mirror of
https://github.com/morten-olsen/homelab-operator.git
synced 2026-02-08 01:36:28 +01:00
631 lines
26 KiB
JSON
631 lines
26 KiB
JSON
{
|
|
"properties": {
|
|
"spec": {
|
|
"description": "Configuration affecting network reachability of a sidecar. See more details at: https://istio.io/docs/reference/config/networking/sidecar.html",
|
|
"properties": {
|
|
"egress": {
|
|
"description": "Egress specifies the configuration of the sidecar for processing outbound traffic from the attached workload instance to other services in the mesh.",
|
|
"items": {
|
|
"type": "object",
|
|
"required": [
|
|
"hosts"
|
|
],
|
|
"properties": {
|
|
"bind": {
|
|
"description": "The IP(IPv4 or IPv6) or the Unix domain socket to which the listener should be bound to.",
|
|
"type": "string"
|
|
},
|
|
"captureMode": {
|
|
"description": "When the bind address is an IP, the captureMode option dictates how traffic to the listener is expected to be captured (or not).\n\nValid Options: DEFAULT, IPTABLES, NONE",
|
|
"type": "string",
|
|
"enum": [
|
|
"DEFAULT",
|
|
"IPTABLES",
|
|
"NONE"
|
|
]
|
|
},
|
|
"hosts": {
|
|
"description": "One or more service hosts exposed by the listener in `namespace/dnsName` format.",
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"port": {
|
|
"description": "The port associated with the listener.",
|
|
"type": "object",
|
|
"properties": {
|
|
"name": {
|
|
"description": "Label assigned to the port.",
|
|
"type": "string"
|
|
},
|
|
"number": {
|
|
"description": "A valid non-negative integer port number.",
|
|
"type": "integer",
|
|
"maximum": 4294967295,
|
|
"minimum": 0
|
|
},
|
|
"protocol": {
|
|
"description": "The protocol exposed on the port.",
|
|
"type": "string"
|
|
},
|
|
"targetPort": {
|
|
"type": "integer",
|
|
"maximum": 4294967295,
|
|
"minimum": 0
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"type": "array"
|
|
},
|
|
"inboundConnectionPool": {
|
|
"description": "Settings controlling the volume of connections Envoy will accept from the network.",
|
|
"properties": {
|
|
"http": {
|
|
"description": "HTTP connection pool settings.",
|
|
"properties": {
|
|
"h2UpgradePolicy": {
|
|
"description": "Specify if http1.1 connection should be upgraded to http2 for the associated destination.\n\nValid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE",
|
|
"_enum": [
|
|
"DEFAULT",
|
|
"DO_NOT_UPGRADE",
|
|
"UPGRADE"
|
|
],
|
|
"type": "string"
|
|
},
|
|
"http1MaxPendingRequests": {
|
|
"description": "Maximum number of requests that will be queued while waiting for a ready connection pool connection.",
|
|
"format": "int32",
|
|
"type": "integer"
|
|
},
|
|
"http2MaxRequests": {
|
|
"description": "Maximum number of active requests to a destination.",
|
|
"format": "int32",
|
|
"type": "integer"
|
|
},
|
|
"idleTimeout": {
|
|
"description": "The idle timeout for upstream connection pool connections.",
|
|
"type": "string",
|
|
"x_kubernetes_validations": [
|
|
{
|
|
"message": "must be a valid duration greater than 1ms",
|
|
"rule": "duration(self) >= duration('1ms')"
|
|
}
|
|
]
|
|
},
|
|
"maxConcurrentStreams": {
|
|
"description": "The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.",
|
|
"format": "int32",
|
|
"type": "integer"
|
|
},
|
|
"maxRequestsPerConnection": {
|
|
"description": "Maximum number of requests per connection to a backend.",
|
|
"format": "int32",
|
|
"type": "integer"
|
|
},
|
|
"maxRetries": {
|
|
"description": "Maximum number of retries that can be outstanding to all hosts in a cluster at a given time.",
|
|
"format": "int32",
|
|
"type": "integer"
|
|
},
|
|
