Tetrate Service BridgeVersion: 1.9.x

security.tsb.tetrate.io/v2

Resource Types:

Group
ServiceSecuritySetting
SecuritySetting

Group

^{^{↩ Parent}}

Name	Type	Description	Required
apiVersion	string	security.tsb.tetrate.io/v2	true
kind	string	Group	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the `metadata` field.	true
spec	object		false
status	object		false

Group.spec

^{^{↩ Parent}}

Name	Type	Description	Required
configGenerationMetadata	object	Default metadata values that will be propagated to the children Istio generated configurations.	false
configMode	enum	Enum: BRIDGED, DIRECT	false
deletionProtectionEnabled	boolean	When set, prevents the resource from being deleted.	false
description	string	A description of the resource.	false
displayName	string	User friendly name for the resource.	false
etag	string	The etag for the resource.	false
fqn	string	Fully-qualified name of the resource.	false
namespaceSelector	object	Set of namespaces owned exclusively by this group.	false
securityDomain	string	Security domains can be used to group different resources under the same security domain.	false

Group.spec.configGenerationMetadata

^{^{↩ Parent}}

Default metadata values that will be propagated to the children Istio generated configurations.

Name	Type	Description	Required
annotations	map[string]string	Set of key value paris that will be added into the `metadata.annotations` field of the Istio generated configurations.	false
labels	map[string]string	Set of key value paris that will be added into the `metadata.labels` field of the Istio generated configurations.	false

Group.spec.namespaceSelector

^{^{↩ Parent}}

Set of namespaces owned exclusively by this group.

Name	Type	Description	Required
names	[]string		false

ServiceSecuritySetting

^{^{↩ Parent}}

Name	Type	Description	Required
apiVersion	string	security.tsb.tetrate.io/v2	true
kind	string	ServiceSecuritySetting	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the `metadata` field.	true
spec	object		false
status	object		false

ServiceSecuritySetting.spec

^{^{↩ Parent}}

Name	Type	Description	Required
configGenerationMetadata	object	Metadata values that will be add into the Istio generated configurations.	false
description	string	A description of the resource.	false
displayName	string	User friendly name for the resource.	false
etag	string	The etag for the resource.	false
fqn	string	Fully-qualified name of the resource.	false
service	string	The service on which the configuration is being applied.	false
settings	object	Security settings to apply to this service.	false
subsets	[]object		false

ServiceSecuritySetting.spec.configGenerationMetadata

^{^{↩ Parent}}

Metadata values that will be add into the Istio generated configurations.

Name	Type	Description	Required
annotations	map[string]string	Set of key value paris that will be added into the `metadata.annotations` field of the Istio generated configurations.	false
labels	map[string]string	Set of key value paris that will be added into the `metadata.labels` field of the Istio generated configurations.	false

ServiceSecuritySetting.spec.settings

^{^{↩ Parent}}

Security settings to apply to this service.

Name	Type	Description	Required
authentication	enum	Enum: UNSET, OPTIONAL, REQUIRED	false
authenticationSettings	object		false
authorization	object		false
configGenerationMetadata	object	Metadata values that will be add into the Istio generated configurations.	false
description	string	A description of the resource.	false
displayName	string	User friendly name for the resource.	false
etag	string	The etag for the resource.	false
extension	[]object		false
fqn	string	Fully-qualified name of the resource.	false
propagationStrategy	enum	Enum: REPLACE, STRICTER	false
waf	object	NOTICE: this feature is in alpha stage and under active development.	false

ServiceSecuritySetting.spec.settings.authenticationSettings

^{^{↩ Parent}}

Name	Type	Description	Required
http	object		false
trafficMode	enum	Enum: UNSET, OPTIONAL, REQUIRED	false

ServiceSecuritySetting.spec.settings.authenticationSettings.http

^{^{↩ Parent}}

Name	Type	Description	Required
jwt	object	Authenticate an HTTP request from a JWT Token attached to it.	false
oidc	object		false
rules	object	List of rules how to authenticate an HTTP request.	false

ServiceSecuritySetting.spec.settings.authenticationSettings.http.jwt

^{^{↩ Parent}}

Authenticate an HTTP request from a JWT Token attached to it.

Name	Type	Description	Required
audiences	[]string		false
fromHeaders	[]object	This field specifies the locations to extract JWT token.	false
issuer	string	Identifies the issuer that issued the JWT.	false
jwks	string	JSON Web Key Set of public keys to validate signature of the JWT.	false
jwksUri	string		false
outputClaimToHeaders	[]object	This field specifies a list of operations to copy the claim to HTTP headers on a successfully verified token.	false
outputPayloadToHeader	string		false

ServiceSecuritySetting.spec.settings.authenticationSettings.http.jwt.fromHeaders[index]

^{^{↩ Parent}}

Name	Type	Description	Required
name	string	The HTTP header name.	false
prefix	string	The prefix that should be stripped before decoding the token.	false

ServiceSecuritySetting.spec.settings.authenticationSettings.http.jwt.outputClaimToHeaders[index]

^{^{↩ Parent}}

Name	Type	Description	Required
claim	string	The name of the claim to be copied from.	false
header	string	The name of the header to be created.	false

ServiceSecuritySetting.spec.settings.authenticationSettings.http.oidc

^{^{↩ Parent}}

Name	Type	Description	Required
authScopes	[]string	Optional list of OAuth scopes to be claimed in the authorization request.	false
authType	enum	Defines how client_id and client_secret are sent in OAuth client to OAuth server requests. Enum: DEFAULT_AUTH_TYPE, URL_ENCODED_BODY, BASIC_AUTH	false
clientId	string	The client_id to be used in the authorize calls.	false
clientTokenSecret	string	The name of the Kubernetes secret containing the client secret.	false
grantType	enum	Enum: DEFAULT_GRANT_TYPE, AUTHORIZATION_CODE	false
provider	object	The OIDC Provider configuration.	false
redirectPathMatcher	string		false
redirectUri	string		false
signoutPath	string	The path to sign a user out, clearing their credential cookies.	false

ServiceSecuritySetting.spec.settings.authenticationSettings.http.oidc.provider

^{^{↩ Parent}}

The OIDC Provider configuration.

