for the entire downstream request (and retries) to be processed. type: string responseHeaders: description: |- HTTPHeaderModifiers is a set of rules for HTTP header modification that should be performed by proxies as the request passes through them. It can operate on either request or response headers depending on the context in which it is used. properties: add: additionalProperties: type: string description: |- Add is a set of name -> value pairs that should be appended to the request or response (i.e. allowing duplicates if the same header already exists). type: object remove: description: |- Remove is the set of header names that should be stripped from the request or response. items: type: string type: array set: additionalProperties: type: string description: |- Set is a set of name -> value pairs that should be added to the request or response, overwriting any existing header values of the same name. type: object type: object retryOn: description: |- RetryOn is a flat list of conditions for Consul to retry requests based on the response from an upstream service. Refer to the valid conditions here: https://developer.hashicorp.com/consul/docs/connect/config-entries/service-router#routes-destination-retryon items: type: string type: array retryOnConnectFailure: description: RetryOnConnectFailure allows for connection failure errors to trigger a retry. type: boolean retryOnStatusCodes: description: RetryOnStatusCodes is a flat list of http response status codes that are eligible for retry. items: format: int32 type: integer type: array service: description: |- Service is the service to resolve instead of the default service. If empty then the default service name is used. type: string serviceSubset: description: |- ServiceSubset is a named subset of the given service to resolve instead of the one defined as that service's DefaultSubset. If empty, the default subset is used. type: string type: object match: description: |- Match is a set of criteria that can match incoming L7 requests. If empty or omitted it acts as a catch-all. properties: http: description: HTTP is a set of http-specific match criteria. properties: caseInsensitive: description: CaseInsensitive configures PathExact and PathPrefix matches to ignore upper/lower casing. type: boolean header: description: |- Header is a set of criteria that can match on HTTP request headers. If more than one is configured all must match for the overall match to apply. items: properties: exact: description: Exact will match if the header with the given name is this value. type: string invert: description: Invert inverts the logic of the match. type: boolean name: description: Name is the name of the header to match. type: string prefix: description: Prefix will match if the header with the given name has this prefix. type: string present: description: Present will match if the header with the given name is present with any value. type: boolean regex: description: Regex will match if the header with the given name matches this pattern. type: string suffix: description: Suffix will match if the header with the given name has this suffix. type: string required: - name type: object type: array methods: description: |- Methods is a list of HTTP methods for which this match applies. If unspecified all http methods are matched. items: type: string type: array pathExact: description: PathExact is an exact path to match on the HTTP request path. type: string pathPrefix: description: PathPrefix is a path prefix to match on the HTTP request path. type: string pathRegex: description: PathRegex is a regular expression to match on the HTTP request path. type: string queryParam: description: |- QueryParam is a set of criteria that can match on HTTP query parameters. If more than one is configured all must match for the overall match to apply. items: properties: exact: description: Exact will match if the query parameter with the given name is this value. type: string name: description: Name is the name of the query parameter to match on. type: string present: description: |- Present will match if the query parameter with the given name is present with any value. type: boolean regex: description: Regex will match if the query parameter with the given name matches this pattern. type: string required: - name type: object type: array type: object type: object type: object type: array type: object status: properties: conditions: description: Conditions indicate the latest available observations of a resource's current state. items: description: |- Conditions define a readiness condition for a Consul resource. See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties properties: lastTransitionTime: description: LastTransitionTime is the last time the condition transitioned from one status to another. format: date-time type: string message: description: A human readable message indicating details about the transition. type: string reason: description: The reason for the condition's last transition. type: string status: description: Status of the condition, one of True, False, Unknown. type: string type: description: Type of condition. type: string required: - status - type type: object type: array lastSyncedTime: description: LastSyncedTime is the last time the resource successfully synced with Consul. format: date-time type: string type: object type: object served: true storage: true subresources: status: {} --- # Source: consul/templates/crd-servicesplitters.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 labels: app: consul chart: consul-helm heritage: Helm release: consul component: crd name: servicesplitters.consul.hashicorp.com spec: group: consul.hashicorp.com names: kind: ServiceSplitter listKind: ServiceSplitterList plural: servicesplitters shortNames: - service-splitter singular: servicesplitter scope: Namespaced versions: - additionalPrinterColumns: - description: The sync status of the resource with Consul jsonPath: .status.conditions[?(@.type=="Synced")].status name: Synced type: string - description: The last successful synced time of the resource with Consul jsonPath: .status.lastSyncedTime name: Last Synced type: date - description: The age of the resource jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: ServiceSplitter is the Schema for the servicesplitters API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: ServiceSplitterSpec defines the desired state of ServiceSplitter. properties: splits: description: |- Splits defines how much traffic to send to which set of service instances during a traffic split. The sum of weights across all splits must add up to 100. items: properties: namespace: description: |- Namespace is the Consul namespace to resolve the service from instead of the current namespace. If empty the current namespace is assumed. type: string partition: description: |- Partition is the Consul partition to resolve the service from instead of the current partition. If empty the current partition is assumed. type: string requestHeaders: description: Allow HTTP header manipulation to be configured. properties: add: additionalProperties: type: string description: |- Add is a set of name -> value pairs that should be appended to the request or response (i.e. allowing duplicates if the same header already exists). type: object remove: description: |- Remove is the set of header names that should be stripped from the request or response. items: type: string type: array set: additionalProperties: type: string description: |- Set is a set of name -> value pairs that should be added to the request or response, overwriting any existing header values of the same name. type: object type: object responseHeaders: description: |- HTTPHeaderModifiers is a set of rules for HTTP header modification that should be performed by proxies as the request passes through them. It can operate on either request or response headers depending on the context in which it is used. properties: add: additionalProperties: type: string description: |- Add is a set of name -> value pairs that should be appended to the request or response (i.e. allowing duplicates if the same header already exists). type: object remove: description: |- Remove is the set of header names that should be stripped from the request or response. items: type: string type: array set: additionalProperties: type: string description: |- Set is a set of name -> value pairs that should be added to the request or response, overwriting any existing header values of the same name. type: object type: object service: description: Service is the service to resolve instead of the default. type: string serviceSubset: description: |- ServiceSubset is a named subset of the given service to resolve instead of one defined as that service's DefaultSubset. If empty the default subset is used. type: string weight: description: |- Weight is a value between 0 and 100 reflecting what portion of traffic should be directed to this split. The smallest representable weight is 1/10000 or .01%. type: number type: object type: array type: object status: properties: conditions: description: Conditions indicate the latest available observations of a resource's current state. items: description: |- Conditions define a readiness condition for a Consul resource. See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties properties: lastTransitionTime: description: LastTransitionTime is the last time the condition transitioned from one status to another. format: date-time type: string message: description: A human readable message indicating details about the transition. type: string reason: description: The reason for the condition's last transition. type: string status: description: Status of the condition, one of True, False, Unknown. type: string type: description: Type of condition. type: string required: - status - type type: object type: array lastSyncedTime: description: LastSyncedTime is the last time the resource successfully synced with Consul. format: date-time type: string type: object type: object served: true storage: true subresources: status: {} --- # Source: consul/templates/crd-tcproutes-external.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: api-approved.kubernetes.io: https://github.com/kubernetes-sigs/gateway-api/pull/1538 gateway.networking.k8s.io/bundle-version: v0.6.2 gateway.networking.k8s.io/channel: experimental creationTimestamp: null labels: app: consul chart: consul-helm heritage: Helm release: consul component: crd name: tcproutes.gateway.networking.k8s.io spec: group: gateway.networking.k8s.io names: categories: - gateway-api kind: TCPRoute listKind: TCPRouteList plural: tcproutes singular: tcproute scope: Namespaced versions: - additionalPrinterColumns: - jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha2 schema: openAPIV3Schema: description: TCPRoute provides a way to route TCP requests. When combined with a Gateway listener, it can be used to forward connections on the port specified by the listener to a set of backends specified by the TCPRoute. properties: apiVersion: description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' type: string kind: description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' type: string metadata: type: object spec: description: Spec defines the desired state of TCPRoute. properties: parentRefs: description: "ParentRefs references the resources (usually Gateways) that a Route wants to be attached to. Note that the referenced parent resource needs to allow this for the attachment to be complete. For Gateways, that means the Gateway needs to allow attachment from Routes of this kind and namespace. \n The only kind of parent resource with \"Core\" support is Gateway. This API may be extended in the future to support additional kinds of parent resources such as one of the route kinds. \n It is invalid to reference an identical parent more than once. It is valid to reference multiple distinct sections within the same parent resource, such as 2 Listeners within a Gateway. \n It is possible to separately reference multiple distinct objects that may be collapsed by an implementation. For example, some implementations may choose to merge compatible Gateway Listeners together. If that is the case, the list of routes attached to those resources should also be merged. \n Note that for ParentRefs that cross namespace boundaries, there are specific rules. Cross-namespace references are only valid if they are explicitly allowed by something in the namespace they are referring to. For example, Gateway has the AllowedRoutes field, and ReferenceGrant provides a generic way to enable any other kind of cross-namespace reference." items: description: "ParentReference identifies an API object (usually a Gateway) that can be considered a parent of this resource (usually a route). The only kind of parent resource with \"Core\" support is Gateway. This API may be extended in the future to support additional kinds of parent resources, such as HTTPRoute. \n The API object must be valid in the cluster; the Group and Kind must be registered in the cluster for this reference to be valid." properties: group: default: gateway.networking.k8s.io description: "Group is the group of the referent. When unspecified, \"gateway.networking.k8s.io\" is inferred. To set the core API group (such as for a \"Service\" kind referent), Group must be explicitly set to \"\" (empty string). \n Support: Core" maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: default: Gateway description: "Kind is kind of the referent. \n Support: Core (Gateway) \n Support: Implementation-specific (Other Resources)" maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: "Name is the name of the referent. \n Support: Core" maxLength: 253 minLength: 1 type: string namespace: description: "Namespace is the namespace of the referent. When unspecified, this refers to the local namespace of the Route. \n Note that there are specific rules for ParentRefs which cross namespace boundaries. Cross-namespace references are only valid if they are explicitly allowed by something in the namespace they are referring to. For example: Gateway has the AllowedRoutes field, and ReferenceGrant provides a generic way to enable any other kind of cross-namespace reference. \n Support: Core" maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string port: description: "Port is the network port this Route targets. It can be interpreted differently based on the type of parent resource. \n When the parent resource is a Gateway, this targets all listeners listening on the specified port that also support this kind of Route(and select this Route). It's not recommended to set `Port` unless the networking behaviors specified in a Route must apply to a specific port as opposed to a listener(s) whose port(s) may be changed. When both Port and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support other parent resources. Implementations supporting other types of parent resources MUST clearly document how/if Port is interpreted. \n For the purpose of status, an attachment is considered successful as long as the parent resource accepts it partially. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Extended \n " format: int32 maximum: 65535 minimum: 1 type: integer sectionName: description: "SectionName is the name of a section within the target resource. In the following resources, SectionName is interpreted as the following: \n * Gateway: Listener Name. When both Port (experimental) and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support attaching Routes to other resources. If that is the case, they MUST clearly document how SectionName is interpreted. \n When unspecified (empty string), this will reference the entire resource. For the purpose of status, an attachment is considered successful if at least one section in the parent resource accepts it. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Core" maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string required: - name type: object maxItems: 32 type: array rules: description: Rules are a list of TCP matchers and actions. items: description: TCPRouteRule is the configuration for a given rule. properties: backendRefs: description: "BackendRefs defines the backend(s) where matching requests should be sent. If unspecified or invalid (refers to a non-existent resource or a Service with no endpoints), the underlying implementation MUST actively reject connection attempts to this backend. Connection rejections must respect weight; if an invalid backend is requested to have 80% of connections, then 80% of connections must be rejected instead. \n Support: Core for Kubernetes Service \n Support: Implementation-specific for any other resource \n Support for weight: Extended" items: description: "BackendRef defines how a Route should forward a request to a Kubernetes resource. \n Note that when a namespace is specified, a ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details." properties: group: default: "" description: Group is the group of the referent. For example, "gateway.networking.k8s.io". When unspecified or empty string, core API group is inferred. maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: default: Service description: Kind is kind of the referent. For example "HTTPRoute" or "Service". Defaults to "Service" when not specified. maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: Name is the name of the referent. maxLength: 253 minLength: 1 type: string namespace: description: "Namespace is the namespace of the backend. When unspecified, the local namespace is inferred. \n Note that when a namespace is specified, a ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. \n Support: Core" maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string port: description: Port specifies the destination port number to use for this resource. Port is required when the referent is a Kubernetes Service. In this case, the port number is the service port number, not the target port. For other resources, destination port might be derived from the referent resource or this field. format: int32 maximum: 65535 minimum: 1 type: integer weight: default: 1 description: "Weight specifies the proportion of requests forwarded to the referenced backend. This is computed as weight/(sum of all weights in this BackendRefs list). For non-zero values, there may be some epsilon from the exact proportion defined here depending on the precision an implementation supports. Weight is not a percentage and the sum of weights does not need to equal 100. \n If only one backend is specified and it has a weight greater than 0, 100% of the traffic is forwarded to that backend. If weight is set to 0, no traffic should be forwarded for this entry. If unspecified, weight defaults to 1. \n Support for this field varies based on the context where used." format: int32 maximum: 1000000 minimum: 0 type: integer required: - name type: object maxItems: 16 minItems: 1 type: array type: object maxItems: 16 minItems: 1 type: array required: - rules type: object status: description: Status defines the current state of TCPRoute. properties: parents: description: "Parents is a list of parent resources (usually Gateways) that are associated with the route, and the status of the route with respect to each parent. When this route attaches to a parent, the controller that manages the parent must add an entry to this list when the controller first sees the route and should update the entry as appropriate when the route or gateway is modified. \n Note that parent references that cannot be resolved by an implementation of this API will not be added to this list. Implementations of this API can only populate Route status for the Gateways/parent resources they are responsible for. \n A maximum of 32 Gateways will be represented in this list. An empty list means the route has not been attached to any Gateway." items: description: RouteParentStatus describes the status of a route with respect to an associated Parent. properties: conditions: description: "Conditions describes the status of the route with respect to the Gateway. Note that the route's availability is also subject to the Gateway's own status conditions and listener status. \n If the Route's ParentRef specifies an existing Gateway that supports Routes of this kind AND that Gateway's controller has sufficient access, then that Gateway's controller MUST set the \"Accepted\" condition on the Route, to indicate whether the route has been accepted or rejected by the Gateway, and why. \n A Route MUST be considered \"Accepted\" if at least one of the Route's rules is implemented by the Gateway. \n There are a number of cases where the \"Accepted\" condition may not be set due to lack of controller visibility, that includes when: \n * The Route refers to a non-existent parent. * The Route is of a type that the controller does not support. * The Route is in a namespace the controller does not have access to." items: description: "Condition contains details for one aspect of the current state of this API Resource. --- This struct is intended for direct use as an array at the field path .status.conditions. For example, \n \ttype FooStatus struct{ \t // Represents the observations of a foo's current state. \t // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\" \t // +patchMergeKey=type \t // +patchStrategy=merge \t // +listType=map \t // +listMapKey=type \t Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"` \n \t // other fields \t}" properties: lastTransitionTime: description: lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. --- Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be useful (see .node.status.conditions), the ability to deconflict is important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object maxItems: 8 minItems: 1 type: array x-kubernetes-list-map-keys: - type x-kubernetes-list-type: map controllerName: description: "ControllerName is a domain/path string that indicates the name of the controller that wrote this status. This corresponds with the controllerName field on GatewayClass. \n Example: \"example.net/gateway-controller\". \n The format of this field is DOMAIN \"/\" PATH, where DOMAIN and PATH are valid Kubernetes names (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names). \n Controllers MUST populate this field when writing status. Controllers should ensure that entries to status populated with their ControllerName are cleaned up when they are no longer necessary." maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*\/[A-Za-z0-9\/\-._~%!$&'()*+,;=:]+$ type: string parentRef: description: ParentRef corresponds with a ParentRef in the spec that this RouteParentStatus struct describes the status of. properties: group: default: gateway.networking.k8s.io description: "Group is the group of the referent. When unspecified, \"gateway.networking.k8s.io\" is inferred. To set the core API group (such as for a \"Service\" kind referent), Group must be explicitly set to \"\" (empty string). \n Support: Core" maxLength: 253 pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string kind: default: Gateway description: "Kind is kind of the referent. \n Support: Core (Gateway) \n Support: Implementation-specific (Other Resources)" maxLength: 63 minLength: 1 pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$ type: string name: description: "Name is the name of the referent. \n Support: Core" maxLength: 253 minLength: 1 type: string namespace: description: "Namespace is the namespace of the referent. When unspecified, this refers to the local namespace of the Route. \n Note that there are specific rules for ParentRefs which cross namespace boundaries. Cross-namespace references are only valid if they are explicitly allowed by something in the namespace they are referring to. For example: Gateway has the AllowedRoutes field, and ReferenceGrant provides a generic way to enable any other kind of cross-namespace reference. \n Support: Core" maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string port: description: "Port is the network port this Route targets. It can be interpreted differently based on the type of parent resource. \n When the parent resource is a Gateway, this targets all listeners listening on the specified port that also support this kind of Route(and select this Route). It's not recommended to set `Port` unless the networking behaviors specified in a Route must apply to a specific port as opposed to a listener(s) whose port(s) may be changed. When both Port and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support other parent resources. Implementations supporting other types of parent resources MUST clearly document how/if Port is interpreted. \n For the purpose of status, an attachment is considered successful as long as the parent resource accepts it partially. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Extended \n " format: int32 maximum: 65535 minimum: 1 type: integer sectionName: description: "SectionName is the name of a section within the target resource. In the following resources, SectionName is interpreted as the following: \n * Gateway: Listener Name. When both Port (experimental) and SectionName are specified, the name and port of the selected listener must match both specified values. \n Implementations MAY choose to support attaching Routes to other resources. If that is the case, they MUST clearly document how SectionName is interpreted. \n When unspecified (empty string), this will reference the entire resource. For the purpose of status, an attachment is considered successful if at least one section in the parent resource accepts it. For example, Gateway listeners can restrict which Routes can attach to them by Route kind, namespace, or hostname. If 1 of 2 Gateway listeners accept attachment from the referencing Route, the Route MUST be considered successfully attached. If no Gateway listeners accept attachment from this Route, the Route MUST be considered detached from the Gateway. \n Support: Core" maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string required: - name type: object required: - controllerName - parentRef type: object maxItems: 32 type: array required: - parents type: object required: - spec type: object served: true storage: true subresources: status: {} status: acceptedNames: kind: "" plural: "" conditions: [] storedVersions: [] --- # Source: consul/templates/crd-terminatinggateways.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.14.0 labels: app: consul chart: consul-helm heritage: Helm release: consul component: crd name: terminatinggateways.consul.hashicorp.com spec: group: consul.hashicorp.com names: kind: TerminatingGateway listKind: TerminatingGatewayList plural: terminatinggateways shortNames: - terminating-gateway singular: terminatinggateway scope: Namespaced versions: - additionalPrinterColumns: - description: The sync status of the resource with Consul jsonPath: .status.conditions[?