gateway.tsb.tetrate.io/v2

Resource Types:

• Tier1Gateway

• IngressGateway

• Group

• Gateway

• EgressGateway

Tier1Gateway

↩ Parent

Name	Type	Description	Required
apiVersion	string	gateway.tsb.tetrate.io/v2	true
kind	string	Tier1Gateway	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the metadata field.	true
spec	object	Tier1Gateway configures a workload to act as a tier1 gateway into the mesh.	false
status	object		false

Tier1Gateway.spec

↩ Parent

Tier1Gateway configures a workload to act as a tier1 gateway into the mesh.

Name	Type	Description	Required
configGenerationMetadata	object	Metadata values that will be add into the Istio generated configurations.	false
description	string	A description of the resource.	false
displayName	string	User friendly name for the resource.	false
etag	string	The etag for the resource.	false
extension	[]object		false
externalServers	[]object	One or more servers exposed by the gateway externally.	false
fqn	string	Fully-qualified name of the resource.	false
internalServers	[]object	One or more servers exposed by the gateway internally for cross cluster forwarding.	false
passthroughServers	[]object	One or more tls passthrough servers exposed by the gateway externally.	false
tcpExternalServers	[]object	One or more tcp servers exposed by the gateway externally.	false
tcpInternalServers	[]object	One or more tcp servers exposed by the gateway for mesh internal traffic.	false
waf	object	WAF settings to be enabled for traffic passing through this Tier1 gateway.	false
workloadSelector	object		false

Tier1Gateway.spec.configGenerationMetadata

↩ Parent

Metadata values that will be add into the Istio generated configurations.

Name	Type	Description	Required
annotations	map[string]string	Set of key value paris that will be added into the metadata.annotations field of the Istio generated configurations.	false
labels	map[string]string	Set of key value paris that will be added into the metadata.labels field of the Istio generated configurations.	false

Tier1Gateway.spec.extension[index]

↩ Parent

Name	Type	Description	Required
config	object	Configuration parameters sent to the WASM plugin execution.	false
fqn	string	Fqn of the extension to be executed.	false
match	[]object	Specifies the criteria to determine which traffic is passed to WasmExtension.	false

Tier1Gateway.spec.extension[index].match[index]

↩ Parent

Name	Type	Description	Required
mode	enum	Criteria for selecting traffic by their direction. Enum: UNDEFINED, CLIENT, SERVER, CLIENT_AND_SERVER	false
ports	[]object	Criteria for selecting traffic by their destination port.	false

Tier1Gateway.spec.extension[index].match[index].ports[index]

↩ Parent

Name	Type	Description	Required
number	integer	Minimum: 0 Maximum: 4.294967295e+09	false

Tier1Gateway.spec.externalServers[index]

↩ Parent

Name	Type	Description	Required
authentication	object		false
authorization	object	Authorization is used to configure authorization of end users.	false
clusters	[]object		false
hostname	string		false
name	string	A name assigned to the server.	false
port	integer	The port where the server is exposed. Minimum: 0 Maximum: 4.294967295e+09	false
rateLimiting	object	Configuration for rate limiting requests.	false
redirect	object	Redirect allows configuring HTTP redirect.	false
tls	object	TLS certificate info.	false

Tier1Gateway.spec.externalServers[index].authentication

↩ Parent

Name	Type	Description	Required
jwt	object	Authenticate an HTTP request from a JWT Token attached to it.	false
oidc	object		false
rules	object	List of rules how to authenticate an HTTP request.	false

Tier1Gateway.spec.externalServers[index].authentication.jwt

↩ Parent

Authenticate an HTTP request from a JWT Token attached to it.

Name	Type	Description	Required
audiences	[]string		false
fromHeaders	[]object	This field specifies the locations to extract JWT token.	false
issuer	string	Identifies the issuer that issued the JWT.	false
jwks	string	JSON Web Key Set of public keys to validate signature of the JWT.	false
jwksUri	string		false
outputClaimToHeaders	[]object	This field specifies a list of operations to copy the claim to HTTP headers on a successfully verified token.	false
outputPayloadToHeader	string		false

Tier1Gateway.spec.externalServers[index].authentication.jwt.fromHeaders[index]

↩ Parent

Name	Type	Description	Required
name	string	The HTTP header name.	false
prefix	string	The prefix that should be stripped before decoding the token.	false

Tier1Gateway.spec.externalServers[index].authentication.jwt.outputClaimToHeaders[index]

↩ Parent

Name	Type	Description	Required
claim	string	The name of the claim to be copied from.	false
header	string	The name of the header to be created.	false

Tier1Gateway.spec.externalServers[index].authentication.oidc

↩ Parent

Name	Type	Description	Required
authScopes	[]string	Optional list of OAuth scopes to be claimed in the authorization request.	false
authType	enum	Defines how client_id and client_secret are sent in OAuth client to OAuth server requests. Enum: DEFAULT_AUTH_TYPE, URL_ENCODED_BODY, BASIC_AUTH	false
clientId	string	The client_id to be used in the authorize calls.	false
clientTokenSecret	string	The name of the Kubernetes secret containing the client secret.	false
grantType	enum	Enum: DEFAULT_GRANT_TYPE, AUTHORIZATION_CODE	false
provider	object	The OIDC Provider configuration.	false
redirectPathMatcher	string		false
redirectUri	string		false
signoutPath	string	The path to sign a user out, clearing their credential cookies.	false

Tier1Gateway.spec.externalServers[index].authentication.oidc.provider

↩ Parent

The OIDC Provider configuration.

Name	Type	Description	Required
authorizationEndpoint	string	The OIDC Provider's authorization endpoint.	false
issuer	string	The OIDC Provider's issuer identifier.	false
jwks	string	JSON string with the OIDC provider's JSON Web Key Sets.	false
jwksUri	string	URI for the OIDC provider's JSON Web Key Sets.	false
tokenEndpoint	string	The OIDC Provider's token endpoint.	false

Tier1Gateway.spec.externalServers[index].authentication.rules

↩ Parent

List of rules how to authenticate an HTTP request.

Name	Type	Description	Required
jwt	[]object	List of rules how to authenticate an HTTP request from a JWT Token attached to it.	false

Tier1Gateway.spec.externalServers[index].authentication.rules.jwt[index]

↩ Parent

Name	Type	Description	Required
audiences	[]string		false
fromHeaders	[]object	This field specifies the locations to extract JWT token.	false
issuer	string	Identifies the issuer that issued the JWT.	false
jwks	string	JSON Web Key Set of public keys to validate signature of the JWT.	false
jwksUri	string		false
outputClaimToHeaders	[]object	This field specifies a list of operations to copy the claim to HTTP headers on a successfully verified token.	false
outputPayloadToHeader	string		false

Tier1Gateway.spec.externalServers[index].authentication.rules.jwt[index].fromHeaders[index]

↩ Parent

Name	Type	Description	Required
name	string	The HTTP header name.	false
prefix	string	The prefix that should be stripped before decoding the token.	false

Tier1Gateway.spec.externalServers[index].authentication.rules.jwt[index].outputClaimToHeaders[index]

↩ Parent

Name	Type	Description	Required
claim	string	The name of the claim to be copied from.	false
header	string	The name of the header to be created.	false

Tier1Gateway.spec.externalServers[index].authorization

↩ Parent

Authorization is used to configure authorization of end users.

Name	Type	Description	Required
external	object		false
local	object		false

Tier1Gateway.spec.externalServers[index].authorization.external

↩ Parent

Name	Type	Description	Required
includeRequestHeaders	[]string		false
tls	object		false
uri	string		false

Tier1Gateway.spec.externalServers[index].authorization.external.tls

↩ Parent

Name	Type	Description	Required
files	object	TLS key source from files.	false
mode	enum	Enum: DISABLED, SIMPLE, MUTUAL	false
secretName	string	TLS key source from a Kubernetes Secret.	false
subjectAltNames	[]string		false

Tier1Gateway.spec.externalServers[index].authorization.external.tls.files

↩ Parent

TLS key source from files.

Name	Type	Description	Required
caCertificates	string		false
clientCertificate	string	Certificate file to authenticate the client.	false
privateKey	string	Private key file associated with the client certificate.	false

Tier1Gateway.spec.externalServers[index].authorization.local

↩ Parent

Name	Type	Description	Required
rules	[]object		false

Tier1Gateway.spec.externalServers[index].authorization.local.rules[index]

↩ Parent

Name	Type	Description	Required
from	[]object		false
name	string	A friendly name to identify the binding.	false
to	[]object		false

Tier1Gateway.spec.externalServers[index].authorization.local.rules[index].from[index]

↩ Parent

Name	Type	Description	Required
jwt	object	JWT configuration to identity the subject.	false

Tier1Gateway.spec.externalServers[index].authorization.local.rules[index].from[index].jwt

↩ Parent

JWT configuration to identity the subject.

Name	Type	Description	Required
iss	string		false
other	map[string]string	A set of arbitrary claims that are required to qualify the subject.	false
sub	string		false

Tier1Gateway.spec.externalServers[index].authorization.local.rules[index].to[index]

↩ Parent

Name	Type	Description	Required
methods	[]string	The HTTP methods that are allowed by this rule.	false
paths	[]string	The request path where the request is made against.	false

Tier1Gateway.spec.externalServers[index].clusters[index]

↩ Parent

Name	Type	Description	Required
labels	map[string]string	Labels associated with the cluster.	false
name	string	The name of the destination cluster.	false
network	string	The network associated with the destination clusters.	false
weight	integer	The weight for traffic to a given destination. Minimum: 0 Maximum: 4.294967295e+09	false

Tier1Gateway.spec.externalServers[index].rateLimiting

↩ Parent

Configuration for rate limiting requests.

Name	Type	Description	Required
externalService	object	Configure ratelimiting using an external ratelimit server.	false
settings	object		false

Tier1Gateway.spec.externalServers[index].rateLimiting.externalService

↩ Parent

Configure ratelimiting using an external ratelimit server.