Name	Type	Description	Required
authorizationEndpoint	string	The OIDC Provider's authorization endpoint.	false
issuer	string	The OIDC Provider's issuer identifier.	false
jwks	string	JSON string with the OIDC provider's JSON Web Key Sets.	false
jwksUri	string	URI for the OIDC provider's JSON Web Key Sets.	false
tokenEndpoint	string	The OIDC Provider's token endpoint.	false

ServiceSecuritySetting.spec.settings.authenticationSettings.http.rules

^{^{↩ Parent}}

List of rules how to authenticate an HTTP request.

Name	Type	Description	Required
jwt	[]object	List of rules how to authenticate an HTTP request from a JWT Token attached to it.	false

ServiceSecuritySetting.spec.settings.authenticationSettings.http.rules.jwt[index]

^{^{↩ Parent}}

Name	Type	Description	Required
audiences	[]string		false
fromHeaders	[]object	This field specifies the locations to extract JWT token.	false
issuer	string	Identifies the issuer that issued the JWT.	false
jwks	string	JSON Web Key Set of public keys to validate signature of the JWT.	false
jwksUri	string		false
outputClaimToHeaders	[]object	This field specifies a list of operations to copy the claim to HTTP headers on a successfully verified token.	false
outputPayloadToHeader	string		false

ServiceSecuritySetting.spec.settings.authenticationSettings.http.rules.jwt[index].fromHeaders[index]

^{^{↩ Parent}}

Name	Type	Description	Required
name	string	The HTTP header name.	false
prefix	string	The prefix that should be stripped before decoding the token.	false

ServiceSecuritySetting.spec.settings.authenticationSettings.http.rules.jwt[index].outputClaimToHeaders[index]

^{^{↩ Parent}}

Name	Type	Description	Required
claim	string	The name of the claim to be copied from.	false
header	string	The name of the header to be created.	false

ServiceSecuritySetting.spec.settings.authorization

^{^{↩ Parent}}

Name	Type	Description	Required
http	object	This is for configuring HTTP request authorization.	false
identityMatch	enum	Enum: UNKNOWN, PEER_CERTIFICATE, PERMISSIVE, SOURCE_IDENTITY	false
mode	enum	A short cut for specifying the set of allowed callers. Enum: UNSET, NAMESPACE, GROUP, WORKSPACE, CLUSTER, DISABLED, CUSTOM, RULES	false
rules	object		false
serviceAccounts	[]string		false

ServiceSecuritySetting.spec.settings.authorization.http

^{^{↩ Parent}}

This is for configuring HTTP request authorization.

Name	Type	Description	Required
external	object		false
local	object		false

ServiceSecuritySetting.spec.settings.authorization.http.external

^{^{↩ Parent}}

Name	Type	Required
includeRequestHeaders	[]string	false
tls	object	false
uri	string	false

ServiceSecuritySetting.spec.settings.authorization.http.external.tls

^{^{↩ Parent}}

Name	Type	Description	Required
files	object	TLS key source from files.	false
mode	enum	Enum: DISABLED, SIMPLE, MUTUAL	false
secretName	string	TLS key source from a Kubernetes Secret.	false
subjectAltNames	[]string		false

ServiceSecuritySetting.spec.settings.authorization.http.external.tls.files

^{^{↩ Parent}}

TLS key source from files.

Name	Type	Description	Required
caCertificates	string		false
clientCertificate	string	Certificate file to authenticate the client.	false
privateKey	string	Private key file associated with the client certificate.	false

ServiceSecuritySetting.spec.settings.authorization.http.local

^{^{↩ Parent}}

Name	Type	Description	Required
rules	[]object		false

ServiceSecuritySetting.spec.settings.authorization.http.local.rules[index]

^{^{↩ Parent}}

Name	Type	Description	Required
from	[]object		false
name	string	A friendly name to identify the binding.	false
to	[]object		false

ServiceSecuritySetting.spec.settings.authorization.http.local.rules[index].from[index]

^{^{↩ Parent}}

Name	Type	Description	Required
jwt	object	JWT configuration to identity the subject.	false

ServiceSecuritySetting.spec.settings.authorization.http.local.rules[index].from[index].jwt

^{^{↩ Parent}}

JWT configuration to identity the subject.

Name	Type	Description	Required
iss	string		false
other	map[string]string	A set of arbitrary claims that are required to qualify the subject.	false
sub	string		false

ServiceSecuritySetting.spec.settings.authorization.http.local.rules[index].to[index]

^{^{↩ Parent}}

Name	Type	Description	Required
methods	[]string	The HTTP methods that are allowed by this rule.	false
paths	[]string	The request path where the request is made against.	false

ServiceSecuritySetting.spec.settings.authorization.rules

^{^{↩ Parent}}

Name	Type	Description	Required
allow	[]object	Allow specifies a list of rules.	false
deny	[]object	Deny specifies a list of rules.	false
denyAll	boolean	Deny all specifies whether all requests should be rejected.	false

ServiceSecuritySetting.spec.settings.authorization.rules.allow[index]

^{^{↩ Parent}}

Name	Type	Description	Required
from	object	From specifies the source of a request.	false
to	object	To specifies the destination of a request.	false

ServiceSecuritySetting.spec.settings.authorization.rules.allow[index].from

^{^{↩ Parent}}

From specifies the source of a request.

Name	Type	Description	Required
fqn	string	The target resource identified by FQN which will be the source of a request.	false

ServiceSecuritySetting.spec.settings.authorization.rules.allow[index].to

^{^{↩ Parent}}

To specifies the destination of a request.