(@.type=="Synced")].status name: Synced type: string - description: The last successful synced time of the resource with Consul jsonPath: .status.lastSyncedTime name: Last Synced type: date - description: The age of the resource jsonPath: .metadata.creationTimestamp name: Age type: date name: v1alpha1 schema: openAPIV3Schema: description: TerminatingGateway is the Schema for the terminatinggateways API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: TerminatingGatewaySpec defines the desired state of TerminatingGateway. properties: deployment: description: Deployment contains all deployment-related configuration properties: affinity: description: Affinity defines pod scheduling affinity rules properties: nodeAffinity: description: Describes node affinity scheduling rules for the pod. properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node matches the corresponding matchExpressions; the node(s) with the highest sum are the most preferred. items: description: |- An empty preferred scheduling term matches all objects with implicit weight 0 (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). properties: preference: description: A node selector term, associated with the corresponding weight. properties: matchExpressions: description: A list of node selector requirements by node's labels. items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: The label key that the selector applies to. type: string operator: description: |- Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: description: |- An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchFields: description: A list of node selector requirements by node's fields. items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: The label key that the selector applies to. type: string operator: description: |- Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: description: |- An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array type: object x-kubernetes-map-type: atomic weight: description: Weight associated with matching the corresponding nodeSelectorTerm, in the range 1-100. format: int32 type: integer required: - preference - weight type: object type: array requiredDuringSchedulingIgnoredDuringExecution: description: |- If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to an update), the system may or may not try to eventually evict the pod from its node. properties: nodeSelectorTerms: description: Required. A list of node selector terms. The terms are ORed. items: description: |- A null or empty node selector term matches no objects. The requirements of them are ANDed. The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. properties: matchExpressions: description: A list of node selector requirements by node's labels. items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: The label key that the selector applies to. type: string operator: description: |- Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: description: |- An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchFields: description: A list of node selector requirements by node's fields. items: description: |- A node selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: The label key that the selector applies to. type: string operator: description: |- Represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. type: string values: description: |- An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. If the operator is Gt or Lt, the values array must have a single element, which will be interpreted as an integer. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array type: object x-kubernetes-map-type: atomic type: array required: - nodeSelectorTerms type: object x-kubernetes-map-type: atomic type: object podAffinity: description: Describes pod affinity scheduling rules (e.g. co-locate this pod in the same node, zone, etc. as some other pod(s)). properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- The scheduler will prefer to schedule pods to nodes that satisfy the affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. Also, MatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. items: type: string type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. items: type: string type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic namespaces: description: |- namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". items: type: string type: array topologyKey: description: |- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. type: string required: - topologyKey type: object weight: description: |- weight associated with matching the corresponding podAffinityTerm, in the range 1-100. format: int32 type: integer required: - podAffinityTerm - weight type: object type: array requiredDuringSchedulingIgnoredDuringExecution: description: |- If the affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. items: description: |- Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. Also, MatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. items: type: string type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. items: type: string type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic namespaces: description: |- namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". items: type: string type: array topologyKey: description: |- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. type: string required: - topologyKey type: object type: array type: object podAntiAffinity: description: Describes pod anti-affinity scheduling rules (e.g. avoid putting this pod in the same node, zone, etc. as some other pod(s)). properties: preferredDuringSchedulingIgnoredDuringExecution: description: |- The scheduler will prefer to schedule pods to nodes that satisfy the anti-affinity expressions specified by this field, but it may choose a node that violates one or more of the expressions. The node that is most preferred is the one with the greatest sum of weights, i.e. for each node that meets all of the scheduling requirements (resource request, requiredDuringScheduling anti-affinity expressions, etc.), compute a sum by iterating through the elements of this field and adding "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the node(s) with the highest sum are the most preferred. items: description: The weights of all of the matched WeightedPodAffinityTerm fields are added per-node to find the most preferred node(s) properties: podAffinityTerm: description: Required. A pod affinity term, associated with the corresponding weight. properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. Also, MatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. items: type: string type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. items: type: string type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic namespaces: description: |- namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". items: type: string type: array topologyKey: description: |- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. type: string required: - topologyKey type: object weight: description: |- weight associated with matching the corresponding podAffinityTerm, in the range 1-100. format: int32 type: integer required: - podAffinityTerm - weight type: object type: array requiredDuringSchedulingIgnoredDuringExecution: description: |- If the anti-affinity requirements specified by this field are not met at scheduling time, the pod will not be scheduled onto the node. If the anti-affinity requirements specified by this field cease to be met at some point during pod execution (e.g. due to a pod label update), the system may or may not try to eventually evict the pod from its node. When there are multiple elements, the lists of nodes corresponding to each podAffinityTerm are intersected, i.e. all terms must be satisfied. items: description: |- Defines a set of pods (namely those matching the labelSelector relative to the given namespace(s)) that this pod should be co-located (affinity) or not co-located (anti-affinity) with, where co-located is defined as running on a node whose value of the label with key matches that of any node on which a pod of the set of pods is running properties: labelSelector: description: |- A label query over a set of resources, in this case pods. If it's null, this PodAffinityTerm matches with no Pods. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- MatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. Also, MatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. items: type: string type: array x-kubernetes-list-type: atomic mismatchLabelKeys: description: |- MismatchLabelKeys is a set of pod label keys to select which pods will be taken into consideration. The keys are used to lookup values from the incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` to select the group of existing pods which pods will be taken into consideration for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming pod labels will be ignored. The default value is empty. The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. items: type: string type: array x-kubernetes-list-type: atomic namespaceSelector: description: |- A label query over the set of namespaces that the term applies to. The term is applied to the union of the namespaces selected by this field and the ones listed in the namespaces field. null selector and null or empty namespaces list means "this pod's namespace". An empty selector ({}) matches all namespaces. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic namespaces: description: |- namespaces specifies a static list of namespace names that the term applies to. The term is applied to the union of the namespaces listed in this field and the ones selected by namespaceSelector. null or empty namespaces list and null namespaceSelector means "this pod's namespace". items: type: string type: array topologyKey: description: |- This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching the labelSelector in the specified namespaces, where co-located is defined as running on a node whose value of the label with key topologyKey matches that of any node on which any of the selected pods is running. Empty topologyKey is not allowed. type: string required: - topologyKey type: object type: array type: object type: object annotations: additionalProperties: type: string description: Annotations are custom annotations applied to the pod type: object consulNamespace: description: ConsulNamespace is the Consul namespace where the gateway is registered type: string enabledDeployment: description: Enabled controls whether to create a Deployment for this gateway type: boolean extraVolumes: description: ExtraVolumes are additional volumes to mount in the pod items: description: ExtraVolume defines a volume to be mounted in the pod. properties: items: items: properties: key: type: string path: type: string required: - key - path type: object type: array load: description: Load indicates if the volume should be loaded type: boolean name: description: Name is the name of the volume type: string type: description: Type is the volume type (configMap or secret) enum: - configMap - secret type: string required: - name - type type: object type: array gatewayName: description: GatewayName is the name of the gateway service in Consul type: string logJSON: description: LogJSON enables JSON formatted logging type: boolean logLevel: description: LogLevel sets the logging level for the gateway type: string nodeSelector: additionalProperties: type: string description: NodeSelector defines labels for node selection type: object priorityClassName: description: PriorityClassName is the priority class for pod scheduling type: string replicas: description: Replicas is the number of pod instances to deploy format: int32 minimum: 1 type: integer resources: description: Resources define CPU and memory requests/limits for the pod properties: claims: description: |- Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container. This is an alpha field and requires enabling the DynamicResourceAllocation feature gate. This field is immutable. It can only be set for containers. items: description: ResourceClaim references one entry in PodSpec.ResourceClaims. properties: name: description: |- Name must match the name of one entry in pod.spec.resourceClaims of the Pod where this field is used. It makes that resource available inside a container. type: string required: - name type: object type: array x-kubernetes-list-map-keys: - name x-kubernetes-list-type: map limits: additionalProperties: anyOf: - type: integer - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true description: |- Limits describes the maximum amount of compute resources allowed. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object requests: additionalProperties: anyOf: - type: integer - type: string pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ x-kubernetes-int-or-string: true description: |- Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ type: object type: object serviceAccount: description: ServiceAccount defines service account configuration properties: annotations: additionalProperties: type: string description: Annotations are annotations for the service account type: object type: object tolerations: description: Tolerations define pod tolerations for node taints items: description: |- The pod this Toleration is attached to tolerates any taint that matches the triple using the matching operator . properties: effect: description: |- Effect indicates the taint effect to match. Empty means match all taint effects. When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. type: string key: description: |- Key is the taint key that the toleration applies to. Empty means match all taint keys. If the key is empty, operator must be Exists; this combination means to match all values and all keys. type: string operator: description: |- Operator represents a key's relationship to the value. Valid operators are Exists and Equal. Defaults to Equal. Exists is equivalent to wildcard for value, so that a pod can tolerate all taints of a particular category. type: string tolerationSeconds: description: |- TolerationSeconds represents the period of time the toleration (which must be of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, it is not set, which means tolerate the taint forever (do not evict). Zero and negative values will be treated as 0 (evict immediately) by the system. format: int64 type: integer value: description: |- Value is the taint value the toleration matches to. If the operator is Exists, the value should be empty, otherwise just a regular string. type: string type: object type: array topologySpreadConstraints: description: TopologySpreadConstraints define pod topology spread constraints items: description: TopologySpreadConstraint specifies how to spread matching pods among the given topology. properties: labelSelector: description: |- LabelSelector is used to find matching pods. Pods that match this label selector are counted to determine the number of pods in their corresponding topology domain. properties: matchExpressions: description: matchExpressions is a list of label selector requirements. The requirements are ANDed. items: description: |- A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values. properties: key: description: key is the label key that the selector applies to. type: string operator: description: |- operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist. type: string values: description: |- values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch. items: type: string type: array required: - key - operator type: object type: array matchLabels: additionalProperties: type: string description: |- matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed. type: object type: object x-kubernetes-map-type: atomic matchLabelKeys: description: |- MatchLabelKeys is a set of pod label keys to select the pods over which spreading will be calculated. The keys are used to lookup values from the incoming pod labels, those key-value labels are ANDed with labelSelector to select the group of existing pods over which spreading will be calculated for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. MatchLabelKeys cannot be set when LabelSelector isn't set. Keys that don't exist in the incoming pod labels will be ignored. A null or empty list means only match against labelSelector. This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). items: type: string type: array x-kubernetes-list-type: atomic maxSkew: description: |- MaxSkew describes the degree to which pods may be unevenly distributed. When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference between the number of matching pods in the target topology and the global minimum. The global minimum is the minimum number of matching pods in an eligible domain or zero if the number of eligible domains is less than MinDomains. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 2/2/1: In this case, the global minimum is 1. | zone1 | zone2 | zone3 | | P P | P P | P | - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) violate MaxSkew(1). - if MaxSkew is 2, incoming pod can be scheduled onto any zone. When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence to topologies that satisfy it. It's a required field. Default value is 1 and 0 is not allowed. format: int32 type: integer minDomains: description: |- MinDomains indicates a minimum number of eligible domains. When the number of eligible domains with matching topology keys is less than minDomains, Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. And when the number of eligible domains with matching topology keys equals or greater than minDomains, this value has no effect on scheduling. As a result, when the number of eligible domains is less than minDomains, scheduler won't schedule more than maxSkew Pods to those domains. If value is nil, the constraint behaves as if MinDomains is equal to 1. Valid values are integers greater than 0. When value is not nil, WhenUnsatisfiable must be DoNotSchedule. For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same labelSelector spread as 2/2/2: | zone1 | zone2 | zone3 | | P P | P P | P P | The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. In this situation, new pod with the same labelSelector cannot be scheduled, because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, it will violate MaxSkew. This is a beta field and requires the MinDomainsInPodTopologySpread feature gate to be enabled (enabled by default). format: int32 type: integer nodeAffinityPolicy: description: |- NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector when calculating pod topology spread skew. Options are: - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. If this value is nil, the behavior is equivalent to the Honor policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string nodeTaintsPolicy: description: |- NodeTaintsPolicy indicates how we will treat node taints when calculating pod topology spread skew. Options are: - Honor: nodes without taints, along with tainted nodes for which the incoming pod has a toleration, are included. - Ignore: node taints are ignored. All nodes are included. If this value is nil, the behavior is equivalent to the Ignore policy. This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. type: string topologyKey: description: |- TopologyKey is the key of node labels. Nodes that have a label with this key and identical values are considered to be in the same topology. We consider each as a "bucket", and try to put balanced number of pods into each bucket. We define a domain as a particular instance of a topology. Also, we define an eligible domain as a domain whose nodes meet the requirements of nodeAffinityPolicy and nodeTaintsPolicy. e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. It's a required field. type: string whenUnsatisfiable: description: |- WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy the spread constraint. - DoNotSchedule (default) tells the scheduler not to schedule it. - ScheduleAnyway tells the scheduler to schedule the pod in any location, but giving higher precedence to topologies that would help reduce the skew. A constraint is considered "Unsatisfiable" for an incoming pod if and only if every possible node assignment for that pod would violate "MaxSkew" on some topology. For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same labelSelector spread as 3/1/1: | zone1 | zone2 | zone3 | | P P P | P | P | If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler won't make it *more* imbalanced. It's a required field. type: string required: - maxSkew - topologyKey - whenUnsatisfiable type: object type: array type: object services: description: Services is a list of service names represented by the terminating gateway. items: description: A LinkedService is a service represented by a terminating gateway. properties: caFile: description: |- CAFile is the optional path to a CA certificate to use for TLS connections from the gateway to the linked service. type: string certFile: description: |- CertFile is the optional path to a client certificate to use for TLS connections from the gateway to the linked service. type: string disableAutoHostRewrite: description: DisableAutoHostRewrite disables terminating gateways auto host rewrite feature when set to true. type: boolean keyFile: description: |- KeyFile is the optional path to a private key to use for TLS connections from the gateway to the linked service. type: string name: description: Name is the name of the service, as defined in Consul's catalog. type: string namespace: description: The namespace the service is registered in. type: string secretRef: description: SecretRef references a Kubernetes secret containing TLS certificates. properties: name: description: Name is the name of the Kubernetes secret. minLength: 1 type: string type: object sni: description: SNI is the optional name to specify during the TLS handshake with a linked service. type: string type: object type: array type: object status: properties: conditions: description: Conditions indicate the latest available observations of a resource's current state. items: description: |- Conditions define a readiness condition for a Consul resource. See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties properties: lastTransitionTime: description: LastTransitionTime is the last time the condition transitioned from one status to another. format: date-time type: string message: description: A human readable message indicating details about the transition. type: string reason: description: The reason for the condition's last transition. type: string status: description: Status of the condition, one of True, False, Unknown. type: string type: description: Type of condition. type: string required: - status - type type: object type: array lastSyncedTime: description: LastSyncedTime is the last time the resource successfully synced with Consul. format: date-time type: string type: object type: object served: true storage: true subresources: status: {} --- # Source: consul/templates/crd-trafficpermissions.yaml apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.12.1 labels: app: consul chart: consul-helm heritage: Helm release: consul component: crd name: trafficpermissions.auth.consul.hashicorp.com spec: group: auth.consul.hashicorp.com names: kind: TrafficPermissions listKind: TrafficPermissionsList plural: trafficpermissions shortNames: - traffic-permissions singular: trafficpermissions scope: Namespaced versions: - additionalPrinterColumns: - description: The sync status of the resource with Consul jsonPath: .status.conditions[?(@.type=="Synced")].status name: Synced type: string - description: The last successful synced time of the resource with Consul jsonPath: .status.lastSyncedTime name: Last Synced type: date - description: The age of the resource jsonPath: .metadata.creationTimestamp name: Age type: date name: v2beta1 schema: openAPIV3Schema: description: TrafficPermissions is the Schema for the traffic-permissions API properties: apiVersion: description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' type: string kind: description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' type: string metadata: type: object spec: properties: action: description: "Action can be either allow or deny for the entire object. It will default to allow. \n If action is allow, we will allow the connection if one of the rules in Rules matches, in other words, we will deny all requests except for the ones that match Rules. If Consul is in default allow mode, then allow actions have no effect without a deny permission as everything is allowed by default. \n If action is deny, we will deny the connection if one of the rules in Rules match, in other words, we will allow all requests except for the ones that match Rules. If Consul is default deny mode, then deny permissions have no effect without an allow permission as everything is denied by default. \n Action unspecified is reserved for compatibility with the addition of future actions." enum: - ACTION_ALLOW - ACTION_DENY - ACTION_UNKNOWN format: int32 type: string destination: description: Destination is a configuration of the destination proxies where these traffic permissions should apply. properties: identityName: type: string type: object permissions: description: Permissions is a list of permissions to match on. They are applied using OR semantics. items: description: Permissions is a list of permissions to match on. properties: destinationRules: description: DestinationRules is a list of rules to apply for matching sources in this Permission. These rules are specific to the request or connection that is going to the destination(s) selected by the TrafficPermissions resource. items: description: DestinationRule contains rules rules to apply to the incoming connection. properties: exclude: description: Exclude contains a list of rules to exclude when evaluating rules for the incoming connection. items: properties: headers: items: properties: exact: type: string invert: type: boolean name: type: string prefix: type: string present: type: boolean regex: type: string suffix: type: string type: object type: array methods: description: Methods is the list of HTTP methods. items: type: string type: array pathExact: type: string pathPrefix: type: string pathRegex: type: string portNames: description: PortNames is a list of workload ports to apply this rule to. The ports specified here must be the ports used in the connection. items: type: string type: array type: object type: array headers: items: properties: exact: type: string invert: type: boolean name: type: string prefix: type: string present: type: boolean regex: type: string suffix: type: string type: object type: array methods: description: Methods is the list of HTTP methods. If no methods are specified, this rule will apply to all methods. items: type: string type: array pathExact: type: string pathPrefix: type: string pathRegex: type: string portNames: items: type: string type: array type: object type: array sources: description: Sources is a list of sources in this traffic permission. items: description: Source represents the source identity. To specify any of the wildcard sources, the specific fields need to be omitted. For example, for a wildcard namespace, identity_name should be omitted. properties: exclude: description: Exclude is a list of sources to exclude from this source. items: description: ExcludeSource is almost the same as source but it prevents the addition of matching sources. properties: identityName: type: string namespace: type: string partition: type: string peer: type: string samenessGroup: type: string type: object type: array identityName: type: string namespace: type: string partition: type: string peer: type: string samenessGroup: type: string type: object type: array type: object type: array type: object status: properties: conditions: description: Conditions indicate the latest available observations of a resource's current state. items: description: 'Conditions define a readiness condition for a Consul resource. See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties' properties: lastTransitionTime: description: LastTransitionTime is the last time the condition transitioned from one status to another. format: date-time type: string message: description: A human readable message indicating details about the transition. type: string reason: description: The reason for the condition's last transition. type: string status: description: Status of the condition, one of True, False, Unknown. type: string type: description: Type of condition. type: string required: - status - type type: object type: array lastSyncedTime: description: LastSyncedTime is the last time the resource successfully synced with Consul. format: date-time type: string type: object type: object served: true storage: true subresources: status: {} --- # Source: consul/templates/auth-method-clusterrole.