Name	Type	Description	Required
domain	string	The rate limit domain to use when calling the rate limit service.	false
failClosed	boolean		false
rateLimitServerUri	string	The URI at which the external rate limit server can be reached.	false
rules	[]object	A set of rate limit rules.	false
timeout	string	The timeout in seconds for the external rate limit server RPC.	false
tls	object		false

Tier1Gateway.spec.externalServers[index].rateLimiting.externalService.rules[index]

↩ Parent

Name	Type	Description	Required
dimensions	[]object	A list of dimensions that are to be applied for this rate limit configuration.	false

Tier1Gateway.spec.externalServers[index].rateLimiting.externalService.rules[index].dimensions[index]

↩ Parent

Name	Type	Description	Required
destinationCluster	object	Rate limit on destination envoy cluster.	false
headerValueMatch	object	Rate limit on the existence of certain request headers.	false
remoteAddress	object	Rate limit on remote address of client.	false
requestHeaders	object	Rate limit on the value of certain request headers.	false
sourceCluster	object	Rate limit on source envoy cluster.	false

Tier1Gateway.spec.externalServers[index].rateLimiting.externalService.rules[index].dimensions[index].headerValueMatch

↩ Parent

Rate limit on the existence of certain request headers.

Name	Type	Description	Required
descriptorValue	string	The value to use in the descriptor entry.	false
dontMatch	boolean	If set to true, the condition will be met when the header value does not match.	false
headers	map[string]object		false

Tier1Gateway.spec.externalServers[index].rateLimiting.externalService.rules[index].dimensions[index].headerValueMatch.headers[key]

↩ Parent

Name	Type	Description	Required
exact	string	Exact string match.	false
prefix	string	Prefix-based match.	false
regex	string	ECMAscript style regex-based match.	false

Tier1Gateway.spec.externalServers[index].rateLimiting.externalService.rules[index].dimensions[index].requestHeaders

↩ Parent

Rate limit on the value of certain request headers.

Name	Type	Description	Required
descriptorKey	string	The key to use in the descriptor entry.	false
headerName	string	The header name to be queried from the request headers.	false

Tier1Gateway.spec.externalServers[index].rateLimiting.externalService.tls

↩ Parent

Name	Type	Description	Required
files	object	TLS key source from files.	false
mode	enum	Enum: DISABLED, SIMPLE, MUTUAL	false
secretName	string	TLS key source from a Kubernetes Secret.	false
subjectAltNames	[]string		false

Tier1Gateway.spec.externalServers[index].rateLimiting.externalService.tls.files

↩ Parent

TLS key source from files.

Name	Type	Description	Required
caCertificates	string		false
clientCertificate	string	Certificate file to authenticate the client.	false
privateKey	string	Private key file associated with the client certificate.	false

Tier1Gateway.spec.externalServers[index].rateLimiting.settings

↩ Parent

Name	Type	Description	Required
failClosed	boolean		false
rules	[]object	A list of rules for ratelimiting.	false
timeout	string	The timeout in seconds for the rate limit server RPC.	false

Tier1Gateway.spec.externalServers[index].rateLimiting.settings.rules[index]

↩ Parent

Name	Type	Description	Required
dimensions	[]object	A list of dimensions to define each ratelimit rule.	false
limit	object	The ratelimit value that will be configured for the above rules.	false

Tier1Gateway.spec.externalServers[index].rateLimiting.settings.rules[index].dimensions[index]

↩ Parent

Name	Type	Description	Required
header	object	Rate limit on certain HTTP headers.	false
remoteAddress	object	Rate limit on the remote address of client.	false

Tier1Gateway.spec.externalServers[index].rateLimiting.settings.rules[index].dimensions[index].header

↩ Parent

Rate limit on certain HTTP headers.

Name	Type	Description	Required
dontMatch	boolean	If set to true, the condition will be met when the header value does not match.	false
name	string	Name of the header to match on.	false
value	object	Value of the header to match on if matching on a specific value.	false

Tier1Gateway.spec.externalServers[index].rateLimiting.settings.rules[index].dimensions[index].header.value

↩ Parent

Value of the header to match on if matching on a specific value.

Name	Type	Description	Required
exact	string	Exact string match.	false
prefix	string	Prefix-based match.	false
regex	string	ECMAscript style regex-based match.	false

Tier1Gateway.spec.externalServers[index].rateLimiting.settings.rules[index].dimensions[index].remoteAddress

↩ Parent

Rate limit on the remote address of client.

Name	Type	Description	Required
value	string	Ratelimit on a specific remote address.	false

Tier1Gateway.spec.externalServers[index].rateLimiting.settings.rules[index].limit

↩ Parent

The ratelimit value that will be configured for the above rules.

Name	Type	Description	Required
requestsPerUnit	integer	Specifies the value of the rate limit. Minimum: 0 Maximum: 4.294967295e+09	false
unit	enum	Specifies the unit of time for rate limit. Enum: UNKNOWN, SECOND, MINUTE, HOUR, DAY	false

Tier1Gateway.spec.externalServers[index].redirect

↩ Parent

Redirect allows configuring HTTP redirect.

Name	Type	Description	Required
authority	string	On a redirect, overwrite the Authority/Host portion of the URL with this value.	false
port	integer	Minimum: 0 Maximum: 4.294967295e+09	false
redirectCode	integer	Minimum: 0 Maximum: 4.294967295e+09	false
scheme	string	On a redirect, overwrite the scheme with this one.	false
uri	string	On a redirect, overwrite the Path portion of the URL with this value.	false

Tier1Gateway.spec.externalServers[index].tls

↩ Parent

TLS certificate info.

Name	Type	Description	Required
cipherSuites	[]string	List of cipher suites to be used for TLS connections.	false
files	object		false
maxProtocolVersion	enum	Set the maximum supported TLS protocol version. Enum: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3	false
minProtocolVersion	enum	Set the minimum supported TLS protocol version. Enum: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3	false
mode	enum	Enum: DISABLED, SIMPLE, MUTUAL, OPTIONAL_MUTUAL	false
secretName	string		false
subjectAltNames	[]string		false

Tier1Gateway.spec.externalServers[index].tls.files

↩ Parent

Name	Type	Description	Required
caCertificates	string		false
privateKey	string		false
serverCertificate	string		false

Tier1Gateway.spec.internalServers[index]

↩ Parent

Name	Type	Description	Required
authentication	object		false
authorization	object	Authorization is used to configure authorization of end user and traffic.	false
clusters	[]object		false
hostname	string		false
name	string	A name assigned to the server.	false

Tier1Gateway.spec.internalServers[index].authentication

↩ Parent

Name	Type	Description	Required
jwt	object	Authenticate an HTTP request from a JWT Token attached to it.	false
oidc	object		false
rules	object	List of rules how to authenticate an HTTP request.	false

Tier1Gateway.spec.internalServers[index].authentication.jwt

↩ Parent

Authenticate an HTTP request from a JWT Token attached to it.

Name	Type	Description	Required
audiences	[]string		false
fromHeaders	[]object	This field specifies the locations to extract JWT token.	false
issuer	string	Identifies the issuer that issued the JWT.	false
jwks	string	JSON Web Key Set of public keys to validate signature of the JWT.	false
jwksUri	string		false
outputClaimToHeaders	[]object	This field specifies a list of operations to copy the claim to HTTP headers on a successfully verified token.	false
outputPayloadToHeader	string		false

Tier1Gateway.spec.internalServers[index].authentication.jwt.fromHeaders[index]

↩ Parent

Name	Type	Description	Required
name	string	The HTTP header name.	false
prefix	string	The prefix that should be stripped before decoding the token.	false

Tier1Gateway.spec.internalServers[index].authentication.jwt.outputClaimToHeaders[index]

↩ Parent

Name	Type	Description	Required
claim	string	The name of the claim to be copied from.	false
header	string	The name of the header to be created.	false

Tier1Gateway.spec.internalServers[index].authentication.oidc

↩ Parent

Name	Type	Description	Required
authScopes	[]string	Optional list of OAuth scopes to be claimed in the authorization request.	false
authType	enum	Defines how client_id and client_secret are sent in OAuth client to OAuth server requests. Enum: DEFAULT_AUTH_TYPE, URL_ENCODED_BODY, BASIC_AUTH	false
clientId	string	The client_id to be used in the authorize calls.	false
clientTokenSecret	string	The name of the Kubernetes secret containing the client secret.	false
grantType	enum	Enum: DEFAULT_GRANT_TYPE, AUTHORIZATION_CODE	false
provider	object	The OIDC Provider configuration.	false
redirectPathMatcher	string		false
redirectUri	string		false
signoutPath	string	The path to sign a user out, clearing their credential cookies.	false

Tier1Gateway.spec.internalServers[index].authentication.oidc.provider

↩ Parent

The OIDC Provider configuration.

Name	Type	Description	Required
authorizationEndpoint	string	The OIDC Provider's authorization endpoint.	false
issuer	string	The OIDC Provider's issuer identifier.	false
jwks	string	JSON string with the OIDC provider's JSON Web Key Sets.	false
jwksUri	string	URI for the OIDC provider's JSON Web Key Sets.	false
tokenEndpoint	string	The OIDC Provider's token endpoint.	false

Tier1Gateway.spec.internalServers[index].authentication.rules

↩ Parent

List of rules how to authenticate an HTTP request.

Name	Type	Description	Required
jwt	[]object	List of rules how to authenticate an HTTP request from a JWT Token attached to it.	false

Tier1Gateway.spec.internalServers[index].authentication.rules.jwt[index]

↩ Parent

Name	Type	Description	Required
audiences	[]string		false
fromHeaders	[]object	This field specifies the locations to extract JWT token.	false
issuer	string	Identifies the issuer that issued the JWT.	false
jwks	string	JSON Web Key Set of public keys to validate signature of the JWT.	false
jwksUri	string		false
outputClaimToHeaders	[]object	This field specifies a list of operations to copy the claim to HTTP headers on a successfully verified token.	false
outputPayloadToHeader	string		false

Tier1Gateway.spec.internalServers[index].authentication.rules.jwt[index].fromHeaders[index]

↩ Parent

Name	Type	Description	Required
name	string	The HTTP header name.	false
prefix	string	The prefix that should be stripped before decoding the token.	false

Tier1Gateway.spec.internalServers[index].authentication.rules.jwt[index].outputClaimToHeaders[index]

↩ Parent

Name	Type	Description	Required
claim	string	The name of the claim to be copied from.	false
header	string	The name of the header to be created.	false

Tier1Gateway.spec.internalServers[index].authorization

↩ Parent

Authorization is used to configure authorization of end user and traffic.