"useClientProtocol": {
|
|
"description": "If set to true, client protocol will be preserved while initiating connection to backend.",
|
|
"type": "boolean"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"tcp": {
|
|
"description": "Settings common to both HTTP and TCP upstream connections.",
|
|
"properties": {
|
|
"connectTimeout": {
|
|
"description": "TCP connection timeout.",
|
|
"type": "string",
|
|
"x_kubernetes_validations": [
|
|
{
|
|
"message": "must be a valid duration greater than 1ms",
|
|
"rule": "duration(self) >= duration('1ms')"
|
|
}
|
|
]
|
|
},
|
|
"idleTimeout": {
|
|
"description": "The idle timeout for TCP connections.",
|
|
"type": "string",
|
|
"x_kubernetes_validations": [
|
|
{
|
|
"message": "must be a valid duration greater than 1ms",
|
|
"rule": "duration(self) >= duration('1ms')"
|
|
}
|
|
]
|
|
},
|
|
"maxConnectionDuration": {
|
|
"description": "The maximum duration of a connection.",
|
|
"type": "string",
|
|
"x_kubernetes_validations": [
|
|
{
|
|
"message": "must be a valid duration greater than 1ms",
|
|
"rule": "duration(self) >= duration('1ms')"
|
|
}
|
|
]
|
|
},
|
|
"maxConnections": {
|
|
"description": "Maximum number of HTTP1 /TCP connections to a destination host.",
|
|
"format": "int32",
|
|
"type": "integer"
|
|
},
|
|
"tcpKeepalive": {
|
|
"description": "If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives.",
|
|
"properties": {
|
|
"interval": {
|
|
"description": "The time duration between keep-alive probes.",
|
|
"type": "string",
|
|
"x_kubernetes_validations": [
|
|
{
|
|
"message": "must be a valid duration greater than 1ms",
|
|
"rule": "duration(self) >= duration('1ms')"
|
|
}
|
|
]
|
|
},
|
|
"probes": {
|
|
"description": "Maximum number of keepalive probes to send without response before deciding the connection is dead.",
|
|
"maximum": 4294967295,
|
|
"minimum": 0,
|
|
"type": "integer"
|
|
},
|
|
"time": {
|
|
"description": "The time duration a connection needs to be idle before keep-alive probes start being sent.",
|
|
"type": "string",
|
|
"x_kubernetes_validations": [
|
|
{
|
|
"message": "must be a valid duration greater than 1ms",
|
|
"rule": "duration(self) >= duration('1ms')"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"type": "object"
|
|
}
|
|
},
|
|
"type": "object"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"ingress": {
|
|
"description": "Ingress specifies the configuration of the sidecar for processing inbound traffic to the attached workload instance.",
|
|
"items": {
|
|
"type": "object",
|
|
"required": [
|
|
"port"
|
|
],
|
|
"properties": {
|
|
"bind": {
|
|
"description": "The IP(IPv4 or IPv6) to which the listener should be bound.",
|
|
"type": "string"
|
|
},
|
|
"captureMode": {
|
|
"description": "The captureMode option dictates how traffic to the listener is expected to be captured (or not).\n\nValid Options: DEFAULT, IPTABLES, NONE",
|
|
"type": "string",
|
|
"enum": [
|
|
"DEFAULT",
|
|
"IPTABLES",
|
|
"NONE"
|
|
]
|
|
},
|
|
"connectionPool": {
|
|
"description": "Settings controlling the volume of connections Envoy will accept from the network.",
|
|
"type": "object",
|
|
"properties": {
|
|
"http": {
|
|
"description": "HTTP connection pool settings.",
|
|
"type": "object",
|
|
"properties": {
|
|
"h2UpgradePolicy": {
|
|
"description": "Specify if http1.1 connection should be upgraded to http2 for the associated destination.\n\nValid Options: DEFAULT, DO_NOT_UPGRADE, UPGRADE",
|
|
"type": "string",
|
|
"enum": [
|
|
"DEFAULT",
|
|
"DO_NOT_UPGRADE",
|
|
"UPGRADE"
|
|
]
|
|
},
|
|
"http1MaxPendingRequests": {
|
|
