gateway.tsb.tetrate.io/v2
Resource Types:
Tier1Gateway
Name | Type | Description | Required |
---|---|---|---|
apiVersion | string | gateway.tsb.tetrate.io/v2 | true |
kind | string | Tier1Gateway | true |
metadata | object | Refer to the Kubernetes API documentation for the fields of the metadata field. | true |
spec | object |
| false |
status | object | false |
Tier1Gateway.spec
Tier1Gateway
configures a workload to act as a tier1 gateway into the mesh.
Name | Type | Description | Required |
---|---|---|---|
configGenerationMetadata | object | Metadata values that will be add into the Istio generated configurations. | false |
description | string | A description of the resource. | false |
displayName | string | User friendly name for the resource. | false |
etag | string | The etag for the resource. | false |
extension | []object | false | |
externalServers | []object | One or more servers exposed by the gateway externally. | false |
fqn | string | Fully-qualified name of the resource. | false |
internalServers | []object | One or more servers exposed by the gateway internally for cross cluster forwarding. | false |
passthroughServers | []object | One or more tls passthrough servers exposed by the gateway externally. | false |
tcpExternalServers | []object | One or more tcp servers exposed by the gateway externally. | false |
tcpInternalServers | []object | One or more tcp servers exposed by the gateway for mesh internal traffic. | false |
waf | object | WAF settings to be enabled for traffic passing through this Tier1 gateway. | false |
workloadSelector | object | false |
Tier1Gateway.spec.configGenerationMetadata
Metadata values that will be add into the Istio generated configurations.
Name | Type | Description | Required |
---|---|---|---|
annotations | map[string]string | Set of key value paris that will be added into the | false |
labels | map[string]string | Set of key value paris that will be added into the | false |
Tier1Gateway.spec.extension[index]
Name | Type | Description | Required |
---|---|---|---|
config | object | Configuration parameters sent to the WASM plugin execution. | false |
fqn | string | Fqn of the extension to be executed. | false |
match | []object | Specifies the criteria to determine which traffic is passed to WasmExtension. | false |
Tier1Gateway.spec.extension[index].match[index]
Name | Type | Description | Required |
---|---|---|---|
mode | enum | Criteria for selecting traffic by their direction. Enum: UNDEFINED, CLIENT, SERVER, CLIENT_AND_SERVER | false |
ports | []object | Criteria for selecting traffic by their destination port. | false |
Tier1Gateway.spec.extension[index].match[index].ports[index]
Name | Type | Description | Required |
---|---|---|---|
number | integer | Minimum: 0 | false |
Tier1Gateway.spec.externalServers[index]
Name | Type | Description | Required |
---|---|---|---|
authentication | object | false | |
authorization | object | Authorization is used to configure authorization of end users. | false |
clusters | []object | false | |
hostname | string | false | |
name | string | A name assigned to the server. | false |
port | integer | The port where the server is exposed. Minimum: 0 | false |
rateLimiting | object | Configuration for rate limiting requests. | false |
redirect | object | Redirect allows configuring HTTP redirect. | false |
tls | object | TLS certificate info. | false |
Tier1Gateway.spec.externalServers[index].authentication
Name | Type | Description | Required |
---|---|---|---|
jwt | object | Authenticate an HTTP request from a JWT Token attached to it. | false |
rules | object | List of rules how to authenticate an HTTP request. | false |
Tier1Gateway.spec.externalServers[index].authentication.jwt
Authenticate an HTTP request from a JWT Token attached to it.
Name | Type | Description | Required |
---|---|---|---|
audiences | []string | false | |
fromHeaders | []object | This field specifies the locations to extract JWT token. | false |
issuer | string | Identifies the issuer that issued the JWT. | false |
jwks | string | JSON Web Key Set of public keys to validate signature of the JWT. | false |
jwksUri | string | false | |
outputClaimToHeaders | []object | This field specifies a list of operations to copy the claim to HTTP headers on a successfully verified token. | false |
outputPayloadToHeader | string | false |
Tier1Gateway.spec.externalServers[index].authentication.jwt.fromHeaders[index]
Name | Type | Description | Required |
---|---|---|---|
name | string | The HTTP header name. | false |
prefix | string | The prefix that should be stripped before decoding the token. | false |
Tier1Gateway.spec.externalServers[index].authentication.jwt.outputClaimToHeaders[index]
Name | Type | Description | Required |
---|---|---|---|
claim | string | The name of the claim to be copied from. | false |
header | string | The name of the header to be created. | false |
Tier1Gateway.spec.externalServers[index].authentication.rules
List of rules how to authenticate an HTTP request.
Name | Type | Description | Required |
---|---|---|---|
jwt | []object | List of rules how to authenticate an HTTP request from a JWT Token attached to it. | false |
Tier1Gateway.spec.externalServers[index].authentication.rules.jwt[index]
Name | Type | Description | Required |
---|---|---|---|
audiences | []string | false | |
fromHeaders | []object | This field specifies the locations to extract JWT token. | false |
issuer | string | Identifies the issuer that issued the JWT. | false |
jwks | string | JSON Web Key Set of public keys to validate signature of the JWT. | false |
jwksUri | string | false | |
outputClaimToHeaders | []object | This field specifies a list of operations to copy the claim to HTTP headers on a successfully verified token. | false |
outputPayloadToHeader | string | false |
Tier1Gateway.spec.externalServers[index].authentication.rules.jwt[index].fromHeaders[index]
Name | Type | Description | Required |
---|---|---|---|
name | string | The HTTP header name. | false |
prefix | string | The prefix that should be stripped before decoding the token. | false |
Tier1Gateway.spec.externalServers[index].authentication.rules.jwt[index].outputClaimToHeaders[index]
Name | Type | Description | Required |
---|---|---|---|
claim | string | The name of the claim to be copied from. | false |
header | string | The name of the header to be created. | false |
Tier1Gateway.spec.externalServers[index].authorization
Authorization is used to configure authorization of end users.