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: consul-consul-auth-method labels: app: consul chart: consul-helm heritage: Helm release: consul component: auth-method rules: - apiGroups: [ "" ] resources: - serviceaccounts verbs: - get --- # Source: consul/templates/connect-inject-clusterrole.yaml # The ClusterRole to enable the Connect injector to get, list, watch and patch MutatingWebhookConfiguration. apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: consul-consul-connect-injector labels: app: consul chart: consul-helm heritage: Helm release: consul component: connect-injector rules: - apiGroups: - consul.hashicorp.com resources: - servicedefaults - serviceresolvers - proxydefaults - meshes - exportedservices - servicerouters - servicesplitters - serviceintentions - ingressgateways - terminatinggateways - gatewayclassconfigs - meshservices - samenessgroups - controlplanerequestlimits - ratelimits - routeretryfilters - routetimeoutfilters - routeauthfilters - routetlssdsfilters - gatewaypolicies - customgatewaypolicies - registrations - jwtproviders - routeauthfilters verbs: - create - delete - get - list - patch - update - watch - apiGroups: - consul.hashicorp.com resources: - servicedefaults/status - serviceresolvers/status - proxydefaults/status - meshes/status - exportedservices/status - servicerouters/status - servicesplitters/status - serviceintentions/status - ingressgateways/status - terminatinggateways/status - samenessgroups/status - controlplanerequestlimits/status - ratelimits/status - registrations/status - jwtproviders/status - routeauthfilters/status - routetlssdsfilters/status - gatewaypolicies/status - customgatewaypolicies/status verbs: - get - patch - update - apiGroups: [""] resources: ["secrets", "serviceaccounts", "services"] verbs: - get - list - watch - delete - create - update - apiGroups: [ "" ] resources: ["endpoints", "namespaces", "nodes", "configmaps"] verbs: - get - list - watch - apiGroups: [ "rbac.authorization.k8s.io" ] resources: [ "roles", "rolebindings" ] verbs: - get - list - watch - delete - create - update - apiGroups: [ "" ] resources: - pods verbs: - "get" - "list" - "watch" - "update" - apiGroups: - coordination.k8s.io resources: - leases verbs: - create - get - list - update - apiGroups: [ "policy" ] resources: [ "podsecuritypolicies" ] verbs: - use - apiGroups: - gateway.networking.k8s.io resources: - gatewayclasses - gateways - httproutes - tcproutes - referencegrants verbs: - create - delete - get - list - patch - update - watch - apiGroups: - consul.hashicorp.com resources: - customgatewayclasses - cgateways - chttproutes - ctcproutes - creferencegrants verbs: - create - delete - get - list - patch - update - watch - apiGroups: - gateway.networking.k8s.io resources: - gatewayclasses/finalizers - gateways/finalizers - httproutes/finalizers - tcproutes/finalizers verbs: - update - apiGroups: - consul.hashicorp.com resources: - customgatewayclasses/finalizers - cgateways/finalizers - chttproutes/finalizers - ctcproutes/finalizers verbs: - update - apiGroups: - gateway.networking.k8s.io resources: - gatewayclasses/status - gateways/status - httproutes/status - tcproutes/status verbs: - get - patch - update - apiGroups: - consul.hashicorp.com resources: - customgatewayclasses/status - cgateways/status - chttproutes/status - ctcproutes/status verbs: - get - patch - update - apiGroups: - apps resources: - deployments verbs: - create - get - list - update - watch - delete - apiGroups: - autoscaling resources: - horizontalpodautoscalers verbs: - create - delete - get - list - patch - update - watch - apiGroups: - core resources: - services verbs: - watch - list - apiGroups: [ "" ] resources: [ "secrets" ] verbs: - "get" - "list" - "watch" --- # Source: consul/templates/gateway-cleanup-clusterrole-custom.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: consul-consul-gateway-cleanup-custom labels: app: consul chart: consul-helm heritage: Helm release: consul component: gateway-cleanup-custom rules: - apiGroups: - consul.hashicorp.com resources: - gatewayclassconfigs verbs: - get - delete - apiGroups: - consul.hashicorp.com resources: - customgatewayclasses verbs: - get - delete --- # Source: consul/templates/gateway-cleanup-clusterrole.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: consul-consul-gateway-cleanup labels: app: consul chart: consul-helm heritage: Helm release: consul component: gateway-cleanup rules: - apiGroups: - consul.hashicorp.com resources: - gatewayclassconfigs verbs: - get - delete - apiGroups: - consul.hashicorp.com resources: - terminatinggateways verbs: - get - list - delete - apiGroups: - gateway.networking.k8s.io resources: - gatewayclasses verbs: - get - delete --- # Source: consul/templates/gateway-resources-clusterrole-custom.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: consul-consul-gateway-resources-custom labels: app: consul chart: consul-helm heritage: Helm release: consul component: gateway-resources-custom rules: - apiGroups: - consul.hashicorp.com resources: - gatewayclassconfigs verbs: - get - update - create - apiGroups: - consul.hashicorp.com resources: - customgatewayclasses verbs: - get - update - create --- # Source: consul/templates/gateway-resources-clusterrole.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: consul-consul-gateway-resources labels: app: consul chart: consul-helm heritage: Helm release: consul component: gateway-resources rules: - apiGroups: - consul.hashicorp.com resources: - gatewayclassconfigs verbs: - get - update - create - apiGroups: - gateway.networking.k8s.io resources: - gatewayclasses verbs: - get - update - create --- # Source: consul/templates/mesh-gateway-clusterrole.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: consul-consul-mesh-gateway labels: app: consul chart: consul-helm heritage: Helm release: consul component: mesh-gateway rules: - apiGroups: [""] resources: - services resourceNames: - consul-consul-mesh-gateway verbs: - get --- # Source: consul/templates/server-clusterrole.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: consul-consul-server namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: server rules: - apiGroups: [""] resources: ["nodes"] verbs: - get --- # Source: consul/templates/webhook-cert-manager-clusterrole.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: consul-consul-webhook-cert-manager labels: app: consul chart: consul-helm heritage: Helm release: consul component: webhook-cert-manager rules: - apiGroups: - "" resources: - secrets verbs: - create - delete - get - list - patch - update - watch - apiGroups: - admissionregistration.k8s.io resources: - mutatingwebhookconfigurations - validatingwebhookconfigurations verbs: - get - list - watch - patch - apiGroups: - apps resources: - deployments resourceNames: - consul-consul-webhook-cert-manager verbs: - get --- # Source: consul/templates/auth-method-clusterrolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: consul-consul-authdelegator labels: app: consul chart: consul-helm heritage: Helm release: consul component: auth-method roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: "system:auth-delegator" subjects: - kind: ServiceAccount name: consul-consul-auth-method namespace: consul --- # Source: consul/templates/auth-method-clusterrolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: consul-consul-auth-method labels: app: consul chart: consul-helm heritage: Helm release: consul component: auth-method roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: consul-consul-auth-method subjects: - kind: ServiceAccount name: consul-consul-auth-method namespace: consul --- # Source: consul/templates/connect-inject-clusterrolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: consul-consul-connect-injector labels: app: consul chart: consul-helm heritage: Helm release: consul component: connect-injector roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: consul-consul-connect-injector subjects: - kind: ServiceAccount name: consul-consul-connect-injector namespace: consul --- # Source: consul/templates/gateway-cleanup-clusterrolebinding-custom.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: consul-consul-gateway-cleanup-custom labels: app: consul chart: consul-helm heritage: Helm release: consul component: gateway-cleanup roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: consul-consul-gateway-cleanup-custom subjects: - kind: ServiceAccount name: consul-consul-gateway-cleanup-custom namespace: consul --- # Source: consul/templates/gateway-cleanup-clusterrolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: consul-consul-gateway-cleanup labels: app: consul chart: consul-helm heritage: Helm release: consul component: gateway-cleanup roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: consul-consul-gateway-cleanup subjects: - kind: ServiceAccount name: consul-consul-gateway-cleanup namespace: consul --- # Source: consul/templates/gateway-resources-clusterrolebinding-custom.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: consul-consul-gateway-resources-custom labels: app: consul chart: consul-helm heritage: Helm release: consul component: gateway-resources-custom roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: consul-consul-gateway-resources-custom subjects: - kind: ServiceAccount name: consul-consul-gateway-resources-custom namespace: consul --- # Source: consul/templates/gateway-resources-clusterrolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: consul-consul-gateway-resources labels: app: consul chart: consul-helm heritage: Helm release: consul component: gateway-resources roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: consul-consul-gateway-resources subjects: - kind: ServiceAccount name: consul-consul-gateway-resources namespace: consul --- # Source: consul/templates/mesh-gateway-clusterrolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: consul-consul-mesh-gateway labels: app: consul chart: consul-helm heritage: Helm release: consul component: mesh-gateway roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: consul-consul-mesh-gateway subjects: - kind: ServiceAccount name: consul-consul-mesh-gateway namespace: consul --- # Source: consul/templates/server-clusterrolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: consul-consul-server labels: app: consul chart: consul-helm heritage: Helm release: consul component: server roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: consul-consul-server subjects: - kind: ServiceAccount name: consul-consul-server namespace: consul --- # Source: consul/templates/webhook-cert-manager-clusterrolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: consul-consul-webhook-cert-manager labels: app: consul chart: consul-helm heritage: Helm release: consul component: webhook-cert-manager roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: consul-consul-webhook-cert-manager subjects: - kind: ServiceAccount name: consul-consul-webhook-cert-manager namespace: consul --- # Source: consul/templates/connect-inject-leader-election-role.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: consul-consul-connect-inject-leader-election namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: connect-injector rules: - apiGroups: - "" resources: - configmaps verbs: - get - list - watch - create - update - patch - delete - apiGroups: - "" resources: - configmaps/status verbs: - get - update - patch - apiGroups: - "" resources: - events verbs: - create - patch --- # Source: consul/templates/ingress-gateways-role.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: consul-consul-ingress-gateway namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: ingress-gateway ingress-gateway-name: consul-consul-ingress-gateway rules: - apiGroups: [""] resources: - services resourceNames: - consul-consul-ingress-gateway verbs: - get - apiGroups: [""] resources: - secrets resourceNames: - consul-consul-ingress-gateway-acl-token verbs: - get --- # Source: consul/templates/server-acl-init-cleanup-role.