"description": "Maximum number of requests that will be queued while waiting for a ready connection pool connection.",
|
|
"type": "integer",
|
|
"format": "int32"
|
|
},
|
|
"http2MaxRequests": {
|
|
"description": "Maximum number of active requests to a destination.",
|
|
"type": "integer",
|
|
"format": "int32"
|
|
},
|
|
"idleTimeout": {
|
|
"description": "The idle timeout for upstream connection pool connections.",
|
|
"type": "string",
|
|
"x-kubernetes-validations": [
|
|
{
|
|
"rule": "duration(self) >= duration('1ms')",
|
|
"message": "must be a valid duration greater than 1ms"
|
|
}
|
|
]
|
|
},
|
|
"maxConcurrentStreams": {
|
|
"description": "The maximum number of concurrent streams allowed for a peer on one HTTP/2 connection.",
|
|
"type": "integer",
|
|
"format": "int32"
|
|
},
|
|
"maxRequestsPerConnection": {
|
|
"description": "Maximum number of requests per connection to a backend.",
|
|
"type": "integer",
|
|
"format": "int32"
|
|
},
|
|
"maxRetries": {
|
|
"description": "Maximum number of retries that can be outstanding to all hosts in a cluster at a given time.",
|
|
"type": "integer",
|
|
"format": "int32"
|
|
},
|
|
"useClientProtocol": {
|
|
"description": "If set to true, client protocol will be preserved while initiating connection to backend.",
|
|
"type": "boolean"
|
|
}
|
|
}
|
|
},
|
|
"tcp": {
|
|
"description": "Settings common to both HTTP and TCP upstream connections.",
|
|
"type": "object",
|
|
"properties": {
|
|
"connectTimeout": {
|
|
"description": "TCP connection timeout.",
|
|
"type": "string",
|
|
"x-kubernetes-validations": [
|
|
{
|
|
"rule": "duration(self) >= duration('1ms')",
|
|
"message": "must be a valid duration greater than 1ms"
|
|
}
|
|
]
|
|
},
|
|
"idleTimeout": {
|
|
"description": "The idle timeout for TCP connections.",
|
|
"type": "string",
|
|
"x-kubernetes-validations": [
|
|
{
|
|
"rule": "duration(self) >= duration('1ms')",
|
|
"message": "must be a valid duration greater than 1ms"
|
|
}
|
|
]
|
|
},
|
|
"maxConnectionDuration": {
|
|
"description": "The maximum duration of a connection.",
|
|
"type": "string",
|
|
"x-kubernetes-validations": [
|
|
{
|
|
"rule": "duration(self) >= duration('1ms')",
|
|
"message": "must be a valid duration greater than 1ms"
|
|
}
|
|
]
|
|
},
|
|
"maxConnections": {
|
|
"description": "Maximum number of HTTP1 /TCP connections to a destination host.",
|
|
"type": "integer",
|
|
"format": "int32"
|
|
},
|
|
"tcpKeepalive": {
|
|
"description": "If set then set SO_KEEPALIVE on the socket to enable TCP Keepalives.",
|
|
"type": "object",
|
|
"properties": {
|
|
"interval": {
|
|
"description": "The time duration between keep-alive probes.",
|
|
"type": "string",
|
|
"x-kubernetes-validations": [
|
|
{
|
|
"rule": "duration(self) >= duration('1ms')",
|
|
"message": "must be a valid duration greater than 1ms"
|
|
}
|
|
]
|
|
},
|
|
"probes": {
|
|
"description": "Maximum number of keepalive probes to send without response before deciding the connection is dead.",
|
|
"type": "integer",
|
|
"maximum": 4294967295,
|
|
"minimum": 0
|
|
},
|
|
"time": {
|
|
"description": "The time duration a connection needs to be idle before keep-alive probes start being sent.",
|
|
"type": "string",
|
|
"x-kubernetes-validations": [
|
|
{
|
|
"rule": "duration(self) >= duration('1ms')",
|
|
"message": "must be a valid duration greater than 1ms"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"defaultEndpoint": {
|
|
"description": "The IP endpoint or Unix domain socket to which traffic should be forwarded to.",
|
|
"type": "string"
|
|
},
|
|
"port": {
|
|
"description": "The port associated with the listener.",