Name	Type	Description	Required
fqn	string	The target resource identified by FQN which will be the destination of a request.	false

ServiceSecuritySetting.spec.settings.authorization.rules.deny[index]

^{^{↩ Parent}}

Name	Type	Description	Required
from	object	From specifies the source of a request.	false
to	object	To specifies the destination of a request.	false

ServiceSecuritySetting.spec.settings.authorization.rules.deny[index].from

^{^{↩ Parent}}

From specifies the source of a request.

Name	Type	Description	Required
fqn	string	The target resource identified by FQN which will be the source of a request.	false

ServiceSecuritySetting.spec.settings.authorization.rules.deny[index].to

^{^{↩ Parent}}

To specifies the destination of a request.

Name	Type	Description	Required
fqn	string	The target resource identified by FQN which will be the destination of a request.	false

ServiceSecuritySetting.spec.settings.configGenerationMetadata

^{^{↩ Parent}}

Metadata values that will be add into the Istio generated configurations.

Name	Type	Description	Required
annotations	map[string]string	Set of key value paris that will be added into the `metadata.annotations` field of the Istio generated configurations.	false
labels	map[string]string	Set of key value paris that will be added into the `metadata.labels` field of the Istio generated configurations.	false

ServiceSecuritySetting.spec.settings.extension[index]

^{^{↩ Parent}}

Name	Type	Description	Required
config	object	Configuration parameters sent to the WASM plugin execution.	false
fqn	string	Fqn of the extension to be executed.	false
match	[]object	Specifies the criteria to determine which traffic is passed to WasmExtension.	false

ServiceSecuritySetting.spec.settings.extension[index].match[index]

^{^{↩ Parent}}

Name	Type	Description	Required
mode	enum	Criteria for selecting traffic by their direction. Enum: UNDEFINED, CLIENT, SERVER, CLIENT_AND_SERVER	false
ports	[]object	Criteria for selecting traffic by their destination port.	false

Name

Type

Description

Required

mode

enum

Criteria for selecting traffic by their direction.

Enum: UNDEFINED, CLIENT, SERVER, CLIENT_AND_SERVER

false

ports

[]object

Criteria for selecting traffic by their destination port.

false

ServiceSecuritySetting.spec.settings.extension[index].match[index].ports[index]

^{^{↩ Parent}}

Name	Type	Description	Required
number	integer	Minimum: 0 Maximum: 4.294967295e+09	false

ServiceSecuritySetting.spec.settings.waf

^{^{↩ Parent}}

NOTICE: this feature is in alpha stage and under active development.

Name	Type	Description	Required
rules	[]string	Rules to be leveraged by WAF.	false

ServiceSecuritySetting.spec.subsets[index]

^{^{↩ Parent}}

Name	Type	Description	Required
name	string	Name used to refer to the subset.	false
settings	object	Security settings to apply to this service subset.	false

ServiceSecuritySetting.spec.subsets[index].settings

^{^{↩ Parent}}

Security settings to apply to this service subset.

Name	Type	Description	Required
authentication	enum	Enum: UNSET, OPTIONAL, REQUIRED	false
authenticationSettings	object		false
authorization	object		false
configGenerationMetadata	object	Metadata values that will be add into the Istio generated configurations.	false
description	string	A description of the resource.	false
displayName	string	User friendly name for the resource.	false
etag	string	The etag for the resource.	false
extension	[]object		false
fqn	string	Fully-qualified name of the resource.	false
propagationStrategy	enum	Enum: REPLACE, STRICTER	false
waf	object	NOTICE: this feature is in alpha stage and under active development.	false

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings

^{^{↩ Parent}}

Name	Type	Description	Required
http	object		false
trafficMode	enum	Enum: UNSET, OPTIONAL, REQUIRED	false

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http

^{^{↩ Parent}}

Name	Type	Description	Required
jwt	object	Authenticate an HTTP request from a JWT Token attached to it.	false
oidc	object		false
rules	object	List of rules how to authenticate an HTTP request.	false

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http.jwt

^{^{↩ Parent}}

Authenticate an HTTP request from a JWT Token attached to it.

Name	Type	Description	Required
audiences	[]string		false
fromHeaders	[]object	This field specifies the locations to extract JWT token.	false
issuer	string	Identifies the issuer that issued the JWT.	false
jwks	string	JSON Web Key Set of public keys to validate signature of the JWT.	false
jwksUri	string		false
outputClaimToHeaders	[]object	This field specifies a list of operations to copy the claim to HTTP headers on a successfully verified token.	false
outputPayloadToHeader	string		false

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http.jwt.fromHeaders[index]

^{^{↩ Parent}}

Name	Type	Description	Required
name	string	The HTTP header name.	false
prefix	string	The prefix that should be stripped before decoding the token.	false

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http.jwt.outputClaimToHeaders[index]

^{^{↩ Parent}}

Name	Type	Description	Required
claim	string	The name of the claim to be copied from.	false
header	string	The name of the header to be created.	false

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http.oidc

^{^{↩ Parent}}

Name	Type	Description	Required
authScopes	[]string	Optional list of OAuth scopes to be claimed in the authorization request.	false
authType	enum	Defines how client_id and client_secret are sent in OAuth client to OAuth server requests. Enum: DEFAULT_AUTH_TYPE, URL_ENCODED_BODY, BASIC_AUTH	false
clientId	string	The client_id to be used in the authorize calls.	false
clientTokenSecret	string	The name of the Kubernetes secret containing the client secret.	false
grantType	enum	Enum: DEFAULT_GRANT_TYPE, AUTHORIZATION_CODE	false
provider	object	The OIDC Provider configuration.	false
redirectPathMatcher	string		false
redirectUri	string		false
signoutPath	string	The path to sign a user out, clearing their credential cookies.	false

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http.oidc.provider

^{^{↩ Parent}}

The OIDC Provider configuration.

Name	Type	Description	Required
authorizationEndpoint	string	The OIDC Provider's authorization endpoint.	false
issuer	string	The OIDC Provider's issuer identifier.	false
jwks	string	JSON string with the OIDC provider's JSON Web Key Sets.	false
jwksUri	string	URI for the OIDC provider's JSON Web Key Sets.	false
tokenEndpoint	string	The OIDC Provider's token endpoint.	false

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http.rules

^{^{↩ Parent}}

List of rules how to authenticate an HTTP request.

