{
  "properties": {
    "spec": {
      "description": "Configuration affecting network reachability of a sidecar. See more details at: https://istio.io/docs/reference/config/networking/sidecar.html",
      "properties": {
        "egress": {
          "description": "Egress specifies the configuration of the sidecar for processing outbound traffic from the attached workload instance to other services in the mesh.",
          "items": {
            "type": "object",
            "required": [
              "hosts"
            ],
            "properties": {
              "bind": {
                "description": "The IP(IPv4 or IPv6) or the Unix domain socket to which the listener should be bound to.",
                "type": "string"
              },
              "captureMode": {
                "description": "When the bind address is an IP, the captureMode option dictates how traffic to the listener is expected to be captured (or not).\n\nValid Options: DEFAULT, IPTABLES, NONE",
                "type": "string",
                "enum": [
                  "DEFAULT",
                  "IPTABLES",
                  "NONE"
                ]
              },
              "hosts": {
                "description": "One or more service hosts exposed by the listener in `namespace/dnsName` format.",
                "type": "array",
                "items": {
                  "type": "string"
                }
              },
              "port": {
                "description": "The port associated with the listener.",
                "type": "object",
                "properties": {
                  "name": {
                    "description": "Label assigned to the port.",
                    "type": "string"
                  },
                  "number": {
                    "description": "A valid non-negative integer port number.",
                    "type": "integer",
                    "maximum": 4294967295,
                    "minimum": 0
                  },
                  "protocol": {
                    "description": "The protocol exposed on the port.",
                    "type": "string"
                  },
                  "targetPort": {
                    "type": "integer",
                    "maximum": 4294967295,
                    "minimum": 0
                  }
                }
              }
            }
          },
          "type": "array"
        },
        "inboundConnectionPool": {
          "description": "Settings controlling the volume of connections Envoy will accept from the network.",
          "properties": {
            "http": {
              "description": "HTTP connection pool settings.",
              "properties": {
                "h2UpgradePolicy": {
                  "description": "Specify if http1.1 connection should be upgraded to http2 for the associated destination.\n\nValid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE",
                  "_enum": [
                    "DEFAULT",
                    "DO_NOT_UPGRADE",
                    "UPGRADE"
                  ],
                  "type": "string"
                },
                "http1MaxPendingRequests": {
                  "description": "Maximum number of requests that will be queued while waiting for a ready connection pool connection.",
                  "format": "int32",
                  "type": "integer"
                },
                "http2MaxRequests": {
                  "description": "Maximum number of active requests to a destination.",
                  "format": "int32",
                  "type": "integer"
                },
                "idleTimeout": {
                  "description": "The idle timeout for upstream connection pool connections.",
                  "type": "string",
                  "x_kubernetes_validations": [
                    {
                      "message": "must be a valid duration greater than 1ms",
                      "rule": "duration(self) >= duration('1ms')"
                    }
                  ]
                },
                "maxConcurrentStreams": {
                  "description": "The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.",
                  "format": "int32",
                  "type": "integer"
                },
                "maxRequestsPerConnection": {
                  "description": "Maximum number of requests per connection to a backend.",
                  "format": "int32",
                  "type": "integer"
                },
                "maxRetries": {
                  "description": "Maximum number of retries that can be outstanding to all hosts in a cluster at a given time.",
                  "format": "int32",
                  "type": "integer"
                },
                "useClientProtocol": {
                  "description": "If set to true, client protocol will be preserved while initiating connection to backend.",
                  "type": "boolean"
                }
              },
              "type": "object"
            },
            "tcp": {
              "description": "Settings common to both HTTP and TCP upstream connections.",
              "properties": {
                "connectTimeout": {
                  "description": "TCP connection timeout.",
                  "type": "string",
                  "x_kubernetes_validations": [
                    {
                      "message": "must be a valid duration greater than 1ms",
                      "rule": "duration(self) >= duration('1ms')"
                    }
                  ]
                },
                "idleTimeout": {
                  "description": "The idle timeout for TCP connections.",
                  "type": "string",
                  "x_kubernetes_validations": [
                    {
                      "message": "must be a valid duration greater than 1ms",
                      "rule": "duration(self) >= duration('1ms')"
                    }
                  ]
                },
                "maxConnectionDuration": {
                  "description": "The maximum duration of a connection.",
                  "type": "string",
                  "x_kubernetes_validations": [
                    {
                      "message": "must be a valid duration greater than 1ms",
                      "rule": "duration(self) >= duration('1ms')"
                    }
                  ]
                },
                "maxConnections": {
                  "description": "Maximum number of HTTP1 /TCP connections to a destination host.",
                  "format": "int32",