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: consul-consul-server-acl-init-cleanup namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: server-acl-init-cleanup rules: - apiGroups: ["batch"] resources: ["jobs"] verbs: ["get", "delete"] --- # Source: consul/templates/server-acl-init-role.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: consul-consul-server-acl-init namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: server-acl-init rules: - apiGroups: [ "" ] resources: - secrets verbs: - create - get - apiGroups: [ "" ] resources: - serviceaccounts resourceNames: - consul-consul-auth-method verbs: - get --- # Source: consul/templates/server-role.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: consul-consul-server namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: server rules: [] --- # Source: consul/templates/terminating-gateways-role.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: consul-consul-terminating-gateway namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: terminating-gateway terminating-gateway-name: consul-consul-terminating-gateway rules: [] --- # Source: consul/templates/connect-inject-leader-election-rolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: consul-consul-connect-inject-leader-election namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: connect-injector roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: consul-consul-connect-inject-leader-election subjects: - kind: ServiceAccount name: consul-consul-connect-injector namespace: consul --- # Source: consul/templates/ingress-gateways-rolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: consul-consul-ingress-gateway namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: ingress-gateway ingress-gateway-name: consul-consul-ingress-gateway roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: consul-consul-ingress-gateway subjects: - kind: ServiceAccount name: consul-consul-ingress-gateway --- # Source: consul/templates/server-acl-init-cleanup-rolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: consul-consul-server-acl-init-cleanup namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: server-acl-init-cleanup roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: consul-consul-server-acl-init-cleanup subjects: - kind: ServiceAccount name: consul-consul-server-acl-init-cleanup --- # Source: consul/templates/server-acl-init-rolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: consul-consul-server-acl-init namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: server-acl-init roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: consul-consul-server-acl-init subjects: - kind: ServiceAccount name: consul-consul-server-acl-init --- # Source: consul/templates/server-rolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: consul-consul-server namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: server roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: consul-consul-server subjects: - kind: ServiceAccount name: consul-consul-server --- # Source: consul/templates/terminating-gateways-rolebinding.yaml apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: consul-consul-terminating-gateway namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: terminating-gateway terminating-gateway-name: consul-consul-terminating-gateway roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: consul-consul-terminating-gateway subjects: - kind: ServiceAccount name: consul-consul-terminating-gateway namespace: consul --- # Source: consul/templates/connect-inject-service.yaml # The service for the Connect sidecar injector apiVersion: v1 kind: Service metadata: name: consul-consul-connect-injector namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: connect-injector spec: ports: - port: 443 targetPort: 8080 selector: app: consul release: "consul" component: connect-injector --- # Source: consul/templates/dns-service.yaml # Service for Consul DNS. apiVersion: v1 kind: Service metadata: name: consul-consul-dns namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: dns spec: type: ClusterIP ports: - name: dns-tcp port: 53 protocol: "TCP" targetPort: dns-tcp - name: dns-udp port: 53 protocol: "UDP" targetPort: dns-udp selector: app: consul release: "consul" hasDNS: "true" --- # Source: consul/templates/ingress-gateways-service.yaml apiVersion: v1 kind: Service metadata: name: consul-consul-ingress-gateway namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: ingress-gateway ingress-gateway-name: consul-consul-ingress-gateway spec: selector: app: consul release: "consul" component: ingress-gateway ingress-gateway-name: consul-consul-ingress-gateway ports: - name: gateway-0 port: 8080 - name: gateway-1 port: 8443 type: ClusterIP --- # Source: consul/templates/mesh-gateway-service.yaml apiVersion: v1 kind: Service metadata: name: consul-consul-mesh-gateway namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: mesh-gateway spec: selector: app: consul release: "consul" component: mesh-gateway ports: - name: gateway port: 443 targetPort: 8443 type: ClusterIP --- # Source: consul/templates/server-service.yaml # Headless service for Consul server DNS entries. This service should only # point to Consul servers. For access to an agent, one should assume that # the agent is installed locally on the node and the NODE_IP should be used. # If the node can't run a Consul agent, then this service can be used to # communicate directly to a server agent. apiVersion: v1 kind: Service metadata: name: consul-consul-server namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: server annotations: spec: clusterIP: None # We want the servers to become available even if they're not ready # since this DNS is also used for join operations. publishNotReadyAddresses: true ports: - name: https port: 8501 targetPort: 8501 - name: grpc port: 8502 targetPort: 8502 - name: serflan-tcp protocol: "TCP" port: 8301 targetPort: 8301 - name: serflan-udp protocol: "UDP" port: 8301 targetPort: 8301 - name: serfwan-tcp protocol: "TCP" port: 8302 targetPort: 8302 - name: serfwan-udp protocol: "UDP" port: 8302 targetPort: 8302 - name: server port: 8300 targetPort: 8300 - name: dns-tcp protocol: "TCP" port: 8600 targetPort: dns-tcp - name: dns-udp protocol: "UDP" port: 8600 targetPort: dns-udp selector: app: consul release: "consul" component: server --- # Source: consul/templates/terminating-gateways-service.yaml apiVersion: v1 kind: Service metadata: name: consul-consul-terminating-gateway namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: terminating-gateway spec: selector: app: consul release: "consul" component: terminating-gateway type: ClusterIP ports: - port: 80 targetPort: 8443 --- # Source: consul/templates/ui-service.yaml # UI Service for Consul Server apiVersion: v1 kind: Service metadata: name: consul-consul-ui namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: ui spec: selector: app: consul release: "consul" component: server ports: - name: https port: 443 targetPort: 8501 --- # Source: consul/templates/connect-inject-deployment.yaml # The deployment for running the Connect sidecar injector apiVersion: apps/v1 kind: Deployment metadata: name: consul-consul-connect-injector namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: connect-injector spec: replicas: 1 selector: matchLabels: app: consul chart: consul-helm release: consul component: connect-injector template: metadata: labels: app: consul chart: consul-helm release: consul component: connect-injector annotations: "consul.hashicorp.com/connect-inject": "false" "consul.hashicorp.com/mesh-inject": "false" spec: serviceAccountName: consul-consul-connect-injector containers: - name: sidecar-injector image: "hashicorp/consul-k8s-control-plane:2.0.0" ports: - containerPort: 8080 name: webhook-server protocol: TCP securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - ALL runAsNonRoot: true seccompProfile: type: RuntimeDefault runAsUser: 100 env: - name: NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: CONSUL_DUAL_STACK value: "false" - name: CONSUL_ADDRESSES value: consul-consul-server.consul.svc - name: CONSUL_GRPC_PORT value: "8502" - name: CONSUL_HTTP_PORT value: "8501" - name: CONSUL_DATACENTER value: dc1 - name: CONSUL_API_TIMEOUT value: 5s - name: CONSUL_USE_TLS value: "true" - name: CONSUL_CACERT_FILE value: "/consul/tls/ca/tls.crt" - name: CONSUL_LOGIN_AUTH_METHOD value: consul-consul-k8s-component-auth-method - name: CONSUL_LOGIN_DATACENTER value: dc1 - name: CONSUL_LOGIN_META value: "component=connect-injector,pod=$(NAMESPACE)/$(POD_NAME)" command: - "/bin/sh" - "-ec" - | exec consul-k8s-control-plane inject-connect \ -config-file=/consul/config/config.json \ -log-level=info \ -log-json=false \ -default-inject=false \ -consul-image="hashicorp/consul:2.0.0" \ -consul-dataplane-image="hashicorp/consul-dataplane:2.0.0" \ -consul-k8s-image="hashicorp/consul-k8s-control-plane:2.0.0" \ -release-name="consul" \ -release-namespace="consul" \ -resource-prefix=consul-consul \ -listen=:8080 \ -default-enable-transparent-proxy=true \ -enable-cni=false \ -transparent-proxy-default-overwrite-probes=true \ -enable-consul-dns=true \ -default-enable-metrics=false \ -enable-gateway-metrics=true \ -enable-gateway-scaling=false \ -default-enable-metrics-merging=false \ -default-merged-metrics-port=20100 \ -default-prometheus-scrape-port=20200 \ -default-prometheus-scrape-path="/metrics" \ -acl-auth-method="consul-consul-k8s-auth-method" \ -allow-k8s-namespace="*" \ -tls-cert-dir=/etc/connect-injector/certs \ -default-envoy-proxy-concurrency=2 \ -default-enable-sidecar-proxy-lifecycle=true \ -default-enable-sidecar-proxy-lifecycle-shutdown-drain-listeners=true \ -default-sidecar-proxy-lifecycle-shutdown-grace-period-seconds=30 \ -default-sidecar-proxy-lifecycle-startup-grace-period-seconds=0 \ -default-sidecar-proxy-lifecycle-graceful-port=20600 \ -default-sidecar-proxy-lifecycle-graceful-shutdown-path="/graceful_shutdown" \ -default-sidecar-proxy-lifecycle-graceful-startup-path="/graceful_startup" \ -default-sidecar-proxy-startup-failure-seconds=0 \ -default-sidecar-proxy-liveness-failure-seconds=0 \ -init-container-memory-limit=150Mi \ -init-container-memory-request=25Mi \ -init-container-cpu-request=50m \ -enable-telemetry-collector=false \ -default-enable-consul-dataplane-as-sidecar=false \ -enabe-tcp-route=true startupProbe: httpGet: path: /readyz/ready port: 9445 scheme: HTTP initialDelaySeconds: 30 failureThreshold: 15 periodSeconds: 2 timeoutSeconds: 5 livenessProbe: httpGet: path: /readyz/ready port: 9445 scheme: HTTP failureThreshold: 2 initialDelaySeconds: 1 successThreshold: 1 timeoutSeconds: 5 readinessProbe: httpGet: path: /readyz/ready port: 9445 scheme: HTTP failureThreshold: 2 initialDelaySeconds: 2 successThreshold: 1 timeoutSeconds: 5 volumeMounts: - name: config mountPath: /consul/config readOnly: true - name: certs mountPath: /etc/connect-injector/certs readOnly: true - name: consul-ca-cert mountPath: /consul/tls/ca readOnly: true resources: limits: cpu: 50m memory: 200Mi requests: cpu: 50m memory: 200Mi volumes: - name: config configMap: name: consul-consul-connect-inject-config - name: certs secret: defaultMode: 420 secretName: consul-consul-connect-inject-webhook-cert - name: consul-ca-cert secret: secretName: consul-ca-cert items: - key: tls.crt path: tls.crt --- # Source: consul/templates/ingress-gateways-deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: name: consul-consul-ingress-gateway namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: ingress-gateway ingress-gateway-name: consul-consul-ingress-gateway spec: replicas: 1 selector: matchLabels: app: consul chart: consul-helm heritage: Helm release: consul component: ingress-gateway ingress-gateway-name: consul-consul-ingress-gateway template: metadata: labels: app: consul chart: consul-helm heritage: Helm release: consul component: ingress-gateway ingress-gateway-name: consul-consul-ingress-gateway consul.hashicorp.com/connect-inject-managed-by: consul-k8s-endpoints-controller annotations: "consul.hashicorp.com/connect-inject": "false" "consul.hashicorp.com/mesh-inject": "false" "consul.hashicorp.com/gateway-kind": "ingress-gateway" "consul.hashicorp.com/gateway-consul-service-name": "ingress-gateway" "consul.hashicorp.com/gateway-wan-address-source": "Service" "consul.hashicorp.com/gateway-wan-port": "8080" spec: terminationGracePeriodSeconds: 10 serviceAccountName: consul-consul-ingress-gateway volumes: - name: tmp emptyDir: medium: "Memory" - name: consul-service emptyDir: medium: "Memory" - name: consul-ca-cert secret: secretName: consul-ca-cert items: - key: tls.crt path: tls.crt initContainers: # ingress-gateway-init registers the ingress gateway service with Consul. - name: ingress-gateway-init image: hashicorp/consul-k8s-control-plane:2.0.0 securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - ALL runAsNonRoot: true seccompProfile: type: RuntimeDefault runAsUser: 100 env: - name: NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName - name: CONSUL_ADDRESSES value: consul-consul-server.consul.svc - name: CONSUL_GRPC_PORT value: "8502" - name: CONSUL_HTTP_PORT value: "8501" - name: CONSUL_DATACENTER value: dc1 - name: CONSUL_API_TIMEOUT value: 5s - name: CONSUL_USE_TLS value: "true" - name: CONSUL_CACERT_FILE value: "/consul/tls/ca/tls.crt" - name: CONSUL_LOGIN_AUTH_METHOD value: consul-consul-k8s-component-auth-method - name: CONSUL_LOGIN_DATACENTER value: dc1 - name: CONSUL_LOGIN_META value: "component=ingress-gateway,pod=$(NAMESPACE)/$(POD_NAME)" - name: CONSUL_NODE_NAME value: $(NODE_NAME)-virtual command: - "/bin/sh" - "-ec" - | exec consul-k8s-control-plane connect-init -pod-name=${POD_NAME} -pod-namespace=${NAMESPACE} \ -gateway-kind="ingress-gateway" \ -proxy-id-file=/consul/service/proxy-id \ -service-name=consul-consul-ingress-gateway \ -log-level=info \ -log-json=false volumeMounts: - name: tmp mountPath: /tmp - name: consul-service mountPath: /consul/service - name: consul-ca-cert mountPath: /consul/tls/ca readOnly: true resources: requests: memory: "50Mi" cpu: "50m" limits: memory: "50Mi" cpu: "50m" containers: - name: ingress-gateway image: "hashicorp/consul-dataplane:2.0.0" securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - ALL runAsNonRoot: true seccompProfile: type: RuntimeDefault runAsUser: 100 resources: limits: cpu: 100m memory: 100Mi requests: cpu: 100m memory: 100Mi volumeMounts: - name: tmp mountPath: /tmp - name: consul-service mountPath: /consul/service readOnly: true - name: consul-ca-cert mountPath: /consul/tls/ca readOnly: true env: - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: POD_IP valueFrom: fieldRef: fieldPath: status.podIP - name: NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName - name: DP_ENVOY_READY_BIND_ADDRESS valueFrom: fieldRef: fieldPath: status.podIP - name: DP_CREDENTIAL_LOGIN_META1 value: pod=$(NAMESPACE)/$(POD_NAME) - name: DP_CREDENTIAL_LOGIN_META2 value: component=ingress-gateway - name: DP_SERVICE_NODE_NAME value: $(NODE_NAME)-virtual args: - -envoy-ready-bind-port=21000 - -addresses=consul-consul-server.consul.svc - -grpc-port=8502 - -proxy-service-id-path=/consul/service/proxy-id - -ca-certs=/consul/tls/ca/tls.crt - -credential-type=login - -login-bearer-token-path=/var/run/secrets/kubernetes.io/serviceaccount/token - -login-auth-method=consul-consul-k8s-component-auth-method - -log-level=info - -log-json=false livenessProbe: tcpSocket: port: 21000 failureThreshold: 3 initialDelaySeconds: 30 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 readinessProbe: tcpSocket: port: 21000 failureThreshold: 3 initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 ports: - name: gateway-health containerPort: 21000 - name: gateway-0 containerPort: 8080 - name: gateway-1 containerPort: 8443 --- # Source: consul/templates/mesh-gateway-deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: name: consul-consul-mesh-gateway namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: mesh-gateway spec: replicas: 1 selector: matchLabels: app: consul chart: consul-helm release: consul component: mesh-gateway template: metadata: labels: app: consul chart: consul-helm release: consul component: mesh-gateway consul.hashicorp.com/connect-inject-managed-by: consul-k8s-endpoints-controller annotations: "consul.hashicorp.com/connect-inject": "false" "consul.hashicorp.com/mesh-inject": "false" "consul.hashicorp.com/gateway-kind": "mesh-gateway" "consul.hashicorp.com/gateway-consul-service-name": "mesh-gateway" "consul.hashicorp.com/mesh-gateway-container-port": "8443" "consul.hashicorp.com/gateway-wan-address-source": "Service" "consul.hashicorp.com/gateway-wan-address-static": "" "consul.hashicorp.com/gateway-wan-port": "443" spec: terminationGracePeriodSeconds: 10 serviceAccountName: consul-consul-mesh-gateway volumes: - name: consul-service emptyDir: medium: "Memory" - name: consul-ca-cert secret: secretName: consul-ca-cert items: - key: tls.crt path: tls.crt initContainers: - name: mesh-gateway-init securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true runAsNonRoot: true seccompProfile: type: RuntimeDefault capabilities: drop: - ALL image: hashicorp/consul-k8s-control-plane:2.0.0 env: - name: NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName - name: CONSUL_ADDRESSES value: consul-consul-server.consul.svc - name: CONSUL_GRPC_PORT value: "8502" - name: CONSUL_HTTP_PORT value: "8501" - name: CONSUL_DATACENTER value: dc1 - name: CONSUL_API_TIMEOUT value: 5s - name: CONSUL_USE_TLS value: "true" - name: CONSUL_CACERT_FILE value: "/consul/tls/ca/tls.crt" - name: CONSUL_LOGIN_AUTH_METHOD value: consul-consul-k8s-component-auth-method - name: CONSUL_LOGIN_DATACENTER value: dc1 - name: CONSUL_LOGIN_META value: "component=mesh-gateway,pod=$(NAMESPACE)/$(POD_NAME)" - name: CONSUL_NODE_NAME value: $(NODE_NAME)-virtual - name: DP_ENVOY_READY_BIND_ADDRESS valueFrom: fieldRef: fieldPath: status.podIP command: - "/bin/sh" - "-ec" - | exec consul-k8s-control-plane connect-init -pod-name=${POD_NAME} -pod-namespace=${NAMESPACE} \ -gateway-kind="mesh-gateway" \ -proxy-id-file=/consul/service/proxy-id \ -service-name=mesh-gateway \ -log-level=info \ -log-json=false volumeMounts: - name: consul-service mountPath: /consul/service - name: consul-ca-cert mountPath: /consul/tls/ca readOnly: true resources: limits: cpu: 50m memory: 50Mi requests: cpu: 50m memory: 50Mi containers: - name: mesh-gateway image: "hashicorp/consul-dataplane:2.0.0" securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true runAsNonRoot: true seccompProfile: type: RuntimeDefault capabilities: drop: - ALL resources: limits: cpu: 100m memory: 100Mi requests: cpu: 100m memory: 100Mi volumeMounts: - mountPath: /consul/service name: consul-service readOnly: true - name: consul-ca-cert mountPath: /consul/tls/ca readOnly: true env: - name: NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: HOST_IP valueFrom: fieldRef: fieldPath: status.hostIP - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName - name: DP_CREDENTIAL_LOGIN_META1 value: pod=$(NAMESPACE)/$(POD_NAME) - name: DP_CREDENTIAL_LOGIN_META2 value: component=mesh-gateway - name: DP_SERVICE_NODE_NAME value: $(NODE_NAME)-virtual command: - consul-dataplane args: - -addresses=consul-consul-server.consul.svc - -grpc-port=8502 - -proxy-service-id-path=/consul/service/proxy-id - -ca-certs=/consul/tls/ca/tls.crt - -credential-type=login - -login-bearer-token-path=/var/run/secrets/kubernetes.io/serviceaccount/token - -login-auth-method=consul-consul-k8s-component-auth-method - -log-level=info - -log-json=false - -envoy-admin-bind-address=127.0.0.1 - -xds-bind-addr=127.0.0.1 - -graceful-addr=127.0.0.1 - -consul-dns-bind-addr=127.0.0.1 livenessProbe: tcpSocket: port: 8443 failureThreshold: 3 initialDelaySeconds: 30 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 readinessProbe: tcpSocket: port: 8443 failureThreshold: 3 initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 ports: - name: gateway containerPort: 8443 --- # Source: consul/templates/terminating-gateways-deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: name: consul-consul-terminating-gateway namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: terminating-gateway terminating-gateway-name: consul-consul-terminating-gateway spec: replicas: 1 selector: matchLabels: app: consul chart: consul-helm heritage: Helm release: consul component: terminating-gateway terminating-gateway-name: consul-consul-terminating-gateway template: metadata: labels: app: consul chart: consul-helm heritage: Helm release: consul component: terminating-gateway terminating-gateway-name: consul-consul-terminating-gateway consul.hashicorp.com/connect-inject-managed-by: consul-k8s-endpoints-controller annotations: "consul.hashicorp.com/connect-inject": "false" "consul.hashicorp.com/mesh-inject": "false" "consul.hashicorp.com/gateway-kind": "terminating-gateway" "consul.hashicorp.com/gateway-consul-service-name": "terminating-gateway" spec: terminationGracePeriodSeconds: 10 serviceAccountName: consul-consul-terminating-gateway volumes: - name: tmp emptyDir: medium: "Memory" - name: consul-service emptyDir: medium: "Memory" - name: consul-ca-cert secret: secretName: consul-ca-cert items: - key: tls.crt path: tls.crt initContainers: # terminating-gateway-init registers the terminating gateway service with Consul. - name: terminating-gateway-init image: hashicorp/consul-k8s-control-plane:2.0.0 securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - ALL runAsNonRoot: true seccompProfile: type: RuntimeDefault runAsUser: 100 env: - name: NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName - name: CONSUL_ADDRESSES value: consul-consul-server.consul.svc - name: CONSUL_GRPC_PORT value: "8502" - name: CONSUL_HTTP_PORT value: "8501" - name: CONSUL_DATACENTER value: dc1 - name: CONSUL_API_TIMEOUT value: 5s - name: CONSUL_USE_TLS value: "true" - name: CONSUL_CACERT_FILE value: "/consul/tls/ca/tls.crt" - name: CONSUL_LOGIN_AUTH_METHOD value: consul-consul-k8s-component-auth-method - name: CONSUL_LOGIN_DATACENTER value: dc1 - name: CONSUL_LOGIN_META value: "component=terminating-gateway,pod=$(NAMESPACE)/$(POD_NAME)" - name: CONSUL_NODE_NAME value: $(NODE_NAME)-virtual command: - "/bin/sh" - "-ec" - | exec consul-k8s-control-plane connect-init -pod-name=${POD_NAME} -pod-namespace=${NAMESPACE} \ -gateway-kind="terminating-gateway" \ -proxy-id-file=/consul/service/proxy-id \ -service-name=terminating-gateway \ -log-level=info \ -log-json=false volumeMounts: - name: tmp mountPath: /tmp - name: consul-service mountPath: /consul/service - name: consul-ca-cert mountPath: /consul/tls/ca readOnly: true resources: requests: memory: "50Mi" cpu: "50m" limits: memory: "50Mi" cpu: "50m" containers: - name: terminating-gateway image: "hashicorp/consul-dataplane:2.0.0" securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - ALL runAsNonRoot: true seccompProfile: type: RuntimeDefault runAsUser: 100 volumeMounts: - name: tmp mountPath: /tmp - name: consul-service mountPath: /consul/service readOnly: true - name: consul-ca-cert mountPath: /consul/tls/ca readOnly: true resources: limits: cpu: 100m memory: 100Mi requests: cpu: 100m memory: 100Mi env: - name: NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName - name: DP_CREDENTIAL_LOGIN_META1 value: pod=$(NAMESPACE)/$(POD_NAME) - name: DP_CREDENTIAL_LOGIN_META2 value: component=terminating-gateway - name: DP_SERVICE_NODE_NAME value: $(NODE_NAME)-virtual - name: DP_ENVOY_READY_BIND_ADDRESS valueFrom: fieldRef: fieldPath: status.podIP command: - consul-dataplane args: - -addresses=consul-consul-server.consul.svc - -grpc-port=8502 - -proxy-service-id-path=/consul/service/proxy-id - -ca-certs=/consul/tls/ca/tls.crt - -credential-type=login - -login-bearer-token-path=/var/run/secrets/kubernetes.io/serviceaccount/token - -login-auth-method=consul-consul-k8s-component-auth-method - -log-level=info - -log-json=false - -envoy-admin-bind-address=127.0.0.1 - -xds-bind-addr=127.0.0.1 - -graceful-addr=127.0.0.1 - -consul-dns-bind-addr=127.0.0.1 livenessProbe: tcpSocket: port: 8443 failureThreshold: 3 initialDelaySeconds: 30 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 readinessProbe: tcpSocket: port: 8443 failureThreshold: 3 initialDelaySeconds: 10 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 5 ports: - name: gateway containerPort: 8443 --- # Source: consul/templates/webhook-cert-manager-deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: name: consul-consul-webhook-cert-manager namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: webhook-cert-manager spec: replicas: 1 selector: matchLabels: app: consul chart: consul-helm heritage: Helm release: consul component: webhook-cert-manager template: metadata: labels: app: consul chart: consul-helm heritage: Helm release: consul component: webhook-cert-manager annotations: "consul.hashicorp.com/connect-inject": "false" "consul.hashicorp.com/mesh-inject": "false" "consul.hashicorp.com/config-checksum": 5c56adb036f422730e191acba57dde5687378dd36f4fcc2098a4f44fbf355537 spec: containers: - command: - "/bin/sh" - "-ec" - | exec consul-k8s-control-plane webhook-cert-manager \ -log-level=info \ -log-json=false \ -config-file=/bootstrap/config/webhook-config.json \ -deployment-name=consul-consul-webhook-cert-manager \ -deployment-namespace=consul image: hashicorp/consul-k8s-control-plane:2.0.0 name: webhook-cert-manager securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - ALL runAsNonRoot: true seccompProfile: type: RuntimeDefault runAsUser: 100 resources: limits: cpu: 100m memory: 50Mi requests: cpu: 100m memory: 50Mi volumeMounts: - name: config mountPath: /bootstrap/config terminationGracePeriodSeconds: 10 serviceAccountName: consul-consul-webhook-cert-manager volumes: - name: config configMap: name: consul-consul-webhook-cert-manager-config --- # Source: consul/templates/server-statefulset.yaml # StatefulSet to run the actual Consul server cluster. apiVersion: apps/v1 kind: StatefulSet metadata: name: consul-consul-server namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: server spec: serviceName: consul-consul-server podManagementPolicy: Parallel replicas: 3 selector: matchLabels: app: consul chart: consul-helm release: consul component: server hasDNS: "true" template: metadata: labels: app: consul chart: consul-helm release: consul component: server hasDNS: "true" annotations: "consul.hashicorp.com/connect-inject": "false" "consul.hashicorp.com/mesh-inject": "false" "consul.hashicorp.com/config-checksum": bb57adf538e46ee259eef61cc62a7daa6742febed0a50e08dec357135adce136 spec: affinity: podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: - labelSelector: matchLabels: app: consul release: "consul" component: server topologyKey: kubernetes.io/hostname terminationGracePeriodSeconds: 30 serviceAccountName: consul-consul-server securityContext: fsGroup: 1000 runAsGroup: 1000 runAsNonRoot: true runAsUser: 100 volumes: - name: tmp emptyDir: {} - name: config configMap: name: consul-consul-server-config - name: extra-config emptyDir: {} - name: tmp-extra-config configMap: name: consul-consul-server-tmp-extra-config - name: consul-ca-cert secret: secretName: consul-ca-cert items: - key: tls.crt path: tls.crt - name: consul-server-cert secret: secretName: consul-server-cert initContainers: - name: locality-init image: hashicorp/consul-k8s-control-plane:2.0.0 env: - name: NODE_NAME valueFrom: fieldRef: fieldPath: spec.nodeName command: - "/bin/sh" - "-ec" - | exec consul-k8s-control-plane fetch-server-region -node-name "$NODE_NAME" -output-file /consul/extra-config/locality.json volumeMounts: - name: extra-config mountPath: /consul/extra-config securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - ALL runAsNonRoot: true seccompProfile: type: RuntimeDefault runAsUser: 100 containers: - name: consul image: "hashicorp/consul:2.0.0" env: - name: ADVERTISE_IP valueFrom: fieldRef: fieldPath: status.podIP - name: HOST_IP valueFrom: fieldRef: fieldPath: status.hostIP - name: POD_IP valueFrom: fieldRef: fieldPath: status.podIP - name: CONSUL_DISABLE_PERM_MGMT value: "true" - name: GOSSIP_KEY valueFrom: secretKeyRef: name: consul-gossip-encryption-key key: key - name: CONSUL_HTTP_ADDR value: https://localhost:8501 - name: CONSUL_CACERT value: /consul/tls/ca/tls.crt - name: ACL_BOOTSTRAP_TOKEN valueFrom: secretKeyRef: name: "consul-bootstrap-acl-token" key: "token" command: - "/bin/sh" - "-ec" - | cp /consul/tmp/extra-config/extra-from-values.json /consul/extra-config/extra-from-values.json [ -n "${HOST_IP}" ] && sed -Ei "s|HOST_IP|${HOST_IP?