Name	Type	Description	Required
external	object		false
local	object		false

Tier1Gateway.spec.internalServers[index].authorization.external

↩ Parent

Name	Type	Description	Required
includeRequestHeaders	[]string		false
tls	object		false
uri	string		false

Tier1Gateway.spec.internalServers[index].authorization.external.tls

↩ Parent

Name	Type	Description	Required
files	object	TLS key source from files.	false
mode	enum	Enum: DISABLED, SIMPLE, MUTUAL	false
secretName	string	TLS key source from a Kubernetes Secret.	false
subjectAltNames	[]string		false

Tier1Gateway.spec.internalServers[index].authorization.external.tls.files

↩ Parent

TLS key source from files.

Name	Type	Description	Required
caCertificates	string		false
clientCertificate	string	Certificate file to authenticate the client.	false
privateKey	string	Private key file associated with the client certificate.	false

Tier1Gateway.spec.internalServers[index].authorization.local

↩ Parent

Name	Type	Description	Required
rules	[]object		false

Tier1Gateway.spec.internalServers[index].authorization.local.rules[index]

↩ Parent

Name	Type	Description	Required
from	[]object		false
name	string	A friendly name to identify the binding.	false
to	[]object		false

Tier1Gateway.spec.internalServers[index].authorization.local.rules[index].from[index]

↩ Parent

Name	Type	Description	Required
jwt	object	JWT configuration to identity the subject.	false

Tier1Gateway.spec.internalServers[index].authorization.local.rules[index].from[index].jwt

↩ Parent

JWT configuration to identity the subject.

Name	Type	Description	Required
iss	string		false
other	map[string]string	A set of arbitrary claims that are required to qualify the subject.	false
sub	string		false

Tier1Gateway.spec.internalServers[index].authorization.local.rules[index].to[index]

↩ Parent

Name	Type	Description	Required
methods	[]string	The HTTP methods that are allowed by this rule.	false
paths	[]string	The request path where the request is made against.	false

Tier1Gateway.spec.internalServers[index].clusters[index]

↩ Parent

Name	Type	Description	Required
labels	map[string]string	Labels associated with the cluster.	false
name	string	The name of the destination cluster.	false
network	string	The network associated with the destination clusters.	false
weight	integer	The weight for traffic to a given destination. Minimum: 0 Maximum: 4.294967295e+09	false

Tier1Gateway.spec.passthroughServers[index]

↩ Parent

Name	Type	Description	Required
clusters	[]object		false
hostname	string		false
name	string	A name assigned to the server.	false
port	integer	The port where the server is exposed. Minimum: 0 Maximum: 4.294967295e+09	false

Tier1Gateway.spec.passthroughServers[index].clusters[index]

↩ Parent

Name	Type	Description	Required
labels	map[string]string	Labels associated with the cluster.	false
name	string	The name of the destination cluster.	false
network	string	The network associated with the destination clusters.	false
weight	integer	The weight for traffic to a given destination. Minimum: 0 Maximum: 4.294967295e+09	false

Tier1Gateway.spec.tcpExternalServers[index]

↩ Parent

Name	Type	Description	Required
clusters	[]object	The destination clusters contain ingress gateways exposing the service.	false
hostname	string		false
name	string	A name assigned to the server.	false
port	integer	The port where the server is exposed. Minimum: 0 Maximum: 4.294967295e+09	false
tls	object	TLS certificate information to terminate TLS.	false

Tier1Gateway.spec.tcpExternalServers[index].clusters[index]

↩ Parent

Name	Type	Description	Required
labels	map[string]string	Labels associated with the cluster.	false
name	string	The name of the destination cluster.	false
network	string	The network associated with the destination clusters.	false
weight	integer	The weight for traffic to a given destination. Minimum: 0 Maximum: 4.294967295e+09	false

Tier1Gateway.spec.tcpExternalServers[index].tls

↩ Parent

TLS certificate information to terminate TLS.

Name	Type	Description	Required
cipherSuites	[]string	List of cipher suites to be used for TLS connections.	false
files	object		false
maxProtocolVersion	enum	Set the maximum supported TLS protocol version. Enum: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3	false
minProtocolVersion	enum	Set the minimum supported TLS protocol version. Enum: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3	false
mode	enum	Enum: DISABLED, SIMPLE, MUTUAL, OPTIONAL_MUTUAL	false
secretName	string		false
subjectAltNames	[]string		false

Tier1Gateway.spec.tcpExternalServers[index].tls.files

↩ Parent

Name	Type	Description	Required
caCertificates	string		false
privateKey	string		false
serverCertificate	string		false

Tier1Gateway.spec.tcpInternalServers[index]

↩ Parent

Name	Type	Description	Required
clusters	[]object	The destination clusters contain ingress gateways exposing the service.	false
hostname	string	The name of the service used.	false
name	string	A name assigned to the server.	false

Tier1Gateway.spec.tcpInternalServers[index].clusters[index]

↩ Parent

Name	Type	Description	Required
labels	map[string]string	Labels associated with the cluster.	false
name	string	The name of the destination cluster.	false
network	string	The network associated with the destination clusters.	false
weight	integer	The weight for traffic to a given destination. Minimum: 0 Maximum: 4.294967295e+09	false

Tier1Gateway.spec.waf

↩ Parent

WAF settings to be enabled for traffic passing through this Tier1 gateway.

Name	Type	Description	Required
rules	[]string	Rules to be leveraged by WAF.	false

Tier1Gateway.spec.workloadSelector

↩ Parent

Name	Type	Description	Required
labels	map[string]string		false
namespace	string	The namespace where the workload resides.	false

IngressGateway

↩ Parent

Name	Type	Description	Required
apiVersion	string	gateway.tsb.tetrate.io/v2	true
kind	string	IngressGateway	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the metadata field.	true
spec	object	IngressGateway configures a workload to act as an ingress gateway into the mesh.	false
status	object		false

IngressGateway.spec

↩ Parent

IngressGateway configures a workload to act as an ingress gateway into the mesh.

Name	Type	Description	Required
configGenerationMetadata	object	Metadata values that will be add into the Istio generated configurations.	false
description	string	A description of the resource.	false
displayName	string	User friendly name for the resource.	false
etag	string	The etag for the resource.	false
extension	[]object		false
fqn	string	Fully-qualified name of the resource.	false
http	[]object	One or more HTTP or HTTPS servers exposed by the gateway.	false
tcp	[]object		false
tlsPassthrough	[]object	One or more TLS servers exposed by the gateway.	false
waf	object	WAF settings to be enabled for traffic passing through the HttpServer.	false
workloadSelector	object		false

IngressGateway.spec.configGenerationMetadata

↩ Parent

Metadata values that will be add into the Istio generated configurations.

Name	Type	Description	Required
annotations	map[string]string	Set of key value paris that will be added into the metadata.annotations field of the Istio generated configurations.	false
labels	map[string]string	Set of key value paris that will be added into the metadata.labels field of the Istio generated configurations.	false

IngressGateway.spec.extension[index]

↩ Parent

Name	Type	Description	Required
config	object	Configuration parameters sent to the WASM plugin execution.	false
fqn	string	Fqn of the extension to be executed.	false
match	[]object	Specifies the criteria to determine which traffic is passed to WasmExtension.	false

IngressGateway.spec.extension[index].match[index]

↩ Parent

Name	Type	Description	Required
mode	enum	Criteria for selecting traffic by their direction. Enum: UNDEFINED, CLIENT, SERVER, CLIENT_AND_SERVER	false
ports	[]object	Criteria for selecting traffic by their destination port.	false

IngressGateway.spec.extension[index].match[index].ports[index]

↩ Parent

Name	Type	Description	Required
number	integer	Minimum: 0 Maximum: 4.294967295e+09	false

IngressGateway.spec.http[index]

↩ Parent

Name	Type	Description	Required
authentication	object	Configuration to authenticate clients.	false
authorization	object	Configuration to authorize a request.	false
hostname	string	Hostname with which the service can be expected to be accessed by clients.	false
name	string	A name assigned to the server.	false
port	integer	The port where the server is exposed. Minimum: 0 Maximum: 4.294967295e+09	false
rateLimiting	object	Configuration for rate limiting requests.	false
routing	object	Routing rules associated with HTTP traffic to this service.	false
tls	object	TLS certificate info.	false
xxxOldAuthentication	object		false
xxxOldAuthorization	object		false

IngressGateway.spec.http[index].authentication

↩ Parent

Configuration to authenticate clients.

Name	Type	Description	Required
jwt	object	Authenticate an HTTP request from a JWT Token attached to it.	false
oidc	object		false
rules	object	List of rules how to authenticate an HTTP request.	false

IngressGateway.spec.http[index].authentication.jwt

↩ Parent

Authenticate an HTTP request from a JWT Token attached to it.

Name	Type	Description	Required
audiences	[]string		false
fromHeaders	[]object	This field specifies the locations to extract JWT token.	false
issuer	string	Identifies the issuer that issued the JWT.	false
jwks	string	JSON Web Key Set of public keys to validate signature of the JWT.	false
jwksUri	string		false
outputClaimToHeaders	[]object	This field specifies a list of operations to copy the claim to HTTP headers on a successfully verified token.	false
outputPayloadToHeader	string		false

IngressGateway.spec.http[index].authentication.jwt.fromHeaders[index]

↩ Parent

Name	Type	Description	Required
name	string	The HTTP header name.	false
prefix	string	The prefix that should be stripped before decoding the token.	false

IngressGateway.spec.http[index].authentication.jwt.outputClaimToHeaders[index]

↩ Parent

Name	Type	Description	Required
claim	string	The name of the claim to be copied from.	false
header	string	The name of the header to be created.	false

IngressGateway.spec.http[index].authentication.oidc

↩ Parent

Name	Type	Description	Required
authScopes	[]string	Optional list of OAuth scopes to be claimed in the authorization request.	false
authType	enum	Defines how client_id and client_secret are sent in OAuth client to OAuth server requests. Enum: DEFAULT_AUTH_TYPE, URL_ENCODED_BODY, BASIC_AUTH	false
clientId	string	The client_id to be used in the authorize calls.	false
clientTokenSecret	string	The name of the Kubernetes secret containing the client secret.	false
grantType	enum	Enum: DEFAULT_GRANT_TYPE, AUTHORIZATION_CODE	false
provider	object	The OIDC Provider configuration.	false
redirectPathMatcher	string		false
redirectUri	string		false
signoutPath	string	The path to sign a user out, clearing their credential cookies.	false

IngressGateway.spec.http[index].authentication.oidc.provider

↩ Parent

The OIDC Provider configuration.