Name	Type	Description	Required
jwt	[]object	List of rules how to authenticate an HTTP request from a JWT Token attached to it.	false

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http.rules.jwt[index]

^{^{↩ Parent}}

Name	Type	Description	Required
audiences	[]string		false
fromHeaders	[]object	This field specifies the locations to extract JWT token.	false
issuer	string	Identifies the issuer that issued the JWT.	false
jwks	string	JSON Web Key Set of public keys to validate signature of the JWT.	false
jwksUri	string		false
outputClaimToHeaders	[]object	This field specifies a list of operations to copy the claim to HTTP headers on a successfully verified token.	false
outputPayloadToHeader	string		false

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http.rules.jwt[index].fromHeaders[index]

^{^{↩ Parent}}

Name	Type	Description	Required
name	string	The HTTP header name.	false
prefix	string	The prefix that should be stripped before decoding the token.	false

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http.rules.jwt[index].outputClaimToHeaders[index]

^{^{↩ Parent}}

Name	Type	Description	Required
claim	string	The name of the claim to be copied from.	false
header	string	The name of the header to be created.	false

ServiceSecuritySetting.spec.subsets[index].settings.authorization

^{^{↩ Parent}}

Name	Type	Description	Required
http	object	This is for configuring HTTP request authorization.	false
identityMatch	enum	Enum: UNKNOWN, PEER_CERTIFICATE, PERMISSIVE, SOURCE_IDENTITY	false
mode	enum	A short cut for specifying the set of allowed callers. Enum: UNSET, NAMESPACE, GROUP, WORKSPACE, CLUSTER, DISABLED, CUSTOM, RULES	false
rules	object		false
serviceAccounts	[]string		false

ServiceSecuritySetting.spec.subsets[index].settings.authorization.http

^{^{↩ Parent}}

This is for configuring HTTP request authorization.

Name	Type	Description	Required
external	object		false
local	object		false

ServiceSecuritySetting.spec.subsets[index].settings.authorization.http.external

^{^{↩ Parent}}

Name	Type	Required
includeRequestHeaders	[]string	false
tls	object	false
uri	string	false

ServiceSecuritySetting.spec.subsets[index].settings.authorization.http.external.tls

^{^{↩ Parent}}

Name	Type	Description	Required
files	object	TLS key source from files.	false
mode	enum	Enum: DISABLED, SIMPLE, MUTUAL	false
secretName	string	TLS key source from a Kubernetes Secret.	false
subjectAltNames	[]string		false

ServiceSecuritySetting.spec.subsets[index].settings.authorization.http.external.tls.files

^{^{↩ Parent}}

TLS key source from files.

Name	Type	Description	Required
caCertificates	string		false
clientCertificate	string	Certificate file to authenticate the client.	false
privateKey	string	Private key file associated with the client certificate.	false

ServiceSecuritySetting.spec.subsets[index].settings.authorization.http.local

^{^{↩ Parent}}

Name	Type	Description	Required
rules	[]object		false

ServiceSecuritySetting.spec.subsets[index].settings.authorization.http.local.rules[index]

^{^{↩ Parent}}

Name	Type	Description	Required
from	[]object		false
name	string	A friendly name to identify the binding.	false
to	[]object		false

ServiceSecuritySetting.spec.subsets[index].settings.authorization.http.local.rules[index].from[index]

^{^{↩ Parent}}

Name	Type	Description	Required
jwt	object	JWT configuration to identity the subject.	false

ServiceSecuritySetting.spec.subsets[index].settings.authorization.http.local.rules[index].from[index].jwt

^{^{↩ Parent}}

JWT configuration to identity the subject.

Name	Type	Description	Required
iss	string		false
other	map[string]string	A set of arbitrary claims that are required to qualify the subject.	false
sub	string		false

ServiceSecuritySetting.spec.subsets[index].settings.authorization.http.local.rules[index].to[index]

^{^{↩ Parent}}

Name	Type	Description	Required
methods	[]string	The HTTP methods that are allowed by this rule.	false
paths	[]string	The request path where the request is made against.	false

ServiceSecuritySetting.spec.subsets[index].settings.authorization.rules

^{^{↩ Parent}}

Name	Type	Description	Required
allow	[]object	Allow specifies a list of rules.	false
deny	[]object	Deny specifies a list of rules.	false
denyAll	boolean	Deny all specifies whether all requests should be rejected.	false

ServiceSecuritySetting.spec.subsets[index].settings.authorization.rules.allow[index]

^{^{↩ Parent}}

Name	Type	Description	Required
from	object	From specifies the source of a request.	false
to	object	To specifies the destination of a request.	false

ServiceSecuritySetting.spec.subsets[index].settings.authorization.rules.allow[index].from

^{^{↩ Parent}}

From specifies the source of a request.

Name	Type	Description	Required
fqn	string	The target resource identified by FQN which will be the source of a request.	false

ServiceSecuritySetting.spec.subsets[index].settings.authorization.rules.allow[index].to

^{^{↩ Parent}}

To specifies the destination of a request.

Name	Type	Description	Required
fqn	string	The target resource identified by FQN which will be the destination of a request.	false

ServiceSecuritySetting.spec.subsets[index].settings.authorization.rules.deny[index]

^{^{↩ Parent}}

Name	Type	Description	Required
from	object	From specifies the source of a request.	false
to	object	To specifies the destination of a request.	false

ServiceSecuritySetting.spec.subsets[index].settings.authorization.rules.deny[index].from

^{^{↩ Parent}}

From specifies the source of a request.

Name	Type	Description	Required
fqn	string	The target resource identified by FQN which will be the source of a request.	false

ServiceSecuritySetting.spec.subsets[index].settings.authorization.rules.deny[index].to

^{^{↩ Parent}}

To specifies the destination of a request.

