{
  "properties": {
    "spec": {
      "description": "Customizing Envoy configuration generated by Istio. See more details at: https://istio.io/docs/reference/config/networking/envoy-filter.html",
      "properties": {
        "configPatches": {
          "description": "One or more patches with match conditions.",
          "items": {
            "type": "object",
            "properties": {
              "applyTo": {
                "description": "Specifies where in the Envoy configuration, the patch should be applied.\n\nValid Options: LISTENER, FILTER_CHAIN, NETWORK_FILTER, HTTP_FILTER, ROUTE_CONFIGURATION, VIRTUAL_HOST, HTTP_ROUTE, CLUSTER, EXTENSION_CONFIG, BOOTSTRAP, LISTENER_FILTER",
                "type": "string",
                "enum": [
                  "INVALID",
                  "LISTENER",
                  "FILTER_CHAIN",
                  "NETWORK_FILTER",
                  "HTTP_FILTER",
                  "ROUTE_CONFIGURATION",
                  "VIRTUAL_HOST",
                  "HTTP_ROUTE",
                  "CLUSTER",
                  "EXTENSION_CONFIG",
                  "BOOTSTRAP",
                  "LISTENER_FILTER"
                ]
              },
              "match": {
                "description": "Match on listener/route configuration/cluster.",
                "type": "object",
                "oneOf": [
                  {
                    "not": {
                      "anyOf": [
                        {
                          "required": [
                            "listener"
                          ]
                        },
                        {
                          "required": [
                            "routeConfiguration"
                          ]
                        },
                        {
                          "required": [
                            "cluster"
                          ]
                        }
                      ]
                    }
                  },
                  {
                    "required": [
                      "listener"
                    ]
                  },
                  {
                    "required": [
                      "routeConfiguration"
                    ]
                  },
                  {
                    "required": [
                      "cluster"
                    ]
                  }
                ],
                "properties": {
                  "cluster": {
                    "description": "Match on envoy cluster attributes.",
                    "type": "object",
                    "properties": {
                      "name": {
                        "description": "The exact name of the cluster to match.",
                        "type": "string"
                      },
                      "portNumber": {
                        "description": "The service port for which this cluster was generated.",
                        "type": "integer",
                        "maximum": 4294967295,
                        "minimum": 0
                      },
                      "service": {
                        "description": "The fully qualified service name for this cluster.",
                        "type": "string"
                      },
                      "subset": {
                        "description": "The subset associated with the service.",
                        "type": "string"
                      }
                    }
                  },
                  "context": {
                    "description": "The specific config generation context to match on.\n\nValid Options: ANY, SIDECAR_INBOUND, SIDECAR_OUTBOUND, GATEWAY",
                    "type": "string",
                    "enum": [
                      "ANY",
                      "SIDECAR_INBOUND",
                      "SIDECAR_OUTBOUND",
                      "GATEWAY"
                    ]
                  },
                  "listener": {
                    "description": "Match on envoy listener attributes.",
                    "type": "object",
                    "properties": {
                      "filterChain": {
                        "description": "Match a specific filter chain in a listener.",
                        "type": "object",
                        "properties": {
                          "applicationProtocols": {
                            "description": "Applies only to sidecars.",
                            "type": "string"
                          },
                          "destinationPort": {
                            "description": "The destination_port value used by a filter chain's match condition.",
                            "type": "integer",
                            "maximum": 4294967295,
                            "minimum": 0
                          },
                          "filter": {
                            "description": "The name of a specific filter to apply the patch to.",
                            "type": "object",
                            "properties": {
                              "name": {
                                "description": "The filter name to match on.",
                                "type": "string"
                              },
                              "subFilter": {
                                "description": "The next level filter within this filter to match upon.",
                                "type": "object",
                                "properties": {
                                  "name": {
                                    "description": "The filter name to match on.",
                                    "type": "string"
                                  }
                                }
                              }
                            }
                          },
                          "name": {
                            "description": "The name assigned to the filter chain.",
                            "type": "string"
                          },
                          "sni": {
                            "description": "The SNI value used by a filter chain's match condition.",