}|g" /consul/extra-config/extra-from-values.json [ -n "${POD_IP}" ] && sed -Ei "s|POD_IP|${POD_IP?}|g" /consul/extra-config/extra-from-values.json [ -n "${HOSTNAME}" ] && sed -Ei "s|HOSTNAME|${HOSTNAME?}|g" /consul/extra-config/extra-from-values.json exec /usr/local/bin/docker-entrypoint.sh consul agent \ -advertise="${ADVERTISE_IP}" \ -config-dir=/consul/config \ -encrypt="${GOSSIP_KEY}" \ -hcl="acl { tokens { initial_management = \"${ACL_BOOTSTRAP_TOKEN}\" } }" \ -config-dir=/consul/extra-config \ volumeMounts: - name: data-consul mountPath: /consul/data - name: config mountPath: /consul/config - name: extra-config mountPath: /consul/extra-config - name: tmp-extra-config mountPath: /consul/tmp/extra-config - name: consul-ca-cert mountPath: /consul/tls/ca/ readOnly: true - name: consul-server-cert mountPath: /consul/tls/server readOnly: true - name: tmp mountPath: /tmp readOnly: false ports: - name: https containerPort: 8501 - name: grpc containerPort: 8502 protocol: "TCP" - name: serflan-tcp containerPort: 8301 protocol: "TCP" - name: serflan-udp containerPort: 8301 protocol: "UDP" - name: serfwan-tcp containerPort: 8302 protocol: "TCP" - name: serfwan-udp containerPort: 8302 protocol: "UDP" - name: server containerPort: 8300 - name: dns-tcp containerPort: 8600 protocol: "TCP" - name: dns-udp containerPort: 8600 protocol: "UDP" readinessProbe: # NOTE(mitchellh): when our HTTP status endpoints support the # proper status codes, we should switch to that. This is temporary. exec: command: - "/bin/sh" - "-ec" - | curl -k \ https://127.0.0.1:8501/v1/status/leader \ 2>/dev/null | grep -E '".+"' failureThreshold: 2 initialDelaySeconds: 5 periodSeconds: 3 successThreshold: 1 timeoutSeconds: 5 resources: limits: cpu: 100m memory: 200Mi requests: cpu: 100m memory: 200Mi securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - ALL runAsNonRoot: true seccompProfile: type: RuntimeDefault runAsUser: 100 volumeClaimTemplates: - metadata: name: data-consul spec: accessModes: - ReadWriteOnce resources: requests: storage: 10Gi --- # Source: consul/templates/server-acl-init-job.yaml apiVersion: batch/v1 kind: Job metadata: name: consul-consul-server-acl-init namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: server-acl-init spec: template: metadata: name: consul-consul-server-acl-init labels: app: consul chart: consul-helm release: consul component: server-acl-init annotations: "consul.hashicorp.com/connect-inject": "false" "consul.hashicorp.com/mesh-inject": "false" spec: restartPolicy: Never serviceAccountName: consul-consul-server-acl-init volumes: - name: consul-ca-cert secret: secretName: consul-ca-cert items: - key: tls.crt path: tls.crt containers: - name: server-acl-init-job image: hashicorp/consul-k8s-control-plane:2.0.0 securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - ALL runAsNonRoot: true seccompProfile: type: RuntimeDefault runAsUser: 100 env: - name: NAMESPACE valueFrom: fieldRef: fieldPath: metadata.namespace - name: POD_NAME valueFrom: fieldRef: fieldPath: metadata.name # Extract the Vault namespace from the Vault agent annotations. - name: CONSUL_ADDRESSES value: consul-consul-server.consul.svc - name: CONSUL_GRPC_PORT value: "8502" - name: CONSUL_HTTP_PORT value: "8501" - name: CONSUL_DATACENTER value: dc1 - name: CONSUL_API_TIMEOUT value: 5s - name: CONSUL_USE_TLS value: "true" - name: CONSUL_CACERT_FILE value: "/consul/tls/ca/tls.crt" volumeMounts: - name: consul-ca-cert mountPath: /consul/tls/ca readOnly: true command: - "/bin/sh" - "-ec" - | CONSUL_FULLNAME="consul-consul" exec consul-k8s-control-plane server-acl-init \ -log-level=info \ -log-json=false \ -resource-prefix=${CONSUL_FULLNAME} \ -k8s-namespace=consul \ -set-server-tokens=true \ -secrets-backend=kubernetes \ -bootstrap-token-secret-name=consul-bootstrap-acl-token \ -bootstrap-token-secret-key=token \ -allow-dns=true \ -connect-inject=true \ -mesh-gateway=true \ -ingress-gateway-name="ingress-gateway" \ -terminating-gateway-name="terminating-gateway" \ -acl-binding-rule-selector=serviceaccount.name!=default \ -client=false \ resources: limits: cpu: 50m memory: 50Mi requests: cpu: 50m memory: 50Mi --- # Source: consul/templates/ui-ingress.yaml apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: consul-consul-ui namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: ui spec: rules: - host: "consul.example.invalid" http: paths: - backend: service: name: consul-consul-ui port: number: 443 path: / pathType: Prefix --- # Source: consul/templates/connect-inject-mutatingwebhookconfiguration.yaml # The MutatingWebhookConfiguration to enable the Connect injector. apiVersion: admissionregistration.k8s.io/v1 kind: MutatingWebhookConfiguration metadata: name: consul-consul-connect-injector namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: connect-injector webhooks: - clientConfig: service: name: consul-consul-connect-injector namespace: consul path: /mutate-v1alpha1-proxydefaults failurePolicy: Fail admissionReviewVersions: - "v1beta1" - "v1" name: mutate-proxydefaults.consul.hashicorp.com rules: - apiGroups: - consul.hashicorp.com apiVersions: - v1alpha1 operations: - CREATE - UPDATE resources: - proxydefaults sideEffects: None - clientConfig: service: name: consul-consul-connect-injector namespace: consul path: /mutate-v1alpha1-mesh failurePolicy: Fail admissionReviewVersions: - "v1beta1" - "v1" name: mutate-mesh.consul.hashicorp.com rules: - apiGroups: - consul.hashicorp.com apiVersions: - v1alpha1 operations: - CREATE - UPDATE resources: - meshes sideEffects: None - clientConfig: service: name: consul-consul-connect-injector namespace: consul path: /mutate-v1alpha1-servicedefaults failurePolicy: Fail admissionReviewVersions: - "v1beta1" - "v1" name: mutate-servicedefaults.consul.hashicorp.com rules: - apiGroups: - consul.hashicorp.com apiVersions: - v1alpha1 operations: - CREATE - UPDATE resources: - servicedefaults sideEffects: None - clientConfig: service: name: consul-consul-connect-injector namespace: consul path: /mutate-v1alpha1-serviceresolver failurePolicy: Fail admissionReviewVersions: - "v1beta1" - "v1" name: mutate-serviceresolver.consul.hashicorp.com rules: - apiGroups: - consul.hashicorp.com apiVersions: - v1alpha1 operations: - CREATE - UPDATE resources: - serviceresolvers sideEffects: None - clientConfig: service: name: consul-consul-connect-injector namespace: consul path: /mutate-v1alpha1-servicerouter failurePolicy: Fail admissionReviewVersions: - "v1beta1" - "v1" name: mutate-servicerouter.consul.hashicorp.com rules: - apiGroups: - consul.hashicorp.com apiVersions: - v1alpha1 operations: - CREATE - UPDATE resources: - servicerouters sideEffects: None - clientConfig: service: name: consul-consul-connect-injector namespace: consul path: /mutate-v1alpha1-servicesplitter failurePolicy: Fail admissionReviewVersions: - "v1beta1" - "v1" name: mutate-servicesplitter.consul.hashicorp.com rules: - apiGroups: - consul.hashicorp.com apiVersions: - v1alpha1 operations: - CREATE - UPDATE resources: - servicesplitters sideEffects: None - clientConfig: service: name: consul-consul-connect-injector namespace: consul path: /mutate-v1alpha1-serviceintentions failurePolicy: Fail admissionReviewVersions: - "v1beta1" - "v1" name: mutate-serviceintentions.consul.hashicorp.com rules: - apiGroups: - consul.hashicorp.com apiVersions: - v1alpha1 operations: - CREATE - UPDATE resources: - serviceintentions sideEffects: None - clientConfig: service: name: consul-consul-connect-injector namespace: consul path: /mutate-v1alpha1-ingressgateway failurePolicy: Fail admissionReviewVersions: - "v1beta1" - "v1" name: mutate-ingressgateway.consul.hashicorp.com rules: - apiGroups: - consul.hashicorp.com apiVersions: - v1alpha1 operations: - CREATE - UPDATE resources: - ingressgateways sideEffects: None - clientConfig: service: name: consul-consul-connect-injector namespace: consul path: /mutate-v1alpha1-terminatinggateway failurePolicy: Fail admissionReviewVersions: - "v1beta1" - "v1" name: mutate-terminatinggateway.consul.hashicorp.com rules: - apiGroups: - consul.hashicorp.com apiVersions: - v1alpha1 operations: - CREATE - UPDATE resources: - terminatinggateways sideEffects: None - clientConfig: service: name: consul-consul-connect-injector namespace: consul path: /mutate-v1alpha1-exportedservices failurePolicy: Fail admissionReviewVersions: - "v1beta1" - "v1" name: mutate-exportedservices.consul.hashicorp.com rules: - apiGroups: - consul.hashicorp.com apiVersions: - v1alpha1 operations: - CREATE - UPDATE resources: - exportedservices sideEffects: None - clientConfig: service: name: consul-consul-connect-injector namespace: consul path: /mutate-v1alpha1-controlplanerequestlimits failurePolicy: Fail admissionReviewVersions: - "v1beta1" - "v1" name: mutate-controlplanerequestlimit.consul.hashicorp.com rules: - apiGroups: - consul.hashicorp.com apiVersions: - v1alpha1 operations: - CREATE - UPDATE resources: - controlplanerequestlimits sideEffects: None - clientConfig: service: name: consul-consul-connect-injector namespace: consul path: /mutate-v1alpha1-ratelimits failurePolicy: Fail admissionReviewVersions: - "v1beta1" - "v1" name: mutate-ratelimits.consul.hashicorp.com rules: - apiGroups: - consul.hashicorp.com apiVersions: - v1alpha1 operations: - CREATE - UPDATE resources: - ratelimits sideEffects: None - name: consul-consul-connect-injector.consul.hashicorp.com # The webhook will fail scheduling all pods that are not part of consul if all replicas of the webhook are unhealthy. objectSelector: matchExpressions: - key: app operator: NotIn values: [ consul ] failurePolicy: Fail sideEffects: None admissionReviewVersions: - "v1beta1" - "v1" clientConfig: service: name: consul-consul-connect-injector namespace: consul path: "/mutate" rules: - operations: [ "CREATE" ] apiGroups: [ "" ] apiVersions: [ "v1" ] resources: [ "pods" ] namespaceSelector: matchExpressions: - key: "kubernetes.io/metadata.name" operator: "NotIn" values: ["kube-system","local-path-storage","openebs","gmp-system","gke-managed-cim"] - admissionReviewVersions: - v1beta1 - v1 clientConfig: service: name: consul-consul-connect-injector namespace: consul path: /mutate-v1alpha1-jwtprovider failurePolicy: Fail name: mutate-jwtprovider.consul.hashicorp.com rules: - apiGroups: - consul.hashicorp.com apiVersions: - v1alpha1 operations: - CREATE - UPDATE resources: - jwtproviders sideEffects: None --- # Source: consul/templates/connect-inject-validatingwebhookconfiguration.yaml # The ValidatingWebhookConfiguration to enable the Connect injector. apiVersion: admissionregistration.k8s.io/v1 kind: ValidatingWebhookConfiguration metadata: name: consul-consul-connect-injector namespace: consul labels: app: consul chart: consul-helm heritage: Helm release: consul component: connect-injector webhooks: - name: validate-gatewaypolicy.consul.hashicorp.com matchPolicy: Equivalent rules: - operations: [ "CREATE" , "UPDATE" ] apiGroups: [ "consul.hashicorp.com" ] apiVersions: [ "v1alpha1" ] resources: [ "gatewaypolicies" ] failurePolicy: Fail sideEffects: None admissionReviewVersions: - v1 clientConfig: service: name: consul-consul-connect-injector namespace: consul path: /validate-v1alpha1-gatewaypolicy - name: validate-customgatewaypolicy.consul.hashicorp.com matchPolicy: Equivalent rules: - operations: [ "CREATE" , "UPDATE" ] apiGroups: [ "consul.hashicorp.com" ] apiVersions: [ "v1alpha1" ] resources: [ "customgatewaypolicies" ] failurePolicy: Fail sideEffects: None admissionReviewVersions: - v1 clientConfig: service: name: consul-consul-connect-injector namespace: consul path: /validate-v1alpha1-gatewaypolicy-custom - name: validate-registration.consul.hashicorp.com matchPolicy: Equivalent rules: - operations: [ "CREATE" , "UPDATE" ] apiGroups: [ "consul.hashicorp.com" ] apiVersions: [ "v1alpha1" ] resources: [ "registrations" ] failurePolicy: Fail sideEffects: None admissionReviewVersions: - v1 clientConfig: service: name: consul-consul-connect-injector namespace: consul path: /validate-v1alpha1-registration --- # Source: consul/templates/generate-manifests-apply-job.yaml # echo "Deleting PVC: consul-consul-gatewayapi-pvc in namespace consul" # kubectl delete pvc consul-consul-gatewayapi-pvc -n consul --ignore-not-found=true