Name	Type	Description	Required
fqn	string	The target resource identified by FQN which will be the destination of a request.	false

ServiceSecuritySetting.spec.subsets[index].settings.configGenerationMetadata

^{^{↩ Parent}}

Metadata values that will be add into the Istio generated configurations.

Name	Type	Description	Required
annotations	map[string]string	Set of key value paris that will be added into the `metadata.annotations` field of the Istio generated configurations.	false
labels	map[string]string	Set of key value paris that will be added into the `metadata.labels` field of the Istio generated configurations.	false

ServiceSecuritySetting.spec.subsets[index].settings.extension[index]

^{^{↩ Parent}}

Name	Type	Description	Required
config	object	Configuration parameters sent to the WASM plugin execution.	false
fqn	string	Fqn of the extension to be executed.	false
match	[]object	Specifies the criteria to determine which traffic is passed to WasmExtension.	false

ServiceSecuritySetting.spec.subsets[index].settings.extension[index].match[index]

^{^{↩ Parent}}

Name

Type

Description

Required

mode

enum

Criteria for selecting traffic by their direction.

Enum: UNDEFINED, CLIENT, SERVER, CLIENT_AND_SERVER

false

ports

[]object

Criteria for selecting traffic by their destination port.

false

ServiceSecuritySetting.spec.subsets[index].settings.extension[index].match[index].ports[index]

^{^{↩ Parent}}

Name	Type	Description	Required
number	integer	Minimum: 0 Maximum: 4.294967295e+09	false

ServiceSecuritySetting.spec.subsets[index].settings.waf

^{^{↩ Parent}}

NOTICE: this feature is in alpha stage and under active development.

Name	Type	Description	Required
rules	[]string	Rules to be leveraged by WAF.	false

SecuritySetting

^{^{↩ Parent}}

Name	Type	Description	Required
apiVersion	string	security.tsb.tetrate.io/v2	true
kind	string	SecuritySetting	true
metadata	object	Refer to the Kubernetes API documentation for the fields of the `metadata` field.	true
spec	object		false
status	object		false

SecuritySetting.spec

^{^{↩ Parent}}

Name	Type	Description	Required
authentication	enum	Enum: UNSET, OPTIONAL, REQUIRED	false
authenticationSettings	object		false
authorization	object		false
configGenerationMetadata	object	Metadata values that will be add into the Istio generated configurations.	false
description	string	A description of the resource.	false
displayName	string	User friendly name for the resource.	false
etag	string	The etag for the resource.	false
extension	[]object		false
fqn	string	Fully-qualified name of the resource.	false
propagationStrategy	enum	Enum: REPLACE, STRICTER	false
waf	object	NOTICE: this feature is in alpha stage and under active development.	false

SecuritySetting.spec.authenticationSettings

^{^{↩ Parent}}

Name	Type	Description	Required
http	object		false
trafficMode	enum	Enum: UNSET, OPTIONAL, REQUIRED	false

SecuritySetting.spec.authenticationSettings.http

^{^{↩ Parent}}

Name	Type	Description	Required
jwt	object	Authenticate an HTTP request from a JWT Token attached to it.	false
oidc	object		false
rules	object	List of rules how to authenticate an HTTP request.	false

SecuritySetting.spec.authenticationSettings.http.jwt

^{^{↩ Parent}}

Authenticate an HTTP request from a JWT Token attached to it.

Name	Type	Description	Required
audiences	[]string		false
fromHeaders	[]object	This field specifies the locations to extract JWT token.	false
issuer	string	Identifies the issuer that issued the JWT.	false
jwks	string	JSON Web Key Set of public keys to validate signature of the JWT.	false
jwksUri	string		false
outputClaimToHeaders	[]object	This field specifies a list of operations to copy the claim to HTTP headers on a successfully verified token.	false
outputPayloadToHeader	string		false

SecuritySetting.spec.authenticationSettings.http.jwt.fromHeaders[index]

^{^{↩ Parent}}

Name	Type	Description	Required
name	string	The HTTP header name.	false
prefix	string	The prefix that should be stripped before decoding the token.	false

SecuritySetting.spec.authenticationSettings.http.jwt.outputClaimToHeaders[index]

^{^{↩ Parent}}

Name	Type	Description	Required
claim	string	The name of the claim to be copied from.	false
header	string	The name of the header to be created.	false

SecuritySetting.spec.authenticationSettings.http.oidc

^{^{↩ Parent}}

Name	Type	Description	Required
authScopes	[]string	Optional list of OAuth scopes to be claimed in the authorization request.	false
authType	enum	Defines how client_id and client_secret are sent in OAuth client to OAuth server requests. Enum: DEFAULT_AUTH_TYPE, URL_ENCODED_BODY, BASIC_AUTH	false
clientId	string	The client_id to be used in the authorize calls.	false
clientTokenSecret	string	The name of the Kubernetes secret containing the client secret.	false
grantType	enum	Enum: DEFAULT_GRANT_TYPE, AUTHORIZATION_CODE	false
provider	object	The OIDC Provider configuration.	false
redirectPathMatcher	string		false
redirectUri	string		false
signoutPath	string	The path to sign a user out, clearing their credential cookies.	false

SecuritySetting.spec.authenticationSettings.http.oidc.provider

^{^{↩ Parent}}

The OIDC Provider configuration.

Name	Type	Description	Required
authorizationEndpoint	string	The OIDC Provider's authorization endpoint.	false
issuer	string	The OIDC Provider's issuer identifier.	false
jwks	string	JSON string with the OIDC provider's JSON Web Key Sets.	false
jwksUri	string	URI for the OIDC provider's JSON Web Key Sets.	false
tokenEndpoint	string	The OIDC Provider's token endpoint.	false

SecuritySetting.spec.authenticationSettings.http.rules

^{^{↩ Parent}}

List of rules how to authenticate an HTTP request.