                  "type": "integer"
                },
                "tcpKeepalive": {
                  "description": "If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives.",
                  "properties": {
                    "interval": {
                      "description": "The time duration between keep-alive probes.",
                      "type": "string",
                      "x_kubernetes_validations": [
                        {
                          "message": "must be a valid duration greater than 1ms",
                          "rule": "duration(self) >= duration('1ms')"
                        }
                      ]
                    },
                    "probes": {
                      "description": "Maximum number of keepalive probes to send without response before deciding the connection is dead.",
                      "maximum": 4294967295,
                      "minimum": 0,
                      "type": "integer"
                    },
                    "time": {
                      "description": "The time duration a connection needs to be idle before keep-alive probes start being sent.",
                      "type": "string",
                      "x_kubernetes_validations": [
                        {
                          "message": "must be a valid duration greater than 1ms",
                          "rule": "duration(self) >= duration('1ms')"
                        }
                      ]
                    }
                  },
                  "type": "object"
                }
              },
              "type": "object"
            }
          },
          "type": "object"
        },
        "ingress": {
          "description": "Ingress specifies the configuration of the sidecar for processing inbound traffic to the attached workload instance.",
          "items": {
            "type": "object",
            "required": [
              "port"
            ],
            "properties": {
              "bind": {
                "description": "The IP(IPv4 or IPv6) to which the listener should be bound.",
                "type": "string"
              },
              "captureMode": {
                "description": "The captureMode option dictates how traffic to the listener is expected to be captured (or not).\n\nValid Options: DEFAULT, IPTABLES, NONE",
                "type": "string",
                "enum": [
                  "DEFAULT",
                  "IPTABLES",
                  "NONE"
                ]
              },
              "connectionPool": {
                "description": "Settings controlling the volume of connections Envoy will accept from the network.",
                "type": "object",
                "properties": {
                  "http": {
                    "description": "HTTP connection pool settings.",
                    "type": "object",
                    "properties": {
                      "h2UpgradePolicy": {
                        "description": "Specify if http1.1 connection should be upgraded to http2 for the associated destination.\n\nValid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE",
                        "type": "string",
                        "enum": [
                          "DEFAULT",
                          "DO_NOT_UPGRADE",
                          "UPGRADE"
                        ]
                      },
                      "http1MaxPendingRequests": {
                        "description": "Maximum number of requests that will be queued while waiting for a ready connection pool connection.",
                        "type": "integer",
                        "format": "int32"
                      },
                      "http2MaxRequests": {
                        "description": "Maximum number of active requests to a destination.",
                        "type": "integer",
                        "format": "int32"
                      },
                      "idleTimeout": {
                        "description": "The idle timeout for upstream connection pool connections.",
                        "type": "string",
                        "x-kubernetes-validations": [
                          {
                            "rule": "duration(self) >= duration('1ms')",
                            "message": "must be a valid duration greater than 1ms"
                          }
                        ]
                      },
                      "maxConcurrentStreams": {
                        "description": "The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.",
                        "type": "integer",
                        "format": "int32"
                      },
                      "maxRequestsPerConnection": {
                        "description": "Maximum number of requests per connection to a backend.",
                        "type": "integer",
                        "format": "int32"
                      },
                      "maxRetries": {
                        "description": "Maximum number of retries that can be outstanding to all hosts in a cluster at a given time.",
                        "type": "integer",
                        "format": "int32"
                      },
                      "useClientProtocol": {
                        "description": "If set to true, client protocol will be preserved while initiating connection to backend.",
                        "type": "boolean"
                      }
                    }
                  },
                  "tcp": {
                    "description": "Settings common to both HTTP and TCP upstream connections.",
                    "type": "object",
                    "properties": {
                      "connectTimeout": {
                        "description": "TCP connection timeout.",
                        "type": "string",
                        "x-kubernetes-validations": [
                          {
                            "rule": "duration(self) >= duration('1ms')",
                            "message": "must be a valid duration greater than 1ms"
                          }
                        ]
                      },
                      "idleTimeout": {
                        "description": "The idle timeout for TCP connections.",
                        "type": "string",
                        "x-kubernetes-validations": [
                          {
                            "rule": "duration(self) >= duration('1ms')",
                            "message": "must be a valid duration greater than 1ms"
                          }
                        ]