Name | Type | Description | Required |
---|---|---|---|
external | object | false | |
local | object | false |
Tier1Gateway.spec.externalServers[index].authorization.external
Name | Type | Description | Required |
---|---|---|---|
includeRequestHeaders | []string | false | |
tls | object | false | |
uri | string | false |
Tier1Gateway.spec.externalServers[index].authorization.external.tls
Name | Type | Description | Required |
---|---|---|---|
files | object | TLS key source from files. | false |
mode | enum | Enum: DISABLED, SIMPLE, MUTUAL | false |
secretName | string | TLS key source from a Kubernetes Secret. | false |
subjectAltNames | []string | false |
Tier1Gateway.spec.externalServers[index].authorization.external.tls.files
TLS key source from files.
Name | Type | Description | Required |
---|---|---|---|
caCertificates | string | false | |
clientCertificate | string | Certificate file to authenticate the client. | false |
privateKey | string | Private key file associated with the client certificate. | false |
Tier1Gateway.spec.externalServers[index].authorization.local
Name | Type | Description | Required |
---|---|---|---|
rules | []object | false |
Tier1Gateway.spec.externalServers[index].authorization.local.rules[index]
Name | Type | Description | Required |
---|---|---|---|
from | []object | false | |
name | string | A friendly name to identify the binding. | false |
to | []object | false |
Tier1Gateway.spec.externalServers[index].authorization.local.rules[index].from[index]
Name | Type | Description | Required |
---|---|---|---|
jwt | object | JWT configuration to identity the subject. | false |
Tier1Gateway.spec.externalServers[index].authorization.local.rules[index].from[index].jwt
JWT configuration to identity the subject.
Name | Type | Description | Required |
---|---|---|---|
iss | string | false | |
other | map[string]string | A set of arbitrary claims that are required to qualify the subject. | false |
sub | string | false |
Tier1Gateway.spec.externalServers[index].authorization.local.rules[index].to[index]
Name | Type | Description | Required |
---|---|---|---|
methods | []string | The HTTP methods that are allowed by this rule. | false |
paths | []string | The request path where the request is made against. | false |
Tier1Gateway.spec.externalServers[index].clusters[index]
Name | Type | Description | Required |
---|---|---|---|
labels | map[string]string | Labels associated with the cluster. | false |
name | string | The name of the destination cluster. | false |
network | string | The network associated with the destination clusters. | false |
weight | integer | The weight for traffic to a given destination. Minimum: 0 | false |
Tier1Gateway.spec.externalServers[index].rateLimiting
Configuration for rate limiting requests.
Name | Type | Description | Required |
---|---|---|---|
externalService | object | Configure ratelimiting using an external ratelimit server. | false |
settings | object | false |
Tier1Gateway.spec.externalServers[index].rateLimiting.externalService
Configure ratelimiting using an external ratelimit server.
Name | Type | Description | Required |
---|---|---|---|
domain | string | The rate limit domain to use when calling the rate limit service. | false |
failClosed | boolean | false | |
rateLimitServerUri | string | The URI at which the external rate limit server can be reached. | false |
rules | []object | A set of rate limit rules. | false |
timeout | string | The timeout in seconds for the external rate limit server RPC. | false |
tls | object | false |
Tier1Gateway.spec.externalServers[index].rateLimiting.externalService.rules[index]
Name | Type | Description | Required |
---|---|---|---|
dimensions | []object | A list of dimensions that are to be applied for this rate limit configuration. | false |
Tier1Gateway.spec.externalServers[index].rateLimiting.externalService.rules[index].dimensions[index]
Name | Type | Description | Required |
---|---|---|---|
destinationCluster | object | Rate limit on destination envoy cluster. | false |
headerValueMatch | object | Rate limit on the existence of certain request headers. | false |
remoteAddress | object | Rate limit on remote address of client. | false |
requestHeaders | object | Rate limit on the value of certain request headers. | false |
sourceCluster | object | Rate limit on source envoy cluster. | false |
Tier1Gateway.spec.externalServers[index].rateLimiting.externalService.rules[index].dimensions[index].headerValueMatch
Rate limit on the existence of certain request headers.
Name | Type | Description | Required |
---|---|---|---|
descriptorValue | string | The value to use in the descriptor entry. | false |
dontMatch | boolean | If set to true, the condition will be met when the header value does not match. | false |
headers | map[string]object | false |
Tier1Gateway.spec.externalServers[index].rateLimiting.externalService.rules[index].dimensions[index].headerValueMatch.headers[key]
Name | Type | Description | Required |
---|---|---|---|
exact | string | Exact string match. | false |
prefix | string | Prefix-based match. | false |
regex | string | ECMAscript style regex-based match. | false |
Tier1Gateway.spec.externalServers[index].rateLimiting.externalService.rules[index].dimensions[index].requestHeaders
Rate limit on the value of certain request headers.
Name | Type | Description | Required |
---|---|---|---|
descriptorKey | string | The key to use in the descriptor entry. | false |
headerName | string | The header name to be queried from the request headers. | false |