Name	Type	Description	Required
jwt	[]object	List of rules how to authenticate an HTTP request from a JWT Token attached to it.	false

SecuritySetting.spec.authenticationSettings.http.rules.jwt[index]

^{^{↩ Parent}}

Name	Type	Description	Required
audiences	[]string		false
fromHeaders	[]object	This field specifies the locations to extract JWT token.	false
issuer	string	Identifies the issuer that issued the JWT.	false
jwks	string	JSON Web Key Set of public keys to validate signature of the JWT.	false
jwksUri	string		false
outputClaimToHeaders	[]object	This field specifies a list of operations to copy the claim to HTTP headers on a successfully verified token.	false
outputPayloadToHeader	string		false

SecuritySetting.spec.authenticationSettings.http.rules.jwt[index].fromHeaders[index]

^{^{↩ Parent}}

Name	Type	Description	Required
name	string	The HTTP header name.	false
prefix	string	The prefix that should be stripped before decoding the token.	false

SecuritySetting.spec.authenticationSettings.http.rules.jwt[index].outputClaimToHeaders[index]

^{^{↩ Parent}}

Name	Type	Description	Required
claim	string	The name of the claim to be copied from.	false
header	string	The name of the header to be created.	false

SecuritySetting.spec.authorization

^{^{↩ Parent}}

Name	Type	Description	Required
http	object	This is for configuring HTTP request authorization.	false
identityMatch	enum	Enum: UNKNOWN, PEER_CERTIFICATE, PERMISSIVE, SOURCE_IDENTITY	false
mode	enum	A short cut for specifying the set of allowed callers. Enum: UNSET, NAMESPACE, GROUP, WORKSPACE, CLUSTER, DISABLED, CUSTOM, RULES	false
rules	object		false
serviceAccounts	[]string		false

SecuritySetting.spec.authorization.http

^{^{↩ Parent}}

This is for configuring HTTP request authorization.

Name	Type	Description	Required
external	object		false
local	object		false

SecuritySetting.spec.authorization.http.external

^{^{↩ Parent}}

Name	Type	Required
includeRequestHeaders	[]string	false
tls	object	false
uri	string	false

SecuritySetting.spec.authorization.http.external.tls

^{^{↩ Parent}}

Name	Type	Description	Required
files	object	TLS key source from files.	false
mode	enum	Enum: DISABLED, SIMPLE, MUTUAL	false
secretName	string	TLS key source from a Kubernetes Secret.	false
subjectAltNames	[]string		false

SecuritySetting.spec.authorization.http.external.tls.files

^{^{↩ Parent}}

TLS key source from files.

Name	Type	Description	Required
caCertificates	string		false
clientCertificate	string	Certificate file to authenticate the client.	false
privateKey	string	Private key file associated with the client certificate.	false

SecuritySetting.spec.authorization.http.local

^{^{↩ Parent}}

Name	Type	Description	Required
rules	[]object		false

SecuritySetting.spec.authorization.http.local.rules[index]

^{^{↩ Parent}}

Name	Type	Description	Required
from	[]object		false
name	string	A friendly name to identify the binding.	false
to	[]object		false

SecuritySetting.spec.authorization.http.local.rules[index].from[index]

^{^{↩ Parent}}

Name	Type	Description	Required
jwt	object	JWT configuration to identity the subject.	false

SecuritySetting.spec.authorization.http.local.rules[index].from[index].jwt

^{^{↩ Parent}}

JWT configuration to identity the subject.

Name	Type	Description	Required
iss	string		false
other	map[string]string	A set of arbitrary claims that are required to qualify the subject.	false
sub	string		false

SecuritySetting.spec.authorization.http.local.rules[index].to[index]

^{^{↩ Parent}}

Name	Type	Description	Required
methods	[]string	The HTTP methods that are allowed by this rule.	false
paths	[]string	The request path where the request is made against.	false

SecuritySetting.spec.authorization.rules

^{^{↩ Parent}}

Name	Type	Description	Required
allow	[]object	Allow specifies a list of rules.	false
deny	[]object	Deny specifies a list of rules.	false
denyAll	boolean	Deny all specifies whether all requests should be rejected.	false

SecuritySetting.spec.authorization.rules.allow[index]

^{^{↩ Parent}}

Name	Type	Description	Required
from	object	From specifies the source of a request.	false
to	object	To specifies the destination of a request.	false

SecuritySetting.spec.authorization.rules.allow[index].from

^{^{↩ Parent}}

From specifies the source of a request.

Name	Type	Description	Required
fqn	string	The target resource identified by FQN which will be the source of a request.	false

SecuritySetting.spec.authorization.rules.allow[index].to

^{^{↩ Parent}}

To specifies the destination of a request.

Name	Type	Description	Required
fqn	string	The target resource identified by FQN which will be the destination of a request.	false

SecuritySetting.spec.authorization.rules.deny[index]

^{^{↩ Parent}}

Name	Type	Description	Required
from	object	From specifies the source of a request.	false
to	object	To specifies the destination of a request.	false

SecuritySetting.spec.authorization.rules.deny[index].from

^{^{↩ Parent}}

From specifies the source of a request.

Name	Type	Description	Required
fqn	string	The target resource identified by FQN which will be the source of a request.	false

SecuritySetting.spec.authorization.rules.deny[index].to

^{^{↩ Parent}}

To specifies the destination of a request.

Name	Type	Description	Required
fqn	string	The target resource identified by FQN which will be the destination of a request.	false

SecuritySetting.spec.configGenerationMetadata

^{^{↩ Parent}}

Metadata values that will be add into the Istio generated configurations.

Name	Type	Description	Required
annotations	map[string]string	Set of key value paris that will be added into the `metadata.annotations` field of the Istio generated configurations.	false
labels	map[string]string	Set of key value paris that will be added into the `metadata.labels` field of the Istio generated configurations.	false

SecuritySetting.spec.extension[index]

^{^{↩ Parent}}

Name	Type	Description	Required
config	object	Configuration parameters sent to the WASM plugin execution.	false
fqn	string	Fqn of the extension to be executed.	false
match	[]object	Specifies the criteria to determine which traffic is passed to WasmExtension.	false

SecuritySetting.spec.extension[index].match[index]

^{^{↩ Parent}}

Name

Type

Description

Required

mode

enum

Criteria for selecting traffic by their direction.