Name	Type	Description	Required
authorizationEndpoint	string	The OIDC Provider's authorization endpoint.	false
issuer	string	The OIDC Provider's issuer identifier.	false
jwks	string	JSON string with the OIDC provider's JSON Web Key Sets.	false
jwksUri	string	URI for the OIDC provider's JSON Web Key Sets.	false
tokenEndpoint	string	The OIDC Provider's token endpoint.	false

IngressGateway.spec.http[index].authentication.rules

↩ Parent

List of rules how to authenticate an HTTP request.

Name	Type	Description	Required
jwt	[]object	List of rules how to authenticate an HTTP request from a JWT Token attached to it.	false

IngressGateway.spec.http[index].authentication.rules.jwt[index]

↩ Parent

Name	Type	Description	Required
audiences	[]string		false
fromHeaders	[]object	This field specifies the locations to extract JWT token.	false
issuer	string	Identifies the issuer that issued the JWT.	false
jwks	string	JSON Web Key Set of public keys to validate signature of the JWT.	false
jwksUri	string		false
outputClaimToHeaders	[]object	This field specifies a list of operations to copy the claim to HTTP headers on a successfully verified token.	false
outputPayloadToHeader	string		false

IngressGateway.spec.http[index].authentication.rules.jwt[index].fromHeaders[index]

↩ Parent

Name	Type	Description	Required
name	string	The HTTP header name.	false
prefix	string	The prefix that should be stripped before decoding the token.	false

IngressGateway.spec.http[index].authentication.rules.jwt[index].outputClaimToHeaders[index]

↩ Parent

Name	Type	Description	Required
claim	string	The name of the claim to be copied from.	false
header	string	The name of the header to be created.	false

IngressGateway.spec.http[index].authorization

↩ Parent

Configuration to authorize a request.

Name	Type	Description	Required
external	object		false
local	object		false

IngressGateway.spec.http[index].authorization.external

↩ Parent

Name	Type	Description	Required
includeRequestHeaders	[]string		false
tls	object		false
uri	string		false

IngressGateway.spec.http[index].authorization.external.tls

↩ Parent

Name	Type	Description	Required
files	object	TLS key source from files.	false
mode	enum	Enum: DISABLED, SIMPLE, MUTUAL	false
secretName	string	TLS key source from a Kubernetes Secret.	false
subjectAltNames	[]string		false

IngressGateway.spec.http[index].authorization.external.tls.files

↩ Parent

TLS key source from files.

Name	Type	Description	Required
caCertificates	string		false
clientCertificate	string	Certificate file to authenticate the client.	false
privateKey	string	Private key file associated with the client certificate.	false

IngressGateway.spec.http[index].authorization.local

↩ Parent

Name	Type	Description	Required
rules	[]object		false

IngressGateway.spec.http[index].authorization.local.rules[index]

↩ Parent

Name	Type	Description	Required
from	[]object		false
name	string	A friendly name to identify the binding.	false
to	[]object		false

IngressGateway.spec.http[index].authorization.local.rules[index].from[index]

↩ Parent

Name	Type	Description	Required
jwt	object	JWT configuration to identity the subject.	false

IngressGateway.spec.http[index].authorization.local.rules[index].from[index].jwt

↩ Parent

JWT configuration to identity the subject.

Name	Type	Description	Required
iss	string		false
other	map[string]string	A set of arbitrary claims that are required to qualify the subject.	false
sub	string		false

IngressGateway.spec.http[index].authorization.local.rules[index].to[index]

↩ Parent

Name	Type	Description	Required
methods	[]string	The HTTP methods that are allowed by this rule.	false
paths	[]string	The request path where the request is made against.	false

IngressGateway.spec.http[index].rateLimiting

↩ Parent

Configuration for rate limiting requests.

Name	Type	Description	Required
externalService	object	Configure ratelimiting using an external ratelimit server.	false
settings	object		false

IngressGateway.spec.http[index].rateLimiting.externalService

↩ Parent

Configure ratelimiting using an external ratelimit server.

Name	Type	Description	Required
domain	string	The rate limit domain to use when calling the rate limit service.	false
failClosed	boolean		false
rateLimitServerUri	string	The URI at which the external rate limit server can be reached.	false
rules	[]object	A set of rate limit rules.	false
timeout	string	The timeout in seconds for the external rate limit server RPC.	false
tls	object		false

IngressGateway.spec.http[index].rateLimiting.externalService.rules[index]

↩ Parent

Name	Type	Description	Required
dimensions	[]object	A list of dimensions that are to be applied for this rate limit configuration.	false

IngressGateway.spec.http[index].rateLimiting.externalService.rules[index].dimensions[index]

↩ Parent

Name	Type	Description	Required
destinationCluster	object	Rate limit on destination envoy cluster.	false
headerValueMatch	object	Rate limit on the existence of certain request headers.	false
remoteAddress	object	Rate limit on remote address of client.	false
requestHeaders	object	Rate limit on the value of certain request headers.	false
sourceCluster	object	Rate limit on source envoy cluster.	false

IngressGateway.spec.http[index].rateLimiting.externalService.rules[index].dimensions[index].headerValueMatch

↩ Parent

Rate limit on the existence of certain request headers.

Name	Type	Description	Required
descriptorValue	string	The value to use in the descriptor entry.	false
dontMatch	boolean	If set to true, the condition will be met when the header value does not match.	false
headers	map[string]object		false

IngressGateway.spec.http[index].rateLimiting.externalService.rules[index].dimensions[index].headerValueMatch.headers[key]

↩ Parent

Name	Type	Description	Required
exact	string	Exact string match.	false
prefix	string	Prefix-based match.	false
regex	string	ECMAscript style regex-based match.	false

IngressGateway.spec.http[index].rateLimiting.externalService.rules[index].dimensions[index].requestHeaders

↩ Parent

Rate limit on the value of certain request headers.

Name	Type	Description	Required
descriptorKey	string	The key to use in the descriptor entry.	false
headerName	string	The header name to be queried from the request headers.	false

IngressGateway.spec.http[index].rateLimiting.externalService.tls

↩ Parent

Name	Type	Description	Required
files	object	TLS key source from files.	false
mode	enum	Enum: DISABLED, SIMPLE, MUTUAL	false
secretName	string	TLS key source from a Kubernetes Secret.	false
subjectAltNames	[]string		false

IngressGateway.spec.http[index].rateLimiting.externalService.tls.files

↩ Parent

TLS key source from files.

Name	Type	Description	Required
caCertificates	string		false
clientCertificate	string	Certificate file to authenticate the client.	false
privateKey	string	Private key file associated with the client certificate.	false

IngressGateway.spec.http[index].rateLimiting.settings

↩ Parent

Name	Type	Description	Required
failClosed	boolean		false
rules	[]object	A list of rules for ratelimiting.	false
timeout	string	The timeout in seconds for the rate limit server RPC.	false

IngressGateway.spec.http[index].rateLimiting.settings.rules[index]

↩ Parent

Name	Type	Description	Required
dimensions	[]object	A list of dimensions to define each ratelimit rule.	false
limit	object	The ratelimit value that will be configured for the above rules.	false

IngressGateway.spec.http[index].rateLimiting.settings.rules[index].dimensions[index]

↩ Parent

Name	Type	Description	Required
header	object	Rate limit on certain HTTP headers.	false
remoteAddress	object	Rate limit on the remote address of client.	false

IngressGateway.spec.http[index].rateLimiting.settings.rules[index].dimensions[index].header

↩ Parent

Rate limit on certain HTTP headers.

Name	Type	Description	Required
dontMatch	boolean	If set to true, the condition will be met when the header value does not match.	false
name	string	Name of the header to match on.	false
value	object	Value of the header to match on if matching on a specific value.	false

IngressGateway.spec.http[index].rateLimiting.settings.rules[index].dimensions[index].header.value

↩ Parent

Value of the header to match on if matching on a specific value.

Name	Type	Description	Required
exact	string	Exact string match.	false
prefix	string	Prefix-based match.	false
regex	string	ECMAscript style regex-based match.	false

IngressGateway.spec.http[index].rateLimiting.settings.rules[index].dimensions[index].remoteAddress

↩ Parent

Rate limit on the remote address of client.

Name	Type	Description	Required
value	string	Ratelimit on a specific remote address.	false

IngressGateway.spec.http[index].rateLimiting.settings.rules[index].limit

↩ Parent

The ratelimit value that will be configured for the above rules.

Name	Type	Description	Required
requestsPerUnit	integer	Specifies the value of the rate limit. Minimum: 0 Maximum: 4.294967295e+09	false
unit	enum	Specifies the unit of time for rate limit. Enum: UNKNOWN, SECOND, MINUTE, HOUR, DAY	false

IngressGateway.spec.http[index].routing

↩ Parent

Routing rules associated with HTTP traffic to this service.

Name	Type	Description	Required
corsPolicy	object	Cross origin resource request policy settings for all routes.	false
rules	[]object	HTTP routes.	false

IngressGateway.spec.http[index].routing.corsPolicy

↩ Parent

Cross origin resource request policy settings for all routes.

Name	Type	Description	Required
allowCredentials	boolean		false
allowHeaders	[]string	List of HTTP headers that can be used when requesting the resource.	false
allowMethods	[]string	List of HTTP methods allowed to access the resource.	false
allowOrigin	[]string	The list of origins that are allowed to perform CORS requests.	false
exposeHeaders	[]string	A white list of HTTP headers that the browsers are allowed to access.	false
maxAge	string	Specifies how long the results of a preflight request can be cached.	false

IngressGateway.spec.http[index].routing.rules[index]

↩ Parent

Name	Type	Description	Required
match	[]object	One or more match conditions (OR-ed).	false
modify	object	One or more mutations to be performed before forwarding.	false
redirect	object	Redirect the request to a different host or URL or both.	false
route	object	Forward the request to the specified destination(s).	false

IngressGateway.spec.http[index].routing.rules[index].match[index]

↩ Parent

Name	Type	Description	Required
headers	map[string]object	The header keys must be lowercase and use hyphen as the separator, e.g.	false
uri	object	URI to match.	false

IngressGateway.spec.http[index].routing.rules[index].match[index].headers[key]

↩ Parent

Name	Type	Description	Required
exact	string	Exact string match.	false
prefix	string	Prefix-based match.	false
regex	string	ECMAscript style regex-based match.	false

IngressGateway.spec.http[index].routing.rules[index].match[index].uri

↩ Parent

URI to match.