|
|
"type": "object",
|
|
"properties": {
|
|
"name": {
|
|
"description": "Label assigned to the port.",
|
|
"type": "string"
|
|
},
|
|
"number": {
|
|
"description": "A valid non-negative integer port number.",
|
|
"type": "integer",
|
|
"maximum": 4294967295,
|
|
"minimum": 0
|
|
},
|
|
"protocol": {
|
|
"description": "The protocol exposed on the port.",
|
|
"type": "string"
|
|
},
|
|
"targetPort": {
|
|
"type": "integer",
|
|
"maximum": 4294967295,
|
|
"minimum": 0
|
|
}
|
|
}
|
|
},
|
|
"tls": {
|
|
"description": "Set of TLS related options that will enable TLS termination on the sidecar for requests originating from outside the mesh.",
|
|
"type": "object",
|
|
"properties": {
|
|
"caCertificates": {
|
|
"description": "REQUIRED if mode is `MUTUAL` or `OPTIONAL_MUTUAL`.",
|
|
"type": "string"
|
|
},
|
|
"caCrl": {
|
|
"description": "OPTIONAL: The path to the file containing the certificate revocation list (CRL) to use in verifying a presented client side certificate.",
|
|
"type": "string"
|
|
},
|
|
"cipherSuites": {
|
|
"description": "Optional: If specified, only support the specified cipher list.",
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"credentialName": {
|
|
"description": "For gateways running on Kubernetes, the name of the secret that holds the TLS certs including the CA certificates.",
|
|
"type": "string"
|
|
},
|
|
"httpsRedirect": {
|
|
"description": "If set to true, the load balancer will send a 301 redirect for all http connections, asking the clients to use HTTPS.",
|
|
"type": "boolean"
|
|
},
|
|
"maxProtocolVersion": {
|
|
"description": "Optional: Maximum TLS protocol version.\n\nValid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3",
|
|
"type": "string",
|
|
"enum": [
|
|
"TLS_AUTO",
|
|
"TLSV1_0",
|
|
"TLSV1_1",
|
|
"TLSV1_2",
|
|
"TLSV1_3"
|
|
]
|
|
},
|
|
"minProtocolVersion": {
|
|
"description": "Optional: Minimum TLS protocol version.\n\nValid Options: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3",
|
|
"type": "string",
|
|
"enum": [
|
|
"TLS_AUTO",
|
|
"TLSV1_0",
|
|
"TLSV1_1",
|
|
"TLSV1_2",
|
|
"TLSV1_3"
|
|
]
|
|
},
|
|
"mode": {
|
|
"description": "Optional: Indicates whether connections to this port should be secured using TLS.\n\nValid Options: PASSTHROUGH, SIMPLE, MUTUAL, AUTO_PASSTHROUGH, ISTIO_MUTUAL, OPTIONAL_MUTUAL",
|
|
"type": "string",
|
|
"enum": [
|
|
"PASSTHROUGH",
|
|
"SIMPLE",
|
|
"MUTUAL",
|
|
"AUTO_PASSTHROUGH",
|
|
"ISTIO_MUTUAL",
|
|
"OPTIONAL_MUTUAL"
|
|
]
|
|
},
|
|
"privateKey": {
|
|
"description": "REQUIRED if mode is `SIMPLE` or `MUTUAL`.",
|
|
"type": "string"
|
|
},
|
|
"serverCertificate": {
|
|
"description": "REQUIRED if mode is `SIMPLE` or `MUTUAL`.",
|
|
"type": "string"
|
|
},
|
|
"subjectAltNames": {
|
|
"description": "A list of alternate names to verify the subject identity in the certificate presented by the client.",
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"verifyCertificateHash": {
|
|
"description": "An optional list of hex-encoded SHA-256 hashes of the authorized client certificates.",
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"verifyCertificateSpki": {
|
|
"description": "An optional list of base64-encoded SHA-256 hashes of the SPKIs of authorized client certificates.",
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"type": "array"
|
|
},
|
|
"outboundTrafficPolicy": {
|
|
"description": "Set the default behavior of the sidecar for handling outbound traffic from the application.",
|
|
"properties": {
|
|
"egressProxy": {
|
|
"properties": {
|
|
"host": {
|
|
"description": "The name of a service from the service registry.",