                      },
                      "maxConnectionDuration": {
                        "description": "The maximum duration of a connection.",
                        "type": "string",
                        "x-kubernetes-validations": [
                          {
                            "rule": "duration(self) >= duration('1ms')",
                            "message": "must be a valid duration greater than 1ms"
                          }
                        ]
                      },
                      "maxConnections": {
                        "description": "Maximum number of HTTP1 /TCP connections to a destination host.",
                        "type": "integer",
                        "format": "int32"
                      },
                      "tcpKeepalive": {
                        "description": "If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives.",
                        "type": "object",
                        "properties": {
                          "interval": {
                            "description": "The time duration between keep-alive probes.",
                            "type": "string",
                            "x-kubernetes-validations": [
                              {
                                "rule": "duration(self) >= duration('1ms')",
                                "message": "must be a valid duration greater than 1ms"
                              }
                            ]
                          },
                          "probes": {
                            "description": "Maximum number of keepalive probes to send without response before deciding the connection is dead.",
                            "type": "integer",
                            "maximum": 4294967295,
                            "minimum": 0
                          },
                          "time": {
                            "description": "The time duration a connection needs to be idle before keep-alive probes start being sent.",
                            "type": "string",
                            "x-kubernetes-validations": [
                              {
                                "rule": "duration(self) >= duration('1ms')",
                                "message": "must be a valid duration greater than 1ms"
                              }
                            ]
                          }
                        }
                      }
                    }
                  }
                }
              },
              "defaultEndpoint": {
                "description": "The IP endpoint or Unix domain socket to which traffic should be forwarded to.",
                "type": "string"
              },
              "port": {
                "description": "The port associated with the listener.",
                "type": "object",
                "properties": {
                  "name": {
                    "description": "Label assigned to the port.",
                    "type": "string"
                  },
                  "number": {
                    "description": "A valid non-negative integer port number.",
                    "type": "integer",
                    "maximum": 4294967295,
                    "minimum": 0
                  },
                  "protocol": {
                    "description": "The protocol exposed on the port.",
                    "type": "string"
                  },
                  "targetPort": {
                    "type": "integer",
                    "maximum": 4294967295,
                    "minimum": 0
                  }
                }
              },
              "tls": {
                "description": "Set of TLS related options that will enable TLS termination on the sidecar for requests originating from outside the mesh.",
                "type": "object",
                "properties": {
                  "caCertificates": {
                    "description": "REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`.",
                    "type": "string"
                  },
                  "caCrl": {
                    "description": "OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented client side certificate.",
                    "type": "string"
                  },
                  "cipherSuites": {
                    "description": "Optional: If specified, only support the specified cipher list.",
                    "type": "array",
                    "items": {
                      "type": "string"
                    }
                  },
                  "credentialName": {
                    "description": "For gateways running on Kubernetes, the name of the secret that holds the TLS certs including the CA certificates.",
                    "type": "string"
                  },
                  "httpsRedirect": {
                    "description": "If set to true, the load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS.",
                    "type": "boolean"
                  },
                  "maxProtocolVersion": {
                    "description": "Optional: Maximum TLS protocol version.\n\nValid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3",
                    "type": "string",
                    "enum": [
                      "TLS_AUTO",
                      "TLSV1_0",
                      "TLSV1_1",
                      "TLSV1_2",
                      "TLSV1_3"
                    ]
                  },
                  "minProtocolVersion": {
                    "description": "Optional: Minimum TLS protocol version.\n\nValid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3",
                    "type": "string",
                    "enum": [
                      "TLS_AUTO",
                      "TLSV1_0",
                      "TLSV1_1",
                      "TLSV1_2",
                      "TLSV1_3"
                    ]
                  },
                  "mode": {
                    "description": "Optional: Indicates whether connections to this port should be secured using TLS.\n\nValid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL",
                    "type": "string",
                    "enum": [
                      "PASSTHROUGH",
                      "SIMPLE",
                      "MUTUAL",
                      "AUTO_PASSTHROUGH",
                      "ISTIO_MUTUAL",
                      "OPTIONAL_MUTUAL"
                    ]
                  },
                  "privateKey": {
                    "description": "REQUIRED if mode is `SIMPLE` or `MUTUAL`.",