Name	Type	Description	Required
exact	string	Exact string match.	false
prefix	string	Prefix-based match.	false
regex	string	ECMAscript style regex-based match.	false

IngressGateway.spec.http[index].routing.rules[index].modify

↩ Parent

One or more mutations to be performed before forwarding.

Name	Type	Description	Required
headers	object	Add/remove/overwrite one or more HTTP headers in a request or response.	false
rewrite	object	Rewrite the HTTP Host or URL or both.	false

IngressGateway.spec.http[index].routing.rules[index].modify.headers

↩ Parent

Add/remove/overwrite one or more HTTP headers in a request or response.

Name	Type	Description	Required
request	object	Header manipulation rules to apply before forwarding a request to the destination service.	false
response	object	Header manipulation rules to apply before returning a response to the caller.	false

IngressGateway.spec.http[index].routing.rules[index].modify.headers.request

↩ Parent

Header manipulation rules to apply before forwarding a request to the destination service.

Name	Type	Description	Required
add	map[string]string		false
remove	[]string	Remove a the specified headers.	false
set	map[string]string	Overwrite the headers specified by key with the given values.	false

IngressGateway.spec.http[index].routing.rules[index].modify.headers.response

↩ Parent

Header manipulation rules to apply before returning a response to the caller.

Name	Type	Description	Required
add	map[string]string		false
remove	[]string	Remove a the specified headers.	false
set	map[string]string	Overwrite the headers specified by key with the given values.	false

IngressGateway.spec.http[index].routing.rules[index].modify.rewrite

↩ Parent

Rewrite the HTTP Host or URL or both.

Name	Type	Description	Required
authority	string	Rewrite the Authority/Host header with this value.	false
uri	string	Rewrite the path (or the prefix) portion of the URI with this value.	false

IngressGateway.spec.http[index].routing.rules[index].redirect

↩ Parent

Redirect the request to a different host or URL or both.

Name	Type	Description	Required
authority	string	On a redirect, overwrite the Authority/Host portion of the URL with this value.	false
port	integer	Minimum: 0 Maximum: 4.294967295e+09	false
redirectCode	integer	Minimum: 0 Maximum: 4.294967295e+09	false
scheme	string	On a redirect, overwrite the scheme with this one.	false
uri	string	On a redirect, overwrite the Path portion of the URL with this value.	false

IngressGateway.spec.http[index].routing.rules[index].route

↩ Parent

Forward the request to the specified destination(s).

Name	Type	Description	Required
host	string		false
port	integer	The port on the service to forward the request to. Minimum: 0 Maximum: 4.294967295e+09	false

IngressGateway.spec.http[index].tls

↩ Parent

TLS certificate info.

Name	Type	Description	Required
cipherSuites	[]string	List of cipher suites to be used for TLS connections.	false
files	object		false
maxProtocolVersion	enum	Set the maximum supported TLS protocol version. Enum: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3	false
minProtocolVersion	enum	Set the minimum supported TLS protocol version. Enum: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3	false
mode	enum	Enum: DISABLED, SIMPLE, MUTUAL, OPTIONAL_MUTUAL	false
secretName	string		false
subjectAltNames	[]string		false

IngressGateway.spec.http[index].tls.files

↩ Parent

Name	Type	Description	Required
caCertificates	string		false
privateKey	string		false
serverCertificate	string		false

IngressGateway.spec.http[index].xxxOldAuthentication

↩ Parent

Name	Type	Description	Required
jwt	object		false

IngressGateway.spec.http[index].xxxOldAuthentication.jwt

↩ Parent

Name	Type	Description	Required
audiences	[]string		false
issuer	string	Identifies the issuer that issued the JWT.	false
jwks	string	JSON Web Key Set of public keys to validate signature of the JWT.	false
jwksUri	string		false

IngressGateway.spec.http[index].xxxOldAuthorization

↩ Parent

Name	Type	Description	Required
external	object		false
local	object		false

IngressGateway.spec.http[index].xxxOldAuthorization.external

↩ Parent

Name	Type	Description	Required
includeRequestHeaders	[]string		false
uri	string		false

IngressGateway.spec.http[index].xxxOldAuthorization.local

↩ Parent

Name	Type	Description	Required
rules	[]object		false

IngressGateway.spec.http[index].xxxOldAuthorization.local.rules[index]

↩ Parent

Name	Type	Description	Required
from	[]object		false
name	string	A friendly name to identify the binding.	false
to	[]object		false

IngressGateway.spec.http[index].xxxOldAuthorization.local.rules[index].from[index]

↩ Parent

Name	Type	Description	Required
jwt	object	JWT configuration to identity the subject.	false

IngressGateway.spec.http[index].xxxOldAuthorization.local.rules[index].from[index].jwt

↩ Parent

JWT configuration to identity the subject.

Name	Type	Description	Required
iss	string		false
other	map[string]string	A set of arbitrary claims that are required to qualify the subject.	false
sub	string		false

IngressGateway.spec.http[index].xxxOldAuthorization.local.rules[index].to[index]

↩ Parent

Name	Type	Description	Required
methods	[]string	The HTTP methods that are allowed by this rule.	false
paths	[]string	The request path where the request is made against.	false

IngressGateway.spec.tcp[index]

↩ Parent

Name	Type	Description	Required
hostname	string	Hostname to identify the service.	false
name	string	A name assigned to the server.	false
port	integer	The port where the server is exposed. Minimum: 0 Maximum: 4.294967295e+09	false
route	object	Forward the connection to the specified destination.	false
tls	object		false

IngressGateway.spec.tcp[index].route

↩ Parent

Forward the connection to the specified destination.

Name	Type	Description	Required
host	string		false
port	integer	The port on the service to forward the request to. Minimum: 0 Maximum: 4.294967295e+09	false

IngressGateway.spec.tcp[index].tls

↩ Parent

Name	Type	Description	Required
cipherSuites	[]string	List of cipher suites to be used for TLS connections.	false
files	object		false
maxProtocolVersion	enum	Set the maximum supported TLS protocol version. Enum: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3	false
minProtocolVersion	enum	Set the minimum supported TLS protocol version. Enum: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3	false
mode	enum	Enum: DISABLED, SIMPLE, MUTUAL, OPTIONAL_MUTUAL	false
secretName	string		false
subjectAltNames	[]string		false

IngressGateway.spec.tcp[index].tls.files

↩ Parent

Name	Type	Description	Required
caCertificates	string		false
privateKey	string		false
serverCertificate	string		false

IngressGateway.spec.tlsPassthrough[index]

↩ Parent

Name	Type	Description	Required
hostname	string	Hostname with which the service can be expected to be accessed by clients.	false
name	string	A name assigned to the server.	false
port	integer	The port where the server is exposed. Minimum: 0 Maximum: 4.294967295e+09	false
route	object	Forward the connection to the specified destination.	false

IngressGateway.spec.tlsPassthrough[index].route

↩ Parent

Forward the connection to the specified destination.

Name	Type	Description	Required
host	string		false
port	integer	The port on the service to forward the request to. Minimum: 0 Maximum: 4.294967295e+09	false

IngressGateway.spec.waf

↩ Parent

WAF settings to be enabled for traffic passing through the HttpServer.

Name	Type	Description	Required
rules	[]string	Rules to be leveraged by WAF.	false

IngressGateway.spec.workloadSelector

↩ Parent

Name	Type	Description	Required
labels	map[string]string		false
namespace	string	The namespace where the workload resides.	false

Group

↩ Parent

Name	Type	Description	Required
apiVersion	string	gateway.tsb.tetrate.io/v2	true
kind	string	Group	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the metadata field.	true
spec	object		false
status	object		false

Group.spec

↩ Parent

Name	Type	Description	Required
configGenerationMetadata	object	Default metadata values that will be propagated to the children Istio generated configurations.	false
configMode	enum	Enum: BRIDGED, DIRECT	false
deletionProtectionEnabled	boolean	When set, prevents the resource from being deleted.	false
description	string	A description of the resource.	false
displayName	string	User friendly name for the resource.	false
etag	string	The etag for the resource.	false
fqn	string	Fully-qualified name of the resource.	false
namespaceSelector	object	Set of namespaces owned exclusively by this group.	false

Group.spec.configGenerationMetadata

↩ Parent

Default metadata values that will be propagated to the children Istio generated configurations.

Name	Type	Description	Required
annotations	map[string]string	Set of key value paris that will be added into the metadata.annotations field of the Istio generated configurations.	false
labels	map[string]string	Set of key value paris that will be added into the metadata.labels field of the Istio generated configurations.	false

Group.spec.namespaceSelector

↩ Parent

Set of namespaces owned exclusively by this group.

Name	Type	Description	Required
names	[]string		false

Gateway

↩ Parent

Name	Type	Description	Required
apiVersion	string	gateway.tsb.tetrate.io/v2	true
kind	string	Gateway	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the metadata field.	true
spec	object		false
status	object		false

Gateway.spec

↩ Parent

Name	Type	Description	Required
configGenerationMetadata	object	Metadata values that will be add into the Istio generated configurations.	false
description	string	A description of the resource.	false
displayName	string	User friendly name for the resource.	false
etag	string	The etag for the resource.	false
fqn	string	Fully-qualified name of the resource.	false
http	[]object	One or more HTTP or HTTPS servers exposed by the gateway.	false
tcp	[]object		false
tls	[]object	One or more TLS servers exposed by the gateway.	false
waf	object	WAF settings to be enabled for traffic passing through the HttpServer.	false
wasmPlugins	[]object		false
workloadSelector	object		false

Gateway.spec.configGenerationMetadata

↩ Parent

Metadata values that will be add into the Istio generated configurations.