                            "type": "string"
                          },
                          "transportProtocol": {
                            "description": "Applies only to `SIDECAR_INBOUND` context.",
                            "type": "string"
                          }
                        }
                      },
                      "listenerFilter": {
                        "description": "Match a specific listener filter.",
                        "type": "string"
                      },
                      "name": {
                        "description": "Match a specific listener by its name.",
                        "type": "string"
                      },
                      "portName": {
                        "type": "string"
                      },
                      "portNumber": {
                        "description": "The service port/gateway port to which traffic is being sent/received.",
                        "type": "integer",
                        "maximum": 4294967295,
                        "minimum": 0
                      }
                    }
                  },
                  "proxy": {
                    "description": "Match on properties associated with a proxy.",
                    "type": "object",
                    "properties": {
                      "metadata": {
                        "description": "Match on the node metadata supplied by a proxy when connecting to istiod.",
                        "type": "object",
                        "additionalProperties": {
                          "type": "string"
                        }
                      },
                      "proxyVersion": {
                        "description": "A regular expression in golang regex format (RE2) that can be used to select proxies using a specific version of istio proxy.",
                        "type": "string"
                      }
                    }
                  },
                  "routeConfiguration": {
                    "description": "Match on envoy HTTP route configuration attributes.",
                    "type": "object",
                    "properties": {
                      "gateway": {
                        "description": "The Istio gateway config's namespace/name for which this route configuration was generated.",
                        "type": "string"
                      },
                      "name": {
                        "description": "Route configuration name to match on.",
                        "type": "string"
                      },
                      "portName": {
                        "description": "Applicable only for GATEWAY context.",
                        "type": "string"
                      },
                      "portNumber": {
                        "description": "The service port number or gateway server port number for which this route configuration was generated.",
                        "type": "integer",
                        "maximum": 4294967295,
                        "minimum": 0
                      },
                      "vhost": {
                        "description": "Match a specific virtual host in a route configuration and apply the patch to the virtual host.",
                        "type": "object",
                        "properties": {
                          "name": {
                            "description": "The VirtualHosts objects generated by Istio are named as host:port, where the host typically corresponds to the VirtualService's host field or the hostname of a service in the registry.",
                            "type": "string"
                          },
                          "route": {
                            "description": "Match a specific route within the virtual host.",
                            "type": "object",
                            "properties": {
                              "action": {
                                "description": "Match a route with specific action type.\n\nValid Options: ANY, ROUTE, REDIRECT, DIRECT_RESPONSE",
                                "type": "string",
                                "enum": [
                                  "ANY",
                                  "ROUTE",
                                  "REDIRECT",
                                  "DIRECT_RESPONSE"
                                ]
                              },
                              "name": {
                                "description": "The Route objects generated by default are named as default.",
                                "type": "string"
                              }
                            }
                          }
                        }
                      }
                    }
                  }
                }
              },
              "patch": {
                "description": "The patch to apply along with the operation.",
                "type": "object",
                "properties": {
                  "filterClass": {
                    "description": "Determines the filter insertion order.\n\nValid Options: AUTHN, AUTHZ, STATS",
                    "type": "string",
                    "enum": [
                      "UNSPECIFIED",
                      "AUTHN",
                      "AUTHZ",
                      "STATS"
                    ]
                  },
                  "operation": {
                    "description": "Determines how the patch should be applied.\n\nValid Options: MERGE, ADD, REMOVE, INSERT_BEFORE, INSERT_AFTER, INSERT_FIRST, REPLACE",
                    "type": "string",
                    "enum": [
                      "INVALID",
                      "MERGE",
                      "ADD",
                      "REMOVE",
                      "INSERT_BEFORE",
                      "INSERT_AFTER",
                      "INSERT_FIRST",
                      "REPLACE"
                    ]
                  },
                  "value": {
                    "description": "The JSON config of the object being patched.",
                    "type": "object",
                    "x-kubernetes-preserve-unknown-fields": true