Enum: UNDEFINED, CLIENT, SERVER, CLIENT_AND_SERVER

false

ports

[]object

Criteria for selecting traffic by their destination port.

false

SecuritySetting.spec.extension[index].match[index].ports[index]

^{^{↩ Parent}}

Name	Type	Description	Required
number	integer	Minimum: 0 Maximum: 4.294967295e+09	false

SecuritySetting.spec.waf

^{^{↩ Parent}}

NOTICE: this feature is in alpha stage and under active development.

Name	Type	Description	Required
rules	[]string	Rules to be leveraged by WAF.	false

security.tsb.tetrate.io/v2

Group​

Group.spec​

Group.spec.configGenerationMetadata​

Group.spec.namespaceSelector​

ServiceSecuritySetting​

ServiceSecuritySetting.spec​

ServiceSecuritySetting.spec.configGenerationMetadata​

ServiceSecuritySetting.spec.settings​

ServiceSecuritySetting.spec.settings.authenticationSettings​

ServiceSecuritySetting.spec.settings.authenticationSettings.http​

ServiceSecuritySetting.spec.settings.authenticationSettings.http.jwt​

ServiceSecuritySetting.spec.settings.authenticationSettings.http.jwt.fromHeaders[index]​

ServiceSecuritySetting.spec.settings.authenticationSettings.http.jwt.outputClaimToHeaders[index]​

ServiceSecuritySetting.spec.settings.authenticationSettings.http.oidc​

ServiceSecuritySetting.spec.settings.authenticationSettings.http.oidc.provider​

ServiceSecuritySetting.spec.settings.authenticationSettings.http.rules​

ServiceSecuritySetting.spec.settings.authenticationSettings.http.rules.jwt[index]​

ServiceSecuritySetting.spec.settings.authenticationSettings.http.rules.jwt[index].fromHeaders[index]​

ServiceSecuritySetting.spec.settings.authenticationSettings.http.rules.jwt[index].outputClaimToHeaders[index]​

ServiceSecuritySetting.spec.settings.authorization​

ServiceSecuritySetting.spec.settings.authorization.http​

ServiceSecuritySetting.spec.settings.authorization.http.external​

ServiceSecuritySetting.spec.settings.authorization.http.external.tls​

ServiceSecuritySetting.spec.settings.authorization.http.external.tls.files​

ServiceSecuritySetting.spec.settings.authorization.http.local​

ServiceSecuritySetting.spec.settings.authorization.http.local.rules[index]​

ServiceSecuritySetting.spec.settings.authorization.http.local.rules[index].from[index]​

ServiceSecuritySetting.spec.settings.authorization.http.local.rules[index].from[index].jwt​

ServiceSecuritySetting.spec.settings.authorization.http.local.rules[index].to[index]​

ServiceSecuritySetting.spec.settings.authorization.rules​

ServiceSecuritySetting.spec.settings.authorization.rules.allow[index]​

ServiceSecuritySetting.spec.settings.authorization.rules.allow[index].from​

ServiceSecuritySetting.spec.settings.authorization.rules.allow[index].to​

ServiceSecuritySetting.spec.settings.authorization.rules.deny[index]​

ServiceSecuritySetting.spec.settings.authorization.rules.deny[index].from​

ServiceSecuritySetting.spec.settings.authorization.rules.deny[index].to​

ServiceSecuritySetting.spec.settings.configGenerationMetadata​

ServiceSecuritySetting.spec.settings.extension[index]​

ServiceSecuritySetting.spec.settings.extension[index].match[index]​

ServiceSecuritySetting.spec.settings.extension[index].match[index].ports[index]​

ServiceSecuritySetting.spec.settings.waf​

ServiceSecuritySetting.spec.subsets[index]​

ServiceSecuritySetting.spec.subsets[index].settings​

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings​

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http​

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http.jwt​

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http.jwt.fromHeaders[index]​

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http.jwt.outputClaimToHeaders[index]​

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http.oidc​

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http.oidc.provider​

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http.rules​

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http.rules.jwt[index]​

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http.rules.jwt[index].fromHeaders[index]​

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http.rules.jwt[index].outputClaimToHeaders[index]​

ServiceSecuritySetting.spec.subsets[index].settings.authorization​

ServiceSecuritySetting.spec.subsets[index].settings.authorization.http​

ServiceSecuritySetting.spec.subsets[index].settings.authorization.http.external​

ServiceSecuritySetting.spec.subsets[index].settings.authorization.http.external.tls​

ServiceSecuritySetting.spec.subsets[index].settings.authorization.http.external.tls.files​

ServiceSecuritySetting.spec.subsets[index].settings.authorization.http.local​

ServiceSecuritySetting.spec.subsets[index].settings.authorization.http.local.rules[index]​

ServiceSecuritySetting.spec.subsets[index].settings.authorization.http.local.rules[index].from[index]​

ServiceSecuritySetting.spec.subsets[index].settings.authorization.http.local.rules[index].from[index].jwt​

ServiceSecuritySetting.spec.subsets[index].settings.authorization.http.local.rules[index].to[index]​

ServiceSecuritySetting.spec.subsets[index].settings.authorization.rules​

ServiceSecuritySetting.spec.subsets[index].settings.authorization.rules.allow[index]​

ServiceSecuritySetting.spec.subsets[index].settings.authorization.rules.allow[index].from​

ServiceSecuritySetting.spec.subsets[index].settings.authorization.rules.allow[index].to​

ServiceSecuritySetting.spec.subsets[index].settings.authorization.rules.deny[index]​

ServiceSecuritySetting.spec.subsets[index].settings.authorization.rules.deny[index].from​

ServiceSecuritySetting.spec.subsets[index].settings.authorization.rules.deny[index].to​