Name	Type	Description	Required
annotations	map[string]string	Set of key value paris that will be added into the metadata.annotations field of the Istio generated configurations.	false
labels	map[string]string	Set of key value paris that will be added into the metadata.labels field of the Istio generated configurations.	false

Gateway.spec.http[index]

↩ Parent

Name	Type	Description	Required
authentication	object		false
authorization	object	Authorization is used to configure authorization of end users.	false
hostname	string	Hostname with which the service can be expected to be accessed by clients.	false
name	string	A name assigned to the server.	false
port	integer	The port where the server is exposed at the gateway workload(pod). Minimum: 0 Maximum: 4.294967295e+09	false
rateLimiting	object	Configuration for rate limiting requests.	false
routing	object	Routing rules associated with HTTP traffic to this server.	false
tls	object	TLS certificate info.	false
transit	boolean	If set to true, the server is configured to be exposed within the mesh.	false

Gateway.spec.http[index].authentication

↩ Parent

Name	Type	Description	Required
jwt	object	Authenticate an HTTP request from a JWT Token attached to it.	false
oidc	object		false
rules	object	List of rules how to authenticate an HTTP request.	false

Gateway.spec.http[index].authentication.jwt

↩ Parent

Authenticate an HTTP request from a JWT Token attached to it.

Name	Type	Description	Required
audiences	[]string		false
fromHeaders	[]object	This field specifies the locations to extract JWT token.	false
issuer	string	Identifies the issuer that issued the JWT.	false
jwks	string	JSON Web Key Set of public keys to validate signature of the JWT.	false
jwksUri	string		false
outputClaimToHeaders	[]object	This field specifies a list of operations to copy the claim to HTTP headers on a successfully verified token.	false
outputPayloadToHeader	string		false

Gateway.spec.http[index].authentication.jwt.fromHeaders[index]

↩ Parent

Name	Type	Description	Required
name	string	The HTTP header name.	false
prefix	string	The prefix that should be stripped before decoding the token.	false

Gateway.spec.http[index].authentication.jwt.outputClaimToHeaders[index]

↩ Parent

Name	Type	Description	Required
claim	string	The name of the claim to be copied from.	false
header	string	The name of the header to be created.	false

Gateway.spec.http[index].authentication.oidc

↩ Parent

Name	Type	Description	Required
authScopes	[]string	Optional list of OAuth scopes to be claimed in the authorization request.	false
authType	enum	Defines how client_id and client_secret are sent in OAuth client to OAuth server requests. Enum: DEFAULT_AUTH_TYPE, URL_ENCODED_BODY, BASIC_AUTH	false
clientId	string	The client_id to be used in the authorize calls.	false
clientTokenSecret	string	The name of the Kubernetes secret containing the client secret.	false
grantType	enum	Enum: DEFAULT_GRANT_TYPE, AUTHORIZATION_CODE	false
provider	object	The OIDC Provider configuration.	false
redirectPathMatcher	string		false
redirectUri	string		false
signoutPath	string	The path to sign a user out, clearing their credential cookies.	false

Gateway.spec.http[index].authentication.oidc.provider

↩ Parent

The OIDC Provider configuration.

Name	Type	Description	Required
authorizationEndpoint	string	The OIDC Provider's authorization endpoint.	false
issuer	string	The OIDC Provider's issuer identifier.	false
jwks	string	JSON string with the OIDC provider's JSON Web Key Sets.	false
jwksUri	string	URI for the OIDC provider's JSON Web Key Sets.	false
tokenEndpoint	string	The OIDC Provider's token endpoint.	false

Gateway.spec.http[index].authentication.rules

↩ Parent

List of rules how to authenticate an HTTP request.

Name	Type	Description	Required
jwt	[]object	List of rules how to authenticate an HTTP request from a JWT Token attached to it.	false

Gateway.spec.http[index].authentication.rules.jwt[index]

↩ Parent

Name	Type	Description	Required
audiences	[]string		false
fromHeaders	[]object	This field specifies the locations to extract JWT token.	false
issuer	string	Identifies the issuer that issued the JWT.	false
jwks	string	JSON Web Key Set of public keys to validate signature of the JWT.	false
jwksUri	string		false
outputClaimToHeaders	[]object	This field specifies a list of operations to copy the claim to HTTP headers on a successfully verified token.	false
outputPayloadToHeader	string		false

Gateway.spec.http[index].authentication.rules.jwt[index].fromHeaders[index]

↩ Parent

Name	Type	Description	Required
name	string	The HTTP header name.	false
prefix	string	The prefix that should be stripped before decoding the token.	false

Gateway.spec.http[index].authentication.rules.jwt[index].outputClaimToHeaders[index]

↩ Parent

Name	Type	Description	Required
claim	string	The name of the claim to be copied from.	false
header	string	The name of the header to be created.	false

Gateway.spec.http[index].authorization

↩ Parent

Authorization is used to configure authorization of end users.

Name	Type	Description	Required
external	object		false
local	object		false

Gateway.spec.http[index].authorization.external

↩ Parent

Name	Type	Description	Required
includeRequestHeaders	[]string		false
tls	object		false
uri	string		false

Gateway.spec.http[index].authorization.external.tls

↩ Parent

Name	Type	Description	Required
files	object	TLS key source from files.	false
mode	enum	Enum: DISABLED, SIMPLE, MUTUAL	false
secretName	string	TLS key source from a Kubernetes Secret.	false
subjectAltNames	[]string		false

Gateway.spec.http[index].authorization.external.tls.files

↩ Parent

TLS key source from files.

Name	Type	Description	Required
caCertificates	string		false
clientCertificate	string	Certificate file to authenticate the client.	false
privateKey	string	Private key file associated with the client certificate.	false

Gateway.spec.http[index].authorization.local

↩ Parent

Name	Type	Description	Required
rules	[]object		false

Gateway.spec.http[index].authorization.local.rules[index]

↩ Parent

Name	Type	Description	Required
from	[]object		false
name	string	A friendly name to identify the binding.	false
to	[]object		false

Gateway.spec.http[index].authorization.local.rules[index].from[index]

↩ Parent

Name	Type	Description	Required
jwt	object	JWT configuration to identity the subject.	false

Gateway.spec.http[index].authorization.local.rules[index].from[index].jwt

↩ Parent

JWT configuration to identity the subject.

Name	Type	Description	Required
iss	string		false
other	map[string]string	A set of arbitrary claims that are required to qualify the subject.	false
sub	string		false

Gateway.spec.http[index].authorization.local.rules[index].to[index]

↩ Parent

Name	Type	Description	Required
methods	[]string	The HTTP methods that are allowed by this rule.	false
paths	[]string	The request path where the request is made against.	false

Gateway.spec.http[index].rateLimiting

↩ Parent

Configuration for rate limiting requests.

Name	Type	Description	Required
externalService	object	Configure ratelimiting using an external ratelimit server.	false
settings	object		false

Gateway.spec.http[index].rateLimiting.externalService

↩ Parent

Configure ratelimiting using an external ratelimit server.

Name	Type	Description	Required
domain	string	The rate limit domain to use when calling the rate limit service.	false
failClosed	boolean		false
rateLimitServerUri	string	The URI at which the external rate limit server can be reached.	false
rules	[]object	A set of rate limit rules.	false
timeout	string	The timeout in seconds for the external rate limit server RPC.	false
tls	object		false

Gateway.spec.http[index].rateLimiting.externalService.rules[index]

↩ Parent

Name	Type	Description	Required
dimensions	[]object	A list of dimensions that are to be applied for this rate limit configuration.	false

Gateway.spec.http[index].rateLimiting.externalService.rules[index].dimensions[index]

↩ Parent

Name	Type	Description	Required
destinationCluster	object	Rate limit on destination envoy cluster.	false
headerValueMatch	object	Rate limit on the existence of certain request headers.	false
remoteAddress	object	Rate limit on remote address of client.	false
requestHeaders	object	Rate limit on the value of certain request headers.	false
sourceCluster	object	Rate limit on source envoy cluster.	false

Gateway.spec.http[index].rateLimiting.externalService.rules[index].dimensions[index].headerValueMatch

↩ Parent

Rate limit on the existence of certain request headers.

Name	Type	Description	Required
descriptorValue	string	The value to use in the descriptor entry.	false
dontMatch	boolean	If set to true, the condition will be met when the header value does not match.	false
headers	map[string]object		false

Gateway.spec.http[index].rateLimiting.externalService.rules[index].dimensions[index].headerValueMatch.headers[key]

↩ Parent

Name	Type	Description	Required
exact	string	Exact string match.	false
prefix	string	Prefix-based match.	false
regex	string	ECMAscript style regex-based match.	false

Gateway.spec.http[index].rateLimiting.externalService.rules[index].dimensions[index].requestHeaders

↩ Parent

Rate limit on the value of certain request headers.

Name	Type	Description	Required
descriptorKey	string	The key to use in the descriptor entry.	false
headerName	string	The header name to be queried from the request headers.	false

Gateway.spec.http[index].rateLimiting.externalService.tls

↩ Parent

Name	Type	Description	Required
files	object	TLS key source from files.	false
mode	enum	Enum: DISABLED, SIMPLE, MUTUAL	false
secretName	string	TLS key source from a Kubernetes Secret.	false
subjectAltNames	[]string		false

Gateway.spec.http[index].rateLimiting.externalService.tls.files

↩ Parent

TLS key source from files.

Name	Type	Description	Required
caCertificates	string		false
clientCertificate	string	Certificate file to authenticate the client.	false
privateKey	string	Private key file associated with the client certificate.	false

Gateway.spec.http[index].rateLimiting.settings

↩ Parent

Name	Type	Description	Required
failClosed	boolean		false
rules	[]object	A list of rules for ratelimiting.	false
timeout	string	The timeout in seconds for the rate limit server RPC.	false

Gateway.spec.http[index].rateLimiting.settings.rules[index]

↩ Parent

Name	Type	Description	Required
dimensions	[]object	A list of dimensions to define each ratelimit rule.	false
limit	object	The ratelimit value that will be configured for the above rules.	false

Gateway.spec.http[index].rateLimiting.settings.rules[index].dimensions[index]

↩ Parent

Name	Type	Description	Required
header	object	Rate limit on certain HTTP headers.	false
remoteAddress	object	Rate limit on the remote address of client.	false

Gateway.spec.http[index].rateLimiting.settings.rules[index].dimensions[index].header

↩ Parent

Rate limit on certain HTTP headers.