                    "type": "string"
                  },
                  "serverCertificate": {
                    "description": "REQUIRED if mode is `SIMPLE` or `MUTUAL`.",
                    "type": "string"
                  },
                  "subjectAltNames": {
                    "description": "A list of alternate names to verify the subject identity in the certificate presented by the client.",
                    "type": "array",
                    "items": {
                      "type": "string"
                    }
                  },
                  "verifyCertificateHash": {
                    "description": "An optional list of hex-encoded SHA-256 hashes of the authorized client certificates.",
                    "type": "array",
                    "items": {
                      "type": "string"
                    }
                  },
                  "verifyCertificateSpki": {
                    "description": "An optional list of base64-encoded SHA-256 hashes of the SPKIs of authorized client certificates.",
                    "type": "array",
                    "items": {
                      "type": "string"
                    }
                  }
                }
              }
            }
          },
          "type": "array"
        },
        "outboundTrafficPolicy": {
          "description": "Set the default behavior of the sidecar for handling outbound traffic from the application.",
          "properties": {
            "egressProxy": {
              "properties": {
                "host": {
                  "description": "The name of a service from the service registry.",
                  "type": "string"
                },
                "port": {
                  "description": "Specifies the port on the host that is being addressed.",
                  "properties": {
                    "number": {
                      "maximum": 4294967295,
                      "minimum": 0,
                      "type": "integer"
                    }
                  },
                  "type": "object"
                },
                "subset": {
                  "description": "The name of a subset within the service.",
                  "type": "string"
                }
              },
              "required": [
                "host"
              ],
              "type": "object"
            },
            "mode": {
              "description": "\n\nValid Options: REGISTRY_ONLY, ALLOW_ANY",
              "_enum": [
                "REGISTRY_ONLY",
                "ALLOW_ANY"
              ],
              "type": "string"
            }
          },
          "type": "object"
        },
        "workloadSelector": {
          "description": "Criteria used to select the specific set of pods/VMs on which this `Sidecar` configuration should be applied.",
          "properties": {
            "labels": {
              "additionalProperties": {
                "type": "string",
                "maxLength": 63,
                "x-kubernetes-validations": [
                  {
                    "rule": "!self.contains('*')",
                    "message": "wildcard is not supported in selector"
                  }
                ]
              },
              "description": "One or more labels that indicate a specific set of pods/VMs on which the configuration should be applied.",
              "maxProperties": 256,
              "type": "object"
            }
          },
          "type": "object"
        }
      },
      "type": "object"
    },
    "status": {
      "properties": {
        "conditions": {
          "description": "Current service state of the resource.",
          "items": {
            "type": "object",
            "properties": {
              "lastProbeTime": {
                "description": "Last time we probed the condition.",
                "type": "string",
                "format": "date-time"
              },
              "lastTransitionTime": {
                "description": "Last time the condition transitioned from one status to another.",
                "type": "string",
                "format": "date-time"
              },
              "message": {
                "description": "Human-readable message indicating details about last transition.",
                "type": "string"
              },
              "reason": {
                "description": "Unique, one-word, CamelCase reason for the condition's last transition.",
                "type": "string"
              },
              "status": {
                "description": "Status is the status of the condition.",
                "type": "string"
              },
              "type": {
                "description": "Type is the type of the condition.",
                "type": "string"
              }
            }
          },
          "type": "array"
        },
        "observedGeneration": {
          "anyOf": [
            {
              "type": "integer"
            },
            {
              "type": "string"
            }
          ],
          "description": "Resource Generation to which the Reconciled Condition refers.",
          "x_kubernetes_int_or_string": true
        },
        "validationMessages": {
          "description": "Includes any errors or warnings detected by Istio's analyzers.",
          "items": {
            "type": "object",
            "properties": {
              "documentationUrl": {
                "description": "A url pointing to the Istio documentation for this specific error type.",
                "type": "string"
              },
              "level": {
                "description": "Represents how severe a message is.\n\nValid Options: UNKNOWN, ERROR, WARNING, INFO",
                "type": "string",
                "enum": [
                  "UNKNOWN",
                  "ERROR",
                  "WARNING",
                  "INFO"
                ]
              },
              "type": {
                "type": "object",
                "properties": {
                  "code": {
                    "description": "A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.",
                    "type": "string"
                  },
                  "name": {
                    "description": "A human-readable name for the message type.",
                    "type": "string"
                  }
                }
              }
            }
          },
          "type": "array"
        }
      },
      "type": "object",
      "x_kubernetes_preserve_unknown_fields": true
    }
  },
  "type": "object"
}