|
|
"type": "string"
|
|
},
|
|
"port": {
|
|
"description": "Specifies the port on the host that is being addressed.",
|
|
"properties": {
|
|
"number": {
|
|
"maximum": 4294967295,
|
|
"minimum": 0,
|
|
"type": "integer"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"subset": {
|
|
"description": "The name of a subset within the service.",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"host"
|
|
],
|
|
"type": "object"
|
|
},
|
|
"mode": {
|
|
"description": "\n\nValid Options: REGISTRY_ONLY, ALLOW_ANY",
|
|
"_enum": [
|
|
"REGISTRY_ONLY",
|
|
"ALLOW_ANY"
|
|
],
|
|
"type": "string"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"workloadSelector": {
|
|
"description": "Criteria used to select the specific set of pods/VMs on which this `Sidecar` configuration should be applied.",
|
|
"properties": {
|
|
"labels": {
|
|
"additionalProperties": {
|
|
"type": "string",
|
|
"maxLength": 63,
|
|
"x-kubernetes-validations": [
|
|
{
|
|
"rule": "!self.contains('*')",
|
|
"message": "wildcard is not supported in selector"
|
|
}
|
|
]
|
|
},
|
|
"description": "One or more labels that indicate a specific set of pods/VMs on which the configuration should be applied.",
|
|
"maxProperties": 256,
|
|
"type": "object"
|
|
}
|
|
},
|
|
"type": "object"
|
|
}
|
|
},
|
|
"type": "object"
|
|
},
|
|
"status": {
|
|
"properties": {
|
|
"conditions": {
|
|
"description": "Current service state of the resource.",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"lastProbeTime": {
|
|
"description": "Last time we probed the condition.",
|
|
"type": "string",
|
|
"format": "date-time"
|
|
},
|
|
"lastTransitionTime": {
|
|
"description": "Last time the condition transitioned from one status to another.",
|
|
"type": "string",
|
|
"format": "date-time"
|
|
},
|
|
"message": {
|
|
"description": "Human-readable message indicating details about last transition.",
|
|
"type": "string"
|
|
},
|
|
"reason": {
|
|
"description": "Unique, one-word, CamelCase reason for the condition's last transition.",
|
|
"type": "string"
|
|
},
|
|
"status": {
|
|
"description": "Status is the status of the condition.",
|
|
"type": "string"
|
|
},
|
|
"type": {
|
|
"description": "Type is the type of the condition.",
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"type": "array"
|
|
},
|
|
"observedGeneration": {
|
|
"anyOf": [
|
|
{
|
|
"type": "integer"
|
|
},
|
|
{
|
|
"type": "string"
|
|
}
|
|
],
|
|
"description": "Resource Generation to which the Reconciled Condition refers.",
|
|
"x_kubernetes_int_or_string": true
|
|
},
|
|
"validationMessages": {
|
|
"description": "Includes any errors or warnings detected by Istio's analyzers.",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"documentationUrl": {
|
|
"description": "A url pointing to the Istio documentation for this specific error type.",
|
|
"type": "string"
|
|
},
|
|
"level": {
|
|
"description": "Represents how severe a message is.\n\nValid Options: UNKNOWN, ERROR, WARNING, INFO",
|
|
"type": "string",
|
|
"enum": [
|
|
"UNKNOWN",
|
|
"ERROR",
|
|
"WARNING",
|
|
"INFO"
|
|
]
|
|
},
|
|
"type": {
|
|
"type": "object",
|
|
"properties": {
|
|
"code": {
|
|
"description": "A 7 character code matching `^IST[0-9]{4}$` intended to uniquely identify the message type.",
|
|
"type": "string"
|
|
},
|
|
"name": {
|
|
"description": "A human-readable name for the message type.",
|
|
"type": "string"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"type": "array"
|
|
}
|
|
},
|
|
"type": "object",
|
|
"x_kubernetes_preserve_unknown_fields": true
|
|
}
|
|
},
|
|
"type": "object"
|
|
} |