Name	Type	Description	Required
dontMatch	boolean	If set to true, the condition will be met when the header value does not match.	false
name	string	Name of the header to match on.	false
value	object	Value of the header to match on if matching on a specific value.	false

Gateway.spec.http[index].rateLimiting.settings.rules[index].dimensions[index].header.value

↩ Parent

Value of the header to match on if matching on a specific value.

Name	Type	Description	Required
exact	string	Exact string match.	false
prefix	string	Prefix-based match.	false
regex	string	ECMAscript style regex-based match.	false

Gateway.spec.http[index].rateLimiting.settings.rules[index].dimensions[index].remoteAddress

↩ Parent

Rate limit on the remote address of client.

Name	Type	Description	Required
value	string	Ratelimit on a specific remote address.	false

Gateway.spec.http[index].rateLimiting.settings.rules[index].limit

↩ Parent

The ratelimit value that will be configured for the above rules.

Name	Type	Description	Required
requestsPerUnit	integer	Specifies the value of the rate limit. Minimum: 0 Maximum: 4.294967295e+09	false
unit	enum	Specifies the unit of time for rate limit. Enum: UNKNOWN, SECOND, MINUTE, HOUR, DAY	false

Gateway.spec.http[index].routing

↩ Parent

Routing rules associated with HTTP traffic to this server.

Name	Type	Description	Required
corsPolicy	object	Cross origin resource request policy settings for all routes.	false
rules	[]object	HTTP routes.	false

Gateway.spec.http[index].routing.corsPolicy

↩ Parent

Cross origin resource request policy settings for all routes.

Name	Type	Description	Required
allowCredentials	boolean		false
allowHeaders	[]string	List of HTTP headers that can be used when requesting the resource.	false
allowMethods	[]string	List of HTTP methods allowed to access the resource.	false
allowOrigin	[]string	The list of origins that are allowed to perform CORS requests.	false
exposeHeaders	[]string	A white list of HTTP headers that the browsers are allowed to access.	false
maxAge	string	Specifies how long the results of a preflight request can be cached.	false

Gateway.spec.http[index].routing.rules[index]

↩ Parent

Name	Type	Description	Required
disableExternalAuthorization	boolean		false
match	[]object	One or more match conditions (OR-ed).	false
modify	object	One or more mutations to be performed before forwarding.	false
redirect	object	Redirect the request to a different host or URL or both.	false
route	object	Forward the request to the specified destination(s).	false

Gateway.spec.http[index].routing.rules[index].match[index]

↩ Parent

Name	Type	Description	Required
headers	map[string]object	The header keys must be lowercase and use hyphen as the separator, e.g.	false
uri	object	URI to match.	false

Gateway.spec.http[index].routing.rules[index].match[index].headers[key]

↩ Parent

Name	Type	Description	Required
exact	string	Exact string match.	false
prefix	string	Prefix-based match.	false
regex	string	ECMAscript style regex-based match.	false

Gateway.spec.http[index].routing.rules[index].match[index].uri

↩ Parent

URI to match.

Name	Type	Description	Required
exact	string	Exact string match.	false
prefix	string	Prefix-based match.	false
regex	string	ECMAscript style regex-based match.	false

Gateway.spec.http[index].routing.rules[index].modify

↩ Parent

One or more mutations to be performed before forwarding.

Name	Type	Description	Required
headers	object	Add/remove/overwrite one or more HTTP headers in a request or response.	false
rewrite	object	Rewrite the HTTP Host or URL or both.	false

Gateway.spec.http[index].routing.rules[index].modify.headers

↩ Parent

Add/remove/overwrite one or more HTTP headers in a request or response.

Name	Type	Description	Required
request	object	Header manipulation rules to apply before forwarding a request to the destination service.	false
response	object	Header manipulation rules to apply before returning a response to the caller.	false

Gateway.spec.http[index].routing.rules[index].modify.headers.request

↩ Parent

Header manipulation rules to apply before forwarding a request to the destination service.

Name	Type	Description	Required
add	map[string]string		false
remove	[]string	Remove a the specified headers.	false
set	map[string]string	Overwrite the headers specified by key with the given values.	false

Gateway.spec.http[index].routing.rules[index].modify.headers.response

↩ Parent

Header manipulation rules to apply before returning a response to the caller.

Name	Type	Description	Required
add	map[string]string		false
remove	[]string	Remove a the specified headers.	false
set	map[string]string	Overwrite the headers specified by key with the given values.	false

Gateway.spec.http[index].routing.rules[index].modify.rewrite

↩ Parent

Rewrite the HTTP Host or URL or both.

Name	Type	Description	Required
authority	string	Rewrite the Authority/Host header with this value.	false
uri	string	Rewrite the path (or the prefix) portion of the URI with this value.	false

Gateway.spec.http[index].routing.rules[index].redirect

↩ Parent

Redirect the request to a different host or URL or both.

Name	Type	Description	Required
authority	string	On a redirect, overwrite the Authority/Host portion of the URL with this value.	false
port	integer	Minimum: 0 Maximum: 4.294967295e+09	false
redirectCode	integer	Minimum: 0 Maximum: 4.294967295e+09	false
scheme	string	On a redirect, overwrite the scheme with this one.	false
uri	string	On a redirect, overwrite the Path portion of the URL with this value.	false

Gateway.spec.http[index].routing.rules[index].route

↩ Parent

Forward the request to the specified destination(s).

Name	Type	Description	Required
clusterDestination	object		false
serviceDestination	object	RouteToService represents the service running in clusters.	false

Gateway.spec.http[index].routing.rules[index].route.clusterDestination

↩ Parent

Name	Type	Description	Required
clusters	[]object	The destination clusters that contain ingress gateways exposing the hostname.	false

Gateway.spec.http[index].routing.rules[index].route.clusterDestination.clusters[index]

↩ Parent

Name	Type	Description	Required
labels	map[string]string	Labels associated with the cluster.	false
name	string	The name of the destination cluster.	false
network	string	The network associated with the destination clusters.	false
weight	integer	The weight for traffic to a given destination. Minimum: 0 Maximum: 4.294967295e+09	false

Gateway.spec.http[index].routing.rules[index].route.serviceDestination

↩ Parent

RouteToService represents the service running in clusters.

Name	Type	Description	Required
host	string	The destination service in &#003C;namespace&#003E;/&#003C;fqdn&#003E;.	false
port	integer	The port on the service to forward the request to. Minimum: 0 Maximum: 4.294967295e+09	false
tls	object		false

Gateway.spec.http[index].routing.rules[index].route.serviceDestination.tls

↩ Parent

Name	Type	Description	Required
files	object	TLS key source from files.	false
mode	enum	Enum: DISABLED, SIMPLE, MUTUAL	false
secretName	string	TLS key source from a Kubernetes Secret.	false
subjectAltNames	[]string		false

Gateway.spec.http[index].routing.rules[index].route.serviceDestination.tls.files

↩ Parent

TLS key source from files.

Name	Type	Description	Required
caCertificates	string		false
clientCertificate	string	Certificate file to authenticate the client.	false
privateKey	string	Private key file associated with the client certificate.	false

Gateway.spec.http[index].tls

↩ Parent

TLS certificate info.

Name	Type	Description	Required
cipherSuites	[]string	List of cipher suites to be used for TLS connections.	false
files	object		false
maxProtocolVersion	enum	Set the maximum supported TLS protocol version. Enum: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3	false
minProtocolVersion	enum	Set the minimum supported TLS protocol version. Enum: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3	false
mode	enum	Enum: DISABLED, SIMPLE, MUTUAL, OPTIONAL_MUTUAL	false
secretName	string		false
subjectAltNames	[]string		false

Gateway.spec.http[index].tls.files

↩ Parent

Name	Type	Description	Required
caCertificates	string		false
privateKey	string		false
serverCertificate	string		false

Gateway.spec.tcp[index]

↩ Parent

Name	Type	Description	Required
hostname	string	Hostname to identify the service.	false
name	string	A name assigned to the server.	false
port	integer	The port where the server is exposed. Minimum: 0 Maximum: 4.294967295e+09	false
route	object	Forward the connection to the specified destination.	false
tls	object	TLS certificate info to terminate the TLS connection.	false
transit	boolean	If set to true, the server is configured to be exposed within the mesh.	false

Gateway.spec.tcp[index].route

↩ Parent

Forward the connection to the specified destination.

Name	Type	Description	Required
clusterDestination	object		false
serviceDestination	object	RouteToService represents the service running in clusters.	false

Gateway.spec.tcp[index].route.clusterDestination

↩ Parent

Name	Type	Description	Required
clusters	[]object	The destination clusters that contain ingress gateways exposing the hostname.	false

Gateway.spec.tcp[index].route.clusterDestination.clusters[index]

↩ Parent

Name	Type	Description	Required
labels	map[string]string	Labels associated with the cluster.	false
name	string	The name of the destination cluster.	false
network	string	The network associated with the destination clusters.	false
weight	integer	The weight for traffic to a given destination. Minimum: 0 Maximum: 4.294967295e+09	false

Gateway.spec.tcp[index].route.serviceDestination

↩ Parent

RouteToService represents the service running in clusters.

Name	Type	Description	Required
host	string	The destination service in &#003C;namespace&#003E;/&#003C;fqdn&#003E;.	false
port	integer	The port on the service to forward the request to. Minimum: 0 Maximum: 4.294967295e+09	false
tls	object		false

Gateway.spec.tcp[index].route.serviceDestination.tls

↩ Parent

Name	Type	Description	Required
files	object	TLS key source from files.	false
mode	enum	Enum: DISABLED, SIMPLE, MUTUAL	false
secretName	string	TLS key source from a Kubernetes Secret.	false
subjectAltNames	[]string		false

Gateway.spec.tcp[index].route.serviceDestination.tls.files

↩ Parent

TLS key source from files.

Name	Type	Description	Required
caCertificates	string		false
clientCertificate	string	Certificate file to authenticate the client.	false
privateKey	string	Private key file associated with the client certificate.	false

Gateway.spec.tcp[index].tls

↩ Parent

TLS certificate info to terminate the TLS connection.