ServiceSecuritySetting.spec.subsets[index].settings.configGenerationMetadata​

ServiceSecuritySetting.spec.subsets[index].settings.extension[index]​

ServiceSecuritySetting.spec.subsets[index].settings.extension[index].match[index]​

ServiceSecuritySetting.spec.subsets[index].settings.extension[index].match[index].ports[index]​

ServiceSecuritySetting.spec.subsets[index].settings.waf​

SecuritySetting​

SecuritySetting.spec​

SecuritySetting.spec.authenticationSettings​

Group

Group.spec

Group.spec.configGenerationMetadata

Group.spec.namespaceSelector

ServiceSecuritySetting

ServiceSecuritySetting.spec

ServiceSecuritySetting.spec.configGenerationMetadata

ServiceSecuritySetting.spec.settings

ServiceSecuritySetting.spec.settings.authenticationSettings

ServiceSecuritySetting.spec.settings.authenticationSettings.http

ServiceSecuritySetting.spec.settings.authenticationSettings.http.jwt

ServiceSecuritySetting.spec.settings.authenticationSettings.http.jwt.fromHeaders[index]

ServiceSecuritySetting.spec.settings.authenticationSettings.http.jwt.outputClaimToHeaders[index]

ServiceSecuritySetting.spec.settings.authenticationSettings.http.oidc

ServiceSecuritySetting.spec.settings.authenticationSettings.http.oidc.provider

ServiceSecuritySetting.spec.settings.authenticationSettings.http.rules

ServiceSecuritySetting.spec.settings.authenticationSettings.http.rules.jwt[index]

ServiceSecuritySetting.spec.settings.authenticationSettings.http.rules.jwt[index].fromHeaders[index]

ServiceSecuritySetting.spec.settings.authenticationSettings.http.rules.jwt[index].outputClaimToHeaders[index]

ServiceSecuritySetting.spec.settings.authorization

ServiceSecuritySetting.spec.settings.authorization.http

ServiceSecuritySetting.spec.settings.authorization.http.external

ServiceSecuritySetting.spec.settings.authorization.http.external.tls

ServiceSecuritySetting.spec.settings.authorization.http.external.tls.files

ServiceSecuritySetting.spec.settings.authorization.http.local

ServiceSecuritySetting.spec.settings.authorization.http.local.rules[index]

ServiceSecuritySetting.spec.settings.authorization.http.local.rules[index].from[index]

ServiceSecuritySetting.spec.settings.authorization.http.local.rules[index].from[index].jwt

ServiceSecuritySetting.spec.settings.authorization.http.local.rules[index].to[index]

ServiceSecuritySetting.spec.settings.authorization.rules

ServiceSecuritySetting.spec.settings.authorization.rules.allow[index]

ServiceSecuritySetting.spec.settings.authorization.rules.allow[index].from

ServiceSecuritySetting.spec.settings.authorization.rules.allow[index].to

ServiceSecuritySetting.spec.settings.authorization.rules.deny[index]

ServiceSecuritySetting.spec.settings.authorization.rules.deny[index].from

ServiceSecuritySetting.spec.settings.authorization.rules.deny[index].to

ServiceSecuritySetting.spec.settings.configGenerationMetadata

ServiceSecuritySetting.spec.settings.extension[index]

ServiceSecuritySetting.spec.settings.extension[index].match[index]

ServiceSecuritySetting.spec.settings.extension[index].match[index].ports[index]

ServiceSecuritySetting.spec.settings.waf

ServiceSecuritySetting.spec.subsets[index]

ServiceSecuritySetting.spec.subsets[index].settings

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http.jwt

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http.jwt.fromHeaders[index]

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http.jwt.outputClaimToHeaders[index]

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http.oidc

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http.oidc.provider

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http.rules

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http.rules.jwt[index]

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http.rules.jwt[index].fromHeaders[index]

ServiceSecuritySetting.spec.subsets[index].settings.authenticationSettings.http.rules.jwt[index].outputClaimToHeaders[index]

ServiceSecuritySetting.spec.subsets[index].settings.authorization

ServiceSecuritySetting.spec.subsets[index].settings.authorization.http

ServiceSecuritySetting.spec.subsets[index].settings.authorization.http.external

ServiceSecuritySetting.spec.subsets[index].settings.authorization.http.external.tls

ServiceSecuritySetting.spec.subsets[index].settings.authorization.http.external.tls.files

ServiceSecuritySetting.spec.subsets[index].settings.authorization.http.local

ServiceSecuritySetting.spec.subsets[index].settings.authorization.http.local.rules[index]

ServiceSecuritySetting.spec.subsets[index].settings.authorization.http.local.rules[index].from[index]

ServiceSecuritySetting.spec.subsets[index].settings.authorization.http.local.rules[index].from[index].jwt

ServiceSecuritySetting.spec.subsets[index].settings.authorization.http.local.rules[index].to[index]

ServiceSecuritySetting.spec.subsets[index].settings.authorization.rules

ServiceSecuritySetting.spec.subsets[index].settings.authorization.rules.allow[index]

ServiceSecuritySetting.spec.subsets[index].settings.authorization.rules.allow[index].from

ServiceSecuritySetting.spec.subsets[index].settings.authorization.rules.allow[index].to

ServiceSecuritySetting.spec.subsets[index].settings.authorization.rules.deny[index]

ServiceSecuritySetting.spec.subsets[index].settings.authorization.rules.deny[index].from

ServiceSecuritySetting.spec.subsets[index].settings.authorization.rules.deny[index].to

ServiceSecuritySetting.spec.subsets[index].settings.configGenerationMetadata

ServiceSecuritySetting.spec.subsets[index].settings.extension[index]

ServiceSecuritySetting.spec.subsets[index].settings.extension[index].match[index]

ServiceSecuritySetting.spec.subsets[index].settings.extension[index].match[index].ports[index]

ServiceSecuritySetting.spec.subsets[index].settings.waf

SecuritySetting

SecuritySetting.spec

SecuritySetting.spec.authenticationSettings

SecuritySetting.spec.authenticationSettings.http