                  }
                }
              }
            }
          },
          "type": "array"
        },
        "priority": {
          "description": "Priority defines the order in which patch sets are applied within a context.",
          "format": "int32",
          "type": "integer"
        },
        "targetRefs": {
          "description": "Optional.",
          "items": {
            "type": "object",
            "required": [
              "kind",
              "name"
            ],
            "properties": {
              "group": {
                "description": "group is the group of the target resource.",
                "type": "string",
                "maxLength": 253,
                "pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
              },
              "kind": {
                "description": "kind is kind of the target resource.",
                "type": "string",
                "maxLength": 63,
                "minLength": 1,
                "pattern": "^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$"
              },
              "name": {
                "description": "name is the name of the target resource.",
                "type": "string",
                "maxLength": 253,
                "minLength": 1
              },
              "namespace": {
                "description": "namespace is the namespace of the referent.",
                "type": "string",
                "x-kubernetes-validations": [
                  {
                    "rule": "self.size() == 0",
                    "message": "cross namespace referencing is not currently supported"
                  }
                ]
              }
            },
            "x-kubernetes-validations": [
              {
                "rule": "[self.group, self.kind] in [['core','Service'], ['','Service'], ['gateway.networking.k8s.io','Gateway'], ['networking.istio.io','ServiceEntry']]",
                "message": "Support kinds are core/Service, networking.istio.io/ServiceEntry, gateway.networking.k8s.io/Gateway"
              }
            ]
          },
          "maxItems": 16,
          "type": "array"
        },
        "workloadSelector": {
          "description": "Criteria used to select the specific set of pods/VMs on which this patch configuration should be applied.",
          "properties": {
            "labels": {
              "additionalProperties": {
                "type": "string",
                "maxLength": 63,
                "x-kubernetes-validations": [
                  {
                    "rule": "!self.contains('*')",
                    "message": "wildcard is not supported in selector"
                  }
                ]
              },
              "description": "One or more labels that indicate a specific set of pods/VMs on which the configuration should be applied.",
              "maxProperties": 256,
              "type": "object"
            }
          },
          "type": "object"
        }
      },
      "type": "object",
      "x_kubernetes_validations": [
        {
          "message": "only one of targetRefs or workloadSelector can be set",
          "rule": "(has(self.workloadSelector)?1:0)+(has(self.targetRefs)?1:0)<=1"
        }
      ]
    },
    "status": {
      "properties": {
        "conditions": {
          "description": "Current service state of the resource.",
          "items": {
            "type": "object",
            "properties": {
              "lastProbeTime": {
                "description": "Last time we probed the condition.",
                "type": "string",
                "format": "date-time"
              },
              "lastTransitionTime": {
                "description": "Last time the condition transitioned from one status to another.",
                "type": "string",
                "format": "date-time"
              },
              "message": {
                "description": "Human-readable message indicating details about last transition.",
                "type": "string"
              },
              "reason": {
                "description": "Unique, one-word, CamelCase reason for the condition's last transition.",
                "type": "string"
              },
              "status": {
                "description": "Status is the status of the condition.",
                "type": "string"
              },
              "type": {
                "description": "Type is the type of the condition.",
                "type": "string"
              }
            }
          },
          "type": "array"
        },
        "observedGeneration": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "description": "Resource Generation to which the Reconciled Condition refers.",
          "x_kubernetes_int_or_string": true
        },
        "validationMessages": {
          "description": "Includes any errors or warnings detected by Istio's analyzers.",
          "items": {
            "type": "object",
            "properties": {
              "documentationUrl": {
                "description": "A url pointing to the Istio documentation for this specific error type.",
                "type": "string"
              },
              "level": {
                "description": "Represents how severe a message is.\n\nValid Options: UNKNOWN, ERROR, WARNING, INFO",
                "type": "string",
                "enum": [
                  "UNKNOWN",
                  "ERROR",
                  "WARNING",
                  "INFO"
                ]
              },
              "type": {
                "type": "object",
                "properties": {
                  "code": {
                    "description": "A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.",
                    "type": "string"
                  },
                  "name": {
                    "description": "A human-readable name for the message type.",
                    "type": "string"
                  }
                }
              }
            }
          },
          "type": "array"
        }
      },
      "type": "object",
      "x_kubernetes_preserve_unknown_fields": true
    }
  },
  "type": "object"
}