Name	Type	Description	Required
cipherSuites	[]string	List of cipher suites to be used for TLS connections.	false
files	object		false
maxProtocolVersion	enum	Set the maximum supported TLS protocol version. Enum: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3	false
minProtocolVersion	enum	Set the minimum supported TLS protocol version. Enum: TLS_AUTO, TLSV1_0, TLSV1_1, TLSV1_2, TLSV1_3	false
mode	enum	Enum: DISABLED, SIMPLE, MUTUAL, OPTIONAL_MUTUAL	false
secretName	string		false
subjectAltNames	[]string		false

Gateway.spec.tcp[index].tls.files

↩ Parent

Name	Type	Description	Required
caCertificates	string		false
privateKey	string		false
serverCertificate	string		false

Gateway.spec.tls[index]

↩ Parent

Name	Type	Description	Required
hostname	string	Hostname with which the service can be expected to be accessed by clients.	false
name	string	A name assigned to the server.	false
port	integer	The port where the server is exposed. Minimum: 0 Maximum: 4.294967295e+09	false
route	object	Forward the connection to the specified destination.	false

Gateway.spec.tls[index].route

↩ Parent

Forward the connection to the specified destination.

Name	Type	Description	Required
clusterDestination	object		false
serviceDestination	object	RouteToService represents the service running in clusters.	false

Gateway.spec.tls[index].route.clusterDestination

↩ Parent

Name	Type	Description	Required
clusters	[]object	The destination clusters that contain ingress gateways exposing the hostname.	false

Gateway.spec.tls[index].route.clusterDestination.clusters[index]

↩ Parent

Name	Type	Description	Required
labels	map[string]string	Labels associated with the cluster.	false
name	string	The name of the destination cluster.	false
network	string	The network associated with the destination clusters.	false
weight	integer	The weight for traffic to a given destination. Minimum: 0 Maximum: 4.294967295e+09	false

Gateway.spec.tls[index].route.serviceDestination

↩ Parent

RouteToService represents the service running in clusters.

Name	Type	Description	Required
host	string	The destination service in &#003C;namespace&#003E;/&#003C;fqdn&#003E;.	false
port	integer	The port on the service to forward the request to. Minimum: 0 Maximum: 4.294967295e+09	false
tls	object		false

Gateway.spec.tls[index].route.serviceDestination.tls

↩ Parent

Name	Type	Description	Required
files	object	TLS key source from files.	false
mode	enum	Enum: DISABLED, SIMPLE, MUTUAL	false
secretName	string	TLS key source from a Kubernetes Secret.	false
subjectAltNames	[]string		false

Gateway.spec.tls[index].route.serviceDestination.tls.files

↩ Parent

TLS key source from files.

Name	Type	Description	Required
caCertificates	string		false
clientCertificate	string	Certificate file to authenticate the client.	false
privateKey	string	Private key file associated with the client certificate.	false

Gateway.spec.waf

↩ Parent

WAF settings to be enabled for traffic passing through the HttpServer.

Name	Type	Description	Required
rules	[]string	Rules to be leveraged by WAF.	false

Gateway.spec.wasmPlugins[index]

↩ Parent

Name	Type	Description	Required
config	object	Configuration parameters sent to the WASM plugin execution.	false
fqn	string	Fqn of the extension to be executed.	false
match	[]object	Specifies the criteria to determine which traffic is passed to WasmExtension.	false

Gateway.spec.wasmPlugins[index].match[index]

↩ Parent

Name	Type	Description	Required
mode	enum	Criteria for selecting traffic by their direction. Enum: UNDEFINED, CLIENT, SERVER, CLIENT_AND_SERVER	false
ports	[]object	Criteria for selecting traffic by their destination port.	false

Gateway.spec.wasmPlugins[index].match[index].ports[index]

↩ Parent

Name	Type	Description	Required
number	integer	Minimum: 0 Maximum: 4.294967295e+09	false

Gateway.spec.workloadSelector

↩ Parent

Name	Type	Description	Required
labels	map[string]string		false
namespace	string	The namespace where the workload resides.	false

EgressGateway

↩ Parent

Name	Type	Description	Required
apiVersion	string	gateway.tsb.tetrate.io/v2	true
kind	string	EgressGateway	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the metadata field.	true
spec	object	EgressGateway configures a workload to act as an egress gateway in the mesh.	false
status	object		false

EgressGateway.spec

↩ Parent

EgressGateway configures a workload to act as an egress gateway in the mesh.

Name	Type	Description	Required
authorization	[]object	The description of which service accounts can access which hosts.	false
configGenerationMetadata	object	Metadata values that will be add into the Istio generated configurations.	false
description	string	A description of the resource.	false
displayName	string	User friendly name for the resource.	false
etag	string	The etag for the resource.	false
extension	[]object		false
fqn	string	Fully-qualified name of the resource.	false
workloadSelector	object		false

EgressGateway.spec.authorization[index]

↩ Parent

Name	Type	Description	Required
from	object	The workloads or service accounts this authorization rule applies to.	false
to	[]string	The external hostnames the workload(s) described in this rule can access.	false

EgressGateway.spec.authorization[index].from

↩ Parent

The workloads or service accounts this authorization rule applies to.

Name	Type	Description	Required
http	object	This is for configuring HTTP request authorization.	false
mode	enum	A short cut for specifying the set of allowed callers. Enum: UNSET, NAMESPACE, GROUP, WORKSPACE, CLUSTER, DISABLED, CUSTOM, RULES	false
rules	object		false
serviceAccounts	[]string		false

EgressGateway.spec.authorization[index].from.http

↩ Parent

This is for configuring HTTP request authorization.

Name	Type	Description	Required
external	object		false
local	object		false

EgressGateway.spec.authorization[index].from.http.external

↩ Parent

Name	Type	Description	Required
includeRequestHeaders	[]string		false
tls	object		false
uri	string		false

EgressGateway.spec.authorization[index].from.http.external.tls

↩ Parent

Name	Type	Description	Required
files	object	TLS key source from files.	false
mode	enum	Enum: DISABLED, SIMPLE, MUTUAL	false
secretName	string	TLS key source from a Kubernetes Secret.	false
subjectAltNames	[]string		false

EgressGateway.spec.authorization[index].from.http.external.tls.files

↩ Parent

TLS key source from files.

Name	Type	Description	Required
caCertificates	string		false
clientCertificate	string	Certificate file to authenticate the client.	false
privateKey	string	Private key file associated with the client certificate.	false

EgressGateway.spec.authorization[index].from.http.local

↩ Parent

Name	Type	Description	Required
rules	[]object		false

EgressGateway.spec.authorization[index].from.http.local.rules[index]

↩ Parent

Name	Type	Description	Required
from	[]object		false
name	string	A friendly name to identify the binding.	false
to	[]object		false

EgressGateway.spec.authorization[index].from.http.local.rules[index].from[index]

↩ Parent

Name	Type	Description	Required
jwt	object	JWT configuration to identity the subject.	false

EgressGateway.spec.authorization[index].from.http.local.rules[index].from[index].jwt

↩ Parent

JWT configuration to identity the subject.

Name	Type	Description	Required
iss	string		false
other	map[string]string	A set of arbitrary claims that are required to qualify the subject.	false
sub	string		false

EgressGateway.spec.authorization[index].from.http.local.rules[index].to[index]

↩ Parent

Name	Type	Description	Required
methods	[]string	The HTTP methods that are allowed by this rule.	false
paths	[]string	The request path where the request is made against.	false

EgressGateway.spec.authorization[index].from.rules

↩ Parent

Name	Type	Description	Required
allow	[]object	Allow specifies a list of rules.	false
deny	[]object	Deny specifies a list of rules.	false
denyAll	boolean	Deny all specifies whether all requests should be rejected.	false

EgressGateway.spec.authorization[index].from.rules.allow[index]

↩ Parent

Name	Type	Description	Required
from	object	From specifies the source of a request.	false
to	object	To specifies the destination of a request.	false

EgressGateway.spec.authorization[index].from.rules.allow[index].from

↩ Parent

From specifies the source of a request.

Name	Type	Description	Required
fqn	string	The target resource identified by FQN which will be the source of a request.	false

EgressGateway.spec.authorization[index].from.rules.allow[index].to

↩ Parent

To specifies the destination of a request.

Name	Type	Description	Required
fqn	string	The target resource identified by FQN which will be the destination of a request.	false

EgressGateway.spec.authorization[index].from.rules.deny[index]

↩ Parent

Name	Type	Description	Required
from	object	From specifies the source of a request.	false
to	object	To specifies the destination of a request.	false

EgressGateway.spec.authorization[index].from.rules.deny[index].from

↩ Parent

From specifies the source of a request.

Name	Type	Description	Required
fqn	string	The target resource identified by FQN which will be the source of a request.	false

EgressGateway.spec.authorization[index].from.rules.deny[index].to

↩ Parent

To specifies the destination of a request.

Name	Type	Description	Required
fqn	string	The target resource identified by FQN which will be the destination of a request.	false

EgressGateway.spec.configGenerationMetadata

↩ Parent

Metadata values that will be add into the Istio generated configurations.

Name	Type	Description	Required
annotations	map[string]string	Set of key value paris that will be added into the metadata.annotations field of the Istio generated configurations.	false
labels	map[string]string	Set of key value paris that will be added into the metadata.labels field of the Istio generated configurations.	false

EgressGateway.spec.extension[index]

↩ Parent

Name	Type	Description	Required
config	object	Configuration parameters sent to the WASM plugin execution.	false
fqn	string	Fqn of the extension to be executed.	false
match	[]object	Specifies the criteria to determine which traffic is passed to WasmExtension.	false

EgressGateway.spec.extension[index].match[index]

↩ Parent

Name	Type	Description	Required
mode	enum	Criteria for selecting traffic by their direction. Enum: UNDEFINED, CLIENT, SERVER, CLIENT_AND_SERVER	false
ports	[]object	Criteria for selecting traffic by their destination port.	false

EgressGateway.spec.extension[index].match[index].ports[index]

↩ Parent

Name	Type	Description	Required
number	integer	Minimum: 0 Maximum: 4.294967295e+09	false

EgressGateway.spec.workloadSelector

↩ Parent

Name	Type	Description	Required
labels	map[string]string		false
namespace	string	The namespace where the workload resides.	false